10 Setting Up Network Integrity for Single Sign-On Authentication

Installing and Deploying Network Integrity Specifying the External LDAP Provider

To install and deploy Network Integrity specifying the external LDAP security provider:

1. Configure authentication providers for your external security provider. See "Configuring Custom Authentication Providers" for more information.

   Oracle recommends Oracle Internet Directory as the LDAP store external to the WebLogic server. See "Installing and Configuring Oracle Internet Directory" for more information.

2. Install and deploy Network Integrity specifying the external LDAP provider.

   When installing Network Integrity, in the Security Provider Selection screen, select the External Security Provider option, and then enter the required information in the External Security Provider Connection Information screen. Follow the instructions provided in "Installing Network Integrity by Using Interactive Install".

Configuring the Frontend URL in Administration Console

Set the front-end host and port so that all requests to access the applications (Network Integrity) deployed in the WebLogic administration server go through the Oracle HTTP server:

To configure the Frontend URL:

1. Log in to the Oracle WebLogic Server administration console.

2. In the Domain Structure tree, expand Environment, and do one of the following:

   • Select Clusters (if the server instances to which you want to proxy requests from Oracle HTTP Server are in a cluster)

   • Select Servers.

     The Summary of Servers page appears.

3. Select the server or cluster to which you want to proxy requests from Oracle HTTP Server.

4. Click the Configuration tab.

5. On the General tab, in the Advanced section, select the WebLogic Plug-In Enabled check box.

6. If you selected Servers in step 2, repeat steps 3 through 5 for the other servers to which you want to proxy requests from Oracle HTTP Servers.

7. Click Save.

8. Restart the WebLogic server.

9. Log in to the Oracle WebLogic Server administration console.

10. In the Domain Structure tree, expand Environment, and click Servers.

    The Summary of Servers screen appears.

11. Click the server where Network Integrity is deployed.

    The settings screen for the server appears.

12. Click the Protocols tab.

13. On the HTTP tab, do the following:

14. In the Frontend Host field, enter the name of the Oracle HTTP Server host machine.

    WebLogic Server uses this value instead of the one in the host header. All HTTP URLs are redirected to this HTTP host.

15. In the Frontend HTTP Port field, enter the Oracle HTTP Server port number.

    All HTTP URLs are redirected to this HTTP port.

16. In the Frontend HTTPS Port field, enter the Oracle HTTP Server SSL port number.

    All HTTPS URLs are redirected to this HTTPS port.

17. Click Save.

18. In the Change Center of the Administration Console, click Activate Changes, which activates these changes.

Creating and Configuring Authentication Providers for OAM SSO

You must create a new OAMIdentityAsserter provider for OAM SSO in WebLogic Server Administration Console.

To create the OAMIdentityAsserter provider:

1. Log in to the WebLogic Server Administration Console.

2. Under Your Application's Security Settings, click Security Realms.

   The Summary of Security Realms screen appears.

3. Select the realm YourRealmName, for which you need to configure the OAM identity asserter.

   The Settings For YourRealmName screen appears.

4. Click the Providers tab, and then click the Authentication tab.

5. Click New.

   The Create a New Authentication Provider screen appears.

6. In the Name field, enter a name for the new provider; for example, OAM ID Asserter.

7. From the Type list, select OAMIdentityAsserter.

8. Click OK.

   The Settings For YourRealmName screen appears, showing the newly created authentication name in the Authentication tab.

9. Click the link for AuthenticatorName (For example, OAM ID Asserter).

   The Settings for AuthenticatorName screen appears.

10. On the Common tab, from the Control Flag list, select REQUIRED.

11. Under Active Types, use the directional arrow buttons to move OAM_REMOTE_USER from the Available column to the Chosen column.

    Ensure that OAMAuthnCookie and OAM_IDENTITY_ASSERTION are present in the Chosen column.

12. Click Save.

13. Click the Providers tab, and then click the Authentication tab.

14. Click the link for DefaultAuthenticator and ensure that the default authenticator's control flag is set to SUFFICIENT.

15. Click the link for OID/OUD Authenticator (for example, OracleInternetDirectoryAuthenticator) and ensure that the OID/OUD authenticator's control flag is set to SUFFICIENT.

    See "Configuring the Authentication Provider" for more information.

16. On the Authentication tab, click Reorder.

    The Reorder Authentication Providers screen appears

17. Use the up and down arrows to reorder the listed authentication providers as follows:

    • OAMIdentityAsserter (REQUIRED)

    • OracleInternetDirectoryAuthenticator (SUFFICIENT)

    • DefaultAuthenticator (SUFFICIENT)

18. Click OK.

Configuring web.xml for the OAM Identity Asserter

You configure the web.xml file for the OAM Identity Asserter by updating the deployment plan. You use deployment plans to change an application's WebLogic Server configuration for a specific environment without modifying existing deployment descriptors.

To update the web.xml file:

1. For using Oracle Access Manager Identity Asserter, you must specify the authentication method as CLIENT-CERT in the web.xml file for the appropriate realm by editing the deployment plan. The web.xml file is located at NI_Home/app/NetworkIntegrity.ear/NetworkIntegrityApp_NetworkIntegrityUI_webapp1.war/WEB-INF/, where NI_Home is the directory in which the Network Integrity software is installed.

   • Depending on your deployment configuration, do one of the following:

     • If Network Integrity is installed in a single server environment, navigate to and open the NI_Home/app/plan/Plan.xml file.

     • If Network Integrity is installed in a clustered server environment, navigate to and open the NI_Home/app/plan/ClusterPlan.xml file.

   • Update the variable-definition and variable-assignment elements; specifically, add CLIENT-CERT as follows:

     <variable-definition>
      <variable>
          <name>ClientCertAuthMethod</name> 
          <value>CLIENT-CERT</value> 
      </variable>
      <variable>
          <name>RealmName</name>  
          <value>myrealm</value>  
      </variable>
     </variable-definition>
     <module-override>
         <module-name>NetworkIntegrityApp_NetworkIntegrityUI_webapp1.war</module-name>
         <module-type>war</module-type> <module-descriptor external="false">
           <root-element>web-app</root-element>
           <uri>WEB-INF/web.xml</uri>
      <variable-assignment>
          <name>ClientCertAuthMethod</name>
          <xpath>/web-app/login-config/auth-method</xpath>
          <operation>replace</operation>
      </variable-assignment>
      <variable-assignment>
          <name>RealmName</name>
          <xpath>/web-app/login-config/realm-name</xpath>
          <operation>add</operation>
       </variable-assignment>
         </module-descriptor>
     </module-override> 
     

   • Save and close the Plan.xml/ClusterPlan.xml file.

2. Update the deployment plan for the currently-deployed Network Integrity application:

   1. Log in to the WebLogic Server Administration Console.

   2. In the Domain Structure tree, expand Environment, and click Deployments.

      The Summary of Deployments screen appears.

   3. Select the check box beside NetworkIntegrity.

   4. Click Update.

      The Update Application Assistant page appears.

   5. Select Update this application in place with new deployment plan changes and click Next.

   6. (Optional) Click Change Path beside the Deployment Plan Path field and browse to the location of the Plan.xml/ClusterPlan.xml file.

      The Summary page appears.

   7. Click Finish.

   8. In the Change Center of the Administration Console, click Activate Changes, which activates these changes.

Configuring the mod_wl_ohs Plug-In for Oracle HTTP Server

You can configure mod_wl_ohs plug-in by specifying directives in the mod_wl_ohs.conf file to enable the Oracle HTTP Server instances to forward requests to the applications deployed on the Oracle WebLogic server or clusters.

For more information, see Oracle Fusion Middleware Using Web Server Plug-Ins with Oracle WebLogic Server.

To configure the mod_wls_ohs plug-in:

1. Open the mod_wl_ohs.conf file from the following location:

   Domain_Home/config/fmwconfig/components/OHS/ohs1/

   where:

   Domain_Home is the directory containing the configuration for the domain into which Oracle HTTP Server is installed.

2. Add directives within the <IfModule weblogic_module> element in the configuration file as follows:

   • To forward requests to the Network Integrity application running on a single Oracle WebLogic Server instance, specify /NetworkIntegrity within the <location> element as follows:

     <IfModule weblogic_module>
     <Location /NetworkIntegrity>
     SetHandler weblogic-handler
     WebLogicHost host
     WebLogicPort port
     </Location>
     </IfModule>
     

     where:

     • host is the name of the WebLogic Administration server machine

     • port is the port of the server on which Network Integrity is installed

   • To forward requests to the Network Integrity application running on a cluster of Oracle WebLogic Server instances, specify /NetworkIntegrity within a new <location> element as follows:

     <IfModule weblogic_module>
     <Location /NetworkIntegrity>
     SetHandler weblogic-handler
     WebLogicCluster host1:port1,host2:port2
     </Location>
     </IfModule>
     

     where:

     • host1 and host 2 are host names of the managed servers

     • port1 and port2 are ports of the managed servers

   • To forward requests to the Network Integrity Web services running on a single Oracle WebLogic Server instance, specify /NetworkIntegrityApp-NetworkIntegrityControlWebService-context-root within the <location> element as follows:

     <IfModule weblogic_module>
     <Location /NetworkIntegrityApp-NetworkIntegrityControlWebService-context-root>
     SetHandler weblogic-handler
     WebLogicHost host
     WebLogicPort port
     </Location>
     </IfModule>
     

     where:

     • host is the name of the WebLogic Administration server machine

     • port is the port of the server on which Network Integrity is installed

   • To forward requests to the Network Integrity Web services running on a cluster of Oracle WebLogic Server instances, specify /NetworkIntegrityApp-NetworkIntegrityControlWebService-context-root within a new <location> element as follows:

     <IfModule weblogic_module>
     <Location /NetworkIntegrityApp-NetworkIntegrityControlWebService-context-root>
     SetHandler weblogic-handler
     WebLogicCluster host1:port1,host2:port2
     </Location>
     </IfModule>
     

     where:

     • host1 and host 2 are host names of the managed servers

     • port1 and port2 are ports of the managed servers

   • To forward requests to the Network Integrity application running on a single Oracle WebLogic Server instance to support integration with UIM, specify /NI_Uim within the <location> element as follows:

     <IfModule weblogic_module>
     <Location /NI_Uim>
     SetHandler weblogic-handler
     WebLogicHost host
     WebLogicPort port
     </Location>
     </IfModule>
     

     where:

     • host is the name of the WebLogic Administration server machine

     • port is the port of the server on which Network Integrity is installed

   • To forward requests to the Network Integrity application running on a cluster of Oracle WebLogic Server instances to support integration with UIM, specify /NI_Uim within a new <location> element as follows:

     <IfModule weblogic_module>
     <Location /NI_Uim>
     SetHandler weblogic-handler
     WebLogicCluster host1:port1,host2:port2
     </Location>
     </IfModule>
     

     where:

     • host1 and host 2 are host names of the managed servers

     • port1 and port2 are ports of the managed servers

   • To forward requests to the Network Integrity application running on a single Oracle WebLogic Server instance into which you want to deploy cartridges, specify /cartridge within the <location> element as follows:

     <IfModule weblogic_module>
     <Location /cartridge>
     SetHandler weblogic-handler
     WebLogicHost host
     WebLogicPort port
     </Location>
     </IfModule>
     

     where:

     • host is the name of the WebLogic Administration server machine

     • port is the port of the server on which Network Integrity is installed

   • To forward requests to the Network Integrity application running on a cluster of Oracle WebLogic Server instances into which you want to deploy cartridges, specify /cartridge within a new <location> element as follows:

     <IfModule weblogic_module>
     <Location /cartridge>
     SetHandler weblogic-handler
     WebLogicHost host
     WebLogicPort ms_port
     </Location>
     </IfModule>
     

     where:

     • host is the machine where the managed server is running

     • ms_port is the port of the managed server running on the host specified in the host variable above

     For example, if a managed server networkintegrity01 with listen port 8065 is running on the machine NETINT1, you must specify the following:

     <IfModule weblogic_module>
     <Location /cartridge>
     SetHandler weblogic-handler
     WebLogicHost NETINT1
     WebLogicPort 8065
     </Location>
     </IfModule>
     

Protecting Resources For SSO Authentication

You must protect resources (for example, the Network Integrity application) in Oracle Access Manager for SSO authentication. For more information, see Fusion Middleware Administrator's Guide for Oracle Access Management.

To protect resources for SSO authentication:

1. Open the Oracle Access Management Console.

2. On the Policy Configuration tab, expand the Application Domains node.

3. Expand the node for the application domain.

4. Within the application domain, expand the Resources node.

5. Click the Resources tab, and then click the New Resource button in the upper-right corner of the Search page.

   The Resource Definition page appears.

6. Do the following to configure the Network Integrity application as a protected resource for SSO authentication:

   • From the Type list, select HTTP.

   • In the Resource URL field, enter /NetworkIntegrity/.../*.

   • From the Protection Level list, select Protected.

7. Click Apply.

Excluding Resources From SSO Authentication

You can exclude HTTP resources that do not require SSO authentication. For example, when accessing a Web Services Description Language (WSDL) document for Web services. The excluded resources are public and do not require an OAM Server check for authentication.

When allowing access to excluded resources, WebGate does not contact the OAM Server. Excluded resources cannot be added to any user-defined policy in the console. For more information, see Fusion Middleware Administrator's Guide for Oracle Access Management.

To exclude resources from SSO authentication:

1. Open the Oracle Access Management Console.

2. On the Policy Configuration tab, expand the Application Domains node.

3. Expand the node for the application domain.

4. Within the application domain, expand the Resources node.

5. Click the Resources tab, and then click the New Resource button in the upper-right corner of the Search page.

   The Resource Definition page appears.

6. Do the following to exclude Network Integrity Web services from SSO authentication:

   • From the Type list, select HTTP.

   • In the Resource URL field, enter the following to exclude Network Integrity Web services from SSO authentication:

     /NetworkIntegrityApp-NetworkIntegrityControlWebService-context-root/.../*

   • From the Protection Level list, select Excluded.

7. Click Apply.

8. Click the New Resource button.

   The Resource Definition page appears.

9. Do the following to exclude the Network Integrity cartridge deployment process from SSO authentication:

   • From the Type list, select HTTP.

   • In the Resource URL field, enter /cartridge/.../*.

   • From the Protection Level list, select Excluded.

10. Click Apply.

11. Click the New Resource button.

    The Resource Definition page appears.

12. Do the following to exclude the Network Integrity and UIM integration process from SSO authentication:

    • From the Type list, select HTTP.

    • In the Resource URL field, enter /NI_Uim/.../*.

    • From the Protection Level list, select Excluded.

13. Click Apply.