How to create an user who can manage OID DAS?

Step 1:

Login to OIDDAS as super user & create this new user by name ‘oid_admin’. Provide this new user ‘Allow User Management and Application Provisioning’ access by clicking on ‘Privileges’ button as shown below

Step 2:

Login to Oracle Directory Manager as root user. Navigate to Entry Management->
cn=OracleContext->  cn=Groups ->
cn=OracleDASAdminGroup
Append the DN of this new user in the uniquemember attribute in the "properties" tab in the right frame.

How to use Search & Select User/Group LOV service units in Partner Applications?

It is common to forget the complete user ID when performing query or lookup on a particular user. One convenient feature is to provide a popup-style user search page to assist the user.

For that purpose, DAS provides service units for searching and selecting users or groups. These service units are sometimes referred to as user or group List Of Values (LOV).

In DAS, the search page for users is called the User Search-And-Select page.

When a custom application needs to invoke an OID DAS function that sends data back to the custom application, we need to use HTTP instead of JavaScript. In order to accomplish this, the custom application invokes the OID DAS function with a callback parameter. The callback parameter is an HTTP URL in the domain of the custom application.

Note:

Since the Java scripts have the security restrictions, data passing across the domains is not possible. Due to this limitation, only the pages in the same domain can access the Oracle

Delegated Administration Services LOV units.

All DAS partner applications should be Single Sign-On enabled, so that user needs not to authenticate him or herself every time he or she performs a Search-And-Select operation.

I. How to invoke Search-and-Select LOV Units for Users or Groups?

A custom application can open a popup window and populate its contents by supplying a search-and-select URL for a user or group by using a URL of the form:

http://das_host:das_port/oiddas/ui/oracle/ldap/das/search/LOVUserSearch

?title=User&callbackurl=http://app_host:app_port/custapp/Callback

or

http://das_host:das_port/oiddas/ui/oracle/ldap/das/search/LOVGroupSearch

?title=User&callbackurl=http://app_host:app_port/custapp/Callback

II. Receiving Data from the User or Group Search-and-Select Service Units

After a User or Group has been selected via the Oracle Internet Directory DAS User or Group Search-and-Select Service Unit, an HTTP form will be submitted to the callbackurl page using the POST method.

The callbackurl page in the popup window may transfer the form parameters to the invoking page in the opener window using JavaScript. It may then close the popup window.

How does Delegated Administration Services provides secure access to the Directory?

When a user logs into an oracle component, the component may need to obtain information from the directory on the end user's behalf such as password verifier. To do this, the component typically logs into the directory as a proxy user, a feature that enables it to switch its identity to that of the end user.

A problem is that the greater the number of components logging into the directory as proxy users, the greater the risk of malicious user accessing the directory as  a proxy user. To prevent this security problem, DAS centralizes proxy user access.

In Oracle DAS environment, each component instead of logging into the directory as a proxy user, logs into the central DAS. DAS then logs into the directory as a proxy user, switches its identity to the end user and performs operations on the user's behalf.

How does Delegated Administration Services Work?

Oracle Delegated Administration Services is a J2EE application that is deployed in OC4J_Security in Oracle AS infra instance.

Oracle DAS performs the following basic tasks 

1. Receive requests from the clients
2. Process those requests- by either retrieving or updating data in Oracle Internet Directory & compile the LDAP result into an HTML page
3. Send the HTML back to the browser

1. The user from a browser using HTTP, sends a request to DAS containing a directory query
2. DAS receives the request & launches the appropriate servlet. The servlet interprets the request & sends it to Oracle Internet Directory using LDAP
3. OID sends LDAP request back to DAS servlet
4. DAS servlet compiles the LDAP result in a HTML page and sends it to the Web browser

What is Oracle Delegated Administration Services?

Delegated Administration Services is a framework that consists of pre-defined web-based units for building administrative & self-service console.These consoles can be used by directory administrators & users to perform specified directory operations.