2 Using the idmConfigTool Command

The IdM configuration tool (idmConfigTool) supports a number of tasks to assist in installing, configuring, and integrating Oracle identity management (IdM) components.

This chapter contains these sections:

• Section 2.1, "About the Tool"

• Section 2.2, "Set Up Environment Variables"

• Section 2.3, "Syntax and Usage"

• Section 2.4, "Command Options and Properties"

• Section 2.5, "Examples"

2.1 About the Tool

This section contains these topics:

• When to Use the Tool

• Tasks performed by the Tool

• Components Supported by the Tool

• Location

• Webgate Types Supported

• Single- and Cross-Domain Scenarios

2.1.1 When to Use the Tool

Use idmConfigTool in these situations:

• prior to installing Oracle Identity Manager and Oracle Access Management Access Manager,

• after installing Oracle Identity Manager and Oracle Access Management Access Manager,

• to dump the configuration of IdM components Oracle Internet Directory, Oracle Virtual Directory, Oracle Identity Manager, and Oracle Access Manager, and

• to validate the configuration parameters for Oracle Internet Directory, Oracle Virtual Directory, Oracle Identity Manager, and Oracle Access Manager.

Section 2.1.2 explains the tasks the tool performs in each situation.

2.1.2 Tasks performed by the Tool

idmConfigTool helps you to perform the following tasks efficiently:

• Validating configuration properties representing the Identity Management components Oracle Internet Directory (OID), Oracle Virtual Directory (OVD), Oracle Access Management Access Manager (OAM-AM) and Oracle Identity Manager (OIM).

• Pre-configuring the Identity Store components (Oracle Internet Directory and Oracle Virtual Directory) to install the other Identity Management components, including Access Manager and Oracle Identity Manager.

• Post-configuring the Access Manager, Oracle Identity Manager components and wiring of Access Manager and Oracle Identity Manager.

• Extracting the configuration of the Identity Management components Oracle Internet Directory, Oracle Virtual Directory, Access Manager and Oracle Identity Manager.

See Also:

Section 2.3.1.

2.1.3 Components Supported by the Tool

idmConfigTool supports these component versions:

• Oracle Internet Directory 11g

• Oracle Virtual Directory 11g

• Oracle Access Management Access Manager 11g

• Oracle Access Manager 10g

• Oracle Identity Manager 11g

• Oracle Unified Directory (OUD) 11g

2.1.4 Location

idmConfigTool is located at:

IAM_ORACLE_HOME/idmtools/bin

2.1.5 Webgate Types Supported

idmConfigTool supports Access Manager 11g Webgates by default. It also supports 10g Webgates.

2.1.6 Single- and Cross-Domain Scenarios

The tool supports two types of scenarios with regard to Weblogic domains:

• A single-domain configuration in which both Access Manager and Oracle Identity Manager servers are configured in the same Weblogic domain

• A dual or cross-domain configuration in which Access Manager and Oracle Identity Manager servers are configured on separate Weblogic domains

See Also:

Section 1.2 for architecture details.

2.2 Set Up Environment Variables

You must configure the environment before running the IdM configuration tool.

Set the following variables:

Variable	Set to
MW_HOME	Set the value to the full path of the installation's Middleware home.
JAVA_HOME	Ensure that the value contains the following directory: MW_HOME/jdkn
IDM_HOME	IDM_ORACLE_HOME, where Oracle Internet Directory is installed (optional)
ORACLE_HOME	Set to the full path of the Oracle home. For IdM integrations, set to IAM_ORACLE_HOME.

2.3 Syntax and Usage

This section contains these topics:

• Command Syntax

• Requirements

• Generated Files

• Using the Properties File

• Using the Tool for OUD Identity Stores

2.3.1 Command Syntax

The tool has the following syntax on Linux:

idmConfigTool.sh -command  
input_file=filename log_file=logfileName log_level=log_level

The tool has the following syntax on Windows:

idmConfigTool.bat -command  input_file=filename log_file=logfileName 
log_level=log_level

Values for command are as follows:

Command	Component name	Description
preConfigIDStore	Identity Store	Configures the identity store and policy store by creating the groups and setting ACIs to the various containers.
prepareIDStore    OAM    OIM    WLS    FUSION    OAAM    all	Identity Store	Configures the identity store by adding necessary users and associating users with groups. Modes enable you to configure for a specific component.
configPolicyStore	Policy Store	Configures policy store by creating read-write user and associates them to the groups.
configOAM	Oracle Access Manager Oracle Identity Manager	Prepares Access Manager for integration with Oracle Identity Manager.
configOIM	Oracle Access Manager Oracle Identity Manager	Sets up wiring between Access Manager and Oracle Identity Manager.
configOVD	Oracle Virtual Directory	Creates Oracle Virtual Directory adapters.
disableOVDAccessConfig	Oracle Virtual Directory	Disables anonymous access to the Oracle Virtual Directory server. Post-upgrade command. Note: configOVD performs this task automatically when run.
postProvConfig	Identity Store	Performs post-provisioning configuration of the identity store.
validate    IDSTORE    POLICYSTORE    OAM11g    OAM10g    OIM	Various	Validates the set of input properties for the named entity.
ovdConfigUpgrade	Oracle Virtual Directory	Updates the configuration for an upgraded Oracle Virtual Directory with split profile.
upgradeLDAPUsersForSSO	Oracle Identity Manager Access Manager	Updates existing users in Oracle Internet Directory by adding certain object classes which are needed for Oracle Identity Manager-Access Manager integration.
upgradeOIMTo11gWebgate	Oracle Identity Manager Access Manager	Upgrades an existing configuration consisting of integrated Oracle Identity Manager-Access Manager, using Webgate 10g, to use Webgate 11g

2.3.2 Requirements

You must run this tool as a user with administrative privileges when configuring the identity store or the policy store.

The validate command requires a component name.

2.3.3 Generated Files

idmConfigTool creates or updates certain files upon execution.

Parameter File

When you run the idmConfigTool, the tool creates or appends to the file idmDomainConfig.param. This file is generated in the directory from which you run the tool. To ensure that the same file is appended to each time the tool is run, always run idmConfigTool from the directory:

IAM_ORACLE_HOME/idmtools/bin

Log File

You can specify a log file using the log_file attribute of idmConfigTool.

If you do not explicitly specify a log file, a file named automation.log is created in the directory where you run the tool.

Check the log file for any errors or warnings and correct them.

2.3.4 Using the Properties File

This section describes the properties file that can be used with idmConfigTool.

2.3.4.1 About the properties File

A properties file provides a convenient way to specify command properties and enable you to save properties for reference and later use. You can specify a properties file, containing execution properties, as input command options. The properties file is a simple text file which must be available at the time the command is executed.

It is not necessary to provide password-related properties in the properties file. Indeed, for security you are advised not to insert passwords into the properties file. When passwords are not provided, the tool prompts for the relevant properties at execution.

2.3.4.2 List of Properties

Table 2-1 lists the properties used for integration command options in the idmConfigTool command. The properties are listed in alphabetical order.

Table 2-1 Properties Used in IdM Configtool properties Files

Parameter	Example Value	Description
ACCESS_GATE_ID	IdentityManagerAccessGate	The Access Manager access gate ID with which Oracle Identity Manager needs to communicate.
ACCESS_SERVER_HOST	mynode.us.example.com	Access Manager Access Server hostname
ACCESS_SERVER_PORT	5575	Access Manager NAP port.
AUTOLOGINURI	/obrar.cgi	URI required by OPSS. Default value is /obrar.cgi
COOKIE_DOMAIN	.us.example.com	Web domain on which the Oracle Identity Manager application resides. Specify the domain in the format .cc.example.com.
COOKIE_EXPIRY_INTERVAL	-1	Cookie expiration period. Set to -1.
DOMAIN_LOCATION	ORACLE_BASE /admin/IDMDomain/aserver/IDMDomain	The location of the Oracle Identity Manager domain.
DOMAIN_NAME	IDM_Domain	The Oracle Identity Manager domain name.
IDSTORE_ADMIN_PORT	4321	The admin port for an Oracle Unified Directory (OUD) identity store.
IDSTORE_HOST	idstore.example.com	Host name of the LDAP identity store directory (corresponding to the IDSTORE_DIRECTORYTYPE).
IDSTORE_PORT	4321	Port number of the LDAP identity store (corresponding to the IDSTORE_DIRECTORYTYPE).
IDSTORE_BINDDN	cn=orcladmin	Administrative user in the identity store.
IDSTORE_PASSWORD		Password for the identity store bind DN.
IDSTORE_USERNAMEATTRIBUTE	cn	Username attribute used to set and search for users in the identity store.
IDSTORE_LOGINATTRIBUTE	uid	The login attribute of the identity store which contains the user's login name.
IDSTORE_USERSEARCHBASE	cn=Users,dc=us,dc=example,dc=com	The location in the directory where users are stored.
IDSTORE_SEARCHBASE	dc=us,dc=example,dc=com	Search base for users and groups contained in the identity store.
IDSTORE_GROUPSEARCHBASE	cn=Groups,dc=us,dc=example,dc=com	The location in the directory where groups are stored.
IDSTORE_OAMSOFTWAREUSER	oamLDAP	The username used to establish the Access Manager identity store connection.
IDSTORE_OAMADMINUSER	oamadmin	The identity store administrator for Access Manager. Required only if the identity store is set as the system identity store.
IDSTORE_OAAMADMINUSER	oaamadmin	The identity store administrator for Oracle Adaptive Access Manager.
IDSTORE_SYSTEMIDBASE	cn=system, dc=test	Base for all the system users.
IDSTORE_READONLYUSER		User with read-only permissions to the identity store.
IDSTORE_READWRITEUSER		User with read-write permissions to the identity store.
IDSTORE_SUPERUSER		The Oracle Fusion Applications superuser in the identity store.
IDSTORE_XELSYSADMINUSER		The administrator of the xelsysadm system account.
IDSTORE_OIMADMINUSER		The identity store administrator for Oracle Identity Manager.
IDSTORE_OIMADMINGROUP		The Oracle Identity Manager administrator group.
IDSTORE_SSL_ENABLED		Whether SSL to the identity store is enabled. Valid values: true | false
IDSTORE_KEYSTORE_FILE		Location of the keystore file containing identity store credentials. Required to establish an SSL connection to the identity store. Applies to Oracle Unified Directory identity stores.
IDSTORE_KEYSTORE_PASSWORD		Password of the keystore file containing identity store credentials (IDSTORE_KEYSTORE_FILE). Required to establish an SSL connection to the identity store. Applies to Oracle Unified Directory identity stores.
IDSTORE_NEW_SETUP		Used for identity store validation. Used in Oracle Fusion Applications environment.
IDSTORE_DIRECTORYTYPE	OVD	Directory type of the identity store for which the authenticator must be created. Set to OVD if you are using Oracle Virtual Directory server to connect to either Oracle Internet Directory or a non-OID directory. Set it to OID if your identity store is in Oracle Internet Directory and you are accessing it directly rather than through Oracle Virtual Directory. Set to OUD if your identity store is Oracle Unified Directory. Valid values: OID, OVD, OUD
IDSTORE_ADMIN_USER	cn=systemids,dc=example,dc=com	The administrator of the identity store directory. Note that the entry must contain the complete LDAP DN of the user; the username alone is not sufficient.
IDSTORE_WLSADMINUSER	weblogic_idm	The identity store administrator for Oracle WebLogic Server
IDSTORE_WLSADMINGROUP	WLS Administrators	The identity store administrator group for Oracle WebLogic Server.
IDSTOR_PASSWD		Password of the identity store administrator.
IDSTORE_PWD_OAMSOFTWAREUSER		Password of the Access Manager software user in the identity store.
IDSTORE_PWD_OAMADMINUSER		Password of the Access Manager user identified as IDSTORE_OAMSOFTWAREUSER.
IDSTORE_PWD_XELSYSADMINUSER		Password of the XELSYSADMIN user in the identity store.
IDSTORE_PWD_WEBLOGICADMINUSER		Password of the WebLogic administrator in the identity store.
IDSTORE_PWD_OAAMADMINUSER		Password of the OAAM administrator in the identity store.
LDAPn_HOST	.	The hostname of the LDAP server
LDAPn_PORT		The LDAP server port number.
LDAPn_BINDDN	.	The bind DN for the LDAP server
LDAPn_PASSWORD		The LDAP server password.
LDAPn_SSL		Indicates whether the connection to the LDAP server is over SSL. Valid values are True or False
LDAPn_BASE		The base DN of the LDAP server.
LDAPn_OVD_BASE		The OVD base DN of the LDAP server.
LDAPn_TYPE		The directory type for the LDAP server. n is 1, 2, and so on. For a single-node configuration specify LDAP1.
LOGINURI	/${app.context}/adfAuthentication	URI required by OPSS. Default value is /${app.context}/adfAuthentication
LOGOUTURI	/oamsso/logout.html	URI required by OPSS. Default value is /oamsso/logout.html
MDS_DB_URL	jdbc:oracle:thin:@DBHOST:1521:SID	URL of the MDS database.
MDS_DB_SCHEMA_USERNAME	edg_mds	Username of the MDS schema user.
OAM_SERVER_VERSION	10g	Required when Access Manager server does not support 11g webgate in Oracle Identity Manager-Access Manager integration. In that case, provide the value as '10g'. Valid values are 10g, 11g.
OAM_TRANSFER_MODE	SIMPLE	The transfer mode for the Access Manager agent being configured. If your access manager servers are configured to accept requests using the simple mode, set OAM_TRANSFER_MODE to SIMPLE. Valid values are OPEN, SIMPLE or CERT.
OAM11G_OAM_SERVER_TRANSFER_MODE	OPEN	The security model in which the Access Manager 11g server functions. Valid values: OPEN or SIMPLE.
OAM11G_SSO_ONLY_FLAG		Specifies whether Access Manager server can perform authorizations. If true, the Access Manager 11g server operates in authentication only mode, where all authorizations return true by default without any policy validations. If false, the server runs in default mode, where each authentication is followed by one or more authorization requests to the server. Valid values: true (no authorization) | false
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN	OAMAdministrators	Specifies the account to administer role security in identity store.
OAM11G_OIM_INTEGRATION_REQ	false	Specifies whether to integrate with Oracle Identity Manager or configure Access Manager in stand-alone mode. Set to true for integration. Valid values: true (integration) | false
OAM11G_SERVER_LBR_HOST	sso.example.com	Hostname of the load balancer to the Oracle HTTP (OHS) server front-ending the Access Manager server.
OAM11G_SERVER_LBR_PORT	443	Port number of the load balancer to the OHS server front-ending the Access Manager server.
OAM11G_SERVER_LBR_PROTOCOL	https	Protocol of the load balancer to the OHS server front-ending the Access Manager server. Valid values: HTTP, HTTPS
OAM11G_SERVER_LOGIN_ATTRIBUTE	uid	At a login attempt, the username is validated against this attribute in the identity store.
OAM11G_SERVER_GLOBAL_SESSION_TIMEOUT		The global session timeout for sessions in the Access Manager server.
OAM11G_SERVER_GLOBAL_SESSION_EXPIRY_TIME		Global session expiry time for a session in the Access Manager server.
OAM11G_SERVER_GLOBAL_MAX_SESSION_PER_USER		Global maximum sessions per user in the Access Manager server.
OAM11G_IDSTORE_NAME		The identity store name. If you already have an identity Store in place which you wish to reuse (rather than allowing the tool to create a new one for you), set this parameter to the name of the Identity Store. The default value is "OAMIDStore".
OAM11G_IMPERSONATION_FLAG		Enable or disable impersonation in Access Manager server. Applicable to Oracle Fusion Applications environment. Valid values: true (enable) | false
OAM11G_IDM_DOMAIN_OHS_HOST	sso.example.com	Host name of the load balancer which is in front of OHS.
OAM11G_IDM_DOMAIN_OHS_PORT	443	Port number on which the load balancer specified as OAM11G_IDM_DOMAIN_OHS_HOST listens.
OAM11G_IDM_DOMAIN_OHS_PROTOCOL	https	protocol for IDM OHS. Valid values: HTTP | HTTPS
OAM11G_OIM_OHS_URL	https://sso.example.com:443/test
OAM11G_WG_DENY_ON_NOT_PROTECTED	true	Deny on protected flag for 10g webgate Valid values: true | false
OAM11G_OAM_SERVER_TRANSFER_MODE	simple	Transfer mode for the IDM domain agent. Valid values: OPEN | SIMPLE | CERT
OAM11G_IDM_DOMAIN_LOGOUT_URLS	/console/jsp/common/logout.jsp,/em/targetauth/emaslogout.jsp	Comma-separated list of Access Manager logout URLs.
OAM11G_IDM_DOMAIN_WEBGATE_PASSWD		The Access Manager domain WebGate password.
OAM11G_OIM_WEBGATE_PASSWD		The password of the Oracle Identity Manager Webgate.
OAM11G_WLS_ADMIN_HOST	myhost.example.com	Host name of the Access Manager domain admin server.
OAM11G_WLS_ADMIN_PORT	7001	Port on which the Access Manager domain admin server is running.
OAM11G_WLS_ADMIN_USER	wlsadmin	The username of the Access Manager domain administrator.
OIM_FRONT_END_HOST	host123.example.com	The hostname of the LBR server front-ending Oracle Identity Manager.
OIM_FRONT_END_PORT	7011	The port number of the LBR server front-ending Oracle Identity Manager.
OIM_MANAGED_SERVER_NAME	WLS_OIM1	The name of the Oracle Identity Manager managed server. If clustered, any of the managed servers can be specified.
OIM_MANAGED_SERVER_HOST		The hostname of the Oracle Identity Manager managed server.
OIM_MANAGED_SERVER_PORT		The port number of the Oracle Identity Manager managed server.
OIM_T3_HOST		The hostname for the Oracle Identity Manager T3 server.
OIM_T3_PORT		The port number of the Oracle Identity Manager T3 server.
OVD_HOST		OVD Server hostname
OVD_PORT		OVD Server port number
OVD_BINDDN		OVD Server bind DN
OVD_PASSWORD		OVD Server password
OVD_SSL		Indicates whether the connection is over SSL. Valid values are True or False
POLICYSTORE_SHARES_IDSTORE	true	Denotes whether the policy store and identity store share the directory. Always true in Release 11g. Valid values: true, false
POLICYSTORE_HOST	mynode.us.example.com	The hostname of your policy store directory.
POLICYSTORE_PORT	1234	The port number of your policy store directory.
POLICYSTORE_BINDDN	cn=orcladmin	Administrative user in the policy store directory.
POLICYSTORE_SEARCHBASE	dc=example,dc=com	The location in the directory where users and groups are stored.
POLICYSTORE_SYSTEMIDBASE	cn=systemids, dc=example,dc=com	The read-only and read-write users for policy store are created in this location. Default value is cn=systemids, policy_store_search_base
POLICYSTORE_READONLYUSER	PolStoreROUser	A user with read privileges in the policy store.
POLICYSTORE_READWRITEUSER	PolStoreRWUser	A user with read and write privileges in the policy store.
POLICYSTORE_CONTAINER	cn=jpsroot	The name of the container used for OPSS policy information
POLICYSTORE_SSL_ENABLED		Whether the policy store is SSL-enabled.
POLICYSTORE_KEYSTORE_FILE		The location of the keystore file for an SSL-enabled policy store.
POLICYSTORE_KEYSTORE_PASSWORD		The password of the keystore file for an SSL-enabled policy store.
SPLIT_DOMAIN	true	Flag to force configOAM to create security providers in the domain against which it is run. Valid values are true, false.
SSO_ENABLED_FLAG	false	Flag to determine if SSO should be enabled. Valid values are true, false.
WEBGATE_TYPE	javaWebgate	The type of WebGate agent you want to create. Set to ohsWebgate10g for configOAM and configOIM regardless of the WebGate version in use.
PRIMARY_OAM_SERVERS	idmhost1.example.com:5575,idmhost2.example.com:5575	A comma-separated list of your Access Manager servers and their proxy ports.
WLSHOST	node01.example.com	The WebLogic Server host name
WLSPORT	7001	The WebLogic Server port number
WLSADMIN	wlsadmin	The WebLogic Server administrator login
WLSPASSWD		The WebLogic Server administrator.

2.3.5 Using the Tool for OUD Identity Stores

This section explains additional tasks you may need to perform when using idmConfigTool for a target identity store which is an instance of Oracle Unified Directory (OUD). Topics include:

• Creating the Global ACI for OUD

• Creating Indexes on OUD Replicas

2.3.5.1 Creating the Global ACI for OUD

When you use idmConfigTool for an identity store that is an instance of OUD, the global ACI is not created. Consequently you must first grant access to the changelog, and then create the ACI. Take these steps:

1. Create a file called mypassword which contains the password you use to connect to OUD.

2. Remove the existing change log on one of the replicated OUD hosts. The command syntax is:

   ORACLE_INSTANCE/bin/dsconfig set-access-control-handler-prop \
   --remove \
   global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version 3.0;
   acl \"External changelog access\"; deny (all) userdn=\"ldap:///anyone\";)"
   --hostname OUD Host \
   --port OUD Admin Port \
   --trustAll ORACLE_INSTANCE/config/admin-truststore \
   --bindDN cn=oudadmin \
   --bindPasswordFile mypassword \
   --no-prompt
   

   For example:

   ORACLE_INSTANCE/bin/dsconfig set-access-control-handler-prop \
   --remove
   global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version 3.0;
   acl \"External changelog access\"; deny (all) userdn=\"ldap:///anyone\";)"
   --hostname OUDHOST1.example.com \
   --port 4444 \
   --trustAll /u01/app/oracle/admin/oud1/OUD/config/admin-truststore \
   --bindDN cn=oudadmin \
   --bindPasswordFile mypassword \
   --no-prompt
   

3. Add the new ACI:

   dsconfig set-access-control-handler-prop \
   --add global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version
   3.0; acl \"External changelog access\"; allow
   (read,search,compare,add,write,delete,export)
   groupdn=\"ldap:///cn=oimAdminGroup,cn=groups,dc=example,dc=com\";)" \
   --hostname OUD Host \
   --port OUD Admin Port \
   --trustAll \
   --bindDN cn=oudadmin \
   --bindPasswordFile password
   --no-prompt
   

   For example:

   dsconfig set-access-control-handler-prop \
   --add
   --add global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version
   3.0; acl \"External changelog access\"; allow
   (read,search,compare,add,write,delete,export)
   groupdn=\"ldap:///cn=oimAdminGroup,cn=groups,dc=example,dc=com\";)" \
   --hostname OUDHOST1 \
   --port 4444 \
   --trustAll \
   --bindDN cn=oudadmin \
   --bindPasswordFile password
   --no-prompt
   

4. Repeat Steps 1 through 3 for each OUD instance.

2.3.5.2 Creating Indexes on OUD Replicas

When idmConfigTool prepares the identity store, it creates a number of indexes on the data. However in a high availability (HA) environment that contains replicas, these replicas are not updated with the indexes and need to be added manually.

The steps are as follows (with LDAPHOST1.example.com representing the first OUD server, LDAPHOST2.example.com the second server, and so on):

1. Create a file called mypassword which contains the password you use to connect to OUD.

2. Configure the indexes on the second OUD server:

   ORACLE_INSTANCE/OUD/bin/ldapmodify -h LDAPHOST2.example.com -Z -X -p 4444
   -a -D "cn=oudadmin" -j mypassword -c -f
   /u01/app/oracle/product/fmw/iam/oam/server/oim-intg/ldif/ojd/schema/ojd_user_index_generic.ldif
   

   and

   ORACLE_INSTANCE/OUD/bin/ldapmodify -h LDAPHOST2.example.com -Z -X -p 4444
   -a -D "cn=oudadmin" -j  mypassword -c -f
   /u01/app/oracle/product/fmw/iam/idmtools/templates/oud/oud_indexes_extn.ldif
   

   Notes:

   • Repeat both commands for all OUD servers for which idmConfigTool was not run.

   • Execute the commands on one OUD instance at a time; that instance must be shut down while the commands are running.

3. Rebuild the indexes on all the servers:

   ORACLE_INSTANCE/OUD/bin/bin/rebuild-index -h localhost -p 4444 -X -D
   "cn=oudadmin" -j mypassword --rebuildAll -b "dc=example,dc=com"
   

   Note:

   You must run this command on all OUD servers, including the first server (LDAPHOST1.example.com) for which idmConfigTool was run.

2.4 Command Options and Properties

This section lists the properties for each command option. Topics include:

• preConfigIDStore Command

• prepareIDStore Command

• configPolicyStore Command

• configOAM Command

• configOIM Command

• postProvConfig Command

• upgradeLDAPUsersForSSO Command

• validate IDStore Command

• validate PolicyStore Command

• validate OAM Command (11g)

• validate OAM Command (10g)

• validate OIM command

• configOVD Command

• ovdConfigUpgrade Command

• disableOVDAccessConfig Command

• upgradeOIMTo11gWebgate

Notes:

• The command options show the command syntax on Linux only. See Section 2.3.1 for Windows syntax guidelines.

• The tool prompts for passwords. For security, it is recommended that you do not specify password attributes in the properties file.

2.4.1 preConfigIDStore Command

Syntax

./idmConfigTool.sh -preConfigIDStore input_file=input_properties

Properties

Table 2-2 lists the properties for this mode:

Table 2-2 Properties of preConfigIDStore

Property	Required?
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_BINDDN	YES
IDSTORE_LOGINATTRIBUTE
IDSTORE_USERNAMEATTRIBUTE	YES
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
IDSTORE_SEARCHBASE	YES
IDSTORE_SYSTEMIDBASE
POLICYSTORE_SHARES_IDSTORE
IDSTORE_ADMIN_PORT	YES (if target identity store is an instance of Oracle Unified Directory (OUD).)
IDSTORE_KEYSTORE_FILE	YES, if target identity store is Oracle Unified Directory. Use the format: oud_install_path /OUD/config/admin-keystore
IDSTORE_KEYSTORE_PASSWORD	YES, if target identity store is Oracle Unified Directory.

Example properties File

Here is a sample properties file for this option:

IDSTORE_HOST : idstore.example.com
IDSTORE_PORT : 389
IDSTORE_BINDDN : cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com

2.4.2 prepareIDStore Command

Syntax

The prepareIDStore command takes mode as an argument to perform tasks for the specified component. The syntax for specifying the mode is:

./idmConfigTool.sh -prepareIDStore mode=mode
input_file=filename_with_Configproperties

where mode must be one of:

• OAM

• OIM

• OAAM

• WLS

• FUSION

• all (performs all the tasks of the above modes combined)

Note:

WLS mode must be run before OAM.

2.4.2.1 prepareIDStore mode=OAM

The following are created in this mode:

• Perform schema extensions as required by the Access Manager component

• Add the oblix schema

• Create the OAMSoftware User

• Create OblixAnonymous User

• Optionally create the Access Manager Administration User

• Associate these users to their respective groups

• Create the group "orclFAOAMUserWritePrivilegeGroup"

Syntax

./idmConfigTool.sh -prepareIDStore mode=OAM
input_file=filename_with_Configproperties

Properties

Table 2-3 lists the properties for this mode:

Table 2-3 prepareIDStore mode=OAM Properties

Parameter	Required?
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_BINDDN	YES
IDSTORE_USERNAMEATTRIBUTE	YES
IDSTORE_LOGINATTRIBUTE
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
IDSTORE_SEARCHBASE	YES
IDSTORE_OAMSOFTWAREUSER
IDSTORE_OAMADMINUSER
IDSTORE_SYSTEMIDBASE
IDSTORE_ADMIN_PORT	YES (if target identity store is an instance of Oracle Unified Directory (OUD).)

Example properties File

Here is a sample properties file for this option. This parameter set would result in OAMADMINUSER and OAMSOFTWARE user being created in the identity store:

IDSTORE_HOST : idstore.example.com
IDSTORE_PORT : 389
IDSTORE_BINDDN : cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
POLICYSTORE_SHARES_IDSTORE: true
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN:OAMAdministrators
IDSTORE_OAMSOFTWAREUSER:oamLDAP
IDSTORE_OAMADMINUSER:oamadmin
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com

2.4.2.2 prepareIDStore mode=OIM

The following are created in this mode:

• Create Oracle Identity Manager Administration User under SystemID container

• Create Oracle Identity Manager Administration Group

• Add Oracle Identity Manager Administration User to Oracle Identity Manager Administration Group

• Add ACIs to Oracle Identity Manager Administration Group

• Create reserve container

• Create xelsysadmin user

Syntax

./idmConfigTool.sh -prepareIDStore mode=OIM
input_file=filename_with_Configproperties

Properties

Table 2-4 lists the properties in this mode:

Table 2-4 prepareIDStore mode=OIM Properties

Parameter	Required?
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_BINDDN	YES
IDSTORE_USERNAMEATTRIBUTE	YES
IDSTORE_LOGINATTRIBUTE
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
IDSTORE_SEARCHBASE	YES
IDSTORE_OIMADMINUSER
IDSTORE_OIMADMINGROUP
IDSTORE_SYSTEMIDBASE
IDSTORE_ADMIN_PORT	YES (if target identity store is an instance of Oracle Unified Directory (OUD).)

Example properties File

Here is a sample properties file for this option. With this set of properties, OIMADMINUSER is created in IDSTORE_SYSTEMIDBASE:

IDSTORE_HOST : idstore.example.com
IDSTORE_PORT : 389
IDSTORE_BINDDN : cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE:cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
POLICYSTORE_SHARES_IDSTORE: true
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com
IDSTORE_OIMADMINUSER: oimadmin
IDSTORE_OIMADMINGROUP:OIMAdministrators

2.4.2.3 prepareIDStore mode=OAAM

The following are created in this mode:

• Create Oracle Adaptive Access Manager Administration User

• Create Oracle Adaptive Access Manager Groups

• Add the Oracle Adaptive Access Manager Administration User as a member of Oracle Adaptive Access Manager Groups

Syntax

./idmConfigTool.sh -prepareIDStore mode=OAAM
input_file=filename_with_Configproperties

Properties

Table 2-5 shows the properties in this mode:

Table 2-5 prepareIDStore mode=OAAM Properties

Parameter	Required?
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_BINDDN	YES
IDSTORE_USERNAMEATTRIBUTE
IDSTORE_LOGINATTRIBUTE
IDSTORE_USERSEARCHBASE
IDSTORE_GROUPSEARCHBASE
IDSTORE_SEARCHBASE
IDSTORE_OAAMADMINUSER	YES
IDSTORE_ADMIN_PORT	YES (if target identity store is an instance of Oracle Unified Directory (OUD).)

2.4.2.4 prepareIDStore mode=WLS

The following are created in the WLS (Oracle WebLogic Server) mode:

• Create Weblogic Administration User

• Create Weblogic Administration Group

• Add the Weblogic Administration User as a member of Weblogic Administration Group

Syntax

./idmConfigTool.sh -prepareIDStore mode=WLS
input_file=filename_with_Configproperties

Properties

Table 2-6 lists the properties in this mode:

Table 2-6 prepareIDStore mode=WLS Properties

Parameter	Required?
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_BINDDN	YES
IDSTORE_USERNAMEATTRIBUTE	YES
IDSTORE_LOGINATTRIBUTE
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
IDSTORE_SEARCHBASE	YES
IDSTORE_WLSADMINUSER	YES
IDSTORE_WLSADMINGROUP	YES
IDSTORE_ADMIN_PORT	YES (if target identity store is an instance of Oracle Unified Directory (OUD).)

Example properties File

Here is a sample properties file for this option. With this set of properties, the IDM Administrators group is created.

IDSTORE_HOST: idstore.example.com
IDSTORE_PORT: 389
IDSTORE_BINDDN: cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users, dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
POLICYSTORE_SHARES_IDSTORE: true
IDSTORE_WLSADMINUSER: weblogic_idm
IDSTORE_WLSADMINGROUP: wlsadmingroup

2.4.2.5 prepareIDStore mode=fusion

The following actions are taken in this mode:.

• Create a Readonly User

• Create a ReadWrite User

• Create a Super User

• Add the readOnly user to the groups orclFAGroupReadPrivilegeGroup and orclFAUserWritePrefsPrivilegeGroup

• Add the readWrite user to the groups orclFAUserWritePrivilegeGroup and orclFAGroupWritePrivilegeGroup

Syntax

./idmConfigTool.sh -prepareIDStore mode=fusion
input_file=filename_with_Configproperties

Properties

Table 2-7 lists the properties in this mode:

Table 2-7 prepareIDStore mode=fusion Properties

Parameter	Required?
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_BINDDN	YES
IDSTORE_USERNAMEATTRIBUTE	YES
IDSTORE_LOGINATTRIBUTE
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
IDSTORE_SEARCHBASE	YES
IDSTORE_READONLYUSER
IDSTORE_READWRITEUSER
IDSTORE_SUPERUSER
IDSTORE_SYSTEMIDBASE
POLICYSTORE_SHARES_IDSTORE
IDSTORE_ADMIN_PORT	YES (if target identity store is an instance of Oracle Unified Directory (OUD).)

Example properties File

Here is a sample properties file for this option, which creates IDSTORE_SUPERUSER:

IDSTORE_HOST : idstore.example.com
IDSTORE_PORT : 389
IDSTORE_BINDDN : cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_READONLYUSER: IDROUser
IDSTORE_READWRITEUSER: IDRWUser
IDSTORE_USERSEARCHBASE:cn=Users,dc=example,dc=com 
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=mycomapny,dc=com
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com
IDSTORE_SUPERUSER: weblogic_fa
POLICYSTORE_SHARES_IDSTORE: true

2.4.2.6 prepareIDStore mode=all

The mode performs all the tasks that are performed in the modes OAM, OIM, WLS, OAAM, and FUSION.

Syntax

./idmConfigTool.sh -prepareIDStore mode=all
input_file=filename_with_Configproperties

Properties

Table 2-8 lists the properties in this mode:

Table 2-8 prepareIDStore mode=all Properties

Parameter	Required?
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_BINDDN	YES
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
IDSTORE_LOGINATTRIBUTE
IDSTORE_SEARCHBASE	YES
IDSTORE_SYSTEMIDBASE
IDSTORE_READONLYUSER
IDSTORE_READWRITEUSER
IDSTORE_SUPERUSER
IDSTORE_OAMSOFTWAREUSER
IDSTORE_OAMADMINUSER
IDSTORE_OIMADMINUSER
IDSTORE_OIMADMINGROUP
IDSTORE_USERNAMEATTRIBUTE	YES
IDSTORE_OAAMADMINUSER	YES
IDSTORE_WLSADMINUSER	YES
IDSTORE_WLSADMINGROUP	YES
IDSTORE_ADMIN_PORT	YES (if target identity store is an instance of Oracle Unified Directory (OUD).)
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN
POLICYSTORE_SHARES_IDSTORE

Example properties File

Here is a sample properties file for this option:

IDSTORE_HOST : node01.example.com
IDSTORE_PORT : 2345
IDSTORE_BINDDN: cn=orcladmin
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com
IDSTORE_READONLYUSER: IDROUser
IDSTORE_READWRITEUSER: IDRWUser
IDSTORE_SUPERUSER: weblogic_fa
IDSTORE_OAMSOFTWAREUSER:oamSoftwareUser
IDSTORE_OAMADMINUSER:oamAdminUser
IDSTORE_OIMADMINUSER: oimadminuser
POLICYSTORE_SHARES_IDSTORE: true
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN:OAMAdministrators
IDSTORE_OIMADMINGROUP: OIMAdministrators
IDSTORE_WLSADMINUSER: weblogic_idm
IDSTORE_WLSADMINGROUP: wlsadmingroup
IDSTORE_OAAMADMINUSER: oaamAdminUser

2.4.3 configPolicyStore Command

Syntax

./idmConfigTool.sh -configPolicyStore input_file=input_properties

Properties

Table 2-9 lists the command properties.

Table 2-9 Properties for ConfigPolicyStore

Property	Required?
POLICYSTORE_HOST	YES
POLICYSTORE_PORT	YES
POLICYSTORE_BINDDN	YES
POLICYSTORE_SEARCHBASE	YES
POLICYSTORE_SYSTEMIDBASE
POLICYSTORE_READONLYUSER
POLICYSTORE_READWRITEUSER
POLICYSTORE_CONTAINER	YES

Example properties File

Here is a sample properties file for this option, which creates readonly user and writeonly user in the policy store:

POLICYSTORE_HOST: mynode.us.example.com
POLICYSTORE_PORT: 3060
POLICYSTORE_BINDDN: cn=orcladmin
POLICYSTORE_READONLYUSER: PolicyROUser
POLICYSTORE_READWRITEUSER: PolicyRWUser
POLICYSTORE_SEARCHBASE: dc=example,dc=com
POLICYSTORE_CONTAINER: cn=jpsroot

2.4.4 configOAM Command

Syntax

./idmConfigTool.sh -configOAM input_file=input_properties

Properties

Table 2-10 lists the command properties.

Table 2-10 Properties of configOAM

Property	Required?
WLSHOST	YES
WLSPORT	YES
WLSADMIN	YES
IDSTORE_BINDDN	YES
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_DIRECTORYTYPE
IDSTORE_USERNAMEATTRIBUTE
IDSTORE_LOGINATTRIBUTE
IDSTORE_USERSEARCHBASE	YES
IDSTORE_SEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
IDSTORE_OAMSOFTWAREUSER
IDSTORE_OAMADMINUSER
IDSTORE_SYSTEMIDBASE	YES
PRIMARY_OAM_SERVERS
WEBGATE_TYPE
ACCESS_GATE_ID
OAM_TRANSFER_MODE
COOKIE_DOMAIN
COOKIE_EXPIRY_INTERVAL
OAM11G_WG_DENY_ON_NOT_PROTECTED
OAM11G_IDM_DOMAIN_OHS_HOST
OAM11G_IDM_DOMAIN_OHS_PORT
OAM11G_IDM_DOMAIN_OHS_PROTOCOL
OAM11G_OAM_SERVER_TRANSFER_MODE
OAM11G_IDM_DOMAIN_LOGOUT_URLS
OAM11G_OIM_WEBGATE_PASSWD
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN
OAM11G_SSO_ONLY_FLAG
OAM11G_OIM_INTEGRATION_REQ
OAM11G_IMPERSONATION_FLAG	Oracle Fusion Applications only.
OAM11G_SERVER_LBR_HOST
OAM11G_SERVER_LBR_PORT
OAM11G_SERVER_LBR_PROTOCOL
OAM11G_SERVER_LOGIN_ATTRIBUTE
OAM11G_IDSTORE_NAME	YES
POLICYSTORE_SHARES_IDSTORE
SPLIT_DOMAIN

Note:

When you execute this command, the tool prompts you for:

• Password of the identity store account to which you are connecting

• Access Manager administrator password

• Access Manager software user password

Example properties File

Here is a sample properties file for this option, which creates an entry for webgate in Access Manager:

WLSHOST: adminvhn.example.com
WLSPORT: 7001
WLSADMIN: weblogic
IDSTORE_HOST: idstore.example.com
IDSTORE_PORT: 389
IDSTORE_BINDDN: cn=orcladmin 
IDSTORE_USERNAMEATTRIBUTE: cn
IDSTORE_LOGINATTRIBUTE: uid
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_OAMSOFTWAREUSER: oamLDAP
IDSTORE_OAMADMINUSER: oamadmin
PRIMARY_OAM_SERVERS: oamhost1.example.com:5575,oamhost2.example.com:5575
WEBGATE_TYPE: ohsWebgate10g
ACCESS_GATE_ID: Webgate_IDM
OAM11G_IDM_DOMAIN_OHS_HOST:sso.example.com
OAM11G_IDM_DOMAIN_OHS_PORT:443
OAM11G_IDM_DOMAIN_OHS_PROTOCOL:https
OAM11G_OAM_SERVER_TRANSFER_MODE:simple
OAM11G_IDM_DOMAIN_LOGOUT_URLS: /console/jsp/common/logout.jsp,/em/targetauth/emaslogout.jsp
OAM11G_WG_DENY_ON_NOT_PROTECTED: false
OAM11G_SERVER_LOGIN_ATTRIBUTE: uid 
OAM_TRANSFER_MODE: simple
COOKIE_DOMAIN: .example.com
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN: OAMAdministrators
OAM11G_SSO_ONLY_FLAG: true
OAM11G_OIM_INTEGRATION_REQ: true or false
OAM11G_IMPERSONATION_FLAG:true
OAM11G_SERVER_LBR_HOST:sso.example.com
OAM11G_SERVER_LBR_PORT:443
OAM11G_SERVER_LBR_PROTOCOL:https
COOKIE_EXPIRY_INTERVAL: -1
OAM11G_OIM_OHS_URL:https://sso.example.com:443/
SPLIT_DOMAIN: true
OAM11G_IDSTORE_NAME: OAMIDStore
IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com

2.4.5 configOIM Command

As of 11g Release 2 (11.1.2), configOIM supports 11g webgate by default. See the WEBGATE_TYPE option for details.

As indicated in the table, certain properties are required when Oracle Identity Manager and Access Manager are configured on different weblogic domains.

Syntax

./idmConfigTool.sh -configOIM input_file=input_file_with_path

Properties

Table 2-11 lists the command properties.

Table 2-11 Properties for configOIM

Property	Required?
LOGINURI	required by Oracle Platform Security Services (OPSS).
LOGOUTURI	required by OPSS.
AUTOLOGINURI	required by OPSS.
ACCESS_SERVER_HOST
ACCESS_GATE_ID
ACCESS_SERVER_PORT
COOKIE_DOMAIN
COOKIE_EXPIRY_INTERVAL
WEBGATE_TYPE
OAM_TRANSFER_MODE
SSO_ENABLED_FLAG
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_BINDDN	YES
IDSTORE_DIRECTORYTYPE
IDSTORE_LOGINATTRIBUTE
IDSTORE_ADMIN_USER
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
MDS_DB_URL
MDS_DB_SCHEMA_USERNAME
WLSHOST	YES
WLSPORT	YES
WLSADMIN	YES
DOMAIN_NAME
DOMAIN_LOCATION
OIM_MANAGED_SERVER_NAME
OAM_SERVER_VERSION	Required only when Access Manager server does not support 11g webgate in Oracle Identity Manager-Access Manager integration. In that case, value should be provided as '10g'.
OAM11G_WLS_ADMIN_HOST	Required if Access Manager and Oracle Identity Manager servers are configured on different Weblogic domains (that is, a cross-domain setup)
OAM11G_WLS_ADMIN_PORT	Required if Access Manager and Oracle Identity Manager servers are configured on different Weblogic domains (that is, a cross-domain setup)
OAM11G_WLS_ADMIN_USER	Required if Access Manager and Oracle Identity Manager servers are configured on different Weblogic domains (that is, a cross-domain setup)

Example properties File

Here is a sample properties file for this option, which seeds the following keys in the credential store framework (CSF): SSOAccessKey, SSOKeystoreKey, SSOGlobalPP:

LOGINURI: /${app.context}/adfAuthentication
LOGOUTURI: /oamsso/logout.html
AUTOLOGINURI: None
ACCESS_SERVER_HOST: OAMHOST1.example.com
ACCESS_SERVER_PORT: 5575
ACCESS_GATE_ID: Webgate_IDM
COOKIE_DOMAIN: .example.com
COOKIE_EXPIRY_INTERVAL: -1
OAM_TRANSFER_MODE: simple
WEBGATE_TYPE: ohsWebgate10g
SSO_ENABLED_FLAG: true
IDSTORE_PORT: 389
IDSTORE_HOST: idstore.example.com
IDSTORE_DIRECTORYTYPE: OID 
IDSTORE_ADMIN_USER: cn=oamLDAP,cn=Users,dc=example,dc=com
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
MDS_DB_URL: jdbc:oracle:thin:DB Hostname:DB portno.:SID
MDS_DB_SCHEMA_USERNAME: edg_mds
WLSHOST: adminvhn.example.com
WLSPORT: 7001
WLSADMIN: weblogic
DOMAIN_NAME: IDMDomain
OIM_MANAGED_SERVER_NAME: WLS_OIM1
DOMAIN_LOCATION: ORACLE_BASE/admin/IDMDomain/aserver/IDMDomain

2.4.6 postProvConfig Command

Syntax

./idmConfigTool.sh -postProvConfig input_file=postProvConfig.props

Properties

The properties for this command are the same as for the preConfigIDStore command.

Example properties File

Here is a sample properties file for this option:

IDSTORE_HOST: host01.example.com
IDSTORE_PORT: 3060
IDSTORE_BINDDN: cn=orcladmin
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
IDSTORE_SEARCHBASE: dc=example,dc=com
IDSTORE_USERSEARCHBASE: cn=systemids,dc=example,dc=com
POLICYSTORE_CONTAINER: cn=FAPolicies
POLICYSTORE_HOST: host01.ca.example.com
POLICYSTORE_PORT: 3060
POLICYSTORE_BINDDN: cn=orcladmin
POLICYSTORE_READWRITEUSER: cn=PolicyRWUser,cn=systemids,dc=example,dc=com
OVD_HOST: host01.ca.example.com
OVD_PORT: 6501
OVD_BINDDN: cn=orcladmin
OIM_T3_URL : t3://host02.ca.example.com:14000
OIM_SYSTEM_ADMIN : abcdef

2.4.7 upgradeLDAPUsersForSSO Command

Syntax

idmConfigTool.sh -upgradeLDAPUsersForSSO input_file=input_Properties

Properties

Table 2-12 lists the command properties.

Table 2-12 Properties for upgradeLDAPUsersForSSO

Property	Required?
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_ADMIN_USER	YES
IDSTORE_DIRECTORYTYPE
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
PASSWORD_EXPIRY_PERIOD
IDSTORE_LOGINATTRIBUTE

Example properties File

Here is a sample properties file for this option:

IDSTORE_HOST: idstore.example.com
IDSTORE_PORT: 389
IDSTORE_ADMIN_USER: cn=orcladmin
IDSTORE_DIRECTORYTYPE:OVD
IDSTORE_USERSEARCHBASE: cn=Users,dc=example,dc=com
IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=example,dc=com
PASSWORD_EXPIRY_PERIOD: 7300
IDSTORE_LOGINATTRIBUTE: uid

2.4.8 validate IDStore Command

Syntax

./idmConfigTool.sh -validate component=IDSTORE input_file=input_Properties

Properties

Table 2-13 lists the command properties.

Table 2-13 Properties for validate IDStore

Property	Required?
IDSTORE_TYPE
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_SSLPORT	YES
IDSTORE_SSL_ENABLED	YES
IDSTORE_SUPER_USER	YES
IDSTORE_READWRITEUSER	YES
IDSTORE_READONLYUSER	YES
IDSTORE_USER_BASE	YES
IDSTORE_GROUP_BASE	YES
IDSTORE_SEEDING
IDSTORE_POST_VALIDATION
IDSTORE_ADMIN_GROUP	YES
IDSTORE_ADMIN_GROUP_EXISTS

Example properties File

Here is a sample properties file for this option:

idstore.type: OID
idstore.host: acb21005.us.example.com
idstore.port: 3030
idstore.sslport: 4140
idstore.ssl.enabled: false
idstore.super.user: cn=weblogic_fa,cn=systemids,dc=example,dc=com
idstore.readwrite.username: cn=IDRWUser,cn=systemids,dc=example,dc=com
idstore.readonly.username: cn=IDROUser,cn=systemids,dc=example,dc=com
idstore.user.base: cn=Users,dc=example,dc=com
idstore.group.base: cn=Groups,dc=example,dc=com
idstore.seeding: true
idstore.post.validation: false
idstore.admin.group: cn=IDM Administrators,cn=Groups,dc=example,dc=com
idstore.admin.group.exists: true

2.4.9 validate PolicyStore Command

Syntax

./idmConfigTool.sh -validate component=POLICYSTORE input_file=input_Properties

Properties

Table 2-14 lists the command properties.

Table 2-14 Properties for validate policystore

Property	Required?
POLICYSTORE_HOST	YES
POLICYSTORE_PORT	YES
POLICYSTORE_SECURE_PORT	YES
POLICYSTORE_IS_SSL_ENABLED
POLICYSTORE_READ_WRITE_USERNAME
POLICYSTORE_SEEDING
POLICYSTORE_JPS_ROOT_NODE
POLICYSTORE_DOMAIN_NAME	YES
POLICYSTORE_CREATED_BY_CUSTOMER
POLICYSTORE_JPS_CONFIG_DIR
POLICYSTORE_CRED_MAPPING_FILE_LOCATION
POLICYSTORE_ADF_CRED_FILE_LOCATION
POLICYSTORE_STRIPE_FSCM
POLICYSTORE_STRIPE_CRM
POLICYSTORE_STRIPE_HCM
POLICYSTORE_STRIPE_SOA_INFRA
POLICYSTORE_STRIPE_APM
POLICYSTORE_STRIPE_ESSAPP
POLICYSTORE_STRIPE_B2BUI
POLICYSTORE_STRIPE_OBI
POLICYSTORE_STRIPE_WEBCENTER
POLICYSTORE_STRIPE_IDCCS
POLICYSTORE_CRED_STORE
IDM_KEYSTORE_FILE

Example properties File

Here is a sample properties file for this option:

POLICYSTORE_HOST: node0316.example.com
POLICYSTORE_PORT: 3067
POLICYSTORE_SECURE_PORT : 3110
POLICYSTORE_IS_SSL_ENABLED: FALSE
POLICYSTORE_READ_WRITE_USERNAME : cn=PolicyRWUser,cn=systemids,dc=example,dc=com
POLICYSTORE_SEEDING: true
POLICYSTORE_JPS_ROOT_NODE : cn=jpsroot
POLICYSTORE_DOMAIN_NAME: dc=example,dc=com

2.4.10 validate OAM Command (11g)

Syntax

./idmConfigTool.sh -validate component=OAM11g input_file=input_Properties

Note:

The tool prompts for the WebLogic administration server user password upon execution.

Properties

Table 2-15 lists the command properties.

Table 2-15 Properties for validate component=OAM11g

Property	Required?
ADMIN_SERVER_HOST	YES
ADMIN_SERVER_PORT	YES
ADMIN_SERVER_USER	YES
IDSTORE_HOST	YES
IDSTORE_PORT	YES
IDSTORE_IS_SSL_ENABLED
OAM11G_ACCESS_SERVER_HOST	YES
OAM11G_ACCESS_SERVER_PORT	YES
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN
OAM11G_OIM_INTEGRATION_REQ
OAM11G_OAM_ADMIN_USER
OAM11G_SSO_ONLY_FLAG

Example properties File

Here is a sample properties file for this option, which validates the Access Manager server:

admin_server_host: abc5411405.ca.example.com
admin_server_port: 17001
admin_server_user: weblogic
IDSTORE_HOST:abc5411405.ca.example.com
IDSTORE_PORT:3060
IDSTORE_IS_SSL_ENABLED:false
OAM11G_ACCESS_SERVER_HOST:abc5411405.ca.example.com
OAM11G_ACCESS_SERVER_PORT:5575
OAM11G_IDSTORE_ROLE_SECURITY_ADMIN:OAMAdministrators
OAM11G_OIM_OHS_URL: http://abc5411405.ca.example.com:7779/
OAM11G_OIM_INTEGRATION_REQ: true
OAM11G_OAM_ADMIN_USER:oamadminuser
OAM11G_SSO_ONLY_FLAG: true
OAM11G_OAM_ADMIN_USER_PASSWD:

2.4.11 validate OAM Command (10g)

Syntax

./idmConfigTool.sh -validate component=OAM10g input_file=input_Properties

Properties

Table 2-16 lists the command properties.

Table 2-16 Properties for validate component=OAM10g

Property	Required?
OAM10g_MODE
OAM10g_NOPROMPT
OAM10g_POLICY_HOST
OAM10g_POLICY_PORT
OAM10g_POLICY_USERDN
OAM10g_POLICY_USERPWD
OAM10g_AAA_MODE
OAM10g_AAA_PASSPHRASE
OAM10g_PRIMARY_SERVERS
OAM10g_SECONDARY_SERVERS
OAM10g_RUNTIME_USER

2.4.12 validate OIM command

Syntax

./idmConfigTool.sh -validate component=OIM11g input_file=input_Properties

Note:

The tool prompts for the WebLogic administration server user password upon execution.

Properties

Table 2-17 lists the command properties.

Table 2-17 Properties for validate component=OIM11g

Property	Required?
ADMIN_SERVER_HOST	YES
ADMIN_SERVER_PORT	YES
ADMIN_SERVER_USER	YES
OAM_HOST
OAM_NAP_PORT
IDSTORE_USERSEARCHBASE	YES
IDSTORE_GROUPSEARCHBASE	YES
OIM_IS_SSL_ENABLED
OIM_HOST	YES
OIM_PORT	YES

Example properties File

Here is a sample properties file for this option:

admin_server_host: node06.example.com
admin_server_port: 17111
admin_server_user: weblogic
oam_host : node06.example.com
oam_nap_port : 5575
idm.keystore.file: idm.keystore.file
idstore.user.base: cn=Users,dc=example,dc=com
idstore.group.base: cn=Groups,dc=example,dc=com
oim_is_ssl_enabled: false
OIM_HOST: node06.example.com
OIM_PORT: 1400

2.4.13 configOVD Command

Syntax

./idmConfigTool.sh -configOVD input_file=input_Properties

Properties

Table 2-18 lists the command properties (where n=1,2..).

Table 2-18 configOVD properties

Property	Required?
OVD_HOST	YES
OVD_PORT	YES
OVD_BINDDN	YES
OVD_SSL
LDAPn_TYPE
LDAPn_HOST	YES
LDAPn_PORT	YES
LDAPn_BINDDN	YES
LDAPn_SSL
LDAPn_BASE	YES
LDAPn_OVD_BASE	YES
USECASE_TYPE	YES

Example Properties Files

The content of the properties file for the configOVD command depends on the Oracle Virtual Directory configuration. This section provides some sample files.

Here is an example of the file named single.txt for a single-server configuration:

ovd.host:myhost.us.example.com
ovd.port:7000
ovd.binddn:cn=orcladmin
ovd.ssl:true
ldap1.type:OID
ldap1.host:myhost.us.example.com
ldap1.port:7000
ldap1.binddn:cn=oimadmin,cn=systemids,dc=example,dc=com
ldap1.ssl:false
ldap1.base:dc=example,dc=com
ldap1.ovd.base:dc=example,dc=com
usecase.type: single

When using this file, the command is thus invoked as:

idmConfigTool -configOVD input_file=path/single.txt
 
Enter OVD password: password
Enter LDAP password: password

Here is an example of the file named split.txt for a split-profile server configuration:

ovd.host:myhost.us.example.com
ovd.port:7000
ovd.binddn:cn=orcladmin
ovd.ssl:true
ldap1.type:AD
ldap1.host:10.0.0.0
ldap1.port:7000
ldap1.binddn:[e-mail]
ldap1.ssl:true
ldap1.base:dc=idmqa,dc=com
ldap1.ovd.base:dc=idmqa,dc=com
usecase.type: split
ldap2.type:OID
ldap2.host:myhost.us.example.com
ldap2.port:7000
ldap2.binddn:cn=oimadmin,cn=systemids,dc=example,dc=com
ldap2.ssl:false
ldap2.base:dc=example,dc=com
ldap2.ovd.base:dc=example,dc=com

When using this file, the command is thus invoked as:

idmConfigTool -configOVD input_file=path/split.txt
 
Enter OVD password: password
Enter LDAP1 password: password
Enter LDAP2 password: password

2.4.14 ovdConfigUpgrade Command

Syntax

./idmConfigTool.sh -ovdConfigUpgrade input_file=input_Properties

Properties

Table 2-19 lists the command properties.

Table 2-19 ovdConfigUpgrade Properties

Property	Required?
OVD_HOST
OVD_PORT
OVD_BINDDN
OVD_SSL
LDAPn_BINDDN
LDAPn_SSL

Example properties File

Here is a sample properties file for this option which upgrades the existing adapters:

ovd.host:abk005sjc.us.myhost.com
ovd.port:8801
ovd.binddn:cn=orcladmin
ovd.ssl:true

2.4.15 disableOVDAccessConfig Command

Syntax

./idmConfigTool.sh -disableOVDAccessConfig input_file=input_Properties

Properties

Table 2-20 lists the command properties.

Table 2-20 disableOVDAccessConfig Properties

Property	Required?
OVD_HOST
OVD_PORT
OVD_BINDDN
OVD_SSL
LDAPn_BINDDN
LDAPn_SSL

Example properties File

Here is a sample properties file for this option which disables the anonymous access in Oracle Virtual Directory:

ovd.host:abc00def.ca.example.com
ovd.port:8501
ovd.binddn:cn=orcladmin
ovd.ssl:true

2.4.16 upgradeOIMTo11gWebgate

Syntax

./idmConfigTool.sh -upgradeOIMTo11gWebgate input_file=input_Properties

Properties

This command uses the same properties that are required for the configOIM command, so the same properties file can work for both. See Table 2-11.

As indicated in the table, certain properties are required when Oracle Identity Manager and Access Manager are configured on different weblogic domains.

2.5 Examples

For examples of idmConfigTool usage, see the individual command options in Command Options and Properties.