21 Configuring Single Sign-On for an Enterprise Deployment

This chapter describes how to configure the Oracle HTTP Server WebGate to enable single sign-on with Oracle Access Manager.

21.1 About Oracle HTTP Server Webgate

Oracle HTTP Server WebGate is a Web server plug-in that intercepts HTTP requests and forwards them to an existing Oracle Access Manager instance for authentication and authorization.

For Oracle Fusion Middleware 12c, the WebGate software is installed as part of the Oracle HTTP Server 12c software installation.

For more extensive information about WebGates, see “Registering and Managing OAM 11g Agents” in the Adminstrator’s Guide for Oracle Access Management.

21.2 General Prerequisites for Configuring Oracle HTTP Server 12c Webgate

Before you can configure Oracle HTTP Server 12c WebGate, you must have installed and configured a certified version of Oracle Access Manager.

At the time this document was published, the supported versions of Oracle Access Manager were 11g Relase 2 (11.1.2.2) and 11g Release 2 (11.1.2.3). For the most up-to-date information, see the certification document for your release on the Oracle Fusion Middleware Supported System Configurations page.

Note:

For production environments, it is highly recommended that you install Oracle Access Manager in its own environment and not on the machines that are hosting the enterprise deployment.

For more information about Oracle Access Manager, see the latest Oracle Identity and Access Management documentation, which you can find in the Middleware documentation on the Oracle Help Center.

21.3 Enterprise Deployment Prerequisites for Configuring OHS 12c Webgate

When you are configuring Oracle HTTP Server Webgate to enable Single Sign-On for an enterprise deployment, consider the prerequisites mentioned in this section.

  • Oracle recommends that you deploy Oracle Access Manager as part a highly available, secure, production environment. For more information about deploying Oracle Access Manager in an enterprise environment, see the Enterprise Deployment Guide for your version of Oracle Identity and Access Mangement.

  • To enable single sign-on for the WebLogic Server Administration Console and the Oracle Enterprise Manager Fusion Middleware Control, you must add a central LDAP-provisioned administration user to the directory service that Oracle Access Manager is using (for example, Oracle Internet Directory or Oracle Unified Directory). For more information about the required user and groups to add to the LDAP directory, follow the instructions in Creating a New LDAP Authenticator and Provisioning Enterprise Deployment Users and Group.

21.4 Configuring Oracle HTTP Server 12c WebGate for an Enterprise Deployment

Perform the following steps to configure Oracle HTTP Server 12c WebGate for Oracle Access Manager on both WEBHOST1 and WEBHOST2.

In the following procedure, replace the directory variables, such as OHS_ORACLE_HOME and OHS_CONFIG_DIR, with the values, as defined in File System and Directory Variables Used in This Guide.

  1. Perform a complete backup of the Web Tier domain.

  2. Change directory to the following location in the Oracle HTTP Server Oracle home:

    cd OHS_ORACLE_HOME/webgate/ohs/tools/deployWebGate/

  3. Run the following command to create the WebGate Instance directory and enable WebGate logging on OHS Instance:

    ./deployWebGateInstance.sh -w OHS_CONFIG_DIR -oh OHS_ORACLE_HOME
    
  4. Verify that a webgate directory and subdirectories was created by the deployWebGateInstance command:

    ls -lart OHS_CONFIG_DIR/webgate/
    total 6
    drwxr-x---+ 8 orcl oinstall 20 Oct  2 07:14 ..
    drwxr-xr-x+ 4 orcl oinstall  4 Oct  2 07:14 .
    drwxr-xr-x+ 3 orcl oinstall  3 Oct  2 07:14 tools
    drwxr-xr-x+ 3 orcl oinstall  4 Oct  2 07:14 config
    
  5. Run the following command to ensure that the LD_LIBRARY_PATH environment variable contains OHS_ORACLE_HOME/lib directory path:

    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:OHS_ORACLE_HOME/lib

  6. Change directory to the following directory

    OHS_ORACLE_HOME/webgate/ohs/tools/setup/InstallTools

  7. Run the following command from the InstallTools directory.

    ./EditHttpConf -w OHS_CONFIG_DIR -oh OHS_ORACLE_HOME -o output_file_name

    This command:

    • Copies the apache_webgate.template file from the Oracle HTTP Server Oracle home to a new webgate.conf file in the Oracle HTTP Server configuration directory.

    • Updates the httpd.conf file to add one line, so it includes the webgate.conf.

    • Generates a WebGate configuration file. The default name of the file is webgate.conf, but you can use a custom name by using the output_file argument to the command.

21.5 Registering the Oracle HTTP Server 12c WebGate with Oracle Access Manager

You can register the WebGate agent with Oracle Access Manager by using the Oracle Access Manager Administration console.

For more information, see "Registering an OAM Agent Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Management.

For more information, see the following topics:

21.5.1 Locating and Preparing the RREG Tool

To set up the RREG tool, complete the following steps:

  1. Log in to one of the Oracle Access Manager hosts in the Application tier.

  2. Change directory to the following directory in the Oracle Access Manager Oracle home:

    OAM_ORACLE_HOME/oam/server/rreg/client

    In this example, OAM_ORACLE_HOME refers to the Oracle home on the system where the Oracle Access Manager software was installed.

    Note:

    If you do not have privileges or access to the Oracle Access Manager server, then you can use out-of-band mode to generate the required files and register the WebGate with Oracle Access Manager. For more information, see About RREG In-Band and Out-of-Band Mode.
  3. Open the oamreg.sh file and set the following environment variables in the file, as follows:

    • Set OAM_REG_HOME to the absolute path to the directory in which you extracted the contents of RREG archive.

      Set JDK_HOME to the absolute path of the directory in which a supported JDK is installed on your machine.

21.5.2 About RREG In-Band and Out-of-Band Mode

You can run the RREG Tool in one of two modes: in-band and out-of-band.

Use in-band mode when you have the privileges to access the Oracle Access Manager server and run the RREG tool yourself from the Oracle Access Manager Oracle home. You can then copy the generated artifacts and files to the Web server configuration directory after you run the RREG Tool.

Use out-of-band mode if you do not have privileges or access to the Oracle Access Manager server. For example, in some organizations, only the Oracle Access Manager server administrators have privileges access the server directories and perform administration tasks on the server. In out-of-band mode, the process can work as follows:

  1. The Oracle Access Manager server administrator provides you with a copy of the RREG archive file (RREG.tar.gz), which the server administrator can find in the location described in Locating and Preparing the RREG Tool.

  2. Untar the RREG.tar.gz file that was provided to you by the server administrator.

    For example:

    gunzip RREG.tar.gz

    tar -xvf RREG.tar

    After you unpack the RREG archive, you can find the tool for registering the agent in the following location:

    RREG_HOME/bin/oamreg.sh

    In this example, RREG_Home is the directory in which you extracted the contents of RREG archive.

  3. Use the instructions in Updating the Standard Properties in the OAM11gRequest.xml File to update the OAM11GRequest.xml file, and send the completed OAM11GRequest.xml file to the Oracle Access Manager server administrator.

  4. The Oracle Access Manager server administrator then uses the instructions in Running the RREG Tool in Out-Of-Band Mode to run the RREG Tool and generate the AgentID_response.xml file.

  5. The Oracle Access Manager server administrator sends the AgentID_response.xml file to you.

  6. Use the instructions in Running the RREG Tool in Out-Of-Band Mode to run the RREG Tool with the AgentID_response.xml file and generate the required artifacts and files on the client system.

21.5.3 Updating the Standard Properties in the OAM11gRequest.xml File

Before you can register the Webgate agent with Oracle Access Manager, you must update some required properties in the OAM11gRequest.xml file.

Note:

If you plan to use the default values for most of the parameters in the provided XML file, then you can use the shorter version (OAM11gRequest_short.xml, in which all non-listed fields will take a default value.

To perform this task:

  1. If you are using in-band mode, then change directory to the following location in the directory:

    OAM_ORACLE_HOME/oam/server/rreg/client
    

    If you are using out-of-band mode, then change directory to the location where you unpacked the RREG archive.

  2. Make a copy of the OAM11gRequest.xml file template.

  3. Review the properties listed in the file, and then update your copy of the OAM11gRequest.xml file to make sure the properties reference the host names and other values specific to your environment.

OAM11gRequest.xml Property Set to...
serverAddress

The host and the port of the Administration Server for the Oracle Access Manager domain.

agentName

Any custom name for the agent. Typically, you use a name that identifies the Fusion Middleware product you are configuring for single sign-on.

applicationDomain

A value that identifies the Web tier host and the FMW component you are configuring for single sign-on.

security

The security mode of the Oracle Access Manager server, which can be open, simple, or certificate mode.

For an enterprise deployment, Oracle recommends simple mode, unless additional requirements exist to implement custom security certificates for the encryption of authentication and authorization traffic.

In most cases, avoid using open mode, because in open mode, traffic to and from the Oracle Access Manager server is not encrypted.

For more information using certificate mode or about Oracle Access Manager supported security modes in general, see Securing Communication Between OAM Servers and WebGatesin the Administrator's Guide for Oracle Access Management.

cachePragmaHeader

private

cacheControlHeader

private

ipValidation

0

<ipValidation>0<ipValidation>
ipValidationExceptions

The IP address of the front-end load balancer. For example:

<ipValidationExceptions>
        <ipAddress>130.35.165.42</ipAddress>
</ipValidation>
agentBaseUrl

The host and the port of the machine on which Oracle HTTP Server 12c WebGate is installed.

21.5.4 Updating the Protected, Public, and Excluded Resources for an Enterprise Deployment

When you set up an Oracle Fusion Middleware environment for single sign-on, you identify a set of URLs that you want Oracle Access Manager to protect with single sign-on. You identify these using specific sections of the OAM11gRequest.xml file. To identify the URLs:
  1. If you haven’t already opened OAM11gRequest.xml file for editing, locate and open the file in a text editor.
  2. Remove the sample entries from the file, and then enter the list of protected, public, and excluded resources in the appropriate sections of the file, as shown in the following example.

    Note:

    If you are using Oracle Access Manager 11g Release 2 (11.1.2.2) or later, then note that the entries with the wildcard syntax (“.../*”) are included for backward compatibility with previous versions of Oracle Access Manager.

    <protectedResourcesList>
            <resource>/integration/worklistapp</resource>
            <resource>/integration/worklistapp/.../*</resource>
            <resource>/workflow/sdpmessagingsca-ui-worklist</resource>
            <resource>/workflow/sdpmessagingsca-ui-worklist/.../*</resource>
            <resource>/b2bconsole</resource>
            <resource>/b2bconsole/.../*</resource>
            <resource>/sdpmessaging/userprefs-ui</resource>
            <resource>/sdpmessaging/userprefs-ui/.../*</resource>
            <resource>/workflow/DefaultToDoTaskFlow</resource>
            <resource>/workflow/DefaultToDoTaskFlow/.../*</resource>
            <resource>/DefaultToDoTaskFlow</resource>
            <resource>/DefaultToDoTaskFlow/.../*</resource>
            <resource>/ess</resource>
            <resource>/ess/.../*</resource>
            <resource>/EssHealthCheck</resource>
            <resource>/EssHealthCheck/.../*</resource>
            <resource>/em</resource>
            <resource>/em/.../*</resource>
            <resource>/console</resource>
            <resource>/console/.../*</resource>
            <resource>/servicebus</resource><!-- (For OSB systems only) -->
            <resource>/servicebus/.../*</resource><!-- (For OSB systems only) -->
            <resource>/lwpfconsole</resource><!-- (For OSB systems only) -->
            <resource>/lwpfconsole/.../*</resource><!-- (For OSB systems only) -->
            <resource>/soa/composer</resource>
            <resource>/soa/composer/.../*</resource>
            <resource>/OracleBAM </resource><!-- (For BAM systems only) -->
            <resource>/OracleBAM/.../*</resource><!-- (For BAM systems only) -->
            <resource>/oracle/bam/server</resource><!-- (For BAM systems only) -->
            <resource>/oracle/bam/server/.../*</resource><!-- (For BAM systems only) -->
            <resource>/bam/composer </resource><!-- (For BAM systems only) -->
            <resource>/bam/composer/.../*</resource><!-- (For BAM systems only) -->
            <resource>/bpm/composer</resource> <!-- (For BPM systems only) -->
            <resource>/bpm/composer/.../*</resource> <!-- (For BPM systems only) -->
            <resource>/bpm/workspace</resource><!-- (For BPM systems only) -->
            <resource>/bpm/workspace/.../*</resource><!-- (For BPM systems only) -->
            <resource>/soa-infra</resource>
            <resource>/soa-infra/deployer</resource>
            <resource>/soa-infra/deployer/.../*</resource>
            <resource>/soa-infra/events/edn-db-log</resource>
           <resource>/soa-infra/events/edn-db-log/.../*</resource>
            <resource>/soa-infra/cluster/info</resource>
            <resource>/soa-infra/cluster/info/.../*</resource>
            <resource>/inspection.wsil</resource>
            <resource>/healthcare/.../*</resource><!-- (For HC systems only) -->
            <resource>/healthcare</resource><!-- (For HC systems only) -->
    </protectedResourcesList>
    <publicResourcesList>
            <resource>/soa-infra/directWSDL</resource>
            <resource>/sbinspection.wsil</resource><!-- (For OSB systems only) -->
    </publicResourcesList>
    <excludedResourcesList>
            <resource>/wsm-pm</resource>
            <resource>/wsm-pm/.../*</resource>
            <resource>/soa-infra</resource>
            <resource>/soa-infra/services/.../*</resource>
            <resource>/OracleBAMWS</resource> <!-- (For BAM systems only) -->
            <resource>/OracleBAMWS/.../*</resource><!-- (For BAM systems only) -->
            <resource>/ucs/messaging/webservice</resource>
            <resource>/ucs/messaging/webservice/.../*</resource>
            <resource>/sbconsole</resource><!-- (For OSB systems only) -->
            <resource>/sbconsole/.../*</resource><!-- (For OSB systems only) -->
            <resource>/sbresource</resource><!-- (For OSB systems only) -->
            <resource>/sbresource/.../*</resource><!-- (For OSB systems only) -->
            <resource>/integration/services/.../*</resource>
            <resource>/integration/services</resource>
            <resource>/b2b/services/</resource>
            <resource>/b2b/services/.../*</resource>
    </excludedResourcesList>
    
  3. Save and close the OAM11GRequest.xml file.

21.5.5 Running the RREG Tool

The following topics provide information about running the RREG tool to register your Oracle HTTP Server Webgate with Oracle Access Manager.

21.5.5.1 Running the RREG Tool in In-Band Mode

To run the RREG Tool in in-band mode:

  1. Change directory the RREG home directory.

    If you are using in-band mode, the RREG directory is inside the Oracle Access Manager Oracle home:

    OAM_ORACLE_HOME/oam/server/rreg/client
    

    If you are using out-of-band mode, then the RREG home directory is the location where you unpacked the RREG archive.

  2. Change directory to the bin directory inside the RREG home directory:

    cd RREG_HOME/bin/
    
  3. Set the permissions of the oamreg.sh command so you can execute the file:

    chmod +x oamreg.sh
    
  4. Run the following command:

    ./oamreg.sh inband input/OAM11GRequest.xml
    

In this example:

  • It is assumed the edited OAM11GRequest.xml file is located in the RREG_HOME/input directory.

  • The output from this command will be saved to the following directory:

    RREG_HOME/output/
    

The following example shows a sample RREG session:

Welcome to OAM Remote Registration Tool!
Parameters passed to the registration tool are: 
Mode: inband
Filename: /u01/oracle/products/fmw/iam_home/oam/server/rreg/client/rreg/input/OAM11GWCCDomainRequest.xml
Enter admin username:weblogic_idm
Username: weblogic_idm
Enter admin password: 
Do you want to enter a Webgate password?(y/n):
n
Do you want to import an URIs file?(y/n):
n

----------------------------------------
Request summary:
OAM11G Agent Name:WCC1221_EDG_AGENT
URL String:null
Registering in Mode:inband
Your registration request is being sent to the Admin server at: http://host1.example.com:7001
----------------------------------------

Jul 08, 2015 7:18:13 PM oracle.security.jps.util.JpsUtil disableAudit
INFO: JpsUtil: isAuditDisabled set to true
Jul 08, 2015 7:18:14 PM oracle.security.jps.util.JpsUtil disableAudit
INFO: JpsUtil: isAuditDisabled set to true
Inband registration process completed successfully! Output artifacts are created in the output folder.

21.5.5.2 Running the RREG Tool in Out-Of-Band Mode

To run the RREG Tool in out-of-band mode on the Oracle Access Manager server, the Oracle Access Manager server administrator uses the following command:

RREG_HOME/bin/oamreg.sh outofband input/OAM11GRequest.xml

In this example:

  • Replace RREG_HOME with the location where the RREG archive file was unpacked on the server.

  • The edited OAM11GRequest.xml file is located in the RREG_HOME/input directory.

  • The RREG Tool saves the output from this command (the AgentID_response.xml file) to the following directory:

    RREG_HOME/output/
    

    The Oracle Access Manager server administrator can then send the AgentID_response.xml to the user who provided the OAM11GRequest.xml file.

To run the RREG Tool in out-of-band mode on the Web server client machine, use the following command:

RREG_HOME/bin/oamreg.sh outofband input/AgentID_response.xml

In this example:

  • Replace RREG_HOME with the location where you unpacked the RREG archive file on the client system.

  • The AgentID_response.xml file, which was provided by the Oracle Access Manager server administrator, is located in the RREG_HOME/input directory.

  • The RREG Tool saves the output from this command (the artifacts and files required to register the Webgate software) to the following directory on the client machine:

    RREG_HOME/output/
    

21.5.6 Files and Artifacts Generated by RREG

The files that get generated by the RREG Tool vary, depending on the security level you are using for communications between the WebGate and the Oracle Access Manager server. For more information about the supported security levels, see Securing Communication Between OAM Servers and WebGates in the Administrator's Guide for Oracle Access Management.

Note that in this topic any references to RREG_HOME should be replaced with the path to the directory where you ran the RREG tool. This is typically the following directory on the Oracle Access Manager server, or (if you are using out-of-band mode) the directory where you unpacked the RREG archive:

OAM_ORACLE_HOME/oam/server/rreg/client

The following table lists the artifacts that are always generated by the RREG Tool, regardless of the Oracle Access Manager security level.

File Location
cwallet.sso RREG_HOME/output/Agent_ID/
ObAccessClient.xml RREG_HOME/output/Agent_ID/

The following table lists the additional files that are created if you are using the SIMPLE or CERT security level for Oracle Access Manager:

File Location
aaa_key.pem RREG_HOME/output/Agent_ID/
aaa_cert.pem RREG_HOME/output/Agent_ID/
password.xml RREG_HOME/output/Agent_ID/

Note that the password.xml file contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.

You can use the files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing aaa_cert.pem and aaa_chain.pem files along with password.xml and aaa_key.pem.

21.5.7 Copying Generated Artifacts to the Oracle HTTP Server WebGate Instance Location

After the RREG Tool generates the required artifacts, manually copy the artifacts from the RREG_Home/output/agent_ID directory to the Oracle HTTP Server configuration directory on the Web tier host.

The location of the files in the Oracle HTTP Server configuration directory depends upon the Oracle Access Manager security mode setting (OPEN, SIMPLE, or CERT).

The following table lists the required location of each generated artifact in the Oracle HTTP configuration directory, based on the security mode setting for Oracle Access Manager. In some cases, you might have to create the directories if they do not exist already. For example, the wallet directory might not exist in the configuration directory.

Note:

For an enterprise deployment, Oracle recommends simple mode, unless additional requirements exist to implement custom security certificates for the encryption of authentication and authorization traffic. The information about using open or certification mode is provided here as a convenience.

Avoid using open mode, because in open mode, traffic to and from the Oracle Access Manager server is not encrypted.

For more information using certificate mode or about Oracle Access Manager supported security modes in general, see Securing Communication Between OAM Servers and WebGatesin the Administrator's Guide for Oracle Access Management.

File

Location When Using OPEN Mode

Location When Using SIMPLE Mode

Location When Using CERT Mode

wallet/cwallet.sso OHS_CONFIG_DIR/webgate/config/wallet OHS_CONFIG_DIR/webgate/config/wallet/ OHS_CONFIG_DIR/webgate/config/wallet/
ObAccessClient.xml OHS_CONFIG_DIR/webgate/config OHS_CONFIG_DIR/webgate/config/ OHS_CONFIG_DIR/webgate/config/
password.xml N/A OHS_CONFIG_DIR/webgate/config/ OHS_CONFIG_DIR/webgate/config/
aaa_key.pem N/A OHS_CONFIG_DIR/webgate/config/simple/ OHS_CONFIG_DIR/webgate/config/
aaa_cert.pem N/A OHS_CONFIG_DIR/webgate/config/simple/ OHS_CONFIG_DIR/webgate/config/

Note:

When you copy ObAccessClient.xml to a new directory, you will need to delete the old ObAccessClient.xml file from the first Oracle HTTP Server location cache location on WEBHOST1:
OHS_DOMAIN_HOME/servers/ohs1/cache/config/

And you must perform the similar step for the second Oracle HTTP Server instance on WEBHOST2:

OHS_DOMAIN_HOME/servers/ohs2/cache/config/

21.5.8 Restarting the Oracle HTTP Server Instance

For information about restarting the Oracle HTTP Server Instance, see "Restarting Oracle HTTP Server Instances by Using WLST" in Administering Oracle HTTP Server.

If you have configured Oracle HTTP Server in a WebLogic Server domain, you can also use Oracle Fusion Middleware Control to restart the Oracle HTTP Server Instances. For more information, see "Restarting Oracle HTTP Server Instances by Using Fusion Middleware Control" in Administrator's Guide for Oracle HTTP Server.

21.6 Setting Up the WebLogic Server Authentication Providers

To set up the WebLogic Server authentication providers, back up the configuration files, set up the Oracle Access Manager Identity Assertion Provider and set the order of providers.

The following topics assumes that you have already configured the LDAP authenticator by following the steps in Creating a New LDAP Authenticator and Provisioning Enterprise Deployment Users and Group. If you have not already created the LDAP authenticator, then do so before continuing with this section.

21.6.1 Backing Up Configuration Files

To be safe, you should first back up the relevant configuration files:

ASERVER_HOME/config/config.xml
ASERVER_HOME/config/fmwconfig/jps-config.xml
ASERVER_HOME/config/fmwconfig/system-jazn-data.xml

Also back up the boot.properties file for the Administration Server:

ASERVER_HOME/servers/AdminServer/security/boot.properties

21.6.2 Setting Up the Oracle Access Manager Identity Assertion Provider

Set up an Oracle Access Manager identity assertion provider in the Oracle WebLogic Server Administration Console.

To set up the Oracle Access Manager identity assertion provider:
  1. Log in to the WebLogic Server Administration Console, if not already logged in.
  2. Click Lock & Edit.
  3. Click Security Realms in the left navigation bar.
  4. Click the myrealm default realm entry.
  5. Click the Providers tab.
  6. Click New, and select the asserter type OAMIdentityAsserter from the drop-down menu.
  7. Name the asserter (for example, OAM ID Asserter) and click OK.
  8. Click the newly added asserter to see the configuration screen for the Oracle Access Manager identity assertion provider.
  9. Set the control flag to REQUIRED.
  10. Select both the ObSSOCookie and OAM_REMOTE_USER options under Chosen types.
  11. Click Save to save the settings.
  12. Click Activate Changes to propagate the changes.
  13. Restart the Administration Server and Managed Servers.

21.6.3 Setting the Order of Providers

Set the order of identity assertion and authentication providers in the WebLogic Server Administration Console.

To set the order of the providers:
  1. Log in to the WebLogic Server Administration Console, if not already logged in.
  2. Click Lock & Edit.
  3. Click Security Realms in the left navigation bar.
  4. Click the myrealm default realm entry.
  5. Click the Providers tab.
  6. Reorder the Oracle Access Manager identity assertion provider, the LDAP authentication provider, and the default authentication provider by ensuring that the control flag for each provider is set as follows:
    • Oracle Access Manager identity assertion provider: REQUIRED

    • LDAP authentication provider: SUFFICIENT

    • Default authentication provider (DefaultAuthenticator): SUFFICIENT

  7. Click OK.
  8. Click Activate Changes to propagate the changes.
  9. Restart the Administration Server, Managed Servers, and system components.

21.7 Configuring Oracle ADF and OPSS Security with Oracle Access Manager

Some Oracle Fusion Middleware management consoles use Oracle Application Development Framework (Oracle ADF) security, which can integrate with Oracle Access Manager Single Sign On (SSO). These applications can take advantage of Oracle Platform Security Services (OPSS) SSO for user authentication, but you must first configure the domain-level jps-config.xml file to enable these capabilities.

The domain-level jps-config.xml file is located in the following location after you create an Oracle Fusion Middleware domain:
DOMAIN_HOME/config/fmwconfig/jps-config.xml 

Note:

The domain-level jps-config.xml should not be confused with the jps-config.xml that is deployed with custom applications.

To update the OPSS configuration to delegate in SSO actions in Oracle Access Manager, complete the following steps:
  1. Change directory to the following directory:
    cd ORACLE_COMMON_HOME/common/bin
    
  2. Start the WebLogic Server Scripting Tool (WLST):
    ./wlst.sh
    
  3. Connect to the Administration Server, using the following WLST command:
    connect(‘admin_user’,’admin_password’,’admin_url’)
    

    For example:

    connect(‘weblogic’,’mypassword’,’t3://ADMINVHN:7001’)
    
  4. Execute the addOAMSSOProvider command, as follows:
    addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi="/oamsso/logout.html")
    

    The following table defines the expected value for each argument in the addOAMSSOProvider command.

    Argument

    Definition

    loginuri

    Specifies the URI of the login page

    Note: For ADF security enabled applications, "<context-root/adfAuthentication" should be provided for the 'loginuri' parameter.

    For example:

    /${app.context}/adfAuthentication
    

    Here is the flow:

    1. User accesses a resource that has been protected by authorization policies in OPSS, fox example.

    2. If the user is not yet authenticated, ADF redirects the user to the URI configured in 'loginuri'.

    3. Access Manager, should have a policy to protect the value in 'loginuri': for example, "/<context-root/adfAuthentication.

    4. When ADF redirects to this URI, Access Manager displays a Login Page (depending on the authentication scheme configured in Access Manager for this URI).

    logouturi

    Specifies the URI of the logout page

    Notes:

    • For ADF security enabled applications, logouturi should be configured based on logout guidelines in “Configuring Centralized Logout for Sessions Involving 11g WebGates” in the Administrator's Guide for Oracle Access Management.

    • When using WebGate 11g, the value of the logouturi should be sought from the 11g WebGate Administrator.

    • When using WebGate 10g, the value of logouturi should be /oamsso/logout.html.

    autologinuri

    Specifies the URI of the autologin page. This is an optional parameter.

  5. Disconnect from the Administration Server:
    disconnect()
    
  6. Restart the Administration Server and all the Managed Servers.