> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strata.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Oracle Universal Directory (LDAP)

The Oracle Universal Directory connector integrates the Maverics Orchestrator with Oracle Unified Directory (OUD) using the LDAP protocol -- enabling attribute lookups and directory queries against an Oracle directory service.

<Note>
  **Console terminology:** In the Maverics Console, this section is called
  **Identity Fabric**. The YAML configuration uses the `connectors` key to define
  identity provider integrations.
</Note>

## Overview

The Oracle Universal Directory connector functions as an LDAP attribute provider. It retrieves user attributes from Oracle Unified Directory for header injection, claim enrichment, or authorization decisions. For general-purpose LDAP directories, see the [LDAP connector](/reference/orchestrator/identity-fabric/ldap). For Microsoft Active Directory environments, see the [Active Directory connector](/reference/orchestrator/identity-fabric/activedirectory).

## Use Cases

* **Unify SSO across Oracle and non-Oracle stacks** -- Enrich sessions with OUD attributes so applications across Oracle and non-Oracle environments receive consistent identity data through a single orchestration layer
* **Simplify Oracle directory consolidation** -- Route OUD attribute lookups through the Orchestrator to reduce direct directory integrations per application, supporting consolidation of Oracle identity infrastructure
* **Cross-platform identity enrichment** -- Combine OIDC or SAML authentication from a cloud IdP with OUD attribute lookups, bridging identity data between Oracle directories and modern identity providers
* **Legacy Oracle app header injection** -- Look up user attributes in OUD and inject them as HTTP headers for legacy Oracle applications that depend on header-based identity

## Setup

<Tabs>
  <Tab title="Console UI">
    To create an Oracle Universal Directory (LDAP) connector in the Maverics Console:

    1. Navigate to **Identity Fabric** in the Console sidebar.
    2. Click **Create** and select **Oracle Universal Directory (LDAP)**.
    3. Enter a **Name** -- the friendly name for your OUD connector.
    4. Enter the **URL** of the OUD LDAP server (e.g., `ldaps://oud.example.com:636`).
    5. Enter the **Base DN** -- the search base for LDAP queries (e.g., `dc=example,dc=com`).
    6. Enter the **Service Account Username** -- the bind DN used to connect to OUD.
    7. Enter the **Service Account Password** -- use the show/hide toggle to verify the value.
    8. Optionally set an **Attribute Delimiter** for multi-valued attributes (default: `,`).
    9. Enter the **OUD Search Key** -- the attribute used for looking up user and group data (e.g., `uid` or `cn`).
    10. Click **Save**.
  </Tab>

  <Tab title="Configuration">
    ```yaml maverics.yaml theme={null}
    connectors:
      - name: oracle-oud
        type: ldap
        url:
          - "ldaps://{{ env.OUD_HOST }}:636"
        serviceAccountUsername: "cn=admin,dc=example,dc=com"
        serviceAccountPassword: <vault.oud_password>
        baseDN: "dc=example,dc=com"
        usernameSearchKey: uid
        userAttributes:
          - cn
          - mail
          - memberOf
        attributeMapping:
          email: mail
          name: cn
        tls: oud-tls
    ```

    ## Configuration Reference

    | Key                      | Type      | Required | Description                                                                                                                                            |
    | ------------------------ | --------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
    | `name`                   | string    | Yes      | Unique connector identifier referenced by app policies and attribute providers                                                                         |
    | `type`                   | string    | Yes      | Must be `ldap`                                                                                                                                         |
    | `url`                    | string\[] | Yes      | OUD server URLs -- supports `ldap://` (port 389) and `ldaps://` (port 636); multiple URLs enable failover                                              |
    | `serviceAccountUsername` | string    | Yes      | Bind DN for the service account (e.g., `cn=admin,dc=example,dc=com`)                                                                                   |
    | `serviceAccountPassword` | string    | Yes      | Service account password -- use secret reference syntax `<namespace.key>`                                                                              |
    | `baseDN`                 | string    | Yes      | Base DN for LDAP searches (e.g., `dc=example,dc=com`)                                                                                                  |
    | `usernameSearchKey`      | string    | No       | LDAP attribute used for username lookup (e.g., `uid` or `cn`)                                                                                          |
    | `userAttributes`         | string\[] | No       | LDAP attributes to retrieve during searches (e.g., `["cn", "mail", "memberOf"]`)                                                                       |
    | `attributeMapping`       | map       | No       | Map Orchestrator attribute names to LDAP attribute names (e.g., `email: "mail"`)                                                                       |
    | `attributeDelimiter`     | string    | No       | Delimiter for multi-valued LDAP attributes (default: `","`)                                                                                            |
    | `tls`                    | string    | No       | Named TLS profile for LDAP connection                                                                                                                  |
    | `healthCheck`            | object    | No       | Health check monitoring configuration (see [Identity Fabric Configuration Reference](/reference/orchestrator/identity-fabric#configuration-reference)) |

    For the complete connector field reference including health check details, see [Identity Fabric Configuration Reference](/reference/orchestrator/identity-fabric#configuration-reference).
  </Tab>
</Tabs>

## Troubleshooting

* **Test LDAP connectivity from the Orchestrator host** -- Use `ldapsearch` or a similar tool to verify the Orchestrator can reach the OUD server on the configured port. Network firewalls or DNS issues are common causes of connection failures.
* **Verify the service account has read permissions on the baseDN** -- The bind DN specified in `serviceAccountUsername` must have sufficient permissions to search the `baseDN` subtree and read the configured attributes.
* **For LDAPS, ensure the TLS profile includes the correct CA certificate** -- If the OUD server uses a private CA, the TLS profile referenced by the `tls` field must include the CA certificate via `caFile`.
* **Check attribute names in mapping** -- LDAP attribute names must match the Oracle Unified Directory schema. Common OUD attributes include `uid`, `cn`, `mail`, and `memberOf`.

## Related Pages

<CardGroup cols={2}>
  <Card title="Oracle Identity Cloud Service" icon="database" href="/reference/orchestrator/identity-fabric/oracle-ics">
    OIDC connector for Oracle IDCS
  </Card>

  <Card title="LDAP" icon="folder-tree" href="/reference/orchestrator/identity-fabric/ldap">
    General-purpose LDAP connector
  </Card>

  <Card title="Active Directory" icon="server" href="/reference/orchestrator/identity-fabric/activedirectory">
    LDAP-based connector for Microsoft Active Directory
  </Card>

  <Card title="Identity Fabric" icon="id-badge" href="/reference/orchestrator/identity-fabric">
    Overview of all identity providers
  </Card>
</CardGroup>