B Integrating Oracle Internet Directory with Oracle Access Manager

This appendix describes post-installation enablement of a centralized LDAP store for use with Oracle Access Manager. Oracle Internet Directory is featured in this discussion. However, tasks are the same regardless of your chosen LDAP provider.

Oracle Access Manager addresses each user population and LDAP directory store as an identity domain. Each identity domain maps to a configured LDAP User Identity Store that is registered with Oracle Access Manager. Multiple LDAP stores can be used with each one relying on a different supported LDAP provider.

During initial WebLogic Server domain configuration, the Embedded LDAP is configured as the one and only User Identity Store for Oracle Access Manager. Within the Embedded LDAP, the Administrators group is created, with weblogic seeded as the default Administrator:

  • Only the User Identity Store designated as the System Store is used to authenticate Administrators signing in to use the Oracle Access Manager Console, remote registration, and custom administrative commands in WLST.

  • Users attempting to access an OAM-protected resource can be authenticated against any store, not necessarily the only one designated as the Default User Identity Store.

  • Oracle Security Token Service uses only the Default User Identity Store. When adding User constraints to a Token Issuance Policy, for instance, the identity store from which the users are to be chosen must be Default User Identity Store.

After registering a User Identity Store with Access Manager, administrators can reference the store in one or more authentication modules, which form the basis for Oracle Access Manager Authentication Schemes and Policies. When you register a partner (either using the Oracle Access Manager Console or the remote registration tool), an application domain can be created and seeded with a policy that uses the designated default Authentication Scheme. When a user attempts to access an Oracle Access Manager-protected resource, she is authenticated against the store designated by the authentication module.

The following topics are covered:

B.1 Installing and Setting Up Required Components

The following overview identifies various tasks required when integrating Oracle Internet Directory 11.1.1.5 with Oracle Access Manager 11.1.1.5.

See Also:

Oracle Fusion Middleware Administrator's Guide for Oracle Access Management.

Task overview: Integrating Oracle Internet Directory 11.1.1.5 with Oracle Access Manager 11.1.1.5

  1. Prepare your environment for this integration:

    1. Install Oracle Internet Directory 11.1.1.5, as described in "Installing Oracle Identity and Access Management (11.1.1.5.0)" in Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

    2. Install and set up Oracle Access Manager with the desired LDAP directory, as described in Oracle Fusion Middleware Administrator's Guide for Oracle Access Management. (see also "Configuring Oracle Internet Directory").

    3. Extend the LDAP directory schema for Access Manager, and create Users and Groups in the LDAP directory as described in Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

  2. Create Authentication Providers for your LDAP provider and Configure WebLogic Server to use them to avoid multiple login pages when accessing the Oracle Access Manager Console:.

    Whether you authenticate through Oracle Access Manager Console or directly through the WebLogic Server Administration Console, confirm that all authentication providers are set to SUFFICIENT for single sign-on:

    1. Click Security Realms, myrealm, then click Providers.

    2. Click New, enter a name, and select a type. For example:

      Name: OID Authenticator

      Type: OracleInternetDirectoryAuthenticator

      OK

    3. In the Authentication Providers table, click the newly added authenticator.

    4. On the Settings page, click the Common tab, set the Control Flag to SUFFICIENT, then click Save.

    5. Click the Provider Specific tab, then specify the following values for your deployment:

      Host: LDAP host. For example: example

      Port: LDAP host listening port. 3060

      Principal: LDAP administrative user. For example: cn=*********

      Credential: LDAP administrative user password. ********

      User Base DN: Same search base as the LDAP user.

      All Users Filter: For example: (&(uid=*)(objectclass=person))

      User Name Attribute: Set as the default attribute for username in the LDAP directory. For example: uid.

      Group Base DN: The group searchbase (same as User Base DN)

      Note:

      Do not set the All Groups filter; the default works fine as is.

      Save.

  3. Set DefaultIdentityAsserter:

    1. From Security Realms, myrealm, Providers, click Authentication, click DefaultIdentityAsserter to see the configuration page.

    2. Click the Common tab and set the Control Flag to SUFFICIENT.

    3. Save.

  4. Reorder Providers:

    1. On the Summary page where providers are listed, click the Reorder button

    2. On the Reorder Authentication Providers page, select a provider name and use the arrows beside the list to order the providers as follows:


      WebLogic Provider
      IAMSuiteAgent
      OracleInternetDirectoryAuthenticator
      DefaultIdentityAsserter

    3. Click OK to save your changes

  5. Activate Changes: In the Change Center, click Activate Changes, then Restart Oracle WebLogic Server.

  6. Proceed with Section B.2, "Defining Authentication in Oracle Access Manager for Oracle Internet Directory".

B.2 Defining Authentication in Oracle Access Manager for Oracle Internet Directory

The following procedure guides as you set up an LDAP Authentication Method that points to your registered User Identity Store and an Authentication Scheme that uses this LDAP module for Form or Basic authentication. OAMAdminConsoleScheme is used in this example on the presumption that you designated your new LDAP store as the System Store. Your environment might be different.

Prerequisites

Section B.1, "Installing and Setting Up Required Components"

Ensure that the designated User Identity Store contains any user credentials required for authentication.

To use your identity store for authentication with Access Manager

  1. Register Oracle Internet Directory with Oracle Access Manager, as described in Managing User Identity Stores in Oracle Fusion Middleware Administrator's Guide for Oracle Access Management.

  2. Define Authentication Modules and Plug-ins: From System Configuration tab, Access Manager Settings section, expand the Authentication Modules node.

    1. LDAP Modules: Open LDAP Authentication module, select your User Identity Store, and click Apply.

    2. Custom Authentication Modules: In LDAPPlugin Steps (stepUI, UserIdentificationPlugIn), specify your KEY_IDENTITY_STORE_REF, and click Apply. For example:


      Authentication Modules
      Custom Authentication module
      LDAPPlugin
      Steps tab
      stepUI UserIdentificationPlugIn

      Repeat this step for the stepUA UserAuthenticationPlugIn plug-in, and Apply your changes, as shown here:

    See Also:

    Oracle Fusion Middleware Administrator's Guide for Oracle Access Management

  3. Define Authentication Scheme Challenge Methods: Form and Basic Challenge Methods require a reference to the LDAP Authentication Module or Plug-in that points to your User Identity Store. For example:


    Oracle Access Manager Console
    Policy Configuration tab
    Shared Components node
    Authentication Schemes node
    DesiredScheme (OAMAdminConsoleScheme or any Form or Basic scheme)

    1. Confirm that the Authentication Module references the LDAP module or plug-in that points to your Identity Store.

    2. Click Apply to submit the changes (or close the page without applying changes).

    3. Dismiss the Confirmation window.

    See Also:

    Oracle Fusion Middleware Administrator's Guide for Oracle Access Management

  4. Proceed to Section B.3, "Managing Oracle Access Manager Policies that Rely on Your LDAP Store".

B.3 Managing Oracle Access Manager Policies that Rely on Your LDAP Store

Oracle Access Manager policies protect specific resources. The policies and resources are organized in an Application Domain.

This section describes how to configure authentication policies to use the Authentication Scheme that points to your User Identity Store.

Prerequisites

Section B.2, "Defining Authentication in Oracle Access Manager for Oracle Internet Directory"

To create an application domain and policies that use LDAP authentication

  1. From the Oracle Access Manager Console, open:


    Oracle Access Manager Console
    Policy Configuration tab
    Application Domains node

  2. Locate and open the desired Application Domain (or click the Create (+) button, enter a unique name, and save it).

  3. Define Resources and Policies: Define (or edit) the following elements for your application domain and environment, as described in Oracle Fusion Middleware Administrator's Guide for Oracle Access Management:

    • Resource Definitions: Before you can add a resource to a policy, you must define the resource within the Application Domain. See "Adding and Managing Resource Definitions for Use in Policies".

    • Authentication Policies: On the Policy page, select the scheme that references the LDAP module or plug-in that points to your registered Oracle Internet Directory User Identity Store. Add specific resources and complete the policy for your environment. See "Defining Authentication Policies for Specific Resources".

    • Authorization Policies: Create or modify an Authorization Policy for specific resources and include any Responses and Constraints you need. See "Defining Authorization Policies for Specific Resources" as described in Oracle Fusion Middleware Administrator's Guide for Oracle Access Management.

    • Token Issuance Policies: Choose the desired User Identity Store when setting Identity Conditions in Token Issuance Policies. See "Managing Token Issuance Policies and Constraints with Oracle Access Manager" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Management.

  4. Proceed to Section B.4, "Validating Authentication and Access".

B.4 Validating Authentication and Access

The procedure here provides several methods for confirming that Agent registration and authentication and authorization policies are operational. The procedures are nearly identical for both OAM Agents and OSSO Agents (mod_osso). However, OSSO Agents use only the authentication policy and not the authorization policy.

To verify authentication and access

  1. Using a Web browser, enter the URL for an application protected by the registered Agent to confirm that the login page appears (proving that the authentication redirect URL was specified appropriately). For example:

    http://myWebserverHost.example.com:8100/resource1.html

  2. Confirm that you are redirected to the login page.

  3. On the Sign In page, enter a valid username and password when asked, and click Sign In.

  4. Confirm that you are redirected to the resource and proceed as follows:

    • Success: If you authenticated successfully and were granted access to the resource; the configuration is working properly.

    • Failure: If you received an error during login or were denied access to the resource, check the following:

      • Authentication Failed: Sign in again using valid credentials.

      • Access to URL ... denied: This userID is not authorized to access this resource.

      • Resource not Available: Confirm that the resource is available.

      • Wrong Redirect URL: Verify the redirect URL in the Oracle Access Manager Console.