18 Integrating Components

18.2.1.1 Making Special gcc Libraries Available

Oracle Web Gate requires special versions of gcc libraries to be installed (Linux only). These library files must exist somewhere on the Linux system. The Web Gate installer asks for the location of these library files at install time. Download the libraries from http://gcc.gnu.org, as described in "Installing Third-Party GCC Libraries (Linux and Solaris Operating Systems Only)" in Oracle Fusion Middleware Installation Guide for Oracle Identity Management

18.2.2.1 Using the Remote Registration Utility

Use the remote registration utility as follows.

Creating an Agent Configuration File

The oamreg.sh script creates an agent configuration using the contents of a configuration file called OAMRequest.xml. You can find the template for this file in the directory IAM_ORACLE_HOME/oam/server/rreg/input.

Create a copy of this file on IDMHOST1, called sso.xml.

In the file supply details for the following attributes:

• serverAddress: URL of WebLogic Administration Server.

• hostIdentifier: IDMDomain

• agentBaseUrl: https://sso.mycompany.com:443

• agentName: Name used to identify the WebGate agent. Good practice is to use a name similar to Webgate_mysso.

• autoCreatePolicy: False

• primaryCookieDomain: Domain your servers reside in, for example: .mycompany.com

• logOutUrls: /oamsso/logout.html

• security: open

Here is a sample file:

<?xml version="1.0"?>
<!-- Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.

   NAME: OAMRequest.xml - Template (with all options) for OAM Agent Registration Request file
   DESCRIPTION: Modify with specific values and pass file as input to the tool
--><OAMRegRequest>

    <serverAddress>http://ADMINHOSTVHN.mycompany.com:7001</serverAddress>
    <hostIdentifier>Webgate_mysso</hostIdentifier>
    <agentName>Webgate_mysso</agentName>
    <autoCreatePolicy>false</autoCreatePolicy>
    <primaryCookieDomain>.mycompany.com</primaryCookieDomain>
    <agentBaseUrl>https://sso.mycompany.com:443</agentBaseUrl>
    <maxCacheElems>100000</maxCacheElems>
    <cacheTimeout>1800</cacheTimeout>
    <cookieSessionTime>3600</cookieSessionTime>
    <maxConnections>1</maxConnections>
    <maxSessionTime>24</maxSessionTime>
    <idleSessionTimeout>3600</idleSessionTimeout>
    <failoverThreshold>1</failoverThreshold>
    <aaaTimeoutThreshold>-1</aaaTimeoutThreshold>
    <sleepFor>60</sleepFor>
    <debug>false</debug>
    <security>open</security>
    <denyOnNotProtected>0</denyOnNotProtected>
    <cachePragmaHeader>no-cache</cachePragmaHeader>
    <cacheControlHeader>no-cache</cacheControlHeader>
    <ipValidation>0</ipValidation>
    <logOutUrls>
        <url>/oamsso/logout.html</url>
    </logOutUrls>
    <protectedResourcesList>
        <resource>/sso.html</resource>
    </protectedResourcesList>
    <publicResourcesList>
        <resource>/public/index.html</resource>
    </publicResourcesList>
    <userDefinedParameters>
        <userDefinedParam>
                <name>MaxPostDataLength</name>
                <value>750000</value>
        </userDefinedParam>
          ……..
          ………..  
  </userDefinedParameters>
</OAMRegRequest>

Creating Oracle Access Manager Agent

The agent configuration is created by running the oamreg.sh script. This is done by issuing the following commands from within the RREG_HOME directory:

export JAVA_HOME=$MW_HOME/jrockit_160_14_R27.6.5-32
./bin/oamreg.sh inband input/sso.xml

When the script runs you will be asked for the following information. Provide the values shown:

Agent User Name: oamadmin
Agent Password: oamadmin user's password
Do you want to enter a Web Gate Password: y
Enter password for webgate and confirm

This will then create a file called ObAccessClient.xml in the directory RREG_HOME/output/Agent_Name.

Copy this file to each webgate installation. Put it in the directory: WEBGATE_INSTALL_DIR/access/oblix/lib.

Now that you have created the agent, you must update it. Please see Section 18.2.2.3, "Update Newly-Created Agent".

18.2.2.2 Using Oracle Access Manager Administration Console

Access the Oracle Access Manager console at: http://admin.mycompany.com/oamconsole

1. Log in as the oamadmin user.

2. Click Add OAM 10g WebGate.

3. Complete the following information:

   • Agent Name: Name for this Agent, for example: Webgate_mysso

   • Access Client Password: Enter a Password for Web Gate to use

     Note:

     Although it is not mandatory to provide a password for Web Gate, Oracle highly recommends that you do so. It is mandatory when wiring Oracle Identity Management to Oracle Access Manager.

   • Agent Base URL: https://sso.mycompany.com:443

   • Host Identifier: IDMDomain

   • Ensure that Auto Create Policies is not selected.

   • Protected Resources: enter protected resources, as required

     Note:

     To make testing easier, it is useful to create a simple HTML file called sso.html in ORACLE_INSTANCE/config/OHS/ohs1/htdocs.

     Choose to protect /sso.html. This will enable you to verify that SSO is working by accessing the URL: https://sso.us.oracle.com/sso.html.

4. Click Apply.

   This will then create a file called ObAccessClient.xml in the directory DOMAIN_HOME/output/Agent Name.

18.2.2.3 Update Newly-Created Agent

After generating the initial configuration, you must edit the configuration and add advanced configuration entries.

1. Double Click IDMDomain under Host Identifiers.

2. Click + in the operations box.

3. Enter the following information:

   • Host Name: admin.mycompany.com

   • Port: 80

4. Click Apply.

5. Select System Configuration Tab

6. Select Agents - OAM Agents - 10g WebGates. from the directory tree.

7. Click the newly created agent (Webgate_mysso).

8. Select Open from the Actions Menu.

9. Verify that all of your access servers are listed in the Primary Servers List box. If any are missing, click the Add icon (+) to add a new preferred server.

10. If any access servers are missing add them to the Primary or Secondary Server list.

11. Update the following information:

    • Primary cookie domain: .mycompany.com (include the dot at the beginning).

    • Logout URL: /oamsso/logout.html

      /console/jsp/common/logout.jsp

      /em/targetauth/emaslogout.jsp

    • Deny if not Protected: Do not select.

12. Click Apply.

18.2.3.1 Oracle WebGate 10g

Start the Web Gate installer by issuing the command:

Oracle_Access_Managerversion_linux_OHS11g_WebGate -gui

Then perform the following steps:

1. On the Welcome to the InstallShield Wizard for Oracle Access Manager WebGate screen.

   Click Next.

2. On the Customer Information screen, enter the username and group that the Identity Server will use. This should be the same as the user and group that installed the Oracle HTTP Server. The default value for username and group is nobody. For example, enter oracle/oinstall.

   Click Next.

3. Specify the installation directory for Oracle Access Manager Access Server. For example, enter: MW_HOME/oam/webgate.

   Click Next.

   Note:

   Oracle Access Manager WebGate is installed in the access subdirectory under /u01/app/oracle/product/fmw/oam/webgate.

4. Oracle Access Manager WebGate will be installed in: /u01/app/oracle/product/fmw/oam/webgate/

   The access directory is created by the installer automatically.

5. Specify the location of the GCC run-time libraries, for example: /u01/app/oracle/oam_lib

   Click Next.

6. The installation progress screen is shown. After the installation process completes, the WebGate Configuration screen appears.

7. On the WebGate Configuration screen, you are prompted for the transport security mode:

   The transport security between all Access System components (Policy Manager, Access Servers, and associated WebGates) must match; select one of the following: Open Mode, Simple Mode, or Cert Mode.

   Select Open Mode.

   Click Next.

8. On the next WebGate Configuration screen, specify the following WebGate details:

   • WebGate ID: The agent name used in Section 18.2.2.2, "Using Oracle Access Manager Administration Console," for example Webgate_mysso.

   • Password for Web Gate: If you entered a password when creating the agent, enter this here. Otherwise leave blank.

   • Access Server ID: WLS_OAM1

   • Host Name: Enter the Host name for one of the access servers for example IDMHOST1

   • Port Number the Access Server listens to: ProxyPort

   Note:

   To find the port that the Access Server is using, log into the oamconsole using the URL: http://admin.mycompany.com/oamconsole. Then perform the following steps:

   1. Select the System Configuration tab.

   2. Select Server Instances.

   3. Select Instance (WLS_OAM1) and click the View icon in the tool bar.

      The proxy entry will have host and port information.

9. On the Configure Web Server screen, click Yes to automatically update the web server, then click Next.

10. 10. On the next Configure Web Server screen, specify the full path of the directory containing the httpd.conf file. The httpd.conf file is located under the following directory:

    /u01/app/oracle/admin/ohsInstance/config/OHS/ohsComponentName

    For example:

    /u01/app/oracle/admin/ohs_instance2/config/OHS/ohs2/httpd.conf

    Click Next.

11. On the next Configure Web Server page, a message informs you that the Web Server configuration has been modified for WebGate.

    Click Next.

12. The next screen, Configure Web Server, displays the following message:

    If the web server is setup in SSL mode, then httpd.conf file needs to be configured with the SSL related parameters. To manually tune your SSL configuration, please follow the instructions that come up.
    

    Click Next.

13. The next screen, Configure Web Server, displays a message with the location of the document that has information on the rest of the product setup, as well as Web Server configuration.

    Select No and click Next.

14. The final Configure Web Server screen appears with a message to manually launch a browser and open the HTML document for further information on configuring your Web Server.

    Click Next.

15. The Oracle COREid Readme screen appears. Review the information on the screen and click Next.

16. A message appears, along with the details of the installation, informing you that the installation was successful.

    Click Finish.

17. Replace the file ObAccessClient.xml in the directory MW_HOME/webgate/access/oblix/lib/ with the file generated in Section 18.2.2.2, "Using Oracle Access Manager Administration Console."

18. Restart the web server by following the instructions in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

19. Repeat for WEBHOST2

18.3.1.1 Update the LDAP Schema Definitions

1. Update the LDAP Schema Definitions and ACLs with the OAM and OIM password expiry schema extensions, as follows:

   1. Create an LDIF file called PasswordExpired.ldif with the following contents:

      dn: cn=subSchemaSubEntry
      changetype: modify
      add:  attributetypes
      attributetypes: ( 1.3.6.1.4.1.3831.0.0.400 NAME 'obpasswordexpirydate' DESC 'Oracle Access Manager defined attribute type' SYNTAX '1.3.6.1.4.1.1466.115.121.1.15'  X-ORIGIN 'user defined' )
      
      dn: cn=subschemasubentry
      changetype: modify
      add: objectclasses
      objectclasses: ( 1.3.6.1.4.1.3831.0.1.40 NAME 'OIMPersonPwdPolicy' DESC 'Oracle Access Manager defined objectclass' SUP top  AUXILIARY MAY ( obpasswordexpirydate ) )
      

   2. On IDMHOST1, set the ORACLE HOME to the IDM_ORACLE_HOME and ensure that the ORACLE_HOME/bin directory is in your path:

      ORACLE_HOME=/u01/app/oracle/product/fmw/idmPATH=$ORACLE_HOME/bin:$PATH
      

   3. Update the LDAP schema by using the ldapadd command. For example:

      ORACLE_HOME/bin/ldapadd -h oid.mycompany.com -p 389 -D "cn=orcladmin" -q -c -v -f /home/oracle/ PasswordExpired.ldif
      

2. Update the LDAP schema with the OAM Schema extensions, if you have not already added them.

   The OAM Schema files OID_oblix_pwd_schema_add.ldif, OID_oblix_schema_add.ldif, OID_oblix_schema_index_add.ldif, and OID_oim_pwd_schema_add.ldif are located under the IAM_ORACLE_HOME/oam/server/oim-intg/schema directory.

   Update the LDAP schema by using the ldapadd command. For example:

   ORACLE_HOME/bin/ldapmodify -h oid.mycompany.com -p 389 -D "cn=orcladmin" -q -c -v -f IAM_ORACLE_HOME/oam/server/oim-intg/schema/OID_oblix_pwd_schema_add.ldif
   
   ORACLE_HOME/bin/ldapmodify -h oid.mycompany.com -p 389 -D "cn=orcladmin" -q -c -v -f IAM_ORACLE_HOME/oam/server/oim-intg/schema/OID_oblix_schema_add.ldif
   
   ORACLE_HOME/bin/ldapmodify -h oid.mycompany.com -p 389 -D "cn=orcladmin" -q -c -v -f IAM_ORACLE_HOME/oam/server/oim-intg/schema/OID_oblix_schema_index_add.ldif
   
   ORACLE_HOME/bin/ldapmodify -h oid.mycompany.com -p 389 -D "cn=orcladmin" -q -c -v -f IAM_ORACLE_HOME/oam/server/oim-intg/schema/OID_oim_pwd_schema_add.ldif
   

18.3.1.2 Creating an Oracle Identity Manager User with Administrator Privileges

Create an OIM User with System Administrator privileges by using the Oracle Identity Manager Administration Console. This user will be used to perform administrative tasks in OAM and OIM. Follow these steps to create the user:

1. Access the Oracle Identity Manager Administration console at: http://oim_host:port/admin/faces/pages/Admin.jspx

2. Create a user called xelsysadm in LDAP, as shown in Section 18.4.5.

   Ensure that the user is created with the mail attribute by adding the following line to the LDIF file:

   mail:[email protected]

   This attribute is required by Oracle Identity Management for user reconcilation.

3. Go to Roles and add the System Administrators role to the intg_admin user.

18.3.1.3 Patching the Oracle Access Manager 10g Access Server

Follow these steps to patch the Access Server on OAMHOST1, OAMHOST2 and OAMADMINHOST:

1. Download the OAM access server patch package from My Oracle Support at https://support.oracle.com. The patch name is Oracle_Access_Manager10_1_4_3_0_BPxx_Patch_linux_Access_Server.zip

2. Shut down Oracle Access Manager 10.1.4.3.0.

3. Unzip the Oracle_Access_Manager10_1_4_3_0_BPxx_Patch_linux_Access_Server.zip to a temporary location

4. Change directory to PatchExtractLocation/Oracle_Access_Manager10_1_4_3_0_BPxx_Patch_linux_Access_Server_binary_parameter.

5. Start the patch installation tool as:

   ./patchinst -i InstallDir/access
   

   where InstallDir is the path to the Access Server install location.

   This applies the required patch for OAM-OIM integration to the OAM 10.1.4.3.0 Access Server. Please see the "Enterprise Deployment Guide" chapter of the 11g Release 1 (11.1.1) Release Notes for the exact patch level required

6. Start the access server as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

7. Stop and start the other Oracle Access Manager components as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

18.3.1.4 Patching the Oracle Access Manager 10g Webgates

Follow these steps to patch the Webgates in your environment:

1. Download the Oracle Access Manager OHS11g WebGate patch from My Oracle Support at https://support.oracle.com. The patch name is Oracle_Access_Manager10_1_4_3_0_BPxx_Patch_linux_OHS11g_WebGate.zip.

2. Stop the Oracle HTTP Server 11g instance as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

3. Unzip the Oracle_Access_Manager10_1_4_3_0_BPxx_Patch_linux_OHS11g_WebGate.zip file to a temporary location. This creates the following two directories:

   • Oracle_Access_Manager10_1_4_3_0_BPxx_Patch_linux_OHS11g_WebGate_binary_parameter

   • Oracle_Access_Manager10_1_4_3_0_BPxx_Patch_linux_OHS11g_WebGate_message_en-us

4. Change directory to: PatchExtractLocation/Oracle_Access_Manager10_1_4_3_0_BPxx_Patch_linux_OHS11g_WebGate_binary_parameter

5. Start the patch installation tool by typing:

   ./patchinst -i InstallDir/access
   

   where InstallDir is the path to the Access Server install location.

   This applies the required patch for OAM-OIM integration to the OAM 10.1.4.3.0 WebGate Instance. Please see the "Enterprise Deployment Guide" chapter of the 11g Release 1 (11.1.1) Release Notes for the exact patch level required.

6. Apply this patch to all the WebGate instances in your environment.

7. On all your web hosts, copy the config.pl, loginredirect.pl, logout.pl and params.pl perl script files located under the /u01/app/oracle/product/fmw/oam/webgate/access/oblix/lib directory to the ORACLE_INSTANCE/config/OHS/InstanceName/cgi-bin directory.

   For example, on WEBHOST1:

   cp /u01/app/oracle/product/fmw/oam/webgate/access/oblix/lib/*.pl /u01/app/oracle/admin/ohs_inst1/OHS/ohs1/cgi-bin/
   

   On WEBHOST2:

   cp /u01/app/oracle/product/fmw/oam/webgate/access/oblix/lib/*.pl /u01/app/oracle/admin/ohs_inst2/OHS/ohs1/cgi-bin/
   

8. Add execute permissions to the config.pl, loginredirect.pl, and logout.pl files located under the ORACLE_INSTANCE/config/OHS/InstanceName/cgi-bin on all the webhosts. To add execute permissions run the following command on all the webhosts, run the following command:

   chmod +x ORACLE_INSTANCE/config/OHS/InstanceName/cgi-bin/*.pl
   

9. Start the OHS server as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

18.3.1.5 Configure the WebLogic Domain for Single Sign On

Update the single sign-on provider configuration using the wlst addOAMSSOProvider command. This command configures the Oracle Access Manager JPS SSO Service Provider. It modifies domain level jps-config.xml file to add an OAM SSO service instance and required properties. The syntax for the command is:

connect()
addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi= "/cgi-bin/logout.pl", autologinuri=None)
disconnect()
exit()

addOAMSSOProvider(loginuri="login_uri", logouturi="logout_uri", autologinuri="autologin_uri")

where:

• loginuri is the login URI that triggers SSO authentication. This is a required parameter.

• logouturi is the logout URI that logs out the signed-on user. This is an Optional parameter.

• autologinuri is the auto login URI. This is an optional parameter.

Follow these steps to configure Oracle Access Manager for Oracle Identity Manager integration.

1. Run wlst.sh from the ORACLE_HOME/common/bin directory to invoke the WLST shell.

2. Connect to the WebLogic Administration Server using the connect command.

3. Run the addOAMSSOProvider WLST command to configure the Oracle Access Manager JPS SSO Service Provider.

For example:

Prompt> ./wlst.sh
wls:/offline>connect('weblogic',password,'t3://idmhost1-vip.mycompany.com:7001')
wls:/IDMDomain/serverConfig> addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi= "/cgi-bin/logout.pl", autologinuri=None)

18.3.2.1 Creating Policies in Oracle Access Manager 10g

To protect OIM pages from unauthorized access, OAM needs to be configured to protect these pages. OAM Access Server requires that OAM Policies be defined to specify the OIM pages that need to be protected and authentication mechanism to be used for authenticating users.

Run the OAM Config Tool on OAMADMINHOST to configure OAM policies to protect OIM pages and to create the required OAM password policies to enable integration with OAM login pages for OIM password management.

Follow the steps below to create the required OAM Policies

1. Create a file with the following contents. These are the public and protected resources for OIM.

   ###########################
   #
   # OAM-OIM Integration
   #
   ###########################
   protected_uris
   ###########################
   
   #Resources protected with default authentication scheme
   /oim
   /xlWebApp
   /Nexaweb
   /workspace
   /admin
   
   ###########################
   public_uris
   ###########################
   
   #Public Policy 1
   Self-Service Operations
   /oim/faces/pages/USelf.jspx
   /admin/faces/pages/forgotpwd.jspx
   /admin/faces/pages/pwdmgmt.jspx
   /oim/afr/blank.html
   /admin/afr/blank.html
   
   #Public Policy 2
   Common JavaScripts, images and CSS
   /oim    /.../{*.js,*.css,*.png,*.gif}
   /admin  /.../{*.js,*.css,*.png,*.gif}
   

2. Run the oamcfgtool located under the ORACLE_HOME/modules/oracle.oamprovider_11.1.1/ directory with the parameters shown in the table:

   [Prompt> java -jar oamcfgtool.jar  mode=CREATE  app_domain=Policy_Domain_Name web_domain=Host_Identifier uris_file=Policy_Configuration_File ldap_host=LDAP_Host ldap_port=LDAP_Port ldap_userdn=LDAP_Bind_User_DN ldap_userpassword=LDAP_Bind_User_Password oam_aaa_host=Access_Server_Host oam_aaa_port=Access_Server_Port oam_aaa_mode={OPEN | SIMPLE | CERT} oam_aaa_passphrase=Global_Pass_Phrase -usei18nlogin  authenticating_wg_url=http://awghost.domain:port  -configOIMPwdPolicy
   

   Parameter	Description	Value
   mode	Mode in which the tool is run	CREATE
   app_domain	The Policy Domain Name	OIMPolicy_AG
   web_domain	The Host Identifier Name. Provide the same value created in Chapter 10	IDMEDG
   uris_file	Location of the file created in step1	/home/oracle/oim-oam.conf
   ldap_host	LDAP Host Name	oid.mycompany.com
   ldap_port	LDAP Port Number	389
   ldap_userdn	LDAP Admin Username	cn=orcladmin
   ldap_userpassword	LDAP Admin Userpassword	password
   oam_aaa_host	OAM10g Access Server Host Name	OAMHOST1.mycompany.com
   oam_aaa_port	OAM10g Access Server Port Number	6023
   oam_aaa_mode	OAM10g Access Server Mode	OPEN
   oam_aaa_passphrase	OAM10g Access Server Passphrase. Use the passphrase provided when creating the access server in Chapter 10	password
   usei18nlogin	Indicates that Internationalized Login Pages should be used for protecting OIM pages.
   authenticating_wg_url	Authenticating webagte URL. This is the URL frontending the OAM Servers. This should be specified when in the RWG-AWG scenario. For this EDG, both are the same.	https://sso.mycompany.com:443
   configOIMPwdPolicy

   
   

3. Update the OAM Password Policy parameters in the Oracle Access Manager Identity Console. Follow these steps:

   1. Navigate to the Oracle Access Manager 10g Identity System Console at: http://oamadminhost.mycompany.com:7777/identity/oblix

   2. Log in to the identity system console using the credentials for the orcladmin user.

   3. Click the link for Identity System Console

   4. On the System Configuration page, click the link for System Configuration.

   5. Click the Password Policy link in the left pane menu

   Update the Lost Password Redirect URL, Password Change Redirect URL, and Account Lockout Redirect URL fields by pre-pending the Single Sign On URL before the OAM Password Policy parameters.

   • Lost Password Redirect URL: https://sso.mycompany.com:443/admin/faces/pages/forgotpwd.jspx?backUrl=%HostTarget%%RESOURCE%

   • Password Change Redirect URL: https://sso.mycompany.com:443/admin/faces/pages/pwdmgmt.jspx?backUrl=%HostTarget%%RESOURCE%

   • Account Lockout Redirect URL: https://sso.mycompany.com:443/ApplicationLockoutURI

This will create the following:

• Policy Domain to protect OIM Pages from unauthenticated access. Also adds specific policies to allow anonymous access to common JavaScripts, CSS, and image files and to OIM pages responsible for providing Forgot Password, Self Registration and Track Registration functionality.

• Authentication Schemes to be used while protecting OIM Pages using OAM Policies.

• Password Policy required in OAM Identity System Console to enable OAM Access Server to redirect users to OIM Password Management pages for Force Password Reset.

• Password Policy Redirect URLs in OAM Identity System Console to specify OIM URLs for Forgot Password, Change on Password Reset and Account Lockout.

18.3.2.2 Configuring OAM 10g for Integration with OIM

There are two access servers and identity servers installed on the system. Make the following changes on both access servers and both identity servers.

1. Navigate to Access_Server_installDir/access/oblix/apps/common/bin. Edit the globalparams.xml file and add the following block to the file:

   <SimpleList>
      <NameValPair
            ParamName="OIMIntegration"
               Value="true">
      </NameValPair>
   </SimpleList>
   

2. Save the file and restart the Access Servers and Identity servers, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

3. Update the "OraDefaultI18NFormAuthNScheme Authentication Scheme by following these steps:

   1. Navigate to the Oracle Access Manager 10g Access System Console at: http://oamadminhost.mycompany.com:7777/access/oblix

   2. Select the Access System Configuration tab.

   3. Select the Authentication Management Link from the menu on the right side

   4. Select the OraDefaultI18NFormAuthNScheme.

   5. Click Modify on the Details for Authentication Scheme page to modify the OraDefaultI18NFormAuthNScheme.

   6. Set these values:

      Level: 5

      Challenge Parameter: OIMStepDownAuthLevel:1. Click + to add this value.

   7. Select Update Cache and Click Save to update the configuration.

4. You must configure the WebGate Login Pages for proper functioning of the Form based Authentication with Internationalization Support. Perform this task on all the WebHosts by editing the file config.js, which is located under the WebGate_HOME/access/oamsso/global directory on WEBHOST1 and WEBHOST2:

   1. Enable the Register and Track links by setting the hideRegLink variable in config.js to false.

   2. Set the value for the OimOHSHostPort variable to the host and port of the OHS instance front ending your OIM instance. For example: https://sso.mycompany.com:443

   3. In Section C of config.js, locate Parameters to specify actual redirection URLs... The entries for var lostPasswordURL, var registrationURL, and var trackRegistrationURL are located there. Ensure that the values are set as follows:

      var registrationURL = OimOHSHostPort +'/oim/faces/pages/USelf.jspx?OP_TYPE=SELF_REGISTRATION&T_ID=Self-Register%20User&E_TYPE=USELF';
      
      var lostPasswordURL = OimOHSHostPort + '/admin/faces/pages/forgotpwd.jspx';
      
      var trackRegistrationURL = OimOHSHostPort + '/oim/faces/pages/USelf.jspx?E_TYPE=USELF&OP_TYPE=UNAUTH_TRACK_REQUEST ';
      

5. Update the loginredirect.pl and the logout.pl files located under the ORACLE_INSTANCE/config/OHS/InstanceName/cgi-bin directory on WEBHOST1 and WEBHOST2 to use the correct perl Interpreter. To do this, update the first line in the file to point to the Perl Interpreter located under the Oracle home of Oracle HTTP Server.

6. On all the Webhosts, edit the config.pl file located under the ORACLE_INSTANCE/cgi-bin directory and update the defaultAWGEndURL, defaultendURL, and mapAgentIdToAgentHostPort variables with the appropriate values for your environment.

   The defaultAWGEndURL and defaultendURL parameters are used to specify default end_url to be used if none is specified in the query string.

   The mapAgentIdToAgentHostPort parameter is an array list that is used to map WebGate Identifier to the root of the web server hosting that WebGate. The agentid parameter is the Webgate Identifier you provided when you created the OIM policies in Section 18.3.2.1.

   To update these values, first locate the following snippet in the config.pl file:

   $defaultAWGEndURL = "http://AWGHost-Port/defaultEndURL_forAWG";
   
   $defaultendURL = "/defaultEndURL_forRWG";                               
   
   %mapAgentIdToAgentHostPort      = (                                "RWG1", "http://RWG1Host-Port/",
                                   "RWG2", "http://RWG2Host-Port/",
                                   "", ""                  ## Terminating entry
                                   );
   

   These entries have the following meanings:

   • defaultAWGEndURL: The end URL on the Authenticating Webgate

   • AWGHost-Port: The Authenticating Webgate Host and Port. In this EDG the Authenticating Webgate and the Resource Webgate are the same.

   • defaultEndURL_forRWG: The default End URL for the Resource Webgate. This is the URL to which the user will be redirected upon logging out

   • mapAgentIdToAgentHostPort: An array list that is used to map WebGate Identifier specified by the agentid to the WebServer hosting that Webgate

   • RWG1/RWG2: The WebGate Id on the Resource Webgate

   • RWG1Host-Port: The Resource Webgate Hostname and Port. In this EDG the resource webgate and the authentication webgate are the same.

   Change these values to look like this:

   $defaultAWGEndURL = "https://sso.mycompany.com:443/oim";
   
   $defaultendURL = "https://sso.mycompany.com:443/oim";
   
   %mapAgentIdToAgentHostPort      = (
                                   " IDMEDG_AG ",
                                   "https://sso.mycompany.com:443/",
                                   "", ""                  ## Terminating entry
                                   );
   

7. Save the file.

   Note:

   The following step sets the logoutRedirectUrl and is required in environments where the Authenticating Web Gate (AWG) and the Resource Web Gate (RWG) are different. In this deployment guide, because the AWG and the RWG are the same, this step is not required.

8. Update the Webgate entries with the logoutRedirectUrl. Follow these steps:

   1. Navigate to the Oracle Access Manager 10g Access System Console at: http://oamadminhost.mycompany.com:7777/access/oblix

   2. Select the Access System Configuration tab.

   3. Select Access Gate Configuration from the menu on the right.

   4. Specify the search criteria for the Access Gate and click Go on the Search for Access Gate to list the WebGate.

   5. Select the WebGate from the list. This is the same WebGate, OIMPolicy_AG, created in Section 18.3.2.

   6. Click Modify on the Details for Access Gate page to modify the OIMPolicy_AG WebGate.

   7. Update the User Defined Parameter section as follows:

      Parameter: logoutRedirectUrl

      Values: https://sso.mycompany.com:443/cgi-bin/logout.pl

   8. Click Save to save the configuration.

9. Stop and start the OHS Instances running on WEBHOST1 and WEBHOST2, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

10. Stop and start all the Identity Servers and Access Servers in your environment, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

18.3.3.1 Configuring OAM 10g/OIM Authenticator

To configure auto-login for Oracle Identity Manager, update the oim-config.xml file with the required parameters. The oam-config.xml file is in the MDS repository under the /db/oim-config.xml directory. The file must be exported to the local file system from MDS, then imported back in to MDS, and the server restarted for the changes to take effect.

1. To export the /db/oim-config.xml file from MDS to the local file system, follow these steps:

   1. Use the OIM Export Metadata tool to export the /db/oim-config.xml file from the MDS repository. The OIM Export Metadata Tool, weblogicExportMetadata.sh, is located under the IAM_ORACLE_HOME/server/bin directory.

   2. Before you attempt to execute the tool, update the weblogic.properties file under the IAM_ORACLE_HOME/server/bin directory with the following properties:

      wls_servername: Server name OIM

      application_name: OIMMetadata

      metadata_to_loc: Location on the OIMHOST to which files are exported

      metadata_files: /db/oim-config.xml

      The following is an example of the weblogic.properties file:

      # Weblogic Server Name on which OIM application is running
      
      wls_servername=WLS_OIM1
      
      # If you are importing or exporting any out of box event handlers, value is oim.
      # For rest of the out of box metadata, value is OIMMetadata.
      # If you are importing or exporting any custom data, always use application name as OIMMetadata.
      
      application_name=OIMMetadata
      
      # Directory location from which XML file should be imported.
      # Lets say I want to import User.xml and it is in the location /scratc/asmaram/temp/oim/file/User.xml,
      # I should give from location value as /scratc/asmaram/temp/oim. Make sure no other files exist
      # in this folder or in its sub folders. Import utility tries to recursively import all the files under the
      # from location folder. This property is only used by weblogicImportMetadata.sh
      
      metadata_from_loc=@metadata_from_loc
      
      # Directory location to which XML file should be exported to
      
      metadata_to_loc=/home/oracle/oim_export# For example /file/User.xml to export user entity definition. You can specify multiple xml files as comma separated values.# This property is only used by weblogicExportMetadata.sh and weblogicDeleteMetadata.sh scripts
      
      metadata_files=/db/oim-config.xml
      
      # Application versionapplication_version=11.1.1.3.0
      

   3. Set the OIM_ORACLE_HOME variable to the Identity Management Oracle home.

      prompt> export OIM_ORACLE_HOME=/u01/app/oracle/product/fmw/iam
      

   4. Run the OIM Export Metadata Tool:

      prompt>./weblogicExportMetadata.sh
      

   5. When prompted, provide the following values:

      username: The admin user name for the Weblogic Domain, for example: weblogic

      password: The password for the Admin User

      server URL: The URL to connect to the OIM managed server, for example: t3://oimhost1.mycompany.com:14000

   6. The output from the tool is similar to this:

      Initializing WebLogic Scripting Tool (WLST) ...
      
      Welcome to WebLogic Server Administration Scripting Shell
      
      Type help() for help on available commands
      
      Starting export metadata script ....
      Please enter your username [weblogic] :weblogic
      Please enter your password [welcome1] :
      Please enter your server URL [t3://localhost:7001] :t3://oimhost1.mycompany.com:14000
      Connecting to t3:// oimhost1.mycompany.com:14000 with userid weblogic ...
      Successfully connected to managed Server 'WLS_OIM2' that belongs to domain 'IDMDomain'.
      
      Warning: An insecure protocol was used to connect to theserver. To ensure on-the-wire security, the SSL port orAdmin port should be used instead.
      Location changed to custom tree. This is a writable tree with No root.
      For more help, use help(custom)
      
      Disconnected from weblogic server: WLS_OIM2
      End of export metadata script ...
      
      Exiting WebLogic Scripting Tool.
      

   7. Edit the oim-config.xml file created under the /home/oracle/oim_export/db directory and update the values as shown

      <ssoConfig>
         <version>@oamVersion</version>
         <accessServerHost>@oamAccessServerHost</accessServerHost>
         <accessServerPort>@oamAccessServerPort</accessServerPort>
         <accessGateID>@oamAccessGateID</accessGateID>
         <cookieDomain>@oamcookiedomain</cookieDomain>
         <napVersion>3</napVersion>
         <transferMode>OPEN</transferMode>  
         <webgateType>ohsWebgate10g</webgateType
         <ssoEnabled>false</ssoEnabled>
      </ssoConfig>
      

      For Example:

      <ssoConfig>
          <version>10.1.4.3</version>
          <accessServerHost>sso.mycompany.com</accessServerHost>
          <accessServerPort>443</accessServerPort>
          <accessGateID>IDMEDG_AG</accessGateID>
          <napVersion>3</napVersion>
          <cookieDomain>.mycompany.com</cookieDomain>
          <transferMode>open</transferMode>
          <webgateType>ohsWebgate10g</webgateType>
          <ssoEnabled>true</ssoEnabled>
      </ssoConfig>   
      

      Note:

      • oamAccessServerHost: Specify the VIP that front ends the OAM servers

      • oamAccessServerPort: Specify the port for the VIP

      • oamAccessGateID: Specify the Access Gate associated with the policy domain. Provide the same Access Gate id that was used to configure the policies for OIM in Section 18.3.2, "Configuring OAM for OAM -OIM Integration."

   8. Save the file.

2. For the changes to take effect, import the file into MDS by following these steps:

   1. Update the weblogic.properties file under the IAM_ORACLE_HOME/server/bin directory as shown here:

      wls_servername: Server name OIM

      application_name: application_name=OIMMetadata

      metadata_from_loc: Location on the OIMHOST from which files are imported

      metadata_files: /db/oim-config.xml

      The following is an example of the weblogic.properties file:

      # Weblogic Server Name on which OIM application is running
      
      wls_servername=WLS_OIM1
      
      # If you are importing or exporting any out of box event handlers, value is oim.
      # For rest of the out of box metadata, value is OIMMetadata.
      # If you are importing or exporting any custom data, always use application name as OIMMetadata.
      
      application_name=oim
      
      # Directory location from which XML file should be imported.
      # Lets say I want to import User.xml and it is in the location /scratc/asmaram/temp/oim/file/User.xml,
      # I should give from location value as /scratc/asmaram/temp/oim. Make sure no other files exist
      # in this folder or in its sub folders. Import utility tries to recursively import all the files under the
      # from location folder. This property is only used by weblogicImportMetadata.sh
      
      metadata_from_loc=/home/oracle/oim_export
      
      # Directory location to which XML file should be exported to
      
      metadata_to_loc=/home/oracle/oim_export
      
      # For example /file/User.xml to export user entity definition. You can specify multiple xml files as comma separated values.
      # This property is only used by weblogicExportMetadata.sh and weblogicDeleteMetadata.sh scripts
      
      metadata_files=/db/oim-config.xml
      
      # Application version
      application_version=11.1.1.3.0
      

   2. Run the OIM Import Metadata Tool:

      prompt>./weblogicImportMetadata.sh
      

      Provide the values for the username, password and the server URL when prompted.

      username: The admin user name for the Weblogic Domain, for example: weblogic

      password: The password for the Admin User

      server URL: The URL to connect to OIM managed server, for Example: t3://oimhost1.mycompany.com:7001

      The output from the tool is similar to this:

      Initializing WebLogic Scripting Tool (WLST) ...
      
      Welcome to WebLogic Server Administration Scripting Shell
      
      Type help() for help on available commands
      
      Starting import metadata script ....
      Please enter your username [weblogic] :weblogic
      Please enter your password [welcome1] :
      Please enter your server URL [t3://localhost:7001] :t3:// oimhost1.mycompany.com:14000
      Connecting to t3://oimhost1.mycompany.com:14000 with userid weblogic ...
      Successfully connected to managed Server 'WLS_OIM1' that belongs to domain 'IDMDomain'.
      
      Warning: An insecure protocol was used to connect to theserver. To ensure on-the-wire security, the SSL port or Admin port should be used instead.
      
      Location changed to custom tree. This is a writable tree with No root.
      For more help, use help(custom)
      Disconnected from weblogic server: WLS_OIM2
      End of import metadata script ...
      Exiting WebLogic Scripting Tool.
      

18.3.3.2 Seeding Access Gate Password in CSF

You must seed the Access Gate Password in the Credential Store Framework. Follow the steps in this section to seed the access gate password.

Seed Access gate password in CSF against Map name oim and key name SSOAccessKey. This CSF is cwallet.sso in the directory DOMAIN_HOME/config/fmwconfig. Run ORACLE_HOME/common/bin/wlst.sh

connect()
createCred(map="oim", key="SSOAccessKey",user="SSOAccessKey",password="welcome1",desc="OAMAccessGatePassword")
listCred(map="oim",key="SSOAccessKey")

18.3.3.3 Enable WLS Plug-ins

Enable the Weblogic Server Plug-ins for OIM using the WLS Admin Console by following these steps:

1. Go to the WebLogic Administration Console at: http://ADMINHOSTVHN.mycompany.com/console

2. Log in to the WebLogic Administration Console using the credentials for the weblogic user

3. Navigate to Environment > servers > WLS_OIM1 > Advanced and select WebLogic Plug-In Enabled if not selected already.

18.3.3.4 Import the SSO Notfication Eventhandlers into the MDS Repository

You must import the SSO notification handler entries for Oracle Access Manager into the Oracle Identity Manager MDS repository. The notification handler entries are in the EventHandlers.xml file located under the IAM_ORACLE_HOME/server/oamMetadata/db/ssointg directory. Import the notification events into the MDS repository using the OIM Import Metadata Tool by following these steps:

1. Use the OIM Import Metadata tool to import the EventHandlers.xml file into the MDS repository. The OIM Import Metadata Tool, weblogicImportMetadata.sh is located under the IAM_ORACLE_HOME/server/bin directory.

2. Before you attempt to execute the tool, update the weblogic.properties file under the IAM_ORACLE_HOME/server/bin directory with the following properties:

   wls_servername: Server name OIM

   application_name: OIMMetadata

   metadata_from_loc: Location on the OIMHOST from which files are imported

   file_names: /db/ssointg/EventHandlers.xml

   The following is an example of the weblogic.properties file:

   # Weblogic Server Name on which OIM application is running
   
   wls_servername=WLS_OIM1
   
   # If you are importing or exporting any out of box event handlers, value is oim.
   # For rest of the out of box metadata, value is OIMMetadata.
   # If you are importing or exporting any custom data, always use application name as OIMMetadata.
   
   application_name=oim
   
   # Directory location from which XML file should be imported.
   # Lets say I want to import User.xml and it is in the location /scratc/asmaram/temp/oim/file/User.xml,
   # I should give from location value as /scratc/asmaram/temp/oim. Make sure no other files exist
   # in this folder or in its sub folders. Import utility tries to recursively import all the files under the
   # from location folder. This property is only used by weblogicImportMetadata.sh
   
   metadata_from_loc=/home/oracle/oim_export
   
   # Directory location to which XML file should be exported to
   
   metadata_to_loc=/home/oracle/oim_export
   
   # For example /file/User.xml to export user entity definition. You can specify multiple xml files as comma separated values.
   
   # This property is only used by weblogicExportMetadata.sh and weblogicDeleteMetadata.sh scripts
   
   metadata_files=/db/ssointg/EventHandlers.xml
   
   # Application version
   application_version=11.1.1.3.0
   

3. Copy IAM_ORACLE_HOME/server/oamMetadata/db/ssointg/EventHandlers.xml to the location provided in the metadata_from_loc parameter.

   For example:

   cp IAM_ORACLE_HOME/server/oamMetadata/db/ssointg/EventHandlers.xml /home/oracle/db/ssointg/EventHandlers.xml
   

4. Copy IAM_ORACLE_HOME/server/oamMetadata/db/ssointg/EventHandlers.xml to the location provided in the metadata_from_loc parameter.

   Run the OIM Import Metadata Tool:

   prompt>./weblogicImportMetadata.sh
   

   Provide the values for the username, password and the server URL when prompted.

   username: The admin user name for the Weblogic Domain, for example: weblogic

   password: The password for the Admin User

   server URL: The URL to connect to OIM managed server, for example: t3://oimhost1.mycompany.com:7001

   The output from the tool is similar to this:

   Initializing WebLogic Scripting Tool (WLST) ...
   
   Welcome to WebLogic Server Administration Scripting Shell
   
   Type help() for help on available commands
   
   Starting import metadata script ....
   Please enter your username [weblogic] :weblogic
   Please enter your password [welcome1] :
   Please enter your server URL [t3://localhost:7001] :t3:// oimhost1.mycompany.com:14000
   Connecting to t3://oimhost1.mycompany.com:14000 with userid weblogic ...
   Successfully connected to managed Server 'WLS_OIM1' that belongs to domain 'IDMDomain'.
   
   Warning: An insecure protocol was used to connect to theserver. To ensure on-the-wire security, the SSL port or Admin port should be used instead.
   
   Location changed to custom tree. This is a writable tree with No root.
   For more help, use help(custom)
   
   Disconnected from weblogic server: WLS_OIM2
   End of import metadata script ...
   

5. Exit the WebLogic Scripting Tool.

18.3.3.5 Configuring OAM 10g/OIM Authenticator

1. Create the Oracle Internet Directory Authenticator as described in Section 20.1.5.1, "Setting Up the Oracle Internet Directory Authenticator."

2. Create the Oracle Access Manager Identity Asserter as described in Section 20.1.5.2, "Setting Up the Oracle Access Manager Identity Asserter."

3. Create the OIMSignature Authenticator as follows

   1. Log in to the WebLogic Administration Console at: http://ADMINHOSTVHN.mycompany.com/console

   2. Click Security Realms from the Domain structure menu.

   3. Click Lock and Edit in the Change Center.

   4. Click myrealm.

   5. Select the Providers tab.

   6. Click New.

   7. Supply the following information:

      Name: OIMSignatureAuthenticator

      Type: OIMSignatureAuthenticator

   8. Click OK.

   9. Click the link for the newly created OIMSignatureAuthenticator provider

   10. Under the Common tab, set the Control Flag as Sufficient.

   11. Click Save

   12. Click Activate Changes to activate the change.

   13. Do not restart the Administration Server or the managed servers; that is done at the end of this section.

4. Set the Control Flag for the OIM Authenticator to Optional. Follow these steps:

   1. Log in to the WebLogic Administration Console at: http://ADMINHOSTVHN.mycompany.com/console

   2. Click Security Realms from the Domain structure menu.

   3. Click Lock and Edit in the Change Center.

   4. Click myrealm.

   5. Select the Providers tab.

   6. Click the OIMAuthenticationProvider link

   7. Under the Common tab, set the Control Flag to Optional.

   8. Click Save.

   9. Click Activate Changes to activate the change.

   10. Do not restart the Administration Server or the managed servers; that is done at the end of this section.

5. Reorder the Authenticator Providers as shown in the table. Follow these steps to reorder the providers:

   1. Log in to the WebLogic Administration Console at: http://ADMINHOSTVHN.mycompany.com/console

   2. Click Security Realms from the Domain structure menu.

   3. Click Lock and Edit in the Change Center.

   4. Click myrealm.

   5. Select the Providers tab.

   6. Click Reorder.

   7. On the Reorder Authentication Providers page, reorder the providers as shown in the following table. Ensure that the Control Flags are as shown in the table.

      Name	Control Flag
      OAMIdentityAsserter	REQUIRED
      Default Authenticator	SUFFICIENT
      OIMSignatureAuthenticator	SUFFICIENT
      OIMAuthentication Provider	OPTIONAL
      OIDAuthenticator	SUFFICIENT
      Default Identity Asserter	SUFFICIENT

      
      

6. Restart the Administration Server and the managed servers in the domain, as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

18.3.4.1 Prerequisites

Ensure that the following criteria have been met before running oimcfgtool:

1. The wlfullclient.jar file exists under the MW_HOME/wlserver_10.3/server/lib directory. If the jar file not present, generate the jar file by following the steps in Section 4.7.7, "Creating the wlfullclient.jar File."

2. You are running oimcfgtool from the IAM_ORACLE_HOME/server/ssointg directory. Do not copy this tool to a different location.

3. Set the JAVA_HOME and the WL_HOME:

   JAVA_HOME=ORACLE_BASE/product/fmw/jdk160_18
   WL_HOME=ORACLE_BASE/product/fmw/wlserver_10.3
   PATH=JAVA_HOME/bin:$PATH
   

   Note:

   The JAVA_HOME must be set to the SUN JDK

18.3.4.2 Using OIM Configuration Tool

Follow these steps to integrate Oracle Access Manager with Oracle Identity Manager using oimcfgtool.

1. Set your ORACLE_HOME to the IAM_ORACLE_HOME, the JAVA_HOME to the SUN JDK directory and make sure that PATH includes JAVA_HOME.

   prompt>export MW_HOME=/opt/maa/oracle/plus/product/fmw
   prompt>export ORACLE_HOME=/opt/maa/oracle/plus/product/fmw/iam
   prompt>export JAVA_HOME=/opt/maa/oracle/plus/product/fmw/jdk160_18
   prompt>export PATH=$JAVA_HOME/bin:$PATH
   

2. Change directory to

   ORACLE_HOME/server/ssointg

   Run the oimcfgtool with the generate-profile option to create the sso-config.profile file. Provide your inputs in sso-config.profile. You will be prompted for required inputs not provided in the profile file. Run the tool as follows:

   java -jar oimcfgtool.jar generate-profile
   

   The output is similar to this:

   Turning off debug logs
   
   Generating sso-config.profile...
   
   Generated sso-config.profile
   

3. Edit the sso-config.profile file created under the IAM_ORACLE_HOME/server/ssointg directory. Provide the following values. The remaining values in the file are not required to update existing LDAP users.

   • LDAP Host: The hostname for the LDAP Server

   • LDAP Port: The port for the LDAP Server

   • LDAP Root DN: The Administrator DN to connect the LDAP Server

   • User Search Base: The LDAP Search Base for the OIM Users

   • Group Search Base: The LDAP Search Base for the OIM Groups

   • Password Expiry Period in Days: The Password Expiry Period in Days. The default value is 7300.

   The following is an example of the sso-config.profile file.

   LDAP Host :-oid.mycompany.com
   LDAP Port :-389
   LDAP Root DN :-cn=orcladmin
   User Search Base :-cn=Users,dc=mycompany,dc=com
   Group Search Base :-cn=Groups,dc=mycompany,dc=com
   Password Expiry Period in Days :-7300
   

4. Run oimcfgtool with the option to update the access server information in the oim-config.xml file. Run the tool as follows and provide the password for the LDAP Root DN when queried:

   java -jar oimcfgtool.jar upgrade-ldap-users
   

   The output will be similar to this:

   [orcl@strasha07 ssointg]$ java -jar oimcfgtool.jar upgrade-ldap-users
   Turning off debug logs
   
   
   ********* Upgrading LDAP Users With OAM ObjectClasses *********
   
   Loading inputs from sso-config.profile
   
   Completed loading inputs from sso-config.profile
   
   Remaining inputs will be queried from console.
   
   Enter LDAP Root DN Password: 
   
   
   Completed loading user inputs for - LDAP connection info
   
   
   
   Completed loading user inputs for - LDAP Upgrade
   
   Upgrading ldap users at - cn=Users,dc=mycompany,dc=com
   
   Parsing - cn=Users,dc=mycompany,dc=com
   
   objectclass OIMPersonPwdPolicy not present in cn=weblogic_idm,cn=users,dc=mycompany,dc=com. Seeding it
   
   objectclass OblixOrgPerson not present in cn=weblogic_idm,cn=users,dc=mycompany,dc=com. Seeding it
   
   objectclass OblixPersonPwdPolicy not present in cn=weblogic_idm,cn=users,dc=mycompany,dc=com. Seeding it
   
   obpasswordexpirydate added in cn=weblogic_idm,cn=users,dc=mycompany,dc=com
   
   Finished parsing LDAP
   
   LDAP Users Upgraded.
   
   ********* ********* *********
   
   Operation completed. Please restart all servers.
   

5. Stop and Start the WLS Administration Server and all the Managed Servers in the domain as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

18.4.4.1 Prerequisites

Ensure that the following criteria have been met before running oimcfgtool:

1. The wlfullclient.jar file exists under the MW_HOME/wlserver_10.3/server/lib directory. If the jar file not present, generate the jar file by following the steps in Section 4.7.7, "Creating the wlfullclient.jar File."

2. You are running oimcfgtool from the IAM_ORACLE_HOME/server/ssointg directory. Do not copy this tool to a different location.

3. Set the JAVA_HOME and the WL_HOME:

   JAVA_HOME=ORACLE_BASE/product/fmw/jdk160_18
   WL_HOME=ORACLE_BASE/product/fmw/wlserver_10.3
   
   PATH=JAVA_HOME/bin:$PATH
   

   Note:

   The JAVA_HOME must be set to the SUN JDK.

18.4.4.2 Using OIM Configuration Tool

Follow these steps to integrate OAM with OIM using oimcfgtool.

1. Set your ORACLE_HOME to the IAM_ORACLE_HOME, the JAVA_HOME to the SUN JDK directory and make sure that PATH includes JAVA_HOME.

   prompt>export MW_HOME=/opt/maa/oracle/plus/product/fmw
   prompt>export ORACLE_HOME=/opt/maa/oracle/plus/product/fmw/iam
   prompt>export JAVA_HOME=/opt/maa/oracle/plus/product/fmw/jdk160_18
   prompt>export PATH=$JAVA_HOME/bin:$PATH
   

2. Run the oimcfgtool with the generate-profile option to create the sso-config.profile file. Provide your inputs in sso-config.profile. You will be prompted for required inputs not provided in profile file. Run the tool as follows:

   java -jar oimcfgtool.jar generate-profile
   

   The output is similar to this:

   java -jar oimcfgtool.jar generate-profile
   Turning off debug logs
   
   Generating sso-config.profile...
   
   Generated sso-config.profile
   

3. Edit the sso-config.profile file created under IAM_ORACLE_HOME/server/ssointg directory. Provide the values as shown:

   • Access Server Host: The port for LoadBalancer virtual IP address front ending the Oracle Access Manager servers

   • Access Server Port: The port for LoadBalancer virtual IP address fronting the Oracle Access Manager servers

   • Access Gate ID: The Name of the Access Gate. Provide the Webgate Gate ID that was configured in Section 18.2.2, "Creating WebGate Agents."

   • Cookie Domain: The cookie domain for your environment. Make sure to use the "." before the domain name

   • Cookie Expiry Interval: The Cookie Expiry Interval. The default value is 120 minutes.

   • OAM Transfer Mode OPEN/SIMPLE/CERT: The OAM Transfer Mode. The default value is OPEN

   • Webgate type javaWebgate/ohsWebgate10g/ohsWebgate11g: The WebGate type. The value used in this deployment guide is ohsWebgate10g.

   • SSO Enabled Flag: True or False. For this deployment guide, it is True.

   • MDS DB Url: The JDBC URL to connect to the MDS database, For Oracle RAC databases, you can specify the URL to connect to a single instance. Use the format: jdbc:oracle:thin:@host:port:sid

   • MDS DB Schema Username: The DB Schema Username for the MDS Database, EDG_MDS

   • Domain Location: The domain directory location for the Administration Server

   • WLS Server URL: The URL to connect to the WebLogic Administration Server. The format is: t3://host:port

   • WLS Username: The username for the WebLogic Administrator

   • Domain Name: The Domain name

   • OIM Managed Server Name: The OIM Managed Server Name

   • LDAP Host: The hostname for the LDAP Server

   • LDAP Port: The port for the LDAP Server

   • LDAP Root DN: The Administrator DN to connect the LDAP Server

   • User Search Base: The LDAP Search Base for the OIM Users

   • Group Search Base: The LDAP Search Base for the OIM Groups

   • Password Expiry Period in Days: The Password Expiry Period in Days. The default value is 7300.

   The following is an example of the sso-config.profile file.

   Access Server Host :- sso.mycompany.com
   Access Server Port :-443
   Access Gate ID :-Webgate_sso
   Cookie Domain :-.mycompany.com
   Cookie Expiry Interval :-120
   OAM Transfer Mode OPEN/SIMPLE/CERT :-OPEN
   Webgate type javaWebgate/ohsWebgate10g/ohsWebgate11g :-ohsWebgate10g
   SSO Enabled Flag :-true
   MDS DB Url :-jdbc:oracle:thin:@oimdb1-vip.mycompany.com:1521:oimdb1
   MDS DB Schema Username :-EDG_MDS
   Domain Location :-/u01/app/oracle/admin/IDMDomain/aserver/IDMDomain
   WLS Server URL :-t3://ADMINHOSTVHN.mycompany.com:7001
   WLS Username :-weblogic
   Domain Name :-IDMDomain
   OIM Managed Server Name :-WLS_OIM1
   LDAP Host :-oid.mycompany.com
   LDAP Port :-389
   LDAP Root DN :-cn=orcladmin
   User Search Base :-cn=Users,dc=mycompany,dc=com
   Group Search Base :-cn=Groups,dc=mycompany,dc=com
   Password Expiry Period in Days :-7300
   

4. Run oimcfgtool with the option to update the access server information in the oim-config.xml file. Run the tool as follows and provide the schema password for the MDS Database when queried:

   java -jar oimcfgtool.jar update-oim-config
   

   The output will be similar to this:

   java -jar oimcfgtool.jar update-oim-config
   Turning off debug logs
   ********* Seeding OAM Config in OIM *********
   Loading inputs from sso-config.profile
   Completed loading inputs from sso-config.profile
   Remaining inputs will be queried from console.
   Completed loading user inputs for - OAM Access Config
   Enter MDS DB Schema Password: 
   Completed loading user inputs for - MDS DB Config
   Validated input values
   Initialized MDS resources
   
   Jun 25, 2010 1:30:50 PM oracle.mds
   NOTIFICATION: transfer operation started.
   Jun 25, 2010 1:30:51 PM oracle.mds
   NOTIFICATION: transfer is completed. Total number of documents successfully processed : 1, total number of documents failed : 0.
   Download from DB completed
   Releasing all resources
   Updated oamMetadata/db/oim-config.xml
   Initialized MDS resources
   
   Jun 25, 2010 1:30:51 PM oracle.mds
   NOTIFICATION: transfer operation started.
   Jun 25, 2010 1:30:53 PM oracle.mds
   NOTIFICATION: transfer is completed. Total number of documents successfully processed : 1, total number of documents failed : 0.
   Upload to DB completed
   
   Releasing all resourcesOAM configuration seeded. Please restart oim server.********* ********* *********Operation completed. Please restart all servers.
   

5. Run the oimcfgtool with the seed-oam-passwords option to seed the OAM webgate passwords in the Credential Store. Run the tool as follows and provide the SSO Access Gate password and the domain location for the Admin Server when queried. This is the same password you provided when you created the Webgate Agents in Section 18.2.2, "Creating WebGate Agents." Leave the ssoKeystore.jks and the SSO Global Passphrase blank. These values are not required when the OAM Transfer Mode is Open:

   java -jar oimcfgtool.jar seed-oam-passwords
   

   The output is similar to this:

   java -jar oimcfgtool.jar seed-oam-passwords
   Turning off debug logs
   ********* Seeding OAM Passwds in OIM *********
   Loading inputs from sso-config.profile
   Completed loading inputs from sso-config.profile
   Remaining inputs will be queried from console.
   
   Enter SSO Access Gate Password: 
   Enter ssoKeystore.jks Password: 
   Enter SSO Global Passphrase: 
   Enter Domain Location: /u01/app/oracle/admin/IDMDomain/aserver/IDMDomain
   
   Completed loading user inputs for - CSF Config
   Updating CSF with Access Gate Password...
   Updating CSF ssoKeystore.jks Password...
   Updating CSF for SSO Global Passphrase Password...
   ********* ********* *********
   Operation completed. Please restart all servers.
   

6. Run the oimcfgtool with the seed-oam-metadata option to upload the OAM notification handlers. Run the tool as follows and provide the schema password for the MDS Database when queried:

   java -jar oimcfgtool.jar seed-oam-metadata
   

   The output is similar to this:

   java -jar oimcfgtool.jar seed-oam-metadata
   Turning off debug logs
   ********* Activating OAM Notifications *********
   Loading inputs from sso-config.profile
   Completed loading inputs from sso-config.profile
   Remaining inputs will be queried from console.
   Enter MDS DB Schema Password: 
   
   Completed loading user inputs for - MDS DB Config
   Initialized MDS resources
   Jun 25, 2010 1:40:58 PM oracle.mds
   NOTIFICATION: transfer operation started.
   Jun 25, 2010 1:40:59 PM oracle.mds
   NOTIFICATION: transfer is completed. Total number of documents successfully processed : 1, total number of documents failed : 0.
   Upload to DB completed
   Releasing all resources
   Notifications activated.
   ********* ********* *********
   Operation completed. Please restart all servers.
   

7. Create the OIMSignature Authenticator as follows:

   1. Log in to the WebLogic Administration Console at: http://admin.mycompany.com/console

   2. Click Security Realms from the Domain structure menu.

   3. Click Lock and Edit in the Change Center.

   4. Click myrealm.

   5. Select the Providers tab.

   6. Click New.

   7. Supply the following information:

      Name: OIMSignatureAuthenticator

      Type: OIMSignatureAuthenticator

   8. Click OK.

   9. Click the link for the newly created OIMSignatureAuthenticator provider.

   10. Under the Common tab, Set the Control Flag to Sufficient.

   11. Click Save.

   12. Click Activate Changes to activate the change.

   13. Do not restart the Administration Server or the managed servers; that is done at the end of this section.

8. Set the Control Flag for the OIM Authentication Provider to Optional. Follow these steps:

   1. Log in to the WebLogic Administration Console at: http://admin.mycompany.com/console

   2. Click Security Realms from the Domain structure menu.

   3. Click Lock and Edit in the Change Center.

   4. Click myrealm.

   5. Select the Providers tab.

   6. Click the OIMAuthenticationProvider link.

   7. Under the Common tab, set the Control Flag to Optional.

   8. Click Save.

   9. Click Activate Changes to activate the change.

   10. Do not restart the Administration Server or the managed servers; that is done at the end of this section.

9. Reorder the Authenticator Providers as shown in the table. Follow these steps to reorder the providers:

   1. Log in to the WebLogic Administration Console at: http://admin.mycompany.com/console

   2. Click Security Realms from the Domain structure menu.

   3. Click Lock and Edit in the Change Center.

   4. Click myrealm.

   5. Select the Providers tab.

   6. Click Reorder

   7. On the Reorder Authentication Providers page, reorder the providers as shown in the following table. Ensure that the Control Flags are set as show in the table.

      Name	Control Flag
      OAM Identity Asserter	REQUIRED
      Default Authenticator	SUFFICIENT
      OIM Signature Authenticator	SUFFICIENT
      OIM Authentication Provider	OPTIONAL
      OVD Authenticator	SUFFICIENT
      Default Identity Asserter	SUFFICIENT

      
      

10. Stop and Start the WLS Administration Server and all the Managed Servers in the domain as described in Section 19.1, "Starting and Stopping Oracle Identity Management Components."

18.5.5.1 Creating a Resource

Now that you have something to protect, create a resource in OAM and assign it to the OAAM policy group you created in Section 11.8.2, "Creating Oracle Adaptive Access Manager Policy Group"

Log in to the OAM console at: http://admin.mycompany.com/oamconsole. Log in using the oamadmin account created previously.

1. From the Navigation window expand: Application Domains > IDMDomainAgent.

2. Click Resources.

3. Click Create on the tool bar below the Browse tab.

4. Enter the following information:

   • Type: http

   • Host Identifier: IDMDomain

   • Resource URL: /oaam_sso.html

5. Click Apply.

18.5.5.2 Assigning Resource to Policy Group

Now that the resource exists, assign it to one of the policy groups you created.

Log in to the OAM console at: http://admin.mycompany.com/oamconsole using the oamadmin account you previously created.

1. From the Navigation window, expand: Application Domains > IDMDomainAgent > Authentication Policies.

2. Click OAAM Protected Resources.

3. Click Edit on the tool bar below the Browse tab.

4. In the Resources box, click +.

5. From the list select, the resource you created.

6. Click Apply.

18.5.5.3 Adding Resource to Protected Resources

All that remains is to add the resource to the list of protected resources. To do this, log in to the OAM console at: http://admin.mycompany.com using the oamadmin account you created.

1. From the Navigation window expand: Application Domains > IDMDomainAgent > Authorization Policies.

2. Click Protected Resource Policy.

3. Click Edit on the tool bar below the Browse tab.

4. In the Resources box, click +.

5. From the list, select the resource you created.

6. Click Apply.

18.5.5.4 Validating Oracle Access Manager

Install Oracle WebGate as described in Section 18.2, "Installing and Configuring WebGate".

Access your protected resource using the URL: https://sso.mycompany.com:443/oaam_sso.html. The OAAM Login page is displayed. Log in using an authorized OAM user such as oamadmin. Once you are logged in, the oaam protected resource is displayed.

18.7.1.1 Generating and Configuring Identity Provider and Service Provider Modules

First, generate metadata.

1. From the OIF menu, select Administration, then Security And Trust and click the Provider Metadata tab.

2. In the Generate Metadata section of the page, select Service Provider and click Generate to generate metadata for the Service Provider.

3. Save the metadata file to a directory on the local disk of the client machine.

4. Then select Identity Provider and click Generate to generate metadata for the Identity Provider.

Next, register the Service Provider and the Identity Provider by loading the metadata.

1. From the OIF menu, select Administration, then Federations.

2. Click Add to load the metadata you just generated.

3. Select Enable Provider and Load Metadata.

Both the Service Provider and the Identity Provider should now be listed on the Federations page.

18.7.1.2 Configuring the Data Stores

1. From the OIF menu, select Administration, then Data Stores.

2. Click Edit, select the Repository Type, and furnish the DataStore details in the User Data Store section of the page.

18.7.1.3 Configuring the Authentication Engines

1. From the OIF menu, select Administration, then Authentication Engines.

2. Furnish the Data Store settings configured in Section 18.7.1.2, "Configuring the Data Stores" here, so that the authentication engine has the details of the user data store to authenticate the user against.

3. Choose LDAP Directory in the Default Authentication Engine list. Click Apply.

4. From the OIF menu, select Administration, then Service Provider. On the Common tab, enable the Service Provider and choose the Service provider that was registered in Section 18.7.1.1, "Generating and Configuring Identity Provider and Service Provider Modules" as the Default Service Provider.

5. Similarly, from the OIF menu, select Administration, then Identity Provider. On the Common tab, enable the Identity Provider and choose the Identity provider that was registered in Section 18.7.1.1, "Generating and Configuring Identity Provider and Service Provider Modules" as the Default Identity Provider.

18.7.1.4 Configuring the OIF Server in Service Provider Mode

Now configure Oracle Identity Federation with the Oracle Access Manager Server details, so that it can send assertion tokens and leverage the session management to the Oracle Access Manager Server.

1. From the OIF menu, select Administration, then Service Provider Integration Modules.

2. Select Oracle Single Sign-On from the list.

3. On the Oracle Single Sign-On tab, select Logout Enabled and configure the following details:

   • Login URL: https://sso.mycompany.com/oam/server/dap/cred_submit

   • Logout URL: https://sso.mycompany.com/oam/server/logout

4. Next to Oracle Single Sign-On Secret, click Regenerate. This generates a file called keystore which contains the keys used to encrypt and decrypt tokens that pass between the Oracle Access Manager Server and the Oracle Identity Federation Server.

5. Generate the keystore file. Save the file when you get the Save As dialog box. Save the keystore file into a location on your localhost.

You will need to furnish the full path of the keystore file when you use the wlst command, as described in the next section.