Skip Headers
Oracle® Fusion Middleware Integration Guide for Oracle Identity Management Suite
11g Release 2 (11.1.2)

Part Number E27123-03
Go to Documentation Home
Home
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

2 Using the idmConfigTool Command

The IdM configuration tool (idmConfigTool) supports a number of tasks to assist in installing, configuring, and integrating Oracle identity management (IdM) components.

This chapter contains these sections:

2.1 About the Tool

This section contains these topics:

2.1.1 When to Use the Tool

Use idmConfigTool in these situations:

  • prior to installing Oracle Identity Manager and Oracle Access Management Access Manager,

  • after installing Oracle Identity Manager and Oracle Access Management Access Manager,

  • to dump the configuration of IdM components Oracle Internet Directory, Oracle Virtual Directory, Oracle Identity Manager, and Oracle Access Manager, and

  • to validate the configuration parameters for Oracle Internet Directory, Oracle Virtual Directory, Oracle Identity Manager, and Oracle Access Manager.

Section 2.1.2 explains the tasks the tool performs in each situation.

2.1.2 Tasks performed by the Tool

idmConfigTool helps you to perform the following tasks efficiently:

  • Validating configuration properties representing the Identity Management components Oracle Internet Directory (OID), Oracle Virtual Directory (OVD), Oracle Access Management Access Manager (OAM-AM) and Oracle Identity Manager (OIM).

  • Pre-configuring the Identity Store components (Oracle Internet Directory and Oracle Virtual Directory) to install the other Identity Management components, including Access Manager and Oracle Identity Manager.

  • Post-configuring the Access Manager, Oracle Identity Manager components and wiring of Access Manager and Oracle Identity Manager.

  • Extracting the configuration of the Identity Management components Oracle Internet Directory, Oracle Virtual Directory, Access Manager and Oracle Identity Manager.

See Also:

Section 2.3.1.

2.1.3 Components Supported by the Tool

idmConfigTool supports these component versions:

  • Oracle Internet Directory 11g

  • Oracle Virtual Directory 11g

  • Oracle Access Management Access Manager 11g

  • Oracle Access Manager 10g

  • Oracle Identity Manager 11g

  • Oracle Unified Directory (OUD) 11g

2.1.4 Location

idmConfigTool is located at:

IAM_ORACLE_HOME/idmtools/bin

2.1.5 Webgate Types Supported

idmConfigTool supports Access Manager 11g Webgates by default. It also supports 10g Webgates.

2.1.6 Single- and Cross-Domain Scenarios

The tool supports two types of scenarios with regard to Weblogic domains:

  • A single-domain configuration in which both Access Manager and Oracle Identity Manager servers are configured in the same Weblogic domain

  • A dual or cross-domain configuration in which Access Manager and Oracle Identity Manager servers are configured on separate Weblogic domains

See Also:

Section 1.2 for architecture details.

2.2 Set Up Environment Variables

You must configure the environment before running the IdM configuration tool.

Set the following variables:

Variable Set to

MW_HOME

Set the value to the full path of the installation's Middleware home.

JAVA_HOME

Ensure that the value contains the following directory:

MW_HOME/jdkn

IDM_HOME

IDM_ORACLE_HOME, where Oracle Internet Directory is installed (optional)

ORACLE_HOME

Set to the full path of the Oracle home. For IdM integrations, set to IAM_ORACLE_HOME.


2.3 Syntax and Usage

This section contains these topics:

2.3.1 Command Syntax

The tool has the following syntax on Linux:

idmConfigTool.sh -command  

input_file=filename log_file=logfileName log_level=log_level

The tool has the following syntax on Windows:

idmConfigTool.bat -command  input_file=filename log_file=logfileName 

log_level=log_level

Values for command are as follows:

Command Component name Description

preConfigIDStore

Identity Store

Configures the identity store and policy store by creating the groups and setting ACIs to the various containers.

prepareIDStore
   OAM
   OIM
   WLS
   FUSION
   OAAM
   all

Identity Store

Configures the identity store by adding necessary users and associating users with groups. Modes enable you to configure for a specific component.

configPolicyStore

Policy Store

Configures policy store by creating read-write user and associates them to the groups.

configOAM

Oracle Access Manager

Oracle Identity Manager

Prepares Access Manager for integration with Oracle Identity Manager.

configOIM

Oracle Access Manager

Oracle Identity Manager

Sets up wiring between Access Manager and Oracle Identity Manager.

configOVD

Oracle Virtual Directory

Creates Oracle Virtual Directory adapters.

disableOVDAccessConfig

Oracle Virtual Directory

Disables anonymous access to the Oracle Virtual Directory server. Post-upgrade command. Note: configOVD performs this task automatically when run.

postProvConfig

Identity Store

Performs post-provisioning configuration of the identity store.

validate
   IDSTORE
   POLICYSTORE
   OAM11g
   OAM10g
   OIM

Various

Validates the set of input properties for the named entity.

ovdConfigUpgrade

Oracle Virtual Directory

Updates the configuration for an upgraded Oracle Virtual Directory with split profile.

upgradeLDAPUsersForSSO

Oracle Identity Manager

Access Manager

Updates existing users in Oracle Internet Directory by adding certain object classes which are needed for Oracle Identity Manager-Access Manager integration.

upgradeOIMTo11gWebgate

Oracle Identity Manager

Access Manager

Upgrades an existing configuration consisting of integrated Oracle Identity Manager-Access Manager, using Webgate 10g, to use Webgate 11g


2.3.2 Requirements

You must run this tool as a user with administrative privileges when configuring the identity store or the policy store.

The validate command requires a component name.

2.3.3 Generated Files

idmConfigTool creates or updates certain files upon execution.

Parameter File

When you run the idmConfigTool, the tool creates or appends to the file idmDomainConfig.param. This file is generated in the directory from which you run the tool. To ensure that the same file is appended to each time the tool is run, always run idmConfigTool from the directory:

IAM_ORACLE_HOME/idmtools/bin

Log File

You can specify a log file using the log_file attribute of idmConfigTool.

If you do not explicitly specify a log file, a file named automation.log is created in the directory where you run the tool.

Check the log file for any errors or warnings and correct them.

2.3.4 Using the Properties File

This section describes the properties file that can be used with idmConfigTool.

2.3.4.1 About the properties File

A properties file provides a convenient way to specify command properties and enable you to save properties for reference and later use. You can specify a properties file, containing execution properties, as input command options. The properties file is a simple text file which must be available at the time the command is executed.

It is not necessary to provide password-related properties in the properties file. Indeed, for security you are advised not to insert passwords into the properties file. When passwords are not provided, the tool prompts for the relevant properties at execution.

2.3.4.2 List of Properties

Table 2-1 lists the properties used for integration command options in the idmConfigTool command. The properties are listed in alphabetical order.

Table 2-1 Properties Used in IdM Configtool properties Files

Parameter Example Value Description

ACCESS_GATE_ID

IdentityManagerAccessGate

The Access Manager access gate ID with which Oracle Identity Manager needs to communicate.

ACCESS_SERVER_HOST

mynode.us.example.com

Access Manager Access Server hostname

ACCESS_SERVER_PORT

5575

Access Manager NAP port.

AUTOLOGINURI

/obrar.cgi

URI required by OPSS. Default value is /obrar.cgi

COOKIE_DOMAIN

.us.example.com

Web domain on which the Oracle Identity Manager application resides. Specify the domain in the format .cc.example.com.

COOKIE_EXPIRY_INTERVAL

-1

Cookie expiration period. Set to -1.

DOMAIN_LOCATION

ORACLE_BASE
/admin/IDMDomain/aserver/IDMDomain

The location of the Oracle Identity Manager domain.

DOMAIN_NAME

IDM_Domain

The Oracle Identity Manager domain name.

IDSTORE_ADMIN_PORT

4321

The admin port for an Oracle Unified Directory (OUD) identity store.

IDSTORE_HOST

idstore.example.com

Host name of the LDAP identity store directory (corresponding to the IDSTORE_DIRECTORYTYPE).

IDSTORE_PORT

4321

Port number of the LDAP identity store (corresponding to the IDSTORE_DIRECTORYTYPE).

IDSTORE_BINDDN

cn=orcladmin

Administrative user in the identity store.

IDSTORE_PASSWORD

 

Password for the identity store bind DN.

IDSTORE_USERNAMEATTRIBUTE

cn

Username attribute used to set and search for users in the identity store.

IDSTORE_LOGINATTRIBUTE

uid

The login attribute of the identity store which contains the user's login name.

IDSTORE_USERSEARCHBASE

cn=Users,dc=us,dc=example,dc=com

The location in the directory where users are stored.

IDSTORE_SEARCHBASE

dc=us,dc=example,dc=com

Search base for users and groups contained in the identity store.

IDSTORE_GROUPSEARCHBASE

cn=Groups,dc=us,dc=example,dc=com

The location in the directory where groups are stored.

IDSTORE_OAMSOFTWAREUSER

oamLDAP

The username used to establish the Access Manager identity store connection.

IDSTORE_OAMADMINUSER

oamadmin

The identity store administrator for Access Manager. Required only if the identity store is set as the system identity store.

IDSTORE_OAAMADMINUSER

oaamadmin

The identity store administrator for Oracle Adaptive Access Manager.

IDSTORE_SYSTEMIDBASE

cn=system, dc=test

Base for all the system users.

IDSTORE_READONLYUSER

 

User with read-only permissions to the identity store.

IDSTORE_READWRITEUSER

 

User with read-write permissions to the identity store.

IDSTORE_SUPERUSER

 

The Oracle Fusion Applications superuser in the identity store.

IDSTORE_XELSYSADMINUSER

 

The administrator of the xelsysadm system account.

IDSTORE_OIMADMINUSER

 

The identity store administrator for Oracle Identity Manager.

IDSTORE_OIMADMINGROUP

 

The Oracle Identity Manager administrator group.

IDSTORE_SSL_ENABLED

 

Whether SSL to the identity store is enabled.

Valid values: true | false

IDSTORE_KEYSTORE_FILE

 

Location of the keystore file containing identity store credentials. Required to establish an SSL connection to the identity store.

Applies to Oracle Unified Directory identity stores.

IDSTORE_KEYSTORE_PASSWORD

 

Password of the keystore file containing identity store credentials (IDSTORE_KEYSTORE_FILE). Required to establish an SSL connection to the identity store.

Applies to Oracle Unified Directory identity stores.

IDSTORE_NEW_SETUP

 

Used for identity store validation.

Used in Oracle Fusion Applications environment.

IDSTORE_DIRECTORYTYPE

OVD

Directory type of the identity store for which the authenticator must be created.

Set to OVD if you are using Oracle Virtual Directory server to connect to either Oracle Internet Directory or a non-OID directory.

Set it to OID if your identity store is in Oracle Internet Directory and you are accessing it directly rather than through Oracle Virtual Directory.

Set to OUD if your identity store is Oracle Unified Directory.

Valid values: OID, OVD, OUD

IDSTORE_ADMIN_USER

cn=systemids,dc=example,dc=com

The administrator of the identity store directory. Note that the entry must contain the complete LDAP DN of the user; the username alone is not sufficient.

IDSTORE_WLSADMINUSER

weblogic_idm

The identity store administrator for Oracle WebLogic Server

IDSTORE_WLSADMINGROUP

WLS Administrators

The identity store administrator group for Oracle WebLogic Server.

IDSTOR_PASSWD

 

Password of the identity store administrator.

IDSTORE_PWD_OAMSOFTWAREUSER

 

Password of the Access Manager software user in the identity store.

IDSTORE_PWD_OAMADMINUSER

 

Password of the Access Manager user identified as IDSTORE_OAMSOFTWAREUSER.

IDSTORE_PWD_XELSYSADMINUSER

 

Password of the XELSYSADMIN user in the identity store.

IDSTORE_PWD_WEBLOGICADMINUSER

 

Password of the WebLogic administrator in the identity store.

IDSTORE_PWD_OAAMADMINUSER

 

Password of the OAAM administrator in the identity store.

LDAPn_HOST

.

The hostname of the LDAP server

LDAPn_PORT

 

The LDAP server port number.

LDAPn_BINDDN

.

The bind DN for the LDAP server

LDAPn_PASSWORD

 

The LDAP server password.

LDAPn_SSL

 

Indicates whether the connection to the LDAP server is over SSL.

Valid values are True or False

LDAPn_BASE

 

The base DN of the LDAP server.

LDAPn_OVD_BASE

 

The OVD base DN of the LDAP server.

LDAPn_TYPE

 

The directory type for the LDAP server. n is 1, 2, and so on. For a single-node configuration specify LDAP1.

LOGINURI

/${app.context}/adfAuthentication

URI required by OPSS. Default value is /${app.context}/adfAuthentication

LOGOUTURI

/oamsso/logout.html

URI required by OPSS. Default value is /oamsso/logout.html

MDS_DB_URL

jdbc:oracle:thin:@DBHOST:1521:SID

URL of the MDS database.

MDS_DB_SCHEMA_USERNAME

edg_mds

Username of the MDS schema user.

OAM_SERVER_VERSION

10g

Required when Access Manager server does not support 11g webgate in Oracle Identity Manager-Access Manager integration. In that case, provide the value as '10g'.

Valid values are 10g, 11g.

OAM_TRANSFER_MODE

SIMPLE

The transfer mode for the Access Manager agent being configured. If your access manager servers are configured to accept requests using the simple mode, set OAM_TRANSFER_MODE to SIMPLE.

Valid values are OPEN, SIMPLE or CERT.

OAM11G_OAM_SERVER_TRANSFER_MODE

OPEN

The security model in which the Access Manager 11g server functions.

Valid values: OPEN or SIMPLE.

OAM11G_SSO_ONLY_FLAG

 

Specifies whether Access Manager server can perform authorizations. If true, the Access Manager 11g server operates in authentication only mode, where all authorizations return true by default without any policy validations. If false, the server runs in default mode, where each authentication is followed by one or more authorization requests to the server.

Valid values: true (no authorization) | false

OAM11G_IDSTORE_ROLE_SECURITY_ADMIN

OAMAdministrators

Specifies the account to administer role security in identity store.

OAM11G_OIM_INTEGRATION_REQ

false

Specifies whether to integrate with Oracle Identity Manager or configure Access Manager in stand-alone mode. Set to true for integration.

Valid values: true (integration) | false

OAM11G_SERVER_LBR_HOST

sso.example.com

Hostname of the load balancer to the Oracle HTTP (OHS) server front-ending the Access Manager server.

OAM11G_SERVER_LBR_PORT

443

Port number of the load balancer to the OHS server front-ending the Access Manager server.

OAM11G_SERVER_LBR_PROTOCOL

https

Protocol of the load balancer to the OHS server front-ending the Access Manager server.

Valid values: HTTP, HTTPS

OAM11G_SERVER_LOGIN_ATTRIBUTE

uid

At a login attempt, the username is validated against this attribute in the identity store.

OAM11G_SERVER_GLOBAL_SESSION_TIMEOUT

 

The global session timeout for sessions in the Access Manager server.

OAM11G_SERVER_GLOBAL_SESSION_EXPIRY_TIME

 

Global session expiry time for a session in the Access Manager server.

OAM11G_SERVER_GLOBAL_MAX_SESSION_PER_USER

 

Global maximum sessions per user in the Access Manager server.

OAM11G_IDSTORE_NAME

 

The identity store name. If you already have an identity Store in place which you wish to reuse (rather than allowing the tool to create a new one for you), set this parameter to the name of the Identity Store.

The default value is "OAMIDStore".

OAM11G_IMPERSONATION_FLAG

 

Enable or disable impersonation in Access Manager server. Applicable to Oracle Fusion Applications environment.

Valid values: true (enable) | false

OAM11G_IDM_DOMAIN_OHS_HOST

sso.example.com

Host name of the load balancer which is in front of OHS.

OAM11G_IDM_DOMAIN_OHS_PORT

443

Port number on which the load balancer specified as OAM11G_IDM_DOMAIN_OHS_HOST listens.

OAM11G_IDM_DOMAIN_OHS_PROTOCOL

https

protocol for IDM OHS.

Valid values: HTTP | HTTPS

OAM11G_OIM_OHS_URL

https://sso.example.com:443/test

 

OAM11G_WG_DENY_ON_NOT_PROTECTED

true

Deny on protected flag for 10g webgate

Valid values: true | false

OAM11G_OAM_SERVER_TRANSFER_MODE

simple

Transfer mode for the IDM domain agent.

Valid values: OPEN | SIMPLE | CERT

OAM11G_IDM_DOMAIN_LOGOUT_URLS

/console/jsp/common/logout.jsp,/em/targetauth/emaslogout.jsp

Comma-separated list of Access Manager logout URLs.

OAM11G_IDM_DOMAIN_WEBGATE_PASSWD

 

The Access Manager domain WebGate password.

OAM11G_OIM_WEBGATE_PASSWD

 

The password of the Oracle Identity Manager Webgate.

OAM11G_WLS_ADMIN_HOST

myhost.example.com

Host name of the Access Manager domain admin server.

OAM11G_WLS_ADMIN_PORT

7001

Port on which the Access Manager domain admin server is running.

OAM11G_WLS_ADMIN_USER

wlsadmin

The username of the Access Manager domain administrator.

OIM_FRONT_END_HOST

host123.example.com

The hostname of the LBR server front-ending Oracle Identity Manager.

OIM_FRONT_END_PORT

7011

The port number of the LBR server front-ending Oracle Identity Manager.

OIM_MANAGED_SERVER_NAME

WLS_OIM1

The name of the Oracle Identity Manager managed server. If clustered, any of the managed servers can be specified.

OIM_MANAGED_SERVER_HOST

 

The hostname of the Oracle Identity Manager managed server.

OIM_MANAGED_SERVER_PORT

 

The port number of the Oracle Identity Manager managed server.

OIM_T3_HOST

 

The hostname for the Oracle Identity Manager T3 server.

OIM_T3_PORT

 

The port number of the Oracle Identity Manager T3 server.

OVD_HOST

 

OVD Server hostname

OVD_PORT

 

OVD Server port number

OVD_BINDDN

 

OVD Server bind DN

OVD_PASSWORD

 

OVD Server password

OVD_SSL

 

Indicates whether the connection is over SSL.

Valid values are True or False

POLICYSTORE_SHARES_IDSTORE

true

Denotes whether the policy store and identity store share the directory. Always true in Release 11g.

Valid values: true, false

POLICYSTORE_HOST

mynode.us.example.com

The hostname of your policy store directory.

POLICYSTORE_PORT

1234

The port number of your policy store directory.

POLICYSTORE_BINDDN

cn=orcladmin

Administrative user in the policy store directory.

POLICYSTORE_SEARCHBASE

dc=example,dc=com

The location in the directory where users and groups are stored.

POLICYSTORE_SYSTEMIDBASE

cn=systemids, dc=example,dc=com

The read-only and read-write users for policy store are created in this location.

Default value is cn=systemids, policy_store_search_base

POLICYSTORE_READONLYUSER

PolStoreROUser

A user with read privileges in the policy store.

POLICYSTORE_READWRITEUSER

PolStoreRWUser

A user with read and write privileges in the policy store.

POLICYSTORE_CONTAINER

cn=jpsroot

The name of the container used for OPSS policy information

POLICYSTORE_SSL_ENABLED

 

Whether the policy store is SSL-enabled.

POLICYSTORE_KEYSTORE_FILE

 

The location of the keystore file for an SSL-enabled policy store.

POLICYSTORE_KEYSTORE_PASSWORD

 

The password of the keystore file for an SSL-enabled policy store.

SPLIT_DOMAIN

true

Flag to force configOAM to create security providers in the domain against which it is run.

Valid values are true, false.

SSO_ENABLED_FLAG

false

Flag to determine if SSO should be enabled.

Valid values are true, false.

WEBGATE_TYPE

javaWebgate

The type of WebGate agent you want to create.

Set to ohsWebgate10g for configOAM and configOIM regardless of the WebGate version in use.

PRIMARY_OAM_SERVERS

idmhost1.example.com:5575,idmhost2.example.com:5575

A comma-separated list of your Access Manager servers and their proxy ports.

WLSHOST

node01.example.com

The WebLogic Server host name

WLSPORT

7001

The WebLogic Server port number

WLSADMIN

wlsadmin

The WebLogic Server administrator login

WLSPASSWD

 

The WebLogic Server administrator.


2.3.5 Using the Tool for OUD Identity Stores

This section explains additional tasks you may need to perform when using idmConfigTool for a target identity store which is an instance of Oracle Unified Directory (OUD). Topics include:

2.3.5.1 Creating the Global ACI for OUD

When you use idmConfigTool for an identity store that is an instance of OUD, the global ACI is not created. Consequently you must first grant access to the changelog, and then create the ACI. Take these steps:

  1. Create a file called mypassword which contains the password you use to connect to OUD.

  2. Remove the existing change log on one of the replicated OUD hosts. The command syntax is:

    ORACLE_INSTANCE/bin/dsconfig set-access-control-handler-prop \
    --remove \
    global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version 3.0;
    acl \"External changelog access\"; deny (all) userdn=\"ldap:///anyone\";)"
    --hostname OUD Host \
    --port OUD Admin Port \
    --trustAll ORACLE_INSTANCE/config/admin-truststore \
    --bindDN cn=oudadmin \
    --bindPasswordFile mypassword \
    --no-prompt
    

    For example:

    ORACLE_INSTANCE/bin/dsconfig set-access-control-handler-prop \
    --remove
    global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version 3.0;
    acl \"External changelog access\"; deny (all) userdn=\"ldap:///anyone\";)"
    --hostname OUDHOST1.example.com \
    --port 4444 \
    --trustAll /u01/app/oracle/admin/oud1/OUD/config/admin-truststore \
    --bindDN cn=oudadmin \
    --bindPasswordFile mypassword \
    --no-prompt
    
  3. Add the new ACI:

    dsconfig set-access-control-handler-prop \
    --add global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version
    3.0; acl \"External changelog access\"; allow
    (read,search,compare,add,write,delete,export)
    groupdn=\"ldap:///cn=oimAdminGroup,cn=groups,dc=example,dc=com\";)" \
    --hostname OUD Host \
    --port OUD Admin Port \
    --trustAll \
    --bindDN cn=oudadmin \
    --bindPasswordFile password
    --no-prompt
    

    For example:

    dsconfig set-access-control-handler-prop \
    --add
    --add global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version
    3.0; acl \"External changelog access\"; allow
    (read,search,compare,add,write,delete,export)
    groupdn=\"ldap:///cn=oimAdminGroup,cn=groups,dc=example,dc=com\";)" \
    --hostname OUDHOST1 \
    --port 4444 \
    --trustAll \
    --bindDN cn=oudadmin \
    --bindPasswordFile password
    --no-prompt
    
  4. Repeat Steps 1 through 3 for each OUD instance.

2.3.5.2 Creating Indexes on OUD Replicas

When idmConfigTool prepares the identity store, it creates a number of indexes on the data. However in a high availability (HA) environment that contains replicas, these replicas are not updated with the indexes and need to be added manually.

The steps are as follows (with LDAPHOST1.example.com representing the first OUD server, LDAPHOST2.example.com the second server, and so on):

  1. Create a file called mypassword which contains the password you use to connect to OUD.

  2. Configure the indexes on the second OUD server:

    ORACLE_INSTANCE/OUD/bin/ldapmodify -h LDAPHOST2.example.com -Z -X -p 4444
    -a -D "cn=oudadmin" -j mypassword -c -f
    /u01/app/oracle/product/fmw/iam/oam/server/oim-intg/ldif/ojd/schema/ojd_user_index_generic.ldif
    

    and

    ORACLE_INSTANCE/OUD/bin/ldapmodify -h LDAPHOST2.example.com -Z -X -p 4444
    -a -D "cn=oudadmin" -j  mypassword -c -f
    /u01/app/oracle/product/fmw/iam/idmtools/templates/oud/oud_indexes_extn.ldif
    

    Notes:

    • Repeat both commands for all OUD servers for which idmConfigTool was not run.

    • Execute the commands on one OUD instance at a time; that instance must be shut down while the commands are running.

  3. Rebuild the indexes on all the servers:

    ORACLE_INSTANCE/OUD/bin/bin/rebuild-index -h localhost -p 4444 -X -D
    "cn=oudadmin" -j mypassword --rebuildAll -b "dc=example,dc=com"
    

    Note:

    You must run this command on all OUD servers, including the first server (LDAPHOST1.example.com) for which idmConfigTool was run.

2.4 Command Options and Properties

This section lists the properties for each command option. Topics include:

Notes:

  • The command options show the command syntax on Linux only. See Section 2.3.1 for Windows syntax guidelines.

  • The tool prompts for passwords. For security, it is recommended that you do not specify password attributes in the properties file.

2.4.1 preConfigIDStore Command

Syntax

./idmConfigTool.sh -preConfigIDStore input_file=input_properties

Properties

Table 2-2 lists the properties for this mode:

Table 2-2 Properties of preConfigIDStore

Property Required?

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_BINDDN

YES

IDSTORE_LOGINATTRIBUTE

 

IDSTORE_USERNAMEATTRIBUTE

YES

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

IDSTORE_SEARCHBASE

YES

IDSTORE_SYSTEMIDBASE

 

POLICYSTORE_SHARES_IDSTORE

 

IDSTORE_ADMIN_PORT

YES (if target identity store is an instance of Oracle Unified Directory (OUD).)

IDSTORE_KEYSTORE_FILE

YES, if target identity store is Oracle Unified Directory.

Use the format:
oud_install_path
/OUD/config/admin-keystore

IDSTORE_KEYSTORE_PASSWORD

YES, if target identity store is Oracle Unified Directory.


Example properties File

Here is a sample properties file for this option:

IDSTORE_HOST : idstore.example.com
IDSTORE_PORT : 389
IDSTORE_BINDDN : cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com

2.4.2 prepareIDStore Command

Syntax

The prepareIDStore command takes mode as an argument to perform tasks for the specified component. The syntax for specifying the mode is:

./idmConfigTool.sh -prepareIDStore mode=mode
input_file=filename_with_Configproperties

where mode must be one of:

  • OAM

  • OIM

  • OAAM

  • WLS

  • FUSION

  • all (performs all the tasks of the above modes combined)

Note:

WLS mode must be run before OAM.

2.4.2.1 prepareIDStore mode=OAM

The following are created in this mode:

  • Perform schema extensions as required by the Access Manager component

  • Add the oblix schema

  • Create the OAMSoftware User

  • Create OblixAnonymous User

  • Optionally create the Access Manager Administration User

  • Associate these users to their respective groups

  • Create the group "orclFAOAMUserWritePrivilegeGroup"

Syntax

./idmConfigTool.sh -prepareIDStore mode=OAM
input_file=filename_with_Configproperties

Properties

Table 2-3 lists the properties for this mode:

Table 2-3 prepareIDStore mode=OAM Properties

Parameter Required?

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_BINDDN

YES

IDSTORE_USERNAMEATTRIBUTE

YES

IDSTORE_LOGINATTRIBUTE

 

OAM11G_IDSTORE_ROLE_SECURITY_ADMIN

 

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

IDSTORE_SEARCHBASE

YES

IDSTORE_OAMSOFTWAREUSER

 

IDSTORE_OAMADMINUSER

 

IDSTORE_SYSTEMIDBASE

 

IDSTORE_ADMIN_PORT

YES (if target identity store is an instance of Oracle Unified Directory (OUD).)


Example properties File

Here is a sample properties file for this option. This parameter set would result in OAMADMINUSER and OAMSOFTWARE user being created in the identity store:

IDSTORE_HOST : idstore.example.com
IDSTORE_PORT : 389
IDSTORE_BINDDN : cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
POLICYSTORE_SHARES_IDSTORE: true
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN:OAMAdministrators
IDSTORE_OAMSOFTWAREUSER:oamLDAP
IDSTORE_OAMADMINUSER:oamadmin
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com

2.4.2.2 prepareIDStore mode=OIM

The following are created in this mode:

  • Create Oracle Identity Manager Administration User under SystemID container

  • Create Oracle Identity Manager Administration Group

  • Add Oracle Identity Manager Administration User to Oracle Identity Manager Administration Group

  • Add ACIs to Oracle Identity Manager Administration Group

  • Create reserve container

  • Create xelsysadmin user

Syntax

./idmConfigTool.sh -prepareIDStore mode=OIM
input_file=filename_with_Configproperties

Properties

Table 2-4 lists the properties in this mode:

Table 2-4 prepareIDStore mode=OIM Properties

Parameter Required?

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_BINDDN

YES

IDSTORE_USERNAMEATTRIBUTE

YES

IDSTORE_LOGINATTRIBUTE

 

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

IDSTORE_SEARCHBASE

YES

IDSTORE_OIMADMINUSER

 

IDSTORE_OIMADMINGROUP

 

IDSTORE_SYSTEMIDBASE

 

IDSTORE_ADMIN_PORT

YES (if target identity store is an instance of Oracle Unified Directory (OUD).)


Example properties File

Here is a sample properties file for this option. With this set of properties, OIMADMINUSER is created in IDSTORE_SYSTEMIDBASE:

IDSTORE_HOST : idstore.example.com
IDSTORE_PORT : 389
IDSTORE_BINDDN : cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE:cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
POLICYSTORE_SHARES_IDSTORE: true
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com
IDSTORE_OIMADMINUSER: oimadmin
IDSTORE_OIMADMINGROUP:OIMAdministrators

2.4.2.3 prepareIDStore mode=OAAM

The following are created in this mode:

  • Create Oracle Adaptive Access Manager Administration User

  • Create Oracle Adaptive Access Manager Groups

  • Add the Oracle Adaptive Access Manager Administration User as a member of Oracle Adaptive Access Manager Groups

Syntax

./idmConfigTool.sh -prepareIDStore mode=OAAM
input_file=filename_with_Configproperties

Properties

Table 2-5 shows the properties in this mode:

Table 2-5 prepareIDStore mode=OAAM Properties

Parameter Required?

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_BINDDN

YES

IDSTORE_USERNAMEATTRIBUTE

 

IDSTORE_LOGINATTRIBUTE

 

IDSTORE_USERSEARCHBASE

 

IDSTORE_GROUPSEARCHBASE

 

IDSTORE_SEARCHBASE

 

IDSTORE_OAAMADMINUSER

YES

IDSTORE_ADMIN_PORT

YES (if target identity store is an instance of Oracle Unified Directory (OUD).)


2.4.2.4 prepareIDStore mode=WLS

The following are created in the WLS (Oracle WebLogic Server) mode:

  • Create Weblogic Administration User

  • Create Weblogic Administration Group

  • Add the Weblogic Administration User as a member of Weblogic Administration Group

Syntax

./idmConfigTool.sh -prepareIDStore mode=WLS
input_file=filename_with_Configproperties

Properties

Table 2-6 lists the properties in this mode:

Table 2-6 prepareIDStore mode=WLS Properties

Parameter Required?

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_BINDDN

YES

IDSTORE_USERNAMEATTRIBUTE

YES

IDSTORE_LOGINATTRIBUTE

 

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

IDSTORE_SEARCHBASE

YES

IDSTORE_WLSADMINUSER

YES

IDSTORE_WLSADMINGROUP

YES

IDSTORE_ADMIN_PORT

YES (if target identity store is an instance of Oracle Unified Directory (OUD).)


Example properties File

Here is a sample properties file for this option. With this set of properties, the IDM Administrators group is created.

IDSTORE_HOST: idstore.example.com
IDSTORE_PORT: 389
IDSTORE_BINDDN: cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users, dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
POLICYSTORE_SHARES_IDSTORE: true
IDSTORE_WLSADMINUSER: weblogic_idm
IDSTORE_WLSADMINGROUP: wlsadmingroup

2.4.2.5 prepareIDStore mode=fusion

The following actions are taken in this mode:.

  • Create a Readonly User

  • Create a ReadWrite User

  • Create a Super User

  • Add the readOnly user to the groups orclFAGroupReadPrivilegeGroup and orclFAUserWritePrefsPrivilegeGroup

  • Add the readWrite user to the groups orclFAUserWritePrivilegeGroup and orclFAGroupWritePrivilegeGroup

Syntax

./idmConfigTool.sh -prepareIDStore mode=fusion
input_file=filename_with_Configproperties

Properties

Table 2-7 lists the properties in this mode:

Table 2-7 prepareIDStore mode=fusion Properties

Parameter Required?

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_BINDDN

YES

IDSTORE_USERNAMEATTRIBUTE

YES

IDSTORE_LOGINATTRIBUTE

 

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

IDSTORE_SEARCHBASE

YES

IDSTORE_READONLYUSER

 

IDSTORE_READWRITEUSER

 

IDSTORE_SUPERUSER

 

IDSTORE_SYSTEMIDBASE

 

POLICYSTORE_SHARES_IDSTORE

 

IDSTORE_ADMIN_PORT

YES (if target identity store is an instance of Oracle Unified Directory (OUD).)


Example properties File

Here is a sample properties file for this option, which creates IDSTORE_SUPERUSER:

IDSTORE_HOST : idstore.example.com
IDSTORE_PORT : 389
IDSTORE_BINDDN : cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_READONLYUSER: IDROUser
IDSTORE_READWRITEUSER: IDRWUser
IDSTORE_USERSEARCHBASE:cn=Users,dc=example,dc=com 
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=mycomapny,dc=com
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com
IDSTORE_SUPERUSER: weblogic_fa
POLICYSTORE_SHARES_IDSTORE: true

2.4.2.6 prepareIDStore mode=all

The mode performs all the tasks that are performed in the modes OAM, OIM, WLS, OAAM, and FUSION.

Syntax

./idmConfigTool.sh -prepareIDStore mode=all
input_file=filename_with_Configproperties

Properties

Table 2-8 lists the properties in this mode:

Table 2-8 prepareIDStore mode=all Properties

Parameter Required?

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_BINDDN

YES

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

IDSTORE_LOGINATTRIBUTE

 

IDSTORE_SEARCHBASE

YES

IDSTORE_SYSTEMIDBASE

 

IDSTORE_READONLYUSER

 

IDSTORE_READWRITEUSER

 

IDSTORE_SUPERUSER

 

IDSTORE_OAMSOFTWAREUSER

 

IDSTORE_OAMADMINUSER

 

IDSTORE_OIMADMINUSER

 

IDSTORE_OIMADMINGROUP

 

IDSTORE_USERNAMEATTRIBUTE

YES

IDSTORE_OAAMADMINUSER

YES

IDSTORE_WLSADMINUSER

YES

IDSTORE_WLSADMINGROUP

YES

IDSTORE_ADMIN_PORT

YES (if target identity store is an instance of Oracle Unified Directory (OUD).)

OAM11G_IDSTORE_ROLE_SECURITY_ADMIN

 

POLICYSTORE_SHARES_IDSTORE

 

Example properties File

Here is a sample properties file for this option:

IDSTORE_HOST : node01.example.com
IDSTORE_PORT : 2345
IDSTORE_BINDDN: cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com
IDSTORE_READONLYUSER: IDROUser
IDSTORE_READWRITEUSER: IDRWUser
IDSTORE_SUPERUSER: weblogic_fa
IDSTORE_OAMSOFTWAREUSER:oamSoftwareUser
IDSTORE_OAMADMINUSER:oamAdminUser
IDSTORE_OIMADMINUSER: oimadminuser
POLICYSTORE_SHARES_IDSTORE: true
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN:OAMAdministrators
IDSTORE_OIMADMINGROUP: OIMAdministrators
IDSTORE_WLSADMINUSER: weblogic_idm
IDSTORE_WLSADMINGROUP: wlsadmingroup
IDSTORE_OAAMADMINUSER: oaamAdminUser

2.4.3 configPolicyStore Command

Syntax

./idmConfigTool.sh -configPolicyStore input_file=input_properties

Properties

Table 2-9 lists the command properties.

Table 2-9 Properties for ConfigPolicyStore

Property Required?

POLICYSTORE_HOST

YES

POLICYSTORE_PORT

YES

POLICYSTORE_BINDDN

YES

POLICYSTORE_SEARCHBASE

YES

POLICYSTORE_SYSTEMIDBASE

 

POLICYSTORE_READONLYUSER

 

POLICYSTORE_READWRITEUSER

 

POLICYSTORE_CONTAINER

YES


Example properties File

Here is a sample properties file for this option, which creates readonly user and writeonly user in the policy store:

POLICYSTORE_HOST: mynode.us.example.com
POLICYSTORE_PORT: 3060
POLICYSTORE_BINDDN: cn=orcladmin
POLICYSTORE_READONLYUSER: PolicyROUser
POLICYSTORE_READWRITEUSER: PolicyRWUser
POLICYSTORE_SEARCHBASE: dc=example,dc=com
POLICYSTORE_CONTAINER: cn=jpsroot

2.4.4 configOAM Command

Syntax

./idmConfigTool.sh -configOAM input_file=input_properties

Properties

Table 2-10 lists the command properties.

Table 2-10 Properties of configOAM

Property Required?

WLSHOST

YES

WLSPORT

YES

WLSADMIN

YES

IDSTORE_BINDDN

YES

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_DIRECTORYTYPE

 

IDSTORE_USERNAMEATTRIBUTE

 

IDSTORE_LOGINATTRIBUTE

 

IDSTORE_USERSEARCHBASE

YES

IDSTORE_SEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

IDSTORE_OAMSOFTWAREUSER

 

IDSTORE_OAMADMINUSER

 

IDSTORE_SYSTEMIDBASE

YES

PRIMARY_OAM_SERVERS

 

WEBGATE_TYPE

 

ACCESS_GATE_ID

 

OAM_TRANSFER_MODE

 

COOKIE_DOMAIN

 

COOKIE_EXPIRY_INTERVAL

 

OAM11G_WG_DENY_ON_NOT_PROTECTED

 

OAM11G_IDM_DOMAIN_OHS_HOST

 

OAM11G_IDM_DOMAIN_OHS_PORT

 

OAM11G_IDM_DOMAIN_OHS_PROTOCOL

 

OAM11G_OAM_SERVER_TRANSFER_MODE

 

OAM11G_IDM_DOMAIN_LOGOUT_URLS

 

OAM11G_OIM_WEBGATE_PASSWD

 

OAM11G_IDSTORE_ROLE_SECURITY_ADMIN

 

OAM11G_SSO_ONLY_FLAG

 

OAM11G_OIM_INTEGRATION_REQ

 

OAM11G_IMPERSONATION_FLAG

Oracle Fusion Applications only.

OAM11G_SERVER_LBR_HOST

 

OAM11G_SERVER_LBR_PORT

 

OAM11G_SERVER_LBR_PROTOCOL

 

OAM11G_SERVER_LOGIN_ATTRIBUTE

 

OAM11G_IDSTORE_NAME

YES

POLICYSTORE_SHARES_IDSTORE

 

SPLIT_DOMAIN

 

Note:

When you execute this command, the tool prompts you for:

  • Password of the identity store account to which you are connecting

  • Access Manager administrator password

  • Access Manager software user password

Example properties File

Here is a sample properties file for this option, which creates an entry for webgate in Access Manager:

WLSHOST: adminvhn.example.com
WLSPORT: 7001
WLSADMIN: weblogic
IDSTORE_HOST: idstore.example.com
IDSTORE_PORT: 389
IDSTORE_BINDDN: cn=orcladmin 
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_OAMSOFTWAREUSER: oamLDAP
IDSTORE_OAMADMINUSER: oamadmin
PRIMARY_OAM_SERVERS: oamhost1.example.com:5575,oamhost2.example.com:5575
WEBGATE_TYPE: ohsWebgate10g
ACCESS_GATE_ID: Webgate_IDM
OAM11G_IDM_DOMAIN_OHS_HOST:sso.example.com
OAM11G_IDM_DOMAIN_OHS_PORT:443
OAM11G_IDM_DOMAIN_OHS_PROTOCOL:https
OAM11G_OAM_SERVER_TRANSFER_MODE:simple
OAM11G_IDM_DOMAIN_LOGOUT_URLS: /console/jsp/common/logout.jsp,/em/targetauth/emaslogout.jsp
OAM11G_WG_DENY_ON_NOT_PROTECTED: false
OAM11G_SERVER_LOGIN_ATTRIBUTE: uid 
OAM_TRANSFER_MODE: simple
COOKIE_DOMAIN: .example.com
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN: OAMAdministrators
OAM11G_SSO_ONLY_FLAG: true
OAM11G_OIM_INTEGRATION_REQ: true or false
OAM11G_IMPERSONATION_FLAG:true
OAM11G_SERVER_LBR_HOST:sso.example.com
OAM11G_SERVER_LBR_PORT:443
OAM11G_SERVER_LBR_PROTOCOL:https
COOKIE_EXPIRY_INTERVAL: -1
OAM11G_OIM_OHS_URL:https://sso.example.com:443/
SPLIT_DOMAIN: true
OAM11G_IDSTORE_NAME: OAMIDStore
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com

2.4.5 configOIM Command

As of 11g Release 2 (11.1.2), configOIM supports 11g webgate by default. See the WEBGATE_TYPE option for details.

As indicated in the table, certain properties are required when Oracle Identity Manager and Access Manager are configured on different weblogic domains.

Syntax

./idmConfigTool.sh -configOIM input_file=input_file_with_path

Properties

Table 2-11 lists the command properties.

Table 2-11 Properties for configOIM

Property Required?

LOGINURI

required by Oracle Platform Security Services (OPSS).

LOGOUTURI

required by OPSS.

AUTOLOGINURI

required by OPSS.

ACCESS_SERVER_HOST

 

ACCESS_GATE_ID

 

ACCESS_SERVER_PORT

 

COOKIE_DOMAIN

 

COOKIE_EXPIRY_INTERVAL

 

WEBGATE_TYPE

 

OAM_TRANSFER_MODE

 

SSO_ENABLED_FLAG

 

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_BINDDN

YES

IDSTORE_DIRECTORYTYPE

 

IDSTORE_LOGINATTRIBUTE

 

IDSTORE_ADMIN_USER

 

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

MDS_DB_URL

 

MDS_DB_SCHEMA_USERNAME

 

WLSHOST

YES

WLSPORT

YES

WLSADMIN

YES

DOMAIN_NAME

 

DOMAIN_LOCATION

 

OIM_MANAGED_SERVER_NAME

 

OAM_SERVER_VERSION

Required only when Access Manager server does not support 11g webgate in Oracle Identity Manager-Access Manager integration. In that case, value should be provided as '10g'.

OAM11G_WLS_ADMIN_HOST

Required if Access Manager and Oracle Identity Manager servers are configured on different Weblogic domains (that is, a cross-domain setup)

OAM11G_WLS_ADMIN_PORT

Required if Access Manager and Oracle Identity Manager servers are configured on different Weblogic domains (that is, a cross-domain setup)

OAM11G_WLS_ADMIN_USER

Required if Access Manager and Oracle Identity Manager servers are configured on different Weblogic domains (that is, a cross-domain setup)


Example properties File

Here is a sample properties file for this option, which seeds the following keys in the credential store framework (CSF): SSOAccessKey, SSOKeystoreKey, SSOGlobalPP:

LOGINURI: /${app.context}/adfAuthentication
LOGOUTURI: /oamsso/logout.html
AUTOLOGINURI: None
ACCESS_SERVER_HOST: OAMHOST1.example.com
ACCESS_SERVER_PORT: 5575
ACCESS_GATE_ID: Webgate_IDM
COOKIE_DOMAIN: .example.com
COOKIE_EXPIRY_INTERVAL: -1
OAM_TRANSFER_MODE: simple
WEBGATE_TYPE: ohsWebgate10g
SSO_ENABLED_FLAG: true
IDSTORE_PORT: 389
IDSTORE_HOST: idstore.example.com
IDSTORE_DIRECTORYTYPE: OID 
IDSTORE_ADMIN_USER: cn=oamLDAP,cn=Users,dc=example,dc=com
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
MDS_DB_URL: jdbc:oracle:thin:DB Hostname:DB portno.:SID
MDS_DB_SCHEMA_USERNAME: edg_mds
WLSHOST: adminvhn.example.com
WLSPORT: 7001
WLSADMIN: weblogic
DOMAIN_NAME: IDMDomain
OIM_MANAGED_SERVER_NAME: WLS_OIM1
DOMAIN_LOCATION: ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain

2.4.6 postProvConfig Command

Syntax

./idmConfigTool.sh -postProvConfig input_file=postProvConfig.props

Properties

The properties for this command are the same as for the preConfigIDStore command.

Example properties File

Here is a sample properties file for this option:

IDSTORE_HOST: host01.example.com
IDSTORE_PORT: 3060
IDSTORE_BINDDN: cn=orcladmin
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_USERSEARCHBASE: cn=systemids,dc=example,dc=com
POLICYSTORE_CONTAINER: cn=FAPolicies
POLICYSTORE_HOST: host01.ca.example.com
POLICYSTORE_PORT: 3060
POLICYSTORE_BINDDN: cn=orcladmin
POLICYSTORE_READWRITEUSER: cn=PolicyRWUser,cn=systemids,dc=example,dc=com
OVD_HOST: host01.ca.example.com
OVD_PORT: 6501
OVD_BINDDN: cn=orcladmin
OIM_T3_URL : t3://host02.ca.example.com:14000
OIM_SYSTEM_ADMIN : abcdef

2.4.7 upgradeLDAPUsersForSSO Command

Syntax

idmConfigTool.sh -upgradeLDAPUsersForSSO input_file=input_Properties

Properties

Table 2-12 lists the command properties.

Table 2-12 Properties for upgradeLDAPUsersForSSO

Property Required?

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_ADMIN_USER

YES

IDSTORE_DIRECTORYTYPE

 

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

PASSWORD_EXPIRY_PERIOD

 

IDSTORE_LOGINATTRIBUTE

 

Example properties File

Here is a sample properties file for this option:

IDSTORE_HOST: idstore.example.com
IDSTORE_PORT: 389
IDSTORE_ADMIN_USER: cn=orcladmin
IDSTORE_DIRECTORYTYPE:OVD
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
PASSWORD_EXPIRY_PERIOD: 7300
IDSTORE_LOGINATTRIBUTE: uid

2.4.8 validate IDStore Command

Syntax

./idmConfigTool.sh -validate component=IDSTORE input_file=input_Properties

Properties

Table 2-13 lists the command properties.

Table 2-13 Properties for validate IDStore

Property Required?

IDSTORE_TYPE

 

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_SSLPORT

YES

IDSTORE_SSL_ENABLED

YES

IDSTORE_SUPER_USER

YES

IDSTORE_READWRITEUSER

YES

IDSTORE_READONLYUSER

YES

IDSTORE_USER_BASE

YES

IDSTORE_GROUP_BASE

YES

IDSTORE_SEEDING

 

IDSTORE_POST_VALIDATION

 

IDSTORE_ADMIN_GROUP

YES

IDSTORE_ADMIN_GROUP_EXISTS

 

Example properties File

Here is a sample properties file for this option:

idstore.type: OID
idstore.host: acb21005.us.example.com
idstore.port: 3030
idstore.sslport: 4140
idstore.ssl.enabled: false
idstore.super.user: cn=weblogic_fa,cn=systemids,dc=example,dc=com
idstore.readwrite.username: cn=IDRWUser,cn=systemids,dc=example,dc=com
idstore.readonly.username: cn=IDROUser,cn=systemids,dc=example,dc=com
idstore.user.base: cn=Users,dc=example,dc=com
idstore.group.base: cn=Groups,dc=example,dc=com
idstore.seeding: true
idstore.post.validation: false
idstore.admin.group: cn=IDM Administrators,cn=Groups,dc=example,dc=com
idstore.admin.group.exists: true

2.4.9 validate PolicyStore Command

Syntax

./idmConfigTool.sh -validate component=POLICYSTORE input_file=input_Properties

Properties

Table 2-14 lists the command properties.

Table 2-14 Properties for validate policystore

Property Required?

POLICYSTORE_HOST

YES

POLICYSTORE_PORT

YES

POLICYSTORE_SECURE_PORT

YES

POLICYSTORE_IS_SSL_ENABLED

 

POLICYSTORE_READ_WRITE_USERNAME

 

POLICYSTORE_SEEDING

 

POLICYSTORE_JPS_ROOT_NODE

 

POLICYSTORE_DOMAIN_NAME

YES

POLICYSTORE_CREATED_BY_CUSTOMER

 

POLICYSTORE_JPS_CONFIG_DIR

 

POLICYSTORE_CRED_MAPPING_FILE_LOCATION

 

POLICYSTORE_ADF_CRED_FILE_LOCATION

 

POLICYSTORE_STRIPE_FSCM

 

POLICYSTORE_STRIPE_CRM

 

POLICYSTORE_STRIPE_HCM

 

POLICYSTORE_STRIPE_SOA_INFRA

 

POLICYSTORE_STRIPE_APM

 

POLICYSTORE_STRIPE_ESSAPP

 

POLICYSTORE_STRIPE_B2BUI

 

POLICYSTORE_STRIPE_OBI

 

POLICYSTORE_STRIPE_WEBCENTER

 

POLICYSTORE_STRIPE_IDCCS

 

POLICYSTORE_CRED_STORE

 

IDM_KEYSTORE_FILE

 

Example properties File

Here is a sample properties file for this option:

POLICYSTORE_HOST: node0316.example.com
POLICYSTORE_PORT: 3067
POLICYSTORE_SECURE_PORT : 3110
POLICYSTORE_IS_SSL_ENABLED: FALSE
POLICYSTORE_READ_WRITE_USERNAME : cn=PolicyRWUser,cn=systemids,dc=example,dc=com
POLICYSTORE_SEEDING: true
POLICYSTORE_JPS_ROOT_NODE : cn=jpsroot
POLICYSTORE_DOMAIN_NAME: dc=example,dc=com

2.4.10 validate OAM Command (11g)

Syntax

./idmConfigTool.sh -validate component=OAM11g input_file=input_Properties

Note:

The tool prompts for the WebLogic administration server user password upon execution.

Properties

Table 2-15 lists the command properties.

Table 2-15 Properties for validate component=OAM11g

Property Required?

ADMIN_SERVER_HOST

YES

ADMIN_SERVER_PORT

YES

ADMIN_SERVER_USER

YES

IDSTORE_HOST

YES

IDSTORE_PORT

YES

IDSTORE_IS_SSL_ENABLED

 

OAM11G_ACCESS_SERVER_HOST

YES

OAM11G_ACCESS_SERVER_PORT

YES

OAM11G_IDSTORE_ROLE_SECURITY_ADMIN

 

OAM11G_OIM_INTEGRATION_REQ

 

OAM11G_OAM_ADMIN_USER

 

OAM11G_SSO_ONLY_FLAG

 

Example properties File

Here is a sample properties file for this option, which validates the Access Manager server:

admin_server_host: abc5411405.ca.example.com
admin_server_port: 17001
admin_server_user: weblogic
IDSTORE_HOST:abc5411405.ca.example.com
IDSTORE_PORT:3060
IDSTORE_IS_SSL_ENABLED:false
OAM11G_ACCESS_SERVER_HOST:abc5411405.ca.example.com
OAM11G_ACCESS_SERVER_PORT:5575
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN:OAMAdministrators
OAM11G_OIM_OHS_URL: http://abc5411405.ca.example.com:7779/
OAM11G_OIM_INTEGRATION_REQ: true
OAM11G_OAM_ADMIN_USER:oamadminuser
OAM11G_SSO_ONLY_FLAG: true
OAM11G_OAM_ADMIN_USER_PASSWD:

2.4.11 validate OAM Command (10g)

Syntax

./idmConfigTool.sh -validate component=OAM10g input_file=input_Properties

Properties

Table 2-16 lists the command properties.

Table 2-16 Properties for validate component=OAM10g

Property Required?

OAM10g_MODE

 

OAM10g_NOPROMPT

 

OAM10g_POLICY_HOST

 

OAM10g_POLICY_PORT

 

OAM10g_POLICY_USERDN

 

OAM10g_POLICY_USERPWD

 

OAM10g_AAA_MODE

 

OAM10g_AAA_PASSPHRASE

 

OAM10g_PRIMARY_SERVERS

 

OAM10g_SECONDARY_SERVERS

 

OAM10g_RUNTIME_USER

 

2.4.12 validate OIM command

Syntax

./idmConfigTool.sh -validate component=OIM11g input_file=input_Properties

Note:

The tool prompts for the WebLogic administration server user password upon execution.

Properties

Table 2-17 lists the command properties.

Table 2-17 Properties for validate component=OIM11g

Property Required?

ADMIN_SERVER_HOST

YES

ADMIN_SERVER_PORT

YES

ADMIN_SERVER_USER

YES

OAM_HOST

 

OAM_NAP_PORT

 

IDSTORE_USERSEARCHBASE

YES

IDSTORE_GROUPSEARCHBASE

YES

OIM_IS_SSL_ENABLED

 

OIM_HOST

YES

OIM_PORT

YES


Example properties File

Here is a sample properties file for this option:

admin_server_host: node06.example.com
admin_server_port: 17111
admin_server_user: weblogic
oam_host : node06.example.com
oam_nap_port : 5575
idm.keystore.file: idm.keystore.file
idstore.user.base: cn=Users,dc=example,dc=com
idstore.group.base: cn=Groups,dc=example,dc=com
oim_is_ssl_enabled: false
OIM_HOST: node06.example.com
OIM_PORT: 1400

2.4.13 configOVD Command

Syntax

./idmConfigTool.sh -configOVD input_file=input_Properties

Properties

Table 2-18 lists the command properties (where n=1,2..).

Table 2-18 configOVD properties

Property Required?

OVD_HOST

YES

OVD_PORT

YES

OVD_BINDDN

YES

OVD_SSL

 

LDAPn_TYPE

 

LDAPn_HOST

YES

LDAPn_PORT

YES

LDAPn_BINDDN

YES

LDAPn_SSL

 

LDAPn_BASE

YES

LDAPn_OVD_BASE

YES

USECASE_TYPE

YES


Example Properties Files

The content of the properties file for the configOVD command depends on the Oracle Virtual Directory configuration. This section provides some sample files.

Here is an example of the file named single.txt for a single-server configuration:

ovd.host:myhost.us.example.com
ovd.port:7000
ovd.binddn:cn=orcladmin
ovd.ssl:true
ldap1.type:OID
ldap1.host:myhost.us.example.com
ldap1.port:7000
ldap1.binddn:cn=oimadmin,cn=systemids,dc=example,dc=com
ldap1.ssl:false
ldap1.base:dc=example,dc=com
ldap1.ovd.base:dc=example,dc=com
usecase.type: single

When using this file, the command is thus invoked as:

idmConfigTool -configOVD input_file=path/single.txt
 
Enter OVD password: password
Enter LDAP password: password

Here is an example of the file named split.txt for a split-profile server configuration:

ovd.host:myhost.us.example.com
ovd.port:7000
ovd.binddn:cn=orcladmin
ovd.ssl:true
ldap1.type:AD
ldap1.host:10.0.0.0
ldap1.port:7000
ldap1.binddn:administrator@idmqa.com
ldap1.ssl:true
ldap1.base:dc=idmqa,dc=com
ldap1.ovd.base:dc=idmqa,dc=com
usecase.type: split
ldap2.type:OID
ldap2.host:myhost.us.example.com
ldap2.port:7000
ldap2.binddn:cn=oimadmin,cn=systemids,dc=example,dc=com
ldap2.ssl:false
ldap2.base:dc=example,dc=com
ldap2.ovd.base:dc=example,dc=com

When using this file, the command is thus invoked as:

idmConfigTool -configOVD input_file=path/split.txt
 
Enter OVD password: password
Enter LDAP1 password: password
Enter LDAP2 password: password

2.4.14 ovdConfigUpgrade Command

Syntax

./idmConfigTool.sh -ovdConfigUpgrade input_file=input_Properties

Properties

Table 2-19 lists the command properties.

Table 2-19 ovdConfigUpgrade Properties

Property Required?

OVD_HOST

 

OVD_PORT

 

OVD_BINDDN

 

OVD_SSL

 

LDAPn_BINDDN

 

LDAPn_SSL

 

Example properties File

Here is a sample properties file for this option which upgrades the existing adapters:

ovd.host:abk005sjc.us.myhost.com
ovd.port:8801
ovd.binddn:cn=orcladmin
ovd.ssl:true

2.4.15 disableOVDAccessConfig Command

Syntax

./idmConfigTool.sh -disableOVDAccessConfig input_file=input_Properties

Properties

Table 2-20 lists the command properties.

Table 2-20 disableOVDAccessConfig Properties

Property Required?

OVD_HOST

 

OVD_PORT

 

OVD_BINDDN

 

OVD_SSL

 

LDAPn_BINDDN

 

LDAPn_SSL

 

Example properties File

Here is a sample properties file for this option which disables the anonymous access in Oracle Virtual Directory:

ovd.host:abc00def.ca.example.com
ovd.port:8501
ovd.binddn:cn=orcladmin
ovd.ssl:true

2.4.16 upgradeOIMTo11gWebgate

Syntax

./idmConfigTool.sh -upgradeOIMTo11gWebgate input_file=input_Properties

Properties

This command uses the same properties that are required for the configOIM command, so the same properties file can work for both. See Table 2-11.

As indicated in the table, certain properties are required when Oracle Identity Manager and Access Manager are configured on different weblogic domains.

2.5 Examples

For examples of idmConfigTool usage, see the individual command options in Command Options and Properties.