8 Configuring Oracle Internet Directory for Oracle Application Server Installation Privileges

8.1 Default Users in Oracle Internet Directory

When you install Oracle Internet Directory, it has two users: cn=orcladmin and orcladmin:

• cn=orcladmin is the Oracle Internet Directory superuser. This user has all the privileges to perform all tasks in Oracle Internet Directory.

  The initial password for cn=orcladmin is the same as the password for the ias_admin user for the Oracle Application Server instance. You specified this password during installation.

  cn=orcladmin is the owner of the objects created in the same installation session. For example, if you installed Oracle Internet Directory, OracleAS Metadata Repository, and Oracle Delegated Administration Services, the cn=orcladmin user is created and becomes a member of the Repository Owners group and the DAS Component Owners group. cn=orcladmin also becomes a member of the iAS Admins group.

  Note that you cannot log in to Oracle Internet Directory as the superuser (cn=orcladmin) using Oracle Delegated Administration Services. To log in as cn=orcladmin, you must use the Oracle Directory Manager.

• The orcladmin user is also created when you install Oracle Internet Directory. The DN for this user is: cn=orcladmin,cn=users,<default realm DN>.

  The initial password for orcladmin is the same as the password for the ias_admin user for the Oracle Application Server instance. You specified this password during installation.

  You can log in to Oracle Internet Directory as orcladmin using Oracle Delegated Administration Services to manage other Oracle Internet Directory users. You can do this because orcladmin is a valid OracleAS Single Sign-On user.

8.2 Groups in Oracle Internet Directory

Groups in Oracle Internet Directory can be classified into these categories:

• Section 8.2.1, ""Global" Groups"

• Section 8.2.2, "Groups for Each Metadata Repository"

• Section 8.2.3, "Groups for Each Component"

8.3 Groups Required to Install Components

Table 8-4 shows the groups that a user needs to belong to in order to install Oracle Application Server components.

The user who installs the components becomes the owner of the components.

1. Run the following command (all on one line):

   prompt> $ORACLE_HOME/bin/ldapsearch -h oidhostname -p oidport -D cn=orcladmin -w password
    -b "orclapplicationcommonname=orasso_ssoserver,cn=sso,cn=products,
         cn=oraclecontext"
    -s base "objectclass=*" seealso
   
   

   Values you need to provide:

   oidhostname - name of the computer running Oracle Internet Directory. Example: dbmachine.mydomain.com.

   oidport - port number on which Oracle Internet Directory is listening. Example: 389.

   passwd - password for the cn=orcladmin user.

2. If the command in the preceding step does not return the name of the metadata repository, then run the following commands:

   1. Run this command first to get the "orclreplicaid" value, which you need for the second command.

      prompt> $ORACLE_HOME/bin/ldapsearch -h oidhostname -p oidport -D cn=orcladmin -w password
       -b "" -s base "objectclass=*" orclreplicaid
      
      

   2. Then run this command.

      prompt> $ORACLE_HOME/bin/ldapsearch -h oidhostname -p oidport -D cn=orcladmin -w password
       -b "orclreplicaid=value_from_previous_command,cn=replication configuration"
       -s base "objectclass=*" seealso
      
      

      This returns a "seealso" value in the format: cn=Metadata repository DB Name,cn=oraclecontext.

8.4 Groups Required to Install Middle Tiers

When you install middle tiers, the installer prompts you to log in to Oracle Internet Directory. Log in as a user who is a member of these groups:

• Section 8.4.1, "Groups Required to Install Against the Desired Metadata Repository"

• Section 8.4.2, "Groups Required to Install Middle Tier Components"

8.4.3 Example

Figure 8-1 shows an Oracle Internet Directory with one metadata repository and one middle tier instance. userA can install middle tiers against the asdb metadata repository because userA belongs to the Mid-Tier Admins and the IAS Admins groups. userA can also install middle tier components because userA belongs to the Trusted Application Admins group, the IAS & User Management Application Admins group, and the Component Owners group for Wireless.

Figure 8-1 Contents of Oracle Internet Directory with One Infrastructure and One Middle Tier

Description of the illustration oid_infra_mt.gif

8.5 Groups Required to Install Additional Metadata Repositories

To install additional metadata repositories, a user must be a member of the IAS Admins group. After installation, the user then becomes a member of the Repository Owners group for that metadata repository.

8.6 Example of Installation with Different Users

Figure 8-2 shows an Oracle Internet Directory with two metadata repositories and two middle tiers installed by different users.

Figure 8-2 Oracle Internet Directory with Two Metadata Repositories and Two Middle Tiers

Description of the illustration oid_infra2.gif

The numbers in the figure correspond to these steps:

This first installation creates an Oracle Internet Directory and a metadata repository.

The installer registers the metadata repository with Oracle Internet Directory by creating the "asdb.oracle.com" entry.

The orcladmin user becomes a member of the Repository Owners group and the Mid-Tier Admins group for this repository.

userA was added to the following groups:

• Mid-Tier Admins group of "asdb.oracle.com"

  This enables userA to use the "asdb.oracle.com" repository for this middle tier. Note that this group is required only if you install the J2EE and Web Cache middle tier with the OracleAS Database-Based Cluster option. If you install the middle tier without this option, userA does not need to belong to this Mid-Tier Admins group.

• iAS Admins group

The installer registers this middle tier with Oracle Internet Directory by creating the "J2EE" entry. (The "J2EE" is the name of the middle tier instance, specified by userA.)

The middle tier becomes a member of the Associated Mid-Tiers group for "asdb.oracle.com".

userB was added to the iAS Admins group so that userB can perform this installation. See Section 8.5, "Groups Required to Install Additional Metadata Repositories".

The installer registers this new repository with Oracle Internet Directory by creating the "asdb1.oracle.com" entry.

userB becomes a member of the Repository Owners group and the Mid-Tier Admins group for the new repository.

userB was added to these groups:

• Mid-Tier Admins group of "asdb1.oracle.com", so that userB can use the repository for this middle tier

• Trusted Application Admins, required for installing OracleAS Portal

• IAS and User Management Application Admins, required for installing OracleAS Portal and OracleAS Wireless

• iAS Admins, required for installing OracleAS Portal and OracleAS Wireless

The installer registers this middle tier with Oracle Internet Directory by creating the "PW1" entry.

The middle tier becomes a member of the Associated Mid-Tiers group for "asdb1.oracle.com".

8.7 How to Create Users in Oracle Internet Directory

You can create users in Oracle Internet Directory using the Self-Service Console, which is part of the Oracle Delegated Administration Services. See the Oracle Internet Directory Administrator's Guide for details.

8.8 How to Add Users to Groups in Oracle Internet Directory

To add users to groups in Oracle Internet Directory, you can use these tools:

• Oracle Directory Manager is a Java-based tool for managing Oracle Internet Directory.

• Oracle Delegated Administration Services is a Web-based tool intended for end-users to perform tasks such as changing their passwords and editing their personal information. If users have the proper privileges, they can also use this tool to create groups and users.

  
  

  Note: You cannot log in to Oracle Internet Directory as the cn=orcladmin superuser using Oracle Delegated Administration Services. In cases where you have to log in as the superuser to add users to groups (or to perform other Oracle Internet Directory-related tasks), you have to use Oracle Directory Manager.

  
  

8.8.1 Using Oracle Directory Manager to Add Users to Groups

When you have to log in as the cn=orcladmin superuser to add users to groups, you have to use Oracle Directory Manager, instead of Oracle Delegated Administration Services.

To add users using Oracle Directory Manager:

1. Start up Oracle Directory Manager. ORACLE_HOME refers to the home directory where Oracle Internet Directory is installed.

   prompt> cd $ORACLE_HOME/bin
   prompt> ./oidadmin
   
   

2. In the Oracle Directory Manager Connect screen, enter the connect information for Oracle Internet Directory:

   • User: Enter cn=orcladmin.

   • Password: Enter the password for cn=orcladmin.

   • Server and Port: Click the icon at the right of the field to enter the name of the computer running Oracle Internet Directory and the port number on which Oracle Internet Directory is listening.

   • Click Login.

3. On the left side, navigate to the group to which you want to add users. Select the group on the left side to display its attributes on the right side.

   To navigate to "global" groups, see Section 8.8.1.1, "Navigating to "Global" Groups".

   To navigate to metadata repository groups, see Section 8.8.1.2, "Navigating to Metadata Repository Groups".

   To navigate to component groups, see Section 8.8.1.3, "Navigating to Component Groups".

4. Add new users to the group by adding the DNs of the users to the uniquemember attribute.

8.8.1.1 Navigating to "Global" Groups

The "global" groups are listed in Table 8-1.

The general navigation path is as follows. See Figure 8-3 for a screenshot.

1. Expand the top-level entry, "Oracle Internet Directory Servers".

2. Expand the specific Oracle Internet Directory.

3. Expand "Entry Management".

4. Expand "cn=OracleContext".

5. Expand "cn=Groups".

6. Click the group to which you want to add users. Figure 8-3 shows Oracle Directory Manager with the iASAdmins group selected.

Figure 8-3 Using Oracle Directory Manager to Add Users to "Global" Groups

Description of the illustration odm_iasadmins.jpg

8.8.1.2 Navigating to Metadata Repository Groups

The metadata repository groups are listed in Table 8-2.

The general navigation path is as follows. See Figure 8-4 for a screenshot.

1. Expand the top-level entry, "Oracle Internet Directory Servers".

2. Expand the specific Oracle Internet Directory.

3. Expand "Entry Management".

4. Expand "cn=OracleContext".

5. Expand "cn=Products".

6. Expand "cn=IAS".

7. Expand "cn=IAS Infrastructure Databases".

8. Expand "orclReferenceName=dbName", where dbName is the name of the metadata repository database.

9. Click the group to which you want to add users. Figure 8-4 shows Oracle Directory Manager with the Repository Owners group for the asdb.us.oracle.com database selected.

Figure 8-4 Using Oracle Directory Manager to Add Users to Metadata Repository Groups

Description of the illustration odm_rep_owner.jpg

8.8.1.3 Navigating to Component Groups

The component groups are listed in Table 8-3.

The general navigation path is as follows. See Figure 8-5 for a screenshot.

1. Expand the top-level entry, "Oracle Internet Directory Servers".

2. Expand the specific Oracle Internet Directory.

3. Expand "Entry Management".

4. Expand "cn=OracleContext".

5. Expand "cn=Products".

6. Expand the particular component (for example, "cn=DAS" or "cn=Forms") whose groups you want to add users to.

7. Expand "orclApplicationCommonName=appName", where appName is specific to the component and application server instance. If you have installed multiple instances of a component, you would see multiple instances of this entry.

8. Click the group to which you want to add users. Figure 8-5 shows Oracle Directory Manager with the Component Owners group for Oracle Delegated Administration Services (DAS) selected.

Figure 8-5 Using Oracle Directory Manager to Add Users to the Component Users Group for the Oracle Delegated Administration Services Component

Description of the illustration odm_das.jpg

8.9 Contents of a New Oracle Internet Directory

When you install OracleAS Infrastructure 10g with Oracle Internet Directory, OracleAS Metadata Repository, and Oracle Delegated Administration Services, the Oracle Internet Directory contains the following objects (Figure 8-6):

• "Global" groups as listed in Table 8-1

• The cn=orcladmin superuser

• The orcladmin user belonging to the default realm

• An entry for the metadata repository registered with the Oracle Internet Directory. This metadata repository is associated with the groups listed in Table 8-2. The cn=orcladmin superuser is a member of the Repository Owners group.

• An application entity entry for the Oracle Delegated Administration Services component. This component is associated with the groups listed in Table 8-3. The cn=orcladmin superuser is a member of the Component Owners group.

  To enable other users to install additional instances of Oracle Delegated Administration Services, log in as cn=orcladmin in Oracle Directory Manager and add the users to the Component Owners group. See Section 8.8.1, "Using Oracle Directory Manager to Add Users to Groups".

Figure 8-6 Contents of a New Oracle Internet Directory

Description of the illustration oid_initial.gif

8.10 On the Specify Login for Oracle Internet Directory Screen, What Username and Realm Do I Enter?

The installer displays the Specify Login for Oracle Internet Directory screen:

• when you are installing OracleAS Infrastructure 10g and you are using an existing Oracle Internet Directory

• when you are installing a middle tier that requires an infrastructure.

This screen prompts you to enter a username and password to log in to Oracle Internet Directory.

In the Username field, enter either the simple username or the user’s DN.

Simple username example: jdoe

DN example: cn=orcladmin

The user must belong to specific groups for installing and configuring certain components. See Table 8-4 for details.

If you want to specify the superuser, enter cn=orcladmin, not just orcladmin.

The Realm field appears only if your Oracle Internet Directory contains more than one realm. The username that you enter is authenticated against the specified realm. If you are unsure what the realm name is, contact your Oracle Internet Directory administrator.

Example 1: in a hosted deployment, the realm name could be similar to the name of the hosted company: XYZCorp.

Example 2: within an enterprise, you could have separate realms for internal users and external users. The realm name for the external users could be externalUsers.