My Oracle Support Banner

OUD 11g /12c - Pass Through Authentication (PTA) not Working when Configured to Use "entryUUID" as Destination DN (Doc ID 2731500.1)

Last updated on DECEMBER 14, 2022

Applies to:

Oracle Unified Directory - Version 11.1.2.3.200625 and later
Information in this document applies to any platform.

Symptoms

The Pass Through Authentication was setup using entryUUID as the destination DN, and it was found that it didn't work.  It was determined that this works when using any other attribute, such as SAMAaccountName or userPrincipalName (AD as backend).  ie;

Mapping:

Source DN dn: guid=*,<SUB>,dc=<SUFFIX_DN>
Destination DN dn: entryuuid=*,dc=<SUFFIX_DN>

Followed below steps to configure:

$ dsconfig -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n \
create-extension --type ldap-server \
--extension-name PTA_EXT \
--set remote-ldap-server-address:HOSTNAME_REMOTE.COM \
--set remote-ldap-server-port:REMOTE_LDAP_PORT --set enabled:true

$ dsconfig -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n create-workflow-element \
--set client-cred-mode:use-specific-identity \
--set enabled:true \
--set ldap-server-extension:PTA_EXT \
--set remote-ldap-server-bind-dn:'cn=<DS_ADMIN>' \
--set remote-ldap-server-bind-password:PASSWORD \
--set remote-root-dn:'cn=<DS_ADMIN>' \
--set remote-root-password:PASSWORD \
--type proxy-ldap \
--element-name

$ dsconfig -h LDAP.HOSTNAME.COM -p LDAP.PORT -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n create-workflow-element \
--set auth-provider-workflow-element:<LDAP.PORT> \
--set enabled:true \
--set user-provider-workflow-element:<BACKEND> \
--set pta-suffix:'o=<SUFFIX_DN>' \
--set pta-auth-suffix:'o=<SUFFIX_DN>' \
--set pta-join-rule:auth.kpLoginID=user.uid \
--set save-password-on-successful-bind:false \
--type pass-through-authentication --element-name <PTA_1>

$ dsconfig -h LDAP.HOSTNAME.COM -p LDAP.PORT -D "cn=<DS_ADMIN>" -j PASSWD_FILE -X -n set-workflow-prop \
--workflow-name <BACKEND>0 \
--set workflow-element:<PTA_1>

 

 

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document
Symptoms
Cause
 4.2 Configuration 1: Pass-Through Authentication
Solution
References


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.