18 Configuring Oracle Mobile Security Services

This chapter describes how to configure Oracle Mobile Security Services (OMSS). Before performing any of the steps in this section, ensure that the latest Mobile Security Suite and Mobile Security Access Server Bundle Patches have been applied.

Oracle Mobile Security Services (OMSS) will be deployed when you configure Oracle Access Management. However, to use its functionality, you must configure OMSS.

This chapter includes the following topics:

18.1 Creating the Configuration Files

Create two properties files - msm.props and msas.props. The content of these files must be same as the file you created in Section 13.2, "Creating a Configuration File", with the following additional properties:

Note:

if your deployment is on Exalogic, you must provide the OTD fail-over group name for IDSTORE_HOST parameter. For non-Exalogic setups, provide the LBR entry point for IDSTORE_HOST.

  • For msm.props file:

    # OMSS Properties

    OMSS_OMSM_IDSTORE_PROFILENAME: MSSProfile

    OMSS_DOMAIN_LOCATION: /u01/oracle/config/domains/IAMAccessDomain

    WLSHOST: iadadminvhn.example.com

    WLSPORT: 7001

    WLSADMIN: weblogic

    WLSPASSWD: password

    OMSS_SCEP_DYNAMIC_CHALLENGE_USER: msmadmin

    OMSS_IDSTORE_ROLE_SECURITY_ADMIN: OAMAdministrators

    OMSS_IDSTORE_ROLE_SECURITY_HELPDESK: MSMHelpDesk

    OMSS_MSAS_SERVER_HOST: msas.example.com

    OMSS_MSAS_SERVER_PORT: 9002

    OAM_SERVER_URL: http://iadinternal.example.com:7777

    OMSS_OMSM_SERVER_NAME: wls_msm1,wls_msm2

    OMSS_OAM_POLICY_MGR_SERVER_NAME: wls_ama1,wls_ama2

    OMSS_OMSM_SERVER_HOST:OAMHOST1.example.com,OAMHOST2.example.com

    OMSS_OMSM_FRONT_END_URL: http://iadinternal.example.com:7777

    OMSS_JDBC_URL: jdbc:oracle:thin:@(DESCRIPTION = (ADDRESS=(PROTOCOL=TCP)(HOST=iaddb-scan.example.com)(PORT=1521)) (CONNECT_DATA=(SERVICE_NAME=iadedg.example.com)))

    OMSS_OMSM_SCHEMA_USER: EDGIAD_OMSM

    OMSS_GATEWAY_INSTANCE_ID: EDGMSAS

  • For msas.props file:

    # OMSS Properties

    OMSS_OMSM_IDSTORE_PROFILENAME: MSSProfile

    WLSHOST: iadadminvhn.example.com

    WLSPORT: 7001

    WLSADMIN: weblogic

    WLSPASSWD: password

    OMSS_DOMAIN_LOCATION: /u01/oracle/config/domains/IAMAccessDomain

    OMSS_SCEP_DYNAMIC_CHALLENGE_USER: msmadmin

    OMSS_IDSTORE_ROLE_SECURITY_ADMIN: OAMAdministrators

    OMSS_IDSTORE_ROLE_SECURITY_HELPDESK: MSMHelpDesk

    OMSS_MSAS_SERVER_HOST: msas.example.com

    OMSS_MSAS_SERVER_PORT: 9002

    OAM_SERVER_URL=http://iadinternal.example.com:7777

    OMSS_OMSM_SERVER_NAME: wls_msm1,wls_msm2

    OMSS_OAM_POLICY_MGR_SERVER_NAME: wls_ama1,wls_ama2

    OMSS_OMSM_FRONT_END_URL: http://iadinternal.example.com:7777

    OMSS_JDBC_URL: jdbc:oracle:thin:@(DESCRIPTION = (ADDRESS=(PROTOCOL=TCP)(HOST=iaddb-scan.example.com)(PORT=1521)) (CONNECT_DATA=(SERVICE_NAME=iadedg.example.com)))

    OMSS_OMSM_SCHEMA_USER: EDGIAD_OMSM

    OMSS_OMSAS_IDSTORE_PROFILENAME: msas-profile

    OMSS_GATEWAY_INSTANCE_ID: EDGMSAS

Description of the Properties:

Table 18-1 describes the properties used for Oracle Mobile Security Suite configuration.

Note:

The value of the property IDSTORE_DIRECTORYTYPE must be specified in UPPERCASE.

The WebLogic Managed Server names in properties OMSS_OMSM_SERVER_NAME and OMSS_OAM_POLICY_MGR_SERVER_NAME must be specified in the same case as configured in WebLogic.

Table 18-1 Oracle Mobile Security Suite Configuration Properties

Property Description

OMSS_OMSM_IDSTORE_PROFILENAME

Name of the identity store profile for Oracle Mobile Security Manager.

OMSS_DOMAIN_LOCATION

The absolute path to the Oracle Mobile Security Suite domain. This is the value of IAD_ASERVER_HOME from the worksheet.

OMSS_SCEP_DYNAMIC_CHALLENGE_USER

User account used for authentication.

OMSS_IDSTORE_ROLE_SECURITY_ADMIN

Name of the administrator group whose members have administrative privileges for Oracle Mobile Security Manager operations. This group is used to allow access to the Oracle Mobile Security Manager features on the Policy Manager Console.

This should be set to the same value that you provided for OAM11G_IDSTORE_ROLE_SECURITY_ADMIN property in the Oracle Access Manager configuration properties file.

OMSS_IDSTORE_ROLE_SECURITY_HELPDESK

Name of the Oracle Mobile Security Manager helpdesk group whose members get helpdesk privileges for Oracle Mobile Security Manager operations.

This group is used to allow access to the Security Help Desk privileges on the Policy Manager Console.

OMSS_MSAS_SERVER_HOST

The host name for Oracle Mobile Security Access Server.

For example, oamhost1.example.com and oamhost2.example.com.

If the Mobile Security Access Server instance is behind a load balancer, provide the host name of the load balancer.

OMSS_MSAS_SERVER_PORT

The SSL port where the Oracle Mobile Security Access Server instance will be running. This is the value of MSAS_PORT from the worksheet.

If the Mobile Security Access Server instance is behind a load balancer, provide the port number of the load balancer.

OAM_SERVER_URL

This is the internal link for OAM internal calls. For example:

http://iadinternal.example.com:7777

OMSS_OMSM_SERVER_NAME

A comma-separated list of Mobile Security Manager Managed Server names.

For example, wls_msm1,wls_msm2.

OMSS_OAM_POLICY_MGR_SERVER_NAME

A comma-separated list of Policy Manager Managed Server names.

For example, wls_ama1,wls_ama2.

OMSS_OMSM_SERVER_HOST

A comma-separated list of host names hosting the Oracle Mobile Security Manager Managed Servers.

For example, OAMHOST1.example.com, OAMHOST2.example.com.

OMSS_OMSM_FRONT_END_URL

The URL of the load balancer which routes requests to the Mobile Security Manager Managed Servers.

For example:

http://igdinternal.example.com:7777

OMSS_JDBC_URL

The JDBC URL to the Oracle Mobile Security Manager database repository, in the following format, where db_host is the host name of the machine on which the database resides, port is the listener port of the database, and service_name is the service name identified for the database:

jdbc:oracle:thin:@db_host:port/service_name

OMSS_OMSM_SCHEMA_USER

The user name for the Oracle Mobile Security Manager schema, which consists of the prefix that was configured for the repository in RCU followed by _OMSM.

For example, EDGIAD_OMSM.

OMSS_GATEWAY_INSTANCE_ID

The name of the Oracle Mobile Security Access Server gateway instance. The gateway instance ID must be the same as the instance ID you use when you configure Oracle Mobile Security Access Server.

This property is only required when you are running the idmConfigTool -configOMSS mode=OMSAS command after you have configured your Oracle Mobile Security Access Server instance.

This property should not be set when you are running the idmConfigTool for configuring Oracle Mobile Security Manager.

OMSS_OMSAS_IDSTORE_PROFILENAME

Name of the identity store profile for Oracle Mobile Security Access Server.

This property is only required for running the idmConfigTool -configOMSS mode=OMSAS command after you have configured your Oracle Mobile Security Access Server instance.

This property should not be set when you are running the idmConfigTool for configuring Oracle Mobile Security Manager.

Oracle Mobile Security Manager can send notifications such as the number of unread e-mails. To enable this, you must provide the exchange server and email server details using the properties described in Table 18-2. These properties are optional and can be provided after the configuration, if required.

Table 18-2 Optional Properties for Oracle Mobile Security Suite Configuration

Property Description

OMSS_EXCHANGE_SERVER_URL

The URL of the Exchange server that Oracle Mobile Security Suite will connect to.

OMSS_EXCHANGE_LISTENER_URL

The listener URL of the Exchange server that Oracle Mobile Security Suite will connect to.

OMSS_EXCHANGE_DOMAIN_NAME

The domain name of the Exchange server that Oracle Mobile Security Suite will connect to.

OMSS_EXCHANGE_ADMIN_USER

The administrative user name of the Exchange server that Oracle Mobile Security Suite will connect to.

OMSS_EXCHANGE_ADMIN_PASSWORD

The password of the Exchange Server administrator.

OMSS_EXCHANGE_SERVER_VERSION

The version number of the Exchange server that Oracle Mobile Security Suite will connect to.

OMSS_EMAIL_ADMIN_USER

The Email address of the Oracle Mobile Security Suite administrator.

OMSS_EMAIL_ADMIN_PASSWORD

The password of the Oracle Mobile Security Suite administrator's Email address.

OMSS_SMTP_HOST

The host name of the SMTP server that Oracle Mobile Security Manager will use to send Email invites to users.

OMSS_SMTP_PORT

The port number of the SMTP server that Oracle Mobile Security Manager will use to send Email invites to users.

OMSS_APPLE_CACERT_FILE

The location of Apple root CA. Required during iOS device enrollment in Oracle Mobile Security Suite.

OMSS_APNS_FILE

The full path and file name of the Apple Push Notification Service (APNs) keystore file, which is used to establish secure connection to Apple server and to send notifications.

This should be the same location on all hosts.

For example, SHARED_CONFIG_DIR/keystores/ APNS.p12

OMSS_APNS_KEYSTORE_TYPE

The type of keystore used for the Apple Push Notification Service (APNs) keystore file (OMSS_APNS_FILE).

The valid keystore types are JKS or PKCS12. The default value is JKS.

OMSS_GCM_API_KEY

The API key value for Google Cloud Messaging (GCM) notification.

OMSS_GCM_SENDER_ID

The Google Cloud Messaging (GCM) notification sender ID.

18.2 Configuring Oracle Mobile Security Manager

Configure Oracle Mobile Security Manager (MSM) using the idmConfig tool. To do this, complete the following steps on OAMHOST1:

  1. Set the following environment variables:

    • Set MW_HOME to IAD_MW_HOME

    • Set JAVA_HOME to JAVA_HOME

    • Set ORACLE_HOME to IAD_ORACLE_HOME

    • Set WL_HOME to IAD_MW_HOME/wlserver_10.3

  2. Change directory to the IAD_ORACLE_HOME/idmtools/bin directory using the following command:

    cd IAD_ORACLE_HOME/idmtools/bin

  3. Run the following command:

    idmConfigTool.sh -configOMSS mode=OMSM input_file=configfile

    In this command, configfile is the full or relative path to the properties file (msm.props) you created in Creating the Configuration Files.

    For example:

    idmConfigTool.sh -configOMSS mode=OMSM input_file=msm.props

    When the command runs, you will be prompted to enter the password of the account that is used to connect to the identity store. It also prompts you to enter passwords for the following:

    • OMSS Keystore: Enter the password that will be assigned to the OMSS keystore when it is created.

    • SCEP Dynamic Challenge Password: Enter the password for the SCEP Dynamic Challenge user.

    • OMSM Schema User Password: Enter the password of the Oracle Mobile Security Manager schema (prefix_OMSM) created using RCU.

    The following is the sample command output:

    (1/8) MSM Configurations                                  Success
(2/8) Seeding User Notification Templates                 Success
(3/8) Seeding CSF Credentials                             Success
(4/8) Configuring IDS Profile                             Success
(5/8) Configuring OMSS Authentication Provider            Success
(6/8) Creating MSM Keystores                              Success
(7/8) Configuring MSM Server's SSL                        Success
(8/8) OAM Console Integration                             Success

    Check the log file for any errors or warnings and correct them. A file named automation.log is created in the directory where you run the tool.

    This process creates objects in the domain. To make these objects visible, you must restart the Administration Server.

  4. Pack the IAMAccessDomain on OAMHOST1 and unpack it on OAMHOST1 and OAMHOST2.

    To pack the IAMAccessDomain, run the following command on OAMHOST1 from the location IAD_MW_HOME/oracle_common/common/bin:

    ./pack.sh -managed=true -domain=IAD_ASERVER_HOME -template=domaintemplateMSM.jar -template_name=domain_template_MSM

    Note:

    The pack command does not overwrite existing files. If the file name that you specify matches the name of an existing file in the specified folder, the pack command fails. You must use a different name for the template file for pack command and use the option overwrite_domain=true for the unpack command.

    The -overwrite_domain option in the unpack command allows unpacking a Managed Server template into an existing domain and existing applications directories. For any file that is overwritten, a backup copy of the original is created. If any modifications had been applied to the start scripts and ear files in the Managed Server domain directory, they must be restored after the unpack operation.

    To unpack the IAMAccessDomain, run the following command on both OAMHOST1 and OAMHOST2 from the location IAD_MW_HOME/oracle_common/common/bin:

    ./unpack.sh -domain=IAD_MSERVER_HOME -template=domaintemplateMSM.jar -app_dir=IAD_MSERVER_HOME/applications -overwrite_domain=true

    Before you run the unpack command, ensure that you have write permissions on the LOCAL_CONFIG_DIR/domains/ directory.

  5. Restart the WebLogic Administration console, and start the following servers:

    • Oracle Access Manager Managed Servers (wls_oam1, wls_oam2)

    • Oracle Access Manager Policy Manager Managed Servers (wls_ama1, wls_ama2)

    • Oracle Mobile Security Manager Managed Servers (wls_msm1, wls_msm2)

Note:

If you are using OUD, just start the Administration Server at this stage.

18.3 Performing Additional Task for Oracle Unified Directory

If you are using Oracle Unified Directory (OUD) as the LDAP identity store and the group object class is groupOfUniqueNames, perform the following additional steps:

  1. Launch the WebLogic Scripting Tool (WLST) by running the following command from the location IAD_ORACLE_HOME/common/bin:

    ./wlst.sh

  2. Connect to the WebLogic Administration Server using the following command:

    connect(username='weblogic', password='wls_admin_password', url='t3://IADADMINVHN:IAD_WLS_PORT')

    For example:

    connect(username='weblogic', password='wls_admin_password', url='t3://iadadminvhn.example.com:7001')

  3. Run the following WLST commands in the same order:

    • edit()

    • startEdit()

    • cd('/SecurityConfiguration/IAMAccessDomain/Realms/myrealm/AuthenticationProviders/OUDAuthenticator')

    • cmo.setStaticMemberDNAttribute('uniquemember')

    • cmo.setStaticGroupDNsfromMemberDNFilter('(&(uniquemember=%M)(objectclass=groupOfUniqueNames))')

    • cmo.setStaticGroupObjectClass('groupOfUniqueNames')

    • activate()

  4. Restart the WebLogic Administration Server and all the Managed Servers.

18.4 Verifying Oracle Mobile Security Manager Configuration

Verify the configuration of Oracle Mobile Security Manager and Access Manager by completing the following steps:

  1. Ensure that the following servers are up and running:

    • Oracle WebLogic Administration Server

    • Oracle Access Manager Managed Servers (for example, wls_oam1)

    • Oracle Access Manager Policy Manager Managed Servers (for example, wls_ama1)

    • Oracle Mobile Security Manager Managed Server (for example, wls_msm1)

  2. Log in to the Administration Console for Oracle Access Management using the following URL:

    http://iadadmin.example.com/oamconsole

  3. Log in to the Access Console using the following URL:

    http://iadadmin.example.com/access

  4. On the Policy Manager console (http://iadadmin.example.com/access), go to the Configuration tab.

    The Configuration Launch Pad opens.

  5. On the Configuration Launch Pad, click Available Services.

    The Available Services page opens.

  6. Ensure that the status of Mobile Security Service has a green check mark. If not, click Enable Service next to Mobile Security Service to enable the status of Mobile Security Service.

  7. After enabling Mobile Security Service, log out of the Policy Manager Console and then log in again.

  8. To access the Mobile Security Manager console pages, click Mobile Security at the top of the screen. The Mobile Security Launch Pad opens.

    Under Mobile Security Manager, click View to choose from the Mobile Security Manager console pages in the menu.

  9. Access the resource http://iadinternal.example.com:7777/msm-mgmt/scim/v1/endpoints

    You should be prompted for a user name and password. Use the oamadmin username and password. The page should be displayed without errors.

18.5 Configuring MSAS Gateway Instances

You must have installed Oracle Mobile Security Access Server (MSAS) in Section 11.2.3, "Installing Oracle Mobile Security Access Server."

After you configure Oracle Mobile Security Manager, you must configure Oracle Mobile Security Access Server Gateway instances. Each instance must be configured exactly the same, with the same instance id, so that they can function as a cluster. While this can be done interactively, it is better to do so by using a property file, which can then be used to configure each instance.

To configure MSAS Gateway instances, complete the following steps:

  1. Create a property file named msas_instance.props with the following properties:

    MSM_URL: http://iadinternal.example.com:7777

    MSM_USER_NAME: weblogic

    MSAS_INSTANCE_ID: EDGMSAS

    MSAS_INSTANCE_ROOT_DIR: LOCAL_CONFIG_DIR/instances/

    MSAS_INSTANCE_SSL_PORT: 9002

    MSAS_LBR_URL: https://msas.example.com:9002

    OAM_HOST: iadadminvhn.example.com

    OAM_PORT: 7001

    OAM_USER_NAME: oamadmin

    OAM_PROTECT: /

    OAUTH_HOST: login.example.com

    OAUTH_PORT: 443

    OAUTH_IS_SSL: true

    OAUTH_SP_ENDPOINT: /oauthservice

    OAM_COOKIE_DOMAIN: .example.com

    Table 18-3 describes the properties used for configuring MSAS Gateway instances.

    Table 18-3 Properties for Configuring MSAS Gateway Instances

    Property Description

    MSM_URL

    The URL for the MSM server that you want this MSAS instance to be registered with. Enter the URL for the MSM server in the following format, where host is either the host name or the IP address of the MSM server and the port number is the listen port for the MSM server.

    http://host:port_number

    For example:

    http://iadinternal.example.com:7777

    MSM_USER_NAME

    The WebLogic Server Administrator username for the MSM domain.

    MSAS_INSTANCE_ID

    A unique name to identify the MSAS instance. It can be any string and must be consistent across instances. This must be same as the value of OMSS_GATEWAY_INSTANCE_ID.

    MSAS_INSTANCE_ROOT_DIR

    Location where the instance configuration files will be created.

    For example:

    LOCAL_CONFIG_DIR/instances

    MSAS_INSTANCE_PORT

    The port that MSAS listens for requests on. This port is SSL enabled.

    This is the value of MSAS_PORT from the worksheet.

    MSAS_LBR_URL

    This is the load balancer entry point for Mobile Security Access Server.

    For example:

    https://msas.example.com:9002

    OAM_HOST

    The IAMAccessDomain Administration Server Virtual Host.

    For example:

    IADADMINVHN.example.com

    OAM_PORT

    The port that the IAMAccessDomain Administration Server uses. For example, 7001.

    OAM_USER_NAME

    The OAMAdmin account your created above.

    OAM_PROTECT

    The resource pattern for each protected application. For example:

    /myapp/login

    The pattern you enter is relative to the host and port of the Access Manager gateway. This entry must begin with a /.

    If you enter /, any requesting URL ending with / will be protected.

    OAUTH_HOST

    The OAUTH entry point in an Enterprise Deployment. This will be the load balancer name.

    For example:

    login.example.com

    OAUTH_PORT

    The port that OAM Managed Servers use in an Enterprise Deployment. This will be the load balancer port.

    For example:

    443

    OAUTH_IS_SSL

    This property specifies where oauth is using the SSL or non SSL port. Valid values are true and false. In an Enterprise Deployment, this value must be true.

    OAUTH_SP_ENDPOINT

    The endpoint where you are accessing clients from the OAuth server.

    For example:

    /oauthservice

  2. Configure the MSAS Gateway instance by running the following command from the location MSAS_ORACLE_HOME/omsas/bin, on WEBHOST1:

    ./configMSAS.sh -properties msas_instance.props

    When the command is run, you will be prompted for the following passwords:

    • Mobile security manager password: This is the WebLogic Administrator password of the IAMAccessDomain.

    • OAM Administrator Password: This is the Access Manager Administrator password.

    When the configuration is completed, the MSAS instance is created in the directory LOCAL_CONFIG_DIR/instances/gateway-id, where the gateway-id is the value you provided in the property file. Validate that this directory exists.

  3. Repeat this procedure on WEBHOST2.

  4. Verify that the MSAS Gateway instance has been registered with MSM by performing the following steps:

    1. Log in to the access console as the oamadmin user.

    2. On the launch pad, click Mobile Security.

    3. Click Environments in the Mobile Security Access Server section. The MSAS instances are shown.

18.6 Integrating MSAS with the Identity Store

To integrate the MSAS with the identity store, complete the following steps on OAMHOST1:

  1. Set the following environment variables:

    • Set MW_HOME to IAD_MW_HOME

    • Set JAVA_HOME to JAVA_HOME

    • Set ORACLE_HOME to IAD_ORACLE_HOME

    • Set WL_HOME to IAD_MW_HOME/wlserver_10.3

  2. Change directory to the IAD_ORACLE_HOME/idmtools/bin directory using the following command:

    cd IAD_ORACLE_HOME/idmtools/bin

  3. Run the following command:

    idmConfigTool.sh -configOMSS mode=OMSAS input_file=configfile

    In this command, configfile is the full or relative path to the properties file (msas.props) you created in Creating the Configuration Files.

    For example:

    idmConfigTool.sh -configOMSS mode=OMSAS input_file=msas.props

    When the command runs, you will be prompted to enter the password of the account that is used to connect to the identity store. It also prompts you to enter passwords for the following:

    • OMSS Keystore: Enter the password that will be assigned to the OMSS keystore when it is created.

    • SCEP Dynamic Challenge Password: Enter the password for the SCEP Dynamic Challenge user.

    • OMSM Schema User Password: Enter the password of the Oracle Mobile Security Manager schema (prefix_OMSM) created using RCU.

    Check the log file for any errors or warnings and correct them. A file named automation.log is created in the directory where you run the tool.

    This process creates objects in the domain. To make these objects visible, you must restart the Administration Server.

  4. Pack the IAMAccessDomain on OAMHOST1 and unpack it on OAMHOST1 and OAMHOST2.

    To pack the IAMAccessDomain, run the following command on OAMHOST1 from the location IAD_MW_HOME/oracle_common/common/bin:

    ./pack.sh -managed=true -domain=IAD_ASERVER_HOME -template=domaintemplateMSAS.jar -template_name=domain_template_MSAS

    Note:

    The pack command does not overwrite existing files. If the file name that you specify matches the name of an existing file in the specified folder, the pack command fails. You must use a different name for the template file for pack command and use the option overwrite_domain=true for the unpack command.

    The -overwrite_domain option in the unpack command allows unpacking a Managed Server template into an existing domain and existing applications directories. For any file that is overwritten, a backup copy of the original is created. If any modifications had been applied to the start scripts and ear files in the Managed Server domain directory, they must be restored after the unpack operation.

    To unpack the IAMAccessDomain, run the following command on both OAMHOST1 and OAMHOST2 from the location IAD_MW_HOME/oracle_common/common/bin:

    ./unpack.sh -domain=IAD_MSERVER_HOME -template=domaintemplateMSAS.jar -app_dir=IAD_MSERVER_HOME/applications -overwrite_domain=true

    Before you run the unpack command, ensure that you have write permissions on the LOCAL_CONFIG_DIR/domains/ directory.

  5. Restart the WebLogic Administration console, and start the following servers:

    • Oracle Access Manager Managed Servers (wls_oam1, wls_oam2)

    • Oracle Access Manager Policy Manager Managed Servers (wls_ama1, wls_ama2)

    • Oracle Mobile Security Manager Managed Servers (wls_msm1, wls_msm2)

18.7 Adding Load Balancer Alias to MSAS Certificate

To prepare MSAS for high availability, you must update the MSAS Gateway SSL certificate with the load balancer alias. To do this, complete the following steps on OAMHOST1:

  1. Launch the WebLogic Scripting Tool (WLST) by running the following command from the location IAD_ORACLE_HOME/common/bin:

    ./wlst.sh

  2. Connect to the WebLogic Administration Server using the following command:

    connect(username='wls_admin_username', password='wls_admin_password', url='t3://IADADMINVHN.example.com:7001')

    In this command, 7001 is the IAD_WLS_PORT from the worksheet.

  3. Run the following commands:

    • svc = getOpssService(name='KeyStoreService')

    • svc.exportKeyStore(appStripe='EDGMSAS', name='sslkeystore', password='password', aliases='EDGMSAS_msasidentity', keypasswords='keypassword', type='JKS',filepath='SHARED_CONFIG_DIR/keystores/EDGMSAS.jks')

    In this command,

    EDGMSAS is the value you specified for the property OMSS_GATEWAY_INSTANCE_ID

    Password is the password of the WebLogic Administrator of the IAMAccessDomain

    keypassword is the password you wish to assign to the exported Keystore

  4. Generate the new certificate request using the following command:

    keytool -keystore SHARED_CONFIG_DIR/keystores/EDGMSAS.jks -storepass password -alias EDGMSAS_msasidentity -certreq -file SHARED_CONFIG_DIR/keystores/msasidentity.csr -keypass keypassword

  5. Sign the new certificate request with Certificate Authority key and add the load balancer's hostname in the certificate's Subject Alternate Name (SAN). Use the load balancer DNS extension, such as msas.example.com. To do this, run the following command:

    keytool -gencert -keystore IAD_ASERVER_HOME/config/fmwconfig/server-identity.jks -storepass password -alias ca -ext san=dns:msas.example.com -infile SHARED_CONFIG_DIR/keystores/msasidentity.csr -outfile SHARED_CONFIG_DIR/keystores/msasidentity.crt

  6. Update the MSAS certificate on the server by completing the following steps:

    1. Export the root CA by running the following command:

      keytool -export -alias ca -file SHARED_CONFIG_DIR/keystores/ca.crt -keystore IAD_ASERVER_HOME/config/fmwconfig/server-identity.jks -storepass password

    2. Import the certificate into the EDGMSAS JKS keystore created in the previous step by running the following command:

      keytool -keystore SHARED_CONFIG_DIR/keystores/EDGMSAS.jks -import -file SHARED_CONFIG_DIR/keystores/ca.crt -alias ca -storepass password

      When this command is run, you will be prompted to trust the certificate. Enter Yes.

    3. Run the following command:

      keytool -keystore EDGMSAS.jks -import -file SHARED_CONFIG_DIR/keystores/msasidentity.crt -alias 'EDGMSAS_msasidentity' -storepass password

      In this command, EDGMSAS is the value you specified for the property OMSS_GATEWAY_INSTANCE_ID.

    4. Import the new certificate into MSAS SSL keystore (KSS keystore) by running the following WLST commands:

      svc = getOpssService(name='KeyStoreService')

      svc.deleteKeyStoreEntry(appStripe='EDGMSAS',name='sslkeystore',password='password', alias='EDGMSAS_msasidentity', keypassword='keypassword')

      svc.importKeyStore(appStripe='EDGMSAS', name='sslkeystore', password='password', aliases='EDGMSAS_msasidentity', keypasswords='keypassword', type='JKS',permission=true, filepath='SHARED_CONFIG_DIR/keystores/EDGMSAS.jks')

18.8 Starting MSAS Instances

Start the MSAS instances on WEBHOST1 and WEBHOST2. To start the MSAS instances, run the following command:

MSAS_ORACLE_INSTANCE/bin/startServer.sh

The MSAS instances should start without error.

18.9 Verifying Oracle Mobile Security Suite Configuration

Verify that Mobile Security Suite is up and running by accessing the following URL:

https://msas.example.com:9002/msm/register/ios

You should be directed to a login page.