Release 9.2
Part Number A96574-01
 Home |
 Book List |
 Contents |
 Index |
 Master Index |
 Feedback |
| Oracle Internet Directory Administrator's Guide Release 9.2 Part Number A96574-01 |
|
This chapter introduces the Oracle Directory Integration Platform, its components, structure, and administration tools.
This chapter contains these topics:
The Oracle Directory Integration Platform enables an enterprise to integrate its applications and other directories with Oracle Internet Directory. It provides all the interfaces and infrastructure for keeping data in Oracle Internet Directory consistent with that in application-specific and connected directories.
For example, an enterprise might need to do the following:
Depending on the type of integration needed, the Oracle Directory Integration Platform provides two distinct services:
Figure 27-1 shows the structure of the Oracle Directory Integration Platform.
Using Oracle Internet Directory as the central repository for diverse LDAP-enabled applications and connected directories can greatly reduce your time and resource costs for administration. To realize these benefits requires that these connected entities reliably both receive and provide the necessary information.
The following scenarios show how these needs may arise and how Oracle Directory Integration Platform can enable your enterprise to meet them:
Provisioning has to do with applications. It notifies them of changes to user or group entries or attributes that the application needs to track.
Synchronization has to do with directories rather than applications. It ensures the consistency of entries and attributes that reside in both Oracle Internet Directory and other connected directories.
This section contains these topics:
Synchronization enables you to coordinate changes among Oracle Internet Directory and connected directories. For all directories to both use and provide only the latest data, each directory must be informed of any change made in any connected directory. The goal of synchronization is to share and make consistent any change to directory information, including data elements other than a user's name, group memberships, or privileges.
Whenever you decide to connect a directory to Oracle Internet Directory, a synchronization profile must be created for that specific directory. It specifies the format and content of the notifications between Oracle Internet Directory and the connected directory.
Provisioning enables you to ensure that an application is notified of changes to user or group information. Such changes can affect whether the application allows a user access to its processes and which resources can be used.
Use provisioning when you are designing or installing an application that
A provisioning integration profile must be created during application installation. Use the Provisioning Subscription Tool to specify the necessary information and create that profile.
Provisioning and synchronization have important operational differences as described in Table 27-1.
In the Oracle Directory Integration Platform environment, connected directories are those whose contents are synchronized with Oracle Internet Directory through the Oracle Directory Synchronization Service.
Oracle Internet Directory is the central directory for all information, and all other directories are synchronized with it. This synchronization can be:
Certain attributes can be targeted or ignored by the synchronization service. For example, employee badge numbers appear in Oracle Human Resources but have no relevance to Oracle Internet Directory, its connected directories, or client applications. You might not want to synchronize them. On the other hand, employee identification numbers do have relevance, and, therefore, you might want to synchronize them.
Figure 27-2 shows the interactions between components in the Oracle Directory Synchronization Service.
The central mechanism triggering all such synchronization activities is the Oracle Internet Directory change log. It adds one or more entries for every change to any connected directory, including Oracle Internet Directory. The Oracle Directory Synchronization Service:
The Oracle Directory Provisioning Integration Service requires a provisioning profile for each application that is to be notified of changes in user or group information. Each provisioning profile:
The profile must be created when the application is installed, by using the Provisioning Subscription Tool.
| See Also:
"The Provisioning Subscription Tool" for information about the Provisioning Subscription Tool |
When changes in Oracle Internet Directory match the provisioning profile of an application, the Oracle Directory Provisioning Integration Service sends the relevant data to that application.
A legacy application--that is, one that was operational before the Oracle Directory Provisioning Integration Service was installed--did not subscribe in the usual way during installation. To enable such an application to receive provisioning information, a provisioning agent, in addition to the provisioning profile, must be developed. The agent must be specifically designed and built to translate the relevant data from Oracle Internet Directory into the exact format required by the legacy application.
Figure 27-3 shows these interactions, including the special case of a provisioning agent for a legacy application.
The Oracle directory integration server is the shared server process consisting of the Oracle Directory Synchronization Service and the Oracle Directory Provisioning Integration Service. It performs these functions:
The directory integration toolkit enables third-party vendors and developers to integrate their solutions with the Oracle Directory Integration Platform environment. Such vendors can include providers of metadirectories and provisioning solutions. The toolkit also allows application vendors whose products are based on or use Oracle technology to integrate provisioning of their users and groups with Oracle Internet Directory.
The toolkit includes the following interfaces, tools, and procedures:
This section describes the tools you can use to administer Oracle Directory Integration Platform. It contains these topics:
Oracle Directory Manager, a Java-based graphical user interface tool, enables you to administer the Oracle Directory Integration Platform by:
OID Control and OID Monitor enable you to start, stop, and monitor the Oracle directory integration server.
In Oracle Internet Directory, you can use OID Control and OID Monitor to control the directory integration server in the ORACLE_HOME where either the Oracle directory server or Oracle directory integration server are installed.
If Oracle Internet Directory installation is client-only, then the OID Control utility and OID Monitor are not installed. In this case, start Oracle directory integration server manually. In this configuration you can still use Oracle Directory Manager to learn the status of Oracle directory integration server.
You can use Oracle Enterprise Manager to monitor the status of various integration profiles. This integrated, comprehensive, systems management platform combines a graphical console, agents, common services, and tools to aid you in scheduling, monitoring, and administering your heterogeneous environment.
See Also:
|
This section describes a deployment in which the Oracle Directory Integration Platform integrates various applications in the MyCompany enterprise.
This section contains these topics:
This enterprise has the following components:
The enterprise requires:
Figure 27-4 illustrates the various components and their relationships to each other.
Figure 27-4 illustrates the following:
In this example, the MyCompany enterprise requires that all users be created in Oracle Human Resources. It is the responsibility of the Oracle Directory Integration Platform to propagate new user records to all other repositories in the enterprise.
Figure 27-5 illustrates the various interactions that help the Oracle Directory Integration Platform complete this task.
Figure 27-5 shows the creation of a new user in Oracle Human Resources, which, in turn, causes an entry for that user to be created in Oracle Internet Directory and the iPlanet Directory Server. It also shows the process of provisioning the user to access two applications in the enterprise: Oracle9iAS Portal and Oracle Internet File System. User creation and provisioning occur in the following manner:
Note that the Oracle Directory Integration Platform does not directly notify Oracle9iAS Portal or Oracle Internet File System about new users. This is because not all users created in Oracle Human Resources need access to all services. In this case, the deployment must explicitly provision the users to use these services, as in steps 5 and 6.
In this example, the MyCompany enterprise requires that any modification to user properties must be communicated to all components interested in such changes. Figure 27-6 illustrates the actions that Oracle Directory Integration Platform takes to meet this requirement.
Figure 27-6 shows the process by which Oracle Directory Integration Platform communicates the modification of user properties to all systems in the enterprise. The process is as follows:
In this example, the MyCompany enterprise requires that a user being deleted or terminated in Oracle Human Resources should automatically be denied access to all enterprise resources that are based on the directory service.
Figure 27-7 shows the flow of events during the deletion of users:
Figure 27-7 shows the process by which Oracle Directory Integration Platform communicates the deletion of users to all systems in the enterprise. The process is as follows:
Once all of the steps are completed, a deleted user in Oracle Human Resources can no longer access Oracle9iAS Portal or Oracle Internet File System.
|
 Copyright © 1999, 2002 Oracle Corporation. All Rights Reserved. |
|
