README.md revision a20efbd22b33014647993674c901e85b7aca2c42
/**
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright 2014 ForgeRock AS. All rights reserved.
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*/
Sample 2 - One-way LDAP -> Internal Repository
==============================================
The sample shows you reconciliation between the OpenIDM internal repository
and a local LDAP directory server, such as OpenDJ, with data flowing from
OpenDJ into the internal repository. No changes are pushed from OpenIDM
to OpenDJ.
The sample includes these configuration files.
* conf/provisioner.openicf-ldap.json configures the LDAP connector.
By default, the LDAP connector uses the following parameters:
"host" : "localhost",
"port" : 1389,
"principal" : "cn=Directory Manager",
"credentials" : "password",
"baseContextsToSynchronize" : [ "ou=People,dc=example,dc=com" ],
"attributesToSynchronize" : [ "uid", "sn", "cn", "givenName", "mail", "description", "telephoneNumber" ],
* conf/scheduler-recon.json configures a scheduler you can use to run
reconciliation periodically.
* conf/sync.json describes how identities in the directory server map to
identities in the internal repository target.
* conf/authentication.json specifies an additional "authModule" entry for "PASSTHROUGH"
authentication. This is used to allow the managed/user entries created from LDAP to
login with the credentials which remain in LDAP.
Setup OpenDJ
------------
1. Extract OpenDJ to a folder called opendj.
2. Run the following command to initialize OpenDJ.
$ opendj/setup --cli --hostname localhost --ldapPort 1389 --rootUserDN "cn=Directory Manager" \
--rootUserPassword password --adminConnectorPort 4444 --baseDN dc=com --acceptLicense --addBaseEntry \
--no-prompt --quiet
3. Load the Example.ldif file supplied in the data folder into OpenDJ.
$ opendj/bin/ldapmodify -a -c --bindDN "cn=Directory Manager" --bindPassword password --hostname localhost \
--port 1389 --filename /path/to/openidm/samples/sample2/data/Example.ldif
After you import the data, ou=People,dc=example,dc=com contains two user entries. Although all attributes to synchronize
can be multi-valued in LDAP, this sample defines only mail as a multi-valued attribute in OpenIDM, in order to match
the definition in the first sample.
Run The Sample In OpenIDM
-------------------------
1. Start the sample.
$ ./startup.sh -p samples/sample2
2. Run reconciliation once, creating users defined in OpenDJ in OpenIDM's internal repository.
$ curl -k -H "Content-type: application/json" -u "openidm-admin:openidm-admin" -X POST \
Alternatively, edit conf/scheduler-recon.json to enable scheduled
reconciliation:
"enabled" : true,
3. Request all identifiers in OpenIDM's internal repository. Use this command to see the results after reconciliation.
$ curl -k -u "openidm-admin:openidm-admin" "https://localhost:8443/openidm/managed/user?_queryId=query-all-ids&_prettyPrint=true"
{
"result" : [ {
"_id" : "678eb8f7-5e3f-4bef-b001-bc0f01353dae",
"_rev" : "0"
}, {
"_id" : "5e9534cb-c37e-48c0-9c1f-0782a7e2a9c0",
"_rev" : "0"
} ],
"resultCount" : 2,
"pagedResultsCookie" : null,
"remainingPagedResults" : -1
}
After you have created the managed/user entries you can use them to login to the UI at https://localhost:8443/openidmui/