This chapter describes how to install and configure Oracle iPlanet 11g WebGate for Oracle Access Manager. For an introduction to WebGates and an overview of installing WebGates, see Chapter 1.
This chapter contains the following sections:
Section 4.3, "Post-Installation Steps for Oracle iPlanet 11g WebGate"
Section 4.4, "Verifying the Installation and Configuration of Oracle iPlanet 11g WebGate"
Section 4.5, "Getting Started with a New Oracle iPlanet 11g WebGate"
Section 4.7, "Silent Installation for Oracle iPlanet 11g WebGate"
This section discusses the following topics:
The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 11g Release 1 (11.1.1).
You can access the Oracle Fusion Middleware Supported System Configurations document by searching the Oracle Technology Network (OTN) web site:
http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html
You must have a 64-bit Java runtime environment (JRE), 1.6 or higher installed.
If you do not have Oracle iPlanet Web Server 7.0.9 installed, you can download the Installer from the Oracle Technology Network (OTN):
http://www.oracle.com/technology/software/products/middleware/htdocs/fmw_11_download.html
For information about installation and configuration, see the Oracle iPlanet Web Server 7.0.9 Installation and Migration Guide.
For information about installing Oracle Access Manager (OAM), see "Installing and Configuring Oracle Identity and Access Management (11.1.1.7.0)" in the Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.
For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see "Configuring Oracle Access Manager" in the Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.
In addition, see the "Securing Communication Between OAM 11g Servers and WebGates" topic in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager for information about configuring Oracle Access Manager in Open, Simple, or Cert mode.
This section includes the following topics:
For information about obtaining the Oracle iPlanet 11g WebGate software, see the Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.
To start the installation wizard, do the following:
Go to the directory in which you extracted the contents of the Installer.
Go to the following location:
cd Disk1
Run the following command:
./runInstaller
Provide the jre location when the Oracle Universal Installer (OUI) prompts for it.
After the Installer starts, the Welcome screen is displayed. Proceed with the installation by referring to the section "Installation Flow and Procedure of Oracle iPlanet 11g WebGate" for installing Oracle iPlanet 11g WebGate for Oracle Access Manager.
To install Oracle iPlanet 11g WebGate for Oracle Access Manager, follow the instructions in Table 4-1.
If you need additional help with any of the installation screens, click Help to access the online help.
Table 4-1 Installation Flow of Oracle iPlanet WebGate
| No. | Screen | Description and Action Required |
|---|---|---|
|
1 |
Welcome Screen |
Click Next to continue. |
|
2 |
Prerequisite Checks Screen |
Click Next to continue. |
|
3 |
Specify Installation Location Screen |
Specify the Middleware Home and Oracle Home locations. For more information about these directories, see "Understanding Oracle Fusion Middleware Concepts and Directory Structure" in Oracle Fusion Middleware Installation Planning Guide. Click Next to continue. |
|
4 |
Installation Summary Screen |
Verify the information on this screen. Click Install to begin the installation. |
|
5 |
Installation Progress Screen |
Click Next to continue. |
|
6 |
Installation Complete Screen |
Click Finish to dismiss the Installer. |
This section includes the following topics:
Create an Oracle Traffic Director instance by using the deployWebGateInstance.sh tool from the Webgate Oracle Home directory.
To deploy the Oracle iPlanet WebGate instance, do the following:
Go to the WebGate_Oracle_Home/webgate/iplanet/tools/deployWebGate directory, by running the following command:
cd WebGate_Oracle_Home/webgate/iplanet/tools/deployWebGate
Run the following command:
./deployWebGateInstance -w WebGate_Instancedir -oh WebGate_Oracle_Home -ws ohs|iplanet|otd
In this command:
WebGate_Instancedir is the directory in which new WebGate instances should be created.
WebGate_Oracle_Home is the WebGate Oracle home directory you specified while installing iPlanet 11g WebGate.
Web server is iPlanet.
Example:
./deployWebGateInstance.sh -w /home/wg_instance4iplanet/ -oh /home/Oracle_OAMWebGate1/ -ws iPlanet
Set the environment variable LD_LIBRARY_PATH to WebGate_Oracle_Home/lib
Example:
bash$ export LD_LIBRARY_PATH=/home/Oracle_OAMWebGate1/lib
To run the EditObjConf tool, do the following:
Go to the WebGate_Oracle_Home/webgate/iplanet/tools/setup/InstallTools directory, by running the following command:
cd WebGate_Oracle_Home/webgate/iplanet/tools/setup/InstallTools
Run the following command:
./EditObjConf -f path_to_webserver_config_file -w WebGate_Instance_Dir -oh WebGate_Oracle_Home -ws WebServer
In this command:
path_to_webserver_config_file is the full path of the iPlanet instance obj.conf file.
WebGate_Instance_Dir is the directory in which the new WebGate instances are created.
WebGate_Oracle_Home is the full path to the WebGate Oracle home.
WebServer is iPlanet.
Example:
cd /home/OAMWebGate1/webgate/iplanet/tools/setup/InstallTools/
./EditObjConf -f /home/instanceHome1/net-test_iplanet1/config/test_iplanet1-obj.conf -oh /home/Oracle_OAMWebGate1/ -w /home/Oracle_OAMWebGate1/wg_instance4iplanet/ -ws iplanet
After installing Oracle iPlanet 11g WebGate for Oracle Access Manager, you can examine the installDATE-TIME_STAMP.out log file to verify the installation. The default location of the log is in the following file:
WebGate_Home/oraInst.loc
Before you use the new Oracle Traffic Director 11g WebGate for Oracle Access Manager, you must complete the following tasks:
Registering the New WebGate Agent for Oracle iPlanet 11g WebGate
Copying Generated Files and Artifacts to the WebGate Instance Location
You can register the new iPlanet WebGate with Oracle Access Manager by using the Oracle Access Manager Administration Console. For more information, see "Registering Partners (Agents and Applications) by Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.
Alternatively, you can use the RREG command-line tool to register a new WebGate agent. You can run the tool in two modes: In-Band and Out-Of-Band.
This section includes the following topics:
To set up the RREG tool, complete the following steps:
After installing and configuring Oracle Access Manager, go to the following directory:
Oracle_IDM2/oam/server/rreg/client
Untar the RREG.tar.gz file.
Example:
gunzip RREG.tar.gz
tar -xvf RREG.tar
The tool for registering the agent is at:
RREG_Home/bin/oamreg.sh
Note:
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg.
Set the following environment variables in the oamreg.sh script:
OAM_REG_HOME
Set this variable to the absolute path to the directory in which you extracted the contents of RREG.tar/rreg.
JDK_HOME
Set this variable to the absolute path to the directory in which Java or JDK is installed on your machine.
You must update the agent parameters, such as agentName, in the OAM11GRequest.xml file in the RREG_Home/input directory.
Note:
The OAM11GRequest.xml file or the short version OAM11GRequest_short.xml is used as a template. You can copy this template file and use it.
Modify the following required parameters in the OAM11GRequest.xml file or in the OAM11GRequest_short.xml file:
serverAddress
Specify the host and the port of the OAM Administration Server.
agentName
Specify any custom name for the agent.
agentBaseUrl
Specify the host and the port of the machine on which Oracle Traffic Director 11g WebGate is installed.
preferredHost
Specify the host and the port of the machine on which Oracle Traffic Director 11g WebGate is installed.
security
Specify the security mode, such as open, based on the WebGate installed.
primaryServerList
Specify the host and the port of Managed Server for the Oracle Access Manager proxy, under a Server container element.
After modifying the file, save and close it.
If you run the RREG tool once after updating the WebGate parameters in the OAM11GRequest.xml file, then the files and artifacts required by WebGate are generated in the following directory:
RREG_Home/output/agent_name
Note:
You can run RREG either on a client machine or on the server. If you are running it on the server, then you must manually copy the artifacts back to the client.
Complete the following steps:
Open the OAM11GRequest.xml file, which is in RREG_Home/input/. RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg. Edit the XML file and specify parameters for the new Oracle Traffic Director WebGate for Oracle Access Manager.
Run the following command:
./RREG_Home/bin/oamreg.sh inband input/OAM11GRequest.xml
If you are an end user with no access to the server, then you can email your updated OAM11GRequest.xml file to the system administrator, who can run RREG in the out-of-band mode. You can collect the generated AgentID_Response.xml file from the system administrator and run RREG on this file to obtain the WebGate files and artifacts you require.
After you receive the generated AgentID_Response.xml file from the administrator, you must manually copy the file to the input directory on your machine.
Complete the following steps:
If you are an end user with no access to the server, then open the OAM11GRequest.xml file, which is in the RREG_Home/input/ directory.
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg. Edit the XML file and specify parameters for the new Oracle iPlanet WebGate for Oracle Access Manager. Send the updated file to your system administrator.
If you are an administrator, copy the updated OAM11GRequest.xml file, which is in the RREG_Home/input/ directory.
This is the file that you received from the end user. Go to your (administrator's) RREG_Home directory and run the following command:
./RREG_Home/bin/oamreg.sh outofband input/OAM11GRequest.xml
An Agent_ID_Response.xml file is generated in the output directory on the administrator's machine in the RREG_Home/output/ directory. Send this file to the end user who sent you the updated OAM11GRequest.xml file.
If you are an end user, copy the generated Agent_ID_Response.xml file, which is in the RREG_Home/input/ directory.
This is the file that you received from the administrator. Move to your (client's) RREG home directory and run the following command:
./RREG_Home/bin/oamreg.sh outofband input/Agent_ID_Response.xml
Note:
If you register the WebGate agent by using the Oracle Access Manager Administration Console, as described in "Registering Partners (Agents and Applications) by Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager, you must manually copy the files and artifacts generated after the registration, from the server (the machine on which the Oracle Access Manager Administration Console is running) to the client. The files and artifacts are generated in the MW_HOME/user_projects/domains/name_of_the_WebLogic_domain_for_OAM/output/Agent_ID directory.
Regardless of the method or mode you use to register the new WebGate agent, the following files and artifacts are generated in the RREG_Home/output/Agent ID directory:
cwallet.sso
ObAccessClient.xml
In the SIMPLE mode, RREG generates:
password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be the same as the passphrase used on the server.
aaa_key.pem
aaa_cert.pem
In the CERT mode, RREG generates password.xml file, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.
Note:
You can use these files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing aaa_cert.pem and aaa_chain.pem files along with password.xml and aaa_key.pem.
After RREG generates these files and artifacts, you must manually copy the following files, based on the security mode you are using, from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home directory.
Do the following according to the security mode you are using:
In OPEN mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:
ObAccessClient.xml
cwallet.sso
In SIMPLE mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:
ObAccessClient.xml
cwallet.sso
password.xml
In addition, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config/simple directory:
aaa_key.pem
aaa_cert.pem
In CERT mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:
ObAccessClient.xml
cwallet.sso
password.xml
After copying the files, you must either generate a new certificate or migrate an existing certificate.
You can generate a new certificate as follows:
Go to the WebGate_Home/webgate/iplanet/tools/openssl directory.
Create a certificate request as follows:
./openssl req -utf8 -new -nodes -config openssl_silent_ohs11g.cnf -keyout aaa_key.pem -out aaa_req.pem -rand WebGate_Home/webgate/iplanet/config/random-seed
Self-sign the certificate as follows:
./openssl ca -config openssl_silent_ohs11g.cnf -policy policy_anything -batch -out aaa_cert.pem -infiles aaa_req.pem
Copy the following generated certificates to the WebGate_Instance_Home/webgate/config directory:
aaa_key.pem
aaa_cert.pem
cacert.pem located in the simpleCA directory
Note:
After copying the cacert.pem file, you must rename the file to aaa_chain.pem.
Migrating an Existing Certificate
If you want to migrate an existing certificate (aaa_key.pem, aaa_cert.pem, and aaa_chain.pem), ensure that you use the same passphrase that you used to encrypt aaa_key.pem. You must enter the same passphrase during the RREG registration process. If you do not use the same passphrase, the password.xml file generated by RREG does not match the passphrase used to encrypt the key.
If you enter the same passphrase, you can copy these certificates as follows:
Go to the WebGate_Instance_Home/WebGate/config directory.
Copy the following certificates to the WebGate_Instance_Home/webgate/config directory:
aaa_key.pem
aaa_cert.pem
aaa_chain.pem
Use the startserv command to start or stopserv command to stop your Oracle iPlanet instance.
To stop the server, run the following command:
/home/bin/stopserv
To start the server, run the following command:
export LD_LIBRARY_PATH=/WebGate_Home/lib
/home/bin/startserv
To restart the Oracle iPlanet instance, stop all running instances, and then run the start command.
You should always use the instructions provided in this section for removing the Oracle iPlanet 11g WebGates for Oracle Access Manager. If you try to remove the software manually, you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this section will ensure that the software is properly removed.
To deinstall the WebGate agent, do the following:
Go to the MW_HOME/webgate_Home/oui/bin directory on UNIX, and MW_HOME\Webgate_home\oui\bin on Windows.
Run the following command:
On UNIX: ./runInstaller -deinstall
On Windows: setup.exe -deinstall -jreLoc JRE_LOCATION
Ensure that you specify the absolute path to your JRE_LOCATION; relative paths are not supported.
After the deinstaller starts, the Welcome screen is displayed. Proceed with the deinstallation by referring to Section 4.6.1.
Follow the instructions in Table 4-2 to complete the deinstallation.
If you need additional help with any of the deinstallation screens, click Help to access the online help.
| Sl. No. | Screen | Description | Action Required |
|---|---|---|---|
|
1. |
Welcome |
Each time the deinstaller starts, the Welcome screen is displayed. |
Click Next. |
|
2. |
Deinstall Oracle Home |
The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall. |
Verify the Oracle home you are about to deinstall. Click Deinstall. On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory in addition to removing the software. Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen. If you select No, go to Section 4.6.2 for instructions on how to manually remove your Oracle home directory. |
|
3. |
Deinstallation progress |
The Deinstallation Progress screen shows the progress and status of the deinstallation. |
Wait until the Deinstallation Complete screen appears. |
|
4. |
Deinstallation Complete |
The Deinstallation Complete screen appears when the deinstallation is complete. |
Click Finish to dismiss the screen. |
If you have selected No on the warning screen during deinstallation, you must manually remove your Webgate_Home directory and any sub-directories. For example: if your Oracle WebGate home directory was /home/Oracle/Middleware/Oracle_OAMWebGate1, run the following command:
cd /home/Oracle/Middleware/
rm -rf Oracle_OAMWebGate1
On Windows, if your Oracle Common home directory was C:\Oracle\Middleware\Oracle_OAMWebGate1, then use a file manager window, go to the C:\Oracle\Middleware directory, right-click on the Oracle_OAMWebGate1 folder, and then select Delete.
To run the Oracle iPlanet 11g WebGate in silent mode, complete the following steps:
Go to the Disk1 directory under the WebGate folder.
Run the following command:
./runInstaller -silent -waitForCompletion -invPtrLoc /home/wg.customInventory ORACLE_HOME=/home/Oracle_OAMWebGate -jreloc /usr -response