To configure DIP to be used with a secure LDAP AD (SSL), first a certificate store must be created for DIP. It can be created with a tool like keytool or kse. Create a JKS store and call it dip.jks. Get a trusted certificate from the AD server (this can be achieved with an ldap command, I used ldapadmin, browsed for CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,C=nl and exported the certificate to file by right-clicking the Cacertificate attribute of the certificate entry). Import this certificate as a trusted certificate in the jks keystore.
This keystore will be used with DIP. For manual ldapcompare and bind commands (and later for the plugins), you will also need a wallet with this certificate.

Now, we need to tell DIP to use this jks store. This can be achieved with the command
./manageDIPServerConfig set -h servername.domain.com -p 7015 -D weblogic -attribute keystorelocation -val /oracle/middleware_OID/keystore/dip.jks
(change servername, port and location as desired). The port must be the port ODSM is using.

We have to create a credential to store the keystore password in OID using wlst:

Run the following commands to create a CSF credential and update the Java Keystore password:

Open the WLST prompt by running the following command:

$ORACLE_HOME/common/bin/wlst.sh

Connect to the WebLogic Admin Server:

connect(‘Weblogic_User’, ‘Weblogic_password’, ‘t3://Weblogic_Host:Weblogic_AdminServer_Port’)

Create the credential and update the Java Keystore password:

createCred(map=”dip”, key=”jksKey”, user=”jksuser”, password=”JKS_password_created_previously_in_step_2″)

The only thing to change here is the password, copy the rest “as is” .

Then, we create the profile as ‘usual’ , ticking the ssl enabled flag and specifying the ssl port of the AD. After correcting the domain mapping rules, bootstrap the profile with $ORACLE_HOME/bin/syncProfileBootstrap.

Second part is to get the oidexplg plugins working. They are configured like any other oidexplg plugin. I created a new one from scratch, because my AD plugins were alreay in use for synchronising with another AD. I copied all the paramters one by one from the AD plugin. The flexfields can be entered after saving the configuration. Don’t forget the secure flexfields for the wallet.

Yes: we need a wallet, with the same certificate as in the keystore we created. Wallets can be created from the Em-console Menu oid/wallets.

To find the created wallet, look for a file ewallet.p12. This location must be registered with the plugins, inlcuding the ewallet.p12 filename.
The wallet password is stored in a secured flexfield.