Pages

Sunday, August 29, 2004

OpenLDAP - Oracle Names Resolution


Unfortunately, Oracle doesn’t provide specific instructions for using any LDAP server other than their Oracle Internet Directory which is too large and complex for our simple needs. Further, Oracle also stated that Oracle Names Server is being deprecated in favor of LDAP. These instructions will help to configure OpenLDAP for Oracle Names Resolution.


Requirements :

  • RedHat Linux 9 installed and operational including network
  • RPMS installed from RedHat CDs
openldap-2.0.27-8
openldap-servers-2.0.27-8
openldap-clients-2.0.27-8


slapd.conf

Configure slapd.conf similar to the following:

include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/redhat/rfc822-MailMember.schema
include /etc/openldap/schema/redhat/autofs.schema
include /etc/openldap/schema/redhat/kerberosobject.schema
include /etc/openldap/schema/oidbase.schema
include /etc/openldap/schema/oidnet.schema
include /etc/openldap/schema/oidrdbms.schema

database ldbm
suffix "dc=example, dc=com"
rootdn "dc=example, dc=com"
rootpw {SSHA}fZyQ6cZiBwXU9bmU2u+pSqvNt/ok5UfW
directory /var/lib/ldap
index objectClass,uid,uidNumber,gidNumber,memberUid eq
index cn,mail,surname,givenname eq,subinitial


This configuration includes oidbase.schema, oidnet.schema and oidrdbms.schema, which include attribute definitions needed by our directory. These files can be grabbed from $ORACLE_HOME/ldap/admin directory, but we need to convert them to OpenLDAP format. The converted files are provided at the end under schemas. Copy them to /etc/openldap/schema directory. The password for rootpw is generated with slappasswd command.

Start OpenLDAP Server :

Change directory to /etc/openldap
# slapd –f slapd.conf --- You cannot stop after starting
# chown ldap.ldap slapd.conf
#/etc/rc.d/init.d/ldap start

Creating the Directory layout


Notice that we already defined the base DN using the suffix keyword in slapd.conf:

suffix "dc=example, dc=com"

We need to create an actual entry for this in the LDAP directory itself using an LDIF-formatted file and ldapadd. Create a file named directory.ldif containing:

dn: dc=example, dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
dc: example
o: Example, Inc.

Be sure to not leave any trailing spaces, as they may confuse ldapadd. Import LDIF entries into the directory using:

# ldapadd –x –h localhost –D 'dc=example,dc=com' –f directory.ldif –W

This will prompt for LDAP password. Type your rootdn password.

Next, create OracleContext in the directory under dc=example,dc=com to serve as a container for net service entries. Import the following LDIF entries using the above ldapadd command after creating a file named orclcontext.ldif containing:

dn: cn=OracleContext,dc=example,dc=com
objectclass: orclContext
cn: OracleContext

Now add net service entries. Create a file named netservice.ldif containing the following entries and import them using ldapadd command. A typical LDIF entry will look something like this for each database.

dn: cn=orcl,cn=OracleContext,dc=example,dc=com
objectclass: top
objectclass: orclNetService
cn: orcl
orclNetDescString: (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=hostname)(PORT=1521)))(CONNECT_DATA=(SID=ORCL)))

To delete from LDAP :
# ldapdelete -x -h localhost -D 'dc=example,dc=com' 'cn=orcl,cn=OracleContext,dc=example,dc=com' -W

Client Configuration :

You will also need to configure the client to use LDAP in its resolution order. Oracle client version 8.1.6 and above can use LDAP directly for lookups. If you have any clients lower than 8.1.6, you'll have to use the Oracle Names LDAP Proxy.

sqlnet.ora

NAMES.DEFAULT_DOMAIN=example.com
NAMES.DIRECTORY_PATH=(LDAP, TNSNAMES)


ldap.ora

DEFAULT_ADMIN_CONTEXT="dc=example,dc=com"
DIRECTORY_SERVERS=ldap-server:port
DIRECTORY_SERVER_TYPE=ad

Schemas :


$ cat oidbase.schema

attributetype ( 2.16.840.1.113894.7.1.1 NAME 'orclVersion'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.7.1.2 NAME 'orclOracleHome'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.7.1.3 NAME 'orclSystemName'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.7.1.4 NAME 'orclServiceType'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.7.1.5 NAME 'orclSid'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.7.1.6 NAME 'orclProductVersion'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )

objectClass ( 2.16.840.1.113894.7.2.2 NAME 'orclContainer' SUP 'top' STRUCTURAL
MUST ( cn ) )

objectClass ( 2.16.840.1.113894.7.2.3 NAME 'orclContext' SUP 'top' STRUCTURAL
MUST ( cn ) )

objectClass ( 2.16.840.1.113894.7.2.6 NAME 'orclSchemaVersion' SUP 'top' STRUCTURAL
MUST ( cn $ orclProductVersion ) )

attributetype ( 2.16.840.1.113894.3.1.12 NAME 'orclNetDescName'
EQUALITY distinguishedNameMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.12'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.13 NAME 'orclNetDescString'
EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

objectClass ( 2.16.840.1.113894.7.2.1001 NAME 'orclService' SUP 'top' STRUCTURAL
MUST ( cn )
MAY ( orclServiceType $ orclOracleHome $ orclSystemName $ orclSid $ orclNetDescName $ orclNetDescString $ orclVersion $ Description ) )


$ cat oidnet.schema

attributetype ( 2.16.840.1.113894.3.1.1 NAME 'orclNetSourceRoute'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.5'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.2 NAME 'orclNetLoadBalance'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.5'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.3 NAME 'orclNetFailover'
SYNTAX '1.3.6.1.4.1.1466.115.121.1.5'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.4 NAME 'orclNetSdu'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.5 NAME 'orclNetServer'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.6 NAME 'orclNetServiceName'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.7 NAME 'orclNetInstanceName'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.8 NAME 'orclNetHandlerName'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.9 NAME 'orclNetParamList'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )

attributetype ( 2.16.840.1.113894.3.1.10 NAME 'orclNetAuthenticationType'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.11 NAME 'orclNetAuthParams'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.14 NAME 'orclNetAddressString'
EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.15 NAME 'orclNetProtocol'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.16 NAME 'orclNetShared'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.17 NAME 'orclNetAddrList'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )

attributetype ( 2.16.840.1.113894.3.1.18 NAME 'orclNetProtocolStack'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.3.1.19 NAME 'orclNetDescList'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )

attributetype ( 2.16.840.1.113894.3.1.20 NAME 'orclNetConnParamList'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )

attributetype ( 2.16.840.1.113894.3.1.21 NAME 'orclNetAuthenticationService'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

objectClass ( 2.16.840.1.113894.3.2.5 NAME 'orclNetService' SUP 'top' STRUCTURAL
MUST ( cn )
MAY ( orclNetDescName $ orclNetDescString $ orclVersion $ Description ) )

objectClass ( 2.16.840.1.113894.3.2.4 NAME 'orclNetDescriptionList' SUP 'top' STRUCTURAL
MUST ( cn )
MAY ( orclNetDescList $ orclNetSourceRoute $ orclNetLoadBalance $ orclNetFailover $ orclNetShared $ orclVersion $ Description ) )

objectClass ( 2.16.840.1.113894.3.2.3 NAME 'orclNetDescription' SUP 'top' STRUCTURAL
MUST ( cn )
MAY ( orclNetAddrList $ orclNetProtocolStack $ orclNetSdu $ orclSid $ orclNetServer $ orclNetServiceName $ orclNetInstanceName $ orclNetHandlerName $ orclOracleHome $ orclNetAuthenticationType $ orclNetAuthenticationService $ orclNetAuthParams $ orclNetParamList $ orclNetConnParamList $ orclNetSourceRoute $ orclNetLoadBalance $ orclNetFailover $ orclNetShared $ orclVersion $ Description ) )

objectClass ( 2.16.840.1.113894.3.2.2 NAME 'orclNetAddressList' SUP 'top' STRUCTURAL
MUST ( cn )
MAY ( orclNetAddrList $ orclNetSourceRoute $ orclNetLoadBalance $ orclNetFailover $ orclNetShared $ orclVersion $ Description ) )

objectClass ( 2.16.840.1.113894.3.2.1 NAME 'orclNetAddress' SUP 'top' STRUCTURAL
MUST ( cn )
MAY ( orclNetAddressString $ orclNetProtocol $ orclNetShared $ orclVersion $ Description ) )


$ cat oidrdbms.schema

attributetype ( 2.16.840.1.113894.2.1.1 NAME 'orclDBtrustedUser'
EQUALITY distinguishedNameMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )

attributetype ( 2.16.840.1.113894.2.1.2 NAME 'orclDBServerMember'
EQUALITY distinguishedNameMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )

attributetype ( 2.16.840.1.113894.2.1.3 NAME 'orclDBEntUser'
EQUALITY distinguishedNameMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )

attributetype ( 2.16.840.1.113894.2.1.4 NAME 'orclDBEntRoleAssigned'
EQUALITY distinguishedNameMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )

attributetype ( 2.16.840.1.113894.2.1.5 NAME 'orclDBServerRole'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )

attributetype ( 2.16.840.1.113894.2.1.6 NAME 'orclDBTrustedDomain'
EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.2.1.7 NAME 'orclDBRoleOccupant'
EQUALITY distinguishedNameMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )

attributetype ( 2.16.840.1.113894.2.1.8 NAME 'orclDBDistinguishedName'
EQUALITY distinguishedNameMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.12'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.2.1.9 NAME 'orclDBNativeUser'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

attributetype ( 2.16.840.1.113894.2.1.10 NAME 'orclDBGlobalName'
EQUALITY caseIgnoreMatch
SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'
SINGLE-VALUE )

objectClass ( 2.16.840.1.113894.2.2.1 NAME 'orclDBServer' SUP 'orclService' STRUCTURAL
MAY ( userCertificate $ orclDBtrustedUser $ orclDBGlobalName ) )

objectClass ( 2.16.840.1.113894.2.2.2 NAME 'orclDBEnterpriseDomain' SUP top STRUCTURAL
MUST cn
MAY ( orclDBServerMember $ orclDBEntUser $ orclDBTrustedDomain ) )

objectClass ( 2.16.840.1.113894.2.2.3 NAME 'orclDBEnterpriseRole' SUP top STRUCTURAL
MUST cn
MAY ( orclDBServerRole $ orclDBEntRoleAssigned $ description $ seeAlso $ o $ ou $ orclDBRoleOccupant ) )

objectClass ( 2.16.840.1.113894.2.2.4 NAME 'orclDBEntryLevelMapping' SUP top STRUCTURAL
MUST cn
MAY ( orclDBDistinguishedName $ orclDBNativeUser ) )

objectClass ( 2.16.840.1.113894.2.2.5 NAME 'orclDBSubtreeLevelMapping' SUP top STRUCTURAL
MUST cn
MAY ( orclDBDistinguishedName $ orclDBNativeUser ) )

No comments:

Post a Comment