12 Handling Lifecycle Management Changes

12.1.3.1 Changing OimFrontEndURL in Oracle Identity Manager Configuration

The OimFrontEndURL is the URL used to access the Oracle Identity Manager UI. This can be a load balancer URL or Web server URL depending on the application server is fronted with loan balancer or Web server, or single application server URL. This is used by Oracle Identity Manager in the notification e-mails as well as the callback URL for SOA calls.

The change may be necessary because of change in Web server hostname or port for Oracle Identity Manager deployment in a clustered environment, or WebLogic managed server hostname or port changes for Oracle Identity Manager deployment in a nonclustered environment.

To change the OimFronEndURL in Oracle Identity Manager configuration:

1. Login to Enterprise Manager by using the following URL when the WebLogic Administrative Server and Oracle Identity Manager managed servers, at least one of the servers in case of a clustered deployment, are running:

   http://ADMIN_SERVER/em

2. Navigate to Identity and Access, oim.

3. Right-click oim, and navigate to System MBean Browser.

4. Under Application Defined MBeans, navigate to oracle.iam, Application:oim, XMLConfig, Config, XMLConfig.DiscoveryConfig, and then Discovery.

5. Enter new value for the OimFrontEndURL attribute, and click Apply to save the changes. Example values can be:

   http://myoim.oracle.com

   https://myoim.oracle.com

   http://myserver.oracle.com:7001

   Note:

   SPML clients store Oracle Identity Manager URL for invoking SPML and sending callback response. Therefore, changes are required corresponding to this. In addition, if Oracle Identity Manager is integrated with OAM, OAAM, or Oracle Identity Navigator (OIN), there may be corresponding changes necessary. For more information, refer to OAM, OAAM, and OIN documentation in the Oracle Technology Network (OTN) Web site.

12.1.3.2 Changing backOfficeURL in Oracle Identity Manager Configuration

Changing backOfficeURL is required only for Oracle Identity Manager deployed in front-office and back-office configuration. This change does not apply for simple clustered or nonclustered deployments. This URL is used internally by Oracle Identity Manager for accessing back-office components from the front-office components. You might change the value of this attribute during the implementation of back-office and front-office configuration, for adding additional servers to back office, and for removing servers from back-office.

To change the value of the backOfficeURL attribute:

1. Login to Enterprise Manager by using the following URL when the WebLogic Administrative Server and Oracle Identity Manager managed servers, at least one of the servers in case of a clustered deployment, are running:

   http://ADMIN_SERVER/em

2. Navigate to Identity and Access, and then oim.

3. Right-click oim, and navigate to System MBean Browser.

4. Under Application Defined MBeans, navigate to oracle.iam, Application:oim, XMLConfig, Config, XMLConfig.DiscoveryConfig, Discovery.

5. Enter a new value for the BackOfficeURL attribute, and click Apply to save the changes. Example values can be:

   t3://mywls1.oracle.com:8001

   t3://mywls1.oracle.com:8001,mywls2.oracle.com:9001

   Note:

   The value of the BackOfficeURL attribute must be empty for Oracle Identity Manager nonclustered and clustered deployments.

12.3.1.1 Enabling SSL for Oracle Identity Manager and SOA WebLogic Server

To enable SSL for Oracle Identity Manager and SOA servers:

1. Log in to WebLogic Server Administrative console and go to Servers, OIM_SERVER1, General. Under the general section, you can enable ssl port to any value and activate it.

2. The server will start listening and you can access the URL with HTTPS protocol.

3. Perform the same steps for Admin/SOA Servers as Oracle Identity Manager might need to interact with SSL-enabled SOA Server.

After enabling SSL on Oracle Identity Manager and SOA Servers, perform the following changes for establishing secured communication between them:

• Changing OimFrontEndURL to Use SSL Port

• Changing backOfficeURL to Use SSL Port

• Changing SOA Server URL to Use SSL Port

12.3.1.2 Changing OimFrontEndURL to Use SSL Port

OimFrontEndURL is used to access the oim application UI. This can be a load balancer URL or web server URL (in case application server is fronted with load balancer or web server) or single application server URL. This is generally used by Oracle Identity Manager in the notificaiton emails or to send a call back web service from SOA to Oracle Identity Manager.

To change the OimFrontEndURL to use SSL port:

1. When the WebLogic admin and Oracle Identity Manager managed servers (at least one of the servers in case of cluster) are running, log in to Enterprise Manager (EM).

   For example:

   http://<AdminServer>/em

2. Navigate to Identity and Access, Oracle Identity Manager.

3. Right click and select System MBean Browser.

4. Under Application Defined MBeans, navigate to oracle.iam, Application:oim, XMLConfig, Config, XMLConfig.DiscoveryConfig, Discovery.

5. Enter a new value for the "OimFrontEndURL" attribute and click Apply to save the changes.

   For example:

   http://myoim.oracle.com

   https://myoim.oracle.com

   http://myserver.oracle.com:7001

   Note:

   Fusion Apps or SPML clients store Oracle Identity Manager URL for invoking SPML and also send callback response. Therefore, there will be changes needed corresponding to this. Also, if Oracle Identity Manager is integrated with OAM/OAAM/OIN, there may be corresponding changes necessary. Refer to Chapter 11, "Integrating with Other Oracle Components" for detailed information about the integration with other components.

12.3.1.3 Changing backOfficeURL to Use SSL Port

backOfficeURL change is required only for Oracle Identity Manager deployed in front-office/back-office configuration. For simple cluster or non-cluster installations the following does not apply. This URL is used internally by Oracle Identity Manager for accessing back-office components from the front-office components. This value needs to be changed initially during the implementation of back-office/front-office configuration, for adding additional servers to back office, and for removing servers from back-office.

To change the backOfficeURL to use SSL port:

1. When the WebLogic admin and Oracle Identity Manager managed servers (at least one of the servers in case of cluster) are running, log in to Enterprise Manager (EM).

   For example:

   http://<AdminServer>/em

2. Navigate to Identity and Access, Oracle Identity Manager.

3. Right click and select System MBean Browser.

4. Under Application Defined MBeans, navigate to oracle.iam, Application:oim, XMLConfig, Config, XMLConfig.DiscoveryConfig, Discovery.

5. Enter a new value for the "backOfficeURL" attribute and click Apply to save the changes.

   For example:

   t3://mywls1.oracle.com:8001

   t3://mywls1.oracle.com:8001,mywls2.oracle.com:9001

   Note:

   For simple cluster and non-cluster installations the value must be empty.

12.3.1.4 Changing SOA Server URL to Use SSL Port

To change SOA server URL to use SSL port:

1. When the admin server and Oracle Identity Manager managed servers are running, log in to Enterprise Manager (EM).

   For example:

   http://<AdminServer>/em

2. Navigate to Identity and Access, Oracle Identity Manager.

3. Right click and select System MBean Browser.

4. Under Application Defined MBeans, navigate to oracle.iam, Application:oim, XMLConfig, Config, XMLConfig.SOAConfig, SOAConfig.

5. Change the values for attributes "Rmiurl", "Soapurl", and click Apply to save the changes.

   Note:

   Rmiurl is used for accessing SOA EJBs deployed on SOA managed servers.

   This is the application server URL. (For clustered installation, it is a comma separated list of all the SOA managed server URLs)

   For example:

   t3://mysoa1.oracle.com:8001

   t3s://mysoa1.oracle.com:8001,mysoa2.oracle.com:8002

   t3://mysoa1.oracle.com:8001,mysoa2.oracle.com:8002,mysoa3.com:8003

   Note:

   Soapurl is used to access SOA web services deployed on SOA managed servers. This is the web server/load balancer URL, in case of a SOA cluster front ended with web server/load balancer. In case of single SOA server, it can be application server URL.

   For example,

   http://myoimsoa.oracle.com

   https://mysoa.oracle.com: 8001

12.3.1.5 Configuring SSL for Design Console

To change the Design console to establish secure connection between Oracle Identity Manager and Design console:

1. Add WebLogic server jars required to support SSL.

2. Copy webserviceclient+ssl.jar from:

   $WL_HOME/server/lib

   to

   $OIM_HOME/designconsole/ext directory.

3. Use the Server trust store in the Design console. To access this:

   1. Go to WebLogic Server Administrative console, Environment, Servers.

   2. Click on <OIM_SERVER_NAME> to view details of the Oracle Identity Manger server.

   3. Click the KeyStores tab and note down the "Trust keystore" location in the "Trust" section.

If Design Console is Deployed on the Oracle Identity Manager Host

Set the TRUSTSTORE_LOCATION environment variable to the location of the "Trust keystore" location noted above.

For example:

setenv TRUSTSTORELOCATION/scratch/user1/dogwoodsh100520/beahome/wlserver_10.3/server/lib/DemoTrust.jks

If Design Console is Deployed on a Different Computer than Oracle Identity Manager

Copy the "Trust keystore" to the box in which Design console is present and set the TRUSTSTORE_LOCATION env variable to the location where "Trust keystore" is copied on the local box.

12.3.1.6 Configuring SSL for Oracle Identity Manager Utilities

Oracle Identity Manager client utilities include PurgeCache, GenerateSnapshot, UploadJars, and UploadResources.

Set the TRUSTSTORE_LOCATION environment variable to the location of the "Trust keystore" location.

For example:

setenv TRUSTSTORELOCATION/scratch/user1/dogwoodsh100520/beahome/wlserver_10.3/server/lib/DemoTrust.jks

12.3.1.7 Configuring SSL for MDS Utilities

All Oracle Identity Manager MDS Utilities which contains WLST scripts must be set to the following environment variable in the shell in which you are running the script:

WLST_PROPERTIES=-Dweblogic.security.SSL.ignoreHostnameVerification=true-Dweblogic.security.TrustKeyStore=DemoTrust

12.3.1.8 Configuring SSL for SPML/Callback Domain

To configure SSL for SPML/callback domain:

1. Ensure that Oracle Identity Manager port is SSL enabled with HostName verification is set to false.

2. Enable SSL on Fusion Applications including callback domain.

3. If you are using WebLogic default trust store, you must not change anything other than enabling the SSL mode.

4. If you have certificates other than default, then the trusted certificates should be exchanged between them to establish two-way trust.

5. If you are using a stand-alone client for sending SPML requests for testing purpose, then you must:

   1. Add the following system properties to SPML client command to send the request to SSL enabled OIM port.

      • Djavax.net.ssl.trustStore=D:\Oracle\Middleware1\wlserver_10.3\server\lib\DemoTrust.jks

      • -Djava.protocol.handler.pkgs=weblogic.net

      • -Dweblogic.security.TrustKeyStore=DemoTrust

   2. Add webserviceclient+ssl.jar to your client classpath.

12.3.2.1 Setting Up DB in Server-Authentication SSL Mode

To set up DB in Server-Authentication SSL mode:

1. Stop the DB server and the listener.

2. Configuring the listener.ora file as follows:

   1. Navigate to the path:

      $DB_ORACLE_HOME/network/admin directory

      For example:

      /scratch/user1/production-database/product/11.1.0/db_1/network/admin

   2. Edit the listener.ora file to include SSL listening port and Server Wallet Location.

      The following is the sample listener.ora file:

      # listener.ora Network Configuration File: /scratch/rbijja/production-database/product/11.1.0/db_1/network/admin/listener.ora
      # Generated by Oracle configuration tools.
       
      SSL_CLIENT_AUTHENTICATION = FALSE
       
      WALLET_LOCATION =
        (SOURCE =
          (METHOD = FILE)
          (METHOD_DATA =
            (DIRECTORY = /scratch/rbijja/production-database/product/11.1.0/db_1/bin/server_keystore_ssl.p12)
          )
        )
       
      LISTENER =
        (DESCRIPTION_LIST =
          (DESCRIPTION =
            (ADDRESS = (PROTOCOL = TCPS)(HOST = dadvmh0175.us.oracle.com)(PORT = 2484))
          )
          (DESCRIPTION =
            (ADDRESS = (PROTOCOL = TCP)(HOST = dadvmh0175.us.oracle.com)(PORT = 1521))
          )
        )
       
      TRACE_LEVEL_LISTENER = SUPPORT
      

3. Configure the sqlnet.ora file as follows:

   1. Navigate to the path:

      $DB_ORACLE_HOME/network/admin directory

      For example:

      /scratch/user1/production-database/product/11.1.0/db_1/network/admin

   2. Edit sqlnet.ora file to include:

      • TCPS Authentication Services

      • SSL_VERSION

      • Server Wallet Location

      • SSL_CLIENT_AUTHENTICATION type (either true or false)

      • SSL_CIPHER_SUITES that can be allowed in the communication (optional)

      The following is the sample sqlnet.ora file:

      # sqlnet.ora Network Configuration File: /scratch/rbijja/production-database/product/11.1.0/db_1/network/admin/sqlnet.ora
      # Generated by Oracle configuration tools.
       
      SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS)
       
      SSL_VERSION = 3.0
       
      SSL_CLIENT_AUTHENTICATION = FALSE
       
      WALLET_LOCATION =
        (SOURCE =
          (METHOD = FILE)
          (METHOD_DATA =
            (DIRECTORY = /scratch/rbijja/production-database/product/11.1.0/db_1/bin/server_keystore_ssl.p12)
          )
        )
      

4. Configure the tnsnames.ora file as follows:

   1. Navigate to the path:

      $DB_ORACLE_HOME/network/admin directory

      For example:

      /scratch/user1/production-database/product/11.1.0/db_1/network/admin

   2. Edit the tnsnames.ora file to include SSL listening port in the description list of the service.

      The following is the sample tnsnames.ora file:

      # tnsnames.ora Network Configuration File: /scratch/user1/production-database/product/11.1.0/db_1/network/admin/tnsnames.ora
      # Generated by Oracle configuration tools.
      
      PRODDB =
       (DESCRIPTION_LIST =
        (DESCRIPTION =
          (ADDRESS = (PROTOCOL = TCPS)(HOST = dadvmh0175.us.oracle.com)(PORT = 2484))
          (CONNECT_DATA =
            (SERVER = DEDICATED)
            (SERVICE_NAME = proddb)
          )
        )
        (DESCRIPTION =
          (ADDRESS = (PROTOCOL = TCP)(HOST = dadvmh0175.us.oracle.com)(PORT = 1521))
          (CONNECT_DATA =
            (SERVER = DEDICATED)
            (SERVICE_NAME = proddb)
          )
        )
       )
      

5. Start/Stop utilities for DB server.

6. Start the DB server.

12.3.2.2 Creating KeyStores and Certificates

You can create server side and client side KeyStores using the orapki utility. This utility will be shipped as a part of Oracle DB installation.

KeyStores could be of any format such as JKS and PKCS12. The format of keystore changes based on the provider implementation. For example, JKS is the implementation provided by Sun Oracle where as PKCS12 is implemented by OraclePKIProvider.

Only JKS client KeyStore is used in Oracle Identity Manager for DB server. This is because using non-JKS KeyStores format such as PKCS12 requires significant changes on the installer side at the critical release time. However, Oracle Identity Manager already has a KeyStore named default-KeyStore.jks, which is in JKS format.

The following are the KeyStores that you can create using orapki utility:

• Creating a Root CA Wallet

• Creating DB Server Side Wallet

• Creating Client Side Wallet

  Note:

  Wallets and KeyStores are interchangeably used and they both mean the same. These refer to a repository of public/private keys and self-signed/trusted certificates.

Creating a Root CA Wallet

To create a root certification authority (CA) wallet:

1. Navigate to the following path:

   $DB_ORACLE_HOME/bin directory

2. Create a wallet by using the command:

   ./orapki wallet create -wallet CA_keystore.p12 -pwd welcome1
   

3. Add a self signed certificate to the CA wallet by using the command:

   ./orapki wallet add -wallet CA_keystore.p12 -dn 'CN=root_test,C=US' -keysize 2048 -self_signed -validity 3650 -pwd welcome1
   

4. View the wallet using the command:

   ./orapki wallet display -wallet CA_keystore.p12 -pwd welcome1
   

5. Export the self signed certificate from the CA wallet using the command:

   ./orapki wallet export -wallet CA_keystore.p12 -dn 'CN=root_test,C=US' -cert self_signed_CA.cert -pwd welcome1
   

Creating DB Server Side Wallet

To create a DB server side wallet:

1. Create a server wallet using the command:

   ./orapki wallet create -wallet server_keystore_ssl.p12 -auto_login -pwd welcome1
   

2. Add a certificate request to the server wallet using the command:

   ./orapki wallet add -wallet server_keystore_ssl.p12/ -dn 'CN=Customer,OU=Customer,O=Customer,L=City,ST=NY,C=US' -keysize 2048 -pwd welcome1
   

3. Export the certificate request to a file, which will be used later for getting it signed using the root CA signature:

   ./orapki wallet export -wallet server_keystore_ssl.p12/ -dn 'CN=Customer,OU=Customer,O=Customer,L=City,ST=NY,C=US' -request server_creq.csr -pwd welcome1
   

4. Get the server wallet's certificate request signed using the CA signature:

   ./orapki cert create -wallet CA_keystore.p12 -request server_creq.csr -cert server_creq_signed.cert -validity 3650 -pwd welcome1
   

5. View the signed certificate using the command:

   /orapki cert display -cert server_creq_signed.cert -complete
   

6. Import the trusted certificate in to the server wallet using the command:

   ./orapki wallet add -wallet server_keystore_ssl.p12 -trusted_cert -cert self_signed_CA.cert -pwd welcome1
   

7. Import this newly created signed certificate (user certificate) to the server wallet using the command:

   ./orapki wallet add -wallet server_keystore_ssl.p12 -user_cert -cert server_creq_signed.cert -pwd welcome1
   

Creating Client Side Wallet

To create a client side (Oracle Identity Manager server) wallet:

1. Create a client keystore using default-keystore.jks keystore which is populated in the following path:

   DOMAIN_HOME/config/fmwconfig

   Note:

   You can also use Oracle PKCS12 wallet as the client keystore.

2. Import the self-signed CA trusted certificate that you have already exported using the server side commands, to the client keystore (default-keystore.jks) by using the command:

   keytool -import -trustcacerts -alias dbtrusted -noprompt -keystore default-keystore.jks -file self_signed_CA.cert -storepass xellerate
   

12.3.2.3 Updating Oracle Identity Manager

You need to perform the following steps in Oracle Identity Manager to enable Oracle Identity Manager and Oracle Identity Manager DB in SSL mode for a secure communication:

1. Import the trusted certificate into the default-keystore.jks keystore of Oracle Identity Manager.

2. Log in to Enterprise Manager.

3. Navigate to Identity and Access, OIM.

4. Right click and navigate to System MBean Browser.

5. Under Application Defined MBeans, navigate to oracle.iam, Application:oim, XMLConfig, Config, XMLConfig.DirectDBConfig, and DirectDB.

6. Change the values for attributes "Sslenabled", "Url" and click Apply. If SSL mode is enabled for DB, then "Url" should contain TCPS enables and SSL port in it.

   For example:

   url="jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCPS)(HOST=my.domain.com)(PORT=2484))(CONNECT_DATA=(SERVICE_NAME=proddb)))"

7. Restart the Oracle Identity Manager server.

12.3.2.4 Updating WebLogic Server

After enabling SSL for Oracle Identity Manager DB, you need to change the following Oracle Identity Manager datasources and authenticators to use DB SSL port:

• Configuring Datasource

• Updating Datasource oimJMSStoreDS Configuration

• Updating Datasource oimOperationsDB Configuration

• Updating Datasource Related to Oracle Identity Manager MDS Configuration

• Updating Oracle Identity Manager Authenticators

Configuring Datasource

To configure the datasource:

1. Log in to Enterprise Manager.

2. Perform the host/port changes.

   Note:

   Before performing changes to database host/port, you must shutdown the managed servers hosting Oracle Identity Manager application. However, you can keep the WebLogic Admin Server up and running.

Updating Datasource oimJMSStoreDS Configuration

To update the datasource oimJMSStoreDS configuration:

1. Log in to WebLogic Server.

2. Navigate to Services, JDBC, Data Sources, oimJMSStoreDS.

3. Click the Connection Pool tab and change the value of the URL and Properties to reflect the changes to DB host/port.

Updating Datasource oimOperationsDB Configuration

To update the Change Datasource oimOperationsDB Configuration:

1. Log in to Enterprise Manager.

2. Navigate to Services, JDBC, Data Sources, oimJMSStoreDS.

3. Click the Connection Pool tab and change the value of the URL and Properties to reflect the changes to DB host/port.

Updating Datasource Related to Oracle Identity Manager MDS Configuration

To update datasource related to Oracle Identity Manager MDS configuration:

1. Log in to Enterprise Manager.

2. Navigate to Services, JDBC, Data Sources, mds-oim.

3. Click the Connection Pool tab and change the value of the URL and Properties to reflect the changes to DB host/port.

   Note:

   You might have to perform similar updates for SOA/OWSM related datasources if required.

Updating Oracle Identity Manager Authenticators

The existing Oracle Identity Manager authenticators in the WebLogic server are configured against Non-SSL DB details and they do not use datasources for communicating with Oracle Identity Manager DB. In order to use SSL DB details in the authenticators, you must perform the following:

1. Ensure that Datasources are configured to SSL.

2. In WebLogic Administrative console, navigate to Security Realms, myrealm, Providers.

3. Remove OIMAuthenticationProvider.

4. Create an authentication provider of type "OIMAuthenticator" and mark the control flag as SUFFICIENT.

5. Create an authentication provider of type "OIMSignatureAuthenticator" and mark the control flag as SUFFICIENT.

6. Reorder the authenticators as:

   1. DefaultAuthenticator

   2. OIMAuthenticator

   3. OIMSignatureAuthenticator

   4. Other providers if any

7. Restart all servers.

12.3.3.1 Enabling OVD-OID with SSL

To enable OVD-OID with SSL:

1. Log in to the OVD EM console.

2. Expand Identity and Access and navigate to ovd1, Administration, Listeners.

3. Click Create and enter all the required fields.

   Note:

   You must select the Listener Type as LDAP.

4. Click OK.

5. Select the newly created LDAP listener and click Edit.

6. In the Edit Listener - OIM SSL ENDPOINT page, edit the newly created LDAP listener.

7. Click OK. The SSL Configuration page opens.

8. Select the Enable SSL checkbox.

9. In the Advanced SSL Settings section, for SSL Authentication, select No Authentication.

10. Click OK.

11. Stop and start the OVD server for the changes to take effect.

    Note:

    You must not use the restart option.

12.3.3.2 Updating Oracle Identity Manager for OVD Host/Port

When LDAPSync is enabled on Oracle Identity Manager, Oracle Identity Manager connects with directory servers through OVD. It connects using ldap/ldaps protocol.

To change OVD host/port:

1. Log in to Oracle Identity Manager Administrative and User console.

2. Navigate to Advanced and click Manage IT Resource.

3. Select IT Resource Type as Directory Server and click Search.

4. In the IT Resource Directory Server, edit "server URL" to include SSL protocol and SSL port details.

5. Ensure that Use SSL is set to true and click Update.