Provisioning to two Active Directory Domains with Oracle Identity Manager – Connector Cloning – Part I

Posted by Vijayakumar Chinnasamy
February 14th, 2011

In many large enterprises, there can be two Active Directory Domains used (sometimes more than two), for example, one for India users and one for North America users (Considering the company has two major locations). This requires two AD Connector instances to be created in OIM, for provisioning and reconciliation purposes. OIM Connector Guide for Active Directory User Management provides following description for creating copies of the Connector to provision into multiple target systems. However detailed instructions are not available in the connector.

From the Oracle Connector Documentation (Oracle Identity Manager Connector Guide for Microsoft Active Directory User Management – Release 9.1.1 – E11197-11 – Page 186):

Section: 4.15.1

To create a copy of the connector:

  1. Create copies of the IT resource, resource object, process form, provisioning process, scheduled tasks, and lookup definitions that hold attribute mappings.
  2. Create a copy of the Lookup.AD.Configuration lookup definition. In the copy that you create, change the values of the following entries to match the details of the process form copy that you create.
      1. ROUserID
      2. ROUserManager
      3. ROFormName
      4. ROUserGUID
  3. Map the new process tasks to the copy of the Lookup.AD.Configuration lookup definition.

Initially I was not sure how I can setup the Cloning. I had two Active Directory Domains. When the users are created in OIM, access policies will identity to which one it has to be provisioned. However I have to setup two AD Connectors for these two domains.

Based on my investigation, following AD Connector Specific objects are involved:

  1. Copy of the IT Resource
  2. Copy of the RO
  3. Copy of the Process form
  4. Copy of the Provisioning Process
  5. Copy of the Scheduled Tasks
  6. Copy of the Lookup Definitions
  7. Copy of the Reconciliation Rule

First, you need to export the relevant objects as XML file, rename them by manually editing the XML file, then re-import them. One recommendation, is run your XML file through “xmllint –format” on Linux, that should make it more readable, so it is easier for you to edit (Thanks to Oracle Support for providing this – xmllint – information).

Here are the steps for cloning a connector – based on my personal experience:

  1. Identify all the connector Objects used by the Active Directory Connector (Mostly the below tables – but I am still not sure whether I covered all the objects – Please let me know if I missed any).
  2. Export these Objects using Deployment Manager Export Utility. This will create an XML File during the export.
  3. Once you have the XML file, you need to identity and replace the values for the objects in the XML file. This is the main reason you should be aware of the AD Connector Objects.
  4. Then, you can import this manipulated XML file into the OIM System. I faced errors during the import. I will write about those errors in the next post.

AD Connector Objects:

S. No. Object Type Object Name for AD Connector
1. IT Resource AD IT Resource
2. Resource Object AD User
4. Provisioning Process AD User
5. Scheduled Tasks Target Recon
6. Lookup Definitions Many…
7. Child Tables UD_ADUSER*

In my current OIM System, I have the default connector configured to the First AD Domain. The cloned connector is configured to the second AD Domain. I thought it was confusing. So, I had a question about this and received the below information from Oracle Support. Hope it is useful.

The best approach is to import the connector twice for the two domains by using the cloning method to clone twice, and leave the original objects installed unused. That way, when you upgrade to newer connector version on top the existing one, you will update the original unused template objects, then clone the change on to the two domain objects.

Second method is, keeping the installed AD Connector for one domain, and the clone the AD Connector for the second AD Domain, will also work.

I liked the approach of keeping two connectors cloned. You may like the other approach, but it is up to you to decide.

I will write a continuation of this post later. Until then

Vijay Chinnasamy

Comments (0)