A Deploying Oracle Identity Management with Multimaster Replication

A.1 Multimaster Identity Management Replication Configuration

In Figure A-1, The Oracle Identity Management master node includes Host 1 and Host 2. Oracle Identity Management and Metadata Repository, Oracle Internet Directory, and Oracle Directory Integration and Provisioning are installed on Host 1. Oracle Application Server Single Sign-On and Oracle Delegated Administration Services, are installed on Host 2.

Similarly, the Oracle Identity Management replica node includes Host 3 and Host 4. Oracle Identity Management and Metadata Repository, Oracle Internet Directory, and Oracle Directory Integration and Provisioning are installed on Host 3. Oracle Application Server Single Sign-On and Oracle Delegated Administration Services, are installed on Host 4.

A.2 Adding a Node to a Multimaster Replication Group

To add a replication node to a functioning directory replication group (DRG), follow these steps.

1. First, install the new node.

   Install Oracle Application Server 10g Release 2 (10.1.2) Identity Management and Metadata Repository. This installation will have only the Metadata Repository, Oracle Internet Directory and Oracle Directory Integration and Provisioning. The replica node Metadata Repository should have a unique global database name.

   Do not install other Identity Management components such as Oracle Application Server Single Sign-On or Oracle Delegated Administration Services.

2. Prepare the environment for adding a node.

   1. Configure the Oracle Net Services environment as described in Task 3, Installing and Configuring a Multimaster Replication Group, in the "Oracle Internet Directory Replication Administration" chapter of Oracle Internet Directory Administrator's Guide.

   2. Stop the directory replication server on all nodes

   3. Identify a sponsor node and switch the sponsor node to read-only mode

      Note: While the sponsor node is in read-only mode, do not make any updates to it. You may, however, update any of the other nodes, but those updates are not replicated immediately. Also, the sponsor node and the MDS can be the same node.

   4. Back up the sponsor node by using ldifwrite. Enter the following command:

      $ORACLE_HOME/bin/ldifwrite -c connect_string  \
               -b "orclagreementid=000001,cn=replication configuration" \
               -f output_ldif_file
      
      

3. Add the node into the replication group.

   1. Perform the Advanced Replication add node setup on the sponsor node by typing:

      $ORACLE_HOME/ldap/bin/remtool -addnode
      
      

      The Replication Environment Management Tool adds the node to the DRG.

      
      

      Note: Note: If you encounter errors, then use remtool -asrverify. If it reports errors, then rectify them by using remtool -asrrectify. Both of those options list all the nodes in the DRG. If the new node is not in the list, then add it by running remtool -addnode again.

      
      

   2. Switch the sponsor node to updatable mode.

   3. Start the directory replication server on all nodes except the new node.

   4. Stop oidmon

   5. Load data into the new node, as follows:

      First do a check and generate by typing:

      $ORACLE_HOME/ldap/bin/bulkload.sh \
        -connect <db_connect_string_of_new_node> \
        -check -generate -restore  \
        absolute_path_to_the_ldif_file_generated_by_ldifwrite
      
      

      
      

      Note: Verify that the $ORACLE_HOME/ldap/log/bulkload.log does not report any errors. It's possible that you might see Duplicate entry errors in the log for some of the entries. You can safely ignore this error and proceed with the load.

      
      

      Now load the data on the target node by typing:

      $ORACLE_HOME/ldap/bin/bulkload.sh \
        -connect db_connect_string_of_new_node \
        -load -restore  \
        absolute_path_to_the_ldif_file_generated_by_ldifwrite
      
      

4. Start the directory server on the new node by typing the following command:

   $ORACLE_HOME/opmn/bin/opmnctl startproc ias-component=OID
   
   

5. Start the directory replication server on the new node by typing:

   $ORACLE_HOME/bin/oidctl connect=db_connect_string_of_new_node \
      server=oidrepld instance=1 \
      flags='-h host_name_of_new_node -p port'  start
   
   

6. Install a new mid-tier, based on the new replica node.

   1. Synchronize the Oracle Application Server Single Sign-On schema passwords from MDS to the new node as described in "Synchronizing the Single Sign-On Schema Password".

   2. Install Oracle Application Server Single Sign-On and Oracle Delegated Administration Services as described in "Installing Oracle Application Server Single Sign-On and Oracle Delegated Administration Services on the Replica Node".

   3. Configure the HTTP load balancer to distribute incoming traffic to this newly installed node.

A.3 Deleting a Node from a Multimaster Replication Group

You can delete a node from a DRG, provided the DRG contains more than two nodes. You might need to do so if the addition of a new node did not fully succeed as a result of system errors. To delete a replication node, perform these steps:

1. Stop the directory replication server on all nodes. To do that, run the following command on each node in the DRG:

   $ORACLE_HOME/bin/oidctl connect=connect_string server=oidrepld instance=1 stop
   
   

   
   

   Note: Note: The instance number may vary.

   
   

2. Stop all processes on the node to be deleted.

   1. Stop all processes in the associated mid-tier Oracle home.

      $ORACLE_HOME/opmn/bin/opmnctl stopall
      
      

   2. On the node to be deleted, stop all Oracle Application Server processes including Oracle Internet Directory Monitor and all directory server instances.

      $ORACLE_HOME/opmn/bin/opmnctl stopall
      
      

3. Delete the node from the master definition site. From the MDS, run the following command:

   $ORACLE_HOME/ldap/bin/remtool -delnode
   
   

   
   

   Note: If you encounter errors, then use remtool -asrverify. If it reports errors, then rectify them by using remtool -asrrectify. Both of those options list all nodes in the DRG. If the new node is not in the list, then add it by running remtool -addnode again.

   
   

4. Start the directory replication server on all nodes by typing the following command:

   $ORACLE_HOME/bin/oidctl connect=connect_string server=oidrepld \
     instance=1 flags='-h host -p port' start
   
   

5. Decommission the removed node and its associated mid-tier. You can optionally decommission the removed replicated node and associated mid-tier by deinstalling the corresponding Oracle homes.