Thursday Oct 02, 2014

Using OUD Transformations to expose Operational attributes as Regular ones

Some (badly written) LDAP client applications expect to get operational attributes along with regular attributes when they search the directory w/o specifying attributes explicitely. The LDAP standards specify that operation attributes have to be explicitely requested in the search request. Alternatively, the special character + can be used to retrieve all the operational attributes w/o specifying explictely one by one.

OUD adheres to the LDAP standard, so operational attributes must be explicitely specified in a search request.
A specific option to facilitate migration from other directories can be used to expose schema related attributes (objectclasses, attributeTypes) as regular attributes. This option is described in one of my posts at

However, others operational attributes are not exposed. Don't worry, OUD transformations framework can help you to solve this specific integration problem:

Say you have an client application that expects the (operational)  pwdChangedTime attribute to be returned systematically as a user attribute.

First, setup a OUD proxy. The client application in question will point to that proxy, but others applications will not be subject to the (non-standard) directory server behaviour.

Then create a Add Outbound Transformation as below:

dsconfig create-transformation \
          --set client-attribute:pwdChangedTime=%pwdChangedTime% \
          --type add-outbound-attribute \
          --transformation-name Mymap \ 

Then put that transformation to a transformation workflow element:

dsconfig create-workflow-element \
          --set enabled:true \
          --set next-workflow-element:userRoot\
          --set transformation:myMap \
          --type transformations \
          --element-name myTransfo \ 

Insert your transformation workflow element to the appropriate workflow:

dsconfig set-workflow-prop \
          --workflow-name workflow1 \
  --set workflow-element:myTransfo \ 

Update the OUD Proxy schema, so that the pwdChangedTime is no longer declared as Operational. All you need to do is remove the  Usage DirectoryOperation and the NO-USER-MODICATION flag. Either modify the schema via LDAP or use the procedure below:

stop the OUD proxy
copy default schema
cp <OUD_HOME>/config/schema/01-pwpolicy.ldif <OUD_PROXY_INSTANCE>/OUD/config/schema
edit <OUD_PROXY_INSTANCE>/OUD/config/schema and change the pwdChangedTime definition as below:

 attributeTypes: ( NAME 'pwdChangedTime'
  DESC 'The time the password was last changed' EQUALITY generalizedTimeMatch
  ORDERING generalizedTimeOrderingMatch SYNTAX
  X-ORIGIN 'draft-behera-ldap-password-policy' )

restart the OUD proxy

At that stage, pwdChangedTime will be returned by a LDAP search with attribute list set to * or empty. 

Monday Jan 27, 2014

OUD 11gR2PS2 ( available

Oracle Unified Directory 11gR2PS2 ( is available for download at Other IdM R2PS2 components are available at

Documentation for Oracle Unified Directory (OUD) 11gR2PS2 ( is available at

Certification matrix is available at

Thursday Apr 18, 2013

Oracle Virtual Desktop Infrastructure and Unified Directory

Oracle Virtual Desktop Infrastructure offers a complete solution for managing and providing access to virtualized desktop environments hosted in the datacenter.  Oracle Virtual Desktop Instrastructure enables organizations to simplify administration, reduce operating costs, increase the utilization of existing IT assets, and boost security by moving from a tradtional desktop environment to a virtual desktop architecture.

Typically, you configure Oracle VDI to use the information held in a corporate user directory, like Oracle Unified Directory Server.

You can use the OUD setup or the ODSM to create a suffix holding users, eg,  ou=People,dc=oscr,dc=uk,dc=oracle,dc=com using existing schema.
Then create a few user entries with the fields User Name, First Name, Last Name, User ID and User Password.  So for my account it is

User Name : Sylvain Duloutre
First Name : Sylvain
Last Name : Duloutre
User ID : sduloutr
User Password : ****

To install Virtual Desktop Infrastructure, follow the install guide, then connect to the VDI Web UI using your preferred browser. Here is a screenshot showing the setup of the VDI server :

Next are 2 screenshots showing the LDAP settings and how they map to VDI:

As you can see there isn't actually a lot of configuration to do.  You  can now login to VDI from a Sunray or from the Oracle Virtual Desktop Client using the login name and password stored in OUD.

Thanks to Rob for VDI snapshots and testing.

Monday Apr 14, 2008

Sun Directory Masters Event 2008

The Sun Directory Masters Event 2008 took place in the Sun Grenoble Engineering Center on April 3-4, 2008. The goal of the Directory Masters Event is to promote the sharing of knowledge and best practices, bring together a well known global technical community, enabling sales and deployments of the Sun Java System Directory Server Enterprise Edition 6.x product.

The Directory Masters event targets three specific audiences with one unified theme of designing, implementing and managing Directory Services solutions. All target audiences were drawn from Sun and partner personnel (sales, service, and pro services).

I gave 2 presentations, one covering Sun Directory Proxy Server 6.x and a second one, more technical, on Virtual Directory capabilities of the product along with some "real" virtual use cases!


I am Sylvain Duloutre, I work as a Software Architect in the Oracle Directory Integration Team, the customer-facing part of Directory Services & Identity Management Product Development, working on Technical Field Enablement.

The views expressed on this blog are my own and do not necessarily reflect the views of Oracle.


« March 2015