OUD and ObjectClass mapping Active Directory?

Similar Questions

• Where can I find and download the Active Directory users and computers for Windows 7

  Where can I find and download Active Directory users and computers for Windows 7

  Thank you

  Fred Tarpley

  Announcement is not a consumer product.  You'll be much more likely to get an answer as to where you can buy it on TechNet (for IT Pro)

  This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
  *

  http://social.technet.Microsoft.com/forums/en-us/home s/fr-U.S./Accueil
  http://social.msdn.Microsoft.com/Forum
  
  
  If you give us a link to the new thread we can point to some resources it

• separate authentication and authorization for Active directory groups

  Hi all

  After a long search and failure, I write the question.

  I use apex oracle 4.2 on windows server 2012 on oracle 12 c, all 64 bits.

  We have configured Microsoft Active directory with LDAP.

  in LDAP, we have a core group which is say A and an is down there students and the two groups.

  According to the staff, there are many other groups and students, there are a lot of groups.

  I created a mobile application, it has a main page that is publicly accessible without username and password.

  in this home page, I have a list that contains two elements, personnel and another is a student.

  When one of the list item, the login screen appears.

  now I want to control when the user clicks on the staff list, only personnel should be authenticated.

  If the end user is a student, it doesn't have to be authenticated.

  the same goes for the student list item, if the end-user click on list of students, only students must be authenticated.

  someone please guide me, I'm failed in research and testing.

  Thank you.

  Kind regards.

  Hi Maahjoor,

  Try this (it is written all the attributes for the user) by logging in to your schema to SQL Developer:

  DECLARE
  
    -- Adjust as necessary.
    l_ldap_host    VARCHAR2(256) := 'hct.org';
    l_ldap_port    VARCHAR2(256) := '389';
    l_ldap_user    VARCHAR2(256) := 'cn=hct\itnew';
    l_ldap_passwd  VARCHAR2(256) := 'itnew';
    l_ldap_base    VARCHAR2(256) := 'DC=hct,DC=org';
  
    l_retval       PLS_INTEGER;
    l_session      DBMS_LDAP.session;
    l_attrs        DBMS_LDAP.string_collection;
    l_message      DBMS_LDAP.message;
    l_entry        DBMS_LDAP.message;
    l_attr_name    VARCHAR2(256);
    l_ber_element  DBMS_LDAP.ber_element;
    l_vals         DBMS_LDAP.string_collection;
  
  BEGIN
  
    -- Choose to raise exceptions.
    DBMS_LDAP.USE_EXCEPTION := TRUE;
  
    -- Connect to the LDAP server.
    l_session := DBMS_LDAP.init(hostname => l_ldap_host,
                                portnum  => l_ldap_port);
  
    l_retval := DBMS_LDAP.simple_bind_s(ld     => l_session,
                                        dn     => l_ldap_user||','||l_ldap_base,
                                        passwd => l_ldap_passwd);
  
    -- Get all attributes
    l_attrs(1) := '*'; -- retrieve all attributes
    l_retval := DBMS_LDAP.search_s(ld       => l_session,
                                   base     => l_ldap_base,
                                   scope    => DBMS_LDAP.SCOPE_SUBTREE,
                                   filter   => l_ldap_user,
                                   attrs    => l_attrs,
                                   attronly => 0,
                                   res      => l_message);
  
    IF DBMS_LDAP.count_entries(ld => l_session, msg => l_message) > 0 THEN
      -- Get all the entries returned by our search.
      l_entry := DBMS_LDAP.first_entry(ld  => l_session,
                                       msg => l_message);
  
      << entry_loop >>
      WHILE l_entry IS NOT NULL LOOP
        -- Get all the attributes for this entry.
        DBMS_OUTPUT.PUT_LINE('---------------------------------------');
        l_attr_name := DBMS_LDAP.first_attribute(ld        => l_session,
                                                 ldapentry => l_entry,
                                                 ber_elem  => l_ber_element);
        << attributes_loop >>
        WHILE l_attr_name IS NOT NULL LOOP
          -- Get all the values for this attribute.
          l_vals := DBMS_LDAP.get_values (ld        => l_session,
                                          ldapentry => l_entry,
                                          attr      => l_attr_name);
          << values_loop >>
          FOR i IN l_vals.FIRST .. l_vals.LAST LOOP
            DBMS_OUTPUT.PUT_LINE('ATTIBUTE_NAME: ' || l_attr_name || ' = ' || SUBSTR(l_vals(i),1,200));
          END LOOP values_loop;
          l_attr_name := DBMS_LDAP.next_attribute(ld        => l_session,
                                                  ldapentry => l_entry,
                                                  ber_elem  => l_ber_element);
        END LOOP attibutes_loop;
        l_entry := DBMS_LDAP.next_entry(ld  => l_session,
                                        msg => l_entry);
      END LOOP entry_loop;
    END IF;
  
    -- Disconnect from the LDAP server.
    l_retval := DBMS_LDAP.unbind_s(ld => l_session);
    DBMS_OUTPUT.PUT_LINE('L_RETVAL: ' || l_retval);
  
  END;
  /
  

  NOTE: The DN parameter on line 29 requires exact unique name for the user. In addition, on line 37 to filter, you can use username i.e. "cn = firstname.lastname."

  You can specify a specific attribute must be extracted from the user in order by changing line 33 of the:

  l_attrs(1) := '*';
  

  TO

  l_attrs(1) := 'title';
  

  Then you can write a function based on above the code to extract the attribute LDAP user as follows:

  create or replace function fnc_get_ldap_user_attr_val ( p_username in varchar2
                                                        , p_password in varchar2
                                                        , p_attrname in varchar2 )
  return varchar2
  as
  
    -- Adjust as necessary.
    l_ldap_host    VARCHAR2(256) := 'hct.org';
    l_ldap_port    VARCHAR2(256) := '389';
    l_ldap_user    VARCHAR2(256) := 'cn='||p_username;
    l_ldap_passwd  VARCHAR2(256) := p_password;
    l_ldap_base    VARCHAR2(256) := 'DC=hct,DC=org';
  
    l_retval       PLS_INTEGER;
    l_session      DBMS_LDAP.session;
    l_attrs        DBMS_LDAP.string_collection;
    l_message      DBMS_LDAP.message;
    l_entry        DBMS_LDAP.message;
    l_attr_name    VARCHAR2(256);
    l_attr_value   VARCHAR2(256);
    l_ber_element  DBMS_LDAP.ber_element;
    l_vals         DBMS_LDAP.string_collection;
  
  BEGIN
  
    -- Choose to raise exceptions.
    DBMS_LDAP.USE_EXCEPTION := TRUE;
  
    -- Connect to the LDAP server.
    l_session := DBMS_LDAP.init(hostname => l_ldap_host,
                                portnum  => l_ldap_port);
  
    l_retval := DBMS_LDAP.simple_bind_s(ld     => l_session,
                                        dn     => l_ldap_user||','||l_ldap_base,
                                        passwd => l_ldap_passwd);
  
    -- Get specific attributes
    l_attrs(1) := p_attrname;
    l_retval := DBMS_LDAP.search_s(ld       => l_session,
                                   base     => l_ldap_base,
                                   scope    => DBMS_LDAP.SCOPE_SUBTREE,
                                   filter   => l_ldap_user,
                                   attrs    => l_attrs,
                                   attronly => 0,
                                   res      => l_message);
  
    IF DBMS_LDAP.count_entries(ld => l_session, msg => l_message) > 0 THEN
      -- Get all the entries returned by our search.
      l_entry := DBMS_LDAP.first_entry(ld  => l_session,
                                       msg => l_message);
  
      << entry_loop >>
      WHILE l_entry IS NOT NULL LOOP
        -- Get all the attributes for this entry.
        DBMS_OUTPUT.PUT_LINE('---------------------------------------');
        l_attr_name := DBMS_LDAP.first_attribute(ld        => l_session,
                                                 ldapentry => l_entry,
                                                 ber_elem  => l_ber_element);
        << attributes_loop >>
        WHILE l_attr_name IS NOT NULL LOOP
          -- Get all the values for this attribute.
          l_vals := DBMS_LDAP.get_values (ld        => l_session,
                                          ldapentry => l_entry,
                                          attr      => l_attr_name);
          << values_loop >>
          FOR i IN l_vals.FIRST .. l_vals.LAST LOOP
            DBMS_OUTPUT.PUT_LINE('ATTIBUTE_NAME: ' || l_attr_name || ' = ' || SUBSTR(l_vals(i),1,200));
            l_attr_value := l_vals(i);
          END LOOP values_loop;
          l_attr_name := DBMS_LDAP.next_attribute(ld        => l_session,
                                                  ldapentry => l_entry,
                                                  ber_elem  => l_ber_element);
        END LOOP attibutes_loop;
        l_entry := DBMS_LDAP.next_entry(ld  => l_session,
                                        msg => l_entry);
      END LOOP entry_loop;
    END IF;
  
    -- Disconnect from the LDAP server.
    l_retval := DBMS_LDAP.unbind_s(ld => l_session);
    DBMS_OUTPUT.PUT_LINE('L_RETVAL: ' || l_retval);
    DBMS_OUTPUT.PUT_LINE('Attribute value: ' || l_attr_value);
  
    return l_attr_value;
  
  END fnc_get_ldap_user_attr_val;
  /
  

  Then create an Application AI_USER_AD_TITLE tell you item request-> shared components.

  Create following procedure to define the point of application on the connection of the user in your APEX application:

  create or replace procedure ldap_post_auth
  as
  
    l_attr_value varchar2(512):
  
  begin
  
    l_attr_value := fnc_get_ldap_user_attr_val ( p_username => apex_util.get_session_state('P101_USERNAME')
                                               , p_password => apex_util.get_session_state('P101_PASSWORD')
                                               , p_attrname => 'title' );
  
    apex_util.set_session_state('AI_USER_AD_TITLE', l_attr_value);
  
  end ldap_post_auth;
  

  Change the "name of procedure after authentication' in your 'ldap_post_auth' authentication scheme

  Then modify the process in charge on your homepage to your application of PORTALS to:

  begin
  
      if :AI_USER_AD_TITLE = 'Student' then
          apex_util.redirect_url(p_url=>'f?p=114:1');
      else
          apex_util.redirect_url(p_url=>'f?p=113:1');
      end if;
  
  end;
  

  I hope this helps!

  Kind regards

  Kiran

• OAM and MS integration Active Directory on non-Windows Server environment

  I begin by saying that I'm dealing with a heterogeneous environment here where several systems are managed by different management levels. Our Oracle systems chose to go all * nix (Solaris Oracle and Red Hat Linux) and so we do not have a single Windows Server in our Oracle services and would really like to keep it this way that we prefer to keep a uniform platform in all of our Oracle servers.  However, the side our Department Office has chosen to use Microsoft Active Directory, and now we want to integrate and perform authentication against it for our protected sites OAM.  We are in the initial phase of installation, but we didn't want to implement a critical server like OAM on the Windows platform and focus rather OAM running on a Red Hat Linux server to Active Directory.  We will also use OID as run us portal but do not want to use it as our authority for Oracle products authentication (local policy is that Active Directory is the authority of the credential is valid on the site as we head towards the true Single Sign On our desktop and web applications).  I have a few questions.
  
  1. it is possible using native or to run the version of Windows of OAM?
  2. If you must run OAM on Windows to use AD for authentication, is it possible to install the Windows of OAM version as kind of an interface for our main server of OAM running under Red Hat Linux to make the AD Auth?
  3. can it be done using some kind of interface such as Oracle Virtual Directory in interface with the interface LDAP to Active Directory MS?

  Hi David,

  Answers online

  1. it is possible using native or to run the version of Windows of OAM?
  You can run all servers in OAM on * nix and just point to AD as a source of data on the machine: port AD running on OAM. There is no need for the components of the OAM on Windows.

  2. If you must run OAM on Windows to use AD for authentication, is it possible to install the Windows of OAM version as kind of an interface for our main server of OAM running under Red Hat Linux to make the AD Auth
  As above, this is not necessary.

  3. can it be done using some kind of interface such as Oracle Virtual Directory in interface with the interface LDAP to Active Directory MS?
  Yes, it is quite possible. Even if it is not necessary in your situation, it provides more flexibility front the user store with OVD, for example when the addition/change of name of Windows domains, or by specifying some branches for users and so on.

  Kind regards
  Colin

• My printer Dell all-in-one said that the Active Directory domain Service is unavailable?

  When I try to print the printer tells me there is no communication and that the Active Directory domain Service is not available

  Hi, Jinagroh,

  See if this helps:

  Domain Services Active directory unavailable? Unable to print in Word 2010 Starter

  http://answers.Microsoft.com/en-us/Windows/Forum/Windows_7-hardware/Active-Directory-domain-services-unavailable-cant/8691ba4f-2657-4387-b1c0-67dcdd99eb7f

  Try to access the print administrator servers. To troubleshoot the device, try the following steps.

  1. click on start, click on devices and printers.
  2. right click on the item of the printer and click on solve.

• Firepower does not work when using the Active Directory group as a rule filter access control

  I am PoV of Cisco ASA with the power of fire with my client. I would like to integrate the power of fire to MS Active Directory. Everything seems to work properly.

  -Fire power user agent installation to complete successfully. Connection to AD work fine. The newspaper is GREEN.

  -J' created a Kingdom in FireSight and you can download users and groups from Active Directory.

  -J' created a politics of identity with passive authentication (using the field I created)

  -Can I use the AD account "user" as a filter in access control rule and it work very well.

  However, if I create the rule of access control with AD Group', the rule never get match. I'm sure that the user that I test is a member of the group. Connection event show the system to ignore this rule and the traffic is blocked by the default action below. It doesn't look like the firepower doesn't know that the user belongs to the group.

  I use

  -User agent firepower for Active Directory v2.3 build 10.

  -ASA 5515 software Version 9.5 (2)

  -Fire version 6.0.0 - 1005 power module

  -Firepower for VMWare Management Center

  Any suggestion would be appreciated. Thanks in advance.

  Hello

  You should check the download user under domain option. Download the users once belonging to a group is specified on the ad and then test the connection.

  Thank you

  Yogesh

• Message "Active Directory Domain Services unavailable"

  I am running Win7 Home Premium and get the message "Active Directory Domain Services is currently unavailable".  I can't print or to set up a printer from ALL software, or any of my software does see my printers.  As everyone with this problem, my computer is a doorstop expensive if I can't print.  I tried all the fixes listed and none of them work.  Microsoft is working on a fix?  If so, how long we see?

  Hello

  Thank you for the update.

  I suggest to refer to the following article and follow the steps.

  This tutorial is designed to help you identify and fix common printer problems in Windows, including print errors, print spooler errors, and other issues that could prevent you from printing. This tutorial does not cover printing problems related to specific programs. Printing problems can be caused by cables that are not properly connected, corrupt, drivers, incompatible drivers, the printer settings, missing updates and problems with your printer.

  Solve printer problems

  http://Windows.Microsoft.com/en-us/Windows/printer-problems-in-Windows-help#fix-printer-problems=Windows-7&V1H=win8tab1&V2H=win7tab1&V3H=winvistatab1&v4h=winxptab1

  Active Directory domain services ensure the storage of hierarchical data, structured and secure for objects in a network such as users, computers, printers, and services. Active Directory Domain Services are supported location and use of these objects.

  Reference:

  Can't print, copy or scan of my computer with my all-in-one printer

  http://support.en.kodak.com/app/answers/detail/A_ID/7359/kW/cannot%20print/selected/true

  Get back to us with the State of the question.

• ACS 5.1 using Active Directory to manage the strategy of network device Admin

  Hi guys, we have configured an ACS 5.1 and integrated with active directory Win2K3, we created two AD groups to manage devices network for administrators and one for operators (read-only), so we have configured a device admin strategy and the two groups work very well, but now we are facing a little problem any user that exists in the AD can connect (user exec mode) network devices and we want to cancel the connection with politics, but we do not know how.

  Is there a way to get a user authenticated against acs internal or external group, but at the user level, everything as you can make it to GBA 4.X?

  Thanks for your help!

  Best regards

  Oscar

  Yes, you can change that, it's a profile of shell by default. You must create a new one with privilege level "not in use" and select the new profile of the shell (no Directors or Operartors) under Default Device Admin > authorization profile > edit and make changes.

  I hope this helps.

• Replication Active Directory Windows or not

  Hi guys

  Any recommendation when replicating Active Directory of Windows?

  Do you recommend using Vmware replication for this?

  or is it better to deploy a second ad in the secondary instead of going through all the work site when you restore a replica a VM AD in this case?

  If the replication is the way to go do you recommend Guest OS standby (VSS)? or normal replication no VSS does support?

  Thank you very much

  someone knows when to use VSS or not in general?

  Thank you very much

  Hello

  Here is the statement of the document Vmware VMware vCenter Site Recovery Manager 5.1 Documentation Library link

  Protection and recovery of Active Directory domain controllers

  Do not use SRM to protect Active Directory domain controllers. Active Directory provides its own mode of technology and the restoration of the replication. Use the Active Directory replication technology and restore mode technology to manage situations of recovery after a disaster.

  Concerning

  Mohammed Emaad

• Active Directory certificate services installation failed with the following error: unknown mapping algorithm. 0 X 80091002 (-2146889726 CRYPT_E_UNKNOWN_ALGO)

  Hello

  I installed the role of CA of the authority in the installation, I want to use the existing root certificate when I try to import this certificate .pfx, that I have this error

  Active Directory certificate services installation failed with the following error: unknown mapping algorithm. 0 X 80091002 (-2146889726 CRYPT_E_UNKNOWN_ALGO)

  Anyone know what's wrong

  Thanks for help.

  This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
  *

  http://social.technet.Microsoft.com/forums/en-us/home s/fr-U.S./Accueil
  http://social.msdn.Microsoft.com/Forum
  
  
  If you give us a link to the new thread we can point to some resources it

• Multiple users Active Directory membership mapping group

  Hi all

  We got 4.2 ACS and two types of user access to our network:

  1_ we got some users in 'CiscoAdmins' Active Directory, corresponding group mapped Cisco ACS group is "switch Admins.

  2_ we also have some users in "VPN_Users' group Active Directory, corresponding mapped Cisco ACS group is"VPN_Users.

  In the "Command mapping" page on Cisco ACS 4.2, we put tte group 'CiscoAdmins' Active Directory mapping at the top "VPN_Users' Active Directory group mapping. So what happens is, if a user belongs to two "CiscoAdmins" and "VPN_Users" groups in Active Directory, users always goes in the "Switch_Admins" group in Cisco ACS.

  However for some users (who belong to two groups in Active Directory), we need to apply some IP allocation and specific authorization.

  The suggestiongs are welcome.

  Thanks in advance.

  Dumlu

  Yes, check ACS for belonging to the user group and it can determine if the user is a member of several groups and then map the corrosponding ACS group. Little additional material on the ACS group mapping

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/GrpMap.html#wp940538#wp940538

  -

  Note: Please rate the answer if it helped
  

• Cisco Secure ACS groups 5.1 Active Directory and RSA Authentication Manager 7.1 for profiles

  / * Style definitions * / table. MsoNormalTable {mso-style-name: "Table Normal" "; mso-knew-rowband-size: 0; mso-knew-colband-size: 0; mso-style - noshow:yes; mso-style-priority: 99; mso-style - qformat:yes; mso-style-parent:" ";" mso-padding-alt: 0 cm 0 cm 5.4pt 5.4pt; mso-para-margin: 0 cm; mso-para-margin-bottom: .0001pt; mso-pagination: widow-orphan; font-size: 11.0pt; font family: 'Calibri', 'sans-serif"; mso-ascii-font-family: Calibri; mso-ascii-theme-make: minor-latin; mso-fareast-font-family:"Times New Roman"; mso-fareast-theme-make: minor-fareast; mso-hansi-font-family: Calibri; mso-hansi-theme-make: minor-latin ;}"}

  Hello

  I'm deploying an ACS connected to an RSA AuthManager (that is connected to an Active Directory domain)

  I create several groups within the Active Directory server, I try to give to users for their groups different access rights.

  I tried to define an access policy "NetOp/NetAdm" and two authorization rules:

  Rule-1 AD - AD1:ExternalGroups contains all dir. INTRA/groups/NETOP 'Auth for net operators' 0

  Rule 2 AD - AD1:ExternalGroups contains all dir. INTRA/groups/NETADM 'Auth net admin' 0

  Default: refuse

  In the identity, I have configured the RSA identity source, so that users get authenticated by the RSA Authentication Manager.

  But I still refuse to get access, RSA authentication is successful, but the group membership, active directory does not work, even with the unix attributes or group principal defined for the user.

  My question is this valid configuration scenario? Is there another way to define several profiles according to the Group of users of external source?

  The stages of monitoring:

  Measures

  Request for access received RADIUS 11001

  11017 RADIUS creates a new session

  Assess Service selection strategy

  15004 Matched rule

  Access to Selected 15012 - NetOp/NetAdm service policy

  Evaluate the politics of identity

  15004 Matched rule

  15013 selected identity Store - server RSA

  24500 Authenticating user on the server's RSA SecurID.

  24501 a session is established with the server's RSA SecurID.

  24506 check successful operation code

  24505 user authentication succeeded.

  24553 user record has been cached

  24502 with RSA SecurID Server session is closed

  Authentication 22037 spent

  22023 proceed to the recovery of the attribute

  24628 user cache not enabled in the configuration of the RADIUS identity token store.

  Identity sequence 22016 completed an iteration of the IDStores

  Evaluate the strategy of group mapping

  15006 set default mapping rule

  Authorization of emergency policy assessment

  15042 no rule has been balanced

  Evaluation of authorization policy

  15006 set default mapping rule

  15016 selected the authorization - DenyAccess profile

  15039 selected authorization profile is DenyAccess

  11003 returned RADIUS Access-Reject

  Thank you

  Christophe

  I think you need to do is to create a sequence of identity with RSA as a selection in

  Authentication and recovery research list of attributes and AD in the additional attribute list recovery research. Then select this sequence as a result of the politics of identity for the service

• Is it possible to map a promoter group in Cisco ISE to a group of users in Active Directory, using a RADIUS server?

  Hello!!

  We are working on a mapping between a promoter Cisco ISE group and a user group in Active Directory, but the customer wants the mapping through a RADIUS SERVER, to avoid the ISE by querying directly activate Directory.

  I know it is possible to use a RADIUS SERVER as source of external identity for ISE... but, is possible to use this RADIUS SERVER for this sponsor group manages?

  Thank you and best regards!

  Hi Rodrigo,

  The answer is no. There is no way to integrate the portal Sponsor config with a RADIUS server. Your DB for authentication Portal Sponsor options;

  AD
  LDAP
  User internal ISE DB

  Sent by Cisco Support technique iPhone App

• DMVPN and active directory (logon)

  Hi all

  We have a DMVPN configuration between a few sites and everything seems fine, except that the logons through the VPN for a new domain active directory are very slow (10-15 minutes). I believe that the problem may be with the fragmentation of tunnel and packages such as AD is configured correctly.

  I am looking for some recommendations or advice on the MTU and TCP MSS settings see if it solves the problem.

  both the hub and the spokes are currently with the following settings MTU and MSS (ive removed some irrelevant information) Tunnel0 was originally a mtu of 1440 but if whatever it is 1400 is even worse.

  Thank you

  interface Tunnel0

  IP 1400 MTU

  IP nat inside

  authentication of the PNDH IP SP1

  dynamic multicast of IP PNDH map

  PNDH network IP-1 id

  IP virtual-reassembly in

  No cutting of the ip horizon

  source of Dialer0 tunnel

  multipoint gre tunnel mode

  0 button on tunnel

  Profile of ipsec protection tunnel 1

  interface Dialer0

  MTU 1492

  the negotiated IP address

  NAT outside IP

  IP virtual-reassembly in

  encapsulation ppp

  IP tcp adjust-mss 1452

  Dialer pool 1

  Dialer-Group 1

  Darren,

  In general the prolem is due to Kerberos on UDP traffic.

  There are several ways you can solve the problem:

  (1) transition to Kerberos over TCP. (suggested)

  (2) setting the MSS on the interface of tunnel not on telephone transmitter (recommended)

  (3) allowing the PMTUD tunnel (strongly recommended).

  M.

• Microsoft and Oracle Internet directory to Active Directory

  Hi all
  
  We have an in-house application that is running on the Oracle 10 g application server. We have a requirement where we want that the user windows authenticated and approved as the user connection for our application.
  
  (1) it is possible to map users to login windows for Oracle Internet Directory?
  (2) if so, how copy/create windows in Oracle Internet Directory users?
  (3) Microsoft Active Directory plays a role in the present?
  (4) what will be the overall throughput if we fix all this?
  (5) is there any place where I can find simple but complete documentation on this?
  
  Pls help.
  
  Kind regards
  Samuel

  Hi Samuel,.

  to do this, you will need to integrate the OID/SSO with Active Directory, as shown:

  Oracle® Identity Management Integration Guide
  10g (10.1.4.0.1)
  B15995-01 part number
  19 integration with Microsoft Active Directory
  http://download-UK.Oracle.com/docs/CD/B28196_01/idmanage.1014/b15995/odip_actdir.htm#OIMIG026

  (1) it is possible to map users to login windows for Oracle Internet Directory?
  If windows users are domain users, then Yes, trough Kerberos and Native of Windows authentication.

  (2) if so, how copy/create windows in Oracle Internet Directory users?
  This task will be done by the ODI (Oracle Directory Integration) server. This will make a sync LDAP based between OID and AD.

  (3) Microsoft Active Directory plays a role in the present?
  Yes, he plays :)

  (4) what will be the overall throughput if we fix all this?
  -Users are synchronized by DIP of AD to OID.
  -User opens the application in the browser
  -The browser sends the kerberos session on the SSO Server ticket
  -SSO server validates the ticket against the KDC
  -SSO logs the user in the application based on the kerberos (windows logon) ticket

  (5) is there any place where I can find simple but complete documentation on this?
  Click on the link I gave you. There are also a lot of notes about this integration metalink. Is a common integration.

  ARO
  Octavian