Oracle® Fusion Middleware Installation Guide for Oracle Identity Management 11g Release 1 (11.1.1) Part Number E12002-05 |
|
|
View PDF |
This section discusses how to configure Oracle Identity Navigator (OIN), Oracle Authorization Policy Manager (OAPM), Oracle Access Manager (OAM), and Oracle Identity Manager (OIM).
It includes the following sections:
In this section, you perform the following tasks:
Install and configure Oracle Internet Directory and Oracle Virtual Directory
Install and configure Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Authorization Policy Manager, and Oracle Identity Navigator
Configure Oracle Access Manager to use Oracle Internet Directory as the LDAP provider
Set up LDAP sync for Oracle Identity Manager
Configure Oracle Identity Manager Server, Design Console (Windows only), and Remote Manager
The following lists the prerequisites for installing and configuring Oracle Identity Manager with LDAP Synchronization, and Oracle Access Manager:
Install a supported version of Oracle Database, as described in Installing Oracle Database.
Create and load database schemas, as described in Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).
Install Oracle WebLogic Server 10.3.3 and creating a Middleware Home, as described in Installing Oracle WebLogic Server 10.3.3 and Creating the Oracle Middleware Home
Ensure that the Oracle Identity Management 11g Release 1 (11.1.1) suite containing Oracle Internet Directory (OID) and Oracle Virtual Directory (OVD) are installed, as described in Installing OID, OVD, ODSM, ODIP, and OIF (11.1.1.4.0).
An IDM_Home directory, such as Oracle_IDM1, is created. This directory is the Oracle Home for Oracle Internet Directory (OID), Oracle Virtual Directory (OVD), and Oracle Directory Services Manager (ODSM).
Configure Oracle Internet Directory (OID) and Oracle Virtual Directory (OVD) in a WebLogic administration domain, as described in OID and OVD with ODSM in a New WebLogic Domain.
Install Oracle Identity Management 11g Release 1 (11.1.1) suite containing Oracle Identity Manager (OIM), Oracle Access Manager (OAM) Oracle Adaptive Access Manager, Oracle Authorization Policy Manager (OAPM), and Oracle Identity Navigator (OIN), as described in Installing OIM, OAM, OAAM, OAPM, and OIN (11.1.1.3.0).
An IDM_Home directory, such as Oracle_IDM2, is created. This directory is the Oracle Home for Oracle Identity Manager (OIM) and Oracle Access Manager (OAM).
Note:
It is assumed that you are installing and configuring Oracle Internet Directory (OID), Oracle Virtual Directory (OVD), Oracle Identity Manager (OIM), and Oracle Access Manager (OAM) on the same machine. Therefore, two distinct IDM_Home directories are mentioned in this chapter.Install the latest version of Oracle SOA Suite under the same Middleware Home, and patch the Oracle SOA Suite to the latest version, as described in Installing the Latest Version of Oracle SOA Suite (Oracle Identity Manager Users Only)
This section discusses the following topics:
Perform the configuration in this topic if you want to configure Oracle Identity Manager (OIM), Oracle Access Manager (OAM), Oracle Adaptive Access Manager (OAAM), Oracle Authorization Policy Manager (OAPM), and Oracle Identity Navigator (OIN) simultaneously in a new WebLogic administration domain. Then you can configure Oracle Access Manager to use Oracle Internet Directory (OID) as its LDAP Provider. You can also set up LDAP Sync for Oracle Identity Manager.
Performing the configuration in this section deploys the following:
WebLogic Administration Server
A Managed Server each for Oracle Identity Manager, Oracle Access Manager, and Oracle Adaptive Access Manager
Oracle Identity Administration Console, Oracle Identity Manager Self Service Console, and Oracle Identity Manager Advanced Administration Console on the Oracle Identity Manager Managed Server
Oracle Identity Navigator and Oracle Authorization Policy Manager applications on the Administration Server
Administration Consoles for the Oracle Access Manager and Oracle Adaptive Access Manager on the Administration Server
The installation and configuration in this section depends on the following:
Oracle WebLogic Server
Installation of Oracle Identity Management Suite, as described in Installing OIM, OAM, OAAM, OAPM, and OIN (11.1.1.3.0)
Oracle Database
Oracle SOA 11g Suite
JDK (either Oracle WebLogic JRockit JDK or Sun JDK 1.6.0)
Database schemas for Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Authorization Policy Manager. For more information about schemas specific to each product, see Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).
To configure Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Identity Navigator, and Oracle Authorization Policy Manager in a new WebLogic domain, complete the following steps:
Ensure that all the prerequisites, listed in Prerequisites, are satisfied. In addition, see Important Notes Before You Begin.
Run the <Oracle_IDM2>/common/bin/config.sh
script (On UNIX). (<Oracle_IDM2>\common\bin\config.cmd
on Windows). The Oracle Fusion Middleware Configuration Wizard appears.
On the Welcome screen, select Create a new WebLogic domain, and click Next. The Select Domain Source screen appears.
On the Select Domain Source screen, ensure that the Generate a domain configured automatically to support the following products: option is selected.
Create a WebLogic administration domain, which supports the following products:
Oracle Identity Manager - 11.1.1.3.0 [Oracle_IDM2]
Oracle Access Manager with Database Policy Store - 11.1.1.3.0 [Oracle_IDM2]
Oracle Adaptive Access Manager Admin Server - 11.1.1.3.0 [Oracle_IDM2]
Oracle Identity Navigator - 11.1.1.3.0 [Oracle_IDM2]
Optional: Oracle Adaptive Access Manager Server - 11.1.1.3.0 [Oracle_IDM2]
Oracle Authorization Policy Manager - 11.1.1.3.0 [Oracle_IDM2]
Note:
When you select any the Oracle Identity Management products, the Oracle JRF 11.1.1.0 [oracle_common] option is also selected automatically.When you select the Oracle Identity Manager - 11.1.1.3.0 [Oracle_IDM2] option, the Oracle SOA Suite - 11.1.1.0 [Oracle_SOA1] option, the Oracle WSM Policy Manager - 11.1.1.0 [oracle_common] option, and the Oracle Enterprise Manager - 11.1.1.0 [oracle_common] option are also selected.
Click Next. The Specify Domain Name and Location screen appears
Enter a name and a location for the domain to be created, and click Next. The Configure Administrator User Name and Password screen appears.
Configure a user name and a password for the administrator. The default user name is weblogic. Click Next.
Choose JRockit SDK 160_17_R28.0.0-679
and Production Mode in the Configure Server Start Mode and JDK screen of the Oracle Fusion Middleware Configuration Wizard. Click Next.
The Configure JDBC Component Schema screen displays a list of the following component schemas:
SOA Infrastructure
User Messaging Service
OAAM Server Schema
OIM MDS Schema
OWSM MDS Schema
OAAM Admin Server
OAAM Admin MDS Schema
APM MDS Schema
APM Schema
OIM Schema
SOA MDS Schema
OAM Infrastructure
On the Configure JDBC Component Schema screen, select a component schema that you want to modify. You can set values for Schema Owner, Schema Password, Database and Service, Host Name, and Port. Click Next. The Test JDBC Component Schema screen appears. After the test succeeds, the Select Optional Configuration screen appears.
On the Select Optional Configuration screen, you can configure Administration Server, Managed Servers, Clusters, and Machines, Deployments and Services, JMS File Store, and RDBMS Security Store. Select the relevant check boxes and click Next.
Optional: Configure Administration Server, as required.
Optional: Configure Managed Servers, as required.
Optional: Configure Clusters, as required.
For more information about configuring clusters for Oracle Identity Management products, see the "Configuring High Availability for Identity Management Components" topic in the guide Oracle Fusion Middleware High Availability Guide.
Optional: Assign Managed Servers to Clusters, as required.
Optional: Configure Machines, as needed. This step is useful when you want to run the Administration Server on one machine and Managed Servers on another physical machine.
Tip:
Before configuring a machine, use theping
command to verify whether the machine or host name is accessible.Optional: Assign the Administration Server to a machine.
Optional: Select Deployments, such as applications and libraries, and Services to target them to a particular cluster or server.
Optional: Configure JMS File Store, as required.
Optional: Configure RDBMS Security Store, as required.
On the Configuration Summary screen, you can view the summary of your configuration for deployments, application, and service. Review the domain configuration, and click Create to start creating the domain.
A WebLogic domain to support Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Authorization Policy Manager, and Oracle Identity Navigator is created in the <MW_HOME>\user_projects\domains
directory (on Windows). On UNIX, the domain is created in the <MW_HOME>/user_projects/domains
directory.
Start the WebLogic Administration Server and Managed Servers (Oracle Identity Manager and Oracle Access Manager), as described in Starting the Stack.
Configure Oracle Access Manager (OAM) to use Oracle Internet Directory (OID) as an LDAP provider by running the createUserIdentityStore
WLST command:
On the command line, use the cd command to move from your present working directory to the Oracle_IDM2/common/bin
directory. Oracle_IDM2 is the IDM_Home for Oracle Identity Manager and Oracle Access Manager.
Launch the WebLogic Scripting Tool (WLST) interface as follows:
On UNIX: Run ./wlst.sh
on the command line.
On Windows: Run wlst.cmd
.
At the WLST command prompt (wls:/offline>
), type the following:
connect()
You are prompted to enter the WebLogic Administration Server user name, password, and URL. For more information about using the WLST interface, see the topic "Using the WebLogic Scripting Tool" in the guide Oracle Fusion Middleware Oracle WebLogic Scripting Tool.
Run the createUserIdentityStore
WLST command, as in the following example:
createUserIdentityStore(name="OAMOIDIdStoreForOIM",principal="cn=orcladmin", credential="welcome1", type="LDAP", userAttr="uid", ldapProvider="OID", roleSecAdmin="OAMAdministrators", userSearchBase="cn=Users,dc=us,dc=acme,dc=com" ,ldapUrl="ldap://<oid host>:<oid port>" ,isPrimary="true" ,userIDProvider="OracleUserRoleAPI" , groupSearchBase="cn=Groups,dc=us,dc=oracle,dc=com")
Note:
Users that are members of the group specified in theroleSecAdmin
attribute are allowed access to the Oracle Access Manager Administration Console. This group must exist under the Directory Information Tree (DIT) specified in the groupSearchBase
attribute. If the group is not available, you can specify the user name, such as orcladmin
, who will have access to the Oracle Access Manager Administration Console. Note that only the user specified in this attribute will have access to the Oracle Access Manager Administration Console.Alternatively, you can use the Oracle Access Manager Administration Console, deployed on the Administration Server, to configure Oracle Internet Directory as an LDAP provider for Oracle Access Manager. For more information, see the "Managing User-Identity Store and OAM Administrator Registrations" topic in the guide Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager.
Set up LDAP Synchronization for Oracle Identity Manager, as described in Setting Up LDAP Synchronization.
Verify LDAP Synchronization, as described in Verifying the LDAP Synchronization.
Start the Oracle Identity Manager Configuration Wizard, as described in Starting the Oracle Identity Manager 11g Configuration Wizard.
Configure Oracle Identity Manager Server, as described in Configuring OIM Server. When configuring Oracle Identity Manager Server, ensure that you select the Enable LDAP Sync option on the LDAP Sync and OAM Screen in the Oracle Identity Manager Configuration Wizard.
Follow the wizard and the steps described in Configuring OIM Server to complete the Oracle Identity Manager Server configuration. Similarly, follow the wizard to configure Oracle Identity Manager Design Console (Windows only) and to configure Oracle Identity Manager Remote Server, as described in Configuring OIM Design Console, and Configuring OIM Remote Manager.
This section discusses the following topics:
The configuration described in this topic is appropriate for environments that have the following conditions:
You want to add Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Authorization Policy Manager, and Oracle Identity Navigator to an existing Oracle Identity Management domain that contains Oracle Internet Directory and Oracle Virtual Directory.
You want to configure all Oracle Identity Management products, including 11.1.1.3.0, in the same WebLogic administration domain.
You want a single WebLogic Administration Server to manage all of the Oracle Identity Management 11g products.
Performing the configuration in this section deploys the following components:
A Managed Server each for Oracle Identity Manager, Oracle Access Manager, and Oracle Adaptive Access Manager
Oracle Identity Manager, Oracle Access Manager, and Oracle Adaptive Access Manager applications on Managed Servers
Administration Consoles for Oracle Access Manager and Oracle Adaptive Access Manager on the existing Administration Server
Oracle Identity Navigator application and Oracle Authorization Policy Manager on the existing Administration Server
Oracle Identity Administration Console, Oracle Identity Manager Self Service Console, and Oracle Identity Manager Advanced Administration Console on the Oracle Identity Manager Managed Server
The configuration in this section depends on the following:
Oracle WebLogic Server
Installation of Oracle Identity Management Suite, as described in Installing OIM, OAM, OAAM, OAPM, and OIN (11.1.1.3.0)
Oracle Database
Oracle SOA 11g Suite
JDK (either Oracle WebLogic JRockit JDK or Sun JDK 1.6.0)
Database schemas for Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Authorization Policy Manager. For more information about schemas specific to each product, see Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).
To extend an existing Oracle Identity Management 11.1.1.3.0 domain (the domain with Oracle Internet Directory and Oracle Virtual Directory) to support Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Authorization Policy Manager, and Oracle Identity Navigator, complete the following steps:
Ensure that all the prerequisites, listed in Prerequisites, are satisfied. In addition, see Important Notes Before You Begin.
Run the <Oracle_IDM1>/bin/config.sh
on UNIX operating systems to start the Oracle Identity Management Configuration Wizard. On Windows, run the <Oracle_IDM1>\bin\config.bat
to start the wizard.
On the Select Domain screen, select the Create New Domain option. Set the Administrator user name and password, as required.
Ensure that you select Oracle Internet Directory and Oracle Virtual Directory on the Configure Components screen.
Follow the wizard, provide the necessary input, and configure the domain.
A new WebLogic domain to support Oracle Internet Directory and Oracle Virtual Directory is created in the <MW_HOME>\user_projects\domains
directory (on Windows). On UNIX, the domain is created in the <MW_HOME>/user_projects/domains
directory.
Ensure that your Oracle database version is supported and you have installed the necessary patches. For more information, see Installing Oracle Database.
Ensure that any appropriate schemas required by Oracle Identity Manager, Oracle SOA Suite, and Oracle Access Manager are created and loaded, as described in Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).
Ensure that the Oracle Identity Management 11g software is installed. Refer to Installing OIM, OAM, OAAM, OAPM, and OIN (11.1.1.3.0) for more information. A new Oracle Home for Oracle Identity Management, such as Oracle_IDM2
, is created under the Middleware Home directory.
Ensure that the latest version of Oracle SOA Suite is installed under the same Middleware Home. Refer to Installing the Latest Version of Oracle SOA Suite (Oracle Identity Manager Users Only) for more information.
Run the <Oracle_IDM2>/common/bin/config.sh
script (on UNIX). (<Oracle_IDM2>\common\bin\config.cmd
on Windows). The Oracle Fusion Middleware Configuration Wizard appears.
On the Welcome screen, select the Extend an existing WebLogic domain option. Click Next. The Select a WebLogic Domain Directory screen is displayed.
On the Select a WebLogic Domain Directory screen, select the directory that contains the domain in which you configured Oracle Internet Directory and Oracle Virtual Directory. Click Next.
On the Select Domain Source screen, ensure that the Extend my domain to automatically to support the following added products: is selected.
Select the following options:
Oracle Identity Manager - 11.1.1.3.0 [Oracle_IDM2]
Oracle Access Manager with Database Policy Store - 11.1.1.3.0 [Oracle_IDM2]
Oracle Adaptive Access Manager Admin Server - 11.1.1.3.0 [Oracle_IDM2]
Oracle Authorization Policy Manager - 11.1.1.3.0 [Oracle_IDM2]
Oracle Identity Navigator - 11.1.1.3.0 [Oracle_IDM2]
Note:
When you select the Oracle Identity Manager - 11.1.1.3.0 [Oracle_IDM2] option, the Oracle SOA Suite - 11.1.1.0 [Oracle_SOA1] option, and the Oracle WSM Policy Manager - 11.1.1.0 [oracle_common] option are also selected.Click Next. The Configure JDBC Component Schema appears.
The screen displays a list of the following component schemas:
SOA Infrastructure
User Messaging Service
OAAM Admin Schema
OAAM Admin MDS Schema
APM Schema
APM MDS Schema
OIM MDS Schema
OWSM MDS Schema
SOA MDS Schema
OAM Infrastructure
OIM Schema
On the Configure JDBC Component Schema screen, select a component schema that you want to modify. You can set values for Schema Owner, Schema Password, Database and Service, Host Name, and Port. Click Next. The Test JDBC Component Schema screen appears. After the test succeeds, the Select Optional Configuration screen appears.
On the Select Optional Configuration screen, you can configure Managed Servers, Clusters, and Machines, Deployments and Services, and JMS File Store. Select the relevant check boxes and click Next.
Optional: Configure Managed Servers, as required.
Optional: Configure Clusters, as required.
For more information about configuring clusters for Oracle Identity Management products, see the "Configuring High Availability for Identity Management Components" topic in the guide Oracle Fusion Middleware High Availability Guide.
Optional: Assign Managed Servers to Clusters, as required.
Optional: Configure Machines, as needed. This step is useful when you want to run the Administration Server on one machine and Managed Servers on another physical machine.
Tip:
Before configuring a machine, use theping
command to verify whether the machine or host name is accessible.Optional: Assign the Administration Server to a machine.
Optional: Select Deployments, such as applications and libraries, and Services to target them to a particular cluster or server.
Optional: Configure JMS File Store, as required.
On the Configuration Summary screen, review the domain configuration, and click Extend to start extending the domain.
Your existing Oracle Identity Management domain with Oracle Internet Directory and Oracle Virtual Directory is configured to support Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Authorization Policy Manager, and Oracle Identity Navigator.
Start the WebLogic Administration Server and Managed Servers (Oracle Identity Manager and Oracle Access Manager), as described in Starting the Stack.
Configure Oracle Access Manager (OAM) to use Oracle Internet Directory (OID) as an LDAP provider by running the createUserIdentityStore
WLST command:
On the command line, use the cd command to move from your present working directory to the Oracle_IDM2/common/bin
directory. Oracle_IDM2 is the IDM_Home for Oracle Identity Manager and Oracle Access Manager.
Launch the WebLogic Scripting Tool (WLST) interface as follows:
On UNIX: Run ./wlst.sh
on the command line.
On Windows: Run wlst.cmd
.
At the WLST command prompt (wls:/offline>
), type the following:
connect()
You are prompted to enter the WebLogic Administration Server user name, password, and URL. For more information about using the WLST interface, see the topic "Using the WebLogic Scripting Tool" in the guide Oracle Fusion Middleware Oracle WebLogic Scripting Tool.
Run the createUserIdentityStore
WLST command, as in the following example:
createUserIdentityStore(name="OAMOIDIdStoreForOIM",principal="cn=orcladmin", credential="welcome1", type="LDAP", userAttr="uid", ldapProvider="OID", roleSecAdmin="OAMAdministrators", userSearchBase="cn=Users,dc=us,dc=acme,dc=com" ,ldapUrl="ldap://<oid host>:<oid port>" ,isPrimary="true" ,userIDProvider="OracleUserRoleAPI" , groupSearchBase="cn=Groups,dc=us,dc=acme,dc=com")
Note:
Users that are members of the group specified in theroleSecAdmin
attribute are allowed access to the Oracle Access Manager Administration Console. This group must exist under the Directory Information Tree (DIT) specified in the groupSearchBase
attribute. If the group is not available, you can specify the user name, such as orcladmin
, who will have access to the Oracle Access Manager Administration Console. Note that only the user specified in this attribute will have access to the Oracle Access Manager Administration Console.Alternatively, you can use the Oracle Access Manager Administration Console, deployed on the Administration Server, to configure Oracle Internet Directory as an LDAP provider for Oracle Access Manager. For more information, see the "Managing User-Identity Store and OAM Administrator Registrations" topic in the guide Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager.
Set up LDAP Synchronization for Oracle Identity Manager, as described in Setting Up LDAP Synchronization.
Verify LDAP Synchronization, as described in Verifying the LDAP Synchronization.
Restart the Administration Server, as described in Restarting Servers.
Start the Oracle Identity Manager Configuration Wizard, as described in Starting the Oracle Identity Manager 11g Configuration Wizard.
Configure Oracle Identity Manager Server, as described in Configuring OIM Server. When configuring Oracle Identity Manager Server, ensure that you select the Enable LDAP Sync option on the LDAP Sync and OAM Screen in the Oracle Identity Manager Configuration Wizard.
Follow the wizard and the steps described in Configuring OIM Server to complete the Oracle Identity Manager Server configuration. Similarly, follow the wizard to configure Oracle Identity Manager Design Console (Windows only) and to configure Oracle Identity Manager Remote Server, as described in Configuring OIM Design Console, and Configuring OIM Remote Manager.