What is a Directory Plug-in & why it is useful?

1. Why do we need a plug-in?

Using Plug-in, we can extend LDAP operations in the following ways:

I. You can validate data before the server performs an LDAP operation on the data

II. You can perform actions after the server successfully completes an LDAP operation

III. You can be authenticated through external credential stores

IV. You can replace an existing server module by defining your own server module. For e.g. you implement your own password value checking

On startup, the directory server loads your plug-in configuration and library. It calls your plug-in functions while processing various LDAP requests.

2. What Is the Plug-in Framework?

The plug-in framework is the environment in which the plug-in user can develop, configure,

and apply the plug-ins. Each individual plug-in instance is called a plug-in module.

The plug-in framework includes the following:

• 
  Plug-in configuration tools
  
• 
  Plug-in module interface
  
• 
  Plug-in LDAP API (ODS.LDAP_PLUGIN package)
  

Follow these steps to use the server plug-in framework:

a) Write a user-defined plug-in procedure. This plug-in module must be written in PL/SQL.

b) Compile the plug-in module against the same database that serves as the Oracle Internet Directory backend database.

c) Register the plug-in module through the configuration entry interface.

3. Operation-Based Plug-ins Supported by the Directory

1. Pre-Operation Plug-ins For e.g validate data

2. Post-Operation Plug-ins For e.g logging and notification

3. When-Operation Plug-ins  such as  Add-on, Replace. You can use both add-on and replace plug-ins with the ldapcompare operation.

4. Real Time Usage of Plug-ins

Example 1: Search Query Logging

It becomes possible to log all of the ldapsearch commands by using post ldapsearch operational plug-in.

Example 2: Synchronizing Two DITs

If there are two interdependent products under cn=Products, cn=oraclecontext & if a user in

the first DIT (product 1) is deleted, the corresponding user in the other DIT (product 2)

must be deleted, then it is possible to set a trigger by using the post ldapdelete operation plug-in.