6 Creating the WebLogic Server Domain for Identity Management

6.1 Enabling ADMINVHN on IDMHOST1

Note that this step is required for failover of the Administration Server, regardless of whether other Oracle Fusion Middleware components are installed later or not.

You will associate the Administration Server with a virtual IP address, ADMINVHN.mycompany.com. Check that ADMINVHN.mycompany.com is enabled on IDMHOST1.

To enable the virtual IP address on Linux, run the following commands as root:

/sbin/ifconfig interface:index IPAddress netmask netmask
/sbin/arping -q -U -c 3 -I interface IPAddress

where interface is eth0, eth1, and so forth, and index is 0, 1, 2, and so forth.

For example:

/sbin/ifconfig eth0:1 100.200.140.206 netmask 255.255.255.0

Enable your network to register the new location of the virtual IP address:

/sbin/arping -q -U -c 3 -I eth0 100.200.140.206

Validate that the address is available by pinging it from another node, for example:

/bin/ping 100.200.140.206

6.2 Running the Configuration Wizard on IDMHOST1 to Create a Domain

Run the Configuration Wizard from the Oracle Common home directory to create a domain containing the Administration Server. Later, you will extend the domain to contain other components.

1. Change directory to the location of the Configuration Wizard. This is within the Oracle Common Home directory (created in Chapter 4, "Installing the Software").

   IDMHOST1> cd ORACLE_BASE/product/fmw/oracle_common/common/bin
   

2. Start the Oracle Fusion Middleware Configuration Wizard:

   IDMHOST1> ./config.sh
   

3. On the Welcome screen, select Create a New WebLogic Domain, and click Next.

4. The Select Domain Source screen is displayed in Figure 6-1.

   Figure 6-1 Select Domain Source Screen

   
   

   On the Select Domain Source screen, do the following:

   • Select Generate a domain configured automatically to support the following products.

   • Select the following products:

     • Basic WebLogic Server Domain - 10.3.3.0 [wlserver_10.3] (This should be selected automatically.)

     • Oracle Enterprise Manager - 11.1.1.0 [oracle_common]

     • Oracle JRF - 11.1.1.0 [oracle_common] (This should be selected automatically.)

   Click Next.

5. On the Specify Domain Name and Location screen, enter the domain name (IDMDomain).

   Make sure that the domain directory matches the directory and shared storage mount point recommended in Section 2.4, "Shared Storage and Recommended Directory Structure."

   Enter

   ORACLE_BASE/admin/IDMDomain/aserver/ 
   

   for the domain directory and

   ORACLE_BASE/admin/IDMDomain/aserver/applications 
   

   for the application directory. This directory should be in shared storage.

6. Click Next.

7. On the Configure Administrator Username and Password screen, enter the username (default is weblogic) and password to be used for the domain's administrator. For example:

   • Name: weblogic

   • User Password: password for weblogic user

   • Confirm User Password: password for weblogic user

   • Description:This user is the default administrator.

   Click Next.

8. On the Configure Server Start Mode and JDK screen, do the following:

   • For WebLogic Domain Startup Mode, select Production Mode.

   • For JDK Selection, select JROCKIT SDK1.6.0_14

   Click Next.

9. On the Select Optional Configuration screen, select the following:

   • Administration Server

   • Managed Servers, Clusters and Machines

   Click Next.

10. On the Configure the Administration Server screen, enter the following values:

    • Name: AdminServer

    • Listen Address: ADMINVHN.mycompany.com.

    • Listen Port: 7001

    • SSL listen port: N/A

    • SSL enabled: unchecked

    Click Next.

11. On the Configure Managed Servers screen, click Next

12. On the Configure Clusters screen, click Next

13. On the Configure Machines screen, click the Unix Machine tab and then click Add to add the following machine. The machine name does not need to be a valid hostname or listen address, it is just a unique identifier of a nodemanager location:

    • Name: ADMINHOST

    • Node manager listen address: localhost

    Leave all other fields to their default values.

14. Click Next.

15. On the Assign Servers to Machines screen, assign servers to machines as follows:

    • ADMINHOST: AdminServer

    Click Next.

16. On the Configuration Summary screen, validate that your choices are correct, then click Create.

17. On the Create Domain screen, click Done.

6.3 Creating boot.properties for the Administration Server on IDMHOST1

Create a boot.properties file for the Administration Server on IDMHOST1. The boot.properties file enables the Administration Server to start without prompting you for the administrator username and password.

For the Administration Server:

1. Create the following directory structure.

   mkdir -p ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain/servers/AdminServer/security
   

2. In a text editor, create a file called boot.properties in the last directory created in the previous step, and enter the username and password in the file. For example:

   username=weblogic
   password=password for weblogic user
   

6.4 Starting Node Manager on IDMHOST1

Perform these steps to start Node Manager on IDMHOST1:

1. Run the startNodeManager.sh script located under the ORACLE_BASE/wlserver_10.3/server/bin directory.

2. Run the setNMProps.sh script on IDMHOST1 to set the StartScriptEnabled property to true:

   cd MW_HOME/oracle_common/common/bin
   ./setNMProps.sh
   

   Note:

   You must use the StartScriptEnabled property to avoid class loading failures and other problems.

3. Stop the Node Manager by killing the Node Manager process.

4. Start Node Manager:

   IDMHOST1> cd ORACLE_BASE/product/fmw/wlserver_10.3/server/bin
   IDMHOST1> ./startNodeManager.sh
   

6.5 Updating the Node Manager Credentials

You start the Administration server by using wlst and connecting to Node Manager. The first start of the Administration Server with Node Manager, however, requires that you change the default username and password that the Configuration Wizard sets for Node Manager. Therefore you must use the start script for the Administration Server for the first start. Follow these steps to start the Administration Server using Node Manager. Steps 1-4 are required for the first start operation, but subsequent starts require only Step 4.

1. Start the Administration Server using the start script in the domain directory.

   IDMHOST1> cd ORACLE_BASE/admin/domain_name/aserver/domain_name/bin
   HOST1> ./startWebLogic.sh
   

2. Use the Administration Console to update the Node Manager credentials.

   1. In a browser, go to http://ADMINVHN.mycompany.com:7001/console.

   2. Log in as the administrator.

   3. Click Lock and Edit.

   4. Click Domain_name->Security->General and expand Advanced at the bottom.

   5. Enter a new username for Node Manager or make a note of the existing one and update the Node Manager password.

   6. Save and activate the changes.

3. Start WLST and connect to the node manager with nmconnect and the credentials set above. Then start the admin server using nmstart.

   IDMHOST1> cd ORACLE_COMMON_HOME/common/bin
   IDMHOST1> ./wlst.sh
   

   Once in the wlst shell, execute the following commands:

   wls:/offline> nmConnect('Admin_User','Admin_Pasword', 'IDMHOST1','5556',
     'IDMDomain','/u01/app/oracle/admin/IDMDomain/aserver/IDMDomain')
   wls:/nm/domain_name> nmStart('AdminServer')
   

   where Admin_user and Admin_Password are the Node Manager username and password you entered in Step 2.

   Note:

   Admin_user and Admin_Password are only used to authenticate connections between Node Manager and clients. They are independent from the server admin ID and password and are stored in the ORACLE_BASE/admin/domain_name/aserver/domain_name/config/nodemanager/nm_password.properties file.

4. Do not restart the Administration Server. It will be restarted in Section 6.7, "Stopping and Starting the WebLogic Administration Server."

6.6 Disabling Host Name Verification for the Oracle WebLogic Administration Server

This step is required if you have not set up the appropriate certificates to authenticate the different nodes with the administration server. (See Chapter 16, "Setting Up Node Manager.") If you have not configured the server certificates, you will receive errors when managing the different WebLogic Servers. To avoid these errors, disable host name verification while setting up and validating the topology, and enable it again once the EDG topology configuration is complete as described in Chapter 16, "Setting Up Node Manager."

Perform these steps to disable host name verification:

1. Log in to Oracle WebLogic Server Administration Console.

2. Click Lock and Edit.

3. Expand the Environment node in the Domain Structure window.

4. Click Servers. The Summary of Servers page appears.

5. Select AdminServer(admin) in the Names column of the table. The Settings page for AdminServer(admin) appears.

6. Click the SSL tab.

7. Click Advanced.

8. Set Hostname Verification to None.

9. Click Save.

10. Save and activate the changes.

6.7 Stopping and Starting the WebLogic Administration Server

1. Stop the administration server as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components"

2. Start WLST and connect to the node manager with nmconnect and the credentials set previously described. Then start the administration server using nmstart.

   IDMHOST1> cd ORACLE_COMMON_HOME/common/bin
   IDMHOST1> ./wlst.sh
   

   Once in the wlst shell, execute the following commands:

   wls:/offline> nmConnect('Admin_User','Admin_Pasword', 'IDMHOST1','5556',  'IDMDomain','/u01/app/oracle/admin/IDMDomain/aserver/IDMDomain')
   wls:/nm/domain_name> nmStart('AdminServer')
   

   where Admin_user and Admin_Password are the Node Manager username and password you entered in Step 2 of Section 6.5, "Updating the Node Manager Credentials."

6.8 Validating the Administration Server

Perform these steps to ensure that the Administration Server is properly configured:

1. In a browser, go to http://ADMINVHN.mycompany.com:7001/console.

2. Log in as the WebLogic administrator, for example: weblogic.

3. Check that you can access Oracle Enterprise Manager Fusion Middleware Control at http://ADMINVHN.mycompany.com:7001/em.

4. Log in to Oracle Enterprise Manager Fusion Middleware Control as the WebLogic administrator, for example: weblogic.

6.9 Configuring Oracle HTTP Server for the Administration Server

To enable Oracle HTTP Server to route to the Administration Server, you must set the the corresponding mount points in your HTTP Server configuration.

1. On each of the web servers on WEBHOST1 and WEBHOST2 create a file called admin.conf in the directory:

   ORACLE_INSTANCE/config/OHS/component/moduleconf 
   

   This file will have the following entries:

   NameVirtualHost *:7777
    
   <VirtualHost *:7777>
    
      ServerName admin.mycompany.com:80
      ServerAdmin [email protected]
      RewriteEngine On
      RewriteOptions inherit
      RewriteRule ^/console/jsp/common/logout.jsp /oamsso/logout.html [PT]
      RewriteRule ^/em/targetauth/emaslogout.jsp /oamsso/logout.html [PT]
    
   # Admin Server and EM
      <Location /console>
         SetHandler weblogic-handler
         WebLogicHost ADMINVHN.mycompany.com
         WeblogicPort 7001
      </Location>
    
      <Location /consolehelp>
         SetHandler weblogic-handler
         WebLogicHost ADMINVHN.mycompany.com
         WeblogicPort 7001
      </Location>
    
      <Location /em>
         SetHandler weblogic-handler
         WebLogicHost ADMINVHN.mycompany.com
         WeblogicPort 7001
      </Location>
    
   </VirtualHost>
   

   Note:

   Values such as admin.mycompany:80 and you@youraddress that are noted in this document serve as examples only. Enter values based on the actual environment.

2. Restart Oracle HTTP Server on both WEBHOST1 and WEBHOST2, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

   WEBHOST1> ORACLE_BASE/admin/instance_name/bin/opmnctl restartproc ias-component=ohs1
    
   WEBHOST2> ORACLE_BASE/admin/instance_name/bin/opmnctl restartproc ias-component=ohs2
   

6.10 Registering Oracle HTTP Server With WebLogic Server

For Oracle Enterprise Manager Fusion Middleware Control to be able to manage and monitor the Oracle HTTP server, you must register the Oracle HTTP server with the domain. To do this, you must register Oracle HTTP Server with WebLogic Server using the following command:

WEBHOST1> cd ORACLE_BASE/admin/instance_name/bin
WEBHOST1> ./opmnctl registerinstance -adminHost ADMINVHN.mycompany.com \
   -adminPort 7001 -adminUsername weblogic

You must also run this command from WEBHOST2 for OHS2.

6.11 Setting the Front End URL for the Administration Console

Oracle WebLogic Server Administration Console tracks changes that are made to ports, channels and security using the console. When changes made through the console are activated, the console validates its current listen address, port and protocol. If the listen address, port and protocol are still valid, the console redirects the HTTP request, replacing the host and port information with the Administration Server's listen address and port. When the Administration Console is accessed using an load balancer, you must change the Administration Server's front end URL so that the user's browser is redirected to the appropriate load balancer address. To make this change, perform the following steps:

1. Log in to Oracle WebLogic Server Administration Console.

2. Click Lock and Edit.

3. Expand the Environment node in the Domain Structure window.

4. Click Servers to open the Summary of Servers page.

5. Select Admin Server in the Names column of the table. The Settings page for AdminServer(admin) appears.

6. Click the Protocols tab.

7. Click the HTTP tab.

8. Set the Front End Host field to admin.mycompany.com (your load balancer address).

9. Set FrontEnd HTTP Port to 80

10. Save and activate the changes.

To eliminate redirections, best practice is to disable the Administration console's Follow changes feature. To do this, log in to the administration console and click Preferences->Shared Preferences. Deselect Follow Configuration Changes and click Save.

6.12 Validating Access Through Oracle HTTP Server

Verify that the server status is reported as Running in the Administration Console. If the server is shown as Starting or Resuming, wait for the server status to change to Started. If another status is reported (such as Admin or Failed), check the server output log files for errors. See Section 19.6, "Troubleshooting" for possible causes.

Validate Administration Console and Oracle Enterprise Manager Fusion Middleware Control through Oracle HTTP Server using the following URLs:

• http://admin.mycompany.com/console

• http://admin.mycompany.com/em

For information on configuring system access through the load balancer, see Section 2.2.1, "Load Balancers."

6.13 Manually Failing Over the Administration Server

This section discusses how to fail over the Administration Server to IDMHOST2 and how to fail it back to IDMHOST1.

This section contains the following topics:

• Section 6.13.1, "Failing over the Administration Server to IDMHOST2"

• Section 6.13.2, "Starting the Administration Server on IDMHOST2"

• Section 6.13.3, "Validating Access to IDMHOST2 Through Oracle HTTP Server"

• Section 6.13.4, "Failing the Administration Server Back to IDMHOST1"

6.14 Backing Up the WebLogic Domain

It is an Oracle best practices recommendation to create a backup after successfully completing the installation and configuration of each tier, or at another logical point. Create a backup after verifying that the installation so far is successful. This is a quick backup for the express purpose of immediate restoration in case of problems in later steps. The backup destination is the local disk. You can discard this backup when the enterprise deployment setup is complete. After the enterprise deployment setup is complete, you can initiate the regular deployment-specific Backup and Recovery process. For more details, see the Oracle Fusion Middleware Administrator's Guide.

For information about database backups, refer to the Oracle Database Backup and Recovery Advanced User's Guide.

To back up the installation at this point, complete these steps:

1. Back up the web tier as described inSection 5.6, "Backing up the Web Tier Configuration."

2. Back up the database. This is a full database backup, either hot or cold. The recommended tool is Oracle Recovery Manager. You can also use operating system tools such as tar for cold backups.

Back up the Administration Server domain directory. This saves your domain configuration. The configuration files all exist under the ORACLE_BASE/admin/domainName/aserver directory.

IDMHOST1> tar cvf edgdomainback.tar ORACLE_BASE/admin/domainName/aserver

For information about backing up the application tier configuration, see Section 19.4, "Performing Backups and Recoveries."