1. Installing WebGates for Oracle Access Manager
  2. Installing and Configuring IIS 12c WebGate for OAM

3 Installing and Configuring IIS 12c WebGate for OAM

This chapter describes how to install and configure Internet Information Services (IIS) 12c WebGate for Oracle Access Manager.

This chapter contains the following sections:

Installation Overview of IIS 12c WebGate

Installing IIS 12c WebGate for Oracle Access Manager involves the following steps:

  1. Installing the IIS web server
  2. Installing IIS 12c WebGate for Oracle Access Manager
  3. Completing the post-installation configuration steps
  4. Verifying the IIS 12c WebGate installation
  5. Registering the new WebGate agent

Parent topic: Installing and Configuring IIS 12c WebGate for OAM

Prerequisites for Installing IIS 12c WebGate

This section discusses the following topics:

Parent topic: Installing and Configuring IIS 12c WebGate for OAM

Oracle Fusion Middleware Certification

The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 12c.

You can access the Oracle Fusion Middleware Supported System Configurations document by searching the Oracle Technology Network (OTN) web site:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

Parent topic: Prerequisites for Installing IIS 12c WebGate

Installing JRE

You must have a 64-bit Java runtime environment (JRE) 11 or higher installed.

Parent topic: Prerequisites for Installing IIS 12c WebGate

Installing Visual C++ Redistributable for Visual Studio 2010 and 2012

You must install Visual C++ Redistributable for Visual Studio 2010 and Visual Studio 2012 Update 4, vcredist_x64.exe.

WARNING:

During IIS 12c WebGate installation, you might encounter Supported MS Visual C++ version is not available in this machine warning if have not installed Visual C++ Redistributable for Visual Studio 2010 and 2012.

For information about downloading, installing, and configuring, see the Microsoft download page and product documentation.

Parent topic: Prerequisites for Installing IIS 12c WebGate

Installing and Configuring IIS

For information about installing and configuring IIS, see the Microsoft HTTP Server product documentation.

Parent topic: Prerequisites for Installing IIS 12c WebGate

Installing and Configuring OAM 12c

For information about installing Oracle Access Manager (OAM), see Installing and Configuring Oracle Identity and Access Management Software in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see Configuring Oracle Access Management in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

For information about configuring Oracle Access Manager in Open, Simple, or Cert mode, see Securing Communication in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager .

Parent topic: Prerequisites for Installing IIS 12c WebGate

Installing IIS 12c WebGate

This section contains the following topics:

Parent topic: Installing and Configuring IIS 12c WebGate for OAM

Obtaining the Software

For information about obtaining the IIS 12c software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.

Parent topic: Installing IIS 12c WebGate

Starting the IIS 12c WebGate Installer

To start the installation wizard, do the following:

  1. Go to the Disk1 directory under the WebGate folder
  2. Run the following command:

    setup_fmw_12.2.1.4.0_iiswebgate_win64.exe

After the Installer starts, the Welcome screen is displayed. Proceed with the installation by referring to Installation Flow and Procedure of IIS 12c WebGate.

Parent topic: Installing IIS 12c WebGate

Installation Flow and Procedure of IIS 12c WebGate

To install IIS 12c WebGate for Oracle Access Manager, follow the instructions in Table 3-1.

If you need additional help with any of the installation screens, click Help to access the online help.

Table 3-1 Installation Flow of IIS WebGate

No. Screen Description and Action Required

1

Welcome Screen

Click Next to continue.

2

Prerequisite Checks Screen

Click Next to continue.

3

Specify Installation Location Screen

Specify the Middleware home and Oracle home locations.

For more information about these directories, see Understanding Your Installation Starting Point in Planning an Installation of Oracle Fusion Middleware.

Oracle home in case of IIS WebGate is any valid directory, not necessarily in the Middleware home. So, if you do not provide a Middleware home or if you provide an invalid Middleware home, the Installer proceeds without any error.

Click Next to continue.

4

Installation Summary Screen

Verify the information on this screen.

Click Install to begin the installation.

5

Installation Progress Screen

Click Next to continue.

6

Installation Complete Screen

Click Finish to dismiss the Installer.

Parent topic: Installing IIS 12c WebGate

Post-Installation Steps for IIS 12c WebGate

This section includes the following topics:

Parent topic: Installing and Configuring IIS 12c WebGate for OAM

Deploying the IIS WebGate Instance

Create an IIS WebGate instance by using the deployWebGateInstance.sh tool from the WebGate Oracle home directory. The WebGate instance directory that you are creating or have provided must be empty.

To deploy the WebGate instance, do the following:

  1. Go to the WebGate_Oracle_Home/webgate/IIS/tools/deployWebGate directory by running the following command:

    cd WebGate_Oracle_Home/webgate/IIS/tools/deployWebGate

  2. Run the following command:

    deployWebGateInstance.bat -w WebGate_Instancedir -oh WebGate_Oracle_Home -ws WebServer

    In the preceding command:

    • WebGate_Instancedir is the directory in which the new WebGate instances should be created.

    • WebGate_Oracle_Home is the WebGate Oracle home directory you specified while installing IIS 12c WebGate.

    • WebServer is IIS.

    Example:

    deployWebGateInstance.bat -w /home/wg_instance4iis/ -oh /home/Oracle_OAMWebGate1/ -ws IIS

Parent topic: Post-Installation Steps for IIS 12c WebGate

Running the ConfigureIISWebGate.bat Tool

To run the ConfigureIISWebGate.bat tool, do the following:

  1. Go to the following directory:

    cd WebGate_Home\webgate\iis\tools\ConfigureIISConf

  2. Run the following command:

    ConfigureIISWebGate.bat -oh <WebGateHome> -w <Webgate Instance> -site <Web Site Name> [-o <output file>]

    In the preceding command:

    • WebGate_Home is the full path to the WebGate Oracle home.

    • WebGate_Instancedir is the directory in which the new WebGate instances are created. This is the same instance directory that you have provided while running the deployWebGateInstance.bat command.

    • SiteName is the IIS WebServer site name.

    Example:

    ConfigureIISWebGate.bat -oh c:\WGHome -w c:\WGInstance -site "Default Web Site

    Note:

    Running the ConfigureIISWebGate.bat command also updates the WebGate_Oracle_Home\webgate\iis\lib\webgate.ini file with IIS Site ID and WebGate Instance Directory.

Parent topic: Post-Installation Steps for IIS 12c WebGate

Verifying the Installation and Configuration of IIS 12c WebGate

After installing IIS 12c WebGate for Oracle Access Manager, you can examine the installDATE-TIME_STAMP.out log file to verify the installation. The default location of the log is in the following file:

WebGate_Home/oraInst.loc

Parent topic: Installing and Configuring IIS 12c WebGate for OAM

Getting Started with a New IIS 12c WebGate

Before you can use the new IIS 12C WebGate agent for Oracle Access Manager, you must complete the following tasks:

Parent topic: Installing and Configuring IIS 12c WebGate for OAM

Registering the New IIS 12c WebGate

Oracle Access Manager WebGate component utilizes a high availability environment to eliminate a single point of failure and to distribute the workload using a load balancer (LBR). OAM needs to be registered only once, the same resulting artifacts are used by all the OAM WebGates that are behind the LBR.

You can register the new IIS WebGate 12c with Oracle Access Manager by using any one of the following options:

Oracle Access Manager Administration console

For complete information about registering WebGate agent using Oracle Access Manager console, see Registering an OAM Agent Using the Console in Administrator's Guide for Oracle Access Management.

RREG tool

For complete information about registering WebGate agent using RREG tool, see:

Parent topic: Getting Started with a New IIS 12c WebGate

Locating and Preparing the RREG Tool

To set up the RREG tool, complete the following steps:

  1. Log in to one of the Oracle Access Manager hosts in the Application tier.

  2. Change directory to the following directory in the Oracle Access Manager Oracle home:

    Note:

    The location is required only for the out-of-band mode.

    OAM_ORACLE_HOME/oam/server/rreg/client

    In this example, OAM_ORACLE_HOME refers to the Oracle home on the system where the Oracle Access Manager software was installed.

    Note:

    If the Oracle Enterprise Deployment Guide for IDM was used, OAM_ORACLE_HOME may be /u01/oracle/products/access/iam.

    Note:

    If you do not have privileges or access to the Oracle Access Manager server, then you can use out-of-band mode to generate the required files and register the WebGate with Oracle Access Manager. See About RREG In-Band and Out-of-Band Mode.

  3. Unzip the RREG.tar.gz file to the required directory.

  4. From the unzipped directory, open the oamreg.sh file and set the following environment variables in the file, as follows:

    • Set OAM_REG_HOME to the absolute path to the directory in which you extracted the contents of RREG archive.

      Set JAVA_HOME to the absolute path of the directory in which a supported JDK is installed on your machine.

Updating the OAM12cRequest.xml File

You must update the agent parameters, such as agentName, in the OAM12cRequest.xml file in the RREG_Home\input directory on Windows. On UNIX, the file is in the RREG_Home/input directory.

Note:

The OAM12cRequest.xml file or the short version OAM12cRequest_short.xml is used as a template. You can copy this template file and use it.

Modify the following required parameters in the OAM12cRequest.xml file or in the OAM12cRequest_short.xml file:

  • serverAddress

    Specify the host and the port of the OAM Administration Server.

  • agentName

    Specify any custom name for the agent.

  • agentBaseUrl

    Specify the host and the port of the machine on which Oracle Traffic Director 12c (12.2.1.4.0) WebGate is installed.

  • preferredHost

    Specify the host and the port of the machine on which Oracle Traffic Director 12c (12.2.1.4.0) WebGate is installed.

  • security

    Specify the security mode, such as open, based on the WebGate installed.

  • primaryServerList

    Specify the host and the port of Managed Server for the Oracle Access Manager proxy, under a Server container element.

After modifying the file, save and close it.

Running the RREG Tool

The following topics provide information about running the RREG tool to register your IIS Webgate with Oracle Access Manager.

About RREG In-Band and Out-of-Band Mode

You can run the RREG Tool in one of two modes: in-band and out-of-band.

Use in-band mode when you have the privileges to access the Oracle Access Manager server and run the RREG tool yourself from the Oracle Access Manager Oracle home. You can then copy the generated artifacts and files to the Web server configuration directory after you run the RREG Tool.

Use out-of-band mode if you do not have privileges or access to the Oracle Access Manager server. For example, in some organizations, only the Oracle Access Manager server administrators have privileges access the server directories and perform administration tasks on the server. In out-of-band mode, the process can work as follows:

  1. The Oracle Access Manager server administrator provides you with a copy of the RREG archive file (RREG.tar.gz).

    The server administrator can find it in the location described in Updating the OAM12cRequest.xml File.

  2. Untar the RREG.tar.gz file that was provided to you by the server administrator.

    For example:

    gunzip RREG.tar.gz

    tar -xvf RREG.tar

    After you unpack the RREG archive, you can find the tool for registering the agent in the following location:

    RREG_HOME/bin/oamreg.sh

    In this example, RREG_Home is the directory in which you extracted the contents of RREG archive.

  3. Use the instructions in Updating the Standard Properties in the OAM11gRequest.xml File to update the OAM12cRequest.xml file, and send the completed OAM12cRequest.xml file to the Oracle Access Manager server administrator.

  4. The Oracle Access Manager server administrator then uses the instructions in Running the RREG Tool in Out-Of-Band Mode to run the RREG Tool and generate the AgentID_response.xml file.

  5. The Oracle Access Manager server administrator sends the AgentID_response.xml file to you.

  6. Use the instructions in Running the RREG Tool in Out-Of-Band Mode to run the RREG Tool with the AgentID_response.xml file and generate the required artifacts and files on the client system.

Parent topic: Running the RREG Tool

Running the RREG Tool in In-Band Mode

To run the RREG Tool in in-band mode:

  1. Navigate to the RREG home directory.

    If you are using in-band mode, the RREG directory is inside the Oracle Access Manager Oracle home:

    OAM_ORACLE_HOME/oam/server/rreg

    If you are using out-of-band mode, then the RREG home directory is the location where you unpacked the RREG archive.

  2. In the RREG home directory, navigate to the bin directory:

    cd RREG_HOME/bin/

  3. Set the permissions of the oamreg.sh command so you can execute the file: 

    chmod +x oamreg.sh

  4. Run the following command:

    ./oamreg.sh inband RREG_HOME/input/OAM12cRequest_edg.xml

In this example:

  • It is assumed the edited OAM12cRequest.xml file is located in the RREG_HOME/input directory.

  • The output from this command will be saved to the following directory:

    RREG_HOME/output/

The following example shows a sample RREG session:

Welcome to OAM Remote Registration Tool!
Parameters passed to the registration tool are: 
Mode: inband
Filename: /u01/oracle/products/fmw/iam_home/oam/server/rreg/client/rreg/input/OAM12cRequest_edg.xml
Enter admin username:weblogic_idm
Username: weblogic_idm
Enter admin password: 
Do you want to enter a Webgate password?(y/n):
n
Do you want to import an URIs file?(y/n):
n

----------------------------------------
Request summary:
OAM12c Agent Name:SOA12214_EDG_AGENT
Base URL: https://soa.example.com:443
URL String:null
Registering in Mode:inband
Your registration request is being sent to the Admin server at: http://host1.example.com:7001
----------------------------------------

Jul 08, 2015 7:18:13 PM oracle.security.jps.util.JpsUtil disableAudit
INFO: JpsUtil: isAuditDisabled set to true
Jul 08, 2015 7:18:14 PM oracle.security.jps.util.JpsUtil disableAudit
INFO: JpsUtil: isAuditDisabled set to true
Inband registration process completed successfully! Output artifacts are created in the output folder.

Parent topic: Running the RREG Tool

Running the RREG Tool in Out-Of-Band Mode

To run the RREG Tool in out-of-band mode on the WEBHOST server, the administrator uses the following command:

RREG_HOME/bin/oamreg.sh outofband input/OAM12cRequest.xml

In this example:

  • Replace RREG_HOME with the location where the RREG archive file was unpacked on the server.

  • The edited OAM12cRequest.xml file is located in the RREG_HOME/input directory.

  • The RREG Tool saves the output from this command (the AgentID_response.xml file) to the following directory: 

    RREG_HOME/output/

    The Oracle Access Manager server administrator can then send the AgentID_response.xml to the user who provided the OAM12cRequest.xml file.

To run the RREG Tool in out-of-band mode on the Web server client machine, use the following command:

RREG_HOME/bin/oamreg.sh outofband input/AgentID_response.xml

In this example:

  • Replace RREG_HOME with the location where you unpacked the RREG archive file on the client system.

  • The AgentID_response.xml file, which was provided by the Oracle Access Manager server administrator, is located in the RREG_HOME/input directory.

  • The RREG Tool saves the output from this command (the artifacts and files required to register the Webgate software) to the following directory on the client machine:

    RREG_HOME/output/

Parent topic: Running the RREG Tool

Files and Artifacts Generated by RREG

Regardless of the method or mode you use to register the new WebGate agent, the following files and artifacts are generated in the RREG_Home/output/Agent_ID directory:

  • cwallet.sso

  • ObAccessClient.xml

  • In SIMPLE mode, RREG generates:

    • password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be the same as the passphrase used on the server.

    • aaa_key.pem

    • aaa_cert.pem

  • In CERT mode, RREG generates password.xml file, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.

    Note:

    You can use these files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing aaa_cert.pem and aaa_chain.pem files along with password.xml and aaa_key.pem.

Deleting the previous version files

After installing the newer version of the IIS Webgate, you must manually delete the older files in the configuration folder.

Complete the following steps:

  1. Go to the {Oracle_OAMWebGate1}/webgate/IIS/config directory.
  2. Delete the np{previous_rel}_wg.txt file.

    Where, {previous_rel} is the version number of the previous release from which you have upgraded from.

Restarting the IIS Instance

Use the startserv command to start or stopserv command to stop your Apache instance.

To stop the server, run the following command:

/home/bin/stopserv

To start the server, run the following command:

export LD_LIBRARY_PATH=/WebGate_Home/lib

/home/bin/startserv

To restart the IIS instance, stop all running instances, and then run the start command.

Copying Generated Files and Artifacts to the IIS WebGate Instance Location

After RREG generates these files and artifacts, you must manually copy them, based on the security mode you are using, from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home directory.

Do the following according to the security mode you are using:

  • In OPEN mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

    • ObAccessClient.xml

    • cwallet.sso

  • In SIMPLE mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

    • ObAccessClient.xml

    • cwallet.sso

    • password.xml

    In addition, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config/simple directory:

    • aaa_key.pem

    • aaa_cert.pem

  • In CERT mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

    • ObAccessClient.xml

    • cwallet.sso

    • password.xml

Parent topic: Getting Started with a New IIS 12c WebGate

Generating a New Certificate

You can generate a new certificate as follows:

  1. Create a certificate request as follows:

    openssl.exe req -utf8 -new -nodes -config openssl_silent_IIS12c.cnf -keyout aaa_key.pem -out aaa_req.pem -rand WebGate_Home/webgate/IIS/config/random-seed

  2. Self-sign the certificate as follows:

    openssl.exe ca -config openssl_silent_IIS12c.cnf -policy policy_anything -batch -out aaa_cert.pem -infiles aaa_req.pem

  3. Copy the following generated certificates to the WebGate_Instance_Home/webgate/config directory:

    • aaa_key.pem

    • aaa_cert.pem

    • cacert.pem located in the simpleCA directory

      Note:

      After copying the cacert.pem file, you must rename the file to aaa_chain.pem.

Migrating an Existing Certificate

If you want to migrate an existing certificate (aaa_key.pem, aaa_cert.pem, and aaa_chain.pem), ensure that you use the same passphrase that you used to encrypt aaa_key.pem. You must enter the same passphrase during the RREG registration process. If you do not use the same passphrase, the password.xml file generated by RREG does not match the passphrase used to encrypt the key.

If you enter the same passphrase, you can copy these certificates as follows:

  1. Go to the webgate_instanceDirectory/webgate/config directory.

  2. Copy the following certificates to the webgate_instanceDirectory/webgate/config directory:

    • aaa_key.pem

    • aaa_cert.pem

    • aaa_chain.pem

Starting the IIS Web Server and Accessing the IIS Resource

To start the IIS web server:

  1. From the Start menu, select run, and type inetmgr.

  2. Select the IIS Site and select Start to start the IIS Site.

After you start the IIS Web Server, log in to it by using the following URL:

http://machine_name.my.company.com:port

WebGate intercepts the request and redirects you to the Oracle Access Manager console. Enter the username and password, and you are redirected to the Microsoft HTTP Server.

Parent topic: Installing and Configuring IIS 12c WebGate for OAM

Deinstalling IIS 12c WebGate

You should always use the instructions provided in this section for removing the IIS 12c WebGate. If you try to remove the software manually, thne you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this chapter will ensure that the software is properly removed.

To deinstall the IIS WebGate, do the following:

  1. Go to the MW_HOME/Webgate_Home/oui/bin directory
  2. Run the following command:

    deinstall.cmd

After the Installer starts, the Welcome screen is displayed. Proceed with the deinstallation by referring to Deinstallation Screens and Instructions.

Parent topic: Installing and Configuring IIS 12c WebGate for OAM

Deinstallation Screens and Instructions

Follow the instructions in Table 4-2 to complete the deinstallation.

If you need additional help with any of the deinstallation screens, click Help to access the online help.

Table 3-2 Deinstallation Flow

Sl. No. Screen Description Action Required

1.

Welcome

Each time the deinstaller starts, the Welcome screen is displayed.

Click Next.

2.

Deinstall Oracle Home

The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall.

Verify the Oracle home you are about to deinstall.

Click Deinstall.

On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory in addition to removing the software.

Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen.

If you select No, go to Manually Removing the Oracle Home Directory for instructions on how to manually remove your Oracle home directory.

3.

Deinstallation progress

The Deinstallation Progress screen shows the progress and status of the deinstallation.

Wait until the Deinstallation Complete screen appears.

4.

Deinstallation Complete

The Deinstallation Complete screen appears when the deinstallation is complete.

Click Finish to dismiss the screen.

Parent topic: Deinstalling IIS 12c WebGate

Navigating the Uninstall Wizard Screens

The Uninstall Wizard shows a series of screens to confirm the removal of the software. See, Navigating the Uninstall Wizard Screens.

Parent topic: Deinstalling IIS 12c WebGate

Manually Removing the Oracle Home Directory

If you have selected No on the warning screen during deinstallation, then you must manually remove your Webgate_Home directory and any sub-directories.

For example:

On UNIX, if your Oracle WebGate home directory was /home/Oracle/Middleware/Oracle_OAMWebGate1, run the following command:

cd /home/Oracle/Middleware/

rm -rf Oracle_OAMWebGate1

Parent topic: Deinstalling IIS 12c WebGate

Silent Installation for IIS 12cWebGate

To run the IIS 12c WebGate in silent mode, complete the following steps:

  1. Set the contents of the silent.rsp file. For example:
    [ENGINE]
#DO NOT CHANGE THIS.
Response File Version=1.0.0.0.0
[GENERIC]
ORACLE_HOME=/home/MW_HOME/iis_WebGate_home
MIDDLEWARE_HOME=/home/MW_HOME
[SYSTEM]
[APPLICATIONS]
[RELATIONSHIPS]

    In the preceding file, the parameters are as follows:

    • ORACLE_HOME: Provide the Oracle home location. This is the directory in which you want to install the new IIS WebGate. The location must be an immediate child folder under the specified Middleware home location. The Oracle home directory name can contain only alphanumeric, hyphen (-), dot (.), and underscore (_) characters, and must begin with an alphanumeric character. The total length must be less than or equal to 128 characters. For example, home/middleware/iis_webgate.

    • MIDDLEWARE_HOME: Specify the full path to your Middleware home directory.

  2. Extract the contents of the installer to a directory.
  3. Run the following command:

    setup_fmw_12.2.1.4.0_iiswebgate_win64.exe -invPtrLoc Absolute_Path_Of_the_oraInst.loc_file -silent -response Absolute_Path_Of_the_silent.rsp_file

    In the preceding command:

    • Absolute_Path_Of_the_oraInst.loc_file is the absolute path to the oraInst.loc file.

    • Absolute_Path_Of_the_ silent.rsp_file is the absolute path to the silent.rsp file you created.

Parent topic: Installing and Configuring IIS 12c WebGate for OAM