Oracle Identity Manager 11g: Essentials

Transcription

1 Oracle Identity Manager 11g: Essentials Volume I Student Guide D65160GC10 Edition 1.0 November 2010 D69802

2 Disclaimer This document contains proprietary information and is protected by copyright and other intellectual property laws. You may copy and print this document solely for your own use in an Oracle training course. The document may not be modified or altered in any way. Except where your use constitutes "fair use" under copyright law, you may not use, share, download, upload, copy, print, display, perform, reproduce, publish, license, post, transmit, or distribute this document in whole or in part without the express authorization of Oracle. The information contained in this document is subject to change without notice. If you find any problems in the document, please report them in writing to: Oracle University, 500 Oracle Parkway, Redwood Shores, California USA. This document is not warranted to be error-free. Restricted Rights Notice If this documentation is delivered to the United States Government or anyone using the documentation on behalf of the United States Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS The U.S. Government s rights to use, modify, reproduce, release, perform, display, or disclose these training materials are restricted by the terms of the applicable Oracle license agreement and/or the applicable U.S. Government contract. Trademark Notice Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Authors Robert LaVallie, Terri Cantor Technical Contributors and Reviewers Eswar Vandanapu, Raj Kuchi, Rajesh Bhabu, Sri Subramanian, Gopal Kumarappan, Mario Lim, Ajay Keni, Brad Donison, Ashok Maram, Bitan Biswas, Amol Dharmadhikari, Abhishek Sharma, Semyon Shulman, Viresh Garg, Sid Choudhury, Javed Beg, Jatan Rajvanshi, Sidhartha Das, Ashutosh Pitre, Shyam Narayan Singh, Sanjay Rallapalli, Srinivas Marni, Debapriya Datta, Alexandre Babeanu, Don Biasotti, Gururaj B.S. This book was published using: Oracle Tutor

3 Table of Contents Introduction Introduction Road Map Course Objectives Road Map Course Units Unit 1: Product Overview Unit 2: Managing Users, User Entities, and Resources Unit 3: Handling Reconciliation Workflows Unit 4: Managing Policies, Reports, and Tools Unit 5: Deploying Configurations Road Map Lesson Summary Road Map What's Next? Identity Management and Identity Administration: Overview Identity Management and Identity Administration: Overview Road Map Lesson Objectives Road Map Identity Management: Overview Identity Management: Importance Identity Management: Benefits Quiz Identity Management: Values How Can Identity Management Help? Quiz Identity Management: Terminology Identity Management: Functions Identity Administration Access Management Directory Services Audit and Compliance Suite Management Quiz Road Map Identity Administration: Infrastructure Identity Administration: Benefits Road Map Lesson Summary Road Map Lesson Demos Road Map What's Next? Launching Oracle Identity Manager Launching Oracle Identity Manager Road Map i

4 Lesson Objectives Road Map Oracle WebLogic Server Overview Oracle WebLogic Server Overview: Domains Comparing Administration Servers and Managed Servers Oracle Identity Manager Server Overview SOA Server Overview Starting Administration and Managed Servers Starting the Administration Server Starting the Managed Servers Monitoring the Status of the Managed Servers Quiz Road Map Oracle Identity Manager Interfaces Oracle Identity Manager Administrative and User Console Overview Oracle Identity Manager Unauthenticated Self Service Console Overview Oracle Identity Manager Unauthenticated Self Service Console: Reset Password Oracle Identity Manager Unauthenticated Self Service Console: Self-Registration Oracle Identity Manager Unauthenticated Self Service Console: Track Registration Web Console Overview Self-Service Functionalities Oracle Identity Manager Self Service Console Oracle Identity Manager Administration Console Oracle Identity Manager Advanced Administration Console Starting the Oracle Identity Manager Web Consoles Oracle Identity Manager Design Console Overview Design Console: User Management Design Console: Resource Management Design Console: Process Management Design Console: Administration Design Console: Development Tools Starting the Oracle Identity Manager Design Console Quiz Road Map Oracle SOA Consoles Overview Oracle SOA Platform Oracle BPM Worklist Console Launching the Oracle SOA Consoles Road Map Lesson Summary Road Map Practice 3 Overview: Launching Oracle Identity Manager Road Map What's Next? Understanding Oracle Identity Manager Understanding Oracle Identity Manager Road Map Lesson Objectives Road Map ii

5 Oracle Identity Management Products Road Map Oracle Identity Manager: Overview Oracle Identity Manager: Features Oracle Identity Manager Features: Self-Service and Delegated Administration Oracle Identity Manager Features: Workflow and Policy Management Oracle Identity Manager Features: Password Management Oracle Identity Manager Features: Audit and Compliance Management Oracle Identity Manager Features: Integration Solutions Oracle Identity Manager: Functional Layers Oracle Identity Manager: Solving Business Challenges Quiz Road Map Oracle Identity Manager Architecture Quiz Road Map Use Case #1: Initial Onboarding Use Case #2: Request-Based Scenario Road Map Reconciliation and Provisioning: Overview Quiz Road Map Oracle Identity Manager Connector: Overview Quiz Road Map Lesson Summary Road Map What's Next? Understanding Organizations, Roles, and Users Understanding Organizations, Roles, and Users Road Map Lesson Objectives Road Map Oracle Identity Manager User User Entity Life Cycle Oracle Identity Manager User Types Oracle Identity Manager Functional Users Quiz Road Map Oracle Identity Manager Organizations Oracle Identity Manager Roles Role Hierarchy Role Category Oracle Identity Manager Entity Relationships Quiz Road Map Overview of the Bulk Load Utility Loading Data with the Bulk Load Utility Bulk Load Utility Scripts, Data Files, and Database Tables iii

6 Bulk-Load Input Source Bulk-Load Database Columns Configuring the Bulk Load Utility Quiz Road Map Creating Oracle Identity Manager Entities Creating an Organization Creating a User Creating a Role Category Creating a Role Assigning a User to a Role Revoking a Role from a User Bulk Modification of Users Modifying an Organization Deleting an Organization Disabling and Deleting a User Deleting a Role Loading User and Role-Related Data with the Bulk Load Utility Quiz Road Map Lesson Summary Road Map Practice 5 Overview: Understanding Organizations, Roles, and Users Road Map What's Next? Using Predefined Connectors Using Predefined Connectors (Initial Onboarding) Road Map Lesson Objectives Road Map Oracle Identity Manager Connectors: Overview Quiz Road Map Types of Oracle Identity Manager Connectors Quiz Road Map Transferring Oracle Identity Manager Connectors: Ways Transferring Oracle Identity Manager Connectors: Advantages Transferring Oracle Identity Manager Connectors: Best Practices Transferring Oracle Identity Manager Connectors: Tools Quiz Road Map Using Oracle Identity Manager Connectors: Setup Using Oracle Identity Manager Connectors: Run Time Step 1: Verifying Installation and Deployment Requirements Step 2: Configuring the External Resource Step 3: Copying Connector and External Code Files Copying Connector Files: Sun Java System Directory Server Step 4: Configuring Oracle Identity Manager Server iv

7 Configuring Oracle Identity Manager Server: Clearing the Server Cache Configuring Oracle Identity Manager Server: Enabling Logging Step 5: Importing an Oracle Identity Manager Connector Step 6: Defining an IT Resource Step 7: Configuring Reconciliation Workflows Step 8: Configuring Provisioning Workflows Step 9: Assigning the Connector to a User Step 10: Completing the Custom Process Form Step 11: Accessing the Resource Quiz Road Map Lesson Summary Road Map Practice 6 Overview: Using Predefined Connectors (Initial Onboarding) Road Map What's Next? Understanding Manual and Automated Provisioning Understanding Manual and Automated Provisioning Road Map Lesson Objectives Road Map Resources Oracle Identity Manager Connectors Differences Between Assigning Resources and Provisioning Resources Quiz Road Map Assigning Resources to Users: Overview Assigning Resources to Users: Criteria Assigning Resources to Users: Request Assigning Resources to Users: Direct Provisioning Quiz Road Map Types of Provisioning Manual Provisioning Autoprovisioning Quiz Road Map Using Criteria to Assign a Resource to a User Step 1: Creating an Auto Membership Rule Step 2: Assigning an Auto Membership Rule to a Role Step 3: Building an Access Policy Provisioning a User with a Resource Manually Step 1: Verifying a Resource Is Assigned to a User Step 2: Completing a Custom Process Form Step 3: Accessing the Resource Quiz Road Map Modifying an Oracle Identity Manager Connector Step 1: Modifying the Provisioning Process v

8 Step 2: Modifying the Custom Process Form Provisioning a User with a Resource Automatically Step 1: Verifying a Resource Is Assigned to a User Step 2: Accessing the Resource Quiz Road Map Lesson Summary Road Map Practice 7 Overview: Understanding Manual and Automated Provisioning Road Map What's Next? Understanding Approval Processes and Requests Understanding Approval Processes and Requests Road Map Lesson Objectives Road Map Request Workflow and Approval Process Overview Request Overview Request Type Request Type Catalog Request Dataset Default Request Dataset XML Files Request Template Approval Process Approval Processes Oracle SOA Platform Template Level Approval Process Approval Policies and the Request and Operation Approval Levels Request and Operation Level Approval Processes Quiz Road Map JDeveloper and SOA Composite Overview Loading an SOA Composite in JDeveloper Deploying an SOA Composite to a Defined Application Server Registering an SOA Composite with Oracle Identity Manager Registering a New SOA Composite with Oracle Identity Manager Disabling an SOA Composite from Oracle Identity Manager Enabling an SOA Composite with Oracle Identity Manager Road Map Creating an Approval Policy Policy Details Set Approval Rule Approval Policy Summary Approval Policy: Operation-Level Example Quiz Road Map Modeling a Request Template Access the Request Template Wizard Request Template Details vi

9 Allowed Resources Attribute Restrictions Attribute Restriction Details Additional Attributes Template User Roles Request Template Confirmation Road Map Request Initiation Flowchart Request and Approval Stages for Requests Request and Approval Stages for Bulk Requests Initiating a Request Request Beneficiary Request Template Select Users Select Resources Resource Details and Additional Data Request Justification Road Map Lesson Summary Road Map Practice 8 Overview: Understanding Request Workflows and Approval Processes Road Map What's Next? Understanding Reconciliation Understanding Reconciliation Road Map Lesson Objectives Road Map Reconciliation and Provisioning Reconciliation: Types Reconciliation: Events Quiz Road Map Authoritative Reconciliation: Conceptual Diagram Authoritative Reconciliation: Single and Multiple Trusted Sources Account Reconciliation: Conceptual Diagram Account Reconciliation: Target System Account Reconciliation: Data Process Flow Road Map Implementing a Reconciliation Workflow Step 1: Verifying Installation and Deployment Requirements Step 2: Configuring the External Resource Step 3: Copying Connector and External Code Files Copying Connector Files: Microsoft Active Directory Copying External Code Files: Microsoft Active Directory Step 4: Configuring Oracle Identity Manager Server Configuring Oracle Identity Manager Server: Clearing the Server Cache Configuring Oracle Identity Manager Server: Enabling Logging Step 5: Importing an Oracle Identity Manager Connector vii

10 Step 6: Defining an IT Resource Step 7: Modifying a Scheduled Job Modifying a Scheduled Job: Trusted Source Modifying a Scheduled Job: Target Resource Step 8: Reconciling with a Trusted Source Step 8: Reconciling with a Target Resource Quiz Road Map Lesson Summary Road Map Practice 9 Overview: Understanding Reconciliation Road Map What's Next? Managing Authorization Policies Managing Authorization Policies Road Map Lesson Objectives Road Map Security Principles: Identity, Authentication, and Authorization What Is Authorization? Quiz Road Map Oracle Entitlement Server Authorization Policy Overview Authorization Policy: Relationship to Roles Authorization Policy: Target Entity Association and Functional Security: Role Management Entity Association and Functional Security: Self Service User Management Entity Association and Functional Security: User Management Authorization Policy: Defining Scope with Data Security Authorization Policy: Policy Assignment Out-of-the-Box Authorization Policies When to Define Authorization Policies Quiz Road Map Creating Role Management Authorization Policies Step 1: Complete the Basic Policy Information Step 2: Select the Role Management Permissions Step 3: Choose Data Constraints Step 4: Select the Assignees Step 5: Confirm the Results Creating Self Service User Management Authorization Policies Step 1: Complete the Basic Policy Information Step 2: Select the Self Service User Management Permissions Step 3: Select the Assignees Step 4: Confirm the Results Creating User Management Authorization Policies Step 1: Complete the Basic Policy Information Step 2: Select the User Management Permissions viii

11 Step 3: Select Data Constraints Step 4: Select the Assignees Step 5: Confirm the Results Road Map Lesson Summary Road Map Practice 10 Overview: Managing Authorization Policies Road Map What's Next? Managing Reports Managing Reports Road Map Lesson Objectives Road Map Reports: Overview Access Policy Reports Attestation, Request, and Approval Reports Password Reports Resource and Entitlement Reports Role and Organization Reports User Reports Quiz Road Map Oracle BI Publisher: Overview Configuring Oracle BI Publisher Step 1: Copying Reports Step 2: Starting Oracle BI Publisher Step 3: Managing Data Sources Managing Data Sources: Creating the OIM JDBC Data Source Managing Data Sources: Creating the BPEL JDBC Data Source Quiz Road Map Creating Reports: Overview Creating an Access Policy Report Creating a Request Report Creating an Approval Report Creating a Password Report Creating a Resource Report Creating a Role Report Creating an Organization Report Creating a User Report Quiz Road Map Lesson Summary Road Map Practice 11 Overview: Managing Reports Road Map What's Next? Auditing, Monitoring, and Logging for Oracle Identity Manager ix

12 Auditing, Monitoring, and Logging for Oracle Identity Manager Road Map Lesson Objectives Roadmap What is Auditing? Auditing: Requirements Auditing: Business Challenges Auditing: Oracle Fusion Middleware Audit Framework Oracle Fusion Middleware Audit Framework: Features Oracle Fusion Middleware Audit Framework Audit Architecture Oracle Fusion Middleware Audit Framework: Audit Flow Oracle Fusion Middleware Audit Framework: Key Technical Concepts Oracle Fusion Middleware Audit Framework: Oracle Identity Manager and SOA Auditing Oracle Identity Manager Auditing: Oracle Identity Manager Audit Engine Auditing: Oracle Identity Manager Audit Levels Auditing: Changing the Oracle Identity Manager Audit Level Auditing: SOA Audit Levels Auditing: Changing the SOA Audit Level Quiz Roadmap What Is Monitoring? Monitoring: Oracle Enterprise Manager Fusion Middleware Control Monitoring: Oracle Identity Manager Monitoring: Oracle Identity Manager Performance Metrics Monitoring: SOA Quiz Roadmap What Is Logging? Benefits of Logging Overview of Log Files Configuration Settings for Log Files for Oracle Identity Manager and SOA Location and Configuration of Log Files for Oracle Identity Manager and SOA Search, View, and Download Log Files Log Files: Setting Information Levels Log Files: Specifying the Log File Locale Log Files: ECID and RID Quiz Roadmap Managing Auditing for Oracle Identity Manager Managing Auditing for SOA Managing Monitoring for Oracle Identity Manager Managing Monitoring for SOA Managing Logging for Oracle Identity Manager Managing Logging for SOA Roadmap Lesson Summary Roadmap Practice 12 Overview: Auditing, Monitoring, and Logging for Oracle Identity Manager x

13 Roadmap What's Next? Transferring Oracle Identity Manager Configurations Transferring Oracle Identity Manager Configurations Road Map Lesson Objectives Road Map Deployment Manager Overview Deployment Manager: Supported Configuration Objects Supported Configuration Object Types Advantages of Using the Deployment Manager to Transfer Configurations Best Practices for Transferring Configuration Objects Quiz Road Map Overview of MDS Utilities MDS WebLogic Properties File Road Map Exporting Data Using the Deployment Manager Importing Data Using the Deployment Manager Exporting Data Using the MDS Export Utility Importing Data Using the MDS Import Utility Deleting MDS Data Using the MDS Delete Utility Quiz Road Map Lesson Summary Road Map Practice 13 Overview: Transferring Oracle Identity Manager Configurations Road Map What's Next? Oracle Identity Management Products: Overview Oracle Identity Management Products: Overview Road Map Appendix Objectives Road Map Oracle Identity Management Products Oracle Identity Management Products: Functional Aspects Oracle Identity Management Products: Functionalities Oracle Identity Management Products: Solutions Identity Administration: Infrastructure Oracle Identity Manager Oracle Identity Analytics Access Management: Infrastructure Oracle Access Manager Oracle Adaptive Access Manager Oracle Authentication Service for OS Oracle Enterprise Single Sign-On Oracle Entitlements Server Oracle Identity Federation Oracle Web Services Manager xi

14 Directory Services: Infrastructure Oracle Virtual Directory Oracle Internet Directory Road Map Appendix Summary Basic Oracle WebLogic Server Concepts Basic Oracle WebLogic Server Concepts Road Map Appendix Objectives Road Map Oracle Fusion Middleware Oracle Fusion Middleware Management Infrastructure Relationship of Fusion Middleware Products to WebLogic Server Typical Oracle Fusion Middleware Environment Overview of WebLogic Server Domain Domain Diagram Road Map Configuring a Domain Starting the Domain Configuration Wizard Creating a Domain Using the Domain Configuration Wizard Creating a New WebLogic Domain and Selecting the Domain Source Configuring Administrator Settings Configuring Startup Mode and JDK Customizing Optional Configuration Configuring the Administration and Managed Servers Configuring Clusters and Assigning Servers to Clusters Creating an HTTP Proxy Application and Configuring Machines Assigning Servers to Machines Configuring JDBC Data Sources Testing Data Source Connections Running Database Scripts Configuring the JMS File Store Customizing Application and Service Targeting Configuration Configuring RDBMS Security Store Database Reviewing the WebLogic Domain Creating the WebLogic Domain Domain Directory Structure Road Map JVM Run-Time Arguments Oracle WebLogic Server Dependencies Configuring CLASSPATH Starting Oracle WebLogic Administration Server Starting Administration Server by Using startweblogic.sh Starting the Administration Server by Using the java weblogic.server Command Stopping the Administration Server Benefits of Using the Administration Console Accessing the Administration Console Administration Console Login Basic Navigation xii

15 Using the Help System General Administration Console User Preferences Advanced Console Options Setting Basic Properties Administration Console Monitoring Starting a Managed Server by Using the Administration Console Shutting Down a Server Shutting Down a Domain Monitoring All Servers Road Map WebLogic Scripting Tool (WLST) Jython Using Jython WLST Modes WLST Example WLST Command Requirements Running WLST Scripts Importing WLST as a Jython Module General WLST Commands Offline WLST Commands Creating a Domain: Example Online WLST Commands WebLogic JMX: Overview Navigating JMX MBeans Road Map What Node Managers Can Do What Is a Machine? Relationship of Machines to Other Components Creating a Machine Defining Names and OS of Machines Assigning Servers to a Machine Monitoring Machines and Servers Configuring a Machine to Use a Node Manager Node Manager Architecture How a Node Manager Starts an Administration Server How a Node Manager Starts a Managed Server How a Node Manager Restarts an Administration Server How a Node Manager Restarts a Managed Server How a Node Manager Shuts Down a Server Instance Road Map Lesson Summary Oracle Identity Manager Architecture Oracle Identity Manager Architecture Road Map Appendix Objectives Road Map Oracle Identity Manager Architecture Road Map Oracle Identity Manager Architecture: Advantages xiii

16 Road Map Oracle Identity Manager Architecture: Features and Benefits Road Map Oracle Identity Manager Architecture: Tiers Tier 1: Presentation Tier Tier 2: Business Services Tier Business Services Tier: API Services Business Services Tier: Identity Services Business Services Tier: Integration Services Business Services Tier: Platform Services Tier 3: Data Tier Road Map Appendix Summary Oracle Identity Manager Connectors Oracle Identity Manager Connectors Road Map Appendix Objectives Road Map Oracle Identity Manager Connector: Overview Road Map Oracle Identity Manager Connector: Types Oracle Identity Manager Connector Types: Predefined Connectors Oracle Identity Manager Connector Types: Generic Technology Connectors Oracle Identity Manager Connector Types: Custom Connectors Road Map Oracle Identity Manager Connector: Components Road Map Constructing an Oracle Identity Manager Connector: Step Constructing an Oracle Identity Manager Connector: Step Constructing an Oracle Identity Manager Connector: Step Constructing an Oracle Identity Manager Connector: Step Constructing an Oracle Identity Manager Connector: Step Constructing an Oracle Identity Manager Connector: Step Constructing an Oracle Identity Manager Connector: Step Constructing an Oracle Identity Manager Connector: Step Road Map Appendix Summary Customizing the Oracle Identity Manager User Interfaces Customizing the Oracle Identity Manager User Interfaces Road Map Appendix Objectives Road Map Oracle Identity Manager User Interfaces User Interface 1: The Login Page User Interface 2: The Unauthenticated Self Service Console User Interface 3: The Identity Administration Console User Interface 4: The Authenticated Self Service Console User Interface 5: The Advanced Administration Console Road Map xiv

17 Levels of Customization Road Map Branding the Identity Administration Console: Overview Branding the Identity Administration Console: Modifying Branding Text Branding the Identity Administration Console: Adding a Logo Branding the Identity Administration Console: Changing the Logo Mouseover Text Branding the Authenticated Self Service Console: Overview Branding the Authenticated Self Service Console: Modifying Branding Text Branding the Authenticated Self Service Console: Adding a Logo Branding the Authenticated Self Service Console: Changing the Logo Mouseover Text Road Map Modifying the Functionality and Appearance of the Identity Administration Console: Overview Modifying the Functionality and Appearance of the Identity Administration Console: Renaming Button Labels Creating Custom Skins and Style Sheets: Overview Modifying the Functionality and Appearance of the Identity Administration Console: Creating a Custom Skin and Style Sheet Modifying the Functionality and Appearance of the Authenticated Self Service Console: Overview Modifying the Functionality and Appearance of the Authenticated Self Service Console: Renaming Button Labels Modifying the Functionality and Appearance of the Authenticated Self Service Console: Creating a Custom Skin and Style Sheet Road Map Appendix Summary Road Map Practice F Overview: Customizing the Oracle Identity Manager User Interfaces xv

18