11 Extending the Domain with Oracle Access Manager 11g

11.1.1 Using Different LDAP Directory Stores

The enterprise deployment described in this guide shows Oracle Access Manager using Oracle Internet Directory as the only LDAP repository. Oracle Access Manager uses a single LDAP for policy and configuration data. It is possible to configure another LDAP as the identity store where users, organizations and groups reside. For example, an Oracle Access Manager instance may use Oracle Internet Directory as its policy and configuration store and point to an instance of Microsoft Active Directory for users and groups.

11.1.2 Using Oracle Virtual Directory as the Identity Store

In addition, the identity stores can potentially be front-ended by Oracle Virtual Directory to virtualize the data sources.

To learn more about the different types of directory configuration for Oracle Access Manager, consult the 11g Oracle Access Manager documentation at Oracle Technology Network. Customers considering these variations should adjust their directory tier and Oracle Access Manager deployment accordingly.

11.3.1 Extend Domain with Oracle Access Manager

Start the configuration wizard by executing the command:

MW_HOME/oracle_common/common/bin/config.sh

Then proceed as follows:

1. On the Welcome screen, select Extend an Existing WebLogic Domain. Click Next.

2. On the Select a WebLogic Domain screen, using the navigator, select the domain home of the admin server, for example: ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain.

   Click Next

3. On the Select Extension Source screen, select Oracle Access Manager with Database Policy Store.

   Click Next

4. The Configure RAC Multi Datasources screen shows the Multi Datasources if you have Oracle Directory Integration Platform or ODSM configured in your domain. Do not make any changes.

   Click Next.

5. On the Configure JDBC Data Sources screen select the datasource OAM Infrastructure.

   Select Configure selected data sources as RAC multi data sources in the next panel.

   Click Next.

6. On the Configure RAC Multi Data Sources Screen:

   • Service Name: Service name of the database that contains the OAM repository (idmedg.mycompany.com)

   • User Name: EDG_OAM

   • Password: Password for user EDG_OAM

   In the top right box, click Add to add the second Oracle RAC node.

   • Host Name: INFRADBHOST1

   • Instance Name: idmdb1

   • Port: 1521

   Click Add again to add the second database host:

   • Host Name: INFRADBHOST2

   • Instance Name: idmdb2

   • Port: 1521

   Click Next.

7. On the Test Component Schema screen, the Wizard attempts to validate the data sources. If the data source validation succeeds, click Next. If it fails, click Previous, correct the problem, and try again.

8. On the Select Optional Configuration screen, select Managed Servers, Clusters and Machines.

   Click Next

9. When you first enter the Configure Managed Servers screen, the configuration wizard will have created a default managed server for you. AT this point, you must do two things:

   1. Change the values of the default managed server.

   2. Add a second managed server and supply values for it.

   That is, you must change the existing entry and add one new entry.

   Do not change the configuration of any managed servers which have already been configured as part of previous application deployments.

   For the default OAM server (oam_server) entry, change the following values:

   • Name: WLS_OAM1

   • Listen Address: IDMHOST1

   To add the second OAM Server, click Add and supply the following values:

   • Name: WLS_OAM2

   • Listen Address: IDMHOST2

   • Listen Port: 14100

   Leave all the other fields at the default settings.

   Click Next.

10. On the Configure Clusters screen, create a cluster by clicking Add. Supply the following information:

    • Name: cluster_oam

    • Cluster Messaging Mode: unicast

    Leave all other fields at the default settings and click Next.

11. On the Assign Servers to Clusters screen, associate the managed servers with the cluster. Click the cluster name in the right pane. Click the managed server under Servers, then click the arrow to assign it to the cluster.

    The cluster_oam will have the managed servers WLS_OAM1 and WLS_OAM2.

    Note:

    Do not change the configuration of any clusters which have already been configured as part of previous application deployments.

    Click Next.

12. On the Configure Machines screen, create a machine for each host in the topology. Click on the tab UNIX if your hosts use Linux or a UNIX-based operating system. Otherwise, click on machines. Supply:

    • Name: The name of the host. Best practice is to use the DNS name. For example: idmhost1.mycompany.com and idmhost2.mycompany.com for the first and second nodes respectively.

    • Node Manager Listen Address: The DNS name of the machine. For example: idmhost1.mycompany.com and idmhost2.mycompany.com for the first and second nodes respectively.

    • Node Manager Port: A port for node manager to use.

    If you have already configured Oracle Directory Integration Platform or ODSM, machines will already exist for those hosts.

    Click Next.

13. On the Assign Servers to Machines screen, indicate which managed servers will run on each of the machines you created.

    Click a machine in the right pane.

    Click the managed servers you want to run on that machine in the left pane.

    Click the arrow to assign the managed servers to the machines. Repeat until all managed servers are assigned to machines. For example:

    IDMHOST1: WLS_OAM1

    IDMHOST2: WLS_OAM2

    Click Next to continue.

14. On the Configuration Summary screen, click Extend to extend the domain.

    Note:

    If you receive a warning that says:

    CFGFWK: Server listen ports in your domain configuration conflict with ports in use by active processes on this host
    

    Click OK.

    This warning appears if managed servers have been defined as part of previous installs and can safely be ignored.

15. Restart the Administration server as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

11.3.2 Starting Oracle Access Manager Server on IDMHOST1

Start Oracle Access Manager on IDMHOST1 by following the start procedures in Section 19.1, "Starting and Stopping Oracle Identity Management Components" for:

• Admin Server (Restart if already running).

• Node Manager (if it is not already started)

• WebLogic Managed Server WLS_OAM1

11.3.3 Remove IDM Domain Agent

By default, the IDMDomain Agent provides single sign-on capability for administration consoles. In enterprise deployments, WebGate handles single sign-on, so you need to remove the IDMDomain agent. Remove the IDMDomain Agent as follows:

Log in to the WebLogic console using the URL: http://admin.mycompany.com/console

Then:

1. Select Security Realms from the Domain Structure Menu

2. Click myrealm.

3. Click the Providers tab.

4. Click on Lock and Edit from the Change Center.

5. Select IDMDomainAgent from the list of authentication providers.

6. Click Delete.

7. Click Yes to confirm the deletion.

8. Click Activate Changes from the Change Center.

9. Restart the Adminisration server and ALL running managed servers, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

11.3.4 Propagating the Domain Changes to the Managed Server Domain Directory

To propagate the start scripts and classpath configuration from the Administration Server's domain directory to the managed server domain directory, proceed as follows:

1. Run the pack command on IDMHOST to create a template pack. Type the following commands:

   IDMHOST1> cd MW_HOME/oracle_common/common/bin
   IDMHOST1> ./pack.sh -managed=true -domain=ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain -template=idmdomaintemplate.jar -template_name=IDMDomain_Template 
   

2. Run the unpack command on IDMHOST1 to unpack the propagated template to the domain directory of the managed server. Type the following command:

   IDMHOST1> ./unpack.sh -domain=ORACLE_BASE/admin/IDMDomain/mserver/IDMDomain/ -template=idmdomaintemplate.jar -overwrite_domain=true -app_dir=ORACLE_BASE/admin/IDMDomain/mserver/applications
   

3. Restart managed server WLS_OAM1.

11.4.1 Deploying Oracle Access Manager on IDMHOST2

Once the configuration has succeeded on IDMHOST1, you can propagate the configuration to IDMHOST2. You do this by packing the domain on IDMHOST1, using the pack script, and unpacking it on IDMHOST2 using the unpack script. Both scripts reside in MW_HOME/oracle_common/common/bin.

Type:

pack.sh -domain=ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain/ -template=/tmp/IDMDomain.jar -template_name="OAM Domain" -managed=true

This creates a file called IDMDomain.jar in the /tmp directory. Copy this file to IDMHOST2.

Unpack the file on IDMHOST2 by using the unpack utility:

./unpack.sh -domain=ORACLE_BASE/admin/IDMDomain/mserver/IDMDomain -template=MW_HOME/templates/IDMDomain.jar -overwrite_domain=true -app_dir=ORACLE_BASE/admin/IDMDomain/mserver/applications

11.4.2 Updating Node Manager Properties File on IDMHOST2

1. Start the Node Manager on IDMHOST2 to create the nodemanager.properties file by using the startNodemanager.sh script located under the MW_HOME/wlserver_10.3/server/bin directory.

2. Before you can start the managed servers by using the console, node manger requires that the property StartScriptEnabled is set to true. You set it by running the setNMProps.sh script located under the MW_HOME/oracle_common/common/bin directory.

   prompt>  MW_HOME/oracle_common/common/bin
   prompt> ./setNMProps.sh
   

3. Stop and Start the node manager as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components"so that the properties take effect.

11.4.3 Starting Oracle Access Manager Server on IDMHOST2

Start Oracle Access Manager on IDMHOST2 by following the start procedures in Section 19.1, "Starting and Stopping Oracle Identity Management Components" for:

• Node Manager

• WebLogic Managed Server WLS_OAM

11.5.1 Prerequisites

Before proceeding, ensure that the following tasks have been performed:

1. Install Oracle Web Tier on WEBHOST1 and WEBHOST2.

2. Install and configure Oracle Access Manager on IDMHOST1 and IDMHOST2.

3. Configure the loadbalancer with a virtual hostname (sso.myconpany.com) pointing to the webservers on WEBHOST1 and WEBHOST2.

4. Configure the loadbalancer with a virtual hostname (admin.mycompany.com) pointing to webservers WEBHOST1 and WEBHOST2.

11.5.2 Making Oracle Access Manager Server Aware of Load balancer

By default, Oracle Access Manager sends requests to the login page located on the local server. In an Enterprise deployment this needs to be changed so that login page requests are sent to the load balancer. Proceed as follows:

1. Log in to the OAM Console at: http://IDMHOST1.mycompany.com/oamconsole as the weblogic user.

2. Click the System Configuration tab.

3. Double click Server Instances.

4. Click SSO Engine tab.

5. Enter the following information:

   • OAM Server Host: sso.mycompany.com

   • OAM Server Port: 443

   • OAM Server Protocol: https

6. Click Apply.

7. Restart managed servers WLS_OAM1 and WLS_OAM2, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

11.5.3 Configuring Oracle HTTP Servers to Display Login Page

On each of the web servers on WEBHOST1 and WEBHOST2 create a file called oam.conf in the directory ORACLE_INSTANCE/config/OHS/component/moduleconf.

This file must contain the following information:

<Location /oam>
    SetHandler weblogic-handler
    WebLogicCluster idmhost1.mycompany.com:14100,idmhost2.mycompany.com:14100 
</Location>

11.5.4 Configuring Oracle HTTP Servers to Access Oracle Access Manager Console

On each of the web servers on WEBHOST1 and WEBHOST2, a file called admin.conf was created in the directory ORACLE_INSTANCE/config/OHS/component/moduleconf. (See Section 6.9, "Configuring Oracle HTTP Server for the Administration Server".) Edit this file and add the following lines within the virtual host definition:

<Location /oamconsole>
   SetHandler weblogic-handler
   WebLogicHost ADMINVHN
   WebLogicPort 7001
</Location>

After editing the file should look like:

NameVirtualHost *:80

<VirtualHost *:80>

   ServerName admin.mycompany.com:80
   ServerAdmin [email protected]
   RewriteEngine On
   RewriteOptions inherit
   RewriteRule ^/console/jsp/common/logout.jsp /oamsso/logout.html [PT]
   RewriteRule ^/em/targetauth/emaslogout.jsp /oamsso/logout.html [PT]

   # Admin Server and EM
   <Location /console>
      SetHandler weblogic-handler
      WebLogicHost ADMINVHN
      WeblogicPort 7001
   </Location>

   <Location /consolehelp>
      SetHandler weblogic-handler
      WebLogicHost ADMINVHN
      WeblogicPort 7001
   </Location>

   <Location /em>
      SetHandler weblogic-handler
      WebLogicHost ADMINVHN
      WeblogicPort 7001
   </Location>

   <Location /oamconsole>
      SetHandler weblogic-handler 
      WebLogicHost ADMINVHN
      WebLogicPort 7001
   </Location>

</VirtualHost>

Then edit ORACLE_INSTANCE/config/OHS/component/httpd.conf. Comment out the following lines by inserting a # at the beginning, so that they look like this:

#*******Default Login page alias*** 
#Alias /oamsso "/u01/app/oracle/product/fmw/webgate/access/oamsso" 
#<LocationMatch "/oamsso/*"> 
#Satisfy any 
#</LocationMatch> 
#********************************** 

Restart the Oracle HTTP Server, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

11.5.5 Validating Accessibility

Attempt to access the OAM application using the URL: sso://mysso.mycompany.com:443/oam

The Oracle Access Manager screen will be displayed. A message saying Action Failed will appear on the screen. You can ignore the message because all we are testing is that the OAM server can be accessed via the Load Balancer.

Attempt to Access the OAM console at: http://admin.mycompany.com/oamconsole

11.7.1 Creating Users and Groups in LDAP

Prior to performing this step, ensure that there is a group in your LDAP store for Oracle Access Manager administrators, such as OAMAdministrator, and that a user such as oamadmin exists in that group.

To do this create the following files:

oam_user.ldif

dn:  cn=oamadmin,cn=Users,dc=mycompany,dc=com
cn:  oamadmin
sn:  oamadmin
description:  oamadmin
uid: oamadmin
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetorgperson
objectclass: orcluser
objectclass: orcluserV2
userpassword: mypasswd

oam_group.ldif

dn: cn=OAMAdministrator,cn=Groups,dc=mycompany,dc=com
cn: OAMAdministrator
displayname: OAMAdministrator
description: OAMAdministrator
uniquemember: cn=oamadmin,cn=Users,dc=mycompany,dc=com
objectclass: top
objectclass: groupofuniquenames
objectclass: orclgroup

Load the user and group into ldap using the following commands:

ldapadd -h myoid.myompany.com -p 389 -D cn="orcladmin" -q -c -v -f oam_user.ldif

ldapadd -h myoid.mycompany.com -p 389 -D cn="orcladmin" -q -c -v -f oam_group.ldif

11.7.2 Backing up Existing Configuration

Before starting the configuration backup the current configuration, so that should anything untoward happen the original configuration can be restored.

To achieve this, make a copy of the files oam-config.xml and oam-policy.xml. These files are located in the directory: DOMAIN_HOME/config/fmwconfig.

11.7.3 Creating User Identity Store

Go to the Oracle Access Manager console at the URL: http://adminvhn.mycompany.com:7001/oamconsole

Log in using the WebLogic administration user.

Click Add User Identity Store.

• Name: LDAP_DIR

• Ldap Provider: OVD

• LDAP URL: ldap://ovd.mycompany.com:389

• Principal: cn=orcladmin

• Credential: orcladmin password

• User Search Base: cn=Users,dc=mycompany,dc=com

• Group Search Base: cn=Groups,dc=mycompany,dc=com

• User Name Attribute: uid

• OAM Administrator's Role: OAMAdministrator

Click Apply.

Click Test Connection to Validate the connection to the LDAP server.

11.7.4 Setting LDAP to Primary Authentication Store

Now that you have defined the LDAP identity store, you must set it as the primary authentication store. You do this by using the Oracle Access Manager console, as follows:

1. Click the System Configuration Tab

   Select Data Sources - User Identity Stores from the navigation pane.

2. Click LDAP_DIR

   Select Open from the Actions menu.

3. Click Set as Primary

4. Test the connection by clicking Test Connection

5. Restart the managed servers Admin Server, WLS_OAM1 and WLS_OAM2, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

11.7.5 Validating the Configuration

Validate the configuration by logging in to the Oracle Access Manager console as the user oamadmin. You can access the console at: http://admin.mycompany.com/oamconsole.

11.8.1 Creating Oracle Access Manager Policy Group

To create the OAM Policy Group perform the following steps:

Log in to the OAM console at: http://admin.mycompany.com using the oamadmin account created previously.

1. From the Navigation Window expand: Application Domains > IDMDomainAgent.

2. Click Authentication Policies

3. Click Create on the tool bar (below the Browse tab).

4. Enter the following information:

   • Name: OAM Protected Resources

   • Authentication Scheme: LDAPScheme

5. Click Apply.

11.8.2 Creating Oracle Adaptive Access Manager Policy Group

This group is only required if you are planning to include OAAM in your topology.

1. From the Navigation Window expand: Application Domains > IDMDomainAgent.

2. Click Authentication Policies.

3. Click Create on the tool bar (below the Browse tab).

4. Enter the following information:

   • Name: OAAM Protected Resources

   • Authentication Scheme: OAAMAdvanced

5. Click Apply.

11.9.1 Creating a Test Resource

Create a test page called sso.html on WEBHOST1 and WEBHOST2. The easiest way to do this is to create a file called sso.html in the directory ORACLE_INSTANCE/config/OHS/component_name/htdocs with the following content:

<html>
<body>
<center>
<p>
<h2>
SSO Protected Resource
</h2>
</p>
</center>
</body>
</html>

11.9.2 Creating a Resource

Now that you have something to protect, you need to create a resource in OAM and assign it to one of the policy groups you created above.

Log in to the OAM console at: http://admin.mycompany.com/oamconsole using the oamadmin account created previously.

1. From the Navigation window expand: Application Domains > IDMDomainAgent.

2. Click Resources.

3. Click Create on the tool bar below the Browse tab).

4. Enter the following information:

   • Type: http

   • Host Identifier: IDMDomain

   • Resource URL: /sso.html

5. Click Apply.

11.9.3 Assigning Resource to Policy Group

Now that the resource exists, assign it to one of the policy groups you just created.

Log in to the OAM console at: http://admin.mycompany.com/oamconsole using the oamadmin account created previously.

1. From the Navigation window expand: Application Domains > IDMDomainAgent > Authentication Policies.

2. Click OAM Protected Resources.

3. Click Edit on the tool bar below the Browse tab.

4. In the Resources box, click +.

5. From the list, select the resource you created above.

6. Click Apply.

11.9.4 Adding Resource to Protected Resources

All that remains is to add the resource to the list of protected resources. To do this, log in to the OAM console at: http://admin.mycompany.com using the oamadmin account created previously.

1. From the Navigation window expand: Application Domains > IDMDomainAgent > Authorization Policies.

2. Click Protected Resource Policy.

3. Click Edit on the tool bar below the Browse tab.

4. In the Resources box, click +.

5. From the list, select the resource you just created.

6. Click Apply.

11.9.5 Validating Oracle Access Manager

To validate that Oracle Access Manager is working correctly:

Install Oracle Webgate as described in Section 18.2, "Installing and Configuring WebGate".

Access your protected resource using the URL: https://sso.mycompany.com:443/sso.html.

The OAM Login page is displayed. Log in as an authorised OAM user, for example: oamadmin. Once you are logged in, the oam protected resource is displayed.