/oud/Oracle/Middleware/Oracle_Home/bin/manageDIPServerConfig set \
-h localhost \
-p 7005 \
-D admin \
-attribute keystorelocation \
-val \
/oud/certs/dip1-dip2oud.jks
[Weblogic user password]
Connection parameters initialized.
Connecting at localhost:7005, with userid "admin"..
Connected successfully.

The attribute keystorelocation is successfully changed to value /oud/certs/dip1-dip2oud.jks.

cd /oud/Oracle/Middleware/Oracle_Home/oracle_common/common/bin
./wlst.sh
connect('admin','password','t3://localhost:7001')
createCred(map="dip",key="jksKey",user="jksuser",password="password")
exit()

DIP binding configuration

cd /oud/Oracle/Middleware/Oracle_Home/bin
./dipConfigurator setup \
-wlshost dip1.domain.com \
-wlsport 7001 \
-wlsuser admin \
-ldaphost dip1.domain.com \
-ldapport 1636 \
-ldapuser 'cn=directory manager' \
-isldapssl true \
-ldapadminport 4444

# If clustered add the below.
-isclustered false

ldapmodify -h localhost -p 1389 -D "cn=directory manager" -w - <

We are now ready to change/modify DIP to SSL communication (mode 2).
follow the below steps to do so.

cd /oud/Oracle/Middleware/Oracle_Home/bin
./manageDIPServerConfig \
set -attribute sslmode -val 2 -h localhost -p 7005 -D "admin"
[Weblogic user password]
Connection parameters initialized.
Connecting at localhost:7005, with userid "admin"..
Connected successfully.

The attribute sslmode is successfully changed to value 2.

Next, Modify the OUD SSL port.
./manageDIPServerConfig set \
-attribute backendhostport \
-val dip1.domain.com:1636 \
-h localhost -p 7005 -D "admin"
[Weblogic user password]
Connection parameters initialized.
Connecting at localhost:7005, with userid "admin"..
Connected successfully.

The attribute backendhostport is successfully changed to value dip1.domain.com:1636.

Finaly, verify DIP still works with SSL on working.
Note: You can do test this from the DIP Web UI as well.
/oud/Oracle/Middleware/Oracle_Home/bin/dipStatus -h localhost -p 7005 -D admin
[Weblogic user password]
Connection parameters initialized.
Connecting at localhost:7005, with userid "admin"..
Connected successfully.

ODIP Application is active at this host and port.

If all works, Restart the DIP wls_ods1 instance. this is required for DIP to start using SSL.
Adding / Configuring SSL From DIP <-> AD communication
To get the ad certificates, run the below.
ldapsearch -h ad1.domain.local -D "CN=Adm account,OU=Admin Accounts,DC=domain,DC=local" -w 'password' -b "cn=configuration,dc=domain,dc=local" "cacertificate=*" dn
ldapsearch -h ad1.domain.local -D "CN=Adm account,OU=Admin Accounts,DC=domain,DC=local" -w 'password' -b "CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=local" "cacertificate=*"

# Note: You can also use openssl to retrieve the certificate.
openssl s_client -connect ad1.domain.com:636 -verify 5

Now, import/add the key to the DIP trusted store.
keytool -importcert -trustcacerts -keystore /oud/certs/dip1-dip2oud.jks -file /oud/certs/ad-cert.csr -alias ad1-ca-cert

Note: AD 2008r2 and below do not support TLS1.2 out of the box, to set DIP to accept min TLS to 1.0, follow the below
https://docs.oracle.com/middleware/12213/dip/administer/GUID-5792E326-0A9E-4B16-83A7-CA8A7E1E1CC9.htm#OIMIG-GUID-89E0E64B-A175-4B22-BB86-AC7BC13059F2

WebLogic to allow TL1.0
From the domain home page, select the Managed Server (wls_ods1) >
>From the WebLogic Server menu, choose System MBean Browser. The System MBean Browser page is displayed >
>Expand Configuration MBeans in the MBean navigation tree and then select com.bea > Server >
>Expand the Server node and then expand the Managed Server node (wls_ods1).
>From the Managed Server node, expand SSL and then select the Managed Server MBEAN.
The Configuration MBEAN page is displayed.

>Select Attributes tab and then select MinimumTLSProtocolVersion.
The Attribute: MinimumTLSProtocolVersion page is displayed.
I select the below (other options detilas is avalble in the dcos)
TLSv1: Specifies TLS V1.0 as the minimum protocol version enabled in SSL connections.

Note: Specify the lowest version i.e. TLSv1, includes TLSv1.1 and TLSv1.2
OUD changes required for DIP
Allow already hashed passwords in OUD.
cd /oud/Oracle/Middleware/Oracle_Home/asinst_1/OUD/bin
./dsconfig -h localhost -p 4444 -D "cn=directory manager" -j /oud/certs/pw.txt -X -n \
  set-password-policy-prop --policy-name "Default Password Policy" \
  --set allow-pre-encoded-passwords:true

Enable change-log if not already done for the cn=oraclecontext
dsreplication enable-changelog -h localhost -p 4444 -D "cn=directory manager" -j /oud/certs/pw.txt -r 8989 -b cn=oraclecontext --trustAll --no-prompt

Configuring Password Sync
If using password ether
from AD => OUD
or
from OUD => AD
Run the below.
From AD => OUD
Synchronize the password from a connected directory to Oracle Unified Directory, by runing the setupPlugin, like the below.
$ORACLE_HOME/bin/dipConfigurator setupPlugin \
-wlshost dip1.domain.com \
-wlsport 7001 \
-wlsuser admin \
-ldaphost dip1.domain.com \
-ldapport 1389 \
-ldapuser 'cn=directory manager' \
-isldapssl false \
-ldapadminport 4444

Note:  To view the Password Filter initialize logs  tail the /oud/Oracle/Middleware/Oracle_Home/ldap/log/dipConfig.log log file.

From OUD => AD
Enable / configure OUD password Translation by running the setupPasswordTranslation, like the below.
$ORACLE_HOME/bin/dipConfigurator setupPasswordTranslation \
-wlshost localhost \
-wlsport 7001 \
-wlsuser admin \
-ldaphost dip1.domain.com \
-ldapport 1389 \
-ldapuser "cn=Directory Manager" \
-isldapssl false \
-ldapadminport 4444

Note:  To view the Password Filter initialize logs  tail the /oud/Oracle/Middleware/Oracle_Home/ldap/log/dipConfig.log log file.
Troblshuting and logging
To increase DIP logging you can do so in the Web UI or in the logging.xml.
The log location is.
/oud/Oracle/Middleware/Oracle_Home/user_projects/domains/dip1/config/fmwconfig/servers/wls_ods1/logging.xml

# Add the next lines to set logging to the max (32).







Helpful links
The Pythian has also relased a very helpful slideshare, that can be found here

Oracle support master notes for DIP - Doc ID 1563196.1

In the article we have completed the Configure WLS And DIP instance. In Part 5 I am going to show you - how to Configure ISW => DIP migration, configure OUD <=> AD mappings..
To continue reading Part 5 click here.

Like what you're reading? please provide feedback, any feedback is appreciated.