12 Configuring Your Environment to Work With Mobile Security Manager

This chapter documents configuration steps that may be required to get Mobile Security Manager working in your environment. It is organized into the following sections:

Note:

See the Oracle Fusion Middleware Integration Guide for Oracle Identity Management Suite to learn how to integrate Oracle Identity Manager Oracle Mobile Security Suite with Oracle Mobile Security Suite.

12.1 Tuning Oracle Mobile Security Suite

See "Tuning Oracle Mobile Security Suite" in the Oracle Fusion Middleware Performance and Tuning Guide for information about tuning the heap size, tuning the datasource connection pool settings, and other tuning recommendations.

12.2 Configuring the Identity Store Configuration

To configure the identity store connection, create an Identity Directory Service Profile in the Oracle Access Management console. Then in Mobile Security Manager, set the IDS Profile Name in the Identity Store Settings tab.

12.3 Configuring NDES and the Active Directory Certificate Authority

This section describes how to configure Windows Enterprise 2008 R2 machines so that the Simple Certificate Enrollment Protocol (SCEP) works with the Mobile Security Manager server. This configuration is required for Secure Workspace enrollment.

Before you begin, install the Network Device Enrollment Service (NDES) on either the Windows Enterprise 2012 R2 or Windows Enterprise 2008 R2 machine.

Note:

Ensure that the user password for the user account specified for the NDES configuration never expires.

  1. Apply the required hotfixes. The following hotfixes must be applied to Windows 2008 R2 machines before you configure NDES:

  2. Configure the Network Device Enrollment Services (NDES) on your Active Directory server by completing the Setup instructions found in the Microsoft TechNet article "Network Device Enrollment Service (NDES) in Active Directory Certificate Services (AD CS):

    http://social.technet.microsoft.com/wiki/contents/articles/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspx

  3. Increase the MAX URL limit. Because SCEP requests use the HTTP GET method, the length of the URL can exceed the limit due to the certificate signing request present in the request URL.

    %windir%\system32\inetsrv\appcmd set config /section:requestfiltering /requestlimits.maxurl:4096
 
 %windir%\system32\inetsrv\appcmd set config /section:requestfiltering /requestlimits.maxquerystring:4096

  4. Extend the Smart Card Logon Certificate Template to create a new template to be used while issuing certificates.

    1. Open Server Manager and right-click the Smartcard Logon template.

      Select Duplicate Template.

      The Duplicate Template dialog opens.

      Description of ndes-ca-config1.png follows
      Description of the illustration ''ndes-ca-config1.png''

    2. Select Windows Server 2003 Enterprise and click OK.

      The Properties of New Template form opens.

    3. On the General tab of the Properties of New Template form, type a template name. You will use this name when configuring NDES.

      Description of ndes-ca-config3.png follows
      Description of the illustration ''ndes-ca-config3.png''

    4. On the Request Handling tab of the Properties of New Template form, select Allow private key to be exported. Do not change the other values.

      Description of ndes-ca-config4.png follows
      Description of the illustration ''ndes-ca-config4.png''

    5. On the Subject Name tab of the Properties of New Template form, select Supply in the request.

      A warning message opens.

      Click OK to close the warning, then click Apply, and click OK to complete the template creation.

      Description of ndes-ca-config5.png follows
      Description of the illustration ''ndes-ca-config5.png''

    6. In the Server Manager window, expand the certificate authority node and choose the Certificate Templates entry under it.

      Select the recently created certificate.

    7. From the menu, choose Action > New > Certificate Template to Issue.

      Select the newly created certificate template.

  5. Set permissions for the certificate template by selecting Allow for Read, Write, Enroll, and Autoenroll.

    Description of ndes-ca-config6.png follows
    Description of the illustration ''ndes-ca-config6.png''

  6. Configure the following values so that Certification Authority includes SAN in the certificate

    certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
 
net stop certsvc
net start certsvc

  7. Set the NDES configuration to disable the password policy and to use the Certificate Template for certificate issuance.

    Update the registry settings for SCEP as follows:

    1. Open the following registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP

    2. Add the new key and value as shown in the screen capture.

      Description of ndes-ca-config7b.png follows
      Description of the illustration ''ndes-ca-config7b.png''

  8. Disable the password policy for NDES.

    1. Open the following registry key:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP\
      EnforcePassword

    2. Change the value for EnforcePassword to 0x00000000.

      Description of ndes-ca-config8.png follows
      Description of the illustration ''ndes-ca-config8.png''

  9. Restart the NDES SCEP server or the Internet Information Server (IIS).

12.4 Configuring Automatic Certificate Revocation with the Active Directory Certificate Authority

When the Mobile Security Manager component of the Oracle Mobile Security Suite is configured to provision certificates from a Microsoft CA, by default those certificates will not be automatically revoked when mobile devices and Workspace apps are wiped or deregistered. Mobile Security Manager uses the Network Device Enrollment Service (NDES) for provisioning certificates. NDES, however, does not provide a network interface for certificate revocation.

This section describes how to configure a Certificate Revocation Application in Internet Information Server (IIS) on the NDES server. Mobile Security Manager will invoke this application so that mobile device and user certificates are automatically revoked at the appropriate points in the lifecycle of mobile devices and workspace apps.

The URL that Mobile Security Manager calls to revoke certificates is computed based on the NDES URL provided in the Mobile Security Manager CA Settings tab. The URL for certificate revocation will be constructed like the following:

http(s)://<ca_host>:<ca_port>/CertService/revoke.php

The Mobile Security Manager server sends POST requests to revoke the certificates, indicating ”Cease of Operation” as the reason for the revocation.

This section includes the following topics:

12.4.1 Steps to Configure Certificate Revocation Application

Before you begin: The Certification Revocation Application is a PHP application. It requires that Internet Information Server (IIS) on your NDES server support PHP applications. If it does not, then follow the Steps in Section 12.4.5, "Configuring IIS to run PHP applications."

Configuring the Certificate Revocation Application involves the following steps:

  1. Deploy Certificate Revocation Application in IIS – In this step you create and configure the PHP application in IIS.

  2. Deploy Certificate Revocation PHP Scripts – In this step you deploy the PHP scripts provided by Oracle to the physical path of the Certificate Revocation Application.

  3. Import Mobile Security Manager Certificate – In this step you import the Mobile Security Manager certificate to the physical path of the Certificate Revocation Application so that it can authenticate certificate revocation requests as originating from Mobile Security Manager.

12.4.2 Deploy the Certificate Revocation Application in IIS

This section describes how to deploy the Certificate Revocation Application in IIS.

  1. Add an Application Pool

    1. Open the IIS Manager application for the NDES IIS instance. Select Application Pools, and in the Actions pane, select Add Application Pool.

      The Add Application Pool dialog opens.

    2. Complete the form as follows and click OK:

      Name – Type CertService.

      .NET Framework version – Use the default value.

      Managed pipeline mode – Choose Integrated.

      Start application pool immediately – Select this option.

      Figure 12-1 Complete the Add Application Pool form

      Description of Figure 12-1 follows
      Description of ''Figure 12-1 Complete the Add Application Pool form''

    3. Edit the newly created CertService application pool.

      In the Actions pane, select Advanced and click ApplicationPoolIdentity to set Identity as a privileged service account.

      The Application Pool Identity dialog opens.

      Figure 12-2 The Application Pool Identity dialog

      Description of Figure 12-2 follows
      Description of ''Figure 12-2 The Application Pool Identity dialog''

    4. Select Custom account and click Set.

      The Set Credentials dialog opens.

    5. In the User name field, enter the user name of a Windows account that has permission to manage certificates at the Certificate Authority level (assigned on the security properties of the CA).

      Enter the password in the Password and Confirm password fields and click OK.

      Click OK to close the other open dialogs.

      Figure 12-3 Enter CA administrator credentials in the Set Credentials dialog

      Description of Figure 12-3 follows
      Description of ''Figure 12-3 Enter CA administrator credentials in the Set Credentials dialog''

      The service account is shown as the identity for the application pool.

  2. Right-click the Default Web Site in the IIS NDES instance and select Add New Application.

    The Add Application dialog opens.

    In the Alias field, enter CertService, then click Select and choose CertService as the Application Pool to use.

    In Physical path, click the ... button and select a physical path for the application.

    Click OK to finish creating the new Certificate Revocation Application.

  3. Update the php.ini file.

    Add the following line to the <PHP_INSTALLATION_HOME>/php.ini file to enable the OpenSSL extension for PHP:

    extension=php_openssl.dll

12.4.3 Deploy the Certificate Revocation PHP Scripts

This section describes how to deploy two PHP scripts for certificate revocation to the physical path of the Certificate Revocation Application.

  1. Create a text file named revoke.php and add the contents of the following code snippet.

    Save the file to the root of the physical path that you selected for the Certificate Revocation Application in step 2 of Section 12.4.2, "Deploy the Certificate Revocation Application in IIS."

    Contents of the revoke.php file

    <?php
function checkNull($var){
    return (!isset($var) || is_null($var));
}
function checkNullOrEmpty($var){
    return (!isset($var) || trim($var)==='');
}
 
include_once "JWT.php";
$postdata = file_get_contents("php://input");
$result = 1;
$reasonCode ="";
try{
                        $ar = json_decode($postdata);
            if( ! checkNull($ar) ){
                        if(!(checkNullOrEmpty($ar->serialnumber)
                                || checkNullOrEmpty($ar->authtoken)
                                || checkNullOrEmpty($ar->caauthority)
                                                        || checkNullOrEmpty($ar->reason))) {
                        
                                                        $check = $ar->caauthority . ":" . $ar->serialnumber;
              $res_pubkey = openssl_pkey_get_public(file_get_contents("certs/SignerCertificate.pem"));
                                $payload = JWT::decode($ar->authtoken, $res_pubkey, true);
                                if(strcmp($check, $payload->sub) == 0){
                                                $cmd="certutil -config \"$ar->caauthority\"  -revoke $ar->serialnumber $ar->reason" ;
                                                exec($cmd);
                                                $status = "0";
                                                $message="Certificate Revoked Successfully" ;
                                                $result = 0;              
                                } else {
                                                                $status = "337";
                                                                $message = "Revoke request does not match with Authentication subject";
                                                                $result = 4;              
                                                        }
                                        } else {
                                                        $result = 2;
                                                        $message = "Missing request parameters";
                        }
                } else {
                                    $result = 3;
            $status = "335";
                            $message = "Http Get is not supported";
                }
} catch (Exception $ex){
   $result = 1;
   $reasonCode = "Authentication Token verification failed";
}
if($result == 1){
    $status = "333" ;
            $message = "Certificate revoke failed.  Reason $reasonCode";
} else if($result == 2){
        $status = "333";
}
$data="{ \"message\": \"$message\", \"code\": \"$status\"}";
header("Content-Type: application/json");
print ($data);
?>

  2. Create a text file named JWT.php and add the contents of the following code snippet.

    Save the file to the root of the physical path that you selected for the Certificate Revocation Application in step 2 of Section 12.4.2, "Deploy the Certificate Revocation Application in IIS."

    Contents of the JWT.php file

    <?php
class JWT
{
    public static function encode($payload, $key, $algo = 'HS256')
    {
       $header = array('typ' => 'JWT', 'alg' => $algo);
       $segments = array(
           JWT::urlsafeB64Encode(json_encode($header)),
           JWT::urlsafeB64Encode(json_encode($payload))
       );
       $signing_input = implode('.', $segments);
       $signature = JWT::sign($signing_input, $key, $algo);
       $segments[] = JWT::urlsafeB64Encode($signature);
       return implode('.', $segments);
    }
 
    public static function decode($jwt, $key = null, $verify = true)
    {
       $tks = explode('.', $jwt);
       if (count($tks) != 3) {
           throw new Exception('Wrong number of segments');
       }
       list($headb64, $payloadb64, $cryptob64) = $tks;
       if (null === ($header = json_decode(JWT::urlsafeB64Decode($headb64))))
       {
           throw new Exception('Invalid segment encoding');
       }
       if (null === $payload = json_decode(JWT::urlsafeB64Decode($payloadb64))) 
      {
           throw new Exception('Invalid segment encoding');
       }
       $sig = JWT::urlsafeB64Decode($cryptob64);
       if ($verify) {
           if (empty($header->alg)) {
               throw new DomainException('Empty algorithm');
           }
           if (!JWT::verifySignature($sig, "$headb64.$payloadb64", $key, $header->alg)) {
               throw new UnexpectedValueException('Signature verification failed');
           }
      }
      return $payload;
   }
        
    public static function getSignature($jwt, $key = null, $verify = true)
    {
       $tks = explode('.', $jwt);
       if (count($tks) != 3) {
           throw new Exception('Wrong number of segments');
       }
       list($headb64, $payloadb64, $cryptob64) = $tks;
       if (null === ($header = json_decode(JWT::urlsafeB64Decode($headb64)))) {
           throw new Exception('Invalid segment encoding');
       }
       if (null === $payload = json_decode(JWT::urlsafeB64Decode($payloadb64))) 
      {
           throw new Exception('Invalid segment encoding');
       }
       $sig = JWT::urlsafeB64Decode($cryptob64);        
       return $sig;
    }
        
    private static function verifySignature($signature, $input, $key, $algo = 'HS256')
    {
       switch ($algo) {
           case'HS256':
           case'HS384':
           case'HS512':
               return JWT::sign($input, $key, $algo) === $signature;
           case 'RS256':
               return (boolean) openssl_verify($input, $signature, $key, OPENSSL_ALGO_SHA256);
           case 'RS384':
               return (boolean) openssl_verify($input, $signature, $key, OPENSSL_ALGO_SHA384);
           case 'RS512':
               return (boolean) openssl_verify($input, $signature, $key, OPENSSL_ALGO_SHA512);
           default:
               throw new Exception("Unsupported or invalid signing algorithm.");
       }
    }
    private static function sign($input, $key, $algo = 'HS256')
    {
       switch ($algo) {
           case 'HS256':
               return hash_hmac('sha256', $input, $key, true);
           case 'HS384':
               return hash_hmac('sha384', $input, $key, true);
           case 'HS512':
               return hash_hmac('sha512', $input, $key, true);
           case 'RS256':
               return JWT::generateRSASignature($input, $key, OPENSSL_ALGO_SHA256);
           case 'RS384':
               return JWT::generateRSASignature($input, $key, OPENSSL_ALGO_SHA384);
           case 'RS512':
               return JWT::generateRSASignature($input, $key, OPENSSL_ALGO_SHA512);
           default:
               throw new Exception("Unsupported or invalid signing algorithm.");
       }
    }
    private static function generateRSASignature($input, $key, $algo)
    {
       if (!openssl_sign($input, $signature, $key, $algo)) {
           throw new Exception("Unable to sign data.");
       }
       return $signature;
    }
    private static function urlSafeB64Encode($data)
    {
       $b64 = base64_encode($data);
       $b64 = str_replace(array('+', '/', '\r', '\n', '='),
               array('-', '_'),
               $b64);
       return $b64;
    }
    private static function urlSafeB64Decode($b64)
    {
       $b64 = str_replace(array('-', '_'),
               array('+', '/'),
               $b64);
       return base64_decode($b64);
    }
}
?>

12.4.4 Import the Mobile Security Manager Certificate in IIS

This section describes how to import the Mobile Security Manager certificate to the physical path of the Certificate Revocation Application. This step is necessary so that the Certificate Revocation Application can authenticate certificate revocation requests as originating from Mobile Security Manager.

  1. Export the Mobile Security Manager certificate from the Mobile Security Manager server:

    1. Go to the Mobile Security Manager installation directory:

      <DOMAIN_HOME>/config/fmwconfig

    2. Export the certificate using the following command:

      keytool -alias oraclemsm -exportcert -file oraclemsm.crt -keystore OracleMSMCertificates.p12 -storepass <KeyStorePassword> -storetype pkcs12

      Tip:

      The keystore password can be obtained from CSF using map name msm and key serverKeystoreKey.

  2. On the NDES server, use the following command to convert the resulting DER encoded certificate to PEM format.

    openssl x509 -inform der -in oraclemsm.crt -out SignerCertificate.pem

  3. Copy the SignerCertificate.pem file to the /certs directory under the physical path of the Certificate Revocation Application.

    <PHYSICAL_PATH>/certs/SignerCertificate.pem

12.4.5 Configuring IIS to run PHP applications

This section describes how to configure IIS on your NDES server to support PHP applications.

Note:

If your IIS instance is already configured to run PHP applications, then skip the steps in this section. If the CGI Role Service is configured, but PHP is not enabled, then skip step 1.

  1. Add the CGI Role Service to IIS:

    1. Open the Server Manager application.

      In the pane on the left, expand Roles, right-click Web Server (IIS), and select Add Role Services.

      The Add Role Services dialog opens.

      Figure 12-4 The Server Manager application

      Description of Figure 12-4 follows
      Description of ''Figure 12-4 The Server Manager application''

    2. Expand Web Server (Installed), expand Application Development (Installed), and select the CGI check box.

      Figure 12-5 The Add Role Services dialog

      Description of Figure 12-5 follows
      Description of ''Figure 12-5 The Add Role Services dialog''

    3. Expand Security and select the Windows Authentication check box.

    4. Expand Management Tools and select the IIS 6 Management Compatibility check box, which selects all of the sub-selections under IIS 6 Management Compatibility.

    5. Select Next.

    6. Select Install.

  2. Configure IIS to handle PHP requests:

    1. Open the Internet Information Services (IIS) Manager application for the NDES IIS instance.

      Select the server, and double-click Handler Mappings.

    2. In the Actions pane on the right, click Add Module Mapping.

    3. Enter *php for Request path.

    4. Select FastCGIModule for Module.

    5. Enter <PHP_INSTALLATION_HOME>/php-cgi.exe as the Executable. If you browse, make sure that you select (*.exe) as the file type; otherwise it will be (*.dll) by default.

    6. Enter a Name of PHP using FASTCGI.

    7. Click the OK button.

      The Add Module Mapping confirmation dialog opens.

      Figure 12-6 The Add Module Mapping confirmation dialog

      Description of Figure 12-6 follows
      Description of ''Figure 12-6 The Add Module Mapping confirmation dialog''

    8. Click Yes to add the FastCGI application for PHP.

    9. In the Actions pane, click Edit Feature Permissions....

      The Edit Feature Permissions dialog opens.

      Under Script, select Execute, then click OK.

    10. In the Actions pane, click Edit....

      Click Request Restrictions, select the Access tab, and ensure that Execute is selected. Click OK to close the Edit Module Mapping dialog.

  3. Add the PHP MIME type:

    1. Select the NDES server instance in the IIS Manager application and double-click MIME Types.

    2. In the Actions pane select Add.

      The Add MIME Type dialog opens.

      Figure 12-7 The Add MIME Type dialog

      Description of Figure 12-7 follows
      Description of ''Figure 12-7 The Add MIME Type dialog''

    3. Complete the form as follows and press OK:

      File name extension -Enter .php

      MIME type - Enter application/x-httpd-php

12.5 Configuring Microsoft Exchange (Secure Mail) to Work With Mobile Security Manager

Use these steps to configure Mobile Security Manager and Microsoft Exchange to work together.

  1. Provide Mobile Security Manager with information about your Exchange server.

    1. Open the Mobile Security Settings page. To learn how, see Section 11.2.2, "How to Open the Mobile Security Settings Page."

    2. Click Exchange Server Settings on the menu bar. (If Exchange Server Settings is not visible, use the arrow buttons to scroll the menu bar to the right. Or, click Down arrow to view additional menu items.)

      The Exchange Server Settings page opens.

    3. Configure the Exchange Server Settings form. Use online help for field descriptions or see the Help Reference for Oracle Mobile Security Suite Consoles.

      Figure 12-8 The Exchange Server Settings page

      Description of Figure 12-8 follows
      Description of ''Figure 12-8 The Exchange Server Settings page''

  2. Modify the Workspace tab of the policy (or policies) to allow the end user access to e-mail on the Exchange server.

    1. Search for the first policy to update. To learn how, see Section 8.7.1, "How to Search for a Policy Record in Mobile Security Manager."

    2. In the search results section expand the policy details by clicking the policy record, then click the Workspace tab to open the Workspace policy.

    3. Expand the Workspace/Apps section and select Email so that it is allowed.

    4. Expand the Application Settings section and select Allow next to PIM .

      In the Email Server URL field, enter the URL for the ActiveSync server, for example: https://mail1.example.com.

    5. Click Apply to save your changes, then repeat the steps for the remaining policies (if any) that need to be updated.

      Figure 12-9 Policy settings that allow users to access e-mail

      Description of Figure 12-9 follows
      Description of ''Figure 12-9 Policy settings that allow users to access e-mail''

  3. Import your Exchange Server's security certificate into the MSAS server's trust store.

    1. Download the Exchange Server certificate to a temp folder on the Oracle Access Management server, for example: /tmp/example-exchange.cer.

    2. Use the following WLST commands to import the certificate to the MSAS server's trust store:

      wls:/offline>connect('@ADMIN_USER','@ADMIN_PWD','t3://@MSM_HOST:@MSM_ADMIN_PORT')
wls:/idmdomain/serverConfig>svc = getOpssService(name='KeyStoreService') 
wls:/idmdomain/serverConfig>svc.importKeyStoreCertificate(appStripe=
 '@MSAS_INSTANCE_NAME',name='ssltruststore',password='pass1234',
 alias='mailca', keypassword='',type='TrustedCertificate',
 filepath='/tmp/example-exchange.cer')

  4. Configure Mobile Security Manager's APNS (Apple Push Notification Service) and GCM (Google Cloud Messaging) settings to receive push notifications from the APNS/GCM servers for new mail or calender requests.

    To configure APNS (for iOS devices):

    1. Open the Mobile Security Settings page. To learn how, see Section 11.2.2, "How to Open the Mobile Security Settings Page."

    2. Click Apple Push Notification Service (APNS) Settings on the menu bar. (If this option is not visible, use the arrow buttons to scroll the menu bar to the right. Or, click Down arrow to view additional menu items.)

      The Apple Push Notification Service (APNS) Settings page opens.

    3. Click Add to create a new row to the settings table. For Certificate Name, enter the name Secure Mail; for Certificate Password, enter the password; for Certificate File, click Choose File and upload the certificate.

      Use online help for field descriptions, or see the Help Reference for Oracle Mobile Security Suite Consoles.

    4. Click Apply to save your changes.

    To configure GCM (for Android devices):

    1. Open the Mobile Security Settings page. To learn how, see Section 11.2.2, "How to Open the Mobile Security Settings Page."

    2. Click Google Cloud Messaging (GCM) Settings on the menu bar. (If this option is not visible, use the arrow buttons to scroll the menu bar to the right. Or, click Down arrow to view additional menu items.)

      The Google Cloud Messaging Service (GCM) Settings page opens.

    3. Click Add to create a new row to the settings table. For Application ID, enter com.nitrodesk.honey.nitroid; for Sender ID, enter the Sender ID value; for API Key, enter the server authentication key that is saved on the third-party application server that gives the application server authorized access to Google services.

      Use online help for field descriptions, or see the Help Reference for Oracle Mobile Security Suite Consoles.

    4. Click Apply to save your changes.

12.6 Configuring Oracle Mobile Security Suite to use Oracle Access Management 11gR2 PS2 for Authentication and SSO

If Oracle Access Management 11gR2 PS2 is already deployed in your environment, Oracle Mobile Security Suite can use that version for authentication and SSO, provided that OMSS is deployed on Oracle Access Management 11gR2 PS3 in a separate WLS domain. This configuration requires the use of Mobile and Social Services on Oracle Access Management 11gR2 PS3.

Before you Begin - Install Oracle Access Management 11gR2 PS3 on Host 1 and Oracle Access Management 11gR2 PS2 on Host 2.

  1. Log on to the Oracle Access Management Console on Host 2 and create a WebGate profile for Mobile and Social Services using the default settings.

    The following options should be selected:

    • Allow Management Operations

    • Allow Token Scope Operations

    • Allow Master Token Retrieval

    • Allow Credential Collector Operations

    In the Access Client Password field, enter a password.

  2. Next you will configure the OAM Authentication Token Service Provider on Host 1 (OAM 11.1.2.3) to use the WebGate on Host 2 to connect to OAM 11.1.2.2.

    Log on to the Oracle Access Management Console on Host 1 and choose MobileSecurity > Mobile and Social Services.

    In the Service Providers section locate OAMAuthentication and click Edit.

    The "out-of-the-box" Oracle Access Manager (OAM) Authentication Token Service Provider Configuration form opens.

    Modify the form as follows:

    • For the OAM_VERSION attribute, keep the default value of OAM_11G.

    • Change the OAM_SERVER_1 attribute value to use the correct OAM host name and port for the Host 2 server, for example:

      oam-host.example.com:5575

    • Change the OAM_LOCAL_MODE attribute value to false.

    • In the WebGate Agent section:

      • Change the WebGate ID value to the name of the WebGate you created using OAM 11gR2 PS2.

      • Replace the Encrypted Password by copying the accessClientPasswd value from the ObAccessClient.xml location on the OAM R2 PS2 server. For example: (ParamName="accessClientPasswd" Value="<Encrypted password value to copy>")

    Figure 12-10 The OAM Authentication Token Service Provider Configuration form

    Description of Figure 12-10 follows
    Description of ''Figure 12-10 The OAM Authentication Token Service Provider Configuration form''

  3. In this step you will modify the OAuth Mobile Service Provider on Host 1 to use Oracle Access Manager on Host 2. This will route Host 1 authentication requests to Host 2.

    Using the Oracle Access Management Console on Host 1, choose MobileSecurity > Mobile OAuth Services > YourDomain > ServiceProviders > OAuthServiceProvider.

    The Mobile Service Provider Configuration form opens.

    Modify the form as follows and click Save:

    • Change the oam.WEBGATE_ID attribute value to the name of the WebGate you created using OAM 11gR2 PS2.

    • Replace the oam.ENCRYPTED_PASSWORD attribute value by copying the accessClientPasswd value from the ObAccessClient.xml location on the OAM R2 PS2 server. For example: (ParamName="accessClientPasswd" Value="<Encrypted password value to copy>")

    • Change the oam.OAM_SERVER_1 attribute value to use the correct OAM host name and port for the OAM 11gR2 PS2 server, for example:

      oam-host.example.com:5575

    • Change the oam.OAM_SERVER_2 attribute value to use the same OAM host name and port for the OAM 11gR2 PS2 server (oam-host.example.com:5575).

    • Change the oam.OAM_LOCAL_MODE attribute value to false.

    Figure 12-11 The OAuth Mobile Service Provider Configuration form

    Description of Figure 12-11 follows
    Description of ''Figure 12-11 The OAuth Mobile Service Provider Configuration form''

  4. On Host 1, you will prepare to merge the credential information from the Host 2 cwallet file into the Oracle Access Manager database. The Host 2 cwallet file was created when you created the WebGate profile on Host 2.

    1. Navigate to the fmwconfig location on Host 1.

      At a command prompt on Host 1 type:

      cp jps-config-jse.xml jps-config-db-mig.xml

    2. On Host 1, create the /tmp/oam directory, then paste the Host 2 cwallet.sso file into /tmp/oam:

      At a command prompt on Host 1 type:

      # mkdir /tmp/oam 
# cp <host>/cwallet.sso /tmp/oam

    3. On Host 1, edit the cwallet.sso file, add the following values, and save the file:

      <serviceInstance location="/tmp/oam" provider="credstoressp" name="credential.file.source">
  <property name="location" value="/tmp/oam" />
</serviceInstance>
 
<jpsContext name="FileSourceContext">
  <serviceInstanceRef ref="credential.file.source"/>
</jpsContext>
 
<jpsContext name="FileDestinationContext">
  <serviceInstanceRef ref="credstore.db"/>
</jpsContext>

  5. Migrate the credentials by running this WLST command on Host 1:

    migrateSecurityStore(type="credStore",
configFile="fmwconfig/jps-config-db-mig.xml", src="FileSourceContext",dst="FileDestinationContext")

  6. Verify that the migration was successful by testing with Enterprise Manager.

    1. Open the Enterprise Manager (EM) console and navigate as follows: welogicdomain > Security > Credentials.

    2. Expand OAMAgent in the Credential Store.

    3. Check that a key was generated that corresponds with the WebGate profile that you created on Host 2 (OAM 11gR2 PS2). For example, if you created a WebGate with WebGate ID "webgate-oauth," you should have a key called "webgate-oauth_Key."

  7. Restart the OAM server on Host 1.