2 Getting Started with OAM Administration and Navigation

About Oracle Access Manager 11g Architecture

This topic provides an overview of Oracle Access Manager 11g, which sits on Oracle WebLogic Servers and is part of the Oracle Fusion Middleware Access Management architecture.

While providing backward compatibility and co-existence with existing solutions, Oracle Access Manager 11g replaces and converges:

• Oracle Access Manager 10g

• Oracle Application Server SSO (OSSO) 10g

• Oracle Sun OpenSSO

As illustrated in Figure 2-1, all user identities, policies, and audit records reside in centrally managed data stores. Oracle WebLogic Server provides domain management, deployment management, and post-installation configuration. Oracle Access Manager manages all agents and policies centrally.

Figure 2-1 Oracle Fusion Middleware Access Management Architecture

Both Oracle WebLogic Server and Oracle Access Manager 11g rely on the Oracle Platform Security Services for authentication, authorization, secure communication (SSL), the common Audit Framework, as well as the credential store, and identity services.

Shared services for Access (SSA) include token processing, session management. Shared services for identity (SSI) include password reset, password policy, and delegated administration through Oracle Identity Manager.

Fraud prevention, security token service, identity federation, authentication and SSO, and authorization and Entitlements are integrated.

Figure 2-2 illustrates the primary Oracle Access Manager 11g components and services. The Protocol Compatibility Framework interfaces with OAM WebGates, mod_osso agents, and custom AccessGates created using the Access Manager Software Developer Kit (SDK).

Figure 2-2 Oracle Access Manager 11g Components and Services

Figure 2-3 illustrates the distribution of Oracle Access Manager components.

Figure 2-3 Component Distribution

The Oracle Access Manager Administration Console (sometimes referred to as the Oracle Access Manager Admin Server) resides on the Oracle WebLogic Administration Server (known as AdminServer). WebLogic Managed Servers hosting OAM runtime instances are known as OAM Servers.

Shared information consists of:

• Agent and server configuration data

• Oracle Access Manager policies

• User session data is shared among all OAM Servers

For more information, see "Comparing Oracle Access Manager 11g with OAM 10g and OSSO 10g".

Comparing Oracle Access Manager 11g with OAM 10g and OSSO 10g

This topic introduces Oracle Access Manager 11g architecture and provides a comparison against the 10g architecture for Oracle Access Manager and OSSO. Included are the following topics:

Oracle Access Manager 11g differs from Oracle Access Manager 10g in that the identity administration features have been transferred to Oracle Identity Manager 11g (including user self-service and self registration, workflow functionality, dynamic group management, and delegated identity administration).

Oracle Access Manager 10g supported Single Sign-on using a single session cookie (the ObSSOCookie) that contained the user identity and user session information required to access target resources that had the same or lower authentication level. The ObSSOCookie was encrypted and decrypted using a global shared secret key, the value of which was stored in the directory server. The ObSSOCookie was consumed by Access System components to verify the user identity and allow or disallow access to protected resources.

To close any possible security gaps, Oracle Access Manager 11g provides new server-side components that maintain backward compatibility with existing Oracle Access Manager 10g policy-enforcement agents (WebGates) and OSSO 10g agents (mod_osso). New Oracle Access Manager 11g WebGates are enhanced versions of 10g WebGates, that support a per-agent secret key for the Single Sign-on (SSO) solution. Thus, cookie-replay type of attack are prevented. The 11g WebGates are all trusted at the same level; a cookie specific for the WebGate is set and cannot be used to access any other WebGate-protected applications on a user's behalf.

Unless explicitly stated, the term "WebGate" refers to both an out of the box WebGate or a custom AccessGate.

Oracle Access Manager 11g uses technology from Oracle Coherence to provide centralized, distributed, and reliable session management.

For a list of names that have changed with Oracle Access Manager 11g, see "Product and Component Name Changes". Table 2-1 provides a comparison of Oracle Access Manager 11g, OAM 10g, and OracleAS SSO 10g.

About Deployment Types and OAM

Table 2-2 describes the types of deployments you might have within your enterprise, even though these might be named differently in your enterprise.

During initial installation and configuration you can create a new WebLogic Server domain (or extend an existing domain) and define information for OAM Servers, Database Schemas, optional WebLogic Managed Servers and clusters, and the embedded LDAP Server.

Regardless of the deployment size or type, in a new WebLogic Server domain the following OAM-related components are deployed using the Oracle Fusion Middleware Configuration Wizard:

• WebLogic Administration Server

• Oracle Access Manager Console deployed on the WebLogic Administration Server (sometimes referred to as the OAM Administration Server)

• A WebLogic Managed Server for Oracle Access Manager

• Application deployed on the Managed Server

While using the Oracle Fusion Middleware Configuration Wizard, the with-DB config template was chosen to set up the database for application domain metadata. The database must be extended with the OAM-specific schema using the Repository Creation Utility (RCU). The policy store bootstrap occurs on the initial AdminServer startup after running the Configuration Wizard. For more information, see the Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

The default Embedded LDAP is set as the primary user identity store for OAM 11g.

A Java key store is set up to be used for certificates for Simple or Certificate-based communication between OAM Servers and WebGates during authorization. The key store bootstrap also occurs on the initial AdminServer startup after running the Configuration Wizard.

About Post-Installation Tasks

During initial deployment, the WebLogic Administrator userID and password are set for use when signing in to both the OAM Administration Console and WebLogic Server Administration Console. A different administrator can be assigned for OAM, as described in "Introduction to OAM Administrators".

OAM administrators can log in and use the OAM Administration Console to manage:

• User identity stores

• OAM Server registration

• Partner (agent and partner application) registration

• Application domains and policies to protect resources

• User sessions

• Common Server Properties

Logging In to the Oracle Access Manager 11g Administration Console

The OAM log in page is shown in Figure 2-4.

Figure 2-4 Oracle Access Manager 11g Log In Page

Description of "Figure 2-4 Oracle Access Manager 11g Log In Page"

To log in to Oracle Access Manager 11g

1. In a browser window, enter the URL to the Oracle Access Manager 11g using the appropriate protocol (HTTP or HTTPS). For example:

   https://hostname:port/oamconsole/
   

   In the sample URL shown here:

   • HTTPS represents the Hypertext Transfer Protocol (HTTP) with the Secure Socket Layer (SSL) enabled to encrypt and decrypt user page requests and the pages returned by the Web server

   • hostname refers to fully-qualified domain name of the computer hosting the Oracle Access Manager 11g Administration Console

   • port refers to the designated bind port for the OAM Administration Console (this is the same as the bind port for the WebLogic Server Administration Console)

   • /oamconsole/refers to the OAM Administration Console Log In page

2. On the Log In page, enter the OAM Administrator credentials. For example:

   Username: Admin_login_id

   Password: Admin_password

3. Click the Log In button or press the Enter key.

4. Proceed as follows:

   • Successful: Policy Configuration, and System Configuration tabs appear on the left; Welcome page is on the right. Tour the console, as described in "Introduction to Policy Configuration and System Configuration Tabs" or start performing tasks on your own.

   • Not Successful: Log in again and ensure that you enter information exactly as specified for the OAM Administrator in the primary user identity store.

     See Also:

     "Introduction to OAM Administrators"

Signing Out of Oracle Access Manager 11g Administration Console

The Sign Out link appears in the upper-right corner of the Administration Console, as shown in Figure 2-5. You select the Sign Out link to conclude your session. Oracle recommends that you also close the browser window after signing out.

Figure 2-5 Sign Out Link, Upper-right Corner

Description of "Figure 2-5 Sign Out Link, Upper-right Corner"

To sign out of Oracle Access Manager 11g Administration Console

1. Click the Sign Out link in the upper-right corner of the console.

2. Close your browser window.

Console Layout and Controls

Figure 2-6 provides a look at the Administration Console as it appears immediately after log in.

Figure 2-6 OAM Administration Console Welcome Page and Policy Configuration Tab

Description of "Figure 2-6 OAM Administration Console Welcome Page and Policy Configuration Tab"

The OAM 11g Administration Console provides named function tabs on the left above the search controls and a menu and tool bar above the navigation tree. Open pages appear on the right. Currently the Welcome page is open.

Following topics provide more information:

• Welcome Page

• Function-Level Tabs and Controls

• Content Pages and Page Controls

Welcome Page

Initially, the Welcome page is open and active on the right side of the console. Sections on the Welcome page include a brief description of a specific function and one or more "shortcuts" (links that you can select) to initiate certain tasks immediately as explained in Table 2-4.

Table 2-4 Welcome Page Quick Pick Sections

Quick Pick Section	Description
Server Configuration	Click Add Server Configuration to launch a fresh Create: OAM Server page. See "About the System Configuration Tab" for more information.
Policies	Click Add Application Domain to launch a fresh Application Domains page. See "About the Policy Configuration Tab" for more information.
Agent Configuration	Click Add OAM 10g Agent to launch a fresh Create: OAM Agent page. Click Add OAM 11g Agent to launch a fresh Create: OAM Agent page. Click Add OSSO Agent to launch a fresh Create: OSSO Agent page.
Other	Click Add Identity Store to launch a fresh Create: User Identity Store page.

Function-Level Tabs and Controls

Table 2-5 introduces the function-level tabs in the OAM 11g Administration Console.

Table 2-5 Function Tabs and Descriptions

Function Tab Name	Description
Policy Configuration	Provides access to definitions for Shared Components and Application Domains. This tab is active and the related navigation tree is visible for browsing on the left side of the screen when you enter the console. See "About the Policy Configuration Tab" for more information.
System Configuration	Provides access to system-level definitions for Agents, Servers, and Data Sources. This is not the active tab when you enter the console, which is why it appears a different color. See "About the System Configuration Tab" for more information.
Browse	Provides the navigation tree from which you can access nodes and instances related to the active configuration tab (Policy or System). This tab is active when you enter the Administration Console.
Search Results	Provides access to the results of your latest search. Search controls appear above the Browse and Search Results tabs. For more information, see "Conducting Searches".

The following topics provide more information about specific controls:

• Browse Tab and Navigation Tree

• Menu and Tool Bar

• View Menu

• Actions Menu

See Also:

"Selecting Controls in the Administration Console"

Browse Tab and Navigation Tree

When the Browse tab is selected, the navigation tree for the active configuration tab (System Configuration or Policy Configuration tab) is visible. Named nodes identify groups under which you can choose individual instances on which to take action.

The nodes in the navigation tree for the Policy Configuration and System Configuration tabs are shown in Figure 2-7.

Figure 2-7 Policy Configuration and System Configuration Navigation Trees

For more information, see the following topics:

• "About the System Configuration Tab"

• "About the Policy Configuration Tab"

Menu and Tool Bar

A menu and tool bar appears above the navigation tree, as shown in Figure 2-8. Menus provide commands that you can use to take action on the selected item in the navigation tree. Many menu commands are also provided as command buttons in the tool bar for quick access.

Figure 2-8 Menu and Tool Bar Above the Navigation Tree

Description of "Figure 2-8 Menu and Tool Bar Above the Navigation Tree"

Table 2-6 provides a description of each command button in the tool bar. Buttons appear in color when they are available. When a command cannot be used, the command button (or menu item) appears in grey.

Table 2-6 Command Buttons in the Tool Bar

Button	Definition	Description
	Refresh	Revives the navigation tree, in the same way a Web browser refreshes a Web page.
	Create	Opens a fresh page under the selected node in the navigation tree, which you can fill in to add a new configuration of the selected type. The new page opens as the active page on the right side of the navigation tree. This is available when you can add a new configuration, for instance, under Server Instances, or a specific Agent type, or a user identity store, or a non-HTTP Resource Type or Host Identifier or Application Domain. Alternatively, use the Create command on the Actions menu as described in Table 2-8.
	Duplicate	Creates a copy of the selected configuration in the navigation tree, named "copy of original." The copy opens as the active page for immediate editing. Many fields are filled in. Exception: Fields that make up the unique identifier of the object (for example, Name of the policy or the URL pattern of a resource) are not automatically filled in. Note: You edit and save the duplicate as usual.
	Edit	Opens the instance you have selected in the navigation tree, to view or modify. The configuration page opens as the active page on the right side of the navigation tree. Alternatively, double click the instance name to display a page for editing.
	Delete	Removes the selected configuration. A deleted configuration is removed from the navigation tree and is no longer accessible to the system. For instance, if you delete an Agent configuration, the Agent is no longer registered and cannot be used. Alternatively, use the Delete command on the Actions menu as described in Table 2-8.
	Detach	Separates the selected item (a results table on a configuration page, for instance) and displays it alone as a full page. Note: If you are viewing a detached table, you can click this button to re-attach it to the corresponding page and restore the standard page view.

View Menu

Figure 2-9 illustrates the View menu, which is available for use with both the Policy Configuration tab and the System Configuration tab.

Figure 2-9 View Menu

Description of "Figure 2-9 View Menu"

Unavailable items (those that cannot be used on the selection in the navigation tree) appear in grey. View menu command descriptions are provided in Table 2-7.

Table 2-7 View Menu Command Descriptions

Command	Description
Expand	Immediately reveal items within the selected node in the navigation tree. This does not open or activate a configuration page. Alternatively, click the icon beside the node in the navigation tree.
Collapse	Immediately conceal everything within the selected node in the navigation tree. This does not close an open page. Alternatively, click the icon beside the node in the navigation tree.
Expand All Below	Immediately reveal everything within the selected node. For example, click Application Domains and then click Expand All Below to see all application domains.
Collapse All Below	Immediately close the selected node and conceal its content. This does not close an open page.
Expand All	Immediately reveal all nodes and instances in the navigation tree. This has no impact on open pages.
Collapse All	Immediately conceal all nodes and instances in the navigation tree. This has no impact on open pages.
Scroll to First Ctrl+Home	Locates and displays the first item in the navigation tree or results table.
Scroll to Last Ctrl+End	Locates and displays the last item in the navigation tree or results table.

Actions Menu

This menu is available only when the System Configuration tab is active. Figure 2-9 illustrates the Actions menu, which provides appropriate commands for the selection in the navigation tree. For instance, if you have Server Instances selected in the navigation tree one of the commands on the Actions menu enables you to open the Server Common Properties page for viewing or editing.

Figure 2-10 Actions Menu

Description of "Figure 2-10 Actions Menu"

Actions menu command descriptions are provided in Table 2-8. Certain commands on this menu mirror functions that are available by using command buttons in the tool bar. Unavailable items (those that cannot be used on the selection in the navigation tree) appear in grey.

Table 2-8 System Configuration, Action Menu, Command Descriptions

Command	Description
Open	Opens the configuration page for the selected instance in the navigation tree. This is not available when you have a node selected in the navigation tree. Alternatively, double-click the instance name in the navigation tree to open a page.
Create	Activates a fresh page that you can fill in to define a new configuration. Alternatively, click the Create button in the tool bar as described in Table 2-6.
Monitor	Displays the monitoring page for the Agent selected in the navigation tree. For more information, see Chapter 15.
Open common properties	Opens the OAM Server Common Properties page, which provides various functional configurations shared among all OAM servers. This is available only when the Server Instances node is selected in the navigation tree.
Delete	Removes the selected instance registration. The deleted registration is removed from the navigation tree and is no longer accessible to the system. For instance, if you delete an agent registration, the Agent is no longer registered and cannot be used. Alternatively, click the Delete button in the tool bar as described in Table 2-6.

Content Pages and Page Controls

Like the Welcome page, any open content pages appear on the right side of the console.

The active content page is visible and generally provides a work space where you can add, view, or modify related settings. A named tab identifies each open page, like the tabs on manila folders. The tab of the active page is white.

Up to ten pages can be open simultaneously per configuration tab: Policy Configuration tab or System Configuration tab. Only the named tabs of opened pages for the currently active configuration tab are shown.

Only the active page is visible, with as many named tabs of other open pages that can fit on one line. You can click a named tab to activate the corresponding page. When named tabs of open pages do not fit on one line, a pointer is provided that enables you to open and choose from a list of concealed pages. Figure 2-11 illustrates multiple pages open at the same time. You can see named tabs for each page and controls to access pages that are concealed (or to close the active page or close multiple pages).

Figure 2-11 Tabs of Open Pages, and Page Controls

Each page appears only once. No warning is issued if you attempt to open the same page multiple times. However, the page is only one time.

Note:

There is no warning if you open the page for the same item more than once.

The controls that you can use with open pages are described in Table 2-9.

See Also:

"Selecting Controls in the Administration Console"

Table 2-9 Controls for Open Pages

Page Control	Definition	Description
	View a list of concealed pages	Click the pointer to view the list of concealed pages when you cannot view all tabs simultaneously.
	Close Active Page	Click this button to close the active page. Note: Closing a page before clicking Apply discards any changes or additions without warning. The changes are lost. You can use this to cancel changes you do not want to retain.
	Close Multiple Pages	Click this button to initiate closing multiple open pages. In the dialog box that appears, click the box beside the name of each page you want to close. Click OK to complete the action. Note: Closing a page before clicking Apply discards any changes or additions without warning. The changes are lost. You can use this to cancel changes you do not want to retain.

Elements on a Page

Pages in the Administration Console contain one or more graphical user interface elements as described in Table 2-10. For an example of each element n the Administration Console, see Figure 2-13 or log into the console and have a look.

Table 2-10 Page Elements and Descriptions

Page Element	Description
Named tab	Identifies each open page on the right side of the console. Also, displays a page of related, lower-level settings. See Figure 2-14 for an example.
Page controls	Enables you to close one or more pages. See Table 2-9.
Apply button	Submits changes or additions made to the page.
Named text box	Enables you to enter relevant details in the named field using the keyboard.
Option button	Enables you to choose one of several options. For example, you can click an option button to define a state (Enabled vs. Disabled) or a security mode (Open vs. Simple vs. Cert).
Tables	Displays current specifications or space for new specifications. Tables have independent command buttons independent from page-level and option buttons.
Command buttons for tables	Enables you to: Add a fresh row. Remove the selected row.
Drop down lists	Provides a menu of choices on certain pages (and as part of the Search controls). You can choose one item from those listed.

Selecting Controls in the Administration Console

This section describes how to select the desired node or instance in the navigation tree, and selecting commands and page controls in the Administration Console. The usual selection guidelines apply.

Table 2-11 describes selections and controls.

Table 2-11 Selection Tasks and Controls

Task	Control	Description
Expand a node		Click the Expand button beside the desired node in the navigation tree to reveal nodes or instances within it.
Collapse a node		Click the Collapse button beside the desired node in the navigation tree to conceal nodes or instances beneath it.
Display View menu	Right-click mouse button	Right-click the desired node in the navigation tree to display a pop-up View menu.
Select	Click mouse button	Click the desired item on which to operate. For example, click the desired: Icon, node, or instance name in the navigation tree (Shared Components is one example) Search Button: Initiates a search based on specified criteria Menu name and command to take action on the selected item in the navigation tree Command button to take immediate action: Menu and tool bar buttons (Table 2-6) Close page buttons (Table 2-9) Command Button on a Page or Table: Apply: Submits additions and changes on the active page. Table or section buttons (Table 2-10) Add a new row. Remove the selected row. Links: Help, and Sign Out are examples
Activate	Click mouse button	Click to activate the desired: Function tab: System Configuration, Policy Configuration, Browse, Search Named tab on a page to reveal related lower-level settings to view or modify: for instance, SSO Engine, Session, and so on Named Page tab to reveal (activate) the page Text field to enter information on a page Page Control (close or close all as described in Table 2-9)
Open	Double click mouse button	Double-click an instance name to open the configuration page. For example, double-click a specific: Resource Type name Host Identifier definition name Authentication scheme name Resource name in an application domain Authentication policy name in an application domain Authorization policy name in an application domain Agent instance name Server instance name User identity store instance name Database instance name Authentication module name System utility name
Highlight	Drag cursor	Drag the cursor across text in a box to highlight its content.

About the System Configuration Tab

Figure 2-12 shows the console. The Policy Configuration and System Configuration tabs appear on the left. Search controls appear directly beneath the Policy Configuration and System Configuration tabs. The navigation tree for the active (White) tab is identified by a Browse tab, which appears directly beneath the Search controls.

A tool bar separates the Browse and Search Results tabs from the navigation tree. The Actions menu is available only with the System Configuration tab; the View menu is always available. The active page appears on the right. The Welcome page is currently the active and open.

Figure 2-12 System Configuration Tab and navigation tree

Description of "Figure 2-12 System Configuration Tab and navigation tree"

The System Configuration tab is currently active. It gives administrators access to Agent, Server, Data Source, and Authentication Module configuration details, and System Utilities. The navigation tree beneath the search controls and tool bar is related to the active tab.

See "Console Layout and Controls" for details on navigating and selecting command buttons, page controls, and menu items in the console.

You can also use commands on the View menu to expand the selected node in the navigation tree or to expand all nodes simultaneously. For instance, click Expand All from the View menu to see all nodes and related instances at one time.

Figure 2-13 provides an expanded view of nodes and instances on the System Configuration tab, navigation tree. A server instance is selected in the tree and the related configuration page appears on the right.

Figure 2-13 System Configuration: Expanded Tree (Left), Active Page (Right)

Description of "Figure 2-13 System Configuration: Expanded Tree (Left), Active Page (Right)"

Figure 2-14 shows the OAM Server Common Properties page, which provides tabs for Auditing, SSO Engine, Session, Coherence, OAM Proxy, and Policy configuration details. This group of definitions is common to all Oracle Access Manager Servers. The Auditing Configuration tab is active and the relevant page is open on the right.

Figure 2-14 OAM Server Common Properties

Description of "Figure 2-14 OAM Server Common Properties"

For more information about system configuration, see:

• Part II, "OAM 11g System Management"

• Part III, "Single Sign-on, Policies, and Testing"

About the Policy Configuration Tab

The Policy Configuration tab in the Oracle Access Manager Administration Console gives administrators access to application domain and shared component configurations. The view in Figure 2-15 lists first-level items beneath Shared Components and Authentication Schemes.

Figure 2-15 Policy Configuration Tab, Navigation Tree, and Active Page

Description of "Figure 2-15 Policy Configuration Tab, Navigation Tree, and Active Page"

See "Console Layout and Controls" for details on navigating and selecting command buttons, page controls, and menu items in the console.

You can also use commands on the View menu to expand the selected node in the navigation tree or to expand all nodes simultaneously. For instance, click Expand All from the View menu to see all nodes and related instances at one time.

About Search Controls

Search controls are shown and described in Table 2-12.

Table 2-12 Search Control Definitions

Search Control	Description
	From the Policy Configuration Search menu, choose an item to define your search.
	From the System Configuration Search menu, choose an item to define your search.
	In the text field, enter the exact name of the instance you want to find. Click the Search button to initiate the search. Note: The name you enter in the field must be an exact match, including capitalization. No wild cards are allowed.
	Click the Search Results tab to reveal the results of your search. Click a command button in the tool bar to remove the instance. The configuration page appears on the right side of the console. Click Detach in the tool bar to expand the table to a full page. Select a View menu item to alter the appearance of the results table.

Searching for an Instance

This topic describes how to perform a search using the capabilities in the Administration Console.

In the example in the following procedure, a search is conducted for an application domain. The procedure is generally the same, regardless of the type or instance you might choose.

To perform a search

1. Activate the Policy or System Configuration tab.

2. From the search type list, choose a type to define your search.

3. In the text field, enter the exact name of the instance you want to find. For example:

   my_host_identifier
   

4. Click the Search button to initiate the search.

5. Click the Search Results tab to display the results table, and then:

   • Edit: Click the Edit command button in the tool bar to display the configuration page.

   • Delete: Click the Delete button in the tool bar to remove the instance; confirm removal when the Confirmation window appears.

   • Detach: Click Detach in the tool bar to expand the table to a full page.

   • View: Select a View menu item to alter the appearance of the results table.

6. Click the Browse tab to return to the navigation tree when you finish with the Search results.