Oracle Adaptive Access Manager (OAAM) is built on a Java EE-based, multi-tiers deployment architecture that separates the platform's presentation, business logic, and data tiers. Because of this separation of tiers, OAAM can rapidly scale with the performance needs of the customer. The architecture can leverage the most flexible and supported cross-platform Java EE services available: a combination of Java, XML and object technologies. This architecture makes OAAM a scalable, fault-tolerant solution.
OAAM Apps is divided into following two components.
OAAM Administration Applications
OAAM Server Applications
This chapter describes the procedure to extend an existing IDM domain to include Oracle Adaptive Access Manager.
This chapter contains the following topics:
Section 12.2, "Configuring Oracle Adaptive Access Manager on IDMHOST1"
Section 12.4, "Configuring Oracle Adaptive Access Manager on OAAMHOST2"
Section 12.5, "Configuring OAAM to Work with the Oracle HTTP Server"
Section 12.6, "Loading Oracle Adaptive Access Manager Seed Data"
Section 12.7, "Backing Up the Application Tier Configuration"
Before you extend the domain to include Oracle Adaptive Access Manager (OAAM), the following prerequisites must be in place.
Create a highly available database to hold the OAAM data. Pre-seed the database with OAAM data objects using the repository creation utility as described in Section 3.3.
Install Oracle WebLogic Server, Oracle Fusion Middleware for Identity Management, and Oracle Management Suite as described in Chapter 4.
Install Oracle HTTP Server on WEBHOST1 and WEBHOST2 as described in Chapter 5.
Create a WebLogic domain described in Chapter 6.
Install and Configure Identity Store (Oracle Internet Directory or Oracle Virtual Directory).
Install and configure Policy Store as described in Section 10.3, "Preparing the OPSS Policy Store."
Create Oracle Adaptive Access Manager Administrative groups and user in LDAP as described in Section 10.4.3, "Creating Users and Groups for Oracle Adaptive Access Manager."
Although OAAM is deployed on servers dedicated to it (OAAMHOST1 and OAAMHOST2), the Weblogic domain must first be extended with OAAM on IDMHOST1. This section describes how to configure Oracle Adaptive Access manager on IDMHOST1.
This section contains the following topics:
Section 12.2.1, "Extending Domain for Oracle Adaptive Access Manager"
Section 12.2.2, "Starting Administration Server on IDMHOST1"
Section 12.2.3, "Creating OAAM Administration User in WebLogic Console"
Section 12.2.4, "Configuring Oracle Adaptive Access Manager on OAAMHOST1"
Start the configuration wizard by executing the command:
MW_HOME/oracle_common/common/bin/config.sh
Then proceed as follows:
On the Welcome Screen, select Extend an Existing WebLogic Domain. Click Next
On the Select a WebLogic Domain screen, using the navigator select the domain home of the Administration Server, for example: ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain.
Click Next.
On the Select Extension Source screen, select the following:
Oracle Adaptive Access Manager - Server
Oracle Adaptive Access Manager Admin Server
Oracle WSM Policy Manager
Oracle Identity Navigator
Click Next
The Configure RAC Multi Data Sources screen displays the schedulerDS Data Source configured for Oracle Directory Integration Platform and Oracle Directory Services manager (ODSM). Do not make any selections or changes on this screen.
Click Next.
On the Configure JDBC Component Schema screen, select all of the data sources, then select Configure selected data sources as RAC multi data sources.
Click Next.
On the Configure RAC Multi Data Source Component Schema page (Real Applications Cluster Databases only), select all the schemas for your component. Do not select schemas listed for previously configured components. Then enter the following information:
| Schema Name | Service Name | Host Names | Instance Names | Port | Schema Owner | Password |
|---|---|---|---|---|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
||||
|
|
|
|
|
|
|
|
|
|
|
|
||||
|
|
|
|
|
|
|
|
|
|
|
|
||||
|
|
|
|
|
|
|
|
|
|
|
|
If you are using Oracle Database 11.2, replace the vip addresses with the 11.2 SCAN address.
Click Next.
On the Test Component Schema screen, the configuration wizard attempts to validate the data source. If the data source validation succeeds, click Next. If it fails, click Previous, correct the issue, and try again.
On the Select Optional Configuration screen, select Managed Server Clusters and Machines. Click Next
When you first enter the Configure Managed Servers screen, the configuration wizard has created a default Managed Server for you. Change the details of the default managed server.
Note:
When you first enter this screen the config wizard has created a default Managed Server for you.
Change the details of the default Managed Server to reflect the following details. That is, change one entry and add one new entry.
Do not change the configuration of any Managed Servers which have already been configured as part of previous application deployments.
For the oaam_server_server1 entry, change the entry to the following values:
Name: WLS_OAAM1
Listen Address: OAAMHOST1
Listen Port:14300
SSL Listen Port: 14301
SSL Enabled: Selected.
For the second OAAM Server, click Add and supply the following information:
Name: WLS_OAAM2
Listen Address: OAAMHOST2
Listen Port: 14300
SSL Listen Port: 14301
SSL Enabled: selected
Select the oaam_admin_server1 entry.
Change the entry to the following values:
Name: WLS_OAAM_ADMIN1
Listen Address: OAAMHOST2
Listen Port:14200
SSL Listen Port: 14201
SSL Enabled: Selected
For the OAAM Administration Server, click Add and supply the following information:
Name: WLS_OAAM_ADMIN2
Listen Address: OAAMHOST2
Listen Port: 14200
SSL Listen Port: 14201
SSL Enabled - selected
Leave all the other fields at the default settings and click Next.
On the Configure Clusters screen, create a cluster by clicking Add.
Name: cluster_oaam.
Cluster Messaging Mode: unicast
Create a second cluster by clicking Add.
Name: cluster_oaam_admin
Cluster Messaging Mode: unicast
Leave all other fields at the default settings and click Next.
On the Assign Servers to Clusters screen, associate the Managed Servers with the cluster. Click the cluster name in the right pane. Click the Managed Server under Servers, then click the arrow to assign it to the cluster.
The cluster_oaam has the Managed Servers WLS_OAAM1 and WLS_OAAM2
The cluster_oaam_admin has the Managed Servers WLS_OAAM_ADMIN1 and WLS_OAAM_ADMIN2
Note:
Do not change the configuration of any clusters which have already been configured as part of previous application deployments.
Click Next.
On the Configure Machines screen, create a machine for each host in the topology. Click the tab UNIX if your hosts use a UNIX-based operating system. Otherwise, click the Machines tab. Supply the following information:
Name: Name of the host. Best practice is to use the DNS name (oaamhost1.mycompany.com).
Node Manager Listen Address: The DNS name of the machine (oaamhost1.mycompany.com)
Node Manager Port: A port for Node Manager to use
Click Next.
On the Assign Servers to Machines screen, indicate which Managed Servers to run on each of the machines you created.
Click a machine in the right pane.
Click the Managed Servers you want to run on that machine in the left pane.
Click the arrow to assign the Managed Servers to the machines.
Repeat until all Managed Servers are assigned to machines.
For example:
oaamhost1: WLS_OAAM1 and WLS_OAAM_ADMIN1
oaamhost2:WLS_OAAM2 and WLS_OAAM_ADMIN2
Click Next to continue.
On the Configuration Summary screen, click Extend to extend the domain.
Note:
Note: If you receive a warning that says:
CFGFWK: Server listen ports in your domain configuration conflict with ports in use by active processes on this host
Click OK.
This warning appears if Managed Servers have been defined as part of previous installs and can safely be ignored.
Restart WebLogic Administration Server on IDM Host 1. See Section 20.1, "Starting and Stopping Oracle Identity Management Components."
Before you can access the OAAM administration console, you must create an administration user. Creating this user here enables you to use the OAAM administration console at this point. If you wire OAAM to Oracle Access Manager or you configure the Default Authenticator as described in chapter 19 then this user becomes redundant and if desired can be removed.
You create an administration user as follows:
Log in to Oracle WebLogic console at the URL: http://idmhost1.mycompany.com:7001/console as the weblogic user.
From the domain structure menu, select Security Realms
Click myrealm.
Click the Users and Groups tab.
Click New.
Enter the following information:
Name: oaamadmin
Description: OAAM Administrative user.
Provider: DefaultAuthenticator
Password/Confirmation: The password you want to assign to the user.
Click OK.
Click the newly created user oaamadmin.
Click the Groups tab.
Assign all groups with the OAAM prefix to the user. Do this by selecting each group and clicking > to move it to the chosen group. The groups are:
OAAMCSRGroup
OAAMCSRInvestigatorGroup
OAAMCSRManagerGroup
OAAMEnvAdminGroup
OAAMInvestigationManagerGroup
OAAMRuleAdministratorGroup
OAAMSOAPServicesGroup
Click Save.
Once the configuration has succeeded on IDMHOST1, you can propagate it to OAAMHOST1. You do this by packing the domain on IDMHOST1, using the pack script, and unpacking it on OAAMHOST1 using the unpack script. Both scripts reside in ORACLE_COMMON_HOME/common/bin.
On IDMHOST1, type:
pack.sh -domain=ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain -template=/tmp/IDMDomain.jar -template_name="OAAM Domain" -managed=true
This creates a file called IDMDomain.jar in the /tmp directory. Copy this file to OAAMHOST1.
On OAAMHOST1, type:
unpack.sh -domain=ORACLE_BASE/admin/IDMDomain/mserver/IDMDomain -template=/tmp/IDMDomain.jar -app_dir=ORACLE_BASE/admin/IDMDomain/mserver/applications
This section contains the following topics:
Section 12.3.1, "Creating Node Manager Properties File on OAAMHOST1"
Section 12.3.2, "Starting Oracle Adaptive Access Manager on OAAMHOST1"
Start the Node Manager to create the nodemanager.properties file on OAAMHOST1 by using the startNodemanager.sh script located under the MW_HOME/wlserver_10.3/server/bin directory.
Before you can start the Managed Servers by using the console, node manager requires that the property StartScriptEnabled is set to true. You set it by running the setNMProps.sh script located under the MW_HOME/oracle_common/common/bin directory.
prompt> MW_HOME/oracle_common/common/bin
prompt> ./setNMProps.sh
Stop and Start the Node Manager as described in Section 20.1, "Starting and Stopping Oracle Identity Management Components"so that the properties take effect.
Start Oracle Adaptive Access Manager on OAAMHOST1 by following the start procedures in Section 20.1, "Starting and Stopping Oracle Identity Management Components" for:
Node Manager
WebLogic Managed Servers WLS_OAAM1 and WLS_OAAM_ADMIN1
Validate the implementation by connecting to the OAAM Administration Server at http://OAAMHOST1.mycompany.com:14200/oaam_admin.
The implementation is valid if OAAM Administration console login page is displayed and you can login using the oaamadmin account you created in Section 12.2.3, "Creating OAAM Administration User in WebLogic Console".
Validate the implementation by connecting to the OAAM Server at: http://OAAMHOST1.mycompany.com:14300/oaam_server.
The implementation is valid if the OAAM Server login page is displayed.
This section describes how to configure Oracle Adaptive Access Manager on OAAMHOST2.
This section contains the following topics:
Once the configuration has succeeded on IDMHOST1, you can propagate it to OAAMHOST2. You do this by packing the domain, using the pack script, on IDMHOST1 and unpacking it, using the unpack script on OAAMHOST2.
Both scripts reside in MW_HOME/oracle_common/common/bin.
On IDMHOST1, either use the IDMDomain.jar file you created in Section 12.2.4, "Configuring Oracle Adaptive Access Manager on OAAMHOST1," or create a new IDMDomain.jar file in /tmp by typing:
pack.sh -domain=ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain -template =/tmp/IDMDomain.jar -template_name="OAAM Domain" -managed=true
Copy IDMDomain.jar to OAAMHOST2.
On OAAMHOST2, type:
unpack.sh -domain=ORACLE_BASE/admin/IDMDomain/mserver/IDMDomain -template=/tmp/IDMDomain.jar -template_name="OAAM Domain" -app_dir=ORACLE_BASE/admin/IDMDomain/mserver/applications
Start OAAMHOST2 from the console as follows.
Start the Node Manager to create the nodemanager.properties file on OAAMHOST2 by using the startNodemanager.sh script located under the MW_HOME/wlserver_10.3/server/bin directory.
Before you can start the Managed Servers by using the console, node manager requires that the property StartScriptEnabled is set to true. You set it by running the setNMProps.sh script located under the MW_HOME/oracle_common/common/bin directory.
prompt> MW_HOME/oracle_common/common/bin
prompt> ./setNMProps.sh
Stop and Start the Node Manager as described in Section 20.1, "Starting and Stopping Oracle Identity Management Components"so that the properties take effect.
Start Oracle Adaptive Access Manager on OAAMHOST2 by following the start procedures in Section 20.1, "Starting and Stopping Oracle Identity Management Components" for:
Node Manager
WebLogic Managed Servers WLS_OAAM1 and WLS_OAAM_ADMIN1
Validate the implementation by connecting to the OAAM Administration Server at http://OAAMHOST2.mycompany.com:14200/oaam_admin. The implementation is valid if OAAM Administration console login page is displayed and you can login using the oaamadmin account you created in Section 10.4.3, "Creating Users and Groups for Oracle Adaptive Access Manager."
Validate the implementation by connecting to the OAAM Server at: http://OAAMHOST2.mycompany.com:14300/oaam_server The implementation is valid if the OAAM Server login page is displayed.
This section describes how to configure Oracle Adaptive Access Manager to work with the Oracle HTTP Server.
This section contains the following topics:
On each WEBHOST, create a file in ORACLE_INSTANCE/config/OHS/ohs1/moduleconf called oaam.conf with the following lines:
<Location /oaam_server> SetHandler weblogic-handler WebLogicCluster oaamhost1.mycompany.com:14300,oaamhost2.mycompany.com:14300 WLProxySSL ON WLProxySSLPassThrough ON </Location>
The OAAM Administration console must only be available through the admin.mycompany.com site. You achieve this by editing the file ORACLE_INSTANCE/config/OHS/component/moduleconf/admin.conf. (You created admin.conf in Section 6.9, "Configuring Oracle HTTP Server for the WebLogic Administration Server").
Edit the virtual host definition in admin.conf.
After editing the file should look like this:
NameVirtualHost *:80
<VirtualHost *:80>
ServerName admin.mycompany.com:80
ServerAdmin you@your.address
RewriteEngine On
RewriteOptions inherit
# Admin Server and EM
<Location /console>
SetHandler weblogic-handler
WebLogicHost ADMINVHN
WeblogicPort 7001
</Location>
<Location /consolehelp>
SetHandler weblogic-handler
WebLogicHost ADMINVHN
WeblogicPort 7001
</Location>
<Location /em>
SetHandler weblogic-handler
WebLogicHost ADMINVHN
WeblogicPort 7001
</Location>
<Location /oaam_admin>
SetHandler weblogic-handler
WebLogicCluster oaamhost1.mycompany.com:14200,oaamhost2.mycompany.com:14200
</Location>
</VirtualHost>
Restart the Oracle HTTP Server on WEBHOST1 and WEBHOST2, as described in Section 20.1, "Starting and Stopping Oracle Identity Management Components."
Because the Oracle HTTP Server acts as a proxy for WebLogic, by default certain CGI environment variables are not passed through to WebLogic. These include the host and port. You must tell WebLogic that it is using a virtual site name and port so that it can generate internal URLs appropriately.
To do this, log in to the WebLogic administration console at http://admin.mycompany.com/console. Proceed as follows:
Select Clusters from the home page or, alternatively, select Environment -> Clusters from the Domain structure menu.
Click Lock and Edit in the Change Center Window to enable editing.
Click the Cluster Name (cluster_oaam).
Select HTTP and enter the following values:
Frontend Host: sso.mycompany.com
Frontend HTTP Port: 80
Frontend HTTPS Port: 443
This ensures that any HTTPS URLs created from within WebLogic are directed to port 443 on the load balancer.
Click Save.
Select Clusters from the home page or, alternatively, select Environment -> Clusters from the Domain structure menu.
Click the Cluster Name (cluster_oaam_admin).
Select HTTP and enter the following values:
Frontend Host: admin.mycompany.com
Frontend HTTP Port: 80
Click Save.
Click Activate Changes in the Change Center window to enable editing.
Restart Managed servers WLS_OAAM1, WLS_OAAM2, WLS_OAAM_ADMIN1 and WLS_OAAM_ADMIN2 as described in Section 20.1, "Starting and Stopping Oracle Identity Management Components."
Log in to the Oracle Adaptive Access Manager administration console, at http://admin.mycompany.com/oaam_admin using the oaamadmin account you created in Section 10.4.3, "Creating Users and Groups for Oracle Adaptive Access Manager."
Also log in to the Oracle Adaptive Access Manager server at https://sso.mycompany.com/oaam_server in using the account oaamadmin account and the password test.
Check that the following URL can be accessed:
https://sso.mycompany.com:443/oaam_server/oamLoginPage.jsp
This section describes how to load seed data into Oracle Adaptive Access Manager.
Log in to Oracle Adaptive Access Manager Administration (OAAM_ADMIN) at:
http://admin.mycompany.com:80/oaam_admin
Connect using the oaamadmin account that you created in Section 12.2.3, "Creating OAAM Administration User in WebLogic Console."
Click System Snapshots, which is located on the Navigation -> Environment menu.
Click Open.
Click Load From File.
Enter the following information:
Name: Default Snapshot
Notes: Default Snapshot
Select Backup Current System Now.
Click Continue.
Click OK to acknowledge backup creation.
Click Choose File.
Select the file oaam_base_snapshot.zip which is located in:
IAM_ORACLE_HOME/oaam/init
Click Load.
You will see a message that says that the snapshot file was loaded successfully. Acknowledge this message by clicking OK.
Click Restore near the top right.
When loading is complete, a message is displayed. Click OK.
It is an Oracle best practices recommendation to create a backup after successfully completing the installation and configuration of each tier, or at another logical point. Create a backup after verifying that the installation so far is successful. This is a quick backup for the express purpose of immediate restoration in case of problems in later steps. The backup destination is the local disk. You can discard this backup when the enterprise deployment setup is complete. After the enterprise deployment setup is complete, you can initiate the regular deployment-specific Backup and Recovery process. For more details, see the Oracle Fusion Middleware Administrator's Guide.
For information on database backups, refer to the Oracle Database Backup and Recovery User's Guide.
To back up the installation to this point, follow these steps:
Back up the web tier as described in Section 5.5, "Backing up the Web Tier Configuration."
Back up the database. This is a full database backup, either hot or cold. The recommended tool is Oracle Recovery Manager.
Back up the Administration Server domain directory as described in Section 6.15, "Backing Up the WebLogic Domain."
Back up the Oracle Internet Directory as described in Section 7.7, "Backing up the Oracle Internet Directory Configuration."
Back up the Oracle Virtual Directory as described in Section 9.10, "Backing Up the Oracle Virtual Directory Configuration."
For information about backing up the application tier configuration, see Section 20.4, "Performing Backups and Recoveries."