OUD 11g /12c - Pass Through Authentication (PTA) not Working when Configured to Use "entryUUID" as Destination DN
(Doc ID 2731500.1)
Last updated on NOVEMBER 30, 2020
Applies to:
Oracle Unified Directory - Version 11.1.2.3.200625 and laterInformation in this document applies to any platform.
Symptoms
We have attempted to setup the Pass Through Authentication to use entryUUID as the destination DN. This works when we use any other attribute, such as SAMAaccountName or userPrincipalName (AD as backend).
Source DN dn: guid=*,<SUB>,dc=<SUFFIX_DN>
Destinatnn DN dn: entryuuid=*,dc=<SUFFIX_DN>
Followed below steps to configure
1) dsconfig -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n \
create-extension --type ldap-server \
--extension-name PTA_EXT \
--set remote-ldap-server-address:HOSTNAME_REMOTE.COM \
--set remote-ldap-server-port:REMOTE_LDAP_PORT --set enabled:true
dsconfig -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n create-workflow-element \
--set client-cred-mode:use-specific-identity \
--set enabled:true \
--set ldap-server-extension:PTA_EXT \
--set remote-ldap-server-bind-dn:'cn=<DS_ADMIN>' \
--set remote-ldap-server-bind-password:PASSWORD \
--set remote-root-dn:'cn=<DS_ADMIN>' \
--set remote-root-password:PASSWORD \
--type proxy-ldap \
--element-name
dsconfig -h LDAP.HOSTNAME.COM -p LDAP.PORT -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n create-workflow-element \
--set auth-provider-workflow-element:<LDAP.PORT> \
--set enabled:true \
--set user-provider-workflow-element:<BACKEND> \
--set pta-suffix:'o=<SUFFIX_DN>' \
--set pta-auth-suffix:'o=<SUFFIX_DN>' \
--set pta-join-rule:auth.kpLoginID=user.uid \
--set save-password-on-successful-bind:false \
--type pass-through-authentication --element-name <PTA_1>
dsconfig -h LDAP.HOSTNAME.COM -p LDAP.PORT -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n set-workflow-prop \
--workflow-name <BACKEND>0 \
--set workflow-element:<PTA_1>
Destinatnn DN dn: entryuuid=*,dc=<SUFFIX_DN>
Followed below steps to configure
1) dsconfig -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n \
create-extension --type ldap-server \
--extension-name PTA_EXT \
--set remote-ldap-server-address:HOSTNAME_REMOTE.COM \
--set remote-ldap-server-port:REMOTE_LDAP_PORT --set enabled:true
dsconfig -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n create-workflow-element \
--set client-cred-mode:use-specific-identity \
--set enabled:true \
--set ldap-server-extension:PTA_EXT \
--set remote-ldap-server-bind-dn:'cn=<DS_ADMIN>' \
--set remote-ldap-server-bind-password:PASSWORD \
--set remote-root-dn:'cn=<DS_ADMIN>' \
--set remote-root-password:PASSWORD \
--type proxy-ldap \
--element-name
dsconfig -h LDAP.HOSTNAME.COM -p LDAP.PORT -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n create-workflow-element \
--set auth-provider-workflow-element:<LDAP.PORT> \
--set enabled:true \
--set user-provider-workflow-element:<BACKEND> \
--set pta-suffix:'o=<SUFFIX_DN>' \
--set pta-auth-suffix:'o=<SUFFIX_DN>' \
--set pta-join-rule:auth.kpLoginID=user.uid \
--set save-password-on-successful-bind:false \
--type pass-through-authentication --element-name <PTA_1>
dsconfig -h LDAP.HOSTNAME.COM -p LDAP.PORT -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n set-workflow-prop \
--workflow-name <BACKEND>0 \
--set workflow-element:<PTA_1>
Changes
Cause
To view full details, sign in with your My Oracle Support account. |
|
Don't have a My Oracle Support account? Click to get started! |
In this Document
| Symptoms |
| Changes |
| Cause |
| 4.2 Configuration 1: Pass-Through Authentication |
| Solution |
| References |