Use of external LDAP server in Weblogic Commerce Server

I'm using the following software:
Iplanet Directory Server v5
Weblogic Application Server v6
Weblogic Commerce v3.5
I need to configure Weblogic Commerce Server to use Iplanet Directory Server directory
services. How do I do that?
I have a couple of questions related to this:
1) As Weblogic Commerce Server runs on top of Weblogic v6, does it mean that to
use an external LDAP server, I need to configure weblogic v6 to do that and not
Weblogic Commerce Server?
2) Whatever may be the case above, how do I do that?
3) config.xml (weblogic application server v6) contains information that needs
to be modified to point to an external JNDI source provider but what information
do I need to modify?
I'd really appreciate if someone can help me out here. Thanks!

"JP" <[email protected]> wrote in message news:[email protected]..
Hi,
I'm looking for someone who has used the Lotus LDAP server for WLP7
authentication.
I connect my portal to the Domino LDAP, User and Groups are working
fine, but the membership of a user to a group is not.
I assume that it's related to the parameters I use (especially the
membership.filter ?):
"user.filter=(&(uid=%u)(objectclass=person));
user.dn=O=Apac;
membership.filter=(&(uniquemember=%M)(objectclass=groupOfNames));
group.filter=(&(cn=%g)(objectclass=groupOfNames));
server.host=jpgal01.apac.bea.com;
group.dn="
Any help would be appreciate, because I just don't where to look for.
Try setting the com.netscape.ldap.trace property.
\* When -D command line option is used, defining the property with
* no value will send the trace output to the standard error. If the
* value is defined, it is assumed to be the name of an output file.
* If the file name is prefixed with a '+' character, the file is
* opened in append mode.
This will create a ldap trace file of the requests that WLS is making on the
LDAP server. You can then see
where the filters are not returning the correct value for the group
membership.

Similar Messages

  • Using external LDAP server for  WL JNDI lookups

    I'm trying to find out if it is possible to re-direct JNDI calls to the WL
    server to an external LDAP server. I know you can install an external LDAP
    server for security purposes, but I would like to use an external LDAP
    server to handle all JNDI lookups (like for JNDI EJB name location, etc.).
    Is this possible?

    You typically need to use our JNDI store. We strongly recommend this for
    performance reasons..
    You can use the JNDI To LDAP bridge which is available from the sun web
    site.
    Michael Girdley
    BEA Systems Inc
    "Jack Archer" <[email protected]> wrote in message
    news:[email protected]..
    I'm trying to find out if it is possible to re-direct JNDI calls to the WL
    server to an external LDAP server. I know you can install an external LDAP
    server for security purposes, but I would like to use an external LDAP
    server to handle all JNDI lookups (like for JNDI EJB name location, etc.).
    Is this possible?

  • How to access an External LDAP on a weblogic server using OPSS APIs.

    Hi,
    Can anyone let me know how I can access an External LDAP configured on a weblogic server using OPSS APIs( or alternative APIs).
    I'm currently using the below snippet and I'm getting only the Users and groups from the DefaultAutheticator on the weblogic server and not the external LDAP Server.
    I've verified the providers, users and groups on the weblogic server console and can see that external LDAP server content is being picked, but my below code does not query them.
    import oracle.security.idm.IMException;
    import oracle.security.idm.IdentityStore;
    import oracle.security.idm.Role;
    import oracle.security.jps.JpsContext;
    import oracle.security.jps.JpsContextFactory;
    import oracle.security.jps.JpsException;
    import oracle.security.jps.service.idstore.IdentityStoreService;
    List<Role> rowData = null;
    JpsContextFactory ctxf = JpsContextFactory.getContextFactory();
    JpsContext ctx = ctxf.getContext();
    IdentityStoreService storeService = ctx.getServiceInstance(IdentityStoreService.class);
    IdentityStore idStore = storeService.getIdmStore();
    rowData = this.getRoles(idStore, "*");
    Any help or pointers are highly appreciated.
    Thanks,
    Bhasker

    Can anyone please provide any suggestions. I trying to google around but still not able to find any solution.
    Thanks,
    Bhasker

  • External LDAP Server

    Hello.
    Is it possible to configure WebLogic to use external LDAP server, which in turn is "built in" in other WebLogic (at other physical machine)?
    And if it is possible, can I use OracleInternetDirectoryAuthenticator provider for this?
    (sorry for my english)

    Hi
    OID is all together a different LDAP provider.
    You can try to create a Authenticator of type LDAPAuthenticator and accordingly provide the configurations.
    Check the below note.
    http://docs.oracle.com/cd/E17904_01/web.1111/e13707/atn.htm#i1199007

  • Usage of external LDAP server with Portal

    Hi All,
    We are in a situation to use external LDAP server with WLP 8.1. These are the
    constraints we have to deal with:
    1. Only read is allowed from this LDAP server.
    2. This would be used for authentication purpose
    If thats the case, how can we use Visitor Entitlements/Delegated Admin and Group
    creation using Portal Admin tool since this will write to the configured LDAP
    server.
    Can somebody answer my question:
    1. Can we use external LDAP server - just for authetication (I know this is possible
    by using JAAS LoginModule, but I just want to get confirmed on this ) and
    2. Use default and embedded LDAP server for all others like Group/Visitor Entitlements/DAs.
    Any relevant pointers are also welcome.
    TIA,
    Prashanth Bhat.

    Thanks for th ereply. Some of your answers are not clear. Can you pls eloborate
    on this?? Pls see my comments below.
    "Johnson" <[email protected]> wrote:
    >
    Phil,
    Can I use embedded LDAP for production?
    Thanks
    Lawrence
    "Phil Griffin" <BEA> wrote:
    "Prashanth " <[email protected]> wrote in message
    news:[email protected]..
    Hi All,
    We are in a situation to use external LDAP server with WLP 8.1. Theseare
    the
    constraints we have to deal with:
    1. Only read is allowed from this LDAP server.
    2. This would be used for authentication purpose
    If thats the case, how can we use Visitor Entitlements/Delegated Adminand
    Group
    creation using Portal Admin tool since this will write to the configuredLDAP
    server.
    Can somebody answer my question:
    1. Can we use external LDAP server - just for authetication (I knowthis
    is possible
    by using JAAS LoginModule, but I just want to get confirmed on this) and
    >
    You can add the external LDAP server just for authentication, but in
    versions through
    8.1 SP2 WLP will want to verify the user exists (via the UserReaderMBean)
    during
    the login process (this check has been removed in SP3). A work around
    is to
    duplicate
    the user in a provider that does impl UserReaderMBean.
    Prashanth : You mean to say we have to duplicate the User in embedded LDAP server
    also??
    >>
    2. Use default and embedded LDAP server for all others like Group/VisitorEntitlements/DAs.
    >
    Yes, the default/embedded LDAP can still be used for DA/visitor
    entitlements. In the current
    release, the Portal Admin Tools can only be configured to use a single
    authentication provider
    while forming entitlements. In SP3, all configured providers are
    listed/usable by the tools.Prashanth : How can we configure Portal Admin tool to use authentication provider
    for entitlements??
    >>
    Any relevant pointers are also welcome.
    TIA,
    Prashanth Bhat.

  • Can I use your Embeded LDAP Server?

    Hi,
    WebLogic Server 7.0 and 8.1 comes with an embedded LDAP Server?
    I have an application that requires iPlanet Directory Server for 7000 entries.
    Can I use the embedded LDAP Server to put my own entries and use it?
    Regards,
    Shanmugavel R P

    Are these videos on mozilla.org somewhere? Please see the last section of the following page, on "Site Licensing": http://www.mozilla.org/about/legal.html

  • Use of Lotus LDAP server for WLP 7 - LDAP experts ?

    Hi,
    I'm looking for someone who has used the Lotus LDAP server for WLP7
    authentication.
    I connect my portal to the Domino LDAP, User and Groups are working
    fine, but the membership of a user to a group is not.
    I assume that it's related to the parameters I use (especially the
    membership.filter ?):
    "user.filter=(&(uid=%u)(objectclass=person));
    user.dn=O=Apac;
    membership.filter=(&(uniquemember=%M)(objectclass=groupOfNames));
    group.filter=(&(cn=%g)(objectclass=groupOfNames));
    server.host=jpgal01.apac.bea.com;
    group.dn="
    Any help would be appreciate, because I just don't where to look for.
    JP

    "JP" <[email protected]> wrote in message news:[email protected]..
    Hi,
    I'm looking for someone who has used the Lotus LDAP server for WLP7
    authentication.
    I connect my portal to the Domino LDAP, User and Groups are working
    fine, but the membership of a user to a group is not.
    I assume that it's related to the parameters I use (especially the
    membership.filter ?):
    "user.filter=(&(uid=%u)(objectclass=person));
    user.dn=O=Apac;
    membership.filter=(&(uniquemember=%M)(objectclass=groupOfNames));
    group.filter=(&(cn=%g)(objectclass=groupOfNames));
    server.host=jpgal01.apac.bea.com;
    group.dn="
    Any help would be appreciate, because I just don't where to look for.
    Try setting the com.netscape.ldap.trace property.
    \* When -D command line option is used, defining the property with
    * no value will send the trace output to the standard error. If the
    * value is defined, it is assumed to be the name of an output file.
    * If the file name is prefixed with a '+' character, the file is
    * opened in append mode.
    This will create a ldap trace file of the requests that WLS is making on the
    LDAP server. You can then see
    where the filters are not returning the correct value for the group
    membership.

  • Use of Lotus LDAP server for WLP 7 - LDAP experts required

    Hi,
    I'm looking for someone who has used the Lotus LDAP server for WLP7
    authentication.
    User and Groups are working fine, the membership of a user to a group is
    not.
    I assume that it's related to the parameters I use (especially the
    membership.filter ?):
    user.filter=(&(uid=%u)(objectclass=person));
    user.dn=O=Apac;
    membership.filter=(&(uniquemember=%M)(objectclass=groupOfNames));
    group.filter=(&(cn=%g)(objectclass=groupOfNames));
    server.host=jpgal01.apac.bea.com;
    group.dn=
    I know that this LDAP server supported, but id it could work at least
    for some time, that would be great !
    thanks for your help,
    JP

    "JP" <[email protected]> wrote in message news:[email protected]..
    Hi,
    I'm looking for someone who has used the Lotus LDAP server for WLP7
    authentication.
    I connect my portal to the Domino LDAP, User and Groups are working
    fine, but the membership of a user to a group is not.
    I assume that it's related to the parameters I use (especially the
    membership.filter ?):
    "user.filter=(&(uid=%u)(objectclass=person));
    user.dn=O=Apac;
    membership.filter=(&(uniquemember=%M)(objectclass=groupOfNames));
    group.filter=(&(cn=%g)(objectclass=groupOfNames));
    server.host=jpgal01.apac.bea.com;
    group.dn="
    Any help would be appreciate, because I just don't where to look for.
    Try setting the com.netscape.ldap.trace property.
    \* When -D command line option is used, defining the property with
    * no value will send the trace output to the standard error. If the
    * value is defined, it is assumed to be the name of an output file.
    * If the file name is prefixed with a '+' character, the file is
    * opened in append mode.
    This will create a ldap trace file of the requests that WLS is making on the
    LDAP server. You can then see
    where the filters are not returning the correct value for the group
    membership.

  • Use of secondary LDAP server

    Is it possible to configure BEA to automatically switch to alternate
    secondary LDAP server in case of failing connection to primary?
    Arne

    "JP" <[email protected]> wrote in message news:[email protected]..
    Hi,
    I'm looking for someone who has used the Lotus LDAP server for WLP7
    authentication.
    I connect my portal to the Domino LDAP, User and Groups are working
    fine, but the membership of a user to a group is not.
    I assume that it's related to the parameters I use (especially the
    membership.filter ?):
    "user.filter=(&(uid=%u)(objectclass=person));
    user.dn=O=Apac;
    membership.filter=(&(uniquemember=%M)(objectclass=groupOfNames));
    group.filter=(&(cn=%g)(objectclass=groupOfNames));
    server.host=jpgal01.apac.bea.com;
    group.dn="
    Any help would be appreciate, because I just don't where to look for.
    Try setting the com.netscape.ldap.trace property.
    \* When -D command line option is used, defining the property with
    * no value will send the trace output to the standard error. If the
    * value is defined, it is assumed to be the name of an output file.
    * If the file name is prefixed with a '+' character, the file is
    * opened in append mode.
    This will create a ldap trace file of the requests that WLS is making on the
    LDAP server. You can then see
    where the filters are not returning the correct value for the group
    membership.

  • How do I configure version 3.0.6.6.5  to use an external LDAP?

    We're running an old version of the Portal (3.0.6.6.5) and we want to use an external ldap running on another box.
    Is it possible?
    How do I do it?

    No sorry as those portable builds are for Windows only.
    If you want Firefox 3.6.18 then see http://www.mozilla.com/en-US/firefox/all-older.html
    You could also try fooling the site in thinking you are using Firefox 3.6.18 by using this Extension. https://addons.mozilla.org/en-US/firefox/addon/user-agent-switcher/

  • How to configure Ironport to Use an external Encrpytion server

    Hi,
    We would like to use an external encryption server to encrypt our emails.
    The Ironport would still be the MX for our domain, and the encryption server would be in the same DMZ as the Ironport.
    Here is the setup we would like to implement:
    Incoming emails:
    - Ironport check the connexion (senderbase)
    - If encrypted (how to detect the mail as encrypted) the mail is not scan AV / SPAM
         - the is it goes to the decryption server
        - then back to Ironport to scan AV/spam
        - then goes to exchange
    - If not encrypted the email is scanned AV/Spam
        - then goes to Exchange for delivery
    Outgoing emails:
    - Exchange to Ironport
    - Scan AV/Spam
    - If needs to be encrypted (with header detected)
         - then goes to encryption server
        - then back to ironport (no scan AV/Spam ) and delivery to Internet
    -If does not need to be encrypted
          - then send to Internet
    Is it possible to configure the Ironport to get this behaviour? and how? I still facing problems with the different flows....
    Any idea would be very helpfull
    Regards
    RD

    For incomig mails you can create a message filter like the following one:
    route_pgp_smime_encrypted_data:
    if (recv-listener == "your listener") AND (encrypted) AND (remote-ip != "IP of your encryption gw")
    alt-mailhost ("IP of your encryption gw");
    Greets
    Jörg

  • External LDAP - Configuring the External LDAP to the Weblogic Server 10.3.3

    I m new to LDAP concepts. Is there any documentation link to configure any of the External LDAP for WLS 10.3.3?
    Where can I download to install the Extarnal LDAP?
    Thanks

    To use Active Directory for quick testing with Weblogic, you can use either Suns Sun One Active Directory Server or OpenLDAP which is an open source LDAP. We use OpenLDAP on unix and configure this with WLS. All our users are in OpenLDAP. Try googling around like "OpenLDAP Download" or "Sun One Directory Server" etc. All these are LDAP sources with very minor differences (Some extra attributes here and there). Configuration wise all are same from WLS point of view. We define LDAPs Host, Port, admin useranme/password, User basedn and Group basedn. These are minimum things we need to know upfront.
    Thanks
    Ravi Jegga

  • Authentication problem by external ldap server for WLS 7.0

    Hi all,
    I have configured iPlanet directory Server to serve as authentication security
    provider for WLS 7.0.While doing so I have created a Test security realm and made
    it as default.I have also configured the other default settings for the remaining
    security providers for the realm.
    Now, while I start the WLS with the default username and password, boot-error
    comes as given below. As a matter of fact I have also created groups with relevant
    username and pwd in the ldap server as specified bu the Bea documentation.
    I have tried to remove the problem since last 4 days but all in fiasco.
    If anybody has any pointer to the problem - it will be a great help.
    The error :
    * To start WebLogic Server, use a username and *
    * password assigned to an admin-level user. For *
    * server administration, use the WebLogic Server *
    * console at http://[hostname]:[port]/console *
    D:\bea\weblogic700\samples\server\config\petstore>"D:\bea\jdk131_03\bin\java"
    -h
    otspot -Xms32m -Xmx200m -Dpet.mode= - Dweblogic.management.discover=false -Dweblo
    gic.Name=petstoreServer -Dbea.home="D:\bea" -Dweblogic.management.username=weblo
    gic -Dweblogic.management.password=weblogic -Dweblogic.ProductionModeEnabled=tru
    e -Djava.security.manager -Djava.security.policy=="D:\bea\weblogic700\server\lib
    \weblogic.policy" weblogic.Server
    Starting WebLogic Server...
    <Nov 19, 2002 10:08:04 AM IST> <Notice> <Management> <140005> <Loading configura
    tion D:\bea\weblogic700\samples\server\config\petstore\.\config.xml>
    <Nov 19, 2002 10:08:21 AM IST> <Notice> <Security> <090082> <Security initializi
    ng using realm RitTestRealm.>
    <Nov 19, 2002 10:08:22 AM IST> <Critical> <WebLogicServer> <000364> <Server fail
    ed during initialization. Exception:java.lang.SecurityException: User weblogic
    i
    s not permitted to boot the server
    java.lang.SecurityException: User weblogic is not permitted to boot the server
    at weblogic.security.service.SecurityServiceManager.doBootAuthorization(
    SecurityServiceManager.java:1076)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityS
    erviceManager.java:1116)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)
    >
    Regards,
    Ritwik

    Thanks Vijay - it has worked by creating the Administrator group in LDAP but Weblogic
    documentation also states the creation of any group in Ldap server with the boot
    username and pwd and then adding the group in the admin role of WLS7.0 - but this
    did not work.
    If there is any info regarding the same - pl. do let me know
    Regards,
    Ritwik
    "Vijay" <[email protected]> wrote:
    >
    Ritwik,
    I think WebLogic 7 requires a group called "Administrators" in the LDAP
    server
    and requires an user to be added to that group. I have this working in
    one of
    my projects. The group really doesnt need to be an LDAP administrative
    group.
    Can you provide any additional information. I might be able to help since
    I got
    this working only a coupla days back.
    Vijay
    "Ritwik Batabyal" <[email protected]> wrote:
    Hi all,
    I have configured iPlanet directory Server to serve as authentication
    security
    provider for WLS 7.0.While doing so I have created a Test security realm
    and made
    it as default.I have also configured the other default settings forthe
    remaining
    security providers for the realm.
    Now, while I start the WLS with the default username and password, boot-error
    comes as given below. As a matter of fact I have also created groups
    with relevant
    username and pwd in the ldap server as specified bu the Bea documentation.
    I have tried to remove the problem since last 4 days but all in fiasco.
    If anybody has any pointer to the problem - it will be a great help.
    The error :
    * To start WebLogic Server, use a username and *
    * password assigned to an admin-level user. For *
    * server administration, use the WebLogic Server *
    * console at http://[hostname]:[port]/console *
    D:\bea\weblogic700\samples\server\config\petstore>"D:\bea\jdk131_03\bin\java"
    -h
    otspot -Xms32m -Xmx200m -Dpet.mode= - Dweblogic.management.discover=false
    -Dweblo
    gic.Name=petstoreServer -Dbea.home="D:\bea" -Dweblogic.management.username=weblo
    gic -Dweblogic.management.password=weblogic -Dweblogic.ProductionModeEnabled=tru
    e -Djava.security.manager -Djava.security.policy=="D:\bea\weblogic700\server\lib
    \weblogic.policy" weblogic.Server
    Starting WebLogic Server...
    <Nov 19, 2002 10:08:04 AM IST> <Notice> <Management> <140005> <Loading
    configura
    tion D:\bea\weblogic700\samples\server\config\petstore\.\config.xml>
    <Nov 19, 2002 10:08:21 AM IST> <Notice> <Security> <090082> <Security
    initializi
    ng using realm RitTestRealm.>
    <Nov 19, 2002 10:08:22 AM IST> <Critical> <WebLogicServer> <000364><Server
    fail
    ed during initialization. Exception:java.lang.SecurityException: User
    weblogic
    i
    s not permitted to boot the server
    java.lang.SecurityException: User weblogic is not permitted to bootthe
    server
    at weblogic.security.service.SecurityServiceManager.doBootAuthorization(
    SecurityServiceManager.java:1076)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityS
    erviceManager.java:1116)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:703)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:588)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:276)
    at weblogic.Server.main(Server.java:31)
    >
    Regards,
    Ritwik

  • JAZN-LDAP: Make use of different LDAP Server

    Hi,
    I am trying to make use of a different LDAP Server (other than OID)-- With OID i am able to authenticate users.
    Now i need to make use of a different LDAP Server (For ex: SunONe Directory Server).. I have tried specifying the LDAP URL location of the new LDAP Server in the Orion-Application.xml as below
    <jazn provider="LDAP" location="ldap://ldaphost:ldapport" />
    But I see that the application is still defaulting to the OID and not making use of the LDAPserver specified above.
    Also, i see that I am unable to modify the LDAP URL Location
    In Step2 of Deploying an Application :
    Deploy Application: User Manager : I have selected the option "Use JAZN LDAP User Manager"
    But the LDAP Location is non-editable and which defaults to the OID location as the one below
    LDAP Location ldap://OIDLDAPURL:PORT
    Could ne1 throw some light on the issue i am facing..
    Thanks
    John

    See Configuring External LDAP Providers @:
    http://matrix.csustan.edu/docs/oracle/oas/web.1012/b14013/ldap3rdparty.htm
    Here are a few gotchas for active directory:
    -if you plan to use the membership of the AD user to AD roles, set in orion-application:
    <jazn provider="XML">
    <property name="custom.ldap.provider" value="true"/>
    <property name="role.mapping.dynamic" value="true"/>
    </jazn>
    in web.xml you should also define
    <security-role>
    <role-name>ldap-role-to-which-ldap-user-belongs-that-is-entitled to-acces-the-resource</role-name>
    </security-role>
    If you run the application in the embedded OC4J it seems it takes this hint from other file that you can determine looking at trace you can make appear with option:
    -Djazn.debug.log.enable=true (in jvm start command)
    When running in embedded OC4J the application is called: current-workspace-app
    Good Luck

  • Confuguration of DMS using an external content server and KPRO

    Hello all,
    I am working in a new EH&S SAP environnement.
    The aim is to configure a DMS to link EH&S with an external content server Documentum using Kpro.
    I have done the following IMG activities:
    - Specify Content Servers (Tcode: OAC0)
    - Maintain Categories (Tcode: OACT)
    - Specify links
    - Specify Data Carriers
    - Define document types
    - Assign EH&S Document Types to Data Carriers
    But i am facing to the following problems:
    - CG36VEN: error: "could not create report for specification XX, variant XX and lang. EN.
    - CG34: error: cannot display document MSDS
    - CG4B: error: cannot display document TEST
    Are there other actions to be done in the IMG activities?
    Any idea to help me please?

    More details:
    I am working in a new EH&S SAP environnement.
    I have installed a new DMS link witn an external documentum content server and he is working fine.
    My aim is to configure EH&S to link SAP EH&S with my DMS.
    Actually my connexion between EH&S and DMS is not working.
    Can you tell me what are actions to be done to link EH&S to my DMS.
    Thanks,
    Ludovic Roux

Maybe you are looking for

  • Issue in starting the server

    Hi All, I wanted to enable Global trust or Cross domain trust between the two domain. To achieve this I executed the following steps: 1. In the left pane, click the name of the domain. 2. Select Security > General. Scroll down and click Advanced. 3.

  • [JS CS3] Problem with EventListener

    Hello, I am having a problem passing information from two functions to a third when those functions are invoked by an eventListener. Below is the code, very simplified. The first function will get the last word of each text frame at the moment the fi

  • How to restrict the user input textfield to an Integer?

    Hello there; Here is my problem, and i need your help. I have a mssql 2005 server as my back end database; I have designed a web application from which i can load a specific table in my database. One of my table column is of integer type and i want t

  • Flash size in browser window

    I set fla properties size to 1000px by 800px , In publish preview page looks fine but after uploaded to ftp and linked to it opens at about three quarters of fla size, http://islamujeres.ws/flash/islabonito.swf I tried 100 percent in publish settings

  • Spare parts palnning

    HI i have gone through the implementation pahse ihave to give solution for spare part palnning prsently my client does with hod based on their experience and previous year calculation and minimum stock level,safety level etc. how to do in sap what is