Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

What's New in This Guide?

• New Features for 11g Release 2 (11.1.2)

Part I Understanding Oracle Privileged Account Manager

1 Understanding Oracle Privileged Account Manager

• 1.1 What is Oracle Privileged Account Manager?
• 1.2 Why Use Oracle Privileged Account Manager?
  • 1.2.1 Features
  • 1.2.2 Functionality
  • 1.2.3 Architecture and Topology
  • 1.2.4 Oracle Privileged Account Manager-Managed CSF Credentials
    • 1.2.4.1 Provisioning
    • 1.2.4.2 Lifecycle Management
    • 1.2.4.3 Application Consumption
• 1.3 How Oracle Privileged Account Manager is Deployed in Oracle Fusion Middleware

2 Understanding Oracle Privileged Account Manager Security

• 2.1 Overview
• 2.2 Understanding Oracle Privileged Account Manager Authentication
  • 2.2.1 Authentication for the Oracle Privileged Account Manager Graphical User Interface
  • 2.2.2 Authentication for the Oracle Privileged Account Manager Server
• 2.3 Understanding Oracle Privileged Account Manager Authorization
  • 2.3.1 Administration Role Types
  • 2.3.2 End Users
• 2.4 Securing Oracle Privileged Account Manager
  • 2.4.1 Securing the Network Channel
    • 2.4.1.1 Connecting to Target Systems
    • 2.4.1.2 Securing the End User Interface
  • 2.4.2 Securing Shared Accounts
    • 2.4.2.1 What is a Shared Account?
    • 2.4.2.2 Security Limitations
    • 2.4.2.3 How to Secure the Account
  • 2.4.3 Enabling Password Resets
  • 2.4.4 Avoiding Assignments through Multiple Paths
  • 2.4.5 Defining Richer Password Policies

Part II Basic Administration

3 Getting Started with Administering Oracle Privileged Account Manager

• 3.1 Getting Started after Installing 11g Release 2 (11.1.2)
• 3.2 Deploying ICF Connectors in Oracle Privileged Account Manager
  • 3.2.1 About ICF Connectors
  • 3.2.2 Locating the Oracle Privileged Account Manager Connector Bundles
  • 3.2.3 Consuming ICF Connectors
  • 3.2.4 Adding New Connectors to an Existing Oracle Privileged Account Manager Installation
    • 3.2.4.1 Adding Connectors Supplied by Oracle
    • 3.2.4.2 Adding Custom Connectors
• 3.3 Starting Oracle Privileged Account Manager
  • 3.3.1 Starting WebLogic
  • 3.3.2 Configuring SSL Communication in Oracle Privileged Account Manager
  • 3.3.3 Assigning the Application Configurator Role to a User
  • 3.3.4 Invoking Oracle Privileged Account Manager's Web-Based Console
• 3.4 Navigating Oracle Privileged Account Manager's Console
  • 3.4.1 Working with the Home Accordion
  • 3.4.2 Working with the Reports Accordion
  • 3.4.3 Working with the Administration Accordion
  • 3.4.4 Working with the Search Portlet
  • 3.4.5 Working with a Search Results Table

4 Adding and Managing an Oracle Privileged Account Manager Server

• 4.1 Overview
• 4.2 Before You Begin
• 4.3 Configuring an External Identity Store for Oracle Privileged Account Manager
  • 4.3.1 Configuring the External Identity Store
  • 4.3.2 Configuring Enterprise Roles
• 4.4 Managing an Oracle Privileged Account Manager Server
  • 4.4.1 Configuring a Connection to the Oracle Privileged Account Manager Server
  • 4.4.2 Managing Oracle Privileged Account Manager Server Properties

5 Configuring and Managing Oracle Privileged Account Manager

• 5.1 Administering Oracle Privileged Account Manager
  • 5.1.1 Working with Policies
    • 5.1.1.1 Policies Overview
    • 5.1.1.2 Viewing Policies
    • 5.1.1.3 Modifying the Default Password Policy
    • 5.1.1.4 Modifying the Default Usage Policy
    • 5.1.1.5 Creating a Password Policy
    • 5.1.1.6 Creating a Usage Policy
    • 5.1.1.7 Searching for Policies
    • 5.1.1.8 Assigning Policies
    • 5.1.1.9 Deleting Policies
  • 5.1.2 Working with Targets
    • 5.1.2.1 What Are Targets?
    • 5.1.2.2 Adding Targets to Oracle Privileged Account Manager
    • 5.1.2.3 Searching for Targets
    • 5.1.2.4 Opening a Target
    • 5.1.2.5 Removing Targets from Oracle Privileged Account Manager
  • 5.1.3 Working with Privileged Accounts
    • 5.1.3.1 What is a Privileged Account?
    • 5.1.3.2 Adding Privileged Accounts into Oracle Privileged Account Manager
    • 5.1.3.3 Searching for Privileged Accounts
    • 5.1.3.4 Opening an Account
    • 5.1.3.5 Managing Account Passwords
    • 5.1.3.6 Checking Out Accounts
    • 5.1.3.7 Checking In Accounts
    • 5.1.3.8 Removing Privileged Accounts from Oracle Privileged Account Manager
  • 5.1.4 Working with Grantees
    • 5.1.4.1 What Are Grantees?
    • 5.1.4.2 Granting Accounts to Users
    • 5.1.4.3 Granting Accounts to Groups
    • 5.1.4.4 Searching for Grantees
    • 5.1.4.5 Opening a Grantee
    • 5.1.4.6 Removing Grantees from an Account
  • 5.1.5 Working with Reports
    • 5.1.5.1 Working with Deployment Reports
    • 5.1.5.2 Working with Usage Reports
    • 5.1.5.3 Working with Failure Reports
• 5.2 Working with Self-Service
  • 5.2.1 Self-Service Workflow
  • 5.2.2 Searching for Accounts
  • 5.2.3 Checking Accounts Out and In
  • 5.2.4 Viewing Checked-Out Accounts
• 5.3 Moving from a Test Environment to a Production Environment

6 Managing Oracle Privileged Account Manager Auditing and Logging

• 6.1 Understanding Oracle Privileged Account Manager Auditing
  • 6.1.1 Configuring Auditing in Oracle Privileged Account Manager
    • 6.1.1.1 Configuring File-Based Auditing in Oracle Privileged Account Manager
    • 6.1.1.2 Configuring Database-Based Auditing in Oracle Privileged Account Manager
    • 6.1.1.3 Deploying Oracle Privileged Account Manager Audit Reports in BI Publisher
    • 6.1.1.4 Setting the Audit Logging Levels
  • 6.1.2 Understanding Oracle Privileged Account Manager Audit Reports
• 6.2 Understanding Oracle Privileged Account Manager Logging
  • 6.2.1 Configuring Basic Logging
  • 6.2.2 Example Logging Data

Part III Advanced Administration

7 Configuring Oracle Privileged Account Manager for Integrated Solutions

• 7.1 Integrating with Oracle Identity Manager
  • 7.1.1 Overview
  • 7.1.2 Configuring Oracle Privileged Account Manager for the Integration
  • 7.1.3 Integrating the Oracle Identity Manager Core
  • 7.1.4 Configuring an Oracle Identity Manager Administrator
  • 7.1.5 Managing Oracle Identity Manager Workflows
• 7.2 Integrating with Oracle Access Management Access Manager
  • 7.2.1 Before You Begin
  • 7.2.2 Enabling Single Sign-On
    • 7.2.2.1 Configure a New Resource for the Agent
    • 7.2.2.2 Configure Oracle HTTP Server for the Access Manager Domain
    • 7.2.2.3 Add New Identity Providers
    • 7.2.2.4 Configure Access to Multiple Applications

Part IV Appendixes

A Working with the Command Line Tool

• A.1 Launching the Command Line Tool
• A.2 Oracle Privileged Account Manager Commands
  • A.2.1 Issuing Commands
  • A.2.2 addaccount Command
  • A.2.3 addtarget Command
  • A.2.4 checkin and checkout Commands
  • A.2.5 displayallaccounts Command
  • A.2.6 displayallgroups Command
  • A.2.7 displayalltargets Command
  • A.2.8 displayallusers Command
  • A.2.9 displaycheckedoutaccounts Command
  • A.2.10 displaydomaintree Command
  • A.2.11 displaytargettypetree Command
  • A.2.12 export and import Commands
  • A.2.13 getglobalconfig Command
  • A.2.14 grantgroupaccess Command
  • A.2.15 grantuseraccess Command
  • A.2.16 modifyglobalconfig Command
  • A.2.17 removeaccount Command
  • A.2.18 removegroupaccess Command
  • A.2.19 removetarget Command
  • A.2.20 removeuseraccess Command
  • A.2.21 resetpassword Command
  • A.2.22 retrieveaccount Command
  • A.2.23 retrievegrantees Command
  • A.2.24 retrievegroup Command
  • A.2.25 retrievetarget Command
  • A.2.26 retrieveuser Command
  • A.2.27 searchaccount Command
  • A.2.28 searchgroup Command
  • A.2.29 searchtarget Command
  • A.2.30 searchuser Command
  • A.2.31 showpassword Command

B Working with Oracle Privileged Account Manager's RESTful Interface

• B.1 Target Resource
  • B.1.1 Get Target Attributes
  • B.1.2 Add a Target
  • B.1.3 Verify a Target
  • B.1.4 Retrieve a Target
  • B.1.5 Update a Target
  • B.1.6 Remove a Target
  • B.1.7 Search for Targets
  • B.1.8 Get Available Accounts
  • B.1.9 Retrieve Accounts Registered on a Target
  • B.1.10 Get Target Types
• B.2 Account Resource
  • B.2.1 Add an Account to a Target
  • B.2.2 Verify an Account
  • B.2.3 Retrieve an Account
  • B.2.4 Reset Password
  • B.2.5 Update an Account
  • B.2.6 Remove an Account
  • B.2.7 Grant a User/Role Access to an Account
  • B.2.8 Remove a User's/Role's Access to an Account
  • B.2.9 Retrieve Grantees on an Account
  • B.2.10 Check Out an Account
  • B.2.11 Check In an Account
  • B.2.12 Retrieve Users Who Checked Out an Account
  • B.2.13 Show Password
• B.3 UI Resource
  • B.3.1 Search Accounts
  • B.3.2 Get All Checked Out Accounts
• B.4 User Resource
  • B.4.1 Get a User
  • B.4.2 Search Users
  • B.4.3 Advanced Search for Users
• B.5 Group Resource
  • B.5.1 Get Group
  • B.5.2 Search Groups
  • B.5.3 Advanced Search for Groups
• B.6 Usage Policy Resource
  • B.6.1 Create a Usage Policy
  • B.6.2 Retrieve a Usage Policy
  • B.6.3 Update a Usage Policy
  • B.6.4 Delete a Usage Policy
• B.7 Password Policy Resource
  • B.7.1 Create a Password Policy
  • B.7.2 Retrieve a Password Policy
  • B.7.3 Delete a Password Policy
  • B.7.4 Update a Password Policy
• B.8 Policy Resource
  • B.8.1 Search for Policies
  • B.8.2 Get Default Policies

C Troubleshooting Oracle Privileged Account Manager

• C.1 Common Problems and Solutions
  • C.1.1 Console Cannot Connect to Oracle Privileged Account Manager Server
  • C.1.2 Console Changes Are Not Reflected in Other, Open Pages
  • C.1.3 Cannot Access Targets or Accounts
  • C.1.4 Cannot Add Database Targets
    • C.1.4.1 Cannot Connect to Oracle Database with sysdba Role
    • C.1.4.2 Cannot Find Special Options for Adding a Database Target
  • C.1.5 Cannot Add an Active Directory LDAP Target
  • C.1.6 Grantee Cannot Perform a Checkout
  • C.1.7 Cannot View Roles from the Configured Remote ID Store
  • C.1.8 Group Membership Changes Are Not Immediately Reflected in Oracle Privileged Account Manager
  • C.1.9 Cannot Use Larger Key Sizes for Export/Import
• C.2 Diagnosing Oracle Privileged Account Manager Problems
  • C.2.1 Increase the Log Level
  • C.2.2 Examine Exceptions in the Logs
• C.3 Need More Help?

Glossary

Index