Oracle Access Management

Transcription

1 Oracle Access Management Needful things to survive Michael Mühlbeyer, Trivadis GmbH BASEL BERN BRUGG DÜSSELDORF FRANKFURT A.M. FREIBURG I.BR. GENF HAMBURG KOPENHAGEN LAUSANNE MÜNCHEN STUTTGART WIEN ZÜRICH

2 Agenda 1. Project and Architecture 2. Installation Oracle Access Management 3. SSO Agents OSSO Agents 11g WebGates 4. Customize Login Pages 5. Summary

3 Project and Architecture

4 Project Industry Public Administration Technologies and Products Oracle Fusion Middleware 11gR1 and 11gR2 Java JDK 1.6.0_45 WebLogic Server Internet Directory Access Management Portal Discoverer Oracle Database Appliance V1, Database EE Challenge Migrate the existing Portal 10g solution to the latest version Install on new Hardware Use Oracle Linux as OS Solution Migration Portal 10g to 11g including Internet Directory, Access Management and Discoverer Replace SSO 10g with Access Management 11g

5 Middleware Infrastructure Architecture Development Intranet F5 LoadBalancer OAM Weblogic Cluster OID Weblogic Cluster Partner Weblogic Cluster Portal Weblogic Cluster LBVODA2 ODAEW (RAC)

6 Middleware Infrastructure Architecture Test Intranet F5 LoadBalancer Internet QS OAM Weblogic Cluster QS OID Weblogic Cluster QS Partner Weblogic Cluster QS Portal Weblogic Cluster ODAQS (RAC) ODAQS STANDBY(RAC)

7 Middleware Infrastructure Architecture Production F5 LoadBalancer Intranet Internet PROD OAM Weblogic Cluster PROD OID Weblogic Cluster PROD Partner Weblogic Cluster PROD Portal Weblogic Cluster ODAPROD(RAC) ODAPROD STANDBY(RAC)

8 OAM Architecture BIG-IP 6900 LOAD BALANCER Virtual Server für OAM OAM Clusterknoten 1 OAM Clusterknoten 2 AdminServer 8001 WebLogic oam_server oam_server Cluster Firewall SCAN Listener ODAEW1 oda21 ODAEW2 oda22 RAC ODAEW

9 Database Architecture ODAPROD1 Primary1 ODAPROD2 Primary2 Data Guard ODAPROD1 StandBy1 ODAPROD2 StandBy2 RAC ODAPROD RAC ODAPROD ODAQS1 Standby1 ODAQS2 Standby2 Data Guard ODAQS1 Primary1 ODAQS2 Primary2 RAC ODAQS RAC ODAQS ODAEW1 Node1 ODAEW2 Node2 RAC ODAEW Internetprotokoll Version 4 (TCP/IPv4) ODA1 ODA

10 Installation Oracle Access Management

11 Installation Installation of binaries with silent mode and response file Start configuration out of the Middlware_Home cd /u00/app/oracle/product/$env/middleware/oam11122/common/bin./config.sh

12 Installation

13 Installation

14 Installation

15 Installation

16 Installation PatchSet Assistant after successful configuration export MW_HOME=/u00/app/oracle/product/$ENV/middleware/oam11122 cd $MW_HOME/oracle_common/bin./psa

17 Installation Database Security Store creation export MW_HOME=/u00/app/oracle/product/es/middleware/oam11121 export ORACLE_HOME=$MW_HOME/Oracle_OAM export DOMAIN_HOME=$MW_HOME/user_projects/domains/OAMDomain $MW_HOME/oracle_common/common/bin/wlst.sh $ORACLE_HOME/common/tools/configureSecurityStore.py -d $DOMAIN_HOME -m create -p <password>

18 Installation Database Security Store validation export PATH=$MW_HOME/oracle_common/common/bin:$PATH cd $ORACLE_HOME/common/tools wlst.sh configuresecuritystore.py -d $DOMAIN_HOME -m validate... Initializing WebLogic Scripting Tool (WLST)... Welcome to WebLogic Server Administration Scripting Shell Type help() for help on available commands Info: Data source is: opss-dbds INFO: Found persistence provider "org.eclipse.persistence.jpa.persistenceprovider". OpenJPA will not be used. WLS ManagedService is not up running. Fall back to use system properties for configuration. Info: Diagnostics data was saved to the credential store. Info: Validate operation has completed successfully

19 Installation Due to the existing OAM configuration of the development some default ports had to be adopted change OAM Proxy Port 5575 to 5675 Change oam.coherence.localport 9095 to 9195 Second cluster node installation was done similar to node cluster node one Extend Cluster pack.sh auf oamqs01 unpack.sh auf oamqs02 AdminServer WebLogic Console Setup servers oam01, oam02 Server config oam_server1, oam_server2 Cluster config qsoam_cluster

20 SSO Agents

21 Access Management Services

22 Access Management Services General description Provides Single Sign-On (SSO) through a common SSO Engine Central login and logout functionality Central login page SSO Engine provides consistent service across multiple protocols and across multiple network domains Support for different identity stores Project scope Application SSO across multiple network domains Integrated applications are Oracle Portal, Oracle Discoverer and several Java applications Oracle Internet Directory is used to store all user identities

23 SSO Components Needed SSO components and basic functionality OAM Server provides the SSO Engine for applications using SSO Web applications are accessible through URLs within a network Application URLs are protected using SSO Agents The SSO Agent is a generic software component Controlling the access to the application Delegating authentication and authorization tasks to the OAM Server Installed in front of the application or part of the Web Server hosting the application Usually a HTTP Server with a specific module Cookies are used to identify Authenticated Users Access Manager Console is used for the configuration details

24 Connection Workflow

25 OSSO Agents

26 SSO Agent - OSSO Agent Oracle Portal and Oracle Discoverer are using OSSO Agents OSSO Agents are a special type of SSO Agents HTTP Server with module "mod_osso" is needed Portal and Discoverer installation provide a HTTP Server including the module "mod_osso" This HTTP Server is used as OSSO Agent Access Manager Console Configuration Create OSSO Agent Create User Identity Store Configure Authentication Scheme Configure Authentication Module Configure Authentication Policy of Application Domain

27 Create OSSO Agent Create OSSO Agent Values Name PortalIntra Base URL Host Identifier portal.intra Creates a new application domain "PortalIntra" Creates the configuration file "osso.conf" for the SSO agent This file must be copied to the HTTP Server of the SSO Agent Restart HTTP Server

28 Create User Identity Store User identities of the project are stored in Oracle Internet Directory Access Manager Console Configuration User Identity Stores Values Name <storename> Store Type OID Oracle Internet Directory Location poid.local.intra:389 Bind DN cn=orcladmin Passwort <pwd> Login ID Attribute uid User Password Attribute userpassword User Search Base cn=users,dc=local,dc=intra Group Search Base cn=groups,dc=local,dc=intra

29 OSSO Agent Configure Authentication Scheme Configure Authentication Scheme The Authentication Schema is part of the Application Domain References the User Identity Store Use LDAPScheme for OID Defines the Authentication Module Depends on LDAPScheme Defines the Challenge URL Forward to Login Page

30 OSSO Agent Configure Authentication Module Configure Authentication Module The Authentication Module "LDAPPlugin" is pre-configured and ready to use Provides two steps of User Authentication stepui User Identification (Identify LDAP user entry) stepua User Authentication (Compare User Password) The parameter KEY_IDENTITY_STORE_REF must match the User Identity Store for each step

31 OSSO Agent Configure Authentication Policy Configure Authentication Policy The Authentication Policy is part of the Application Domain The Application Domain includes all details of the SSO Agent The Authentication Policy defines public and protected resources of your application The Protected Resource Policy must match the Authentication Schema Changes directly affect the SSO Agent, no server restart is needed

32 11g WebGates

33 SSO Agent - WebGate Java Web Applications hosted on WebLogic Server are using WebGates 11g WebGates are a special type of SSO Agents Installation HTTP Server software is required Installation and configuration of WebGate software is required Access Manager Console Configuration Create 11g WebGate Configure Authentication Scheme (Same as OSSO Agent) Configure Authentication Module (Same as OSSO Agent) Configure Authentication Policy of Application Domain (Same as OSSO Agent)

34 11g WebGate Create 11g WebGate Create 11g WebGate Values Name Base URL Protected Resource List Public Resource List Use Option "AutoCreatePolicies" Creates new application domain Creates configuration files ObAccessClient.xml, cwallet.sso Files must be copied to the WebGate Restart HTTP Server

35 WebGate Configuration WebLogic Server Configure additional Security Provider within the Security Realm OAMIdentityAsserter OIDAuthentication HTTP Server WebGate Configuration (webgate.conf) is configured automatically Webgate should know where to find the OAM Server Configure Virtual Hosts (virtual_hosts.conf) Needed in HA environments Configure WebLogic Handler (mod_wl_ohs.conf) Defines weblogic-handler and weblogiccluster for each application

36 Customize Login Pages

37 Developing Custom Login Pages Access Management provides standard Login Pages and also supports custom login pages Develop your own Java application containing a login page Start developing using the Developer s Guide Developer's Guide for Oracle Access Management The sample application does not work, but this will be fixed in future releases Use examples from the Web Project Scope Simple Web Application containing a Java Server Page for a Form-based login

38 login.jsp Directory structure of the Web Application loginpages deploy custompages.war custompages META-INF MANIFEST.MF WEB-INF lib oamcustomui.jar web.xml pages css images javascript login.jsp Include oamcustomui.jar from Access Management

39 login.jsp Access Management provides standard Login Pages and also supports custom login pages OAM Server URL and Credential Collector Endpoint needed Additional Parameter REQUEST_ID <form action="<%=oamloginserverbaseurl%>/oam/server/auth_cred_submit" method="post"> <input type="text" name="username" /> <input "PASSWORD" name="password" /> <input type="hidden" name="<%=genericconstants.request_id%>" value="<%=requestid%>"> <% if (requesttoken!= null && requesttoken.length() > 0) { %> <input type="hidden" name="<%=genericconstants.am_request_token_identifier%>" value="<%=requesttoken%>"> <% } %> </form>

40 Deployment and Configuration The application must be deployed on the OAM Server when using the Embedded Credential Collector WebLogic Console for Deployment Access Manager Console Configure Authentication Schema Context Type = customwar Context Value = Application Root Context Challenge URL = Path to the Login Page

41 Summary

42 Needful Things to Survive Needful Things Start with 11g Release 2 Read the documentation, make familiar with the concepts Advantages Fully integrated with Oracle Fusion Middleware Integration of Open Source Products possible Disadvantages Complex enterprise solutions and functions

43 Further information Fusion Middleware Documentation Library Installation Guide Oracle Directory and Access Management Administrator's Guide for Oracle Access Management Developer's Guide for Oracle Access Management

44 Questions & Answers Michael Mühlbeyer Trivadis GmbH Phone