OUD 11g /12c - Pass Through Authentication (PTA) not Working when Configured to Use "entryUUID" as Destination DN
(Doc ID 2731500.1)
Last updated on DECEMBER 14, 2022
Applies to:
Oracle Unified Directory - Version 11.1.2.3.200625 and laterInformation in this document applies to any platform.
Symptoms
The Pass Through Authentication was setup using entryUUID as the destination DN, and it was found that it didn't work. It was determined that this works when using any other attribute, such as SAMAaccountName or userPrincipalName (AD as backend). ie;
Mapping:
Source DN dn: guid=*,<SUB>,dc=<SUFFIX_DN>
Destination DN dn: entryuuid=*,dc=<SUFFIX_DN>
Followed below steps to configure:
$ dsconfig -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n \
create-extension --type ldap-server \
--extension-name PTA_EXT \
--set remote-ldap-server-address:HOSTNAME_REMOTE.COM \
--set remote-ldap-server-port:REMOTE_LDAP_PORT --set enabled:true
$ dsconfig -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n create-workflow-element \
--set client-cred-mode:use-specific-identity \
--set enabled:true \
--set ldap-server-extension:PTA_EXT \
--set remote-ldap-server-bind-dn:'cn=<DS_ADMIN>' \
--set remote-ldap-server-bind-password:PASSWORD \
--set remote-root-dn:'cn=<DS_ADMIN>' \
--set remote-root-password:PASSWORD \
--type proxy-ldap \
--element-name
$ dsconfig -h LDAP.HOSTNAME.COM -p LDAP.PORT -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n create-workflow-element \
--set auth-provider-workflow-element:<LDAP.PORT> \
--set enabled:true \
--set user-provider-workflow-element:<BACKEND> \
--set pta-suffix:'o=<SUFFIX_DN>' \
--set pta-auth-suffix:'o=<SUFFIX_DN>' \
--set pta-join-rule:auth.kpLoginID=user.uid \
--set save-password-on-successful-bind:false \
--type pass-through-authentication --element-name <PTA_1>
$ dsconfig -h LDAP.HOSTNAME.COM -p LDAP.PORT -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n set-workflow-prop \
--workflow-name <BACKEND>0 \
--set workflow-element:<PTA_1>
Cause
To view full details, sign in with your My Oracle Support account. |
|
Don't have a My Oracle Support account? Click to get started! |
In this Document
Symptoms |
Cause |
4.2 Configuration 1: Pass-Through Authentication |
Solution |
References |