Oracle® Application Server High Availability Guide 10g (10.1.4.0.1) Part Number B28186-01 |
|
|
View PDF |
This chapter provides high-level instructions for installing Oracle Identity Management components with Oracle Internet Directory multimaster replication. This chapter assumes that you are familiar with Oracle Application Server components, including: Oracle Internet Directory, OracleAS Single Sign-On, Oracle Delegated Administration Services, and Oracle Directory Integration Platform. You should also be familiar with Oracle Internet Directory replication concepts.
You might find the following documentation pointers useful:
For information on | See: |
---|---|
Running a replicated Oracle Internet Directory |
|
Deploying Oracle Identity Management with fan-out replication | Oracle Identity Management Infrastructure Administrator's Guide |
Using Oracle Directory Integration Platform with Oracle Internet Directory | Oracle Identity Management Integration Guide |
Using Oracle Delegated Administration Services with Oracle Internet Directory | Oracle Identity Management Guide to Delegated Administration |
Keep the following points in mind when using the command-line tools mentioned in this chapter:
The ORACLE_HOME
, MASTER_HOME
, and REPLICA_HOME
variables designate absolute Oracle home paths.
Use the appropriate path separator while running the commands. The notation in this chapter is based on the UNIX path variable notation. For example, the ldapadd
tool is located in the ORACLE_HOME/bin
directory in the UNIX environment. In the Windows environment, this tool is located in the ORACLE_HOME\bin
directory.
The PATH
environment variable should include the ORACLE_HOME/bin
, ORACLE_HOME/ldap/bin
, and ORACLE_HOME/opmn/bin
directories.
Include $ORACLE_HOME/lib
in the appropriate library environment variable. For example, in the Solaris environment, include $ORACLE_HOME/lib
in the LD_LIBRARY_PATH
environment variable.
This chapter contains the following sections:
Section 10.1, "Multimaster Identity Management Replication Configuration"
Section 10.2, "Adding a Node to a Multimaster Replication Group"
Section 10.3, "Deleting a Node from a Multimaster Replication Group"
Figure 10-1 shows an Oracle Application Server topology with Oracle Internet Directory and OracleAS Single Sign-On running in multimaster replication mode. The master Oracle Internet Directory instance runs on Host 1, the replica on Host 3. Each Oracle Internet Directory instance has its own database. A load balancer directs LDAP requests to the Oracle Internet Directory instances.
Host 2 and Host 4 run OracleAS Single Sign-On and Oracle Delegated Administration Services. On Host 2, these components use the Oracle Internet Directory on Host 1. Similarly, on Host 4, these components use the Oracle Internet Directory on Host 3. Note that these components access Oracle Internet Directory directly, without going through the load balancer. This means that OracleAS Single Sign-On and Oracle Delegated Administration Services on Host 2 always access the Oracle Internet Directory on Host 1, and the same components on Host 4 always access the Oracle Internet Directory on Host 3. You can think of Host 1 and Host 2 as one "stack", and Host 3 and Host 4 as another "stack".
Because OracleAS Single Sign-On and Oracle Delegated Administration Services on Host 2 and Host 4 use different metadata repositories, you cannot place them in the same OracleAS Cluster. Figure 10-1 shows them in different clusters. On Host 2, OracleAS Single Sign-On and Oracle Delegated Administration Services are in a cluster called dcmCluster1
, and on Host 4, they are in a different cluster called dcmCluster2
. In Figure 10-1 each cluster contains only one Oracle Application Server instance. You can add more instances to each cluster, if you want. See Section 10.1.10, "Installing Additional OracleAS Single Sign-On / Oracle Delegated Administration Services Instances in Each Replication Stack" for details.
A load balancer directs requests to OracleAS Single Sign-On and Oracle Delegated Administration Services on Host 2 and Host 4. The load balancer can direct requests to these components on either host (despite the fact that these components on each host use different Oracle Internet Directory instances and do not belong to the same cluster) because these components reference a replicated Oracle Internet Directory / OracleAS Single Sign-On environment, which keeps the Oracle Internet Directory-managed data in the two databases synchronized.
See Section 10.1.9, "Load Balancer Configuration in a Multimaster Replication Scenario" for details on configuring the load balancers in this topology.
Steps to Create this Topology
To create this topology, perform these steps:
Table 10-1 Steps for Creating Multimaster Topology
Step | See this section | |
---|---|---|
1. |
Install Oracle Internet Directory and Oracle Directory Integration Platform on the master node (Host 1). |
Section 10.1.1, "Installing on the Master Node" |
2. |
Install Oracle Internet Directory and Oracle Directory Integration Platform on the replica node (Host 3). |
Section 10.1.2, "Installing on the Replica Node" |
3. |
Configure Oracle Internet Directory for replication. |
Section 10.1.3, "Setting up Multimaster Replication" |
4. |
Install OracleAS Single Sign-On and Oracle Delegated Administration Services on Host 2. |
|
5. |
Synchronize the OracleAS Single Sign-On password. |
Section 10.1.5, "Synchronizing the OracleAS Single Sign-On Schema Password" |
6. |
Install OracleAS Single Sign-On and Oracle Delegated Administration Services on Host 4. |
|
Install Oracle Internet Directory and Oracle Directory Integration Platform on the master node as follows:
In the Oracle Application Server installer on Host 1: select Identity Management and Metadata Repository in the Select Installation Type screen, and select Oracle Internet Directory and Oracle Directory Integration Platform in the Select Configuration Options screen. This chapter refers to this Oracle home on Host 1 as the MASTER_HOME.
Do not install any other Identity Management components such as OracleAS Single Sign-On or Oracle Delegated Administration Services on Host 1.
Install Oracle Internet Directory with OracleAS Metadata Repository on the replica node as follows:
In the Oracle Application Server installer on Host 3:
Select Identity Management and Metadata Repository in the Select Installation Type screen.
Select Oracle Internet Directory, Oracle Directory Integration Platform, High Availability and Replication in the Select Configuration Options screen.
This chapter refers to this Oracle home on Host 3 as the REPLICA_HOME. This Oracle home will have only Oracle Internet Directory with OracleAS Metadata Repository and Oracle Directory Integration Platform. The OracleAS Metadata Repository database should have a unique global database name.
Do not install any other Oracle Identity Management components, such as OracleAS Single Sign-On and Oracle Delegated Administration Services on Host 3.
Note: When installing the replica, be sure to select High Availability and Replication in the Select Configuration Options screen so that the installer will prompt you for the replication type. It will ask you to select ASR Replica or LDAP Replica. Select ASR Replica. |
To set up the master and the replica nodes for replication, perform the following tasks described in the Oracle Internet Directory Administrator's Guide:
Item | Name |
---|---|
Book | Oracle Internet Directory Administrator's Guide
This book is available in the Oracle Application Server documentation set. |
Chapter | 30, "Oracle Internet Directory Replication Installation and Configuration" |
Section | 30.3.2, "Installing and Configuring a Multimaster Replication Group" |
Task | Task 3: Set Up Oracle Database Advanced Replication for a Directory Replication Group
Task 5: Ensure that Oracle Directory Server Instances Are Started on All the Nodes Task 6: Start the Replication Servers on All Nodes in the DRG Task 7: Test Directory Replication |
On the master node (Host 2 in Figure 10-1), install OracleAS Single Sign-On and Oracle Delegated Administration Services so that these components use the OracleAS Metadata Repository and Oracle Internet Directory on Host 1. To do this, make the following selections in the installation screens:
Specify File Locations - enter the destination directory where you want to install OracleAS Single Sign-On and Oracle Delegated Administration Services.
Select a Product to Install - select Oracle Application Server Infrastructure.
Select Installation Type - select Identity Management.
Confirm Pre-Installation Requirements - verify that you meet the requirements and select all the checkboxes.
Select Configuration Options - select OracleAS Single Sign-On, Oracle Delegated Administration Services, and High Availability and Replication.
Specify Port Configuration Options - select Automatic.
Select High Availability Option - select OracleAS Cluster (Identity Management).
Create or Join an Oracle Application Server Cluster (Identity Management) - select Create a New Oracle Application Server Cluster.
Specify New Oracle Application Server Cluster Name - enter a name for the new cluster (for example: dcmCluster1
).
Specify LDAP Virtual Host and Ports - enter the physical hostname of Host 1 (not the virtual name configured on the load balancer), and the necessary ports for Oracle Internet Directory.
Specify Oracle Internet Directory Login - enter the login and password for Oracle Internet Directory.
Specify HTTP Listen Port, Load Balancer Host and Port - enter the port number that you want to use for Oracle HTTP Server in HTTP Listener Port. In HTTP Load Balancer Hostname and Port, enter the HTTP virtual hostname configured on the load balancer and the port number configured for the virtual hostname.
Specify Instance Name and ias_admin Password - enter a name for this Oracle Application Server instance, and the password for the ias_admin user.
To synchronize the OracleAS Single Sign-On schema password between the master Metadata Repository database (MDS) and the replica Metadata Repository database (RMS), follow the steps in the following section:
Item | Name |
---|---|
Book | Oracle Application Server Single Sign-On Administrator's Guide
This book is available in the Oracle Application Server documentation set. |
Chapter | 9, "Advanced Deployment Options" |
Section | 9.2.2, "Configuring the Identity Management Database for Replication" |
Step | Perform step 2. |
Whenever you add a new OracleAS Single Sign-On and Oracle Delegated Administration Services replica, you must first perform this step from the master Oracle home on the replica to synchronize the OracleAS Single Sign-On schema password with the OracleAS Metadata Repository.
Note: If you encounter errors, the OracleAS Metadata Repository might be misconfigured. Either the MDS or RMS might not have the correct database information, as used by OracleAS Single Sign-On. |
Install OracleAS Single Sign-On and Oracle Delegated Administration Services on the replica node as follows:
On Host 4, install OracleAS Single Sign-On and Oracle Delegated Administration Services so that these components use the Metadata Repository and Oracle Internet Directory on the replica node (Host 3 in Figure 10-1). To do this, follow the screen sequence shown in Section 10.1.4, "Installing OracleAS Single Sign-On and Oracle Delegated Administration Services on the Master Node", with the following differences:
In step 8, you also create a new cluster. You cannot join this instance (on Host 4) with the instance on Host 2 in the same cluster because the instances use different OracleAS Metadata Repositories.
In step 9, enter a different cluster name (for example: dcmCluster2
).
In step 10, enter the physical hostname for Host 3 instead of Host 1, because you want OracleAS Single Sign-On and Oracle Delegated Administration Services to use the Oracle Internet Directory running on Host 3.
Synchronize the mod_osso
configuration from the master middle tier, as described in the following section:
Item | Name |
---|---|
Book | Oracle Application Server Single Sign-On Administrator's Guide
This book is available in the Oracle Application Server documentation set. |
Chapter | 9, "Advanced Deployment Options" |
Section | 9.1.2.3, "Configuration Steps" |
Step | Reregister mod_osso on the single sign-on middle tiers |
Repeat this procedure to install additional OracleAS Single Sign-On and Oracle Delegated Administration Services instances, as needed.
If you selected the SSL option when installing the OracleAS Single Sign-On and Oracle Delegated Administration Services components, be aware of the following situation that can cause an error when running in SSL mode.
When both nodes (Node 2 and Node 4 in Figure 10-1) running OracleAS Single Sign-On and Oracle Delegated Administration Services are active, you may see the following error in the browser when you try to access the OracleAS Single Sign-On Administrator page from the /pls/orasso
URL:
Service Temporarily Unavailable The server is temporarily unavailable to service your request due to maintenance downtime or capacity problems. Please try again later.
In the error_log
file, you may see the following error:
mod_plsql: /pls/orasso/ORASSO.home HTTP-503 ORA-20000 Call to WPG_SESSION API Failed.
To fix this problem, check that your load balancer's persistence setting is configured correctly. If you are using OracleAS Web Cache as the load balancer, ensure that the session is set to "Any Set-Cookie", as shown in Figure 10-2.
If you are using a hardware load balancer, check the load balancer documentation and confirm that the load balancer's persistence setting is set to a value that supports SSL communication. If you are not sure which value to specify, contact the load balancer vendor directly.
For more information, see OracleMetaLink Note 372956.1. You can access OracleMetaLink at http://metalink.oracle.com
.
Figure 10-2 In OracleAS Web Cache, Configure the Session to "Any Set-Cookie"
Oracle Directory Integration Platform supports high availability in an Oracle Internet Directory multimaster replicated scenario, with certain drawbacks. In this high availability scenario, when changes are applied to Oracle Internet Directory on one node, the changes get propagated to the other consumer nodes. The Oracle Directory Integration Platform server running on each node is responsible for event propagation to the configured applications on that node. That is, the applications that have provisioning profiles on that Oracle Internet Directory node will be informed of the changes happening on that Oracle Internet Directory node.
Figure 10-1 shows two load balancers: one for HTTP requests and one for LDAP requests. Note the following points when you configure these load balancers:
The LDAP load balancer does not accept requests from OracleAS Single Sign-On and Oracle Delegated Administration Services.
OracleAS Single Sign-On and Oracle Delegated Administration Services should not use the LDAP load balancer because they need to send requests only to the Oracle Internet Directory in the same "stack", where a stack consists of OracleAS Single Sign-On and its corresponding Oracle Internet Directory. You associated this OracleAS Single Sign-On with its Oracle Internet Directory during installation (see step 10).
For example, in Figure 10-1, OracleAS Single Sign-On and Oracle Delegated Administration Services on Host 2 and the Oracle Internet Directory on Host 1 make up one stack, and OracleAS Single Sign-On and Oracle Delegated Administration Services on Host 4 and the Oracle Internet Directory on Host 3 make up another stack.
All other LDAP requests (other than the ones from OracleAS Single Sign-On / Oracle Delegated Administration Services) should go through the LDAP load balancer. For example, requests from OracleAS Portal should go through the LDAP load balancer.
The HTTP load balancer should monitor both the OracleAS Single Sign-On servers and the Oracle Internet Directory servers on all nodes. It needs to do this so that it can ensure that the HTTP and LDAP requests are routed to the same "stack". For example, if the Oracle Internet Directory on Host 1 is down, then the HTTP load balancer should route HTTP requests only to the OracleAS Single Sign-On server on Host 4 because its Oracle Internet Directory server on Host 3 is up.
The HTTP load balancer should be configured for persistent routing of HTTP requests.
For details on deploying applications in a replicated environment, see section 3.3.2.7, "Application Deployments in Replicated Directory Environments", in the Oracle Identity Management Infrastructure Administrator's Guide.
You can add OracleAS Single Sign-On and Oracle Delegated Administration Services instances to each of the OracleAS Clusters that you created previously in Section 10.1.4 and Section 10.1.6. Each cluster will provide redundancy for OracleAS Single Sign-On and Oracle Delegated Administration Services in each replica's stack.
To do this, follow the generic indications and recommendations for Distributed OracleAS Cluster (Identity Management) installations as described in the Oracle Application Server Installation Guide, and make the following selections in the installation screens:
Specify File Locations - enter the destination directory where you want to install OracleAS Single Sign-On and Oracle Delegated Administration Services.
Select a Product to Install - select Oracle Application Server Infrastructure.
Select Installation Type - select Identity Management.
Confirm Pre-Installation Requirements - verify that you meet the requirements and select all the checkboxes.
Select Configuration Options - select OracleAS Single Sign-On, Oracle Delegated Administration Services, and High Availability and Replication.
Specify Port Configuration Options - select Automatic.
Select High Availability Option - select OracleAS Cluster (Identity Management).
Create or Join an Oracle Application Server Cluster (Identity Management) - select Join an Oracle Application Server Cluster.
Specify Existing OracleAS Cluster Name - enter the name of the cluster (for example: dcmCluster1
for the master (Host 1/Host 2) stack, or dcmCluster2
for the replica (Host 3/Host 4) stack).
Specify LDAP Virtual Host and Ports - enter the physical hostname of Host 1 (not the virtual name configured on the load balancer), and the necessary ports for Oracle Internet Directory. If you are installing on the replica stack, enter the physical hostname of Host 3.
Specify Oracle Internet Directory Login - enter the login and password for Oracle Internet Directory.
Specify HTTP Listen Port, Load Balancer Host and Port - enter the port number that you want to use for Oracle HTTP Server in HTTP Listener Port. In HTTP Load Balancer Hostname and Port, enter the HTTP virtual hostname configured on the load balancer and the port number configured for the virtual hostname.
Specify Instance Name and ias_admin Password - enter a name for this Oracle Application Server instance, and the password for the ias_admin user.
To add a replication node to a functioning directory replication group (DRG), follow these steps.
First, install the new node.
Install Identity Management and Metadata Repository. This installation will have only the Metadata Repository, Oracle Internet Directory and Oracle Directory Integration Platform. The replica node Metadata Repository should have a unique global database name.
Do not install other Identity Management components such as OracleAS Single Sign-On or Oracle Delegated Administration Services.
Prepare the environment for adding a node.
Configure the Oracle Net Services environment as described in Task 3, Installing and Configuring a Multimaster Replication Group, in the "Oracle Internet Directory Replication Administration" chapter of Oracle Internet Directory Administrator's Guide.
Stop the directory replication server on all nodes
Identify a sponsor node and switch the sponsor node to read-only mode
Note: While the sponsor node is in read-only mode, do not make any updates to it. You may, however, update any of the other nodes, but those updates are not replicated immediately. Also, the sponsor node and the MDS can be the same node.
Back up the sponsor node by using ldifwrite
. Enter the following command:
ORACLE_HOME/bin/ldifwrite -c connect_string \ -b "orclagreementid=000001,cn=replication configuration" \ -f output_ldif_file
Add the node into the replication group.
Perform the Advanced Replication add node setup on the sponsor node by typing:
ORACLE_HOME/bin/remtool -addnode
The Replication Environment Management Tool adds the node to the DRG.
Note: Note: If you encounter errors, then useremtool -asrverify . If it reports errors, then rectify them by using remtool -asrrectify . Both of those options list all the nodes in the DRG. If the node to be deleted is in the list, then delete it by running remtool -delnode again. |
Switch the sponsor node to updatable mode.
Start the directory replication server on all nodes except the new node.
Stop oidmon
Load data into the new node, as follows:
First do a check and generate by typing:
ORACLE_HOME/ldap/bin/bulkload.sh \
-connect <db_connect_string_of_new_node> \
-check -generate -restore \
absolute_path_to_the_ldif_file_generated_by_ldifwrite
Note: Verify that theORACLE_HOME/ldap/log/bulkload.log does not report any errors. It is possible that you might see Duplicate entry errors in the log for some of the entries. You can safely ignore this error and proceed with the load. |
Now load the data on the target node by typing:
ORACLE_HOME/ldap/bin/bulkload.sh \ -connect db_connect_string_of_new_node \ -load -restore \ absolute_path_to_the_ldif_file_generated_by_ldifwrite
Start the directory server on the new node by typing the following command:
ORACLE_HOME/opmn/bin/opmnctl startproc ias-component=OID
Start the directory replication server on the new node by typing:
ORACLE_HOME/bin/oidctl connect=db_connect_string_of_new_node \ server=oidrepld instance=1 \ flags='-h host_name_of_new_node -p port' start
Install a new middle tier, based on the new replica node.
Synchronize the OracleAS Single Sign-On schema passwords from MDS to the new node as described in Section 10.1.5, "Synchronizing the OracleAS Single Sign-On Schema Password".
Install OracleAS Single Sign-On and Oracle Delegated Administration Services as described in Section 10.1.6, "Installing OracleAS Single Sign-On and Oracle Delegated Administration Services on the Replica Node".
Configure the HTTP load balancer to distribute incoming traffic to this newly installed node.
You can delete a node from a DRG, provided the DRG contains more than two nodes. You might need to do so if the addition of a new node did not fully succeed as a result of system errors. To delete a replication node, perform these steps:
Stop the directory replication server on all nodes. To do that, run the following command on each node in the DRG:
ORACLE_HOME/bin/oidctl connect=connect_string server=oidrepld instance=1 stop
Note: The instance number may vary. |
Stop all processes on the node to be deleted.
Stop all processes in the associated middle tier Oracle homes.
ORACLE_HOME/opmn/bin/opmnctl stopall
On the node to be deleted, stop all Oracle Application Server processes including Oracle Internet Directory Monitor and all directory server instances.
ORACLE_HOME/opmn/bin/opmnctl stopall
Delete the node from the master definition site. From the MDS, run the following command:
ORACLE_HOME/bin/remtool -delnode
Note: If you encounter errors, then useremtool -asrverify . If it reports errors, then rectify them by using remtool -asrrectify . Both of those options list all nodes in the DRG. If the new node is not in the list, then add it by running remtool -addnode again. |
Start the directory replication server on all nodes by typing the following command:
ORACLE_HOME/bin/oidctl connect=connect_string server=oidrepld \ instance=1 flags='-h host -p port' start
Decommission the removed node and its associated middle tier. You can optionally decommission the removed replicated node and associated middle tier by deinstalling the corresponding Oracle homes.