D Completing Installation of Oracle WebCenter Interaction Identity Service for LDAP

If you installed Oracle WebCenter Interaction Identity Service for LDAP, perform the following tasks to complete the installation:

• Verifying Installation

• Creating a Remote Authentication Source

• Creating a Remote Profile Source

• Creating a Job

This chapter also include the section Advanced Configuration, which includes the following optional advanced procedures for LDAP configuration:

• Configuring Logging

• Configuring Application Server Session Settings

• Configuring LDAP Server Settings

• Using Oracle WebCenter Interaction Identity Service for LDAP over SSL

Verifying Installation

After you have deployed the Oracle WebCenter Interaction Identity Service for LDAP package, you can run a diagnostic utility to verify connectivity among deployment components.

To verify your deployment of the Oracle WebCenter Interaction Identity Service for LDAP package:

1. In a Web browser, open the URL for the remote server diagnostics utility, for example: http://RemoteServer:port/ldapws/install/index.html

2. Complete the steps as described in the utility summary page to verify the correct configuration of deployment components.

Creating a Remote Authentication Source

Create a remote authentication source to import users and groups from LDAP:

1. Log in to the portal as an administrator.

2. Click Administration.

3. Click the LDAP IDS folder.

4. From the Create Object menu, choose Authentication Source - Remote.

5. In the Choose Web Service dialog box, choose LDAP IDS.

6. Configure the authentication source as described in the online help.

Stay logged in to the portal with the LDAP IDS folder open for the next procedure.

Creating a Remote Profile Source

Create a remote profile source to import users' profile information from LDAP. To create a remove profile source, in the LDAP IDS folder of the portal's Administrative Object Directory:

1. From the Create Object menu, choose Profile Source - Remote.

2. In the Choose Web Service dialog box, choose LDAP IDS.

3. Configure the profile source as described in the online help.

Creating a Job

To import users, groups, or users' profile information, you must associate the authentication source or profile source with a job and run the job. To create and run a job, perform the following steps in the Oracle WebCenter Interaction Identity Service for LDAP folder of the portal's Administrative Object Directory:

1. From the Create Object menu, select Job.

2. Click Add Operation.

3. Choose the authentication source or profile source that you created.

4. Choose the scheduling values for the job and click Finish.

5. Name the job and click OK.

6. When you are finished creating the job, make sure the Oracle WebCenter Interaction Identity Service for LDAP folder is associated with an automation service. For assistance, see the online help under Select Utilities, then Automation Service.

Advanced Configuration

This section describes the following optional advanced procedures for LDAP configuration:

• Configuring Logging

• Configuring Application Server Session Settings

• Configuring LDAP Server Settings

• Using Oracle WebCenter Interaction Identity Service for LDAP over SSL

Configuring Logging

The ldapws.war file includes the log4j.properties file. The log4j.properties controls the logging settings for the application. You can open the log4j.properties file and edit it within the ldapws.war file.

There are two appenders defined:

• A1 is for the authentication source log

• A2 is for the profile source log

The default settings for the parameters in this file should be sufficient but there are several settings that you can change:

Table D-1 Logging Settings

Files	Function
Append	Determines whether writes to the log file are appended at the end of the file, or if the file is overwritten. This should be set to true.
MaxFileSize	Specifies the maximum size a log file can be before it is rolled over into a new file if the appender is a RollingFileAppender. If you choose to roll over based on the date, the MaxFileSize setting does not take effect.
MaxBackupIndex	Sets the number of rolled-over files that are saved. The number of roll-over files you set for the MaxBackupIndex value depends on how much disk space you choose to devote to log files.
DatePattern	Determines the basis on which files are rolled over if the appender is a DailyRollingFileAppender. YYY-mm means the file is rolled over once a month. YYYY-mm-dd means the file is rolled over ever day. YYYY-mm-dd-HH rolls over every hour and so forth.
RollingFileAppender	If several synchronization jobs are run once a day use the RollingFileAppender so that the individual log files do not grow excessively large.
DailyRollingFIleAppender	In changing the DailyRollingFileAppender from RollingFileAppender, the MaxFileSize setting is ignored. This enables you to set the type of appender to either rollover based on date or size. If you use a DailyRollingFileAppender then you must look at the average size of the log created by a single synchronization run to determine what the total disk space is. If synchronizations are run once a week, then setting MaxBackupIndex to 10 provides approximately two months of job histories.

Configuring Application Server Session Settings

Within the ldapws.war file there is a web.xml file that includes settings for the application session. You can open this file and edit it within the ldapws.war file.

During large synchronizations, the portal must create database objects for all the users and groups returned by the Oracle WebCenter Interaction Identity Service for LDAP. This might cause session timeouts between the calls to GetGroups, GetUsers, and GetMembers.

You can avoid this timeout error by increasing the session-timeout value in the session-config object of web.xml.

Configuring LDAP Server Settings

LDAP servers allow you to set the maximum return size of a query result as well as the time limit for a query. If the Oracle WebCenter Interaction Identity Service for LDAP log file ever indicates a SizeLimitExceeded or TimeLimitExceeded error it is most likely that you must adjust these values on the LDAP server. Different LDAP server administration consoles have these settings in different locations and you should contact your LDAP system administrator if you have questions about the location of the settings.

Using Oracle WebCenter Interaction Identity Service for LDAP over SSL

to use the Oracle WebCenter Interaction Identity Service for LDAP over SSL there are two connections you must secure. This section includes the following topics:

• Setting Up SSL Between the Portal and the Remote Server

• Setting Up SSL Between the Remote Server and the LDAP Server

Setting Up SSL Between the Portal and the Remote Server

to connect to the Oracle WebCenter Interaction Identity Service for LDAP from the portal over SSL, you must connect to the remote server on an SSL port and import its trusted certificate.

From a Web browser on the portal server navigate to: https://remote_server:app_server_ssl_port.

If the computer hosting the portal does not already have a certificate from the remote server it prompts you with a Security Alert. Choose to view the certificate and install it to the Trusted Root Certification Authorities store.

When running the installer for Oracle WebCenter Interaction Identity Service for LDAP, choose https protocol and enter the SSL port for the application server. In the portal, when you configure the remote server object, use https and the SSL port.

Setting Up SSL Between the Remote Server and the LDAP Server

To connect to the LDAP server over SSL, import the certificate for the LDAP server into the cacerts file in the jre of the application server.

1. From a Web browser on the remote server navigate to: https://ldap_server:ldap_ssl_port. You should be prompted with a Security Alert.

2. Choose to view the certificate and import it.

3. Click Tools, then Internet Options.

4. Select the Content tab and click Certificates.

5. Find the certificate for the LDAP server that you just imported and choose to export it as a DER encoded binary. Export it to the APP_SERVER_JAVA_HOME/jre/lib/security folder.

6. Use the java keytool to import this certificate to the cacerts file at APP_SERVER_JAVA_HOME/jre/lib/security.

   For instructions on using the keytool refer to the SunJava documentation.

   When you create the authentication source in the portal, enter 2 as the Security Mode. The standard SSL port is 636. If your LDAP server is using a different SSL port, enter this in the Alternate Port box.