README revision 4b4c3a2028eea921136be5b4717c69c074b4982e
43b4c41fbb07705c9df321221ab9cb9832460407Christian MaederSample 2 - One-way LDAP -> Internal Repository
c63ebf815c8a874525cf18670ad74847f7fc7b26Christian Maeder----------------------------------------------
456238178f89e5a3de2988ee6c8af924297d52d9Christian MaederCopyright (c) 2012 ForgeRock AS
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian MaederThis work is licensed under a Creative Commons Attribution-
456238178f89e5a3de2988ee6c8af924297d52d9Christian MaederNonCommercial-NoDerivs 3.0 Unported License. See
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maederhttp://creativecommons.org/licenses/by-nc-nd/3.0/
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian MaederThe sample shows you reconciliation between the OpenIDM internal repository
43b4c41fbb07705c9df321221ab9cb9832460407Christian Maederand a local LDAP directory server, such as OpenDJ, with data flowing from
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian MaederOpenDJ into the internal repository. No changes are pushed from OpenIDM
c9a7e6af169a2adfb92f42331cd578065ed83a2bChristian MaederTo run this sample, launch OpenIDM with the sample configuration as follows:
c9a7e6af169a2adfb92f42331cd578065ed83a2bChristian Maeder$ /path/to/openidm/startup.sh -p samples/sample2
e7757995211bd395dc79d26fe017d99375f7d2a6Christian Maederor follow the documentation in the Install Guide:
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maederhttp://openidm.forgerock.org/doc/install-guide/index.html#more-sample2
a1ed34933c266ce85066acb0d7b20c90cb8eb213Christian MaederThe sample includes these configuration files.
404166b9366552e9ec5abb87a37c76ec8a815fb7Klaus Luettich* conf/provisioner.openicf-ldap.json configures the LDAP connector.
b1f59a4ea7c96f4c03a4d7cfcb9c5e66871cfbbbChristian Maeder By default, the LDAP connector uses the following parameters:
ad270004874ce1d0697fb30d7309f180553bb315Christian Maeder "host" : "localhost",
4d56f2fa72e4aec20eb827c11ed49c8cbb7014bdChristian Maeder "port" : 1389,
4cb215739e9ab13447fa21162482ebe485b47455Christian Maeder "principal" : "cn=Directory Manager",
8ef75f1cc0437656bf622cec5ac9e8ea221da8f2Christian Maeder "credentials" : "password",
404166b9366552e9ec5abb87a37c76ec8a815fb7Klaus Luettich "baseContextsToSynchronize" : [ "ou=People,dc=example,dc=com" ],
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maeder "attributesToSynchronize" : [ "uid", "sn", "cn", "givenName", "mail", "description" ],
74eed04be26f549d2f7ca35c370e1c03879b28b1Christian Maeder* conf/scheduler-recon.json configures a scheduler you can use to run
d23b0cc79c0d204e6ec758dff8d0ba71c9f693f7Christian Maeder reconciliation periodically.
3e8b136f23ed57d40ee617f49bcac37830b58cabChristian Maeder* conf/sync.json describes how identities in the directory server map to
ef9e8535c168d3f774d9e74368a2317a9eda5826Christian Maeder identities in the internal repository target.
ef9e8535c168d3f774d9e74368a2317a9eda5826Christian MaederData for this sample is stored in data/Example.ldif. After you import
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maederthe data, ou=People,dc=example,dc=com contains a single user entry for
e593b89bfd4952698dc37feced21cefe869d87a2Christian Maederthe user from the first sample. Although all attributes to synchronize
63f0e65a37b95621334db9ee4ba0cd9d826f5c0fChristian Maedercan be multi-valued in LDAP, this sample defines only mail as a multi-
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maedervalued attribute in OpenIDM, in order to match the definition in the
1aee4aaddde105264c1faf394d88e302c05094ffChristian MaederThe following curl command runs reconciliation once, creating users defined
51d769d55d88dfa88bdf54bee78d8fa85a2deba8Christian Maederin OpenDJ in OpenIDM's internal repository:
7cc09dd93962a2155c34d209d1d4cd7d7b838264Christian Maeder$ curl --header "X-OpenIDM-Username: openidm-admin" --header "X-OpenIDM-Password: openidm-admin" --request POST "http://localhost:8080/openidm/recon?_action=recon&mapping=systemLdapAccounts_managedUser"
1aee4aaddde105264c1faf394d88e302c05094ffChristian MaederAlternatively, edit conf/scheduler-recon.json to enable scheduled
1aee4aaddde105264c1faf394d88e302c05094ffChristian Maederreconciliation:
dcbd32289a7bdf1e6edd06c6ab0698c6a9dbf37aChristian Maeder "enabled" : true,
f4a2a20e49f41b2afa657e5e64d9e349c7faa091Christian MaederThe following curl command requests all identifiers in OpenIDM's internal
dcbd32289a7bdf1e6edd06c6ab0698c6a9dbf37aChristian Maederrepository. Use it to see the results after reconciliation for example.
1cd4f6541984962658add5cfaa9f28a93879881bChristian Maeder$ curl --header "X-OpenIDM-Username: openidm-admin" --header "X-OpenIDM-Password: openidm-admin" "http://localhost:8080/openidm/managed/user/?_queryId=query-all-ids"