Assuming you've just come from HOW TO: Configure OIM 11g AD/LDAP Authentication Part 1, the following steps carries on from that.

Within the previous step, there was a configuration setup for an LDAP connection to access user with the necessary rights within AD to access OIM. Below is to assurance that the configuration for the groups is also in place. The AD group in question is called "oimusers", in which all users who shall be able to login to OIM need to be member of this group. The group need to be named exactly "oimusers".

Groups
By using the same process you used to locate the LDAP DN as mentioned in the HOW TO: Configure OIM 11g AD/LDAP Authentication Part 1 blog, you can use the apache LDAP query to discover the DN of the 'oimusers' group. This group membership must be assigned to the user within Active Directory for this to be transferred over.

You are then required to login into the WLS provider configuration screen and populate the group information

Once saved, you will be asked to thenrestart your WLS domain. Assuming you have your configuration correct, you'll be able to see the users and groups associated with your 'myrealm'.

Now jump back to the Weblogic admin console and click on authentication provider and click on provider Specific. This is the page is the single configuration for the authentication provider to extract the users.

You will also be able to see that the users and groups. If you don't see the users and groups, then the configuration was setup incorrectly

It will also be worth ranking up the order of your newly created AD provider to the top, which in the event will be the initial search for the user credentials. If this is not used, and that the password within OIM differs within AD, you will get a invalid password prompt when you attempt a login within your OIM AD credentials

If you have done this correctly and that the users and groups have been setup, you should now be able to access OIM using your AD credentials

About the author