Oracle connects to AD Server via SSL

Because of the company's business needs, we hope to be able to synchronize the HR Department company and employee information to the Ad server, the other application system to do a unified domain authentication management, because Java to achieve more trouble, but also to get a web container what, so decided to directly in the HR database to write the process to synchronize, Because you want to synchronize the past users have a default password, and the account is enabled by default, so you need to connect to the Ad server via SSL, and spent some time looking for some information (really not easy to find, Baidu basically did not, flip the wall with Google search), Now record some of the key implementation codes and considerations.

"One" creates wallet on the Oracle server
First, you should export a root certificate with a. cer extension on the ad server, and this step please contact the webmaster, which is not described here.

Log on to Oracle server
Su-oracle
Mkdir/home/oracle/wallet
Formally create a Wallet object with access to password wallet
ORAPKI Wallet CREATE-WALLET/HOME/ORACLE/WALLET-PWD Wallet
Add the root certificate that is exported on the ad server to the wallet
ORAPKI Wallet Add-wallet/home/oracle/wallet-trusted_cert-cert/home/oracle/certnew.cer


The "Two" connection to the LDAP server part of the code, where g_ the beginning of the variable, you need to replace your own
Procedure Ldap_connect is
Begin
Dbms_ldap. Use_exception: = true;

--note that the port variable value here should be 636, because we want to use an SSL connection, the normal connection is set to 389
G_session: = Dbms_ldap.init (
hostname = G_ldap_host,
Portnum = G_ldap_port
);

--Through wallet verification
G_return_value: = Dbms_ldap.open_ssl (
LD = G_session,
SSLWRL = ' File:/home/oracle/wallet ',--wallet address
SSLWALLETPASSWD = ' wallet ',--wallet authentication password
Sslauth = 2
);

--Remember that the authentication user here should have administrator privileges, otherwise the OU and user permissions are not created later
G_return_value: = dbms_ldap.simple_bind_s (
LD = G_session,
DN = G_login_user,
passwd = G_login_password
);

exception
When others then
Dbms_output.put_line (Sqlcode | | ': ' | | SQLERRM);
Ldap_disconnect;
Pkg_log.error (' ldap_connect ', ' cause of error ' sqlcode= ' | | sqlcode| | ' Sqlerrm= ' | | sqlerrm| | ' 】‘);
End Ldap_connect;

"Three" points of attention when creating a user
You can change the password (unicodepwd) and the Account Control (userAccountControl) attribute when you create or modify the user.
However, when setting unicodepwd, the variable in binary format is required, some of the code is as follows

Procedure Ldap_add_user (
P_SN VARCHAR2,
P_given_name VARCHAR2,
P_user_name VARCHAR2,
P_user_principal_name VARCHAR2,
P_user_password VARCHAR2,
P_belong_ou VARCHAR2
) is
V_array Dbms_ldap. Mod_array: = Dbms_ldap.create_mod_array (10);
V_add_values Dbms_ldap. String_collection;
V_pwd_values Dbms_ldap. Berval_collection;

V_DN VARCHAR2 (300); --DN Information

Begin

......

V_add_values (1): = ' 512 '; --Normal Account

Dbms_ldap.populate_mod_array (
Modptr = V_array,
Mod_op = Dbms_ldap. Mod_add,
Mod_type = ' userAccountControl ',
Modval = V_add_values
);

V_pwd_values (1): = Utl_raw.cast_to_raw (CONVERT (' "' | | p_user_password| | ' ', ' al16utf16le ');

Dbms_ldap.populate_mod_array (
Modptr = V_array,
Mod_op = Dbms_ldap. Mod_add,
Mod_type = ' unicodepwd ',
--Here the parameter name must be Modbval, otherwise it will not compile, if the Plsql dev tool automatically prompted with the parameter is modval, this pit toss me old long
Modbval = V_pwd_values
);

......

End

Oracle connects to AD Server via SSL