4.2 WebLogic Server Deployment

This section contains the following topics:

Parent topic: Advanced Deployment Options

4.2.1 Provision WebLogic Server Domain

Oracle TSAM Plus Manager is a web application running in a WebLogic Server domain. The shell script TSAMWLSProvision.sh is to be used to create a new WebLogic Server domain to host Oracle TSAM Plus Manager.

Parent topic: WebLogic Server Deployment

4.2.1.1 Usage

TLS is enabled by default. When TLS is enabled, specify -adminPort, -identityKeystore, -trustKeystore, and -privateKeyAlias. Use -disableTLS only for non-TLS domains. 

./TSAMWLSProvision.sh [-WLSHome <path to WLS Home>] -domainLoc <path to domain> -port <Listen Port> -dataServerPort <DataServer Port> [-adminPort <Admin Port>] -adminUser <admin username> [-identityKeystore <path>] [-trustKeystore <path>] [-privateKeyAlias <alias>] [-disableTLS]

For example:

-port 8001 -dataServerPort 8002

The -dataServerPort argument is required. If it is not specified, the provisioning script exits with an error.

-WLSHome is optional; if omitted, the bundled WebLogic Server is used. -domainLoc, -port, -dataServerPort, and -adminUser are required. TLS is enabled by default. Unless -disableTLS is specified, -adminPort, -identityKeystore, -trustKeystore, and -privateKeyAlias are also required

Table 4-4 Parameter List

Name Description
-WLSHome <path to WLS Home> (Optional) ORACLE_HOME of WLS installation. If not set, uses the bundled WLS.
-domainLoc <path to domain> Location for the new WLS domain.
-port <Listen Port> [1-65535] Port number on which WebLogic Server listens for incoming connections
-adminPort <Admin Port> Required when TLS is enabled. [1-65535] Port number for WebLogic administrative operations.
-adminUser <new user> Admin user name of the new WLS domain.
-dataServerPort <DataServer Port> Required. [1-65535] Port number for the TSAM DataServer channel used by LMS.
-disableTLS (Optional) TLS disabled
-identityKeystore <path> Required when TLS is enabled. Path to the identity keystore.
-trustKeystore <path> Required when TLS is enabled. Path to the trust keystore.
-privateKeyAlias <alias> Required when TLS is enabled. Alias for the private key in the identity keystore.
-h or -help (Optional) Show help message.

Parent topic: Provision WebLogic Server Domain

4.2.1.2 Generate mTLS Keystores and Wallets

TSAM supports mTLS by default. For example, the hostnames (both the short name and the fully qualified domain name, or FQDN) of the machines running WebLogic Server (WLS) and Tuxedo should be included in the SANs. Otherwise, the mTLS connection will fail to be established. Therefore, the Subject Alternative Names (SANs) in the certificate must be configured correctly. Otherwise, the mTLS connection will fail to be established.

Use the commands below to create a CA, endpoint certificate, traditional JKS identity and trust stores, and an LMS wallet. Replace only the example values and enter a secure password when prompted.

  1. Set the example environment variables
    export HOST='tsam.example.com'
export CA_NAME='TLS-Example-Root-CA'
export SERVER_ALIAS='tsam-server'
export CLIENT_ALIAS='tsam-lms'
export APPDIR='/opt/example/tsam-app'
export SANS='DNS:tsam-tls,DNS:tsam-tls.example.com,DNS:*.example.com,IP:127.0.0.1'
export CA_SUBJ="/C=US/ST=CA/L=ExampleCity/O=Example/OU=Security/CN=$CA_NAME"
export SERVER_SUBJ="/C=US/ST=CA/L=ExampleCity/O=Example/OU=IT/CN=$HOST"
export CLIENT_SUBJ="/C=US/ST=CA/L=ExampleCity/O=Example/OU=LMS/CN=$CLIENT_ALIAS"
  2. Generate the CA
    openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out tls-ca-key.pem
openssl req -x509 -new -sha256 -days 9000 -key tls-ca-key.pem -out tls-ca-cert.pem -subj "$CA_SUBJ" \
  -addext "basicConstraints=critical,CA:true,pathlen:0" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"
  3. Create the WebLogic server certificate

    The SAN list must contain every hostname clients use to reach the TLS endpoint.

    openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out tls-server-key.pem
openssl req -new -sha256 -key tls-server-key.pem -out tls-server-csr.pem -subj "$SERVER_SUBJ" \
  -addext "subjectAltName=$SANS" \
  -addext "extendedKeyUsage=serverAuth,clientAuth"
openssl x509 -req -sha256 -days 9000 -copy_extensions copy \
  -in tls-server-csr.pem -CA tls-ca-cert.pem -CAkey tls-ca-key.pem \
  -CAcreateserial -out tls-server-cert.pem
  4. Create the WebLogic identity and trust JKS files

    The final WebLogic identity and trust stores are traditional JKS. The PKCS12 file below is only an intermediate import source for the private key pair.

    openssl pkcs12 -export -out tls-server-source.p12 -inkey tls-server-key.pem -in tls-server-cert.pem -certfile tls-ca-cert.pem -name "$SERVER_ALIAS"
keytool -importkeystore -noprompt -srckeystore tls-server-source.p12 -srcstoretype PKCS12 -destkeystore tsam_tls_keystore.jks -deststoretype JKS -alias "$SERVER_ALIAS"
keytool -import -noprompt -trustcacerts -alias "$CA_NAME" -file tls-ca-cert.pem -keystore tsam_tls_truststore.jks -storetype JKS
  5. Verify the WebLogic JKS Files
    keytool -list -v -keystore tsam_tls_keystore.jks -storetype JKS
keytool -list -v -keystore tsam_tls_truststore.jks -storetype JKS
openssl verify -CAfile tls-ca-cert.pem tls-server-cert.pem

Parent topic: Provision WebLogic Server Domain

4.2.1.3 Configure mTLS Certificate on Oracle TSAM Plus Agent

Create the LMS client certificate, package it with the CA chain as an Oracle-compatible wallet, and place the wallet in the LMS application directory.
  1. Create the LMS client certificate 
    openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out tls-client-key.pem
openssl req -new -sha256 -key tls-client-key.pem -out tls-client-csr.pem -subj "$CLIENT_SUBJ" \
  -addext "extendedKeyUsage=clientAuth"
openssl x509 -req -sha256 -days 9000 -copy_extensions copy \
  -in tls-client-csr.pem -CA tls-ca-cert.pem -CAkey tls-ca-key.pem \
  -CAcreateserial -out tls-client-cert.pem
  2. Package the LMS client key pair as a wallet
    openssl pkcs12 -export -out ewallet.p12 -inkey tls-client-key.pem -in tls-client-cert.pem -certfile tls-ca-cert.pem -name "$CLIENT_ALIAS"
mkdir -p "$APPDIR/wallet.tsam-lms"
cp ewallet.p12 "$APPDIR/wallet.tsam-lms/ewallet.p12"
  3. Configure LMS in UBBCONFIG

    Add the LMS settings to the *SERVERS section. Set SEC_PRINCIPAL_LOCATION to the parent directory of wallet.tsam-lms. Enter the wallet password when prompted by tmloadcf. 

    LMS SRVGRP=LMSGRP SRVID=100 CLOPT="-A -- -l https://<example-host>:<example-port>/tsam"
    SEC_PRINCIPAL_NAME="$CLIENT_ALIAS"
    SEC_PRINCIPAL_LOCATION="<parent directory of wallet.tsam-lms>"
    SEC_PRINCIPAL_PASSVAR="PASSVAR"
  4. Load and start the configuration
    tmloadcf <UBBCONFIG>
# Start Tuxedo after the WebLogic domain is running
tmboot -y

    Note:

    Final WebLogic stores must report `Keystore type: JKS`. The LMS wallet remains PKCS12 because it is the Oracle wallet artifact. Keep private keys and passwords restricted.

Parent topic: Provision WebLogic Server Domain

4.2.1.4 Example

To create a WebLogic Server domain using the bundled WLS:
./TSAMWLSProvision.sh -domainLoc /u01/oracle/user_projects/domains/tsam_domain \
  -port 7002 -dataServerPort 7003 -adminPort 9002 -adminUser tsamops \
  -identityKeystore /home/oracle/ssl/identity.jks \
  -trustKeystore /home/oracle/ssl/trust.jks \
  -privateKeyAlias myserver

To create a WebLogic Server domain with TLS disabled:

./TSAMWLSProvision.sh ... -port 8001 -dataServerPort 8002 -adminUser weblogic -disableTLS

Parent topic: Provision WebLogic Server Domain

4.2.1.5 Output

A new WebLogic Server domain is created. Start it by executing $TSAM_DIR/bin/startup.sh -domainLoc <DOMAIN_HOME>, where <DOMAIN_HOME> is the same directory specified with TSAMWLSProvision.sh -domainLoc.

Parent topic: Provision WebLogic Server Domain

4.2.2 Deploy Oracle TSAM Plus Manager

The related DB users must be provisioned before the TSAM Plus ear file deployment.

The Oracle TSAM Plus Manager application is packaged in an EAR file tsam_22c.ear. Oracle TSAM Plus Manager uses a dedicated WebLogic Server data source to access the database. The JNDI name of the data source is jdbc/TSAM_db1. Also, when -enableAI is set, then another data source jdbc/TSAM_db2 is created. This option adds TSAM_DS2 (jdbc/TSAM_db2) with -createDataSource. It does not provision AI users, credentials, profiles, agents, or schemas, and -dbAIUser is required.

Before deployment, run TSAMOIDC_enable.sh -oidcPropertiesFile <file> to preprocess tsam_22c.ear. The properties file must define issuer, clientId, clientSecret, and redirectUrl; inactivityTimeout is optional. Deploy the modified EAR with -enableOIDC. This option configures the OIDC identity asserter in myrealm. Map the administrator and viewer principals to the corresponding application roles, and protect the properties file and modified EAR because they contain the client secret.

The shell script TSAMDeploy.sh can be used optionally to create the data source, and deploy the Oracle TSAM Plus Manager EAR file to a WebLogic server domain.

Make sure the WebLogic Server domain is up and running. If it is not running, execute $TSAM_DIR/bin/startup.sh to start the WebLogic Server domain.

(Optional) Configures a WebLogic OpenID Connect identity asserter named oidc in myrealm and places it first in the authentication-provider order when no provider with that name exists. This option does not modify the EAR or update an existing oidc provider. Before using this option, preprocess tsam_22c.ear with TSAMOIDC_enable.sh -oidcPropertiesFile <file>.

Parent topic: WebLogic Server Deployment

4.2.2.1 Usage 

./TSAMDeploy.sh -WLSHome <path to WLS Home> -WLSURL <WLS URL> -WLSAdminUser <admin username> [-WLSHostnameVerification] [-disableTLS] [-trustKeystore <path>] [-createDataSource] [-dbConnStr <DB connection string>] [-dbUser <DB user>] [-enableAI] [-dbAIUser <DB AIUser>] [-enableOIDC] [-EARFile <path to EAR file> [-domainLoc <path to domain>]]

Table 4-5 Parameter List

Name Description
-WLSHome <path to WLS Home> (Optional) ORACLE_HOME of WLS installation. If not set, then it uses the bundled WLS.
-WLSURL <URL> Admin URL of the target WebLogic Server.
-WLSAdminUser <username> Admin username of the WLS domain.
-WLSHostnameVerification (Optional) Flag to enable hostname verification.
-disableTLS (Optional) TLS disabled
-trustKeystore <path> (Optional) Path to trust keystore.
-createDataSource (Optional) Creates the Data Source
-dbConnStr <string> (Optional) Database connection string. Required if creating a data source.
-dbUser <username> (Optional) Database username. Required if creating a data source.
-enableAI (Optional) Enable AI feature for TSAM.
-dbAIUser <aiusername> (Optional).Database AI username when creating AI Data Source. It is mandatory if you are creating a data source and -enableAI is set.
-enableOIDC Preprocess tsam_22c.ear with TSAMOIDC_enable.sh -oidcPropertiesFile <file>, then deploy that EAR with TSAMDeploy.sh ... -enableOIDC. List issuer, clientId, clientSecret, and redirectUrl; document myrealm and administrator/viewer principal-to-role mappings; and restrict access to the properties file and EAR because clientSecret is embedded.
-EARFile Optional unless deploying or redeploying the TSAM Plus Manager EAR. When -EARFile is set, -domainLoc is required.
-domainLoc <path to domain> Required when -EARFile is set. Location of the target WebLogic domain.
-h or -help (Optional) Show help message.

Parent topic: Deploy Oracle TSAM Plus Manager

4.2.2.2 Examples

To create a data source in the bundled WebLogic Server and deploy Oracle TSAM Plus, specify the -domainLoc parameter when using the -EARFile option.

To create a data source in the bundled WLS, and deploy the Oracle TSAM Plus When -EARFile is set, -domainLoc is required. 

./TSAMDeploy.sh -WLSURL t3s://localhost:9002 \   -WLSAdminUser weblogic 
    -trustKeystore /home/oracle/ssl/tsam-tls-truststore.jks -createDataSource -dbConnStr
    "jdbc:oracle:thin:@//dbhost:1521/ORCL" -dbUser tsamuser1 -enableAI -dbAIUser tsamuser2
    -EARFile ${TSAM_DIR}/deploy/tsam_22c.ear -domainLoc <domain_directory>
EAR Only Deployment
./TSAMDeploy.sh -WLSURL t3s://localhost:9002 -WLSAdminUser weblogic \
  -trustKeystore /u01/keystores/trust.jks \
  -EARFile /workspace/tsam/tsam-adf-app/Mgr/target/tsam_22c.ear \
  -domainLoc /u01/oracle/user_projects/domains/tsam_domain
To create Data Source only in the bundled WLS, without deploying Oracle TSAM Plus Manager EAR file:
./TSAMDeploy.sh -WLSURL t3s://localhost:9002 -WLSAdminUser weblogic -trustKeystore /home/oracle/ssl/tsam-tls-truststore.jks -createDataSource -dbConnStr "jdbc:oracle:thin:@//dbhost:1521/ORCL" -dbUser tsamuser1 -enableAI -dbAIUser tsamuser2
./TSAMDeploy.sh -WLSURL t3s://localhost:9002 \-WLSAdminUser weblogic \v-trustKeystore /u01/keystores/trust.jks \ -EARFile ${TSAM_HOME}/deploy/tsam_22c.ear\
-domainLoc <DOMAIN_HOME>
To deploy the Oracle TSAM Plus Manager EAR file to the bundled WLS, without creating a data source:
./TSAMDeploy.sh -WLSURL t3s://localhost:9002 -WLSAdminUser weblogic -trustKeystore /u01/keystores/trust.jks -EARFile /workspace/tsam/tsam-adf-app/Mgr/target/tsam_22c.ear

Parent topic: Deploy Oracle TSAM Plus Manager

4.2.2.3 Output

The Oracle TSAM Plus Manager application is deployed to the WebLogic Server domain. You can access the Oracle TSAM Plus Console from a browser via https://<hostname>:<port>/tsam with username admin and the password you entered when prompted “Enter TSAM Plus admin password” during the execution of TSAMDBSchemaSetup.sh.

Note:

  • Use HTTPS when TLS is enabled and HTTP with -disableTLS.
  • <port> is the WebLogic console listen port, not the TSAM DataServer channel port

Parent topic: Deploy Oracle TSAM Plus Manager

4.2.3 Start and Shutdown WebLogic Server Domain

To start the WebLogic Server domain:

$TSAM_DIR/bin/startup.sh -domainLoc <DOMAIN_HOME>

To shutdown the WebLogic Server domain:

$TSAM_DIR/bin/shutdown.sh-domainLoc <DOMAIN_HOME> -trustKeystore <path> [-WLSHostnameVerification]

The -trustKeystore option is required. Hostname verification is disabled by default and is enabled only when -WLSHostnameVerification is specified.

Parent topic: WebLogic Server Deployment