Installing and Configuring Oracle Virtual Directory

Purpose

This OBE tutorial describes and shows you how to perform the installation of Oracle Virtual Directory. This process involves installing the Oracle Virtual Directory Server and the Oracle Virtual Directory Manager. This OBE tutorial also lists the preinstallation requirements.

Time to Complete

Approximately 2 hours

Topics

This OBE tutorial covers the following topics:

	Overview
	Scenario
	Performing the Preinstallation Requirements
	Installing Oracle Virtual Directory Server
	Installing the Oracle Virtual Directory Manager
	Installing the Oracle Virtual Directory Manager Patch 10.1.4.0.1
	Configuring the Oracle Virtual Directory with Active Directory
	Configuring the Oracle Virtual Directory with Oracle Internet Directory
	Configuring the Oracle Virtual Directory with a Local Store Adapter
	Summary
	Related Information

Viewing Screenshots

Place the cursor over this icon to load and view all the screenshots for this tutorial. (Caution: Because this action loads all screenshots simultaneously, response time may be slow depending on your Internet connection.)

Note: Alternatively, you can place the cursor over each individual icon in the following steps to load and view only the screenshot associated with that step.

The screenshots will not reflect the specific environment you are using. They are provided to give you an idea of where to locate specific functionality in Oracle Virtual Directory.

Overview

Oracle Virtual Directory (OVD) provides real-time Internet and industry-standard Lightweight Directory Access Protocol (LDAP) and XML views of existing enterprise identity information, without synchronization or moving data from its native locations. OVD enables rapid deployment of directory-enabled application by providing a single, consistent LDAP view of data from multiple directories or even from nondirectory data repositories, such as relational databases. Because OVD virtualizes directory data, it enables better security and protection of directory data by serving as a directory firewall and enforcing access control policies.

Back to Topic List

Scenario

Linda is an administrator in charge of maintaining and securing Mydo Main’s user and organizational records. In addition, she is responsible for automating and regulating the access rights that these users and organizations have with the company’s resources. She is also accountable for ensuring that these users and organizations are able to access their resources through authentication, in an integrated heterogeneous environment. Employees of Mydo Main work with vendors and partners using an extranet, which is built by using Oracle Portal. These employees access internal Web applications using an intranet, which is developed using Internet Information Server (IIS). In Mydo main, Active
Directory (AD) is used as the corporate directory for storing the information of employees. Oracle Internet Directory (OID) is used to store the vendor and partner information and it supports the Vendor Portal.

To provide a single point of administration, Linda decides to implement Oracle Virtual Directory to integrate the AD and OID LDAP servers. By using OVD, Mydo Main produces a highly available directory services that provides a unified synchronous view for user data across LDAP servers, which enables better administration for Linda and other administrators.

The following image highlights the setup/architecture for the complete OAM-OVD integration scenario.

Back to Topic List

Performing the Preinstallation Requirements

Before you start the installation task, make sure that your system environment meets the following requirements:

Software Requirements

The system should include the following products:

Oracle Internet Directory 10g (10.1.4.0.1): The Remote Base for the directory information should be ou=vendors,dc=mydopartners,dc=com. For setting up the OID instance, note the following points:
- You can use staticports.ini from here.
- You can load the OID instance with dummy user data by using the Lightweight Directory Interchange Format (LDIF) files from here.
Active Directory: The Remote Base for the directory information should be cn=users,dc=mydomain,dc=com. For setting up the AD instance, note the following points:
- You can load the AD instance with dummy user data by using the LDIF files from here.
- You can use JXplorer (download from here), an open-source LDAP browser, to load and access directory data. This provides you with a consistent, third-party, standards-based perspective of data in the different directories. JXplorer uses templates to save connection settings for directories. It has been preconfigured with some templates that have been named using the convention: Directory Type – User Name. For example, to connect to Active Directory as the Administrator, select the ad(administrator) template in the Use a Template drop-down list, enter the password for the Administrator in the Security section, and then click OK.
- Before using JXplorer, you need to copy a customized connections.txt file (from here) to the installed location of JXplorer (for example, C:\Program Files\JXplorer).
- To load the data into AD by using JXplorer, perform the following steps:
  - Click Security > Trusted Servers and CAs.
  - Click Add Certificate and select the ten.mydomain.com_RootCA.cer certificate file.
  - Click Open and then click OK.
  - Connect to the ad(administrator) template and click OK.
  - Click LDIF > Import File and select the LDIF file for Active Directory and click Open.
- The employee_list.vbs file is a Visual Basic Script file that will be run by the Microsoft Scripting Engine. Running this script will change the password for the AD users to abcd1234.
Digital certificate: To operate against SSL/TLS encrypted directory server ports, Oracle Virtual Directory needs to recognize the signature of the certificate authority for the encryption certificate deployed on the encrypted directory server. Note that only the self-signed certificate (serverselfsigned) is generated during the OVD Server installation. You need to use the root certificate that contains the specific information for the Mydo Main certificate authority.
Installation files for the following products:
- Oracle Virtual Directory Server 10.1.4.0.1
- Oracle Virtual Directory Manager 10.1.4.0.1
- Oracle Virtual Directory Patch 10.1.4.0.1: To obtain this patch, perform the following steps:
  - Go to http://metalink.oracle.com.
  - Log in with your username and password.
  - Select Patch Number from the Quick Find drop-down list, enter 566797, and then click Go.
  - View the details for the patch and click Download.

Hardware Requirements

Item	Specification
Processor Type	Intel Xeon or Pentium IV
Processor Speed	2.4 GHz or higher
Number of Processors	1 or more (if required)
Memory	1 GB
Hard Disk Space	20 GB (initial size)
Operating System	MS Windows 2003 Server with SP1

Back to Topic List

Installing Oracle Virtual Directory Server

Oracle Virtual Directory is a multifunction virtual directory server. Support for Oracle Virtual Directory is enabled from the Oracle Virtual Directory Manager platform and other development tools for mapping scripts and Java plug-ins to enable advanced integration requirements. Oracle Virtual Directory Server and Oracle Virtual Directory Manager operate together in a client/server architecture. You need to first install Oracle Virtual Directory on a server and then install Oracle Virtual Directory Manager on any number of client administration workstations. To install Oracle Virtual Directory Server, perform the following steps:

In Windows Explorer, navigate to E:\install_files\OVD101401\Server and double-click the ovid1014.exe file. This launches the OVD installer.

Note: You can navigate to the custom path in your environment where the installer has been copied.

Review the introduction information and click Next.

Enter the path as E:\Oracle\OViD for installing Oracle Virtual Directory Server and click Next.

Review the options for creation of product icons and then click Next.

Review the information for initial configuration that will minimally configure the virtual directory and click Next.

For configuring the administrative gateway, provide the Server Name value as ten_vd1, change Admin Port to 8889, and then click Next.

Note: By not specifying the value for the Admin NIC IP field, you can manage the server instance from any of the available addresses on the host as long as the name of the server matches the name supplied from the OViD Management interface. The Secure (use SSL/TLS) option enables all management interactions to occur over encrypted channels. The certificate for this communication is self-signed from the Oracle Virtual Directory server by default.

Retain the Root DN as cn=admin and set the password to abcd1234.

Note: You can use your own values for all these parameters on the basis of any changes made to the default values.

Select the LDAPv3 check box as the listener and click Next.

The LDAP services work on a particular port number. Change the port number to 391 and do not select the Secure check box.

10.

Notice the default setting for the directory base suffix. Change the value to dc=mydomain,dc=ovd and click Next.

11.

Select the Yes option so that Oracle Virtual Directory is installed as a Windows service, and click Next.

12.

Review the installation summary and click Install.

13.

After the files are unpacked, SSL needs to be configured for the server. Review the initial SSL configuration information and click Next.

14.

Enter the Server Host Name as ten.mydomain.com and click Next.

15.

The blank certification form appears. Provide the following information for the self-signing certificate information and click Next.

Field	Value
Organizational Unit (OU)	Identity Management
Organization (O)	Oracle
Locality/City/Principality (L)	Redwood Shores
State (S)	California
Country (C)	US

16.

Review the summary information for the self-signed certificate. Click Next to generate the certificate.

17.

The server certificate is now successfully generated. Click OK.

18.

The Oracle Virtual Directory installation is now complete. Click Done to exit the installer.

Back to Topic List

Installing the Oracle Virtual Directory Manager

After performing the installation for the Oracle Virtual Directory Server, you need to install the Oracle Virtual Directory Manager. OVD Manager is a Java-based application that can be installed as a stand-alone application or as a plug-in to the Eclipse 3.0 platform. As a client application, OVD Manager can be installed on either the OVD server or on any other machine that communicates with the OVD server. A typical configuration is to install OVD Manager on one administrative desktop machine to manage all your OVD server instances.
OVD Manager communicates with the OVD server by using standard Web services operations (SOAP over HTTP/HTTPS) through the OVD admin port configured during the installation of OVD. To install the Oracle Virtual Directory Manager, perform the following steps:

In Windows Explorer, navigate to E:\install_files\OVD101401\Manager\Windows, and then double-click the ovidm1014.exe file. The OVD installer is launched.

Note: You can navigate to the custom path in your environment where the installer has been copied.

Review the introduction information and click Next.

Enter the path as E:\Oracle\OViD_Manager for installing Oracle Virtual Directory Manager, and then click Next.

Review the options for creation of product icons, and then click Next.

Click Next to accept the default workspace folder.

Review the installation summary and click Install.

The Oracle Virtual Directory Manager installation is now complete. Click Done to exit the installer.

Note: You need to restart the OVD Server after this step. To restart the OVD server, click Start > Settings > Control Panel > Administrative Tools, and double-click Services. Right-click the OViD_8889 service and select Start.

A single OViD Manager installation can manage multiple OViD projects and their associated servers. For this setup, you need to create a directory management project. In the OViD Manager, click File > New > Directory Management Project.

Note: You need to start the OVD Manager in this step. To start the OVD Manager, click Start > Programs > Oracle > OViD Manager > Oracle Virtual Directory Manager.

Enter OVD_Training as the Project Name and then click Finish to create the new project.

Note: Make sure that the Use default check box is selected in the Project contents region.

10.

To manage a virtual directory server configuration, the server object needs to be created in the OViD Manager. You need to create an instance in OViD Manager for the OViD Server. Click OVD_Training in the Server Navigator panel, and then click File > New > Virtual Directory Server.

11.

The New OViD Server window is displayed. Provide the following information for the new OViD Server and then select the Secure check box. Upon selecting this check box, the Certificate Trust Validation window is displayed.

Field	Value
Document Folder	/OVD_Training (default value)
Server Name	ten.mydomain.com
Manage Existing Server	<selected>
Host DNS/IP	ten.mydomain.com
Admin Port	8889
Admin DN	cn=Admin
Admin Pwd	abcd1234
Secure	<selected>

12.

Click Trust and then click Finish to accept the settings and create the new virtual directory server management instance.

13.

Notice that a new panel for the ten.mydomain.com server appears in the OViD Manager window.

Back to Topic List

Installing the Oracle Virtual Directory Manager Patch 10.1.4.0.1

After performing the installation for the Oracle Virtual Directory Server, you need to install the Oracle Virtual Directory Manager Patch 10.1.4.0.1. This patch enables you to use all the latest templates for all types of adapters. To install the Oracle Virtual Directory Manager patch, perform the following steps:

1.	To install the patch, stop the OVD Manager and the OVD server. Exit the OVD Manager and go to Start > Settings > Control Panel > Administrative Tools > Services to stop the service for the OVD Server.
2.	In Windows Explorer, you need to backup a set of JAR files. Browse to the E:\Oracle\OViD\plugins\lib location to back up the following files (to .bak format): CachePlugin.jar* DumpTransactions.jar UniqueEntry.jar Note: You can browse to any custom location where you have installed your OVD Server. In this tutorial, you can rename the files to *.bak to back up the files.
3.	Browse to E:\Oracle\OViD\server\lib location to back up the vde.jar file.
4.	You need to then copy vde.jar files from the OVD patch folder to the E:\Oracle\OViD\server\lib folder.
5.	You need to then copy the following .jar files from the OVD patch folder to the E:\Oracle\OViD\plugins\lib* folder: CachePlugin.jar DumpTransactions.jar UniqueEntry.jar
6.	Copy the following files from the patch directory to the E:\Oracle\OViD_Manager\plugins\com.octetstring.dme.core_10.1.4.01\lib folder: CachePlugin.jar DumpTransactions.jar UniqueEntry.jar vde.jar
7.	Copy the following files from the patch directory to the E:\Oracle\OViD_Manager\plugins\com.octetstring.dme.ui_10.1.4.01 folder: ui.jar uisrc.zip Note: Restart the OVD Server service from Start > Settings > Control Panel > Administrative Tools > Services.

Back to Topic List

Configuring the Oracle Virtual Directory with Active Directory

Adapters can be deployed using unencrypted LDAP communications over the standard port 389 or encrypted LDAP communications over standard port 636. To operate against SSL/TLS–encrypted directory server ports, the Oracle Virtual Directory must recognize the signature of the certificate authority for the encryption certificate deployed on the encrypted directory server. You will deploy an adapter against an encrypted directory server by checking the signature of the root certificate authority (CA) into the virtual directory so that the OViD Server will recognize and operate against directory servers with certificates signed by the CA. Next you will create and deploy an LDAP connector for the AD directory server using the encrypted port 636 for communications. To configure the Oracle Virtual Directory with AD, perform the following steps:

Navigate to E:\Oracle\OViD_Manager and double-click the OViDmanager.exe file. This application launches the OViD Manager.

Expand the OVD Training project and select the ten.mydomain.com server option within the project.

Right-click the ten.mydomain.com option and select Connect to Server. Use the same BIND DN and Password as abcd1234, and then select Manage > Server Certificates.

Click the Import Signed Cert tab.

Note: You can review the options for generating certificate requests for the server, and import/export certificates and keys. These options can be used to obtain a certificate for the OViD Server that is signed by a trusted CA.

In the Certificate Import Wizard, click Browse to select the ten.mydomain.com_RootCA.cer file from the Certificates directory and enter the Alias as RootCA. Then click Finish.

Note: You can select the certificate from any custom location where you would have stored the certificate file. For this environment, you can browse to C:\Documents and Settings\Administrator\Desktop\Certificates to locate the certificate file.

Notice the certificate details and click Close.

In OViD Manager, right-click Adapters, and then select New > LDAP Adapter.

You need to provide the configuration details for the new LDAP adapter. Provide the following information for the new LDAP adapter and click Validate.

Field	Value
Adapter Template	OAM/AD Adapter with Mapper
Adapter Name	ad_ten.mydomain.com
DNS Host Discovery	No (default)
LDAP Server	Server DNS/IP - ten.mydomain.com
	Port - 636
Server Proxy Bind DN	cn=administrator, cn=users, dc=mydomain, dc=com
Proxy Password	abcd1234
Pass Through Credentials	Always (default)
Secure SSL/TLS	<checked>
Kerberos Bind	<unchecked>
Remote Base	cn=users,dc=mydomain,dc=com
Mapped Namespace	ou=employees,dc=mydomain,dc=ovd

Notice the Certificate Trust Validation Window for certifying the server certificate. To use this certificate, click Trust.

10.

Notice that the SSL communication is confirmed with the server on port 636. Click OK to confirm.

11.

You can see that the LDAP server entry is now validated and is indicated with a green check mark. Click Finish to save the adapter.

12.

You need to save the adapter and configuration changes to the OViD Server. This procedure pushes all current configuration information to the virtual directory server rather than just the incremental changes. To perform the save operation, in the OVD_Training option, right-click the ten.mydomain.com server option and select Save All To Server.

Note: You can also click the ad_ten.mydomain.com adapter and right-click to select Save to Server just for the AD adapter.

13.

A confirmation appears before overwriting all the configuration information currently running on the OViD Server instance on ten.mydomain.com. Click OK to confirm this overwrite and restart the server.

14.

Click OK.

Note: Notice that the ten.mydomain.com server instance in the Server Navigator pane no longer shows an asterisk because the adapter is now deployed to the OViD Server.

15.

You can view the mapper plugin that is applied when you configure the AD adapter. To view this, click the ad_ten.mydomain.com adapter in the server navigation pane, click Plugins in the right pane, and expand All Operations to view in detail the mapper plug-in.

16.

You need to test the adapter after deploying it to the OViD Server. For testing this adapter, you use an LDAP browser native to the OViD Manager utility to examine both the virtualized interface and the adapter source data from the AD directory. In the Server Navigator pane, under the Browser panel, right-click the OVD_Training project option and select Refresh Current Node.

17.

Expand the structures under the OVD_Training section and click the ten.mydomain.com > Client View option, and then notice the new branch for ou=Employees,dc=mydomain,dc=ovd. The OViD Server then establishes a connection and requests the information from the AD server.

18.

Click the user CN=Charles Fox from the substructure of ou=Employees,dc=mydomain,dc=ovd and notice that his distinguished name (CN=Charles Fox,ou=Employees,dc=mydomain,dc=ovd) reflects the virtualized structure of the OVD (ou=Employees,dc=mydomain,dc=ovd) and not the structure of the AD server (CN=Users,DC=mydomain,DC=com) where his record resides.

Note: The distinguished name (DN) for the record reflects the virtual domain (dc=mydomain,dc=ovd) and not the real domain (dc=mydomain,dc=com) of their native AD repository.

Back to Topic List

Configuring the Oracle Virtual Directory with Oracle Internet Directory

You can also configure an adapter for OID in OVD Manager to virtualize data stored in the OID LDAP server. To configure Oracle Virtual Directory with OID, perform the following steps:

In OViD Manager, right-click Adapters, and then select New > LDAP Adapter.

You need to provide the configuration details for the new LDAP adapter. Provide the following information for the new LDAP adapter and click Validate.

Field	Value
Adapter Template	Oracle Internet Directory
Adapter Name	oid_ten.mydomain.com
DNS Host Discovery	No (default)
LDAP Server	Server DNS/IP - ten.mydomain.com
	Port - 13060
Server Proxy Bind DN	cn=orcladmin
Proxy Password	abcd1234
Pass Through Credentials	Always
Secure SSL/TLS	<unchecked>
Kerberos Bind	<unchecked>
Remote Base	ou=vendors,dc=mydopartners,dc=com
Mapped Namespace	ou=partners,dc=mydomain,dc=ovd

Note that the LDAP server entry is now validated and is indicated with a green check mark. Click Finish to save the adapter.

In the Directory Manager right-hand pane, notice that the Adapters tab has OID_ten.mydomain.com and the Adapter section in the left pane shows the new OID adapter with an asterisk. You need to save the adapter and configuration changes to the OViD Server. This procedure pushes all current configuration information to the virtual directory server rather than just the incremental changes. To perform the save operation, in the OVD_Training option, right-click the ten.mydomain.com server option and select Save All To Server.

Note: You can also click the oid_ten.mydomain.com adapter and right-click to select Save to Server just for the OID adapter.

Click OK.

You need to test the adapter after deploying it to the OViD Server. For testing this adapter, you use an LDAP browser native to the OViD Manager utility to examine both the virtualized interface and the adapter source data from the OID directory. In the Server Navigator pane, under the Browser panel, right-click the OVD_Training project option and select Refresh Current Node.

Expand the structures under OVD_Training section and click the ten.mydomain.com > Client View option and notice the new branch for ou=watermains,ou=Partners,dc=mydomain,dc=ovd. The OViD Server then establishes a connection and requests the information from the OID server. Notice the DN for Elise Sherman, one of the partner member in WaterMains organization.

Back to Topic List

Configuring the Oracle Virtual Directory with a Local Store Adapter

You can configure a local storage adapter that can reside on top of the other configured LDAP adapters to route information and data access. This can be done to restrict and simplify the end users accessing data from different LDAP sources, which can interface just one common top-level client view for all. To configure Oracle Virtual Directory with a local store adapter, perform the following steps:

In the OViD Manager, right-click Adapters, and then select New > Local Store Adapter.

You need to provide the configuration details for the new local store adapter. Provide the following information for the new adapter and click Finish.

Field	Value
Adapter Template	Local_Storage_Adapter
Adapter Name	TreeTop
Adapter Suffix	dc=mydomain,dc=ovd
Database File	data/localDB (default)
Cache Size	1000 (default)
Pwd Encryption	SSHA (default)
Backup File	backup/localDBbck (default)
Backup Hour	23 (default)
Backup Minute	45 (default)
File in rotation	7 (default)

Note that the TreeTop storage adapter is listed under the adapters in the ten.mydomain.com server. Right click the adapter and select Save to Server.

In the Save Configuration Wizard, select the TreeTop adapter, and then click Next.

Click Finish to restart the adapter.

Notice that the configuration is successfully saved to the server. Then, click OK.

You need to test the local adapter after deploying it to the OViD Server. For testing this adapter, you use a browser native to the OViD Manager utility to examine both the virtualized interface and the adapter source data from the other LDAP directories. In the Server Navigator pane, under the Browser panel, right-click the OVD_Training project option and select Refresh Current Node.

Expand the structures in the OVD_Training section and click the ten.mydomain.com > Client View option and notice the new branch for the top-level client view with dc=mydomain,dc=ovd.

You can expose the TreeTop adapter to clients by hiding OID and AD adapters so that all client operations are handled by using the local store adapter. For doing this, you need to unset the visibility attribute from the routing section for OID and AD adapters. To perform this task, for both the AD and OID adapter, in the General Settings section under Routing, select No from the Visibility drop-down list.

10.

In the Server Navigator section, right-click ten.mydomain.com and select Save All To Server.

11.

Ensure that the visibility option is set to Yes for the TreeTop adapter and the routing exclude binds from both the AD and OID adapters. To view the client view for the local adapter, in the Server Navigator pane, under the Browser panel, right-click the OVD_Training project option and select Refresh Current Node. You would be able to view the client view for the local storage adapter overlaying the other two adapters.

12.

In the OVD_Training section, right-click the Client View option and notice the new branch for the top-level client view with dc=mydomain,dc=ovd.

13.

Expand the structures in the OVD_Training section and click Client View > Import LDIF.

14.

Navigate to the E:\Input_files\LocalStorageAdapter folder and select the treetop_entry.ldif file and click Open.

Note: You can use a sample treetop_entry.ldif file from here.

15.

In the OVD_Training section, right-click the Client View option and notice the details for the top-level client view with dc=mydomain,dc=ovd.

Back to Topic List

Summary

In this lesson, you learned how to:

Back to Topic List

	Perform the preinstallation requirements
	Install the Oracle Virtual Directory Server
	Install the Oracle Virtual Directory Manager
	Install the Oracle Virtual Directory Manager Patch 10.1.4.01
	Configure the Oracle Virtual Directory with Active Directory
	Configure the Oracle Virtual Directory with Oracle Internet Directory
	Configuring the Oracle Virtual Directory with a Local Store Adapter

Back to Topic List