10 Creating the Initial Infrastructure Domain for an Enterprise Deployment
This chapter provides information on variables used when creating the infrastructure domain, creating the database schemas and configuring the infrastructure domain.
- Variables Used When Creating the Infrastructure Domain
As you perform the tasks in this chapter, you will be referencing the directory variables listed in this section. - Understanding the Initial Infrastructure Domain
Before you begin creating the initial Oracle Fusion Middleware Infrastructure domain, be sure to review the following key concepts. - Installing the Oracle Fusion Middleware Infrastructure in Preparation for an Enterprise Deployment
Use the following sections to install the Oracle Fusion Middleware Infrastructure software in preparation for configuring a new domain for an enterprise deployment. - Creating the Database Schemas
Before you can configure a Fusion Middleware Infrastructure domain, you must install the schemas listed in this section in a certified database for use with this release of Oracle Fusion Middleware. - Configuring the Infrastructure Domain
This section provides instructions for creating a WebLogic domain using the configuration wizard. - Starting the Administration Server
After the domain is created, you can then perform the following tasks on WCCHOST1. - Creating a New LDAP Authenticator and Provisioning Enterprise Deployment Users and Group
When you configure an Oracle Fusion Middleware domain, the domain is configured by default to use the WebLogic Server authentication provider (DefaultAuthenticator). However, for an enterprise deployment, Oracle recommends that you use a dedicated, centralized LDAP-compliant authentication provider.
10.1 Variables Used When Creating the Infrastructure Domain
As you perform the tasks in this chapter, you will be referencing the directory variables listed in this section.
The directory variables are defined in File System and Directory Variables Used in This Guide.
-
ORACLE_HOME
-
APPLICATION_HOME
-
JAVA_HOME
In addition, you'll be referencing the following virtual IP (VIP) addresses and host names defined in Reserving the Required IP Addresses for an Enterprise Deployment:
-
ADMINVHN
-
WCCHOST1
-
WCCHOST2
-
DBHOST1
-
DBHOST2
-
SCAN Address for the Oracle RAC Database (
DB-SCAN.example.com)
10.2 Understanding the Initial Infrastructure Domain
Before you begin creating the initial Oracle Fusion Middleware Infrastructure domain, be sure to review the following key concepts.
10.2.1 About the Infrastructure Distribution
You create the initial Infrastructure domain for an enterprise deployment using the Oracle Fusion Middleware Infrastructure distribution. This distribution contains both the Oracle WebLogic Server software and the Oracle JRF software.
The Oracle JRF software consists of Oracle Web Services Manager, Oracle Application Development Framework (Oracle ADF), Oracle Enterprise Manager Fusion Middleware Control, the Repository Creation Utility (RCU), and other libraries and technologies required to support the Oracle Fusion Middleware products.
Later in this guide, you can then extend the domain to support the Oracle Fusion Middleware products required for your enterprise deployment.
For more information, see "Understanding Oracle Fusion Middleware Infrastructure" in Understanding Oracle Fusion Middleware.
10.2.2 Characteristics of the Initial Infrastructure Domain
The following table lists some of the key characteristics of the initial Infrastructure domain. By reviewing and understanding these characteristics, you can better understand the purpose and context of the procedures used to configure the domain.
Many of these characteristics are described in more detail in Understanding a Typical Enterprise Deployment.
| Characteristic of the Domain | More Information |
|---|---|
|
Contains only an Administration Server. Managed Servers are added to the domain later, when you extend the initial domain to include Oracle Fusion Middleware products. |
|
|
Uses a separate virtual IP (VIP) address for the Administration Server. |
Configuration of the Administration Server and Managed Servers Domain Directories |
|
Uses a per domain Node Manager configuration. |
About the Node Manager Configuration in a Typical Enterprise Deployment |
|
Requires a separately installed LDAP-based authentication provider. |
Understanding OPSS and Requests to the Authentication and Authorization Stores |
10.3 Installing the Oracle Fusion Middleware Infrastructure in Preparation for an Enterprise Deployment
Use the following sections to install the Oracle Fusion Middleware Infrastructure software in preparation for configuring a new domain for an enterprise deployment.
- Installing a Supported JDK
- Starting the Infrastructure Installer on WCCHOST1
- Navigating the Infrastructure Installation Screens
- Installing Oracle Fusion Middleware Infrastructure on the Other Host Computers
- Checking the Directory Structure
After you install the Oracle Fusion Middleware Infrastructure and create the Oracle home, you should see the directory and sub-directories listed in this topic. The contents of your installation vary based on the options you selected during the installation.
10.3.1 Installing a Supported JDK
Oracle Fusion Middleware requires that a certified Java Development Kit (JDK) is installed on your system. See the following sections for more information:
10.3.1.1 Locating and Downloading the JDK Software
To find a certified JDK, see the certification document for your release on the Oracle Fusion Middleware Supported System Configurations page.
After you identify the Oracle JDK for the current Oracle Fusion Middleware release, you can download an Oracle JDK from the following location on Oracle Technology Network:
http://www.oracle.com/technetwork/java/index.html
Be sure to navigate to the download for the Java SE JDK.
10.3.1.2 Installing the JDK Software
Install the JDK in the following locations:
-
On the shared storage device, where it will be accessible from each of the application tier host computers. Install the JDK in the
/u01/oracle/products/jdkdirectory. -
On the local storage device for each of the Web tier host computers.
The Web tier host computers, which reside in the DMZ, do not necessarily have access to the shared storage on the application tier.
For more information about the recommended location for the JDK software, see the Understanding the Recommended Directory Structure for an Enterprise Deployment.
The following example describes how to install a recent version of JDK 1.8:
10.3.2 Starting the Infrastructure Installer on WCCHOST1
To start the installation program, perform the following steps.
When the installation program appears, you are ready to begin the installation. See Navigating the Installation Screens for a description of each installation program screen.
10.3.3 Navigating the Infrastructure Installation Screens
The installation program displays a series of screens, in the order listed in the following table.
If you need additional help with any of the installation screens, click the screen name.
| Screen | Description |
|---|---|
|
On UNIX operating systems, this screen will appear if this is the first time you are installing any Oracle product on this host. Specify the location where you want to create your central inventory. Make sure that the operating system group name selected on this screen has write permissions to the central inventory location. For more information about the central inventory, see "Understanding the Oracle Central Inventory" in Installing Software with the Oracle Universal Installer. |
|
|
This screen introduces you to the product installer. |
|
|
Use this screen to automatically search My Oracle Support for available patches or automatically search a local directory for patches that you’ve already downloaded for your organization. |
|
|
Use this screen to specify the location of your Oracle home directory. For the purposes of an enterprise deployment, enter the value of the ORACLE_HOME variable listed in Table 7-2. |
|
|
Use this screen to select the type of installation and consequently, the products and feature sets you want to install. For this topology, select Fusion Middleware Infrastructure. Note: The topology in this document does not include server examples. Oracle strongly recommends that you do not install the examples into a production environment. |
|
|
This screen verifies that your system meets the minimum necessary requirements. If there are any warning or error messages, refer to the Oracle Fusion Middleware System Requirements and Specifications document on the Oracle Technology Network (OTN). |
|
|
If you already have an Oracle Support account, use this screen to indicate how you would like to receive security updates. If you do not have one and are sure you want to skip this step, clear the check box and verify your selection in the follow-up dialog box. |
|
|
Use this screen to verify the installation options you selected. If you want to save these options to a response file, click Save Response File and provide the location and name of the response file. Response files can be used later in a silent installation situation. For more information about silent or command-line installation, see "Using the Oracle Universal Installer in Silent Mode" in Installing Software with the Oracle Universal Installer. |
|
|
This screen allows you to see the progress of the installation. |
|
|
This screen appears when the installation is complete. Review the information on this screen, then click Finish to dismiss the installer. |
10.3.4 Installing Oracle Fusion Middleware Infrastructure on the Other Host Computers
If you have configured a separate shared storage volume or partition for WCCHOST2, then you must also install the Infrastructure on WCCHOST2.
For more information, see Shared Storage Recommendations When Installing and Configuring an Enterprise Deployment.
To install the software on the other host computers in the topology, log in to each host, and use the instructions in Starting the Infrastructure Installer on WCCHOST1 and Navigating the Infrastructure Installation Screens to create the Oracle home on the appropriate storage device.
Note:
In previous releases, the recommended enterprise topology included a colocated set of Oracle HTTP Server instances. In those releases, there was a requirement to install the Infrastructure on the Web Tier hosts (WEBHOST1 and WEBHOST2). However, for this release, the enterprise deployment topology assumes the Web servers are installed and configured in standalone mode, so they are not considered part of the application tier domain. For more information, see Configuring the Web Tier for an Enterprise Deployment
10.3.5 Checking the Directory Structure
After you install the Oracle Fusion Middleware Infrastructure and create the Oracle home, you should see the directory and sub-directories listed in this topic. The contents of your installation vary based on the options you selected during the installation.
To check the directory structure:
10.4 Creating the Database Schemas
Before you can configure a Fusion Middleware Infrastructure domain, you must install the schemas listed in this section in a certified database for use with this release of Oracle Fusion Middleware.
-
Metadata Services (MDS)
-
Audit Services (IAU)
-
Audit Services Append (IAU_APPEND)
-
Audit Services Viewer (IAU_VIEWER)
-
Oracle Platform Security Services (OPSS)
-
User Messaging Service (UMS)
-
WebLogic Services (WLS)
-
Common Infrastructure Services (STB)
You use the Repository Creation Utility (RCU) to create the schemas. This utility is installed in the Oracle home for each Oracle Fusion Middleware product. For more information about RCU and how the schemas are created and stored in the database, see "Preparing for Schema Creation" in Creating Schemas with the Repository Creation Utility.
Follow the instructions in this section to install the required schemas.
10.4.1 Installing and Configuring a Certified Database
Make sure you have installed and configured a certified database, and that the database is up and running.
For more information, see the Preparing the Database for an Enterprise Deployment.
10.4.2 Starting the Repository Creation Utility (RCU)
To start the Repository Creation Utility (RCU):
10.4.3 Navigating the RCU Screens to Create the Schemas
Follow the instructions in this section to create the schemas for the Fusion Middleware Infrastructure domain:
- Task 1 Introducing RCU
-
Review the Welcome screen and verify the version number for RCU. Click Next to begin.
- Task 2 Selecting a Method of Schema Creation
-
If you have the necessary permission and privileges to perform DBA activities on your database, select System Load and Product Load on the Create Repository screen. The procedure in this document assumes that you have the necessary privileges.
If you do not have the necessary permission or privileges to perform DBA activities in the database, you must select Prepare Scripts for System Load on this screen. This option will generate a SQL script, which can be provided to your database administrator. See "Understanding System Load and Product Load" in Creating Schemas with the Repository Creation Utility.
Tip:
For more information about the options on this screen, see "Create repository" in Creating Schemas with the Repository Creation Utility.
- Task 3 Providing Database Credentials
-
On the Database Connection Details screen, provide the database connection details for RCU to connect to your database.
In the Host Name field, enter the SCAN address of the Oracle RAC Database.
Click Next to proceed, then click OK in the dialog window confirming that connection to the database was successful.
Tip:
For more information about the options on this screen, see "Database Connection Details" in Creating Schemas with the Repository Creation Utility.
- Task 4 Specifying a Custom Prefix and Selecting Schemas
-
-
Specify the custom prefix you want to use to identify the Oracle Fusion Middleware schemas.
The custom prefix is used to logically group these schemas together for use in this domain. For the purposes of this guide, use the prefix
FMW1221.Tip:
Make a note of the custom prefix you choose to enter here; you will need this later, during the domain creation process.
For more information about custom prefixes, see "Understanding Custom Prefixes" in Creating Schemas with the Repository Creation Utility.
-
Select AS Common Schemas.
When you select AS Common Schemas, all of the schemas in this section are automatically selected.
If the schemas in this section are not automatically selected, then select the required schemas.
A schema called Common Infrastructure Services is also automatically created; this schema is grayed out and cannot be selected or deselected. This schema (the STB schema) enables you to retrieve information from RCU during domain configuration. For more information, see "Understanding the Service Table Schema" in Creating Schemas with the Repository Creation Utility.
Tip:
For more information about how to organize your schemas in a multi-domain environment, see "Planning Your Schema Creation" in Creating Schemas with the Repository Creation Utility.
Click Next to proceed, then click OK on the dialog window confirming that prerequisite checking for schema creation was successful.
-
- Task 5 Specifying Schema Passwords
-
Specify how you want to set the schema passwords on your database, then specify and confirm your passwords.
Tip:
You must make a note of the passwords you set on this screen; you will need them later on during the domain creation process.
- Task 6 Completing Schema Creation
-
Navigate through the remainder of the RCU screens to complete schema creation.
For the purposes of this guide, you can accept the default settings on the remaining screens, or you can customize how RCU creates and uses the required tablespaces for the Oracle Fusion Middleware schemas.
For more information about RCU and its features and concepts, see Creating Schemas with the Repository Creation Utility.
When you reach the Completion Summary screen, click Close to dismiss RCU.
10.5 Configuring the Infrastructure Domain
This section provides instructions for creating a WebLogic domain using the configuration wizard.
For more information on other methods available for domain creation, see "Additional Tools for Creating, Extending, and Managing WebLogic Domains" in Creating WebLogic Domains Using the Configuration Wizard.
10.5.1 Starting the Configuration Wizard
To begin domain configuration, run the following command in the Oracle Fusion Middleware Oracle home.
ORACLE_HOME/oracle_common/common/bin/config.sh
10.5.2 Navigating the Configuration Wizard Screens to Configure the Infrastructure Domain
Follow the instructions in this section to create and configure the domain for the topology.
- Task 1 Selecting the Domain Type and Domain Home Location
-
On the Configuration Type screen, select Create a New Domain.
In the Domain Location field, specify the value of the ASERVER_HOME variable, as defined in File System and Directory Variables Used in This Guide.
Tip:
For more information about the other options on this screen of the Configuration Wizard, see "Configuration Type" in Creating WebLogic Domains Using the Configuration Wizard.
- Task 2 Selecting the Configuration Templates
-
On the Templates screen, make sure Create Domain Using Product Templates is selected, then select the following templates:
-
Oracle Enterprise Manager - 12.2.1.1.0 [em]
Selecting this template automatically selects the following dependencies:
-
Oracle JRF - 12.2.1.1.0 [oracle_common]
-
WebLogic Coherence Cluster Extension - 12.2.1.1.0 [wlserver]
-
Tip:
More information about the options on this screen can be found in Templates in Creating WebLogic Domains Using the Configuration Wizard.
-
- Task 3 Selecting the Application Home Location
-
On the Application Location screen, specify the value of the APPLICATION_HOME variable, as defined in File System and Directory Variables Used in This Guide.
Tip:
More information about the options on this screen can be found in Application Location in Creating WebLogic Domains Using the Configuration Wizard.
- Task 4 Configuring the Administrator Account
-
On the Administrator Account screen, specify the user name and password for the default WebLogic Administrator account for the domain.
Make a note of the user name and password specified on this screen; you will need these credentials later to boot and connect to the domain's Administration Server.
- Task 5 Specifying the Domain Mode and JDK
-
On the Domain Mode and JDK screen:
-
Select Production in the Domain Mode field.
-
Select the Oracle Hotspot JDK in the JDK field.
Selecting Production Mode on this screen gives your environment a higher degree of security, requiring a user name and password to deploy applications and to start the Administration Server.
Tip:
More information about the options on this screen, including the differences between development mode and production mode, can be found in Domain Mode and JDK in Creating WebLogic Domains Using the Configuration Wizard.
In production mode, a boot identity file can be created to bypass the need to provide a user name and password when starting the Administration Server. For more information, see Creating the boot.properties File.
-
- Task 6 Specifying the Database Configuration Type
-
Select RCU Data to activate the fields on this screen.
The RCU Data option instructs the Configuration Wizard to connect to the database and Service Table (STB) schema to automatically retrieve schema information for the schemas needed to configure the domain.
Note:
If you choose to select Manual Configuration on this screen, you will have to manually fill in the parameters for your schema on the JDBC Component Schema screen.
After selecting RCU Data, fill in the fields as shown in the following table. Refer to GUID-3E450253-35A9-45A0-B4AB-0BC109EA2246.htm#GUID-CF612A2F-B312-458C-9D48-517D2357C2C4__BABHHCBF for a partial screen shot of a sample Database Configuration Type screen.
Field Description DBMS/Service
Enter the service name for the Oracle RAC database where you will install the product schemas. For example:
orcl.example.com
Be sure this is the common service name that is used to identify all the instances in the Oracle RAC database; do not use the host-specific service name.
Host Name
Enter the Single Client Access Name (SCAN) Address for the Oracle RAC database, which you entered in the Enterprise Deployment Workbook.
Port
Enter the port number on which the database listens. For example,
1521.Schema Owner
Schema Password
Enter the user name and password for connecting to the database's Service Table schema.
This is the schema user name and password that was specified for the Service Table component on the Schema Passwords screen in RCU (see Creating the Database Schemas).
The default user name is
prefix_STB, whereprefixis the custom prefix that you defined in RCU.Click Get RCU Configuration when you are finished specifying the database connection information. The following output in the Connection Result Log indicates that the operation succeeded:
Connecting to the database server...OK Retrieving schema data from database server...OK Binding local schema components with retrieved data...OK Successfully Done.
Click Next if the connection to the database is successful.
Tip:
More information about the RCU Data option can be found in "Understanding the Service Table Schema" in Creating Schemas with the Repository Creation Utility.
More information about the other options on this screen can be found in Datasource Defaults in Creating WebLogic Domains Using the Configuration Wizard.
- Task 7 Specifying JDBC Component Schema Information
-
Verify that the values on the JDBC Component Schema screen are correct for all schemas.
The schema table should be populated because you selected Get RCU Data on the previous screen. As a result, the Configuration Wizard locates the database connection values for all the schemas required for this domain.
At this point, the values are configured to connect to a single-instance database. However, for an enterprise deployment, you should use a highly available Real Application Clusters (RAC) database, as described in Preparing the Database for an Enterprise Deployment.
In addition, Oracle recommends that you use an Active GridLink datasource for each of the component schemas. For more information about the advantages of using GridLink data sources to connect to a RAC database, see "Database Considerations" in the High Availability Guide.
To convert the data sources to GridLink:
-
Select all the schemas by selecting the check box at in the first header row of the schema table.
-
Click Convert to GridLink and click Next.
-
- Task 8 Providing the GridLink Oracle RAC Database Connection Details
-
On the GridLink Oracle RAC Component Schema screen, provide the information required to connect to the RAC database and component schemas, as shown in Table 10-1 and in GUID-3E450253-35A9-45A0-B4AB-0BC109EA2246.htm#GUID-CF612A2F-B312-458C-9D48-517D2357C2C4__BABJBCFF.
Table 10-1 Recommended Values for Selected Fields on the GridLink Oracle RAC Component Schema Screen
Element Description and Recommended Value SCAN, Host Name, and Port
Select the SCAN check box.
In the Host Name field, enter the Single Client Access Name (SCAN) Address for the Oracle RAC database.
In the Port field, enter the SCAN listening port for the database (for example,
1521).ONS Host and Port
In the ONS Port field, enter the SCAN address for the Oracle RAC database.
In the Port field, enter the ONS Remote port (typically,
6200).Enable Fan
Select the Enable Fan check box to receive and process FAN events.
For more information about specifying the information on this screen, as well as information about how to identify the correct SCAN address, see "Configuring Active GridLink Data Sources with Oracle RAC" in the High Availability Guide.
You can also click Help to display a brief description of each field on the screen.
- Task 9 Testing the JDBC Connections
-
Use the JDBC Component Schema Test screen to test the data source connections you have just configured.
A green check mark in the Status column indicates a successful test. If you encounter any issues, see the error message in the Connection Result Log section of the screen, fix the problem, then try to test the connection again.
Tip:
More information about the other options on this screen can be found in Test Component Schema in Creating WebLogic Domains Using the Configuration Wizard.
- Task 10 Selecting Advanced Configuration
-
To complete domain configuration for the topology, select the following options on the Advanced Configuration screen:
-
Administration Server
This is required to properly configure the listen address of the Administration Server.
-
Node Manager
This is required to configure Node Manager.
-
Server Template, Managed Servers, Clusters, Dynamic Servers, Virtual Targets and Coherence
This is required to configure the Managed Servers and cluster, and also for configuring the machine and targeting the Managed Servers to the machine.
Note:
When using the Advanced Configuration screen in the Configuration Wizard:
-
If any of the above options are not available on the screen, then return to the Templates screen, and be sure you selected the required templates for this topology.
-
Do not select the Domain Frontend Host Capture advanced configuration option. You will later configure the frontend host property for specific clusters, rather than for the domain.
-
- Task 11 Configuring the Administration Server Listen Address
-
On the Administration Server screen:
-
In the Server Name field, retain the default value -
AdminServer. -
In the Listen Address field, enter the virtual host name that corresponds to the VIP of the ADMINVHN that you procured in Procuring Resources for an Enterprise Deployment and enabled in Preparing the Host Computers for an Enterprise Deployment.
For more information on the reasons for using the ADMINVHN virtual host, see Reserving the Required IP Addresses for an Enterprise Deployment.
-
Leave the other fields at their default values.
In particular, be sure that no server groups are assigned to the Administration Server.
-
- Task 12 Configuring Node Manager
-
Select Per Domain Default Location as the Node Manager type, then specify the Node Manager credentials you will use to connect to the Node Manager.
Tip:
For more information about the options on this screen, see "Node Manager" in Creating WebLogic Domains Using the Configuration Wizard.
For more information about per domain and per host Node Manager implementations, see About the Node Manager Configuration in a Typical Enterprise Deployment.
For additional information, see “Configuring Node Manager on Multiple Machines” in Administering Node Manager for Oracle WebLogic Server.
- Task 13 Configuring Managed Servers
-
There are no Managed Servers in the initial Infrastructure domain. Click Next to proceed to the next screen.
- Task 14 Configuring a Cluster
-
There are no clusters in the initial Infrastructure domain. Click Next to proceed to the next screen.
- Task 15 Configure Coherence Clusters
-
There are no clusters in the initial Infrastructure domain. Click Next to proceed to the next screen.
- Task 16 Creating Machines
-
Use the Machines screen to create a new machine in the domain. A machine is required in order for the Node Manager to be able to start and stop the servers.
-
Select the Unix Machine tab.
-
Click the Add button to create a new Unix machine.
Use the values in Table 10-2 to define the Name and Node Manager Listen Address of the new machine.
-
Verify the port in the Node Manager Listen Port field.
The port number
5556, shown in this example, may be referenced by other examples in the documentation. Replace this port number with your own port number as needed.
Table 10-2 Values to Use When Creating Unix Machines
Name Node Manager Listen Address Node Manager Listen Port ADMINHOST
Enter the value of the ADMINVHN variable.
5556
Tip:
More information about the options on this screen can be found in Machines in Creating WebLogic Domains Using the Configuration Wizard.
-
- Task 17 Reviewing Virtual Targets
-
Click Next to proceed to the next screen.
- Task 18 Reviewing Partitions
-
Click Next to proceed to the next screen.
- Task 19 Reviewing Your Configuration Specifications and Configuring the Domain
-
The Configuration Summary screen contains the detailed configuration information for the domain you are about to create. Review the details of each item on the screen and verify that the information is correct.
You can go back to any previous screen if you need to make any changes, either by using the Back button or by selecting the screen in the navigation pane.
Domain creation will not begin until you click Create.
Tip:
More information about the options on this screen can be found in Configuration Summary in Creating WebLogic Domains Using the Configuration Wizard.
- Task 20 Monitoring Configuration Progress
-
After all the processes are complete, click Next to proceed to the next screen.
- Task 21 Writing Down Your Domain Home and Administration Server URL
-
The Configuration Success screen will show the following items about the domain you just configured:
-
Domain Location
-
Administration Server URL
-
You must make a note of both items as you will need them later; the domain location is needed to access the scripts used to start the Node Manager and Administration Server, and the URL is needed to access the Administration Server.
Click Finish to dismiss the configuration wizard.
10.6 Starting the Administration Server
After the domain is created, you can then perform the following tasks on WCCHOST1.
- Starting the Node Manager in the Administration Server Domain Home on WCCHOST1
Use these steps to start the per-domain Node Manager for the ASERVER_HOME domain directory. - Creating the boot.properties File
You must create aboot.propertiesif you want start the Node Manager without being prompted for the Node Manager credentials. This step is required in an enterprise deployment. The credentials you enter in this file are encrypted when you start the Administration Server. - Starting the Administration Server Using the Node Manager
After you have configured the domain and configured the Node Manager, you can start the Administration Server, using the Node Manager. In an enterprise Deployment, the Node Manager is used to start and stop the Administration Server and all the Managed Servers in the domain. - Validating the Administration Server
Before proceeding with the configuration steps, validate that the Administration Server has started successfully by making sure you have access to the Oracle WebLogic Server Administration Console and Oracle Enterprise Manager Fusion Middleware Control, which both are installed and configured on the Administration Servers.
10.6.1 Starting the Node Manager in the Administration Server Domain Home on WCCHOST1
Use these steps to start the per-domain Node Manager for the ASERVER_HOME domain directory.
10.6.2 Creating the boot.properties File
You must create a boot.properties if you want start the Node Manager without being prompted for the Node Manager credentials. This step is required in an enterprise deployment. The credentials you enter in this file are encrypted when you start the Administration Server.
To create a boot.properties file for the Administration Server:
10.6.3 Starting the Administration Server Using the Node Manager
After you have configured the domain and configured the Node Manager, you can start the Administration Server, using the Node Manager. In an enterprise Deployment, the Node Manager is used to start and stop the Administration Server and all the Managed Servers in the domain.
To start the Administration Server using the Node Manager:
10.6.4 Validating the Administration Server
Before proceeding with the configuration steps, validate that the Administration Server has started successfully by making sure you have access to the Oracle WebLogic Server Administration Console and Oracle Enterprise Manager Fusion Middleware Control, which both are installed and configured on the Administration Servers.
To navigate to Fusion Middleware Control, enter the following URL, and log in with the Oracle WebLogic Server administrator credentials:
ADMINVHN:7001/em
To navigate to the Oracle WebLogic Server Administration Console, enter the following URL, and log in with the same administration credentials:
ADMINVHN:7001/console
10.7 Creating a New LDAP Authenticator and Provisioning Enterprise Deployment Users and Group
When you configure an Oracle Fusion Middleware domain, the domain is configured by default to use the WebLogic Server authentication provider (DefaultAuthenticator). However, for an enterprise deployment, Oracle recommends that you use a dedicated, centralized LDAP-compliant authentication provider.
The following topics describe how to use the Oracle WebLogic Server Administration Console to create a new authentication provider for the enterprise deployment domain. This procedure assumes you have already installed and configured a supported LDAP directory, such as Oracle Unified Directory or Oracle Internet Directory.
- About the Supported Authentication Providers
- About the Enterprise Deployment Users and Groups
- Prerequisites for Creating a New Authentication Provider and Provisioning Users and Groups
- Provisioning a Domain Connector User in the LDAP Directory
- Creating the New Authentication Provider
- Provisioning an Enterprise Deployment Administration User and Group
- Adding the New Administration User to the Administration Group
- Updating the boot.properties File and Restarting the System
10.7.1 About the Supported Authentication Providers
Oracle Fusion Middleware supports a variety of LDAP authentication providers. For more information, see "Identity Store Types and WebLogic Authenticators" in Securing Applications with Oracle Platform Security Services.
The instructions in this guide assume you will be using one of the following providers:
-
Oracle Unified Directory
-
Oracle Internet Directory
-
Oracle Virtual Directory
Note:
By default, the instructions here describe how to configure the identity service instance to support querying against a single LDAP identity store.
However, you can configure the service to support a virtualized identity store, which queries multiple LDAP identity stores, using LibOVD.
For more information about configuring a Multi-LDAP lookup, refer to "Configuring the Identity Store Service" in Securing Applications with Oracle Platform Security Services.
10.7.2 About the Enterprise Deployment Users and Groups
The following topics provide important information on the purpose and characteristics of the enterprise deployment administration users and groups.
10.7.2.1 About Using Unique Administration Users for Each Domain
When you use a central LDAP user store, you can provision users and groups for use with multiple Oracle WebLogic Server domains. As a result, there is a possibility that one WebLogic administration user can have access to all the domains within an enterprise.
Such an approach is not recommended. Instead, it is a best practice to assign a unique distinguished name (DN) within the directory tree for the users and groups you provision for the administration of your Oracle Fusion Middleware domains.
For example, if you plan to install and configure an Oracle WebCenter Content enterprise deployment domain, then create a user called weblogic_wcc and an administration group called WCCAdministrators.
10.7.2.2 About the Domain Connector User
Oracle recommends that you create a separate domain connector user (for example, wccLDAP) in your LDAP directory. This user allows the domain to connect to the LDAP directory for the purposes of user authentication. It is recommended that this user be a non-administrative user.
In a typical Oracle Identity and Access Management deployment, you create this user in the systemids container. This container is used for system users that are not normally visible to users. Placing the user into the systemids container ensures that customers who have Oracle Identity Manager do not reconcile this user.
10.7.2.3 About Adding Users to the Central LDAP Directory
After you configure a central LDAP directory to be the authenticator for the enterprise domain, then you should add all new users to the new authenticator and not to the default WebLogic Server authenticator.
To add new users to the central LDAP directory, you cannot use the WebLogic Administration Console. Instead, you must use the appropriate LDAP modification tools, such as ldapbrowser or JXplorer.
When you are using multiple authenticators (a requirement for an enterprise deployment), login and authentication will work, but role retrieval will not. The role is retrieved from the first authenticator only. If you want to retrieve roles using any other authenticator, then you must enable virtualization for the domain.
Enabling virtualization involves the following steps:
-
Locate and open the following configuration file with a text editor:
DOMAIN_HOME/config/fmwconfig/jps-config.xml -
In the serviceInstance tag with
name="idstore.ldap"andprovider="idstore.ldap.provider", add or update the following property as follows:<property name="virtualize" value="true"/>
For more information about the virtualize property, see “OPSS System and Configuration Properties” in Securing Applications with Oracle Platform Security Services.
10.7.2.4 About Product-Specific Roles and Groups for Oracle WebCenter Content
Each Oracle Fusion Middleware product implements its own predefined roles and groups for administration and monitoring.
As a result, as you extend the domain to add additional products, you can add these product-specific roles to the WCCAdministrators group. After they are added to the WCCAdministrators group, each product administrator user can administer the domain with the same set of privileges for performing administration tasks.
Instructions for adding additional roles to the WCCAdministrators group are provided in Common Configuration and Management Tasks for an Enterprise Deployment.
10.7.2.5 Example Users and Roles Used in This Guide
In this guide, the examples assume that you provision the following administration user and group with the DNs shown below:
-
Admin User DN:
cn=weblogic_wcc,cn=users,dc=example,dc=com -
Admin Group DN:
cn=WCCAdministrators,cn=groups,dc=example,dc=com -
Product-specific LDAP Connector User:
cn=wccLDAP,cn=systemids,dc=example,dc=comThis is the user you will use to connect WebLogic Managed Servers to the LDAP authentication provider. This user must have permissions to read and write to the Directory Trees:cn=users,dc=example,dc=com cn=groups,dc=example,dc=com
Note:
When using Oracle Unified Directory, this user will need to be granted membership in the following groups to provide read and write access:
cn=orclFAUserReadPrivilegeGroup,cn=groups,dc=example,dc=com cn=orclFAUserWritePrivilegeGroup,cn=groups,dc=example,dc=com cn=orclFAGroupReadPrivilegeGroup,cn=groups,dc=example,dc=com cn=orclFAGroupWritePrivilegeGroup,cn=groups,dc=example,dc=com
10.7.3 Prerequisites for Creating a New Authentication Provider and Provisioning Users and Groups
Before you create a new LDAP authentication provider, back up the relevant configuration files:
ASERVER_HOME/config/config.xml ASERVER_HOME/config/fmwconfig/jps-config.xml ASERVER_HOME/config/fmwconfig/system-jazn-data.xml
In addition, back up the boot.properties file for the Administration Server in the following directory:
DOMAIN_HOME/servers/AdminServer/security
10.7.4 Provisioning a Domain Connector User in the LDAP Directory
This example shows how to create a user called wccLDAP in the central LDAP directory.
To provision the user in the LDAP provider:
-
Create an ldif file named
domain_user.ldifwith the contents shown below and then save the file:dn: cn=wccLDAP,cn=systemids,dc=example,dc=com changetype: add orclsamaccountname: wccLDAP userpassword: password objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgperson objectclass: orcluser objectclass: orcluserV2 mail: wccLDAP@example.com givenname: wccLDAP sn: wccLDAP cn: wccLDAP uid: wccLDAP
Note:
If you are using Oracle Unified Directory, then add the following four group memberships to the end of the LDIF file to grant the appropriate read/write privileges:
dn: cn=orclFAUserReadPrivilegeGroup,cn=groups,dc=example,dc=example changetype: modify add: uniquemember uniquemember: cn=wccLDAP,cn=systemids,dc=example,dc=example dn: cn=orclFAGroupReadPrivilegeGroup,cn=groups,dc=example,dc=com changetype: modify add: uniquemember uniquemember: cn=wccLDAP,cn=systemids,dc=example,dc=example dn: cn=orclFAUserWritePrivilegeGroup,cn=groups,dc=example,dc=example changetype: modify add: uniquemember uniquemember: cn=wccLDAP,cn=systemids,dc=example,dc=com dn: cn=orclFAGroupWritePrivilegeGroup,cn=groups,dc=example,dc=com changetype: modify add: uniquemember uniquemember: cn=wccLDAP,cn=systemids,dc=example,dc=com
-
Provision the user in the LDAP directory.
For example, for an Oracle Unified Directory LDAP provider:
OUD_INSTANCE_HOME/bin/ldapmodify -a \ -h oudhost.example.com -D "cn=oudadmin" \ -w password \ -p 1389 \ -f domain_user.ldif
For Oracle Internet Directory:
OID_ORACLE_HOME/bin/ldapadd -h oidhost.example.com \ -p 3060 \ -D cn="orcladmin" \ -w password \ -c \ -v \ -f domain_user.ldif
10.7.5 Creating the New Authentication Provider
To configure a new LDAP-based authentication provider:
-
Log in to the WebLogic Server Administration Console.
-
Click Security Realms in the left navigational bar.
-
Click the myrealm default realm entry.
-
Click the Providers tab.
Note that there is a
DefaultAuthenticatorprovider configured for the realm. This is the default WebLogic Server authentication provider. -
Click Lock & Edit in the Change Center.
-
Click the New button below the Authentication Providers table.
-
Enter a name for the provider.
Use one of the following names, based on the LDAP directory service you are planning to use as your credential store:
-
OUDAuthenticatorfor Oracle Unified Directory -
OIDAuthenticatorfor Oracle Internet Directory -
OVDAuthenticatorfor Oracle Virtual Directory
-
-
Select the authenticator type from the Type drop-down list.
Select one of the following types, based on the LDAP directory service you are planning to use as your credential store:
-
OracleUnifiedDirectoryAuthenticatorfor Oracle Unified Directory -
OracleInternetDirectoryAuthenticatorfor Oracle Internet Directory -
OracleVirtualDirectoryAuthenticatorfor Oracle Virtual Directory
-
-
Click OK to return to the Providers screen.
-
On the Providers screen, click the newly created authenticator in the table.
-
Select SUFFICIENT from the Control Flag drop-down menu.
Setting the control flag to SUFFICIENT indicates that if the authenticator can successfully authenticate a user, then the authenticator should accept that authentication and should not continue to invoke any additional authenticators.
If the authentication fails, it will fall through to the next authenticator in the chain. Make sure all subsequent authenticators also have their control flags set to SUFFICIENT; in particular, check the
DefaultAuthenticatorand make sure that its control flag is set to SUFFICIENT. -
Click Save to save the control flag settings.
-
Click the Provider Specific tab and enter the details specific to your LDAP server, as shown in the following table.
Note that only the required fields are discussed in this procedure. For information about all the fields on this page, consider the following resources:
-
To display a description of each field, click Help on the Provider Specific tab.
-
For more information on setting the User Base DN, User From Name Filter, and User Attribute fields, see "Configuring Users and Groups in the Oracle Internet Directory and Oracle Virtual Directory Authentication Providers" in Administering Security for Oracle WebLogic Server.
Parameter Sample Value Value Description Host
For example:
oud.example.comThe LDAP server's server ID.
Port
For example:
1689The LDAP server's port number.
Principal
For example:
cn=wccLDAP, cn=systemids,dc=example,dc=comThe LDAP user DN used to connect to the LDAP server.
Credential
Enter LDAP password.
The password used to connect to the LDAP server.
SSL Enabled
Unchecked (clear)
Specifies whether SSL protocol is used when connecting to the LDAP server.
User Base DN
For example:
cn=users,dc=example,dc=comSpecify the DN under which your users start.
All Users Filter
(&(uid=*)(objectclass=person))Instead of a default search criteria for All Users Filter, search all users based on the
uidvalue.If the User Name Attribute for the user object class in the LDAP directory structure is a type other than
uid, then change that type in the User From Name Filter field.For example, if the User Name Attribute type is
cn, then this field should be set to:(&(cn=*)(objectclass=person)))
User From Name Filter
For example:
(&(uid=%u)(objectclass=person))
If the User Name Attribute for the user object class in the LDAP directory structure is a type other than
uid, then change that type in the settings for the User From Name Filter.For example, if the User Name Attribute type is
cn, then this field should be set to:(&(cn=%u)(objectclass=person))).User Name Attribute
For example:
uidThe attribute of an LDAP user object that specifies the name of the user.
Group Base DN
For example:
cn=groups,dc=example,dc=comSpecify the DN that points to your Groups node.
Use Retrieved User Name as Principal
Checked
Must be turned on.
GUID Attribute
entryuuidThis value is prepopulated with
entryuuidwhenOracleUnifiedDirectoryAuthenticatoris used for OUD. Check this value if you are using Oracle Unified Directory as your authentication provider. -
-
Click Save to save the changes.
-
Return to the Providers page by clicking Security Realms in the right navigation pane, clicking the default realm name (myrealm), and then Providers.
-
Click Reorder, and then use the resulting page to make the Provider you just created first in the list of authentication providers.
-
Click OK.
-
In the Change Center, click Activate Changes .
-
Restart the Administration Server.
To stop and start the Administration Server using the Node Manager:
-
Start WLST:
cd ORACLE_COMMON_HOME/common/bin ./wlst.sh -
Connect to Node Manager using the Node Manager credentials you defined in when you created the domain in the Configuration Wizard:
wls:/offline>nmConnect('nodemanager_username','nodemanager_password', 'ADMINVHN','5556','domain_name', 'ASERVER_HOME') -
Stop the Administration Server:
nmKill('AdminServer') -
Start the Administration Server:
nmStart('AdminServer') -
Exit WLST:
exit()
-
-
After the restart, review the contents of the following log file:
ASERVER_HOME/servers/AdminServer/logs/AdminServer.logVerify that no LDAP connection errors occurred. For example, look for errors such as the following:
The LDAP authentication provider named "OUDAuthenticator" failed to make connection to ldap server at ...
If you see such errors in the log file, then check the authorization provider connection details to verify they are correct and try saving and restarting the Administration Server again.
-
After you restart and verify that no LDAP connection errors are in the log file, try browsing the users and groups that exist in the LDAP provider:
In the Administration Console, navigate to the Security Realms > myrealm > Users and Groups page. You should be able to see all users and groups that exist in the LDAP provider structure.
10.7.6 Provisioning an Enterprise Deployment Administration User and Group
This example shows how to create a user called weblogic_wcc and a group called WCCAdministrators.
To provision the administration user and group in LDAP provider:
-
Create an ldif file named
admin_user.ldifwith the contents shown below and then save the file:dn: cn=weblogic_wcc,cn=users,dc=example,dc=com changetype: add orclsamaccountname: weblogic_wcc userpassword: password objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetorgperson objectclass: orcluser objectclass: orcluserV2 mail: weblogic_wcc@example.com givenname: weblogic_wcc sn: weblogic_wcc cn: weblogic_wcc uid: weblogic_wcc
-
Provision the user in the LDAP directory.
For example, for an Oracle Unified Directory LDAP provider:
OUD_INSTANCE_HOME/bin/ldapmodify -a \ -h oudhost.example.com -D "cn=oudadmin" \ -w password \ -p 1389 \ -f admin_user.ldif
For Oracle Internet Directory:
OID_ORACLE_HOME/bin/ldapadd -h oidhost.example.com \ -p 3060 \ -D cn="orcladmin" \ -w password \ -c \ -v \ -f admin_user.ldif
-
Create an
ldiffile namedadmin_group.ldifwith the contents shown below and then save the file:dn: cn=WCCAdministrators,cn=Groups,dc=example,dc=com displayname: WCCAdministrators objectclass: top objectclass: groupOfUniqueNames objectclass: orclGroup uniquemember: cn=weblogic_wcc,cn=users,dc=example,dc=com cn: WCCAdministrators uniquemember: cn=wccLDAP, cn=systemids, dc=example, dc=com cn: WCCAdministrators description: Administrators Group for the Oracle WebCenter Content Domain
-
Provision the group in the LDAP Directory.
For Oracle Unified Directory:
OUD_INSTANCE_HOME/bin/ldapmodify -a \ -D "cn=oudadmin" \ -h oudhost.example.com \ -w password \ -p 3060 \ -f admin_group.ldif
For Oracle Internet Directory:
OID_ORACLE_HOME/bin/ldapadd -h oid.example.com \ -p 3060 \ -D cn="orcladmin" \ -w password \ -c \ -v \ -f admin_group.ldif
-
Verify that the changes were made successfully:
-
Log in to the Oracle WebLogic Server Administration Console.
-
In the left pane of the console, click Security Realms.
-
Click the default security realm (myrealm).
-
Click the Users and Groups tab.
-
Verify that the administrator user and group you provisioned are listed on the page.
-
10.7.7 Adding the New Administration User to the Administration Group
After adding the users and groups to Oracle Internet Directory, the group must be assigned the Administration role within the WebLogic domain security realm. This enables all users that belong to the group to be administrators for the domain.
To assign the Administration role to the new enterprise deployment administration group:
- Expand the Global Roles entry in the table and click Roles.
- Click the Admin role.
