Domain User and Group creation

[53d117460ec63d70]

Can WLS users and groups be specified in the model so that WDT will add them to the created domain? The documentation states that they cannot be discovered (https://github.com/oracle/weblogic-deploy-tooling/blob/master/site/discover.md) but I cannot see any mention of creation.

[ddsharpe]

Not today. We have talked about this several times, but never implemented it. There hasn't been any demand for it, since WLS recommends using external LDAP providers over the embedded LDAP in production. If you feel like this is a big deal for your use case, it would help me if could you describe the impact to you, your project, or your company.

[53d117460ec63d70]

For domains that use embedded LDAP we are updating DefaultAuthenticatorInit.ldift with the users and groups after WDT has created it. It would be cleaner to have all the domain config in the model but it's not a big deal. Thanks.

[wszczurek]

It is useful to have support for creating users and groups in WDT in my opinion.
This could be especially useful if we have more than one authentication providers (Local LDAP and Remote/Central LDAP).
There is quite often rule to not rely only on Remote/Central LDAP but to keep in place local LDAP too.
The WLS instances need to be available (access) via local authentication provider if the network connectivity to remote, central LDAP is not available.

[ddsharpe]

@53d117460ec63d70 which API are you using to update the ldift file?
@wszczurek are you saying that you need to load users/groups locally and remotely?

Which version(s) of WLS are you using?

[wszczurek]

WLS: 10.3.6 and 12.2.1.3

The users are different in local and remote (central) ldap.
There are generic, non-personal users in the Local LDAP. You can think about them like generic/system/service accounts.
There are personal users (real people) in the Central/Remote LDAP.

With this approach WLS is working properly even if you do not have access to Central/Remote LDAP. It is useful in case you have many system around the globe and you do not want to have "Permanent" dependency to Central/Remote LDAP, which can be not always available.

[53d117460ec63d70]

@53d117460ec63d70 which API are you using to update the ldift file?
@wszczurek are you saying that you need to load users/groups locally and remotely?

Which version(s) of WLS are you using?

WLS10.3.6
I'm currently using the ansible blockinfile module with a Jinja2 template and creating the salted SHA1 hashed with a custom ansible filter plugin.

[rakillen]

Fixed with #411