-
Oracle Identity Manager
|
October 24, 2013
Configure Oracle Identity Manager AD/LDAP Authentication
Requirements (on AD side)
- LDAP connection user with the necessary rights in AD to do subtree searches on your users and groups container, respectively in the scope we configure below
- For LDAP in OIM to work, you need an AD Group called "oimusers", in which all users who shall be able to login to OIM need to be member. The group need to be named exactly "oimusers".
Step 1: Login Weblogic Administration Console
Step 2: Create New Provider
Authentication Provider
- Name: ADAuthenticationProvider
- Type: ActiveDirectoryAuthenticator
- Control Flag: SUFFICIENT
User scope configuration
- User Base DN: Container where your users are found
- Rest of the parameters stay default
Group scope configuration
- Group Base DN: Container where your groups are found
- Your "oimusers" group must be found in this container or in the subtree
- Rest of the parameters stay default
Step 3: Restart Admin Server
Step 4: Check oimusers group
Step 5: Re order providers
Step 6: Restart Admin Server
Join the discussion
Comments ( 5 )
Recent Content
-
Oracle Identity Manager
Using OIM APIs in Oracle BPEL
Step by step using OIMClient classes in Oracle BPEL with Java_Embedding Lets start Step 1: authwl.conf file Create folder into your project and...
-
Oracle Identity Manager
How To Reuse UserLogin in OIM
After delete a user, you can reuse userlogin in OIM. Please follow the steps below. Step 1: Login system admin screen and click on "System...
Oracle
hi,
thank you for this tutorial. works fine!
when adding more than 1000 users to that oimusers group, we get this error message in the admin server log:
------------ logfile start ------------
<BEA-240003> <Console encountered the following error java.lang.RuntimeException: netscape.ldap.LDAPException: error result (4); Sizelimit exceeded at weblogic.security.providers.authentication.LDAPAtnNameList.handleUnexpectedLDAPException(LDAPAtnNameList.java:179)
------------ logfile end ------------
I think our AD-configuration: MaxPageSize=1000 is the problem. but it is not possible to increase that pagesize. do you know a workaround for this problem?
br,
max
Hi Max,
You can use AD groups recursively, it means that any AD group can contain another AD group.
So you can add groups as a member of "oimusers".
thnx,
Arda
ok
HI,
Using ldap authentication only (disabling local), can OIM stop working password sync in target systems?
Hi Arda,
For performing this do we need to enable LDAP synchronization feature in OIM?
Thanks!