Evaluated Configuration Guide for Oracle Identity Manager 10g ( )

Transcription

1 Evaluated Configuration Guide for Oracle Identity Manager 10g ( ) Issue : 1.0 Date : Status : Definitive Distribution : OIM Evaluation Team Prepared by Reviewed by Authorised by : Hugh Griffin, Mike McCormack... : Hugh Griffin... : Petra Manche...

2 ======================================================== Evaluated Configuration Guide for Oracle Identity Manager 10g ( ) December 2012 Author: Hugh Griffin Contributor: Mike McCormack Copyright 2011, Oracle Corporation. All rights reserved. This documentation contains proprietary information of Oracle Corporation; it is protected by copyright law. Reverse engineering of the software is prohibited. If this documentation is delivered to a U.S. Government Agency of the Department of Defense, then it is delivered with Restricted Rights and the following legend is applicable: RESTRICTED RIGHTS LEGEND Use, duplication or disclosure by the Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of DFARS , Rights in Technical Data and Computer Software (October 1988). Oracle Corporation, 500 Oracle Parkway, Redwood City, CA The information in this document is subject to change without notice. If you find any problems in the documentation, please report them to us in writing. Oracle Corporation does not warrant that this document is error free. Oracle is a registered trademark and Oracle Business Intelligence 10g are trademarks or registered trademarks of Oracle Corporation. Other names may be trademarks of their respective owners. ======================================================== Document History Version Date Notes 0.1 March 2011 Initial formal release 0.2 June 2011 Release after re-install 0.3 November 2011 Post-evaluation updates 1.0 December 2011 Minor formatting updates Page 2 of 113

3 Table Of Contents 1 Introduction Purpose Intended Audience Evaluated Configuration Guide Overview Document Structure Format Preparation Machine Configuration Physical Environmental Assumptions Electronic Delivery of the TOE Physical Delivery of the TOE Installation Oracle Identity Management Installation Order Start up and Shutdown procedure...15 Annex A TOE Components A.1 Oracle Identity Management Server...16 A.2 Supporting components for TOE testing...16 Annex B Server Start up and Shutdown Procedures B.1 Start order...17 B.2 OIM Server...17 B.3 Database Server...18 B.4 Internet Directory Server...19 Annex C Install Red Hat Linux 4 Update 5 x86_64 for OIM server C.1 Install the Operating System...20 C.2 Patch the Operating System...20 C.3 Configure the Operating System...20 C.4 Install Java...22 Annex D OIM Server Installation D.1 Install the Oracle Application Server...23 D.2 Upgrade the Oracle Application Server...25 D.3 Create OC4J Instance for OIM...26 D.4 Apply Oracle Application Server CPU Patch...27 D.5 Configure RMI Settings...28 D.6 Install Oracle Database for OIM...28 D.7 Install Oracle Database Patchset...30 D.8 Create Listener for OIM Database...31 D.9 Create Database Instance for OIM Database...31 D.10 Prepare Database Instance for OIM Installation...33 D.11 Install Oracle Identity Manager...34 D.12 Upgrade OIM from to D.13 Post OIM Installation Configuration...40 Annex E Install Identity Management & Metadata Repository on OID Server E.1 Install the Operating System...43 E.2 Patch the Operating System...43 E.3 Configure the Operating System...43 E.4 Install the Identity Management & Metadata Repository...45 Page 3 of 113

4 E.5 Configure the OID Infrastructure...47 Annex F Oracle Database Server F.1 Install the Operating System...52 F.2 Patch the Operating System...52 F.3 Configure the Operating System...52 F.4 Install the Oracle Database Server...54 F.5 Create Listener for odb Database...56 F.6 Create a Database Instance...57 F.7 Secure Database...59 Annex G Recommendations for OIM Secure Audit Administration Annex H Perform Hardening of the TOE and Environment H.1 Administration Client Configuration...67 H.2 User Client Configuration...68 H.3 Configure SSL for User and Admin Console...68 H.4 Install the Design Console with SSL enabled...72 H.5 Enable the Firewall...76 H.6 Configure OIM Security settings...77 H.7 Configure OIM Password policy...78 H.8 Configure Attestation Scheduled task...81 Annex I Oracle Identity Management Connectors I.1 Install the Database Connector...83 I.2 Install the Oracle Internet Directory Connector...87 Annex J Configure Database and Internet Directory Connectors J.1 Database Connector Configuration...91 J.2 Configure Database Provisioning Test data...91 J.3 Oracle Internet Directory Connector Configuration Annex K Guidance for Secure Administration K.1 Web Browsing and OIM access K.2 Creating or updating an administrative group within OIM K.3 Updating menu items within OIM K.4 Ensuring secure Approval process for OIM Access Policies K.5 Enabling secure Self-Registration for OIM K.6 Configuration for IT Resources K.7 Configuration for User Provisioning Requests K.8 Directly Provisioning users K.9 Granting the admin privilege to directly provision users Annex L References Page 4 of 113

5 Abbreviations CC CEM CI EAL ECG ETR ISO IT OR OSP PP SAR SFP SFR ST TOE TSF TSFI URL Common Criteria Common Evaluation Methodology Configuration Item Evaluation Assurance Level Evaluated Configuration Guide Evaluation Technical Report International Standards Organisation Information Technology Observation Report Organisational Security Policy Protection Profile Security Assurance Requirement Security Function Policy Security Functional Requirement Security Target Target of Evaluation TOE Security Functionality TSF Interface Universal Resource Locator Page 5 of 113

6 1 Introduction 1.1 Purpose This document is the Evaluated Configuration Guide (ECG) for Oracle Identity Manager 10g ( ). Title: Evaluated Configuration Guide for Oracle Identity Manager 10g ( ) Target of Evaluation (TOE): Oracle Identity Manager 10g ( ) Release: Connectors: Oracle Database User Management Connector ; Oracle Internet Directory Connector The connectors are installed as part of Oracle Identity Manager 10g ( ) and as such are part of the TOE. Operating System Platform: Red Hat Enterprise Linux AS Version 4 Update 5 Database Platform: Oracle Database Management System 10g ( ) Application Server Platform: OracleAS 10gR2 ( ) Keywords: Oracle Identity Manager, EAL Intended Audience The intended audience for this document includes evaluators of the TOE, system integrators who will be integrating the TOE into IT systems, and Accreditors of the systems into which the TOE has been integrated. 1.3 Evaluated Configuration Guide Overview This document explains the manner in which the TOE must be configured along with the host operating system so as to provide the security functionality and assurance as required under the Common Criteria for Information Technology Security Evaluation [CC]. The TOE is hosted on Red Hat Enterprise Linux AS Version 4 Update 5 operating system platform and uses Oracle Application Server 10g Release 2 ( ) as a container platform. Page 6 of 113

7 The assumptions and procedures stated in the document are intended to remove potential vulnerabilities or attack paths from the TOE in its environment. They do not have any impact on the correct implementation of the TOE s SFs. The Evaluation Assurance Level for the TOE is EAL4. The Security Target used for the evaluation of the TOE is [ST], which also provides an overview of the TOE. 1.4 Document Structure This ECG is divided into 5 sections and 12 Annexes, as follows: Section 1 (this section) provides an introduction to the ECG. Section 2 provides the preparatory actions to be undertaken before installing the software for the evaluated configuration. Section 3 provides the installation of the software for the Oracle Identity Manager in the evaluated configuration. Section 4 provides the post-installation actions to start and stop the evaluated configuration. Section 5 provides the supporting procedures to ensure that the TOE is operated in a way that upholds the security objectives defined in [ST]. Annex A provides the list of components in servers required to install and run the TOE. Annex B provides the start up and shutdown procedures for the OIM evaluated configuration. Annex C provides steps needed to create an installation of Red Hat Enterprise Linux AS Version 4 Update 5 on an OIM server machine. Annex D provides the steps needed to install Oracle Application Server and Oracle Identity Management for use on the OIM server machine in the evaluated configuration. Annex E provides the steps needed to install Oracle Internet Directory for use on the OID server machine in the evaluated configuration. Annex F provides the steps needed to install an Oracle Database for use on the Database server machine in the evaluated configuration. Annex G provides recommendations for secure administration of audit in OIM in the evaluated configuration. Page 7 of 113

8 Annex H provides the steps needed to harden OIM and Red Hat Enterprise Linux AS Version 4 Update 5 for all server machines in the evaluated configuration. Annex I provides the steps needed to install and configure the DB and OID Connectors for the OIM Server machine in the evaluated configuration. Annex J provides the steps needed to configure the Database and Internet Directory Connectors for provisioning, reconciliation and attestation. These are the examples used for evaluator testing. Annex K provides additional guidance for secure administration of OIM. This must be followed to maintain OIM in a secure state. Annex L provides the list of documents that are referenced within this guide, e.g. the Oracle Identity Management Security Target [ST]. 1.5 Format Assertions for the physical, host, and Oracle configurations are given identifiers to the left of each evaluation configuration requirement in bold Arial font, e.g. [A-1] or a number to show the step, e.g. 1. Mandatory evaluation configuration requirements use the words must and/or shall in each assertion. Strongly recommended evaluation configuration requirements use the words should in each assertion. Commands typed from the Linux Command line for formatted in Courier New. For example, oracle> mkdir oracle Instructions regarding the use of a GUI are formatted using Times New Roman (i.e the default font for this document). The screen name will be identified using Courier New. References to sections of documents listed in Annex L are in the format [document, section]. Page 8 of 113

9 2 Preparation This part of the ECG provides the preparatory actions to be undertaken before installing the software for the evaluated configuration of Oracle Identity Management (OIM). 2.1 Machine Configuration In the configuration used for the evaluation testing of Oracle Identity Manager 10g ( ), the OIM Server was installed on a DELL Rack Mounted Server, which also hosted 2 virtual machines. Of the 2 virtual machines, 1 is a database server and the other a directory server. This enabled testing of the TOE provisioning to a database and reconciliation with a directory. It is recommended that a production configuration of Oracle Identity Management ( ) be used on physically separate servers. The virtual machines allocated for the installation of the TOE during the evaluation were: Machines Specification Products to be installed db and oid Hosted on: Dell PowerEdge 1950 A Dual-Core Intel Xeon 5300 sequence processors (2.33GHz) 4GB RAM Red Hat Linux 4 Update 5 x86_64 As per Annex A of this document. Table 2.1: Virtual Configuration of machines supporting the TOE The TOE was installed without virtualisation on the above platform and designated oim. In addition, two client machines are required as follows: DC Client: this is a Windows XP administration client with IE7 installed on it for installing the OID and database connectors on the OIM Server. Version of the OIM Design Console is also installed on this, and patched from the OIM patch as specified in [DCIG, 3.4]. User Client: this is a Windows XP client machine also with IE7. Page 9 of 113

10 The list below gives a high level overview of which key components are installed where and their purpose. Machine 1 oim Hostname: oim.oim-test.com IP address: subnet mask: Operating System: Red Hat Enterprise Linux 4 Update 5 Installed Components: Oracle Application Server 10g ( ) Oracle Database 10g ( ) Oracle Identity Manager 10g ( ) instance of TOE Database User Management Connector ( ) part of TOE Oracle Internet Directory Connector ( ) part of TOE Machine 2 db Hostname: odb.sme1.com IP address: subnet mask: Operating System: Red Hat Enterprise Linux 4 Update 5 Installed Components: Oracle Database 10g ( ) Machine 3 oid Hostname: oid.sme1.com IP address: subnet mask: Operating System: Red Hat Enterprise Linux 4 Update 5 Installed Components: Oracle Internet Directory 10g ( ) Page 10 of 113

11 2.2 Physical Environmental Assumptions This section describes physical requirements on the server machine so that the security of the TOE can be maintained. [IM.A-1] [IM.A-2] The processing resources of the TOE shall be located within controlled access facilities which will prevent unauthorised physical access to the TOE by unprivileged users. Only authorised administrators for the system hosting the TOE shall have physical access to that system. Such administrators include the Operating System Administrators, Access and Identity Master Administrators, OID Directory Administrators and Database Administrators. The media on which the TOE audit data resides shall not be physically removable from the underlying operating system by unauthorised users. [IM.A-3] Any on-line and/or off-line storage media on which security relevant data resides shall be located within controlled access facilities which will prevent unauthorised physical access. 2.3 Electronic Delivery of the TOE To receive electronic delivery of OIM, complete the following steps: 1. If you do not always have a SHA-1 file hash tool, download an appropriate SHA-1 tool to verify SHA-1 checksums. SHA-1 tools are available for any platform. 2. Access the Oracle E-Delivery website at: 3. (Optional) Choose a language preference. 4. Check Continue. 5. Enter your user information and click the checkboxes to agree to the license terms and export restrictions, then click Continue. 6. Select Oracle Oracle BEA in the Product Pack field, then select Linux x86-64 or Linux x86 from OS platform from the drop-down list. 7. Select Oracle Application Server 10g Release 3 (10.1.3) Media Pack for Linux x86 Part number B from the results list, then click Continue. 8. Select the following from the list Page 11 of 113

12 Oracle Identity Management Infrastructure and Oracle Identity Federation ( ) for Linux x86 (CD 1 of 2) part number B Oracle Identity Management Infrastructure and Oracle Identity Federation ( ) for Linux x86 (CD 2 of 2) part number B Click the View Digest button. A popup window displays with all available checksum values (both MD5 and SHA-1). Note that you should only use the SHA-1 checksum for verification. Take a note of the SHA-1 checksum value provided for the desired download (depending on your OS platform). 10. Make sure that the certificate associated with the web page that displays the digest is signed by a trusted CA. If your browser does not display any error message regarding the certificate, than it is signed by a trusted CA already known to the browser (here: Verisign). You can check this by moving the house pointer over the secure session system (lock) in the browser. 11. In case of verification errors, the displayed digest cannot be trusted. 12. Close the View Digest popup window. 13. Click the Download button for the desired download (depending on your OS platform) and save the selected.zip file to the desired disk location. 14. Verify that the checksum for your download matches the checksum shown on the Oracle download page. To obtain the correct version of the Connectors, raise an SR on and ask for a URL for V Oracle Identity Manager Connectors, or request the Database and OID Connector from this media. 2.4 Physical Delivery of the TOE To request the media pack: 1. Go to and select Shop Online. 2. Choose the appropriate store and select Application Server. 3. Select Identity Management Infrastructure and Oracle Identity Management ( ) and choose your licensing terms. 4. Select Purchase Media Packs. Page 12 of 113

13 5. Select Linux x Select Oracle Identity Management Infrastructure and Oracle Identity Management ( ) for Linux x86 Media Pack for Linux x86 (32 bit). When the media pack arrives the relevant CDs / DVDs are: V Oracle Identity Manager Connectors B Oracle Identity Management Infrastructure and Oracle Identity Federation ( ) for Linux x86. Page 13 of 113

14 3 Installation This chapter describes the installation of the software for the evaluated configuration. Many of the instructions are performed on the command line. They will need to be performed as the user denoted e.g. root>. When switching users at the command line always use the argument -', for example su - orainfra to ensure the users environment such as $ORACLE_HOME is set correctly. Throughout this document example hostnames are used (for example, odb.sme1.com). When updating these to reflect the end customer infrastructure, care must be taken that they are changed consistently. It is recommended that a log book is used during the installation to note these down. The full list of passwords and passphrases against different usernames should also be compiled during installation. When installation is complete, this should be stored in a secure location for use in an emergency. The port numbers referenced in this document are the defaults used during the install process but as this can be affected by port availability during the installation process, ensure to always check the ports being used. This can be done by checking the ports configured at install time by looking at $ORACLE_HOME/install/portlist.ini or checked by running netstat -ltpn as root at any time As SSL is used within the TOE some steps require signed certificates. Either an internal Certification Authority (CA) can used or certificate signing requests will need to be sent to a commercial CA for signing. The former was used during the evaluation for convenience. 3.1 Oracle Identity Management Installation Order In order to install an instance of an Oracle Identity Management (OIM) server in the evaluated configuration the steps in the following Annexes should be followed in the order given below: Red Hat Enterprise Linux AS Version 4 Update 5 shall be installed as described in Annex C and [ECGOEL4] for all OIM server machines to be set up in the evaluated configuration. Annex D describes the steps needed to install OIM Server. Annex E describes the steps needed to install an OID Server for use as a trusted source for OIM reconciliation. Page 14 of 113

15 Annex F describes the steps needed to install an Oracle Database Server for provisioning by OIM. Annex G describes how to configure the OIM auditing functionality securely. Annex H describes the steps needed to harden OIM, clients and the Red Hat Enterprise Linux AS Version 4 Update 5 for security. Annex I describes the steps needed to install the Database and Internet Directory Connectors. Annex J describes how to configure the OIM Database and Internet Directory Connectors for provisioning, reconciliation and attestation. This was the foundation set up for evaluator testing. As such, the instructions in this Annex are a resource for configuring OIM and the connectors, however they are not normative or required for secure configuration. 3.2 Start up and Shutdown procedure This is provided in Annex B. This should not be attempted until all steps for at least one Oracle Identity Management with Connectors, Oracle Database and Oracle Internet Directory instance have been completed. Page 15 of 113

16 Annex A TOE Components A.1 Oracle Identity Management Server A.1.1 Oracle Application Server for Oracle Identity Manager OracleAS 10gR is the base, on which is installed Patches , and to take it to OracleAS 10gR A.1.2 Oracle Database for Oracle Identity Manager Oracle Database is the base. Upgrade of Oracle Database to via Patch A.1.3 Oracle Identity Manager Oracle Identity Manager Upgrade of Oracle Identity Manager to via Patch A.1.4 Oracle Connector Pack for Oracle Database Oracle Identity Manager Connector Pack A.1.5 Oracle Connector Pack for Oracle Internet Directory Oracle Identity Manager Connector Pack A.2 Supporting components for TOE testing A.2.1 Oracle Database Server Oracle Database A.2.2 Oracle Internet Directory Oracle Internet Directory Page 16 of 113

17 Annex B Server Start up and Shutdown Procedures B.1 Start order This Annex describes the post-installation actions to start and stop the OIM Server in the evaluated configuration. The evaluators test configuration should be started in the following order: OIM Server DB Server OID Server B.2 OIM Server B.2.1 Start Up Run the following commands from root on the OIM server to be started: # su - oracle $ lsnrctl start $ sqlplus / as sysdba SQL> startup SQL> quit $ opmnctl startall Start a web browser on a Windows client machine configured as specified in Annex H.1 and access the following URL: Security note: All privileged users should ensure that after performing their tasks, they log off and close down their browser before browsing to other sites. If access to other websites is required at the same time as access to OIM administration features, a different browser should be used (i.e. not Internet Explorer). B.2.2 Shutdown Run the following commands from root on the OIM server to be shutdown: # su - oracle $ opmnctl stopall Page 17 of 113

18 $ sqlplus / as sysdba SQL> shutdown immediate SQL> quit $ lsnrctl stop B.3 Database Server B.3.1 Start Up Run the following commands from root on the Database server to be started: # su - oradb $ lsnrctl start $ sqlplus / as sysdba SQL> startup SQL> quit B.3.2 Shutdown Run the following commands from root on the Database server to be shutdown: # su - oradb $ sqlplus / as sysdba SQL> shutdown immediate SQL> quit $ lsnrctl stop Page 18 of 113

19 B.4 Internet Directory Server B.4.1 Start Up Run the following commands from root on the Oracle Internet Directory server to be started: # su - orainfra $ lsnrctl start $ sqlplus / as sysdba SQL> startup SQL> quit $ opmnctl startall $ emctl start iasconsole $ emctl start dbconsole B.4.2 Shutdown Run the following commands from root on the Oracle Internet Directory server to be shutdown: # su - orainfra $ opmnctl stopall $ emctl stop iasconsole $ emctl stop dbconsole $ sqlplus / as sysdba SQL> shutdown immediate SQL> quit $ lsnrctl stop Page 19 of 113

20 Annex C Install Red Hat Linux 4 Update 5 x86_64 for OIM server This annex describes the steps required to install the evaluated configuration of Oracle Enterprise Linux 4 Update 5 x86_64 for the OIM server. [ECGOEL4] may be read for general guidance when installing Oracle Enterprise Linux. C.1 Install the Operating System Perform a standard Red Hat Enterprise Linux Advanced Server 4 update 5 installation bearing in mind the following settings: Use automatic partitioning Configure the network configured as required, e.g / Set the firewall to disabled (Note: this will be enabled) Set the SELinux setting to Warn Customise software packages to be installed: development->development tools system->system tools; plus systat. Graphical internet->unselect all except for firefox eth0 For the user account, create a user called oracle. C.2 Patch the Operating System Apply the latest Operating System security patches available via the Red Hat network. C.3 Configure the Operating System [WOS.1] Load up a Terminal and as root perform some system configuration: Setup the host file if DNS is not being used by adding the following lines with IP addresses and hostnames to match the infrastructures conventions, e.g.: oim.sme1.com oim odb.sme1.com odb oid.sme1.com oid [WOS.2] Create the required operating system groups as root: # groupadd oracle # groupadd dba Page 20 of 113

21 [WOS.3] Add oracle to the oracle group: root> usermod -g oracle G dba oracle [WOS.4] Create the directory /u01 to install the oracle software under and set the ownership: root> mkdir p /u01/oracle root> chown R oracle:oracle /u01 root> chmod 770 /u01/oracle [WOS.5] Setup kernel parameters, check parameters below and add following as required to /etc/sysctl.conf: # OIM ECG Changes kernel.msgmnb=65535 kernel.msgmni=2878 kernel.msgmax=8192 kernel.shmall= kernel.shmmax= kernel.shmmni=4096 kernel.sem= fs.file-max= net.ipv4.ip_local_port_range= net.core.rmem_default= net.core.rmem_max= net.core.wmem_default= net.core.wmem_max= [WOS.6] Load new kernel parameters: root> sysctl p [WOS.7] Create the directories for the installation media: oracle> mkdir p /space/src/oracle/appserver oracle> cd /space/src/oracle oracle> mkdir p Database oracle> mkdir p OIM9100 oracle> mkdir p Connectors oracle> mkdir p Patches oracle> chown R oracle:oracle /space/src/oracle/* [WOS.8] Unzip the installation media obtained using either 2.3 or 2.4, and patches as specified in Annex A above for the Oracle Application Server, Database, OIM, Connectors and Patches into the respective directories created above. Page 21 of 113

22 C.4 Install Java The actions [WOS.10] to [WOS.11] listed in this section are required to install Java for the OIM server before the installation of OIM server machine(s) can be carried out. Java is required to configure aspects of OIM as a browser based Java applet is used. [WOS.10] [WOS.11] Download the latest version of Java JRE for Linux from java.com, e.g. jre- 6u21-linux-i586-rpm.bin Start Installer: root> cp <path-to-java-installation-media>/jre-6u21-linuxi586-rpm.bin ~ root> cd ~ root> chmod +x jre-6u21-linux-i586-rpm.bin root>./jre-6u21-linux-i586-rpm.bin root> cd /usr/lib/firefox /plugins/ root> ln -s /usr/java/jre1.6.0_21/plugin/i386/ns7/ libjavaplugin_oji.so Note: The firefox directory name referenced above may vary slightly depending on the version installed. Page 22 of 113

23 Annex D OIM Server Installation D.1 Install the Oracle Application Server This step installs the Oracle Application Server Infrastructure (OracleAS) including an instance of Oracle Database which will be used to store Oracle Access Manager configuration data and also user details. Note: The OracleAS installation also includes OHS and OC4J. Oracle Identity Management in installed on OracleAS. D.1.1 Installation Steps [OAS.1] As oracle run the Application Server Installer: su - oracle oracle> cd /space/src/oracle/appserver oracle>./runinstaller [OAS.2] On the Oracle Application Server SOA Suite Installation screen: Click->Advanced Install radio button Select->Yes [OAS.3] [OAS.4] On the Specify Inventory Directory and Credentials screen: Change the path to /u01/oracle/inventory Specify the Operating System group name as oracle A pop up screen appears containing instructions to run a script as a root user in /u01/oracle/inventory. Using the open terminal type: oracle> su - root # cd /u01/oracle/inventory #./orainstroot.sh # cd /u01/ # chown R oracle:oracle OraInventory When this has completed successfully, return to the pop up screen and Select->Continue [OAS.5] On the Select Installation Type screen: Select->J2EE Server and Web Server Page 23 of 113

24 [OAS.6] [OAS.7] [OAS.8] [OAS.9] [OAS.10] [OAS.10] [OAS.11] On the Prerequisite Checks screen all checks should succeed. On completion: On the Port Configuration Options screen accept the default of Automatic port configuration and then On the Administration Settings screen enter the following values: AS Instance Name->AS1 AS Administrator->oc4jadmin AS Administrator Password->enter a secure password: should be at least 6 characters and not be a dictionary word, be alpha-numeric and have at least one number, capital letter; optionally one special character from the following: $, _, # Check->box marked Configure this as an Administration OC4J instance. OC4J Instance Name->oc4j_home On the Cluster Topology Configuration screen On the Summary screen Select->Install On the Installation screen The product is installed. This will take some time. Progress is marked by a status bar showing % complete. Part way through a pop up screen appears containing instructions to run a configuration script as a root user in /u01/oracle/product/ /oracleas_1. Using the open terminal type: # cd /u01/oracle/product/ /oracleas_1 #./root.sh When this has completed successfully, return to the pop up screen and Select->OK The installation completes. [OAS.10] On the Configuration Assistants screen, each configuration step is run with the status displayed. This may take some time to complete. when complete. [OAS.11] On the End Of Installation screen: Page 24 of 113

25 Note down the URL of the Oracle Application 10g Server welcome screen: e.g. Select-> Exit D.2 Upgrade the Oracle Application Server This upgrades the Oracle Application Server to D.2.1 Installation Steps [UAS.1] [UAS.2] [UAS.3] [UAS.4] [UAS.5] [UAS.6] [UAS.7] As oracle run the OAS Patch Installer: su - oracle oracle> cd /space/src/oracle/patches/p /disk1 oracle>./runinstaller On the Welcome screen: Select-> Next On the Specify file locations screen: Source->/space/src/oracle/Patches/p /Disk1/stage/products.xml Destination name->oracleas1 Destination -> /u01/oracle/product/ /oracleas_1 Select-> Next On the Administrator (oc4jadmin)password screen: Enter the oc4jadmin password as specified at [OAS.8]. Select-> Next On the Installation Summary screen Select->Install On the Install screen The patch is installed. This will take some time. Progress is marked by a status bar showing % complete. Part way through a set up privileges pop up screen appears containing instructions to run a configuration script as a root user in /u01/oracle/product/ /oracleas_1. Using the open terminal type: # su - root # cd /u01/oracle/product/ /oracleas_1 #./root.sh # exit When this has completed successfully, return to the pop up screen and Select->OK Page 25 of 113

26 The installation completes. [UAS.8] On the Configuration Assistants screen, each configuration step is run with the status displayed. This may take some time to complete. when complete. [UAS.9] On the End Of Installation screen: Select-> Exit D.3 Create OC4J Instance for OIM This creates an OC4J instance in which OIM will be able to run. D.3.1 Installation Steps [OC4J.1] From the Linux menu open the firefox web browser. Enter (e.g. Log on to the Enterprise Manager using oc4jadmin and the administrator password as specified at [OAS.8]. [OC4J.2] [OC4J.3] Click on the Application Server name (AS1). Click on the Create OC4J Instance button. Enter the OC4J instance name (oc4j_oim). Select the Add to a new group with name radio button. Enter the group name oim_group Also, tick the Start this OC4J instance after creation box. [OC4J.4] Click on Create button. Completion is confirmed and you can logout. [OC4J.5] Using the open terminal, run the following commands: oracle> cd ~ oracle> nano./.bash_profile enter the following: export ORACLE_HOME=/u01/oracle/product/ /OracleAS_1 export OAS_HOME=/u01/oracle/product/ /OracleAS_1 export JAVA_HOME=$OAS_HOME/jdk export PATH=$JAVA_HOME/bin:$OAS_HOME/opmn/bin:$PATH Page 26 of 113

27 Ctrl O Ctrl X oracle>.bash_profile D.4 Apply Oracle Application Server CPU Patch This patches the Oracle Application Server to D.4.1 [PAS.1] Installation Steps First, update the opatch utility to the latest version. You can find this on the Oracle support web site by searching for Patch and downloading the most recent versions for a Linux platform. At the time of writing OPatch 10.1 for 9i was used and OPatch Technical note provides the background understanding you need to manage opatch. For information about how to download the most recent version see note When you have downloaded the most recent opatch, copy the.zip file to /space/src/oracle/patches/ As oracle in the terminal window perform the following commands: oracle> opmnctl stopall oracle> mv OPatch OPatch_original oracle> unzip /space/src/oracle/patches/p _101000_linux.zip d $OAS_HOME oracle> mv OPatch OPatch_10.1 oracle> unzip /space/src/oracle/patches/p _102000_linux.zip d $OAS_HOME oracle> mv OPatch OPatch_10.2 Installation has been done when the unzipping has completed. You can confirm the version of opatch installed using: oracle> $OAS_HOME/OPatch_10.x/opatch version where x is 1 for the 10.1 directory and 2 for the 10.2 directory. [PAS.2] Continue in the terminal window: Oracle> cd $OAS_HOME oracle> cd../ oracle> $ORACLE_HOME/OPatch_10.1/opatch apply oracle> cd../ oracle> $ORACLE_HOME/OPatch_10.1/opatch apply oracle> cd../ oracle> $ORACLE_HOME/OPatch_10.1/opatch apply During the above patch applications the questions raised by the installers should be answered. Page 27 of 113

28 D.5 Configure RMI Settings This configures the RMI.xml file and restarts the application server. D.5.1 Installation Steps [CRS.1] As oracle in the terminal window run the following: oracle> nano $OAS_HOME/j2ee/oc4j_oim/config/rmi.xml locate <rmi-server tag add the following line: max-server-sockets= 200 Ctrl-O Ctrl-X to save and close oracle> nano $OAS_HOME/opmn/conf/opmn.xml locate oc4j_oim text scroll down 14 lines or so to locate the line containing: <port id= rmi range= /> replace this line with: <port id= rmi range= /> Ctrl-O Ctrl-X to save and close oracle> opmnctl startall D.6 Install Oracle Database for OIM This creates a Database instance that OIM will use as its data repository. D.6.1 Installation Steps [DB.1] [DB.2] As oracle run the database Installer: su - oracle oracle> cd /space/src/oracle/database/database oracle>./runinstaller On the Select Installation Method screen: The entries on this screen should be filled out as follows: Oracle Home Installation->/u01/oracle/product/ /OracleAS_1 Installation Type-> Enterprise Edition 1.3GB UNIX DBA Group-> oracle Page 28 of 113

29 Create Starter Database (additional 72M)->checked Global Database Name: oracle Database Password: enter a secure password: should be at least 6 characters and not be a dictionary word, be alpha-numeric and have at least one number, capital letter; optionally one special character from the following: $, _, # Confirm Password: as previous Select Advanced Installation [DB.3] [DB.4] [DB.5] [DB.6] [DB.7] [DB.8] [DB.9] [DB.10] On the Select Installation Type screen: Select->Enterprise Edition (1.26GB) On the Specify Home Details screen enter: Name->oimdb Path->/u01/oracle/product/ /Database On the Product Specific Prerequisite Checks screen all checks should succeed. On completion: On the Select Configuration Option screen: Select->Install database Software only On the Privilege Operating System Group screen, ensure that the entries are as follows: Database Administrator Group->oracle Database Operator Group->oracle On the Summary screen Select->Install On the Installation screen The product is installed. This will take some time. Progress is marked by a status bar showing % complete. Part way through a pop up screen appears containing instructions to run a configuration script as a root user in /u01/oracle/product/ /database/. Using the open terminal type: # cd /u01/oracle/product/ /database #./root.sh When this has completed successfully, return to the pop up screen and Select->OK Page 29 of 113

30 The installation completes. [DB.11] On the End Of Installation screen: Select->Exit D.7 Install Oracle Database Patchset This upgrades the Database instance to D.7.1 Installation Steps [UDB.1] [UDB.2] [UDB.3] [UDB.4] [UDB.5] [UDB.6] As oracle run the database Installer: su - oracle oracle> cd /space/src/oracle/patches/p oracle>./runinstaller On the Welcome screen: Select-> Next On the Specify Home Details screen enter: Name->oimdb Path->/u01/oracle/product/ /Database On the Summary screen Select->Install On the Installation screen The product is installed. This will take some time. Progress is marked by a status bar showing % complete. Part way through a pop up screen appears containing instructions to run a configuration script as a root user in /u01/oracle/product/ /database/. Using the open terminal type: # cd /u01/oracle/product/ /database #./root.sh When this has completed successfully, return to the pop up screen and Select->OK The installation completes. [UDB.7] On the End Of Installation screen: Select->Exit Page 30 of 113

31 D.8 Create Listener for OIM Database This creates the Listener for the OIM Database. D.8.1 Installation Steps [LIS.1] [LIS.2] [LIS.3] As oracle run netca in an open terminal window: su - oracle oracle> cd /u01/oracle/product/ /database/bin oracle>./netca On the Welcome screen: Select-> Listener Configuration On the Listener Configuration screen: Select-> Add [LIS.4] [LIS.5] [LIS.6] [LIS.7] On the Listener Name screen: Listener Name-> OIM_LISTENER On the Select Protocols screen: to select the default TCP option On the TCP/IP Protocol screen: to select the default 1521 port On the More Listeners screen: Select->No Listener Configuration complete is displayed. [LIS.8] [LIS.9] On the Completion Message screen: On the Welcome screen that is re-displayed: Select->Finish D.9 Create Database Instance for OIM Database This creates the Database instance for the OIM Database. Page 31 of 113

32 D.9.1 Installation Steps [DBC.1] [DBC.2] [DBC.3] [DBC.4] [DBC.5] [DBC.6] [DBC.7] [DBC.8] [DBC.9] [DBC.10] [DBC.11] As oracle run dbca in an open terminal window: oracle>./dbca On the Welcome screen: On the Step 1 screen: Select-> Create a Database On the Step 2 screen: Select-> Custom Database On the Step 3 screen: Enter Global Database Name-> [e.g. use domain in format oim.oim-test.com] Enter SID->oim On the Step 4 screen: Accept defaults: configure the Database with Enterprise Manager & Use Database Control for Database Management; so just: On the Step 5 screen: Enter the password, same ALL accounts-> Use a secure password: should be at least 6 characters and not be a dictionary word, be alpha-numeric and have at least one number, capital letter; optionally one special character from the following: $, _, # On the Step 6 screen: Accept default: File System; so just On the Step 7 screen: Accept default: Use Database File Locations...; so just On the Step 8 screen: Accept default recovery option; so just On the Step 9 screen: Page 32 of 113

33 Accept default database content options; so just [DBC.12] [DBC.13] [DBC.14] On the Step 10 screen: Select->All Initialization Parameters button Select->Show Advanced Parameters button Scroll down to QUERY_REWRITE_INTEGRITY parameter and change the value->trusted Select->Close On the Step 11 Database Storage screen: On the Step 12 Creation options screen: Accept defaults Select->Finish The confirmation screen is displayed showing the database details to be created. Select->OK to complete [DBC.15] On the Database Configuration Assistant screen: Progress is displayed as the database is created. This process may take some time. [DBC.16] On the Database Configuration Assistant screen a Database Creation completion message is displayed. Select->Exit to finish [DBC.17] In the terminal window as oracle, run the following command: oracle> lsnrctl start D.10 Prepare Database Instance for OIM Installation This prepares the Database instance for the OIM installation. D.10.1 Installation Steps [PDB.1] As oracle in the open terminal window: oracle> nano ~/.bash_profile ensure the following is set: export ORACLE_HOME=/u01/oracle/product/ /Database Page 33 of 113

34 export ODB_HOME=/u01/oracle/product/ /Database export OAS_HOME=/u01/oracle/product/ /OracleAS_1 export JAVA_HOME=$OAS_HOME/jdk export PATH=$PATH:$OAS_HOME/jdk/bin:$OAS_HOME/opmn/bin;$ODB_HOME/bin:$JAV A_HOME:$ODB_HOME/bin Ctrl-O; Ctrl-X oracle> su oracle {ensure that envt variables are set} oracle> cd /space/src/oracle/oim9101/installserver/xellerate/db/oracle oracle> cp prepare_xl_db.sh $ODB_HOME oracle> cp xell_db_prepare.sh $ODB_HOME oracle> cd $ODB_HOME oracle> chmod 755 prepare_xl_db.sh oracle> chmod 755 xell_db_prepare.sql oracle> dos2unix prepare_xl_db.sh oracle> groups response should be: oracle osdba dba if dba is not present then oracle> su root # usermod a G dba oracle # exit oracle> opmnctl stopall oracle> lsnrctl stop oracle> lsnrctl start oracle> opmnctl startall oracle> sqlplus / as sysdba SQL> startup SQL> exit oracle>./prepare_xl_db.sh Respond as follows: ORACLE_HOME:-> /u01/oracle/product/ /database ORACLE SID: oim OIM user name: oim_manager OIM user password: enter a secure password: should be at least 6 characters and not be a dictionary word, be alpha-numeric and have at least one number, capital letter; optionally one special character from the following: $, _, # Tablespace name: oim_data The directory in which to store the data file: /u01/oracle/product/ /database/oradata/oim The name of the data file: oim_data_01 The name of the temporary tablespace: temp Prepare_xl_db.sh script then completes D.11 Install Oracle Identity Manager This installs the Oracle Identity Manager. Page 34 of 113

35 D.11.1 Installation Steps [OIM.1] [OIM.2] [OIM.3] [OIM.4] As oracle in the open terminal window: oracle> su oracle {to ensure that envt variables are set} oracle> export PATH=$JAVA_HOME/bin:$PATH oracle> cd /space/src/oracle/oim9101/installserver/ oracle>./install_server.sh The installer runs in text mode. For language, press <Enter> to chose the default of English. The welcome screen is displayed, accept default [1] by pressing <Enter>. The Admin User information is displayed. Enter the password for the xelsysadm account. Use a secure password: should be at least 6 characters and not be a dictionary word, be alpha-numeric and have at least one number, capital letter; optionally one special character from the following: $, _, #. Enter confirmation of secure password entered when prompted Confirm User Password. Accept default [1] by pressing <Enter>. Accept default [1] by pressing <Enter> again. [OIM.5] [OIM.6] Select the OIM application to install: 2 for Oracle Identity Manager. Accept default [0] to finish, by pressing <Enter>. When prompted enter the following responses for database connectivity information: Destination Directory->/u01/oracle/product/9.1.0/OIMServer Accept default [1] to continue to next setting by pressing <Enter>. Enter y to allow creation of the OIM Server destination directory specified above. Accept default [0] to select Oracle Database and continue to next screen by pressing <Enter>. Accept default [1] to continue to next setting by pressing <Enter>. Accept default [Database Hostname-> localhost] and continue to next screen by pressing <Enter> Accept default [Port Number-> 1521] and continue to next screen by pressing <Enter> Enter oim for Database SID and press <Enter> Enter oim_manager for User Name and press <Enter> Page 35 of 113

36 Accept default of [1] to proceed to the next screen. [OIM.7] Enter the following configuration options: Select Authentication Mode-> Accept default [0] which chooses Oracle Identity Manager Default Authentication by pressing <Enter> Accept default of [1] to proceed to the next screen. Select Application Server-> Select 2 to choose Oracle Application Server and press <Enter>, then accept [0] by pressing <Enter> to finish. Accept default of [1] to proceed to the next screen. The Application Server is clustered-> Accept default of No by pressing <Enter> Accept default of [1] to proceed to the next screen. Location for Application Server-> enter /u01/oracle/product/ /oracleas_1 and press <Enter> Location for the JDK-> enter /u01/oracle/product/ /oracleas_1/jdk and press <Enter> Accept default of [1] to proceed to the next screen. oc4jadmin username-> Accept default [oc4jadmin] by pressing <Enter> password-> enter password as entered at [OAS.8] and press <Enter> RMI Port Number-> change to and press <Enter> OC4J Instance name-> enter oc4j_oim and press <Enter> Should the installer fail by taking you back to oc4jadmin username re-create the oc4j instance and try the installer from there. Ensure that the RMI settings for such a new oc4j instance are configured as per D.5 above. [OIM.8] Accept default of [1] to proceed to installation of OIM, which completes with no errors. This step may take some time. D.12 Upgrade OIM from to This upgrades the OIM Server to D.12.1 Installation Steps [UPG.1] As oracle in the terminal window run the following commands: oracle> su - oracle oracle> cd /space/src/oracle/patches/p /db/oracle/scripts oracle>./oim_db_upg_9101_to_9102.sh Page 36 of 113

37 ensure that the ORACLE_HOME is for the database: /u01/oracle/product/ /database Use y to accept oim as database SID Use: /space/src/oracle/patches/p as the Db Schema update script directory Use: oim_manager for Db Schema user name Enter password for oim_manager Upgrade runs without errors: Starting Oracle Identity Maanger Db Schema Upgrade... Oracle Identity Manager Db Schema Upgrade Successful... Starting Oracle Identity Manager Db Stored Procedure Upgrade... Oracle Identity Manager Db Stored Procedure Upgrade Successful... Please see logs at: /space/src/oracle/patches/p /db/oracle/log/oim_db_upg_9101_t o_9102 oracle> export ORACLE_HOME=$ODB_HOME oracle> sqlplus username: oim_manager password: <oim_manager password> (see [PDB.1]) screen displays connected e_xacm.sql script runs without errors SQL>exit oracle> [UPG.8] Edit the LoadXML.sh file to set its variables as follows from the terminal window: oracle> cd /space/src/oracle/patches/p /db/metadata oracle> nano LoadXML.sh modify the following entries as follows: # Set JAVA_HOME to point to java home export JAVA_HOME=/u01/oracle/product/ /Database/jdk # If you are running Oracle, uncomment the following lines and # set the path of the directory containing Oracle JDBC Drivers. export ORACLE_DRIVER_DIR=/u01/oracle/product/ /Database/jdbc/l ib #Set the Oracle JDBC driver being used for the OIM version export JDBC_DRIVER_VERSION=ojdbc14.jar #Set the OIM home location for the installation export XLHOME=/u01/oracle/product/9.1.0/OIMServer/xellerate Ctrl-O Ctrl-X [UPG.9] Run the LoadXML.sh file and respond to the prompts as required. Page 37 of 113

38 Oracle>./LoadXML.sh oim_manager password (see [PDB.1]) [UPG.11] Update the FormMetaData.xml file in $OIM_HOME\xellerate\config as follows: oracle> cd $OIM_HOME/xellerate/config oracle> nano FormMetaData.xml In the Form name="5" element of the FormMetaData.xml file, add the lines highlighted bold font in the following code block: <Form name="5"> <!-- Resource Name --> <AttributeReference editable="true" optional="false">- 502</AttributeReference> <!-- Description --> <AttributeReference editable="true" optional="false">- 503</AttributeReference> <!--Type--> <AttributeReference editable="true" optional="true">- 504</AttributeReference> <!-- Target --> <AttributeReference editable="true" optional="true">- 505</AttributeReference> <!-- Auto Prepopulate --> <AttributeReference editable="true" optional="true">- 506</AttributeReference> <!-- Allow Multiple --> <AttributeReference editable="true" optional="true">- 507</AttributeReference> <!-- Allow All --> <AttributeReference editable="true" optional="true">- 508</AttributeReference> <!-- Auto Save --> <AttributeReference editable="true" optional="true">- 509</AttributeReference> <!-- Auto Launch --> <AttributeReference editable="true" optional="true">- 510</AttributeReference> <!-- Self Request Allowed --> <AttributeReference editable="true" optional="true">- 511</AttributeReference> <!-- Provision By Resource Admin Only --> <AttributeReference editable="true" optional="true">- 512</AttributeReference> <!-- Off-line Provisioning --> <AttributeReference editable="true" optional="true">- 513</AttributeReference> <!-- Trusted Source --> <AttributeReference editable="true" optional="true">- 514</AttributeReference> <!-- Sequence Recon --> <AttributeReference editable="true" optional="true">- 515</AttributeReference> </Form> <!-- Resource Management section --> Page 38 of 113

39 <!-- List of attributes that can be displayed in the "Resource" Form - -> <Attribute name="-501" varianttype="long" datalength="50" map="objects.key" /> <Attribute name="-502" label="taskdetails.label.resourcename" displaycomponenttype="textfield" varianttype="string" datalength="80" map="objects.name" /> <Attribute name="-503" label="usergrouppolicies.label.columnheading.policydescription" displaycomponenttype="textfield" varianttype="string" datalength="256" map="structure Utility.Description" /> <Attribute name="-504" label="global.label.type" displaycomponenttype="lookupfield" varianttype="long" datalength="256" map="objects.type"> <ValidValues lookupcode="lookup.objects.object Type" selectioncolumn="lkv_encoded"/> </Attribute> <Attribute name="-505" label="requestwizard.message.target" displaycomponenttype="textfield" varianttype="string" datalength="256" map="objects.order For" /> <Attribute name="-506" label="global.label.autoprepopulate" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.auto Prepopulate" /> <Attribute name="-507" label="duallisttest.message.resourceallowmultiple" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.allow Multiple" /> <Attribute name="-508" label="global.label.allowall" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.allow All" /> <Attribute name="-509" label="global.label.autosave" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.auto Save" /> <Attribute name="-510" label="global.label.autolaunch" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.auto Launch" /> <Attribute name="-511" label="global.label.selfrequestallowed" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.self Request Allowed" /> <Attribute name="-512" label="global.label.provisionbyresourceadminonly" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.admin Only" /> <Attribute name="-513" label="global.label.offlineprovisioning" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.off-line Provisioning" /> <Attribute name="-514" label="global.label.trustedsource" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.trusted Source" /> <Attribute name="-515" label="global.label.sequencerecon" displaycomponenttype="checkbox" varianttype="string" datalength="1" map="objects.sequence Recon" /> [UPG.10] Save and close the file: Ctrl-O, Ctrl-X. Page 39 of 113