By Sylvain Duloutre-Oracle on Jan 22, 2015
ODSEE 126.96.36.199.2 Bundle Patch has been Released for Directory Server and Directory Proxy Server. (Doc ID 1962875.1)
Search for Doc ID 1962875.1 in My Oracle Support for instructions.
ODSEE 188.8.131.52.2 Bundle Patch has been Released for Directory Server and Directory Proxy Server. (Doc ID 1962875.1)
Search for Doc ID 1962875.1 in My Oracle Support for instructions.
I was recently involved in a LDAP directory services
transition project, from DSEE 184.108.40.206 to OUD 11gR2PS1, for a large
manufacturing enterprise. Directory service is medium-sized with a few of million LDAP entries, and is accessed by a wide range of services and applications, ranging from Corporate
Directory to Identity Store for Identity Management and user management for
intranet and extranet portals.
Here is an overview of the steps we followed and the issues we addressed during this project to successfully transition the infrastructure to OUD.
Putting in place a sound methodology and design is
a key success factor for a directory migration, regardless the final migration
This assessment was conducted over a period of 3 weeks and included the following:
- Identification and formalization of the main drivers and requirements for transition
- Inventory of the current directory infrastructure, including identification of the application portfolio accessing the directory
- Identification of transition options compatible with requirements
- Estimation of transition effort
- Identification of training requirement for the staff and skills required during the transition, especially people with business knowledge of the data stored in the directory.
For this project, the 4 main drivers to migrate to OUD were:
- native support of EUS (ability to store Oracle DB accounts used by Enterprise User Security) as deployment of EUS was a Corporate decision
- smooth integration and official support of OUD with the Oracle Identity stack, especially OIM and OAM
- superior scalability, able to deliver SLA required by new services to be rolled out in the coming years
- support for global account lockout
About 10,000 applications word-wide access the directory. Among them, 10 were identified as critical for the transition, mostly provisioning applications.
Figure 1: Existing DSEE topology with 4 masters, 6
read-only replicas in each DC + 2 read-only replicas in remote branches
OUD provides several options to transition from DSEE. For this project, the DSEE and OUD topologies have to cohabit for 6 months in production as transition was planned incrementally on a geo basis. Furthermore, client applications heavily relies on password policy, so strong data consistency is required across the 2 topologies during transition. Based on that, tightly-coupled cohabitation via the replication gateway was selected. In addition to that, this strategy provides smooth and incremental transition without interruption of service.
Transition analysis and design was conducted over a period of 1 week. The goal of this critical phase was to adapt schema, configuration and data to OUD, define and automate procedures to deploy an OUD directory server able to deliver a service equivalent to existing DSEE servers in staging area. Business knowledge of directory data was really important during this phase. Transition of the replication topology was also addressed during this phase.
4 OUD servers have been deployed as a directory backbone. Actual roll-out of other OUD servers (20+ servers all over the world) will be performed incrementally over the next months.
Transition analysis and design heavily relied on the
transitioning tools provided with OUD. Transitioning to OUD implies adapting
ODSEE configuration (and sometimes the data) to the OUD format.
The OUD delivery provides tools to automatically adapt ODSEE configuration and data. The few configuration elements that can't be adapted automatically are identified by the OUD diagnostic tools and require manual adaptation.
The work was broken down into the following steps:
OUD ships with the ds2oud tool able
to diagnose DSEE configuration, schema and existing user data. You can use this
tool to identify areas that are likely to require special attention during the
Many of the differences spotted by this tool can be automatically migrated, especially those related to schema and server configuration. Others issues, related to advanced server configuration and user data requires manual intervention as they often require business knowledge or architectural decisions.
In order to run this tool, you must have administrative access to one running DSEE instance. For sake of security, one additional DSEE master server was deployed specifically for that purpose so that production systems are not impacted at all by this diagnostic phase.
2.2 Migrating the schema, configuration and data to a reference OUD instance
LDAP schemas were compared first. Custom schema extensions were properly imported to the OUD side. However, we faced a couple of issues with some experimental schemas, e.g. RFC 2307: OUD ships with the latest versions of the RFCs, but in this case, DSEE was using an older and incompatible version of the schema. A huge amount of existing LDAP entries were relying on the older schema, so we decided to use this old schema on OUD too.
We also used ds2oud to migrate the server configuration. The -F option is used to produce a batch file containing a list of configuration changes to be applied to the OUD directory server. This batch file was reused to setup subsequent OUD servers during server roll-out.
Global parameters, database suffixes, indexes, global password policy were migrated automatically.
Note: Support of global password policy and account lockout during cohabitation of DSEE and OUD via the replication gateway requires that DSEE use the 'DS6' password policy mode. For this deployment, the DSEE topology was already using this mode, so no additional action was required on that side.
For this project, most of the transition effort was related to user data migration: LDAP was deployed more than 15 years ago. LDAP entries were provisioned over time by a huge variety of applications. The number of provisioning applications is now quite limited. However, it appeared that about 5% of the LDAP entries did not strictly conform to the LDAP schema and/or to the LDAP standard. By default, OUD strictly enforce the LDAP standard and the LDAP schema, including attribute value syntax check. DSEE does not check attribute value syntax.
Based on that, it was decided to use that transition project to conduct a detailed data assessment and sanitization. This assessment was completed over the 1 week period as originally planned. However, it required involvement of additional stakeholders to figure out whether entries that did not match the LDAP schema were correct or incorrect from a business and application perspective.
Here are a few road blocks hit and addressed:
- Most LDAP entries contained more than one structural LDAP object class
This non-standard setting is accepted by ODSEE but by default, it is rejected by OUD. That check was relaxed on OUD because applications creating these entries could not be modified.
- Some entries contained attribute type extensions (e.g criteria:criteria;x-custom-extension) that violate LDAP standards because they contain underscores.
That check was relaxed on OUD as well
- Some DNs and telephoneNumber attributes contain incorrect values
These values were cleaned up on DSEE.
The transition strategy chosen is based on the replication protocol. It provides strong data consistency and all data including directory metadata are replicated back and forth between DSEE and OUD.
For that project, directory metadata, mainly access controls, could be replication w/o any problem, However, we had to adapt directory metadata related to account-based resource limits settings:
Some DSEE entries contain the following resource limit attributes, namely nsSizeLimit, nsTimeLimit, nsLookThroughLimit, nsIdleTimeout. Corresponding attributes on OUD are ds-rlim-size-limit, ds-rlim-time-limit, ds-rlim-lookthrough-limit,ds-rlim-idle-time-limit. In order to replicate the functionality correctly, the OUD schema was modified so that each DSEE attribute name related to resource limits is declared as an alias name for each corresponding OUD attribute.
A few OUD servers were deployed in staging area and
configured as defined above. Then traffic from key customer applications identified
during the transition assessment was redirected to the OUD infrastructure.
This phase is very important to validate the changes above and identify behavioral differences between OUD and DSEE that are not always detected automatically. We detected a few problems that required additional configuration changes on the OUD side. These changes were added to the list of configuration to be applied to OUD servers.
Here are a few road blocks hit and how we addressed them:
- Few applications were performing unindexed operations. By default, OUD reject such searches.
For technical reasons, it was not acceptable to create the appropriate indexes to suppress unindexed searches: For this project, we recommend to disable privileges leading to aci behavioral differences between OUD and ODSEE.
- Attributes present in the rootDSE and in the schema are flagged as operational, so they are not returned to client applications unless they are explicitly specified in the search attribute list. On ODSEE, these attributes are systematically returned.
Client applications relied on the DSEE behavior; we had to modify the OUD configuration so that rootDSE entries are returned like user attributes
- By default, in OUD, unauthenticated users are not granted access to cn=schema nor the rootDSE.
Appropriate access controls was added to OUD
In such medium/large replication topology, it is advisable to separate the
directory server and replication server instances into separate JVMs, and to
limit the number of replication servers:
2.4 Deploy additional instances in a replicated topology
- 4 instances having both Directory server and Replication Server roles are
deployed, 2 in each data center.
- The number of directory server instances serving search operations could be reduced to 4 due to superior OUD performances.
- 2 replication groups are defined so that DSs in one data center preferably connect to a RS within the same data center.
- 2 directory servers deployed in remote branches are configured as read-only replicas to conform to corporate rules. These 2 servers can connect to replication server from either data center to receive updates.
Note: Unlike DSEE topology, every directory server running in the main data centers are read-write master. The corresponding servers in DSEE handled a limited write traffic that was redirected to DSEE masters via referrals. The new OUD topology eliminates the need for referrals.
Figure 2: New OUD topology with 4 RS+DS, 4 DS in each DC + 2 read-only DS in remote branches
The main outcome of the transition analysis and
design phase is a collection of commands to be applied to set up an OUD
directory server instance.
Additional OUD directory server instances were setup then configured. The Test to Production feature provided by OUD is used to clone configurations to pre-production environment.
Data are exported from DSEE (with the --opends flag) to preserve replication metadata, so that replication can be established between the 2 environments. Data are imported in a single OUD directory server, then replication was enabled between servers and database files are copied to the other servers. In the customer environment, this initialization strategy was preferred over an over-the-network full initialization.
The minimum version required for tightly coupled coexistence is ODSEE 11g Release 1 (11.1.1) for the ODSEE master that communicates directly with the replication gateway. However, the rest of the ODSEE topology does not need to be uniformly based on this version and remain in 6.x, so we upgraded 2 DSEE masters to the latest ODSEE 11gR1 PS2 (220.127.116.11.0). Instances were automatically upgraded in place without having to copy, export or import anything. An alternate solution would have been to deploy 2 new ODSEE 11g instances as replication gateway companion.
At that stage, 2 replication gateways are deployed as described in the OUD administration guide. This is the recommended setting to avoid single point of failure.
Backup strategy was adapted to reflect the new hybrid topology: In a replicated environment involving ODSEE and OUD, you must perform regular backups on the ODSEE side and on the OUD side. A backup must always be restored in the topology it is associated with.
3: Cohabitation DSEE/OUD
The current plan is to keep the DSEE-OUD cohabitation for 6 months as applications are progressively redirected to OUD.
coupled coexistence of OUD with ODSEE is achieved by deploying OUD and ODSEE in
a replicated topology using the “Replication Gateway”. The replication gateway
provides out-of-the-box live transition without service interruption.
This enables you to run OUD and DSEE in parallel in a mixed environment so that you can transition to OUD over time, validate your upgrade strategy application by application, and most importantly, without downtime.
Migration tools shipped with OUD addresses most of the transitioning issues. However, data cleaning and/or manual adaptation is sometimes required during this process, so some time should be allocated to address that during the transition analysis and design.
Oracle Unified Directory 11gR2PS2 (18.104.22.168) is available for download at http://download.oracle.com/otn/nt/middleware/11g/111220/ofm_oud_generic_22.214.171.124.0_disk1_1of1.zip. Other IdM R2PS2 components are available at http://www.oracle.com/technetwork/middleware/id-mgmt/downloads/index.html
Documentation for Oracle Unified Directory (OUD) 11gR2PS2 (126.96.36.199) is available at http://docs.oracle.com/cd/E49437_01/index.htm
Certification matrix is available at http://www.oracle.com/technetwork/middleware/id-mgmt/documentation/identity-access-111220certmatrix-2105036.xlsx
The ds2oud tool can be used to migrate DSEE configuration to OUD. However, a few additional OUD configuration changes might be required on a case by case basis to provide seamless transition for applications.
Here are the top 5 differences spotted during real transition projects and how to address them:
#1 Syntax checking
DSEE does not check attribute value syntax. OUD does, so attribute values must conform to the attribute syntax defined in the schema. For instance, an attribute with Boolean syntax can hold TRUE or FALSE values only. Ideally, data should be fixed by the customer. However, this is not always possible and takes time. Furthermore, somne client application may rely on the incorrect data.
To disable attribute value syntac checking on OUD, the invalid-attribute-syntax-behavior property in the global configuration can be changed to 'warn' or accept
#2 Structural objectclasses
Every user entry must have exactly one STRUCTURAL object-class to conform to Directory Standards. If a ODSEE entry has 0 or more than one structural object-class, the entry would be rejected during an import. ODSEE does not differentiate between the two object-class types, so this kind of schema inconsistency is commonly found in real deployments. It is recommended that you fix such user entries on the ODSEE side before transitioning to OUD.
Alternatively, you can disable this schema checking as described in https://blogs.oracle.com/sduloutr/entry/cohabitation_odsee_oud_schema_checking
# Schema and root DSE access
The root DSE entry (empty DN) and the schema entry (cn=schema) contains several operational attributes. DSEE systematically returns these attributes even when the client application does not list them explilcitely in the search attribute list. This does not conform to the LDAP standard. By default OUD does not return them. However, it is possible to configure OUD to behave like DSEE using the procedure described in https://blogs.oracle.com/sduloutr/entry/oracle_unified_directory_root_dse
#4 Unindexed searches
By default, OUD does not allow unindexed searches as they may impact overall directory services performances. DSEE does.
It is recommended to limit the number of unindexed searches by creating additional indexes. However, unindex searches are valid patterns in some specific situations.
It is possible to grant unindexed search privilege on a per user account basis as described in https://blogs.oracle.com/sduloutr/entry/cohabitation_migration_odsee_oud_privileges
#5 Anonymous access
By default, DSEE accepts requests with DN and no passsword. Such requests are processed as anonymous.
By default, OUD rejects such requests. This behaviour can be changed by setting the property bind-with-dn-requires-password to false in the global OUD configuration
OUD provides a privilege subsystem, which can be used to define capabilities that will be granted to users. The privilege subsystem works in conjunction with the access control implementation in the process of determining whether a user will be allowed to perform a certain operation.
In general, default OUD access control settings are stricter than ODSEE. Appropriate privileges must be added to achieve behavior that is equivalent to that of ODSEE. For instance, by default, OUD ACIs don’t allow users to reset another users’s password. Alternatively, it is possible to disable the privilege subsystem.
By default, normal users are not granted any of the privileges listed above. Therefore, if a user should be allowed to perform any of the associated operations, they must be granted the appropriate privileges. This can be done by adding the ds-privilege-name operational attribute to the user's entry. ds-privilege-name is a multivalued attribute, and if a user is to be given multiple privileges, then a separate value should be used for each one. When the virtual attribute subsystem is in place, it should also be possible to grant privileges to groups of users automatically by making ds-privilege-name a virtual attribute in those user entries.
As an example, the following modification can be used to add the proxied-auth privilege to the user cn=Proxy User,dc=example,dc=com:
dn: cn=Proxy User,dc=example,dc=com changetype: modify add: ds-privilege-name ds-privilege-name: proxied-auth
Granting privileges explictely to users may not be the optimal solution when OUD and ODSEE cohabit in a replication topology as the OUD-specific ds-privilege-name would be replicated by to ODSEE, so privileges can also be assign implicitely to a set of user based on group membership for example, using the notion of virtual attribute. I'll cover Virtual attribute in a subsequent post.
Alternatively, It is possible to disable those privileges leading to aci behavioral
differences between OUD and ODSEE. For instance, the unindexed-search privilege can be disabled so that users can
perform un-indexed searches. A privilege (unindex search checking in the example below) can be disabled using the following
dsconfig set-global-configuration-prop --add \disabled-privilege: unindexed-search -n
The list of OUD privileges is available here.
By default, OUD schema scheck is stricter than ODSEE. Schema checking is key for data sanity, however this might cause some trouble when "incorrect" data have to be imported into OUD or when incorrect data are replicated from ODSEE.
Generally speaking, it is not recommanded to disable schema checking and the data should be fixed whenever possible before import and on the ODSEE side when ODSEE and OU cohabit in the same replication topology. In some cases, this is not possible, so some specific checks can be disabled to accomodate with common inconsistency:
Structural object class unicity
Per LDAP standard, every LDAP entry must contain exactly one structural object class. In many deployments, some LDAP entries contain 0 or more than 1 objectclass and several LDAP server implementations do not enforce this. By default OUD does. Such check can be relaxed w/o know adverse effect by using the command below:
dsconfig set-global-configuration-prop --set \ single-structural-objectclass-behavior:accept -n
Attribute type names containing invalid characters
A few customers defined their own attribute types, using forbidden characters, e.g undercores, or leading digit in attribute names and/or in attribute type extensions (e.g 4you;x_bad_extension). Such check can be relaxed using the command below:
dsconfig set-global-configuration-prop --set \ allow-attribute-name-exceptions:true -n
Zero-length attribute value
Zero-length attribute values (that is, an empty string) is technically not allowed by the revised LDAPv3 specification, but some environments may require it for backward compatibility with servers that do allow it. Empty string can be explicitely allowed on a per LDAP syntax basis, using the example below for DirectoryString syntax:
dsconfig set-attribute-syntax-prop --syntax-name Directory\ String \ --set allow-zero-length-values:true -n
Oracle Unified Directory 11g Release 1 (11.1.1) provides a mechanism to replicate data between Oracle Directory Server Enterprise Edition and Oracle Unified Directory. Depending on the ODSEE features used, the OUD configuration may need to be adapted to provide the same service transparently to client application.
Both ODSEE and OUD provide ways to control ressources used by a directory user. The following limits are provided by OUD at the global configuration level:
The corresponding configuration attributes in ODSEE are search-size-limit, search-time-limit, look-through-limit, idle-timeout. Such configuration mapping is automatically provided by tools like ds2oud.
Server limits for search operations can also be controlled using special operational attribute values assoaicted with the user binding to the directory. These attributes are stored as part of the directory data, so they are replicated between ODSEE and OUD. Attribute names (and sometimes values) vary so the OUD configuration need to be extended to deal with that:
entries may contain the following resource
limit attributes: nsSizeLimit, nsTimeLimit, nsLookThroughLimit,
nsIdleTimeout. Corresponding attributes on OUD are
ds-rlim-lookthrough-limit,ds-rlim-idle-time-limit.In order to replicate
the functionality correctly, the
OUD schema (02-config.ldif) must be modified so that each DSEE attribute
related to resource limits is declared as an alias name for each
OUD attribute. An alias can be declared in an attributeType declaration as below:
attributeTypes: ( 188.8.131.52.4.1.26027.1.1.244 NAME ( 'ds-pwp-password-policy-dn' 'alias-for-ds-pwp-password-policy-dn')
On DSEE, -1 is used to disable a resource limit. On
OUD, 0 is used. One way to address this difference is to create a virtual
attribute on OUD to override the content of the OUD attribute when the value of
the DSEE attribute is equals to -1. A virtual attribute must be created for the
4 attributes mentioned, as described below:
dsconfig create-virtual-attribute --name "mapping nsTimeLimit " --type user-defined --set attribute-type:ds-rlim-time-limit \ --set filter:”(nsTimeLimit=-1)”\ --set conflict-behavior:virtual-overrides-real \ --set value:"0" --set enabled:true
dsconfig create-virtual-attribute --name "mapping nsLookthroughLimit" --type user-defined --set attribute-type:ds-rlim-lookthrough-limit --set filter:”(nsLookthroughLimit=-1)” --set conflict-behavior:virtual-overrides-real --set value:"0" --set enabled:true
dsconfig create-virtual-attribute --name "mapping nsIdleTimeout " \ --type user-defined --set attribute-type:ds-rlim-idle-time-limit \ --set filter:”(nsIdleTimeout=-1)”\ --set conflict-behavior:virtual-overrides-real \ --set value:"0" --set enabled:true
More information about account-based resource limits is available here.
Oracle Directory Server Enterprise Edition 11gR1 PS1(184.108.40.206.0) aka 7.1 using old Sun versioning is available for download at http://www.oracle.com/technetwork/middleware/downloads/oid-11g-161194.html
The corresponding doc set is available at http://download.oracle.com/docs/cd/E20295_01/index.htm
For questions, please use the OTN dedicated forum at http://forums.oracle.com/forums/forum.jspa?forumID=877&start=0
DSEE - Directory Services Enterprise Edition, provides a Web Services access (HTTP/SOAP binding) using the DSMLv2 standard. Development of WS clients using the contract-first approach requires a corresponding WSDL file describing the service.
I recently wrote such WSDL file. I had to modify slightly some regular expressions present in the DSML types as IDEs like NetBeans or JDeveloper complain during xml binding generation, that's the reason why it may worth sharing this. An updated WSDL file is available here. You can use it as such for Web Service client code generation but don't forget to override the service port binding at the end of the file.
I am Sylvain Duloutre, I work as a Software Architect in the Oracle Directory Integration Team, the customer-facing part of Directory Services & Identity Management Product Development, working on Technical Field Enablement.
The views expressed on this blog are my own and do not necessarily reflect the views of Oracle.