orcluniqueattrname

Yes

Any string

N/A

N/A

orcluniquescope

No

One of the following:

• base--Searches the root entry only

• onelevel--Searches one level only

• sub--Searches the entire directory

sub

Searches the entire directory

orcluniqueenable

No

Either 0 (disable) or 1 (enable)

0

Disables attribute uniqueness

orcluniquesubtree

No

Any string

" "

Searches the entire directory

orcluniqueobjectclass

No

Any string

" "

Searches all object classes

orclPurgeBase

The base DN of DIT where the garbage collection task is applied

Yes

RDN of garbage collector configuration entry DN

orclpurgestart

Time in seconds when the garbage collector starts to run. If the garbage collector is enabled, and the value for this attribute is 0, then the garbage collector is enabled immediately.

The format is yyyymmddhhmmss.

No

NULL

orclpurgetargetage

Age of the target objects in hours. All objects older than the age specified by this attribute are purged.

No

12 (or 10 days old if the attribute value not specified)

orclPurgeInterval

Time interval in hours that the garbage collection job is executed again. This can be measured from either the point in time specified in the orclpurgestart attribute or from the last time it was run

No

24

orclpurgetransize

Number of objects to be purged in one commit transaction.

No

1000

orclpurgerun

Indicator that the submitted job is to be executed immediately whenever this attribute is added or modified

No

N/A

orclPurgeEnable

Flag to enable or disable garbage collectors

No

1

orclPurgeDebug

Flag to enable or disable collection of debugging messages

No

0

orclpurgefilename

Name of file that stores garbage collection logging messages

No

oidgc001

orclpurgefileloc

Absolute file directory where the log file is saved

No

. (period)

orclPurgeBase

The base DN of the naming context to which the garbage collection task is to be applied.

cn=auditlog

orclpurgestart

Time in seconds when the garbage collector starts to run. If the garbage collector is enabled, and the value for this attribute is 0, then the garbage collector is enabled immediately.

The format is yyyymmddhhmmss.

NULL (12:00 a.m. of the day Oracle Internet Directory is installed)

orclpurgetargetage

The age of the target objects in hours. All the objects older than the age specified by this attribute are purged.

12 hours

orclPurgeInterval

Time interval in hours that the garbage collection job is executed again. This can be measured from either the point in time specified in the orclpurgestart attribute or from the last time it was run

NULL (24 hours)

orclpurgetransize

The number of objects to be purged in one commit transaction.

1000

orclpurgerun

Every time this attribute is added or modified, then the submitted job is executed immediately.

N/A

orclPurgeEnable

Flag to enable/disable garbage collectors

1

orclPurgeDebug

Flag to enable/disable debugging messages collecting

0

orclpurgefilename

File name that saves garbage collection logging messages

oidgc001.log

orclpurgefileloc

Absolute file directory where the log file is saved.

. (period)

orclPurgeBase

The base DN of the naming context to which the garbage collection task is to be applied.

cn=changelog

orclpurgestart

Time in seconds when the garbage collector starts to run. If the garbage collector is enabled, and the value for this attribute is 0, then the garbage collector is enabled immediately.

The format is yyyymmddhhmmss.

NULL (12:00 a.m. of the day Oracle Internet Directory is installed)

orclpurgetargetage

The age of the target objects in hours. All the objects older than the age specified by this attribute are purged.

12 hours

orclPurgeInterval

Time interval in hours that the garbage collection job is executed again. This can be measured from either the point in time specified in the orclpurgestart attribute or from the last time it was run

NULL (24 hours)

orclpurgetransize

The number of objects to be purged in one commit transaction.

1000

orclpurgerun

Every time this attribute is added or modified, then the submitted job is executed immediately.

N/A

orclPurgeEnable

Flag to enable/disable garbage collectors

1

orclPurgeDebug

Flag to enable/disable debugging messages collecting

0

orclpurgefilename

File name that saves garbage collection logging messages

oidgc001.log

orclpurgefileloc

Absolute file directory where the log file is saved.

. (period)

orclPurgeBase

The base DN of the naming context to which the garbage collection task is to be applied.

cn=
orclgeneralstats,cn=orclsm

orclpurgestart

Time in seconds when the garbage collector starts to run. If the garbage collector is enabled, and the value for this attribute is 0, then the garbage collector is enabled immediately.

The format is yyyymmddhhmmss.

NULL (12:00 a.m. of the day Oracle Internet Directory is installed)

orclpurgetargetage

The age of the target objects in hours. All the objects older than the age specified by this attribute are purged.

12 hours

orclPurgeInterval

Time interval in hours that the garbage collection job is executed again. This can be measured from either the point in time specified in the orclpurgestart attribute or from the last time it was run

NULL (24 hours)

orclpurgetransize

The number of objects to be purged in one commit transaction.

1000

orclpurgerun

Every time this attribute is added or modified, then the submitted job is executed immediately.

N/A

orclPurgeEnable

Flag to enable/disable garbage collectors

1

orclPurgeDebug

Flag to enable/disable debugging messages collecting

0

orclpurgefilename

File name that saves garbage collection logging messages

oidgc001.log

orclpurgefileloc

Absolute file directory where the log file is saved.

. (period)

orclPurgeBase

The base DN of the naming context to which the garbage collection task is to be applied.

cn=orclhealthstats,
cn=orclsm

orclpurgestart

Time in seconds when the garbage collector starts to run. If the garbage collector is enabled, and the value for this attribute is 0, then the garbage collector is enabled immediately.

The format is yyyymmddhhmmss.

NULL (12:00 a.m. of the day Oracle Internet Directory is installed)

orclpurgetargetage

The age of the target objects in hours. All the objects older than the age specified by this attribute are purged.

12 hours

orclPurgeInterval

Time interval in hours that the garbage collection job is executed again. This can be measured from either the point in time specified in the orclpurgestart attribute or from the last time it was run.

NULL (24 hours)

orclpurgetransize

The number of objects to be purged in one commit transaction.

1000

orclpurgerun

Every time this attribute is added or modified, then the submitted job is executed immediately.

N/A

orclPurgeEnable

Flag to enable/disable garbage collectors

1

orclPurgeDebug

Flag to enable/disable debugging messages collecting

0

orclpurgefilename

File name that saves garbage collection logging messages

oidgc001.log

orclpurgefileloc

Absolute file directory where the log file is saved.

. (period)

orclPurgeBase

The base DN of the naming context to which the garbage collection task is to be applied.

cn=
orclsecrefreshevents,cn=orclsm

orclpurgestart

Time in seconds when the garbage collector starts to run. If the garbage collector is enabled, and the value for this attribute is 0, then the garbage collector is enabled immediately.

The format is yyyymmddhhmmss.

NULL (12:00 a.m. of the day Oracle Internet Directory is installed)

orclpurgetargetage

The age of the target objects in hours. All the objects older than the age specified by this attribute are purged.

12 hours

orclPurgeInterval

Time interval in hours that the garbage collection job is executed again. This can be measured from either the point in time specified in the orclpurgestart attribute or from the last time it was run.

NULL (24 hours)

orclpurgetransize

The number of objects to be purged in one commit transaction.

1000

orclpurgerun

Every time this attribute is added or modified, then the submitted job is executed immediately.

N/A

orclPurgeEnable

Flag to enable/disable garbage collectors

1

orclPurgeDebug

Flag to enable/disable debugging messages collecting

0

orclpurgefilename

File name that saves garbage collection logging messages

oidgc001.log

orclpurgefileloc

Absolute file directory where the log file is saved.

. (period)

orclPurgeBase

The base DN of the naming context to which the garbage collection task is to be applied.

cn=orclsysresourceevents, cn=orclsm

orclpurgestart

Time in seconds when the garbage collector starts to run. If the garbage collector is enabled, and the value for this attribute is 0, then the garbage collector is enabled immediately.

The format is yyyymmddhhmmss.

NULL (12:00 a.m. of the day Oracle Internet Directory is installed)

orclpurgetargetage

The age of the target objects in hours. All the objects older than the age specified by this attribute are purged.

12 hours

orclPurgeInterval

Time interval in hours that the garbage collection job is executed again. This can be measured from either the point in time specified in the orclpurgestart attribute or from the last time it was run.

NULL (24 hours)

orclpurgetransize

The number of objects to be purged in one commit transaction.

1000

orclpurgerun

Every time this attribute is added or modified, then the submitted job is executed immediately.

N/A

orclPurgeEnable

Flag to enable/disable garbage collectors

1

orclPurgeDebug

Flag to enable/disable debugging messages collecting

0

orclpurgefilename

File name that saves garbage collection logging messages

oidgc001.log

orclpurgefileloc

Absolute file directory where the log file is saved.

. (period)

orclPurgeBase

The base DN of the naming context to which the garbage collection task is to be applied.

cn=tombstone

orclpurgestart

Time in seconds when the garbage collector starts to run. If the garbage collector is enabled, and the value for this attribute is 0, then the garbage collector is enabled immediately.

The format is yyyymmddhhmmss.

NULL (12:00 a.m. of the day Oracle Internet Directory is installed)

orclpurgetargetage

The age of the target objects in hours. All the objects older than the age specified by this attribute are purged.

12 hours

orclPurgeInterval

Time interval in hours that the garbage collection job is executed again. This can be measured from either the point in time specified in the orclpurgestart attribute or from the last time it was run.

NULL (24 hours)

orclpurgetransize

The number of objects to be purged in one commit transaction.

1000

orclpurgerun

Every time this attribute is added or modified, then the submitted job is executed immediately.

N/A

orclPurgeEnable

Flag to enable/disable garbage collectors

1

orclPurgeDebug

Flag to enable/disable debugging messages collecting

0

orclpurgefilename

File name that saves garbage collection logging messages

oidgc001.log

orclpurgefileloc

Absolute file directory where the log file is saved.

. (period)

orclpluginname

PurgeAdmin

orclplugintype

operational

orclplugintiming

post

orclpluginldapoperation

ldapadd

orclpluginsubscriberdnlist

cn=purgeconfig,cn=subconfigsubentry

orclpluginname

PurgeAdmin

orclplugintype

operational

orclplugintiming

post

orclpluginldapoperation

ldapmodify

orclpluginsubscriberdnlist

cn=purgeconfig,cn=subconfigsubentry

orclpluginname

PurgeAdmin

orclplugintype

operational

orclplugintiming

post

orclpluginldapoperation

ldapdelete

orclpluginsubscriberdnlist

cn=purgeconfig,cn=subconfigsubentry

General Information

-

Profile Name (orclodipAgentName)

Name of the profile for the particular third-party directory you are integrating with. This attribute is mandatory.

Synchronization Mode
(orclodipSynchronizationMode)

Direction of synchronization between Oracle Internet Directory and the connected directory.

IMPORT indicates importing changes from the third-party directory to Oracle Internet Directory.

EXPORT indicates exporting changes from Oracle Internet Directory to the third-party directory.

ProfileStatus (orclOdipAgentControl)

Indicator whether the profile is enabled or disabled. The default is DISABLE. You must set this value to ENABLE.

Profile Password (orclodipProfilePassword)

The password used by the profile to bind to Oracle Internet Directory. In case of import, the changes are made with the profile name as the identity. The default value is welcome.

Note: For security reasons, change this password.

Scheduling Interval
(orclODIPSchedulingInterval)

Time interval in seconds after which a connected directory is synchronized with Oracle Internet Directory. The default is 600.

This attribute can be modified.

Maximum Number of Retries
(orclodipSyncRetryCount)

Maximum number of times Oracle directory integration and provisioning server tries to run the third-party directory connector in the event of a failure. The default is 5.

Profile Version

Version of the Oracle Directory Integration and Provisioning platform with which this profile was created.The default value is 1.0. This value cannot be modified.

Debug Level

(orclodipdebuglevel)

Identifier indicating the level of debugging required for any profile.

Set this attribute to 63 for the maximum debug level.

See Also: "Setting Debug Logging Levels"

Execution Information

-

Agent Execution Command (orclodipAgentExeCommand)

Connector executable name and argument list used by the directory integration and provisioning server. It can be passed as a command-line argument when the connector is invoked.

See Also: Chapter 39, "Synchronization with Oracle Human Resources" for typical usage of passing it in the command-line

Connected Directory Account (orclodipConDirAccessAccount)

Valid user account in the connected directory to be used by the connector for synchronization. The value is specific to the connected directory with which you are integrating. For instance, for the SunONE synchronization connector, it is the valid bind DN in the SunONE Directory Server. For the Human Resources Connector, it is a valid user identifier in the Oracle Human Resources database. For other connectors, it can be passed as a command-line argument when the connector is invoked.

See Also: Chapter 39, "Synchronization with Oracle Human Resources" for typical usage of passing it in the command-line

Connected Directory Account Password (orclodipConDirAccessPassword)

Password to be used by the user specified in the orclOdipConDirAccessAccount attribute to connect to the connected directory. The value is specific to the third-party directory with which you are integrating. For instance, for the SunONE synchronization connector, it is the valid bind password in the SunONE Directory Server. For the Human Resources Agent, it is the Oracle Human Resources database password.

Additional Config Info (orclodipAgentConfigInfo)

Any configuration information that you want the connector to store in Oracle Internet Directory. It is passed by the directory integration and provisioning server to the connector at time of connector invocation. The information is stored as an attribute and the directory integration and provisioning server does not have any knowledge of its content. When the connector is scheduled for execution, the value of the attribute is stored in the file,
$ORACLE_HOME/
ldap/odi/conf/profile_name.cfg that can be processed by the connector.

Upload the file by using either the Directory Integration and Provisioning Assistant or the ldapuploadagentfile.sh tool. Do this for both import and export agents.

See Also:

• "The Directory Integration and Provisioning Assistant"

• "The ldapUploadAgentFile.sh Tool Syntax"

Connected Directory URL
(orclOdipConDirURL)

Connect details required to connect to the connected directory. This parameter refers to the host name and port number as host:port:sslmode.

To connect by using SSL, enter host:port:1.

Make sure the certificate to connect to the directory is stored in the wallet, the location of which is specified in the file odi.properties.

Note: To connect to SunONE Directory Server by using SSL, the server certificate needs to be loaded into the wallet.

See Also: The chapter on Oracle Wallet Manager in Oracle Advanced Security Administrator's Guide

Interface Type (orclodipInterfaceType)

The data format or protocol used in synchronization. Supported values are:

• LDIF--Import or export from a LDIF File

• Tagged--Import or export from a tagged file--a proprietary format supported by the Oracle directory integration and provisioning server, similar to LDIF format

• LDAP--Import from or export to an LDAP-compliant directory

• DB --Import from or export to an Oracle9i Database Server directory

Mapping Information

-

Mapping Rules
(orclodipAttributeMappingRules)

Attribute for storing the mapping rules. Store the mapping rules in a file by using the Directory Integration and Provisioning Assistant or the ldapuploadagentfile.sh tool.

See Also:

• "Mapping Rules and Formats"

• "Format of the Mapping Rules Attribute"

• "The Directory Integration and Provisioning Assistant"

Connected Directory Matching Filter
(orclodipConDirMatchingFilter)

This attribute specifies the filter to apply to the third-party directory change log. It is used in the import profile. The filter must be set in the import profile when both the import and export integration profiles are enabled, as follows:

Modifiersname != connected_directory_account

This prevents the same change from being exchanged between the two directories indefinitely.

To avoid confusion, make this account specific to synchronization.

OID Matching Filter (orclOdipOIDMatchingFilter)

In export profiles, this attribute specifies the filter to apply to the Oracle Internet Directory change log container. It is used in the export profile. It must be set in the export profile when both the import and export integration profiles are enabled, as in the following example:

Modifiersname != orclodipagentname=iPlanetImport,
cn=subscriber profile,cn=
changelog subscriber,cn=oracle internet directory

This prevents the same change from being exchanged between the two directories indefinitely.

In import profiles, this attribute specifies a key for mapping entries between Oracle Internet Directory and the connected directory. This is useful when the DN cannot be used as the key.

Status Information

-

OID Last Applied Change Number (orclLastAppliedChangeNumber)

For export operations, the last change from Oracle Internet Directory that was applied to the connected directory. The default value is 0. Set this to the value of the lastchangenumber attribute of Oracle Internet Directory. If you have used the Directory Integration and Provisioning Assistant for bootstrapping using LDAP, then this is set automatically at the end of the bootstrapping process.

This is valid only in the export profile.

Last Execution Time (orclodipLastExecutionTime)

Status attribute set to the last time the integration profile was executed successfully by the Oracle directory integration and provisioning server. Its format is dd-mon-yyyy hh:mm:ss, where hh is the time of day in 24-hour format. This attribute is initialized during profile creation.

Last Successful Execution Time (orclodipLastSuccessfulExecution
Time)

Status attribute set to the last time the integration profile was executed successfully by the Oracle directory integration and provisioning server. The format is dd-mon-yyyy hh:mm:ss, where hh is the hour in 24-hour format.

Synchronization Status

Synchronization status of the last execution: Success or failure.
(orclodipSynchronizationStatus) Initially, this attribute has the value Yet to be executed. It is a read-only attribute

Synchronization Errors
(orclodipSynchronizationErrors)

Messages explaining errors if the last execution failed. This parameter is updated by Oracle directory integration and provisioning server. It is a read-only attribute.

Last Applied Change Number
(orclodipConDirLastAppliedChgNum)

For import operations, the last change from the connected directory that was applied to Oracle Internet Directory. The default value is 0. Set this to the value of the lastchangenumber attribute of Oracle Internet Directory. If you have used the Directory Integration and Provisioning Assistant for bootstrapping using LDAP, then this is set automatically at then end of the bootstrapping process.

This is valid only in the import profile.

orclpwdAlphaNumeric

Number of Numeric Characters in Password

Number of numeric characters required in a password. By default, one numeric character is required. That is, the default value is 1.

orclpwdencryptionenable

Enable reversible user password encryption

If the value is TRUE, then the user password is stored in reversible encrypted form.

orclpwdIllegalValues

Illegal Values

Multivalued attribute containing the common words and attribute types whose values cannot be used as a valid password. By default, all words are acceptable password values.

orclpwdipmaxfailure

IP Lockout Maximum Failure

Specify the maximum number of falied logins from a specific IP address after which the account is locked.

orclpwdToggle

Old Password Can Be New Password

Specification for whether a user's old password can become the new one. By default, it can. The default value is 1.

orlcpwdiplockout

IP Lockout

Specify whether you want to enforce account lockout for a specific IP address. A value of TRUE enforces the lockout. The default is FALSE.

pwdAllowUserChange

User-defined Passwords

Indicator of whether users can change their own passwords. If allowed, then users can change their passwords by using ldapmodify. If not allowed, then the directory server verifies that the user has privileges to change the password. If the user does not have the appropriate privileges, then the directory server sends the client an error message.

By default, user-defined passwords are allowed.

pwdCheckSyntax

Check Password Syntax

Indicator of whether syntax checking is enforced. If 1, then syntax checking is enforced. The default value is 1.

By default, password syntax checking is turned on, and user passwords must contain one numeric character.

orclpwdpolicyenable

Enable/disable Password Policy

Enalbed=1

Disabled=0

pwdExpireWarning

Password Expiration Warning

The number of seconds before password expiration that the directory server sends the user a warning. If password expiration is enabled, then, by default, the directory server sends a warning before the password expires.

The directory server sends the warning at each logon. If the user does not modify the password before it expires, the user is locked out until the password is changed by the administrator.

For this feature to work, the client application must support it.

The default is 0, which means no warnings are sent.

Example: If pwdMaxAge is 7200. and pwdExpireWarning is 3600, then your password expires after 2 hours. If you bind during the last hour, then you receive a warning that your password is about to expire.

pwdFailureCountInterval

Password Failure Count Interval

The number of seconds after which the password failure times are purged from the user entry. If this attribute is not present, or if it has a value of 0, then failure times are never purged. The default is 0.

pwdGraceLoginLimit

Number of Grace Logins after Password Expiration

Maximum number of grace logins allowed after a password expires. By default, no grace logins.are allowed. The default value is 3.

pwdInHistory

Number of Password History

How many of a user's previous passwords the directory server is to store. If a user attempts to reuse one of the passwords the directory server has stored, then the password is rejected. The directory server does not maintain a password history by default.

pwdLockout

Password Lockout

Specification for whether users are locked out of the directory after the number of consecutive failed bind attempts specified by pwdmaxFailure. If the value of this policy attribute is 1, then users are locked out. If this attribute is not present, or if the value is 0, then users are not locked out and the value of pwdMaxFailure is ignored. By default, account lockout is enforced. The account is locked after three consecutive login failures.

pwdLockoutDuration

Lockout Duration

The number of seconds a user is locked out of the directory if both of the following are true:

• Account lockout is enabled

• The user has been unable to bind successfully to the directory for at least the number of times specified by pwdMaxFailure

You can set user lockout for a specific duration, or until the administrator resets the user's password. A default value of 0 (zero) means that the user is locked out forever.

pwdMaxAge

Password Expiry Time

The maximum length of time, in seconds, that a given password is valid. If this attribute is not present, or if the value is 0 (zero), then the password does not expire. By default, the passwords expire in 60 days.

pwdMaxFailure

Password Maximum Failure

The number of consecutive failed bind attempts after which a user account is locked. If this attribute is not present, or if the value is 0 (zero), then the account is not locked due to failed bind attempts, and the value of the password lockout policy is ignored. The default is 4.

pwdMinLength

Minimum Number of Characters of Password

The minimum number of characters required in a password. By default, the minimum length is 5; however, the value for this attribute must be at least 1.

pwdMustChange

Password Change after Reset

Indicator of whether users must change their passwords after the first login, or after the password is reset by the administrator. Enabling this option requires users to change their passwords even if user-defined passwords are disabled. By default, users need not change their passwords after reset.

Cn

Plug-in entry name

Yes

orclPluginAttributeList

A semicolon-separated attribute name list that controls whether the plug-in takes effect. If the target attribute is included in the list, the plug-in is invoked.

No

orclPluginEnable

0 = disable (default)

1 = enable

No

orclPluginEntryProperties

An ldap search filter type value need to be specified here. For example, if we specify orclPluginEntryProperties:(&(objectclass=inetorgperson)(sn=Cezanne)), then plug-in will not be invoked if the target entry has objectclass equal to inetorgperson and sn equal to Cezanne.

No

orclPluginIsReplace

For WHEN timing plug-in only

0 = disable (default)

1 = enable

No

orclPluginKind

PL/SQL

No

orclPluginLDAPOperation

One of the following values:

ldapcompare
ldapmodify
ldapbind
ldapadd
ldapdelete
ldapsearch

Yes

orclPluginName

Plug-in package name

Yes

orclPluginRequestGroup

A semicolon-separated group list that controls if the plug-in takes effect. You can use this group to specify who can actually invoke the plug-in.

For example, if you specify orclpluginrequestgroup:cn=security,cn=groups,dc=oracle,dc=com, when you register the plug-in, then the plug-in will not be invoked unless the ldap request comes from the person who belongs to the group cn=security,cn=groups,dc=oracle,dc=com.

No

orclPluginRequestNegGroup

A semicolon-separated group list that controls if the plug-in takes effect. You can use this group to specify who can NOT invoke the plug-in. For example, if you specify orclpluginrequestgroup: cn=security,cn=groups,dc=oracle,dc=com, when you register the plug-in, then the plug-in will not be invoked if the ldap request comes from the person who belongs to the group cn=security,cn=groups,dc=oracle,dc=com.

No

orclPluginResultCode

An integer value to specify the ldap result code. If this value is specified, then plug-in will be invoked only if the ldap operation is in that result code scenario.

This is only for the POST plug-in type.

No

orclPluginShareLibLocation

File location of the dynamic linking library. If this value is not present, then Oracle Internet Directory server assumes the plug-in language is PL/SQL.

No

orclPluginSubscriberDNList

A semicolon-separated DN list that controls if the plug-in takes effect. For example:

orclPluginSubscriberDNList=
dc=COM,c=us;
dc=us,dc=oracle,dc=com;
dc=org,dc=us;

o=IMC,c=US

If the target DN of an LDAP operation is included in the list, then the plug-in is invoked.

No

orclPluginTiming

One of the following values:

pre
when
post

See Also: "About Directory Server Plug-ins" for explanations of these values

No

orclPluginType

One of the following values:

operational
attribute
password_policy
syntax
matchingrule

See Also: The chapter about the Oracle Internet Directory server plug-in framework in Oracle Internet Directory Application Developer's Guide

Yes

orclPluginVersion

Supported plug-in version number

No

modifyTimestamp

Time of entry creation or modification

No

modifiersName

Name of person creating or modifying the entry

No

orclChangeRetryCount

Single-valued attribute. The number of processing retry attempts for a change-entry before being moved to the human intervention queue. The value for this parameter must be equal to or greater than 1 (one).

10

Yes

orclThreadsPerSupplier

Number of worker threads directory replication server provides for each supplier for change log processing. The value for this parameter must be equal to or greater than 1 (one).

5

Yes