0N/ASample 2 - One-way LDAP -> Internal Repository

3157N/A----------------------------------------------

0N/ACopyright (c) 2012 ForgeRock AS

0N/AThis work is licensed under a Creative Commons Attribution-

0N/ANonCommercial-NoDerivs 3.0 Unported License. See

0N/A

0N/AThe sample shows you reconciliation between the OpenIDM internal repository

0N/Aand a local LDAP directory server, such as OpenDJ, with data flowing from

0N/AOpenDJ into the internal repository. No changes are pushed from OpenIDM

0N/Ato OpenDJ.

0N/A

0N/ATo run this sample, launch OpenIDM with the sample configuration as follows:

0N/A$ /path/to/openidm/startup.sh -p samples/sample2

0N/A

0N/Aor follow the documentation in the Install Guide:

0N/Ahttp://openidm.forgerock.org/doc/install-guide/index.html#more-sample2

0N/A

1472N/AThe sample includes these configuration files.

1472N/A

1472N/A* conf/provisioner.openicf-ldap.json configures the LDAP connector.

0N/A By default, the LDAP connector uses the following parameters:

0N/A "host" : "localhost",

0N/A "port" : 1389,

1879N/A "principal" : "cn=Directory Manager",

1879N/A "credentials" : "password",

1879N/A "baseContextsToSynchronize" : [ "ou=People,dc=example,dc=com" ],

1879N/A "attributesToSynchronize" : [ "uid", "sn", "cn", "givenName", "mail", "description" ],

1879N/A* conf/scheduler-recon.json configures a scheduler you can use to run

1879N/A reconciliation periodically.

1879N/A* conf/sync.json describes how identities in the directory server map to

1879N/A identities in the internal repository target.

1879N/A

1879N/AData for this sample is stored in data/Example.ldif. After you import

1879N/Athe data, ou=People,dc=example,dc=com contains a single user entry for

1879N/Athe user from the first sample. Although all attributes to synchronize

1879N/Acan be multi-valued in LDAP, this sample defines only mail as a multi-

4141N/Avalued attribute in OpenIDM, in order to match the definition in the

4141N/Afirst sample.

4141N/A

4141N/AThe following curl command runs reconciliation once, creating users defined

1879N/Ain OpenDJ in OpenIDM's internal repository:

1879N/A

1879N/A$ curl --header "X-OpenIDM-Username: openidm-admin" --header "X-OpenIDM-Password: openidm-admin" --request POST "http://localhost:8080/openidm/recon?_action=recon&mapping=systemLdapAccounts_managedUser"

1879N/A

1879N/AAlternatively, edit conf/scheduler-recon.json to enable scheduled

1879N/Areconciliation:

1879N/A

1879N/A "enabled" : true,

1879N/A

1879N/AThe following curl command requests all identifiers in OpenIDM's internal

1879N/Arepository. Use it to see the results after reconciliation for example.

1879N/A

1879N/A$ curl --header "X-OpenIDM-Username: openidm-admin" --header "X-OpenIDM-Password: openidm-admin" "http://localhost:8080/openidm/managed/user/?_queryId=query-all-ids"

1879N/A