Oracle® Role Manager Integration Guide Release 10g (10.1.4.2) Part Number E14611-07 |
|
|
View PDF |
This chapter contains procedures for manual configuration of the WebLogic application servers for Oracle Identity Manager and Oracle Role Manager in preparation for deployment of the Oracle Role Manager Integration Library (Integration Library). The procedures in this chapter are expected to be performed in the sequence they are presented.
Note:
If you run the automated configuration scripts as described in Chapter 4, you do not need to perform the manual steps in this chapter.This chapter includes the following sections:
The Oracle Role Manager Integration Library is intended to be deployed on the application server on which Oracle Identity Manager is deployed. The procedures in this chapter assume the following:
You have the access to the files in ORMINT_HOME.
You have the appropriate permission to add and modify files in the application servers where Oracle Identity Manager and Oracle Role Manager are deployed.
You have the appropriate permission to stop and start the application servers where Oracle Identity Manager and Oracle Role Manager are deployed.
You have access to the WebLogic Server Administrative Console and know the administrator user ID and password for the domains where Oracle Identity Manager and Oracle Role Manager are deployed.
For clustered environments, the managed servers in the cluster can be started and stopped remotely on the administrative console.
This procedure assumes that a WebLogic server and domain have been created for Oracle Role Manager with a host alias set for port access to Oracle Role Manager.
This section includes the following subsections:
To configure the JMS module connection factory:
Start the Oracle Role Manager server if it is not already started.
In a Web browser, log in to the WebLogic Server Console. For example:
http://appserverhost:7001/console
From Services, select Messaging, then select JMS Modules.
Click ORM JMSModule.
Click New.
Select the Connection Factory option.
Click Next.
In the Name field, enter OIM ConnectionFactory
.
In the JNDI Name field, enter external/srqueues/orm/QueueConnectionFactory
.
Click Next, then click Finish.
Click OIM ConnectionFactory.
Ensure that Default Targeting is enabled.
On the Transactions tab, select XA Connection Factory Enabled.
Click Save.
You should see the new connection factory in the list.
To configure the foreign JNDI providers:
From Services, select Foreign JNDI Providers.
Click New.
In the Name field, enter Remote OIM ForeignJNDIProvider
.
Click OK.
Click Remote OIM ForeignJNDIProvider.
In the Initial Context Factory field, enter weblogic.jndi.WLInitialContextFactory
.
In the Provider URL field, enter t3://
oim_ipaddress
:
oim_port
where
oim_ipaddress
is the IP address of the Oracle Identity Manager application server host
oim_port
is the port for access to the Oracle Identity Manager server
Note:
If you a configuring a clustered server environment, the URL must be in the form t3://oim_ipaddress1:port,oim_ipaddress2:portIn the User field, enter Internal
.
In the Password field, enter the password of the Internal user.
In the Confirm Password field, enter the password again.
Click Save.
Configure the Remote OIM Connection Factory as follows:
From Services, select Foreign JNDI Providers.
Click Remote OIM ForeignJNDIProvider.
On the Links tab, click New.
In the Name field, enter RoleUpdateQCF
.
In the Local JNDI Name field, enter oim/OIMserver/QueueConnectionFactory
.
In the Remote JNDI Name field, enter oim/OIMserver/QueueConnectionFactory
.
Click OK.
Configure the Remote OIM Queue as follows:
On the Links tab, click New.
In the Name field, enter RoleUpdateQueue
.
In the Local JNDI Name field, enter oim/OIMserver/RoleManagerQueue
.
In the Remote JNDI Name field, enter oim/OIMserver/RoleManagerQueue
.
Click OK.
To configure the credentials:
Click the domain on which Oracle Role Manager is deployed.
On the Security tab, expand Advanced.
Clear any value in the Credential field.
In the Credential field, enter the domain credential of the Oracle Identity Manager server.
Note:
The domain credential is generated when the server is started and ensures that by default no two WebLogic server domains have the same credential. In this case, the same credentials are entered for both Oracle Identity Manager and Oracle Role Manager.In the Confirm Credential field, enter the credential again.
Click Save.
Restart the Oracle Role Manager server.
Note:
In you are configuring a clustered environment, perform this procedure for each managed server.To change the subdeployment of the Oracle Identity Manager connection factory:
In the domain tree, select Services, then select Messaging.
Select JMS Modules, then click ORM JMSModule.
Click OIM ConnectionFactory.
Deselect the Default Targeting Enabled box, then click Save.
Click the Subdeployment tab.
In the Subdeployment list, select cf-sub.
Click Save.
This procedure disables transaction authentication for Oracle Role Manager transactions. Disabling transaction authentication is required when the node manager is not accepting connection due to wrong certificate configuration.
Note:
In you are configuring a clustered environment, perform this procedure for each managed node.To disable authentication on the Oracle Role Manager node:
Navigate to WEBLOGIC_HOME
\common\nodemanager
folder and edit the nodemanager.properties file.
Change the value of the AuthenticationEnabled
property to false
.
Restart all the servers on the Oracle Role Manager domain including the admin server.
This procedure assumes that a WebLogic server and domain has been created for Oracle Identity Manager.
For clustered environments, it is assumed that the managed servers in the cluster can be started and stopped remotely on the administrative console and that the Integration Library software has been distributed on all managed nodes.
This section includes the following subsections:
(Clustered Mode Only) Configuring JMS Queues and Connection Factories
(Nonclustered Mode Only) Configuring JMS Queues and Connection Factories
(Clustered Mode Only) Adding the Integration Library System Properties
If you are invoking Oracle Identity Manager using a startup script, you must edit the script to include the path to the Integration Library software and add the Integration Library binaries to the classpath before you can start using the Oracle Role Manager Integration Library. Making this change before the Integration Library software is deployed does not affect the operation of Oracle Identity Manager until it is restarted.
To modify the startup script:
On the Oracle Identity Manager host, navigate to the bin directory on the domain on which Oracle Identity Manager is deployed. For example, WEBLOGIC_HOME/user_projects/domains/oimdomain/bin.
Open the start script for editing
For UNIX-based systems, open xlStartWLS.sh.
For Windows systems, open xlStartWLS.cmd
Note:
If you have a managed server environment where the server is started from this script, open the xlStartManagedWebLogic.sh or xlStartManagedWebLogic.cmd instead.Add the following libraries to the CLASSPATH environment setting:
ORMINT_HOME/lib/commons-logging.jar;ORMINT_HOME/lib/orm_encryption.jar;ORMINT_HOME/lib/server_api_14.jar
where ORMINT_HOME is the full path to the home directory of the Oracle Role Manager Integration Library.
Modify the JAVA_OPTIONS entry as follows:
For UNIX-based systems, add a backslash (\) at the end of the -Djava.awt.headless=true argument.
For Windows system, add a caret (^) at the end of the -Djava.awt.headless=true argument.
Add the following argument to the end of the JAVA_OPTIONS entry:
-DORMINT_ROOT_DIR=ORMINT_HOME
where ORMINT_HOME is the full path to the home directory of the Oracle Role Manager Integration Library.
Optionally, to enable logging for the Integration Library, add the following argument to the end of the JAVA_OPTIONS entry:
-Djava.util.logging.config.file=ORMINT_HOME/config/logging.properties
where ORMINT_HOME is the full path to the home directory of the Oracle Role Manager Integration Library.
Save and close the start script.
Note:
In a clustered server environment, perform this procedure on all managed nodes.To configure the shared libraries:
On the file system where Oracle Identity Manager is deployed, create the following directory if it does not exist:
OIM_appserver/jdk/jre/lib/endorsed
where OIM_appserver/jdk
is the JDK directory for WebLogic, either Sun JDK or WebLogic JRockit.
Copy the following libraries into the endorsed
directory:
ORMINT_HOME/lib/xercesImpl.jar ORMINT_HOME/lib/xml-apis.jar
Restart the Oracle Identity Manager server.
To configure JMS queues and connection factories:
In a Web browser, log in to the WebLogic Server Console. For example:
http://appserverhost:7001/console
Configure a JMS queue connection factory as follows:
From Services, select Messaging, then select JMS Modules.
Click New.
In the Name field, enter OIM-ORM JMS Module
, then click Next.
Assign the JMS module to the Oracle Identity Manager cluster, for example OIM_Cluster, then click Next.
Click Next.
Select the Would you like to add resources box, then click Finish.
On the Settings page, click New.
Select ConnectionFactory, then click Next.
In the Name field, enter ormJMSConnectionFactory
.
In the JNDI Name field, enter /oim/OIMserver/QueueConnectionFactory
.
Click Next, then click Finish.
Click ormJMSConnectionFactory.
On the Transactions tab, select XA Connection Factory Enabled.
Click Save.
Configure a JMS server for each Oracle Identity Manager managed server as follows:
From Services, select Messaging, then select JMS Servers.
Click New.
In the Name field, enter ORMIntegration1
, then click Next.
Click Finish.
Click the newly created JMS server, for example ORMIntegration1.
Select the Targets tab and assign the JMS server to the first Oracle Identity Manager managed server, for example, OIM_Server1.
Click Save.
Repeat these steps for each managed server. For example, create ORMIntegration2 and assign it to OIM_Server2, and so on.
Configure a distributed JMS queue as follows:
From Services, select Messaging, then select JMS Modules.
Click OIM-ORM JMS Module, then click New.
Select Distributed Queue, then click Next.
In the Name field, enter ormJMSQueue
.
In the JNDI Name field, enter oim/OIMserver/RoleManagerQueue
.
Click Next.
Click Advanced Targeting.
Click Create a New Subdeployment.
In the Subdeployment Name field, enter ormJMSQueue subdeployment
.
Click OK.
Select each of the JMS servers created in step 3. For example, ORMIntegration1 and ORMIntegration2.
Click Finish.
To configure JMS queues and connection factories:
In a Web browser, log in to the WebLogic Server Console. For example:
http://appserverhost:7001/console
Configure a JMS queue connection factory as follows:
From Services, select Messaging, then select JMS Modules.
Click New.
In the Name field, enter OIM-ORM JMS Module
, then click Next.
Select AdminServer, then click Next.
Select Would you like to add resources, then click Finish.
On the Settings page, click New.
Choose the ConnectionFactory option, then click Next.
In the Name field, enter ormJMSConnectionFactory
.
In the JNDI Name field, enter /oim/OIMserver/QueueConnectionFactory
.
Click Next, then click Finish.
Click ormJMSConnectionFactory.
On the Transactions tab, select XA Connection Factory Enabled.
Click Save.
Configure a JMS server as follows:
From Services, select Messaging, then select JMS Servers.
Click New.
In the Name field, enter ORMIntegration
.
Click Finish.
Click ORMIntegration.
On the Targets tab, select AdminServer from the Targets list.
Click Save.
Configure a JMS queue as follows:
From Services, select Messaging, then select JMS Modules.
Click OIM-ORM JMS Module, then click New.
Choose the Queue option, then click Next.
In the Name field, enter ormJMSQueue
.
In the JNDI Name field, enter oim/OIMserver/RoleManagerQueue
.
Click Next.
Click Create a New Subdeployment.
In the Subdeployment Name field, enter ormJMSQueue subdeployment
.
Click OK, then click Next.
Select ORMIntegration as the JMS Server.
Click Finish.
To configure Foreign JMS queues and connection factories:
Configure a foreign JNDI provider as follows:
From Services, select Foreign JNDI Providers, then click New.
In the Name field, enter OIM ORM server
.
Click OK.
Click OIM ORM server.
In the Initial Context Factory field, enter weblogic.jndi.WLInitialContextFactory
.
In the Provider URL field, enter t3://
orm_ipaddress
:
orm_port
where
orm_ipaddress
is the IP address of the Oracle Role Manager application server host
orm_port
is the port for access to the Oracle Role Manager administrative console and Web UI.
Note:
If you a configuring a clustered server environment, the URL must be in the form t3://orm_ipaddress1:port,orm_ipaddress2:portIn the User field, enter the user name of the WebLogic Administrator.
In the Password field and Confirm Password field, enter the password of the WebLogic Administrator.
Click Save.
Configure foreign JNDI links as follows:
From Services, select Foreign JNDI Providers.
Click OIM ORM server.
On the Links tab, click New.
In the Name field, enter OIMORMQueueConnectionFactory
.
In the Local JNDI Name field, enter external/srqueues/orm/QueueConnectionFactory
.
In the Remote JNDI Name field, enter external/srqueues/orm/QueueConnectionFactory
.
Note:
The locale and remote JNDI names must be the same as the JNDI name set in Section 7.2.1, "Configuring the JMS Connection Factory."Click OK.
On the Links tab, click New.
In the Name field, enter OIM ORM Queue
.
In the Local JNDI Name field, enter orm/queue/IncomingEventQueue
.
In the Remote JNDI Name field, enter orm/queue/IncomingEventQueue
.
Click OK.
Click the domain where the Oracle Identity Manager server resides.
On the Security tab, expand the Advanced link at the bottom of the page.
In the Credential field, clear any existing credential, then enter the same domain credential that was used for the Oracle Role Manager server (see step 4 of Section 7.2.3).
Note:
The domain credential is generated when the server is started and ensures that by default no two WebLogic server domains have the same credential. In this case, the same credentials are entered for both Oracle Identity Manager and Oracle Role Manager.In the Confirm Credential field, enter the credential again.
Click Save.
If you have a non-clustered server environment, restart the Oracle Identity Manager server. For clustered server environments, continue configuration steps in the next section before restarting the server.
Note:
Perform this procedure on all managed nodes.To add the Integration Library JVM system properties:
Log on to the WebLogic Server administrative console using a Web browser.
For each managed server, configure the system properties as follows:
On the Oracle Identity Manager domain of the primary node, select the domain name, then select Servers.
Select the first managed server, for example, OIM_Server1.
On the Configuration tab, click the Server Start subtab.
In the ClassPath field, add the following Integration Library paths to the existing classpath settings:
ORMINT_HOME\lib\commons-logging.jar ORMINT_HOME\lib\orm_encryption.jar ORMINT_HOME\lib\server_api_14.jar
In the Arguments field, append the following argument to any existing arguments:
-DORMINT_ROOT_DIR=ORMINT_HOME
where ORMINT_HOME
is the Integration Library installation directory. For example, C:/ORMINT_HOME.
Optionally, to enable logging for the Integration Library, in the Arguments field, add the following argument:
-Djava.util.logging.config.file=ORMINT_HOME/config/logging.properties
where ORMINT_HOME
is the Integration Library installation directory. For example, C:/ORMINT_HOME.
Click Save.
Restart the node manager on each managed server, then start each managed server.
To deploy the Integration Library application:
On the Oracle Identity Manager host, create the EAR file for the Integration Library application that contains JAR files from Oracle Identity Manager as follows:
In a command window, navigate to ORMINT_HOME/bin.
Run the following command:
For UNIX-based systems: sh create_ear.sh OIM_HOME/xellerate
For Windows systems: create_ear.bat OIM_HOME/xellerate
where OIM_HOME is the root installation directory for Oracle Identity Manager.
From the Oracle Identity Manager host, connect to the WebLogic Server Console in a Web browser. For example:
http://appserverhost:7001/console
Select Deployments.
Click Install.
Browse to navigate to the ORMINT_HOME/lib directory.
Choose roleManagerIntegration_WebLogic10.3.ear, then click Next.
Choose Install this deployment as an application, then click Next.
In the Target list, select the target server on which to deploy Oracle Role Manager, then click Next.
Note:
If you are configuring a clustered environment, select the cluster for Oracle Role Manager from the Target list.Accept the defaults on the next page, then click Next.
Click Finish.
Click Deployments.
You should see indication of successful deployment
If you have a clustered server environment, restart the admin server and all managed servers.