7 Post-Install Configuration for Oracle Identity Manager Server and OC4J

After you have installed Oracle Identity Manager, you must complete some post-installation tasks before you can use the application. Additionally, there are several optional post-installation tasks you may choose to complete, depending on your deployment, before using the application. The following is a list of the sections in this chapter:

• Required Post-Installation Tasks for OC4J

• Optional Post-installation Tasks

Required Post-Installation Tasks for OC4J

After you install Oracle Identity Manager on OC4J you must perform the tasks in this section for Oracle Identity Manager to operate properly.

Increasing the OC4J Heap Size

After installing Oracle Identity Manager on OC4J you must increase the OC4J heap size before using Oracle Identity Manager. Perform the following steps to increase the OC4J heap size:

1. Open the <OC4J_HOME>\opmn\conf\opmn.xml file in a text editor.

2. Search for the following string:

   -XX:MaxPermSize=128M
   
   

   Change this string to the following:

   -XX:MaxPermSize=512M 
   
   

3. Save and close the <OC4J_HOME>\opmn\conf\opmn.xml file.

4. Restart the OC4J application server after increasing the heap size.

Increasing the Number of MDB Listener Threads

After installing Oracle Identity Manager on OC4J you must increase the number of MDB listener threads before using Oracle Identity Manager. By default, the number of listener threads is set to 1 and you must increase that setting to 15. Perform the following steps to increase the number of MDB listener threads:

1. Open the <XL_HOME>\xellerate\DDTemplates\BO\orion-ejb-jar.xml file in a text editor.

2. Add a listener thread attribute by inserting the following text:

   <message-driven-deployment name="MessageHandlerMDB"
   connection-factory-location="jms/XAQueueConnectionFactory"
   destination-location="queue/xlQueue"
   listener-threads="15"
   >
   
   

3. Save and close the orion-ejb-jar.xml file.

4. Run the <XL_HOME>\setup\patch_oc4j command.

5. Restart the OC4J application server.

Configuring JMS File-based Persistence

After installing Oracle Identity Manager on OC4J you must configure JMS file-based persistence to ensure messages in the JMS queue can continue to be processed after the server restarts. Perform the following steps to configure JMS file-based persistence:

1. Stop the OC4J application server if it is running.

2. Open the <OC4J_HOME>\j2ee\home\config\jms.xml file in a text editor.

3. Add a persistence file attribute for xlQueue by inserting the following text:

   <queue
   name="xlQueue"
   location="queue/xlQueue"
   persistence-file="xlQueueJMSStore"
   >
   

4. Add a persistence file attribute for xlErrorQueue by inserting the following text:

   <queue
   name="xlErrorQueue"
   location="queue/xlErrorQueue"
   persistence-file="xlErrorQueueJMSStore"
   >
   
   

5. Save and close the jms.xml file.

6. Start the OC4J application server.

Optional Post-installation Tasks

After installing Oracle Identity Manager, you should considering performing the optional post-installation tasks documented in this section before using the application. Depending on your Oracle Identity Manager deployment, you may choose not to perform some of these tasks.

Changing Keystore Passwords

Oracle Identity Manager has two keystores: one for the Oracle Identity Manager server and one for the database. During installation, the passwords for both are set to xellerate. Oracle recommends changing the keystore passwords for all production installations. You can use the keytool to change the keystore password for either keystore.

To change the keystore password:

1. Open a command prompt on the Oracle Identity Manager host computer.

2. Navigate to the <XL_HOME>\xellerate\config directory.

3. Run the keytool with the following options:

   <JAVA_HOME>\jre\bin\keytool -storepasswd -new <new_password> -storepass xellerate -keystore .xlkeystore -storetype JKS

   Table 7-1 lists the options used in the preceding example of keytool usage:

   Table 7-1 Command Options for keytool

   Option	Description
   <JAVA_HOME>	Location of the Java directory associated with the application server
   <new_password>	New password for the keystore
   -keystore <option>	Keystore whose password you are changing (.xlkeystore for the Oracle Identity Manager server or .xldatabasekey for the database)
   -storetype <option>	JKS for .xlkeystore and JCEKS for .xldatabasekey

   
   

4. Launch a plain-text editor, then open the <XL_HOME>\xellerate\config\xlconfig.xml file.

5. Edit the <xl-configuration>.<Security>.<XLPKIProvider>.<KeyStore> section to specify the keystore password.

   Note:

   Change the <XLSymmetricProvider>.<KeyStore> section of the configuration file to update the password for the database keystore (.xldatabasekey).

   • Change the password tag to encrypted="false".

   • Enter the password (in the clear). For example, change the following block:

     <Security>
     <XLPKIProvider>
     <KeyStore>
     <Location>.xlkeystore</Location>
     <Password encrypted="true">xYr5V2FfkRYHxKXHeT9dDg==</Password>
     <Type>JKS</Type>
     <Provider>sun.security.provider.Sun</Provider>
     </KeyStore>
     
     

     to the following:

     <Security>
     <XLPKIProvider>
     <KeyStore>
     <Location>.xlkeystore</Location>
     <Password encrypted="false">newpassword</Password>
     <Type>JKS</Type>
     <Provider>sun.security.provider.Sun</Provider>
     </KeyStore>
     
     

6. Restart your application server.

   When you stop and start the application server, a backup of the configuration file is created. The configuration file (with the new password) is read in, and the password is encrypted in the file.

7. If all of the preceding steps have succeeded, you can delete the backup file.

Setting Log Levels

Oracle Identity Manager uses log4j for logging. Logging levels are configured in the logging properties file, <XL_HOME>/xellerate/config/log.properties. By default, Oracle Identity Manager is configured to output at the Warning level. You can change the log level universally for all components or for an individual component.

Oracle Identity Manager components are listed in the <XL_HOME>\xellerate\config\log.properties file in the XELLERATE section, for example:

log4j.logger.XELLERATE=WARN
log4j.logger.XELLERATE.DDM=DEBUG
log4j.logger.XELLERATE.ACCOUNTMANAGEMENT=DEBUG
log4j.logger.XELLERATE.SERVER=DEBUG
log4j.logger.XELLERATE.RESOURCEMANAGEMENT=DEBUG
log4j.logger.XELLERATE.REQUESTS=DEBUG
log4j.logger.XELLERATE.WORKFLOW=DEBUG
log4j.logger.XELLERATE.WEBAPP=DEBUG
log4j.logger.XELLERATE.SCHEDULER=DEBUG
log4j.logger.XELLERATE.SCHEDULER.Task=DEBUG
log4j.logger.XELLERATE.ADAPTERS=DEBUG
log4j.logger.XELLERATE.JAVACLIENT=DEBUG
log4j.logger.XELLERATE.POLICIES=DEBUG
log4j.logger.XELLERATE.RULES=DEBUG
log4j.logger.XELLERATE.DATABASE=DEBUG
log4j.logger.XELLERATE.APIS=DEBUG
log4j.logger.XELLERATE.OBJECTMANAGEMENT=DEBUG
log4j.logger.XELLERATE.JMS=DEBUG
log4j.logger.XELLERATE.REMOTEMANAGER=DEBUG
log4j.logger.XELLERATE.CACHEMANAGEMENT=DEBUG
log4j.logger.XELLERATE.ATTESTATION=DEBUG
log4j.logger.XELLERATE.AUDITOR=DEBUG

To set Oracle Identity Manager log levels, edit the logging properties in the <XL_HOME>\xellerate\config\log.properties file as follows:

1. Open the <XL_HOME>\xellerate\config\log.properties file in a text editor. This file contains a general setting for Oracle Identity Manager and specific settings for the components and modules that comprise Oracle Identity Manager.

   By default, Oracle Identity Manager is configured to output at the Warning level:

   log4j.logger.XELLERATE=WARN

   This is the general value for Oracle Identity Manager. Individual components and modules are listed following the general value in the properties file. You can set individual components and modules to different log levels. The log level for a specific component overrides the general setting.

2. Set the general value to the desired log level. The following is a list of the supported log levels, appearing in descending order of information logged (DEBUG logs the most information and FATAL logs the least information):

   • DEBUG

   • INFO

   • WARN

   • ERROR

   • FATAL

3. Set other component log levels as desired. Individual components or modules can have different log levels. For example, the following values set the log level for the Account Management module to INFO, while the server is at DEBUG and the rest of Oracle Identity Manager is at the WARN level.

   log4j.logger.XELLERATE=WARNlog4j.logger.XELLERATE.ACCOUNTMANAGEMENT=INFOlog4j.logger.XELLERATE.SERVER=DEBUG

4. Save your changes.

5. Restart your application server so that the changes take effect.