Leave a Comment:
34 comments
Password change from AD to OIM can be achieved only via password sync connector.
Other option for password sync could be AD -> OID -> OIM (where password sync from AD to OID using AD-OID integration and then from OID to OIM using LDAPSync) – This will be less preferred route .
Password Sync is better way as this is immediate , why don’t you want to use password sync ?
ReplyAtul Thanks for your reply.
It really helps as always
Actually our Active Directory team is not happy with internal architecture of ‘password synch connector’. During password change it put internal lock which is not considered good here.
One last suggestion.
I was thinking in below direction but do not have experience on any other product other than OIM.
Like I integrate anyone componenet of eSSO with AD so that esSSO password and AD password get in synch. Then integrating OIM with eSSO.
Process might be password from AD >> eSSO>>OIM.
Kindly ignore my ignorance and suggest.
Thanks Again!
Atul,
How about the other way around? OIM to AD sync. Our set up is as follows.
Our college maintains an Oracle ID for every past, current of course future students, faculty, staff, etc.
Our department is currently managing authentication to our department lab systems in AD. This involves importing users each session into AD and setting a temp passwords with a require password change first log in.
This works great except the user accounts are based on the college’s eID. Meaning the samaccountname is the same as the name in the college’s ID management system.
This actually causes a lot of confusion since everyone typically chooses two different passwords for the same user name.
So I was wondering if it is possible to set up a one way password sync from the Oracle IDM to AD.
Seeing as our department only has a small subset of the overall users this makes even more sense to me.
This is how I am hoping it would work. I get registration data for our department. I import new users based on their eID, set a default password for each new user, set user account control not to require password change, never expire. Then behind the scenes the through the connector server on the DC each users password is updated with the password stored in OIM.
That way users can authenticate to our lab systems using the same password they use for everything else throughout the college.
I have seen many examples of syncing like you initially show but none so far the way I am hoping to get things to work.
Is this possible?
Thanks,
Don
Reply@ Don,
From your comment it is not clear which product with in IDM stack do you use to sync data from Oracle to AD. There are two things I can think of OID & OIM and both support password sync from OID/OIM to AD .
Tell me which Oracle Product you use for authentication (where username/password is store) so I can tell you how to sync password from that source to AD or vice versa.
ReplyAtul,
Sorry for the delayed response. I was waiting to hear back what product we are running from our service center. I though we had moved up to Oracle but we still are currently on Sun Identity manager 5.2 patch 4.
Don
Reply@ Praveen, What help do you need to install AD password SYNC for 11gR2 ? Password Sync is still 9.1.1.5 Patch Set 7 (9.1.1.5.7) (as of Aug 2013) which is available at http://www.oracle.com/technetwork/middleware/id-mgmt/downloads/connectors-101674.html
Documentation is available at http://docs.oracle.com/cd/E11223_01/doc.910/e11218/install_config.htm#CBDJFBCA Install Password Sync Connector on every Domain Controller Server in AD
ReplyI’m looking for part 2 as well. Do you have a link for it? I can’t find it when i do a web search.
Thanks.
ReplyWhat type of privileges/role should the OIM service account have to allow password change? Can it be part of the Administrators?
ReplyTo add/delete account in AD. Yes it can be part of Administrators (but neeed to be – Just create/delete/modify)
ReplyI assume this is OIM administrators group but what would be the minimum Active Directory rights required for this account to synchronize the passwords between AD to OIM and vice versa?
Reply[…] Microsoft Windows, Microsoft Exchange, and Password Synchronization), I also posted about Password Synchronization for Active Directory that must be installed on all Microsoft Active Directory Domain Controllers, and is used to sync […]
ReplyAtul,
Can you please suggest how to configure Password Sync connector on a clustered environment, we have more then 2 OIM servers configured. Can we configure OHS server for Password Sycn.
Kindly suggest or provide any link to understand the configuration before implementing it.
Reply@ Ravi,
If you have more than one OIM managed server then either configure OHS server (mod_wl_ohs) or load balancer in front of OIM managed servers and ensure that you can access
http(s)://OHS_or_LBR:ohs_or_lbr_listen_port/spmlws/OIMProvisioning
During password sync connector install on domain controllers (you must install PWD sync on all DCs) when prompted for OIM Host and Port, use OHS or LBR listen host and list port number
Rest all is same as single node OIM password sync
ReplyIf you configure OHS then in OHS mod_wls_ohs there must be
mapping of /spmlws in mod_wl_ohs to OIM server /spmlws
SetHandler weblogic-handler
WebLogicCluster OIm_managedserver1:14000,OIm_managedserver2:14000
More on how to configure mod_wl_ohs at
ReplyCould you please provide instructions to use SSL for password sync where OIM is in a clustered environment front ended by a LB?
ReplyHi Atul,
We have an environment with OIM-AD pass sync installed on it and working fine. Users are allowed to change their passwords from both OIM and AD. But we sometimes get an error in OIM logs like “Error occurred while setting user password.” and when we check AD pass sync logs we saw that error is about password history. I have an opinion but not sure. When we change password from OIM we send it to AD by change user password task and when AD password is changed OIM-AD pass sync catches the process and sends new password back to OIM and this time OIM rejects the newly changed password with error “IAM-3030006:The following password policy rules were not met:Password must not be one of 4 previous passwords.”. Is there any solution to ignore this error which is actually not an error ?
Reply@ mathmut,
Change password policy in OIM that it allows previous passwords .
—–
Regards
Atul Kumar
Contact Us for Consulting Services
Atul,
Thanks but users are allowed to change passwords from both OIM and AD. If we allow previous passwords from OIM then we cannot control password history if user changes password from OIM self service.
ReplyHi atul,
I am using OIM 9i and am using custom built connector for AD and not the OOTB from oracle.But can i use the AD password sync connector provided by oracle along with my custom AD connector?
As i saw a note by you that MIcrosoft AD connector is a pre-requisite for AD passwrd sync connctor.
ReplyNirav, I don’t see any problem with that as long as users are synced between AD and OiM. I am sending you message directly on your mail or contact me via contact us.
Are you hitting any issue with password sync ?
Replyhi Atul,
I have mailed u ..
Yes user password is not getting synced.
“Unable to sync OIM user password.Run configparameter.exe is the status when i view in the event logs.
Regards,
Nirav
Hi Atul,
oim ad password sync logs are enabled for our system. But it causes a problem about disk space. Is there a log appender config for this or do we have to disable logging?
Regards,
Mahmut
Hi Atul,
As far as I have understood the requirement of AD Password Sync Connector, it is to sync the password changes from AD to OIM.
But in my environment when i change the password of a user account in AD, it immediately changes the password of the OIM user.
There is no Password Sync installed on the AD as far as i know. Even in the registry the folders that you showed in the screenshots are not present.
Have i not understood the purpose of the connector or is there something else i need to check in AD to make sure that the password sync connector is not installed?
ReplyHi Atul,
How can we sync passwords from AD to OIM for all existing users in AD. So they can access the self service portal using their AD credentials.
Best regards,
Salman
Hi Atul,
We imported the AD certificate recently in OIM and connected to AD via 636 port and we are not able to sync the users(data) from AD to OIM now both through 636 and 389 port but we are able to reset the password through 636. Can you tell me y the data is not syncing.
Recently AD has been migrated to 2008. OIm version is 9.1.0
ReplyIn what Mode AD is configured ? Trust Source or something else
For trusted source check scheduled job to pull users in running and there are no errors . Check OIM server log file to see sync is not happening . Create a user in OIM, assign AD account to this resource and check OIM logs .
ReplyHi,
I am facing the same problem as Mathmut where a password change in AD gets pushed back into OIM and creates a cycle. Password can be changed through both OIM and AD.
Anyone has any pointers on how to solve that problem?
Thanks
ReplyHi Everyone,
Can someone please provide suggestions on how to sync oracle E-Business Suite password with active directory? Thanks
Reply[…] Microsoft Active Directory (AD) to Oracle Identity Manager. – If you wish to synchronize user’s password from Microsoft Active Directory (AD) to Oracle Identity Manager (OIM) then you must install Microsoft Active Directory. […]
Reply