6 Integrating Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Manager

This chapter describes how to integrate Oracle Access Manager with Oracle Identity Manager and Oracle Adaptive Access Manager for secure password collection:

6.1 Introduction

In 11g Release 1 (11.1.1), Oracle Access Manager does not provide its own identity service. Instead, Oracle Access Manager:

  • consumes identity services provided by Oracle Identity Manager, LDAP directories, and other sources

  • integrates with Oracle Identity Manager and Oracle Adaptive Access Manager to deliver a range of secure password collection and challenge-related functionality to Oracle Access Manager protected applications

Although other combinations are possible, integrating Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Manager is the recommended option and provides these features:

  • Password entry protection through personalized virtual authenticators

  • KBA challenge questions for secondary login authentication based on risk

  • OTP challenge for secondary login authentication based on risk

  • Registration flows to support password protection and KBA and OTP challenge functionality

  • User preferences flows to support password protection and KBA and OTP challenge functionality

  • Password management flows

Oracle Adaptive Access Manager

Oracle Adaptive Access Manager is responsible for:

  • Running fraud rules before and after authentication

  • Navigating the user through Oracle Adaptive Access Manager flows based on the outcome of fraud rules

Oracle Identity Manager

Oracle Identity Manager is responsible for:

  • Provisioning users (add/modify, delete users)

  • Managing passwords (reset/change password)

Oracle Access Manager

Oracle Access Manager is responsible for:

  • Authenticating and authorizing users

  • Providing statuses such as Reset Password, Password Expired, User Locked, and others

6.2 Process Flow

In this deployment, Oracle Access Manager redirects users to Oracle Adaptive Access Manager when a trigger condition for password management is in effect. The "trigger condition" is the authentication scheme used in Oracle Access Manager.

Oracle Adaptive Access Manager interacts with the user based on lifecycle policies retrieved from Oracle Access Manager, and when the condition is resolved, notifies Oracle Access Manager so that the user is redirected to the protected resource. In this integration, Oracle Identity Manager serves to provide password policy enforcement.

For a detailed description of the processing flow see Section 2.8, "Integrating Oracle Identity Manager, Oracle Access Manager, and Oracle Adaptive Access Manager"

6.3 Prerequisites

The following needs to be in place for the integration:

The steps below are based on the assumption that Oracle Access Manager and Oracle Identity Manager are integrated using the out-of-the box integration.

6.4 Overview of Integration Tasks

The following tasks are required to perform this integration:

6.5 Install Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Manager

Install Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Manager on different servers with all three in the same domain.

Perform post-configuration for Oracle Access Manager and Oracle Adaptive Access Manager with the out-of-the-box configuration.

Ensure that the out-of-the-box policies and KBA questions are configured; this is important for Oracle Adaptive Access Manager authentication to work. For details on these default policies and questions, see:

For information on installing the Identity Management Suite, refer to Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

6.6 Integrate Oracle Access Manager and Oracle Identity Manager

Integration between Oracle Identity Manager and Oracle Access Manager is required for integration between Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Identity Manager.

For information on integrating Oracle Access Manager and Oracle Identity Manager, refer to Integration Between OIM and OAM in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

6.7 Enable LDAP Synchronization for Oracle Identity Manager

Enabling LDAP synchronization for Oracle Identity Manager is required for integration between Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Identity Manager.

Oracle Adaptive Access Manager will be working off the same directory with which Oracle Identity Manager is synchronizing.

For information about setting up Oracle Identity Manager for LDAP synchronization, refer to OIM with LDAP Sync in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

6.8 Integrate Oracle Access Manager and Oracle Adaptive Access Manager

This task involves integrating the Oracle Access Manager and Oracle Adaptive Access Manager components as part of integrating Oracle Access Manager, Oracle Identity Manager, and Oracle Adaptive Access Manager to deliver password management and challenge-related functionality to Oracle Access Manager-protected applications.

Note:

The integration of Oracle Access Manager and Oracle Adaptive Access Manager requires that the IdentityManagerAccessGate 10gWebGate profile exist. You can validate this through the Oracle Access Manager Console by navigating to System Configuration, then Agents, then 10gWebGates.

In the integration of Oracle Access Manager, Oracle Identity Manager, and Oracle Adaptive Access Manager, the IdentityManagerAccessGate profile should already exist since it is configured during the Oracle Access Manager - Oracle Identity Manager integration (see Section 6.6, "Integrate Oracle Access Manager and Oracle Identity Manager").

Configure the Oracle Adaptive Access Manager and Oracle Access Manager integration as follows:

6.8.1 Set Oracle Adaptive Access Manager Properties for Oracle Access Manager

Note:

Before doing this procedure, you must take into account whether the OAAM console is being protected.

To set Oracle Adaptive Access Manager properties for Oracle Access Manager:

  1. Start the managed server hosting the Oracle Adaptive Access Manager server.

  2. Go to the Oracle Adaptive Access Manager Admin Console at http://OAAM Managed Server Host:OAAM Admin Managed Server Port/oaam_admin.

  3. Log in as a user with access to the property editor.

  4. Open the Oracle Adaptive Access Manager property editor to set the Oracle Access Manager properties.

    If a property does not exist, you must add it.

    For the following properties, set the values according to your deployment:

    Table 6-1 Configuring Oracle Access Manager Property Values

    Property Name Property Values

    bharosa.uio.default.password.auth.provider.classname

    com.bharosa.vcrypt.services.OAMOAAMAuthProvider

    bharosa.uio.default.is_oam_integrated

    true

    oaam.uio.oam.host

    Access Server host machine name

    For example, host.oracle.com

    oaam.uio.oam.port

    Access Server Port; for example, 3004

    oaam.uio.oam.obsso_cookie_domain

    Cookie domain defined in Access Server WebGate Agent

    oaam.uio.oam.java_agent.enabledFoot 1 

    Default value is false. Set this to true only if the OAM Java Agent (also known as the WLSAgent) is used to protect the application.

    When setting this property, note the following points about the property oaam.uio.oam.obsso_cookie_name:

    • By default, the property oaam.uio.oam.obsso_cookie_name does not exist.

    • If using Java agent, when setting oaam.uio.oam.java_agent.enabled to true, also set the property oaam.uio.oam.obsso_cookie_name to the value OAMAuthnCookie since the Java agent uses the OAMAuthnCookie cookie.

    • If using Webgate Agent and oaam.uio.oam.java_agent.enabled is set to false, if the property oaam.uio.oam.obsso_cookie_name happens to be set, remove that property.

    oaam.uio.oam.virtual_host_nameFootref 1

    Default value is IDMDomain when the OAM Java Agent (also known as the WLSAgent) is used.

    Change this value only if the virtual host name is different from IDMDomain.

    oaam.uio.oam.webgate_id

    IdentityManagerAccessGate

    The name of the WebGate Agent for Oracle Identity Manager integration. The default is IdentityManagerAccessGate.

    oaam.uio.login.page

    /oamLoginPage.jsp

    oaam.uio.oam.secondary.host

    Name of the secondary Access Server host machine.

    The property must be added, as it is not set by default.

    This property is used for high availability. You can specify the fail-over hostname using this property.

    oaam.uio.oam.secondary.host.port

    Port number of the secondary Access Server

    The property must be added as it is not set by default.

    This property is used for high availability. You can specify the fail-over port using this property.

    oaam.oam.csf.credentials.enabled

    true

    This property enables configuring credentials in the Credential Store Framework instead of maintaining them using the properties editor. This step is performed so that credentials can be securely stored in CSF.

    Footnote 1 Required when using the OAM Java agent.

For information on setting properties in Oracle Adaptive Access Manager, see "Using the Property Editor" in Oracle Fusion Middleware Administrator's Guide for Oracle Adaptive Access Manager.

For more information about the IDM Domain Agent, see Section 1.2, "A Note About IDMDomain Agents and Webgates".

6.8.2 Set Oracle Access Manager Credentials in Credential Store Framework

So that Oracle Access Manager WebGate credentials can be securely stored in the Credential Store Framework, follow these steps to add a password credential to the Oracle Adaptive Access Manager domain:

  1. Go to the Oracle Fusion Middleware Enterprise Manager Console at http://WebLogic Server Host:Administration Port/em.

  2. Log in as a WebLogic Administrator.

  3. Expand the Base_Domain icon in the navigation tree in the left pane.

  4. Select your domain name, right-click, select the menu option Security, and then select the option Credentials in the sub-menu.

  5. Click Create Map.

  6. Click oaam to select the map, then click Create Key.

  7. In the pop-up window make sure Select Map is oaam.

  8. Provide the following properties and click OK.

    Name Value
    Map Name oaam
    Key Name oam.credentials
    Key Type Password
    UserName Oracle Access Manager user with Administrator rights
    Password Password of Oracle Access Manager WebGate Agent

6.9 Integrate Oracle Identity Manager and Oracle Adaptive Access Manager

This section describes how to integrate Oracle Identity Manager and Oracle Adaptive Access Manager for the three-way integration of Oracle Access Manager, Oracle Identity Manager, and Oracle Adaptive Access Manager:

6.9.1 Set Oracle Adaptive Access Manager Properties for Oracle Identity Manager

To set Oracle Adaptive Access Manager properties for Oracle Identity Manager:

  1. Go to the Oracle Adaptive Access Manager Admin Console at http://OAAM Managed Server Host:OAAM Admin Managed Server Port/oaam_admin.

  2. Log in as a user with access to the Properties Editor.

  3. Open the Oracle Adaptive Access Manager Property Editor to set the Oracle Identity Manager properties.

    If a property does not exist, you need to add it.

    For the following properties, set the values according to your deployment:

    Table 6-2 Configuring Oracle Identity Manager Property Values

    Property Name Property Values

    bharosa.uio.default.user.management.provider.classname

    com.bharosa.vcrypt.services.OAAMUserMgmtOIM

    oaam.oim.auth.login.config

    ${oracle.oaam.home}/../designconsole/config/authwl.conf

    oaam.oim.url

    t3://<OIM Managed Server>:<OIM Managed Port>

    For example, t3://host.oracle.com:14000

    oaam.oim.xl.homedir

    ${oracle.oaam.home}/../designconsole

    bharosa.uio.default.signon.links.enum.selfregistration.url

    http://<OIM Managed Server>:<OIM Managed Port>/oim/faces/pages/USelf.jspx?E_TYPE=USELF&OP_TYPE=SELF_REGISTRATION&backUrl=<OAAM Login URL for OIM>

    where <OAAM Login URL for OIM> is http://<OHS host>:<OHS port>/oim/faces/pages/Self.jspx or (in case of IDMDOMAINAgent ) is http://<OIM host>:<OIMport>/oim/faces/pages/Self.jspx.

    OHS setup was performed during the integration between Oracle Access Manager and Oracle Identity Manager.

    bharosa.uio.default.signon.links.enum.trackregistration.url

    http://<OIM Managed Server>:<OIM Managed Port>/oim/faces/pages/USelf.jspx?E_TYPE=USELF&OP_TYPE=UNAUTH_TRACK_REQUEST&backUrl=<OAAM Login URL for OIM>

    where <OAAM Login URL for OIM> is http://<OHS host>:<OHS port>/oim/faces/pages/Self.jspx or (in case of IDMDOMAINAgent ) is http://<OIM host>:<OIMport>/oim/faces/pages/Self.jspx.

    OHS setup was performed during the integration between Oracle Access Manager and Oracle Identity Manager.

    bharosa.uio.default.signon.links.enum.trackregistration.enabled

    true

    bharosa.uio.default.signon.links.enum.selfregistration.enabled

    true

    oaam.oim.csf.credentials.enabled

    true

    This property enables the configuring of credentials in the Credential Store Framework as opposed to maintaining them using the Properties Editor. This step is performed so that credentials can be securely stored in CSF.

For information on setting properties in Oracle Adaptive Access Manager, see "Using the Property Editor" in Oracle Fusion Middleware Administrator's Guide for Oracle Adaptive Access Manager.

6.9.2 Set Oracle Identity Manager Credentials in Credential Store Framework

So that Oracle Identity Manager WebGate credentials can be securely stored in the Credential Store Framework, follow these steps to add a password credential to the Oracle Adaptive Access Manager domain:

  1. Go to the Oracle Fusion Middleware Enterprise Manager Console at http://<<WebLogic Server host>:<Administration Port>/em.

  2. Log in as a WebLogic Administrator.

  3. Expand the <Base_Domain> icon in the navigation tree in the left pane.

  4. Select your domain name, right click, and select the menu option Security and then the option Credentials in the sub menu.

  5. Click Create Map.

  6. Click oaam to select the map, then click Create Key.

  7. In the pop-up window make sure Select Map is oaam.

  8. Provide the following properties and click OK.

    Name Value
    Map Name oaam
    Key Name oim.credentials
    Key Type Password
    UserName Username of Oracle Identity Manager Administrator
    Password Password of Oracle Identity Manager Administrator

6.10 Configure Oracle Identity Manager Properties for the Integration

In Oracle Identity Manager, system properties are configured to enable Oracle Adaptive Access Manager to provide the challenge question-related functionality instead of Oracle Identity Manager:

To modify Oracle Identity Manager properties for Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Manager integration:

  1. Log in to Oracle Identity Manager Administrative Console.

  2. Click the Advanced link in the self-service console.

  3. Click System Properties in System Management.

  4. Click on Advanced Search.

  5. Set the following properties and click Save.

    Note:

    For the URLs, use the hostnames as they were configured in Oracle Access Manager. For example, if a complete hostname (with domain name) was provided during Oracle Access Manager configuration, use the complete hostname for the URLs.

    Table 6-3 Oracle Identity Manager Redirection

    Keyword Property Name and Value

    OIM.DisableChallengeQuestions

    TRUE

    OIM.ChangePasswordURL

    URL for change password page in Oracle Adaptive Access Manager

    (http://OAAM Server Managed Server Host:OAAM Server Managed Server Port/oaam_server/oimChangePassword.jsp

    In a high availability (HA) environment, set this property to point to the virtual IP URL for the OAAM server.

    OIM.ForgotPasswordURL

    URL for forgot password page in Oracle Adaptive Access Manager

    (http://OAAM Server Managed Server Host:OAAM Server Managed Server Port/oaam_server/oimForgotPassword.jsp)

    OIM.ChallengeQuestionModificationURL

    URL for challenge questions modification page in Oracle Adaptive Access Manager

    (http://OAAM Server Managed Server Host:OAAM Server Managed Server Port/oaam_server/oimResetChallengeQuestions.jsp)

6.11 Configure Oracle Access Manager Policy Authentication Scheme

Change your protected web application's Oracle Access Manager policy to point to the OAAMAdvanced authentication scheme using the Oracle Access Manager administration console.

The steps are as follows:

  1. Go to the Oracle Access Manager Administration Console using a URL of the form http://hostname:port/oamconsole.

    For details, see Logging In to the Oracle Access Manager 11g Administration Console in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager.

  2. Log in as the Oracle Access Manager administrator.

  3. From the Policy Configuration tab, navigate the tree as follows:

    • expand the Application Domains node

    • expand the IDMDomainAgent

    • expand Authentication Policies

  4. Select for editing the authentication policy named Protected HigherLevel Policy, and assign to it the OAAMAdvanced authentication scheme.

  5. Test the Oracle Adaptive Access Manager URL in a separate browser session by navigating to:

    http://OAAM Server Managed Server Host:OAAM Server Managed Server Port/oaam_server/oamLoginPage.jsp

  6. Verify that the Oracle Adaptive Access Manager server user login page appears with no errors.

    Do not attempt to log in to the OAAM server yet.

  7. Log in to the Oracle Access Manager administration console using the administrative credentials.

  8. Set the Oracle Adaptive Access Manager URL by navigating to the OAAMAdvanced authentication scheme and making these changes:

    • Add the challenge_url.

      Ensure that the Oracle Adaptive Access Manager URL is correct and is the same URL that you tested in Step 5.

      http://OAAM Server Managed Server Host:OAAM Server Managed Server Port/oaam_server/oamLoginPage.jsp

      (Note: Do not use the protocol string "http(s)", or URL redirection will not succeed. Use an explicit protocol, either http or https.)

    • Set contextType to external.

  9. Restart the Oracle Access Manager managed server.

6.12 Restart the Servers

Once integration between Oracle Access Manager and Oracle Adaptive Access Manager is complete, restart the managed servers:

  1. Start the managed server hosting the Oracle Access Manager server.

  2. Restart the Oracle Adaptive Access Manager managed servers (OAAM Admin and OAAM server).

6.13 Troubleshooting Tips

This section provides additional troubleshooting and configuration tips for the integration of Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Manager.

6.13.1 Policies and Challenge Questions

You may encounter a non-working URL if policies and challenge questions are not available as expected in your Oracle Adaptive Access Manager environment. For example, the Forgot Password page will fail to come up and you are redirected back to the login page.

To ensure correct operation, make sure that the default base policies and challenge questions shipped with Oracle Adaptive Access Manager have been imported into your system. For details, see Setting Up the Oracle Adaptive Access Manager Environment in the Oracle Fusion Middleware Administrator's Guide for Oracle Adaptive Access Manager.

6.13.2 Cookie Domain Definition

Incorrect value of the cookie domain in your configuration can result in login failure.

For correct Webgate operation, ensure that the property oaam.uio.oam.obsso_cookie_domain is set to match the corresponding value in Oracle Access Manager; for example, .us.oracle.com.