http://onlineAppsDBA.com

This can be a pretty daunting task at first (especially if you don't have a good grasp of basic LDAP syntax) but it is extremely beneficial in certain environments. For instance, we use our institution's AD for authentication but have our authorization rules set up on the OID and Oracle accounts for the end-users, giving the ma "single sign-on" experience. Very much worth the effort.

Thanks for sharing your experience with readers. Its true that its worth knowing LDAP syntax and basics.

Hi I feel integrating OID with AD is not a easy task.It is mentioned EAP (External Authentication plugin) can be used for AD-OID sync but I have few issues on this. In my environment I want to establish a single password concept for both thin client and thick client. EAP works good for thin client but does not support thick client. Hence it looks like password filter and server chaining are few options to resolve thick cient issue. Could you please give me an idea whether EAP can be used for both thick and thin client. In my environment the password is in AD and no where. IF EAP can be used then How it can be done?

Sisir,
We are migrating to http://onLineAppsDBA.com so In future I'll respond on on Line Apps DBA

I have posted your comment at this site and answer as well
http://onlineappsdba.com/index.php/2007/05/09/integrate-oid-with-ad-part-i/

so stay tuned for EAP on that site

Hi Sisir,
I have a small query,
We have AD as an Authenticating server and OID as an Authorization server with synchronization happening between them. The current scenario is that a user gets logged into a Java swing application that runs on client PCs with SSO and authenticated against AD of that Domain controller, This Swing app needs to connect to a few Web Services that we are trying to secure using OWSM but OWSM does not provide any Kerberos token authentication with AD in its current version. Therefore, I am thinking of creating a custom policy step in Java that will do the kerberos token authentication with AD and deploy that step in OWSM using their SDK. This token authentication will actually return me the user credentials which I then use to call the OID for authorization i.e to check if the credentials are valid to call the operations defined in WS. Is there a way if I can directly call OID with the credentials which btw the swing app can also provide me. And configure OID to pass the credentials to AD and then OID actually gives the Authentication and if authentication is succesful then OID executes the authorization step or else throws an error or exception etc. I hope I am making some sense. Just to let you know my knowledge of OID and AD is not that great but I am willing to spend more time if the scenario I have explained can be implemented.
Thanks for that buddy, Appreciate your efforts.
Sandy

Hi Atul,

Have you tried configuring Windows Native Authentication with OID. Since i have tried to , but metalink analyst has confirmed the KDC is not issuing the tickets.

Sine they dont have support , they are asking me to contact microsoft .

Incase if you had done this setup , can you please tell me what are the pre-requesites on windows 2003 Server Sp1 to be taken .

Regards

Bala

Hi Atul,
I have done the AD to OID Synchronization with an OID Version 10.1.2, which works fine.

The problem is that in AD there are some thousands of groups that we don't need in OID (the performance gets very bad). I would like the synchronization to only synchronize 15 named Groups. The Oracle Documentation is not very detailed on the search filter. Could you give me a hint on the syntax of the search filter to manage this task?

Thank you very much and regards

Pascal