15
Oracle Components and Oracle Internet Directory

Many Oracle components use Oracle Internet Directory for a variety of purposes. In doing this, they rely on a consolidated Oracle Internet Directory schema and a default Directory Information Tree (DIT). This chapter:

• Describes the consolidated Oracle Internet Directory schema used by various components

• Describes a default DIT structure available when using the various Oracle components

• Describes how you can modify the default DIT structure to accommodate the needs of hosted application environments

This chapter contains these topics:

• About Oracle Components and Directory Usage

• Ready-to-Use Default Configuration

• A Default Subscriber Configuration

About Oracle Components and Directory Usage

Oracle Internet Directory enables Oracle components to:

• Maintain for each user a single, global identity across the application environment

• Store and administer configuration information for components in a central place

This chapter considers two general types of environment:

• Hosted--In a hosted environment, one enterprise--for example, an application service provider--makes Oracle components available to multiple other enterprises and stores information for them. In such hosted environments, the enterprise performing the hosting is called the default subscriber, and the enterprises that are hosted are called subscribers. A global administrator performs activities that span the entire directory. Other administrators may be delegated to exercise roles in specific subscriber domains, or for specific applications.

• Non-hosted--In a non-hosted environment, in which there are no subscribers, the enterprise installing Oracle Internet Directory for use with Oracle components is called the default subscriber.

Directory schema and DIT requirements are defined with enough flexibility to accommodate both deployment models.

Ready-to-Use Default Configuration

To make it easy for you to start using Oracle components that use the directory, Oracle Universal Installer creates a default schema and directory information tree (DIT) during Oracle Internet Directory installation. This default DIT framework is the same for both hosted and non-hosted environments. It is flexible; you can modify it to suit the needs of your deployment.

During Oracle Internet Directory installation, the Oracle Universal Installer creates:

• Base schema elements--that is, attributes and object classes--some of which are defined by the Internet Engineering Task Force (IETF), and some of which are specific to Oracle components

• The root Oracle context, a directory container of information common to all Oracle components in the entire site

• Default subscriber Oracle context containing information common to all Oracle components in the subscriber's subtree

• Subscriber Oracle context containing information common to all Oracle components in the subscriber's subtree

• A default password policy for each subscriber. This password policy will then apply to all users in the subscriber user base.

The Root Oracle Context

The root Oracle context includes:

• Site-wide information, including such metadata as default parameter settings, default profiles, and default authorization policies

• A discovery mechanism for Oracle components in a hosted environment to find necessary information for each subscriber

Figure 15-1 shows the organization of the root Oracle context.

Figure 15-1 The Root Oracle Context

Text description of the illustration oidag053.gif

Some of the discovery-related information stored at the root Oracle context includes:

• Subscriber Search Base (orclSubscriberSearchBase)

  This attribute identifies the node in the DIT under which all the subscribers are placed. This attribute becomes particularly important in the hosted scenario because it provides a common point for all the products to locate a subscriber. For example, in Figure 15-1, Subscriber serves as the search base for locating a subscriber. In a non-hosted environment, the value of this attribute points to the parent of the default subscriber.

• Subscriber Nickname Attribute (orclSubscriberNickNameAttribute)

  This attribute identifies the nickname attribute to be used when searching for a subscriber under the subscriber search base. For example, because a subscriber is typically represented as an organization, the attribute o can be used as the nickname attribute.

• Default Subscriber (orclDefaultSubscriber)

  This attribute points to the default subscriber node in the DIT.

In both hosted and non-hosted scenarios, a component finds the correct node in the DIT by using the orclSubscriberSearchBase and orclSubscriberNickNameAttribute attributes. Once the component finds the appropriate subtree, it obtains the subscriber-specific information it needs from the Oracle context in that subtree.

For example, Oracle9iAS Single Sign-On uses this framework for authenticating a user in a hosted scenario. When a user logs in, Oracle9iAS Single Sign-On prompts the user for a subscriber. Then, when it looks for an entry, the Oracle9iAS Single Sign-On server finds the correct subscriber node in the DIT by using the orclSubscriberSearchBase & orclSubscriberNickName attributes. Once it learns where the subscriber-specific information resides, it then looks in the subscriber-specific Oracle context to find the location of the user.

If a client does not specify a subscriber, then Oracle Internet Directory assumes that the user is looking for information in the default subscriber subtree.

The Subscriber Oracle Context

A subscriber-specific Oracle context includes:

• A discovery mechanism for Oracle components to find necessary information in the subscriber's subtree

• Oracle component data specific to a subscriber

• An access policy at the subscriber node to protect subscriber data from other subscribers

• A default password policy applicable to all users is placed in the Common container. The attribute orclCommonUserSearchBase must be set to the appropriate value for the password policy to be enforced, i.e., the policy will be applied to a user whenever the corresponding attribute matches the value of orclCommonUserSearchBase.

Figure 15-2 shows the organization of a subscriber-specific Oracle context.

Figure 15-2 Subscriber-Specific Oracle Context

Text description of the illustration oidag052.gif

Figure 15-2 shows subscriber-wide information in the directory for an Oracle component and information common to all components. It illustrates two aspects:

• An example of the default subscriber is shown under the container called "Users."

• An example of the default user is shown under the container called "Oracle Context."

The Common entry in the subscriber-specific Oracle context contains information for locating users and groups. Specifically, it includes:

• User Search Base (orclCommonUserSearchBase)

  This attribute specifies the node in the subscriber DIT under which all the users are placed. For example, in Figure 15-2, users serves as the search base while searching for a user in a subscriber.

• User Nickname attribute (orclCommonUserNickNameAttribute)

  This attribute specifies the nickname attribute to be used when searching for a user under the user search base. For example, when a user logs in, Oracle9iAS Single Sign-On prompts the user for the value of this attribute.

• Group Search Base (orclCommonGroupSearchBase)

  This attribute specifies the node in the subscriber DIT under which all the groups can be found.

• Object classes to be used for creating user entries (orclUserObjectClass)

  This attribute specifies a list of object classes to be used when creating user entries under the subscriber tree--for example, person, organizationalPerson, inetOrgPerson, orclUser, and so on. For example, the Delegated Administration Service uses this attribute in configuring users.

In a hosted scenario, you might dedicate a particular instance of a component to multiple subscribers. For example, each subscriber might have its own instance of the Oracle9iAS Portal component. In this case, the instance information and other data required by each individual subscriber is stored in each subscriber's Oracle context. General information required by all subscribers is stored in the root Oracle context.

In Figure 15-2, the dotted line between the user and the subscriber shows some of the flexibility with which you can organize a subscriber subtree. You can create and store user data in different ways--for example, you can store it:

• Directly under the subscriber node

• Outside the subscriber tree as illustrated in Figure 15-3.

Figure 15-3 Separation of a Subscriber and Subscriber's User Information

Text description of the illustration oidag054.gif

As Figure 15-3 shows, you are not required to create a subscriber's users under the subscriber node itself. The orclCommonUserSearchBase attribute in the Common entry for each subscriber-specific Oracle context points to the node containing the user data--in Figure 15-3, it is dc=myCompany,dc=com. This enables subscribers to keep the DNs they may already have, without having to migrate them to a different DIT structure.

A Default Subscriber Configuration

Figure 15-4 shows the DIT for a default subscriber in a non-hosted environment.

Figure 15-4 Default DIT in Non-Hosted Environment

Text description of the illustration oidag051.gif

During an Oracle Internet Directory installation, Oracle Universal Installer determines the domain information for the site where it is installing Oracle Internet Directory. It establishes the default DIT structure based on this information. For example, if Oracle Internet Directory is installed at My_Company.com, then Oracle Universal Installer creates the following nodes in the DIT:

• The root Oracle context containing information common to all Oracle components

• The node marked as Com in the above figure

• The My_Company node and, under it, the Oracle context

• User and Group containers under the default subscriber node--in this example, My_Company.com

If you use the default DIT for your enterprise, then you do not need to configure anything at the root Oracle context. Instead, depending on the structure of the subtree that your deployment uses, you simply do the following:

• Configure the user search base and related discovery information in the Oracle context in the default subscriber node. For example, in the deployment in Figure 15-4 , the user search base and related discovery information reside in the Common container under cn=Products,cn=Oracle Context,o=GM.

• Place user entries in the Users container, and group entries in the Groups container, both of which reside immediately below the default subscriber node.

In a hosted environment, you would create subscribers at the same level in the DIT as the default subscriber node itself.

As part of Default DIT Creation a seed user is also created to help bootstrap using the Delegated Administration Service and other tools. The user is identified by the following DN: cn=orclAdmin,cn=users,cn=my_company, dc=com. The initial password for the user is the same as the Oracle Internet Directory super user (cn=orcladmin) password. By default, this user is allowed to create, delete, and edit users under the cn=Users container or create, delete, and edit groups under the cn=Groups container.

The user also has permission to change the Delegated Administration Service configuration in Oracle Internet Directory. By using this seed user identity, the administrator can use the Delegated Administration Service to create users and groups, and thereby bootstrap the entire directory environment.

See Also: Chapter 9, "The Delegated Administration Service"