Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

What's New In This Guide

• New and Changed Features for 11g Release 2 (11.1.2)
• Other Significant Changes in this Book

Part I Introduction to Oracle Privileged Account Manager

1 Introduction to Oracle Privileged Account Manager

• 1.1 What is Oracle Privileged Account Manager?
• 1.2 Why Use Oracle Privileged Account Manager?
  • 1.2.1 Features
  • 1.2.2 Functionality
  • 1.2.3 Architecture and Topology
• 1.3 How Oracle Privileged Account Manager is Deployed in Oracle Fusion Middleware
• 1.4 Understanding the Relationship between Oracle Privileged Account Manager Entities

2 Understanding Oracle Privileged Account Manager Security

• 2.1 Overview
• 2.2 Understanding Oracle Privileged Account Manager Authentication
  • 2.2.1 Authentication for the Oracle Privileged Account Manager Console
  • 2.2.2 Authentication for the Oracle Privileged Account Manager Server
• 2.3 Understanding Oracle Privileged Account Manager Authorization
  • 2.3.1 Administration Role Types
  • 2.3.2 End Users
• 2.4 Securing Oracle Privileged Account Manager
  • 2.4.1 Securing the Network Channel
    • 2.4.1.1 Connecting to Target Systems
    • 2.4.1.2 Securing the End User Interface
  • 2.4.2 Securing Shared Accounts
    • 2.4.2.1 What is a Shared Account?
    • 2.4.2.2 Security Limitations
    • 2.4.2.3 How to Secure the Account
  • 2.4.3 Enabling Password Resets
  • 2.4.4 Avoiding Assignments through Multiple Paths
  • 2.4.5 Defining Richer Password Policies
  • 2.4.6 Hardening the Back-End Oracle Privileged Account Manager Database
• 2.5 Understanding Session Management Security
• 2.6 Understanding Plug-In Security

Part II Basic Administration

3 Getting Started with Managing Oracle Privileged Account Manager

• 3.1 Before You Begin
• 3.2 Understanding ICF Connectors in Oracle Privileged Account Manager
  • 3.2.1 About the ICF Connectors
  • 3.2.2 Locating the Oracle Privileged Account Manager Connector Bundles
  • 3.2.3 Consuming ICF Connectors
• 3.3 Starting Oracle Privileged Account Manager
  • 3.3.1 Starting WebLogic
  • 3.3.2 Configuring an External Identity Store for Oracle Privileged Account Manager
  • 3.3.3 Preparing the Identity Store
    • 3.3.3.1 Using the idmConfigTool to Prepare the Directory
    • 3.3.3.2 Manually Preparing the Directory
  • 3.3.4 Assigning the Application Configurator Role to a User
• 3.4 Administering Oracle Privileged Account Manager
• 3.5 Working with Oracle Privileged Account Manager Self-Service

4 Starting and Using the Oracle Privileged Account Manager Console

• 4.1 Before You Begin
• 4.2 Invoking Oracle Privileged Account Manager's Web-Based Console
• 4.3 Navigating Oracle Privileged Account Manager's Console
  • 4.3.1 Working with the Home Accordion
  • 4.3.2 Working with the Administration Accordion
  • 4.3.3 Working with the Reports Accordion
  • 4.3.4 Working with the Configuration Accordion
  • 4.3.5 Working with the Search Portlet
  • 4.3.6 Working with a Search Results Table

5 Configuring and Managing the Servers

• 5.1 Understanding the Servers
  • 5.1.1 Oracle Privileged Account Manager Server
  • 5.1.2 Oracle Privileged Session Manager Server
• 5.2 Managing an Oracle Privileged Account Manager Server
  • 5.2.1 Before You Begin
  • 5.2.2 Configuring a Connection to the Oracle Privileged Account Manager Server
  • 5.2.3 Managing Oracle Privileged Account Manager Server Properties
    • 5.2.3.1 From the Console
    • 5.2.3.2 From the Command Line
• 5.3 Managing the Oracle Privileged Session Manager Server
  • 5.3.1 Before You Begin
  • 5.3.2 Configuring a Connection to the Oracle Privileged Session Manager Server
  • 5.3.3 Managing the Oracle Privileged Session Manager Properties

6 Working with Targets

• 6.1 What Are Targets?
• 6.2 Adding Targets to Oracle Privileged Account Manager
  • 6.2.1 database Target Type Parameters
  • 6.2.2 ldap Target Type Parameters
  • 6.2.3 lockbox Target Type Parameters
  • 6.2.4 unix Target Type Parameters
• 6.3 Searching for Targets
• 6.4 Opening a Target
• 6.5 Managing a Target's Service Account Password
• 6.6 Removing Targets from Oracle Privileged Account Manager

7 Working with Service Accounts

• 7.1 Understanding Service Accounts
• 7.2 Creating Service Accounts
• 7.3 Managing Service Account Passwords
  • 7.3.1 Showing Service Account Passwords
  • 7.3.2 Viewing the Password History
  • 7.3.3 Resetting Service Account Passwords
  • 7.3.4 Understanding Service Account Password Rollover

8 Working with Privileged Accounts

• 8.1 What is a Privileged Account?
  • 8.1.1 Managing System Accounts
  • 8.1.2 Managing Application Accounts
  • 8.1.3 Understanding Sharing Accounts
• 8.2 Adding Privileged Accounts into Oracle Privileged Account Manager
  • 8.2.1 Adding the Account
  • 8.2.2 Adding Grantees
  • 8.2.3 Adding CSF Mappings
• 8.3 Searching for Privileged Accounts
• 8.4 Opening Privileged Accounts
• 8.5 Checking Out Privileged Accounts
  • 8.5.1 Checking Out Passwords
  • 8.5.2 Checking Out Privileged Account Sessions
• 8.6 Checking In Privileged Accounts
• 8.7 Viewing a Session Recording
• 8.8 Managing Privileged Account Passwords
  • 8.8.1 Showing an Account Password
  • 8.8.2 Viewing an Account's Password History
  • 8.8.3 Resetting an Account Password
• 8.9 Removing Privileged Accounts from Oracle Privileged Account Manager

9 Working with Policies

• 9.1 What Are Oracle Privileged Account Manager Policies?
• 9.2 Working with Password Policies
  • 9.2.1 Searching for Password Policies
  • 9.2.2 Viewing Password Policies
  • 9.2.3 Modifying the Default Password Policy
  • 9.2.4 Creating a Password Policy
  • 9.2.5 Assigning Password Policies
  • 9.2.6 Deleting Password Policies
• 9.3 Working with Usage Policies
  • 9.3.1 Searching for Usage Policies
  • 9.3.2 Viewing Usage Policies
  • 9.3.3 Modifying the Default Usage Policy
  • 9.3.4 Creating a Usage Policy
  • 9.3.5 Assigning Usage Policies
  • 9.3.6 Deleting Usage Policies

10 Working with Grantees

• 10.1 What Are Grantees?
• 10.2 Granting Accounts to Users
• 10.3 Granting Accounts to Groups
• 10.4 Searching for Grantees
• 10.5 Opening a Grantee
• 10.6 Removing Grantees from an Account

11 Working with Plug-Ins

• 11.1 What is a Plug-In?
• 11.2 Developing Plug-Ins for Oracle Privileged Account Manager
  • 11.2.1 Overview
  • 11.2.2 Supported Languages
  • 11.2.3 Prerequisites
  • 11.2.4 Oracle Privileged Account Manager Plug-In Benefits
  • 11.2.5 Design Guidelines
  • 11.2.6 Framework Description
  • 11.2.7 Supported Operations and Timings
    • 11.2.7.1 Pre-Operation Plug-Ins
    • 11.2.7.2 Post-Operation Plug-Ins
  • 11.2.8 Filtering Rules
• 11.3 Creating a Plug-In Configuration
• 11.4 Searching for Plug-In Configurations
• 11.5 Opening a Plug-In
• 11.6 Deleting a Plug-In

12 Working with Self-Service

• 12.1 Introduction to Using Self Service
• 12.2 Viewing Your Accounts
• 12.3 Searching for Accounts
• 12.4 Opening Accounts
• 12.5 Checking Accounts Out and In
• 12.6 Viewing Your Checked-Out Accounts
• 12.7 Checking Out Privileged Account Sessions
• 12.8 Showing a Password

Part III Monitoring Oracle Privileged Account Manager

13 Working with Reports

• 13.1 Viewing a Report
• 13.2 Working with Deployment Reports
• 13.3 Working with Usage Reports
• 13.4 Working with Failure Reports
• 13.5 Working with Checkout History Reports

14 Managing Oracle Privileged Account Manager Auditing and Logging

• 14.1 Understanding Oracle Privileged Account Manager Auditing
  • 14.1.1 Configuring Auditing in Oracle Privileged Account Manager
    • 14.1.1.1 Configuring File-Based Auditing in Oracle Privileged Account Manager
    • 14.1.1.2 Configuring Database-Based Auditing in Oracle Privileged Account Manager
    • 14.1.1.3 Deploying Oracle Privileged Account Manager Audit Reports in BI Publisher
    • 14.1.1.4 Setting the Audit Logging Levels
  • 14.1.2 Understanding Oracle Privileged Account Manager Audit Reports
  • 14.1.3 Auditing Application Consumption of Credentials from CSF
• 14.2 Understanding Oracle Privileged Account Manager Logging
  • 14.2.1 Configuring Basic Logging
  • 14.2.2 Example Logging Data

Part IV Advanced Administration

15 Performing Advanced Configuration Tasks for Oracle Privileged Account Manager

• 15.1 Configuring Oracle Privileged Account Manager to Communicate With Target Systems Over SSL
• 15.2 Securing Data On Disk
  • 15.2.1 Enabling TDE Mode
    • 15.2.1.1 Enable TDE in the Database
    • 15.2.1.2 Enable Encryption in the Oracle Privileged Account Manager Schema
    • 15.2.1.3 Enable TDE Mode in the Oracle Privileged Account Manager Server Configuration
  • 15.2.2 Disabling TDE Mode
    • 15.2.2.1 Disable TDE Mode in the Oracle Privileged Account Manager Server Configuration
    • 15.2.2.2 Disable Encryption in the Oracle Privileged Account Manager Schema
• 15.3 Adding New Connectors to an Existing Oracle Privileged Account Manager Installation
  • 15.3.1 Adding Connectors Supplied by Oracle
  • 15.3.2 Adding Custom Connectors
• 15.4 Advanced Management of Session Manager Data
  • 15.4.1 Overview
  • 15.4.2 Partitioning
  • 15.4.3 Partition OPSM_SESSIONS Table
  • 15.4.4 Purging
• 15.5 Moving from a Test Environment to a Production Environment
• 15.6 Rebranding Oracle Privileged Account Manager
  • 15.6.1 Customizing the Login Page
  • 15.6.2 Customizing the Oracle Privileged Account Manager Page

16 Developing Plug-Ins for Oracle Privileged Account Manager

• 16.1 Overview
  • 16.1.1 Oracle Privileged Account Manager Framework Packages
  • 16.1.2 Special Considerations for Using Oracle Privileged Account Manager Plug-Ins
• 16.2 Setting Up a Plug-In
• 16.3 Understanding the Plug-In API
  • 16.3.1 Communication between the Server and Plug-In
  • 16.3.2 Plug-In Structure
  • 16.3.3 Plug-In Interfaces and Classes
    • 16.3.3.1 PlugInContext
    • 16.3.3.2 PluginResult
    • 16.3.3.3 PrePlugin
    • 16.3.3.4 PostPlugin
• 16.4 Debugging and Logging for Plug-Ins
• 16.5 Example Plug-ins
  • 16.5.1 Pre Plug-In Example
  • 16.5.2 Post Plug-In Example
• 16.6 Managing Plug-Ins

17 Configuring Oracle Privileged Account Manager for Integrated Solutions

• 17.1 Integrating with Oracle Identity Manager
  • 17.1.1 Overview
  • 17.1.2 Before You Begin
    • 17.1.2.1 Installing Oracle Identity Manager
    • 17.1.2.2 Configuring an Oracle Identity Manager Administrator
    • 17.1.2.3 Configuring the External Identity Stores
    • 17.1.2.4 Creating LDAP Groups
    • 17.1.2.5 Adding the Oracle Privileged Account Manager CA Certificate
  • 17.1.3 Setting Up Oracle Identity Manager for the Integration
    • 17.1.3.1 Installing and Configuring the Generic LDAP Connector
    • 17.1.3.2 Creating an Application Instance
  • 17.1.4 Running the opamSetup Script
  • 17.1.5 Creating the OPAM_TAGS UDF
  • 17.1.6 Tagging Catalog Entries with Oracle Privileged Account Manager Metadata
• 17.2 Integrating with Oracle Access Management Access Manager
  • 17.2.1 Before You Begin
  • 17.2.2 Enabling Single Sign-On
    • 17.2.2.1 Configure a New Resource for the Agent
    • 17.2.2.2 Configure Oracle HTTP Server for the Access Manager Domain
    • 17.2.2.3 Add New Identity Providers
    • 17.2.2.4 Configure Access to Multiple Applications
• 17.3 Integrating with the Credential Store Framework
  • 17.3.1 Understanding Oracle Privileged Account Manager-Managed CSF Credentials
  • 17.3.2 Provisioning
  • 17.3.3 Lifecycle Management
  • 17.3.4 Application Consumption

Part V Appendixes and Glossary

A Working with the Command Line Tool

• A.1 Using the Command Line Tool
  • A.1.1 Launching the Command Line Tool
    • A.1.1.1 Launching the Command Line Tool from IAM_HOME
    • A.1.1.2 Launching the Command Line Tool from Oracle Privileged Account Manager Client Archive
  • A.1.2 Issuing Commands
• A.2 Working with the Server
  • A.2.1 getconfig Command
  • A.2.2 getserverstatus Command
  • A.2.3 modifyconfig Command
• A.3 Working with Policies
  • A.3.1 addpasswordpolicy Command
  • A.3.2 addusagepolicy Command
  • A.3.3 modifypasswordpolicy Command
  • A.3.4 modifyusagepolicy Command
  • A.3.5 removepasswordpolicy Command
  • A.3.6 removeusagepolicy Command
  • A.3.7 retrievepasswordpolicy Command
  • A.3.8 retrieveusagepolicy Command
• A.4 Working with Targets
  • A.4.1 addtarget Command
    • A.4.1.1 ldap Target Type Parameters
    • A.4.1.2 database Target Type Parameters
    • A.4.1.3 unix Target Type Parameters
    • A.4.1.4 lockbox Target Type Parameters
  • A.4.2 displayalltargets Command
  • A.4.3 modifytarget Command
  • A.4.4 removetarget Command
  • A.4.5 resettargetpassword Command
  • A.4.6 retrievetarget Command
  • A.4.7 searchtarget Command
  • A.4.8 showtargetpassword Command
  • A.4.9 showtargetpasswordhistory Command
• A.5 Working with Accounts
  • A.5.1 addaccount Command
  • A.5.2 displayallaccounts Command
  • A.5.3 checkin Command
  • A.5.4 checkout Command
  • A.5.5 displaycheckedoutaccounts Command
  • A.5.6 modifyaccount Command
  • A.5.7 removeaccount Command
  • A.5.8 resetpassword Command
  • A.5.9 retrieveaccount Command
  • A.5.10 searchaccount Command
  • A.5.11 searchcheckouthistory Command
  • A.5.12 showpassword Command
  • A.5.13 showpasswordhistory Command
• A.6 Working with Grantees
  • A.6.1 displayallgroups Command
  • A.6.2 displayallusers Command
  • A.6.3 grantgroupaccess Command
  • A.6.4 grantuseraccess Command
  • A.6.5 removegroupaccess Command
  • A.6.6 removeuseraccess Command
  • A.6.7 retrievegrantees Command
  • A.6.8 retrievegroup Command
  • A.6.9 retrieveuser Command
  • A.6.10 searchgroup Command
  • A.6.11 searchuser Command
• A.7 Working with Plug-Ins
  • A.7.1 addplugin Command
  • A.7.2 addplugincustomattr Command
  • A.7.3 removeplugincustomattr Command
  • A.7.4 retrieveplugin Command
  • A.7.5 searchplugin Command
  • A.7.6 modifyplugin Command
  • A.7.7 removeplugin Command
• A.8 Exporting and Importing Data
  • A.8.1 export Command
  • A.8.2 filedecryption Command
  • A.8.3 import Command

B Working with Oracle Privileged Account Manager's RESTful Interface

• B.1 Overview
• B.2 Server State Resource
  • B.2.1 Get Server State
• B.3 Configuration Resource
  • B.3.1 Global Configuration Resource
    • B.3.1.1 Get Configuration Resource
    • B.3.1.2 Update Configuration Resource
  • B.3.2 Oracle Privileged Session Manager Configuration Resource
    • B.3.2.1 Get Configuration Resource
    • B.3.2.2 Update Configuration Resource
• B.4 Policy Resource
  • B.4.1 Search for Policies
  • B.4.2 Get Default Policies
  • B.4.3 Password Policy Resource
    • B.4.3.1 Retrieve a Password Policy
    • B.4.3.2 Update a Password Policy
    • B.4.3.3 Create a Password Policy
    • B.4.3.4 Get Accounts for Password Policy
    • B.4.3.5 Delete a Password Policy
  • B.4.4 Usage Policy Resource
    • B.4.4.1 Retrieve a Usage Policy
    • B.4.4.2 Update a Usage Policy
    • B.4.4.3 Create a Usage Policy
    • B.4.4.4 Get Grants for Usage Policy
    • B.4.4.5 Delete a Usage Policy
• B.5 Target Resource
  • B.5.1 Get Target Attributes
  • B.5.2 Add a Target
  • B.5.3 Verify a Target
  • B.5.4 Retrieve a Target
  • B.5.5 Update a Target
  • B.5.6 Remove a Target
  • B.5.7 Search for Targets
  • B.5.8 Get Available Accounts
  • B.5.9 Retrieve Accounts Registered on a Target
  • B.5.10 Get Target Types
  • B.5.11 Reset Password
  • B.5.12 Show Service Account Password
  • B.5.13 Show Service Account Password (Deprecated)
  • B.5.14 Show Service Account Password History
• B.6 Account Resource
  • B.6.1 Add an Account to a Target
  • B.6.2 Get Applicable Usage Policy for the Account
  • B.6.3 Grant a User/Role Access to an Account
  • B.6.4 Add or Remove a CSF Map-Key for an Account
  • B.6.5 Search Accounts
  • B.6.6 Search Assigned Accounts
  • B.6.7 Retrieve an Account
  • B.6.8 Retrieve Grantees on an Account
  • B.6.9 Retrieve Users Who Checked Out an Account
  • B.6.10 Check Out an Account
  • B.6.11 Get All Checked Out Accounts
  • B.6.12 Get Session Checkout Instructions
  • B.6.13 Checkout History for an Account
  • B.6.14 Checkout History
  • B.6.15 Check In an Account
  • B.6.16 Verify an Account
  • B.6.17 Update an Account
  • B.6.18 Remove an Account
  • B.6.19 Remove a User's/Role's Access to an Account
  • B.6.20 Show Password
  • B.6.21 Show Password (Deprecated)
  • B.6.22 Show Password History
  • B.6.23 Show Password History (Deprecated)
  • B.6.24 Reset Password
• B.7 UI Resource
  • B.7.1 Search Accounts (Deprecated)
  • B.7.2 Search Assigned Accounts (Deprecated)
  • B.7.3 Get All Checked Out Accounts (Deprecated)
• B.8 User Resource
  • B.8.1 Get a User
  • B.8.2 Get All Accounts Granted to a User
  • B.8.3 Search Users from Identity Store
  • B.8.4 Search for Assigned Users
• B.9 Group Resource
  • B.9.1 Get Group
  • B.9.2 Get Member Users of a Group
  • B.9.3 Get Member Groups of a Group
  • B.9.4 Get All Accounts Granted to a Group
  • B.9.5 Search Groups from Identity Store
  • B.9.6 Advanced Search for Assigned Groups
• B.10 Plug-In Resource
  • B.10.1 Add Plug-In Configuration
  • B.10.2 Verify Plug-In Configuration
  • B.10.3 Search For Plug-In Configuration
  • B.10.4 Retrieve Plug-In Configuration
  • B.10.5 Update Plug-In Configuration
  • B.10.6 Remove Plug-In Configuration

C Troubleshooting Oracle Privileged Account Manager

• C.1 Introduction to Troubleshooting Oracle Privileged Account Manager
• C.2 Getting Started with Troubleshooting and Logging Basics for Oracle Privileged Account Manager
  • C.2.1 Increasing the Log Level
  • C.2.2 Examining Exceptions in the Logs
• C.3 Resolving Common Problems and Solutions
  • C.3.1 Console Cannot Connect to Oracle Privileged Account Manager Server
  • C.3.2 Console Changes Are Not Reflected in Other, Open Pages
  • C.3.3 Cannot Access Targets or Accounts
  • C.3.4 Cannot Add Database Targets
    • C.3.4.1 Cannot Connect to Oracle Database with sysdba Role
    • C.3.4.2 Cannot Find Special Options for Adding a Database Target
  • C.3.5 Cannot Add an Active Directory LDAP Target
  • C.3.6 Grantee Cannot Perform a Checkout
  • C.3.7 Cannot View Users or Roles from the Configured Remote Identity Store
  • C.3.8 Group Membership Changes Are Not Immediately Reflected in Oracle Privileged Account Manager
  • C.3.9 Cannot Use Larger Key Sizes for Export/Import
  • C.3.10 Oracle Privileged Account Manager End Users Gain Privileges They Were Not Explicitly Granted
  • C.3.11 Cannot Access MSSQL Server Targets and Accounts
  • C.3.12 Troubleshooting Issues with Using Oracle Database TDE
    • C.3.12.1 TDE Wallet Errors
    • C.3.12.2 The TDE Wallet is Open, but Columns Are Not Encrypted
  • C.3.13 Cannot Open Session Recordings
    • C.3.13.1 Cannot Access Recordings In Internet Explorer Browser
    • C.3.13.2 Cannot Access Recordings in Any Browser
  • C.3.14 Session Checkout Does Not Work, Even After Granting the Account
  • C.3.15 OPAM Console Login Does Not Work in Internet Explorer 11 Browser
• C.4 Using My Oracle Support for Additional Troubleshooting Information

Glossary

Index