2 Before You Configure

2.1 Verify Your Client and Server Operating Systems

Oracle Authentication Services for Operating Systems has both server and client components. The server is the computer that runs Oracle Internet Directory. The client is a computer that uses the services of Oracle Internet Directory for authentication.

For up-to-date information about supported server and client operating systems, please consult the following documents:

• The README document accompanying this release

• Note 1064891.1: Oracle Authentication Services for Operating Systems Documentation Addendum (11.1.1.3). This document is available on My Oracle Support at https://support.oracle.com.

2.2 Install Oracle Internet Directory and Oracle Directory Integration Platform

Before you can configure Oracle Authentication Services for Operating Systems, you must install Oracle Internet Directory. If you plan to migrate entries from an existing LDAP-compliant directory, or to synchronize Oracle Internet Directory with another directory, such as Active Directory, you must install Oracle Directory Integration Platform along with Oracle Internet Directory.

2.3 Upgrade from Oracle Authentication Services for Operating Systems 10g

If you have already installed Oracle Authentication Services for Operating Systems 10g, you do not need to reconfigure your server or client machines unless you are changing some configuration features, such as ports or SSL certificate.

Upgrade to Oracle Internet Directory 11g as described in Oracle Fusion Middleware Upgrade Guide for Oracle Identity Management. Apply 11g R1 Patch Set 2 (11.1.1.3.0).

If you need to change the configuration, use the 11g scripts, as described in Chapter 3, "Configuring Oracle Authentication Services for Operating Systems."

In Oracle Internet Directory 11g Release 1 (11.1.1) and later, anonymous binds are allowed by default, but anonymous users can only perform search operations on the root DSE entry. When you upgrade, however, Oracle Internet Directory enables anonymous binds. If, for some reason, anonymous binds have been disabled, you can enable them by using the ldapmodify command, as described in the Troubleshooting section "Users Cannot Log In".

2.4 Determine Which Product Features You Will Use

Before you begin the installation, consider which features of the product you are likely to use. For basic functionality, you must run the server script on the system where you are running the Oracle Internet Directory server, then run the client script on each client. These scripts configure the server and clients for LDAP authentication. In addition to configuring basic LDAP authentication, you can choose from the following options:

• Secure Socket Layer (SSL)–Unless your server and clients are isolated from the internet, you should enable SSL. To do so, use the SSL versions of the server and client configuration scripts. The libuser tool system-config-users requires SSL when you use it with Oracle Authentication Services for Operating Systems on Red Hat or Oracle Enterprise Linux.

• Certificate and wallet to use with SSL–The SSL server configuration script can use an existing certificate or generate a self-signed certificate, which is not designed for production mode. If you plan to use an existing certificate, you must have already configured Oracle Internet Directory in SSL mode with this certificate. You can also choose to use a customized wallet instead of the default wallet.

  See Also:

  • The "Configuring Secure Sockets Layer (SSL)" chapter in Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory for information on configuring Oracle Internet Directory in SSL mode.

  • Oracle Fusion Middleware Administrator's Guide for information on Oracle wallets.

• Current authentication source to migrate from–If you are using files, NIS, or another LDAP server, you can migrate to Oracle Internet Directory.

• Whether to configure the libuser tools to use LDAP–The GUI tool system-config-users and the command-line utilities (luseradd, luserdelete, etc.) exist, by default, on Red Hat Enterprise Linux and Oracle Enterprise Linux. You can configure the libuser tools to work with LDAP, so that adding a user with luseradd, for example, adds the user entry to Oracle Internet Directory. If you do not use the libuser tools, you must use Oracle Directory Manager, Oracle Internet Directory bulk tools, or Oracle Internet Directory LDAP tools to configure entries directly in Oracle Internet Directory. If your client is Red Hat Enterprise Linux or Oracle Enterprise Linux, the client script will prompt you as to whether you want to configure libuser.

  Note:

  • To use libuser tools, you must configure your client and server for SSL.

  • If you plan to use Oracle Internet Directory to enforce password policies, you cannot use tools in the libuser package to add passwords or entries containing passwords.

  • You cannot use the non-libuser commands useradd, userdel, groupadd, or groupdel for user or group administrative tasks.

• Data to migrate–Open Source scripts such as those described in the next section support migration of users and groups and other configuration data from NIS or from files. Oracle Authentication Services for Operating Systems includes tools for migrating from a third-party LDAP directory server.

• Whether to migrate sudo–You can use Oracle Internet Directory instead of a sudoers configuration file to authenticate sudo commands.

• How to enforce password policies–You can continue to use the operating system for password enforcement. Alternatively, you can use Oracle Internet Directory for centralized password policies.

• Whether to integrate with Active Directory–You can use credentials stored in Active Directory for user authentication on Linux or UNIX-based operating systems.

2.5 Get NIS Migration Tools

If you have user, group, and other entries maintained in the local file system or in NIS/NIS+, you can move to LDAP as your storage mechanism for these entries. There are tools available to extract the existing information and produce output files in the LDAP Data Interchange Format (LDIF). Once you have your information in LDIF files, you can use the ldapadd tool to load the information into Oracle Internet Directory.

2.6 Download SUDO Package

If you want to migrate the contents of the sudoers file to LDAP, you must run a migration script and build sudo with LDAP enabled. You can obtain the sudo package from:

http://www.gratisoft.us/sudo

2.7 Create and Index New Custom Attributes (Optional)

You cannot successfully search for an attribute in Oracle Internet Directory unless the attribute is indexed. If you plan to add custom attributes, you can index them at the time you create them by using Oracle Directory Manager. You can also use ldapmodify to create an indexed attribute. You would use an LDIF file such as this:

dn: cn=catalogs
changetype: modify
add: orclindexedattribute
orclindexedattribute: attribute_name

Alternatively, you can index attributes after they have been created in Oracle Internet Directory by using catalog, as explained in "Using Custom Attributes in Oracle Internet Directory".

Function not implemented. DSA unwilling to perform.

2.8 Platform-Specific Tasks

The following pre-installation tasks are platform-specific.