My Oracle Support Banner

How To Convert Attributes Containing Distinguished Name Values To The OVD Namespace (Doc ID 1122574.1)

Last updated on NOVEMBER 03, 2019

Applies to:

Oracle Virtual Directory - Version 10.1.4.3.0 and later
Information in this document applies to any platform.
***Checked for relevance on 20-Feb-2013***

Goal

This note explains how attributes containing Distinguished Name (DN) values can be converted by Oracle Virtual Directory (OVD).

OVD may be configured as a Virtual Proxy.
This means that a Namespace Mapping is executed by OVD, if the OVD Adapter Root Namespace is different from the Adapter Remote Base.

Example Adapter configuration:

    Adapter Root: dc=<OVD_DOMAIN>,dc=com
    Remote Base: dc=<REMOTE_DOMAIN>

An entry in the back-end Server with the DN "cn=<USERNAME>,dc=<REMOTE_DOMAIN>" would be returned by OVD with the DN value "cn=<USERNAME>,<OVD_DOMAIN>,dc=com" .

OVD converts the Remote Base part of the entry DN ( "dc=<REMOTE_DOMAIN>" )  to the Adapter Root ( "dc=<OVD_DOMAIN>,dc=com" ).


But there are some attributes that contain Distinguished Name values as well. (e.g.,  uniquemember, member, manager )

OVD by default passes the attribute values without performing a conversion.


In a common scenario, the attribute DN values are within the Adapter Remote Base Namespace, but it is also possible in some special cases that the attribute DN values are outside of the Adapter Namespace.
 

Example:

Adapter configuration:
    Adapter Root: dc=<OVD_DOMAIN>,dc=com
    Remote Base: dc=<REMOTE_DOMAIN>

User entry containing a DN value for the "manager" attribute within the Adapter Namespace:
    ------------------
    DN:  cn=<USERNAME>,dc=<REMOTE_DOMAIN>
    objectclass=inetorgperson
    cn=<USERNAME>
    sn=<USERNAME>
    manager= cn=<MANAGER_NAME>,dc=<REMOTE_DOMAIN>
    ------------------

User entry containing a DN value for the "manager" attribute outside of the Adapter Namespace:
    ---------------------
    DN: cn=<USERNAME>,dc=<REMOTE_DOMAIN>
    objectclass=inetorgperson
    cn=<USERNAME>
    sn=<USERNAME>
    manager= cn=<MANAGER_NAME>,dc=<ANOTHER_REMOTE_DOMAIN>
    ---------------------



For the most common scenario (attribute DN values within the Adapter Namespace), OVD provides the Adapter configuration parameter "DN Attributes". Attributes listed in this parameter will be converted following the same rule applied to convert the Distinguished Name of the entry, so that the part of the DN value containing the Adapter "Remote Base" will be converted to the OVD root.

For example:
"cn=<MANAGER_NAME>,dc=<REMOTE_DOMAIN>" will be converted to "cn=<MANAGER_NAME>,dc=<OVD_DOMAIN>,dc=com"



OVD is not able to convert attribute DN values outside of the Adapter Namespace out-of-the-box.

This means with the above example OVD would not convert the "manager" value of "cn=<MANAGER_NAME>,dc=<ANOTHER_REMOTE_DOMAIN>" even if the "manager" attribute is listed in the Adapter "DN Attributes" parameter.

The solution for this uncommon scenario would be to create a custom mapping script.

This Document addresses how to convert those DNs to the OVD Namespace.

Solution

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!


In this Document
Goal
Solution
References


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.