22
Oracle Delegated Administration Services

This chapter describes issues for both the Oracle Delegated Administration Services and the Oracle Internet Directory Self-Service Console. It includes the following topics:

• Section 22.1, "General Issues and Workarounds"

• Section 22.2, "Configuration Issues and Workarounds"

• Section 22.3, "Administration Issues and Workarounds"

• Section 22.4, "Documentation Errata"

22.1 General Issues and Workarounds

This section describes general issues and their workarounds for Oracle Delegated Administration Services. It includes the following topics:

• Section 22.1.1, "Use the Oracle Internet Directory Self-Service Console to Change Passwords When Required by Password Policy"

• Section 22.1.2, "Realm Values Cannot Be Edited with Oracle Delegated Administration Services Configuration Privileges in Releases 9.0.2 and 9.0.4"

• Section 22.1.3, "Roles with No Members Are not Displayed in Role Assignment Section in Create/edit User"

• Section 22.1.4, "Group Owner Unable to Edit Groups Created in the Same Session"

22.1.1 Use the Oracle Internet Directory Self-Service Console to Change Passwords When Required by Password Policy

Oracle Internet Directory 10g (9.0.4) enables prompting of users to change their passwords after initial login. Users must change their passwords by using the Oracle Internet Directory Self-Service Console Password Change screen. Using other mechanisms may not satisfy the password change requirement, and users may be prompted to change their password the next time they log in as well.

22.1.2 Realm Values Cannot Be Edited with Oracle Delegated Administration Services Configuration Privileges in Releases 9.0.2 and 9.0.4

In Releases 9.0.2 and 9.0.4 upgrade, only the orcladmin user can edit realm values. Other users, even those with Oracle Delegated Administration Services configuration privileges cannot edit them. This is because the latter do not have sufficient privileges to read the User Search Base, User Creation Base, Group Search Base, and Group Creation Base. The workaround is to modify the ACLs on these containers and enable anonymous browse access.

22.1.3 Roles with No Members Are not Displayed in Role Assignment Section in Create/edit User

Workaround: A role should contain at least one unique member, so that it would be displayed in the Role Assignment section in Create User page and the Edit User page.

To add a unique member to a role, the syntax of the LDIF file is:

dn: DN_of_role_entry 

changetype: modify 

add:uniquemember 

uniquemember:DN of member entry 

Issue this command to modify the file:

ldapmodify -p oid_port -h oid_host -D "cn=orcladmin" -w admin_password -v -f 
file_name.ldif 

22.1.4 Group Owner Unable to Edit Groups Created in the Same Session

After creating a group, the owner of the group cannot edit the group in the same session. Workaround: Logout, close the browser, then login again. [2944346]

22.2 Configuration Issues and Workarounds

This section describes configuration issues and their workarounds for Oracle Delegated Administration Services. It includes the following topics:

• Section 22.2.1, "Deploying Oracle Delegated Administration Services on a Separate Host"

• Section 22.2.2, "Default Realm Administrator Lacks Necessary Configuration Privileges"

• Section 22.2.3, "Configuring Oracle Delegated Administration Services to Run Against an Oracle Internet Directory Installation Upgraded from 9.2 to 9.0.4"

22.2.1 Deploying Oracle Delegated Administration Services on a Separate Host

To configure Oracle Delegated Administration Services in a separate Oracle Home, you perform a standalone installation of it. To do this, you select the Identity Management installation type, and, on the Configuration Options screen, select Delegated Administration Services.

See Also: Oracle Application Server 10g Installation Guide for Release 10g (9.0.4)

22.2.2 Default Realm Administrator Lacks Necessary Configuration Privileges

When logging in to Oracle Internet Directory Self-Service Console, the administrator of the default realm does not have the necessary privileges to create users or change DAS configuration. The workaround is:

1. In Oracle Directory Manager, navigate to: cn=userpassword, cn=attributes,cn=User Configuration,cn=Attribute Configuration,cn=DAS,cn=Products, cn=OracleContext,DN of the realm.

2. Select the above entry and change the value of orcldasviewable to 0.

3. Choose Apply.

4. Restart the Oracle Internet Directory Self-Service Console.

22.2.3 Configuring Oracle Delegated Administration Services to Run Against an Oracle Internet Directory Installation Upgraded from 9.2 to 9.0.4

Follow these steps to make Oracle Delegated Administration Services 10g (9.0.4) work against an installation of Oracle Internet Directory that has been upgraded from Release 9.2 to Release 9.0.4.

1. Use ldapmodify to run the schema_delta.sbs file located in $ORACLE_HOME/ldap/das. When you do this, replace all the occurrences of %s_OracleContextDN% in schema_delta.sbs with the value cn=oraclecontext,realm DN.

   The syntax for ldapmodify is:

   ldapmodify -p port number -h host -D "cn=orcladmin" -w orcladmin passwaord 
   -f schema_delta.sbs
   
   

2. Modify the ACL on the container cn=users,realm DN and cn=groups,realm DN to allow anonymous browse access.

22.3 Administration Issues and Workarounds

This section describes administration issues and their workarounds for Oracle Delegated Administration Services. It includes the following topics:

• Section 22.3.1, "Unified Messaging Voicemail PIN Field Mislabeled in Oracle Internet Directory Self-Service Console"

• Section 22.3.2, "Unlocking Privileged User Accounts"

• Section 22.3.3, "Running Oracle Delegated Administration Services in One DNS Domain and OracleAS Portal in Another"

22.3.1 Unified Messaging Voicemail PIN Field Mislabeled in Oracle Internet Directory Self-Service Console

When Oracle Collaboration Suite users use the Self-Service Console to change their passwords, the field name associated with their voicemail PIN number is incorrectly displayed as 'EmailServerContainer'. To solve this problem:

1. Use Oracle Directory Manager to navigate to the entry of the following DN: cn=orclpwdverifierconfig,cn=EMailServerContainer, cn=Products,cn=OracleContext,cn=subscriber realm

2. Select the entry.

3. Select All for View Properties.

4. In the displayname text box, enter Voicemail PIN.

5. Choose Apply.

22.3.2 Unlocking Privileged User Accounts

Oracle Identity Management has two distinct types of privileged user. Both privileged user accounts can be locked if certain password policies are activated.

The first type of privileged user, the super user with the DN cn=orcladmin, is represented as a special user entry found within the default identity management realm. It enables directory administrators to make any modifications to the DIT and any changes to the configuration of Oracle Internet Directory servers. If the super user (orcladmin) account is locked--for example, as a result of too many attempts to bind with an incorrect password--then an administrator with DBA privileges to the Oracle Internet Directory repository can unlock it by using the oidpasswd tool. To unlock the orcladmin account execute the command:

oidpasswd unlock_su_acct=TRUE

The second privileged user, a realm-specific privileged user, governs capabilities such as creation and deletion of users and groups within a realm and all the functionality related to Oracle Delegated Administration Services. This account is represented by an entry with the DN cn=orcladmin,cn=users,realm DN. Note that, in contrast to the single super user account, each realm has its own realm-specific privileged user. To unlock the realm-specific privileged account, the administrator modifies the realm-specific privileged users account password by using Oracle Directory Manager.

22.3.3 Running Oracle Delegated Administration Services in One DNS Domain and OracleAS Portal in Another

If you are running Oracle Delegated Administration Services in one domain, and OracleAS Portal in another, then, in the Oracle Application Server Portal Configuration Guide, follow the instructions in Section 6.1.6.2, "Relationship Between OracleAS Portal and Oracle Internet Directory".

22.4 Documentation Errata

This section describes errors in the documentation for Oracle Delegated Administration Services. It includes the following topics:

• Section 22.4.1, "Online Help Incorrectly States How to Edit Identity Management Realms"

• Section 22.4.2, "Online Help for "Configure Roles" Screen Does Not Display"

22.4.1 Online Help Incorrectly States How to Edit Identity Management Realms

The online help for the Oracle Internet Directory Self-Service Console incorrectly states that, after searching for a particular realm, you can modify it by selecting it from the search results page and choosing Proceed. However, the search results page enables you only to view, and not to modify, the selected realm. To modify a realm configuration, select the Configuration tab, enter your changes, then choose Submit. For instructions on viewing and modifying configuration settings for a realm, see the Chapter 31, "Oracle Internet Directory Self-Service Console" in the Oracle Internet Directory Administrator's Guide.

22.4.2 Online Help for "Configure Roles" Screen Does Not Display

In the Oracle Internet Directory Self-Service Console, the Configure Roles page (Step 5 of the "Configure User Entry" task) has help icons at the top and bottom of the page that generate the error message "The requested topic could not be found."