7 Configuring Oracle Access Manager to use Windows Native Authentication

7.3.1 Edit the krb5.conf File

To edit the krb5.conf file

1. Open the krb5.conf file, which is located in /etc/krb5.conf.

2. Update the file with the following entries

   [Libdefaults]
   default_realm = HOLMIUM.NGAM.COM
   ticket_lifetime = 600
    
   [realms]
    
   HOLMIUM.NGAM.COM = {
   kdc = holmium.us.oracle.com
   admin_server = holmium.us.oracle.com
   default_domain = HOLMIUM.NGAM.COM
   }
    
   [domain_realm]
   .holmium.ngam.com = HOLMIUM.NGAM.COM
   holmium.ngam.com = HOLMIUM.NGAM.COM
   

7.3.2 Create the Service Principal Name (SPN)

You perform this task to create an SPN and associate it with a user.

The following procedure includes an example user named testuser. The Oracle Access Manager server is deployed on a machine named mynode47.us.mycorp.com.

To create the SPN and associate it with a user

1. Create the user in Microsoft Active Directory.

2. Run ktpass to create the service principal name and associate it with this user. For example:

   ktpass -princ HTTP/[email protected] -pass Oblix!@# 
   -mapuser testuser -out D:\etc\ keytab.service
   

   Here:

   • HTTP/[email protected] is a principal name associated with user testuser.

   • Oblix!@# is testuser's password.

   • The service is the name of the machine on which the Oracle Access Manager server is deployed. For example, if the service is mynode47.us.mycorp.com then the principal name is HTTP/[email protected].

   • The -mapuser parameter specifies a userid (samaccountname) to which this principal name is to be attached. A given principal name can only be attached to one user.

   • D:\etc\ keytab.service is the keytab file to be generated. Once the file is generated, this keytab file will be used on the Oracle Access Manager server.

3. Copy the newly created keytab.services file to the machine on which the NG server is running.

7.3.3 Obtain the Kerberos Ticket

You use the kinit command to obtains the master Kerberos ticket that you use to get tickets for other services.

The kinit command uses the /etc/krb5.conf file; ensure that this file has the correct attributes. The basic syntax for kinit is: shown here

kinit  [-k] [-t <keytab_filename>] [<principal>] 

To obtain the Kerberos ticket

1. On the Oracle Access Manager server host machine, run the command from JDK_HOME/bin.

   kinit –V HTTP/[email protected] –k –t /scratch/kerberos/keytab.service 
   

   where:

   • -V indicates verbose mode

   • principal name is HTTP/[email protected]

   • -k instructs the command to use keytab

   • -t is the keytab filename to use

2. Proceed to "Configuring Oracle Access Manager for WNA".

7.4.1 Set Up the Kerberos Authentication Module in Oracle Access Manager

Before you can use WNA, you must define specific values for the Kerberos authentication module in the Oracle Access Manager policy configuration oam-policy.xml file.

Users with valid Oracle Access Manager Administrator credentials can perform the following task to define specific values for the Kerberos authentication module in Oracle Access Manager.

To set up the Kerberos Authentication Module

1. Locate the oam-config.xml file in the following path:

   Middleware_Home/user_projects/domains/IDMDomain/config/fmwconfig/oam-config.xml

2. Make a backup copy of the oam-config.xml file and store it in another location in case you need it later.

3. Edit the oam-config.xml file to define Kerberos module parameters and values. Examples of these parameters include the keytab file containing pairs of Kerberos principals and encrypted keys, and the krb5.conf file which contains Kerberos configuration information including the locations of KDCs. (Note: The files are created at Kerberos installation and appear in the install directory.) Edit the file as follows:

   <authn-module name="Kerberos" type="KERBEROS" id="4" description="Kerberos 
   Module">
   <property value="/u01/app/oracle/install/fmw11g/Middleware/wna/<host_
   name>.keytab" name="keytabfile"/>
   <property value="HTTP/<host_name>.oracle.com" name="principal"/>
   <property value="/u01/app/oracle/install/fmw11g/Middleware/wna/krb5.conf" 
   name="krbconfigfile"/>
   </authn-module>
   

   Here, "host_name" is the name of the Oracle Access Manager server host.

4. Save the file.

5. Proceed with "Set the Oracle Access Manager Authentication Scheme for Windows Native Authentication".

7.4.2 Set the Oracle Access Manager Authentication Scheme for Windows Native Authentication

Users with valid Oracle Access Manager administrator credentials can perform the following task to define specific values for the Kerberos authentication module in Oracle Access Manager.

You can use the Oracle Access Manager Administration Console to ensure that the authentication policy for the protected page is set to use the Kerberos authentication scheme and that the scheme uses the Windows Native Authentication challenge method.

To set the Kerberos authentication scheme

1. Configure the Kerberos authentication scheme to use WNA as a challenge method:

   1. From the Oracle Access Manager Policy Configuration tab, navigation pane, expand the Authentication Schemes node.

   2. Double-click KerbScheme to display the configuration details.

   3. Change the Challenge Method to WNA, if needed.

   4. Click Apply and close the confirmation window.

   5. Close the page.

2. Configure the application domain protecting the resource to use the Kerberos authentication scheme as follows:

   1. From the Oracle Access Manager Policy Configuration tab, navigation pane, expand the Application Domains node.

   2. Locate the desired application domain name an expand it.

   3. In the application domain node, expand the Authentication Policies node reveal existing policies.

   4. Double-click your Protected Resource Policy to display the related page.

   5. Authentication Scheme: Choose KerbScheme from the list.

   6. Click Apply, and then close the confirmation window.

   7. Close the page.

3. Proceed to "Register Microsoft Active Directory as a User-Identity Data Store".

7.4.3 Register Microsoft Active Directory as a User-Identity Data Store

When using Windows Native Authentication, the user credentials must reside in Microsoft Active Directory, which must be registered as the user identity store for Oracle Access Manager.

Users with valid Oracle Access Manager Administrator credentials can perform the following task to register Microsoft Active Directory as the user store for Oracle Access Manager.

Prerequisites

A fully-configured Microsoft Active Directory authentication service should be set up with User accounts for mapping Kerberos services, Service Principal Names (SPNs) for those accounts, and Key tab files. For more information, see Oracle Fusion Middleware Securing Oracle WebLogic Server 11g Release 1 (10.3.3).

To register Microsoft Active Directory with Oracle Access Manager

1. From the System Configuration tab, navigation pane, expand the Data Sources node.

2. Click the User Identity Stores node, and then click the Add button in the tool bar.

3. Enter required values for your Microsoft Active Directory. For example:

   
   Name: UserIdentityStoreAD
   LDAP Url: ldap://ldap_host.domain.com:389
   Principal: CN=Administrator,CN=Users,DC=dept,DC=domain,DC=com
   Credential: ********
   User Search Base: CN=Users,DC=dept,DC=domain,DC=com
   User Name Attribute: UserPrincipalName
   Subscriber Name: CN=Users,DC=dept,DC=domain,DC=com
   LDAP Provider: AD
   

4. Primary: Click the Primary button to make this the primary user identity store for Oracle Access Manager.

5. Role Mapping: By default, the Oracle Access Manager administrator's role is the same as the WebLogic administrator's role (Administrators). However, you can define a new Oracle Access Manager Administrator's role in the primary user identity store for Oracle Access Manager 11g. For more information, see the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager.

6. Click Apply to submit the changes and dismiss the confirmation window.

7. Restart the Oracle Access Manager Administration Server and managed servers.

7.4.4 Verify the Oracle Access Manager Configuration File

Verify that the following are specified in the oam-config.xml file:

• path to the krb5.conf file

• path to the keytab file

• a principal to connect with KDC

Continuing the example used in earlier steps, the oam-config.xml file looks as follows:

<Setting Name="KerberosModules" Type="htf:map">
   <Setting Name="6DBSE52C" Type="htf:map">
      <Setting Name="principal"           Type="xsd:string">HTTP/[email protected]
      </Setting>
      <Setting Name="name" Type="xsd:string">XYZKerberosModule</Setting>
      <Setting Name="keytabfile"           Type="xsd:string">/scratch/kerberos/keytab.service
      </Setting>
      <Setting Name="krbconfigfile" Type="xsd:string">/etc/krb5.conf</Setting>
   </Setting>
</Setting>