Oracle® Fusion Middleware Installation Guide for Oracle Identity Management 11g Release 1 (11.1.1) Part Number E12002-06 |
|
|
View PDF |
This chapter explains how to configure Oracle Authorization Policy Manager (OAPM) in a new or existing WebLogic administration domain.
It discusses the following topics:
The following are the prerequisites for installing and configuring Oracle Identity Management 11g Release 1 (11.1.1) products:
Installing Oracle Database, as described in Installing Oracle Database.
Installing Oracle WebLogic Server 10.3.3 and creating a Middleware Home, as described in Installing Oracle WebLogic Server 10.3.3 and Creating the Oracle Middleware Home.
Creating and loading schemas using Oracle Fusion Middleware Repository Creation Utility (RCU), as described in Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).
Installing the Oracle Identity Management 11g Release 1 (11.1.1.3.0) suite, as described in Installing OIM, OAM, OAAM, OAPM, and OIN (11.1.1.3.0). The Oracle Identity Management suite contains Oracle Identity Manager (OIM), Oracle Access Manager (OAM), Oracle Adaptive Access Manager (OAAM), Oracle Authorization Policy Manager (OAPM), and Oracle Identity Navigator (OIN).
Before you start installing and configuring Oracle Identity Management products in any of the scenarios discussed in this chapter, keep the following points in mind:
It is assumed that you are installing Oracle Internet Directory, Oracle Virtual Directory, Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Navigator on the same machine.
Note:
In this chapter, two IDM_Home directories are mentioned in descriptions and procedures. For example, the first one, Oracle_IDM1 can be the IDM_Home directory for Oracle Internet Directory, Oracle Virtual Directory, Oracle Directory Services Manager, Oracle Directory Integration Platform, and Oracle Identity Federation. The second one, Oracle_IDM2 can be the IDM_Home directory for Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Authorization Policy Manager, and Oracle Identity Navigator.However, note that Oracle_IDM1 and Oracle_IDM2 are used as examples in this document. You can specify any name for either of your IDM_Home directories. In addition, you can install the two Oracle Identity Management suites (one containing Oracle Internet Directory, Oracle Virtual Directory, Oracle Directory Services Manager, Oracle Directory Integration Platform, and Oracle Identity Federation; another containing Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Authorization Policy Manager, and Oracle Identity Navigator) in any order on your machine.
If you choose to use the default names, the first installation creates an Oracle_IDM1 directory, and the second installation creates an Oracle_IDM2 directory.
If you have not installed Oracle Internet Directory, Oracle Virtual Directory, Oracle Directory Services Manager, Oracle Directory Integration Platform, or Oracle Identity Federation on the same machine where you are installing Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Authorization Policy Manager, and Oracle Identity Navigator, then you will see a single IDM_Home directory, such as Oracle_IDM1, under your MW_HOME directory.
For more information, see Overview and Structure of Oracle Identity Management 11g Installation.
You must run the Oracle Identity Management 11g Installer to install Oracle Authorization Policy Manager (OAPM). For more information, see Preparing to Install Oracle Identity Management and Installing OIM, OAM, OAAM, OAPM, and OIN (11.1.1.3.0).
This topic describes how to configure Oracle Authorization Policy Manager (OAPM) in a new WebLogic domain. It includes the following sections:
Perform the configuration in this topic if you want to install Oracle Authorization Policy Manager in an environment where you may install Oracle Identity Manager, Oracle Access Manager, Oracle Identity Navigator, or Oracle Adaptive Access Manager at a later stage in the same domain.
Performing the configuration in this section deploys the following:
WebLogic Administration Server
Oracle Authorization Policy Manager application on the Administration Server
The configuration in this section depends on the following:
Oracle WebLogic Server.
Installation of the Oracle Identity Management 11g software.
Database schema for Oracle Authorization Policy Manager and Metadata Services (MDS). For more information about schemas specific to Oracle Authorization Policy Manager, see Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).
Perform the following steps to configure Oracle Authorization Policy Manager in a new WebLogic domain:
Ensure that all the prerequisites, listed in Prerequisites, are satisfied. In addition, see Important Notes Before You Begin.
Run the <Oracle_IDM2>/common/bin/config.sh
script (on UNIX). (<Oracle_IDM2>\common\bin\config.cmd
on Windows). The Oracle Fusion Middleware Configuration Wizard appears.
On the Welcome screen, select the Create a new WebLogic domain option. Click Next. The Select Domain Source screen appears.
On the Select Domain Source screen, ensure that the Generate a domain configured automatically to support the following products: option is selected.
Select the Oracle Application Authorization Policy Manager - 11.1.1.3.0 [Oracle_IDM2] option. When you select this option, the Oracle JRF 11.1.1.0 [oracle_common] option is also selected, by default. For association with Oracle Enterprise Manager Fusion Middleware Control at a later stage, select the Oracle Enterprise Manager - 11.1.1.3.0 [oracle_common] template. Click Next. The Select Domain Name and Location screen appears.
Enter a name and a location for the domain to be created, and click Next. The Configure Administrator User Name and Password screen appears.
Configure a user name and a password for the administrator. The default user name is weblogic
. Click Next.
Choose JRockit SDK 160_17_R28.0.0-679
and Production Mode in the Configure Server Start Mode and JDK screen of the Oracle Fusion Middleware Configuration Wizard. Click Next. The Configure JDBC Component Schema screen is displayed.
On the Configure JDBC Component Schema screen, select a component schema, such as the APM MDS Schema or the APM Schema that you want to modify. You can set values for Schema Owner, Schema Password, Database and Service, Host Name, and Port. Click Next. The Test JDBC Component Schema screen appears. After the test succeeds, the Select Optional Configuration screen appears.
On the Select Optional Configuration screen, you can configure the Administration Server, Managed Servers, Clusters, Machines, Deployments and Services, and RDBMS Security Store. Select the relevant check boxes and click Next.
Optional: Configure the following Administration Server parameters:
Name
Listen Address
Listen Port
SSL Listen Port
SSL Enabled
Optional: Add and configure Managed Servers, as required. Note that Oracle Authorization Policy Manager does not require a Managed Server because the application is deployed on the WebLogic Administration Server.
Optional: Configure Clusters, as required.
For more information about configuring clusters for Oracle Identity Management products, see the "Configuring High Availability for Identity Management Components" topic in the guide Oracle Fusion Middleware High Availability Guide.
Optional: Assign Managed Servers to Clusters, as required.
Optional: Configure Machines, as needed. This step is useful when you want to run the Administration Server on one machine and Managed Servers on another physical machine.
Tip:
Before configuring a machine, use theping
command to verify whether the machine or host name is accessible.Optional: Assign the Administration Server to a machine.
Optional: Select Deployments, such as applications and libraries, and Services to target them to a particular cluster or server.
Optional: Configure RDBMS Security Store Database, as required.
On the Configuration Summary screen, review the domain configuration, and click Create to start creating the domain.
A new WebLogic domain to support Oracle Authorization Policy Manager is created in the <MW_HOME>\user_projects\domains
directory (on Windows). On UNIX, the domain is created in the <MW_HOME>/user_projects/domains
directory.
This topic describes how to configure Oracle Authorization Policy Manager (OAPM) in an existing Oracle Identity Management domain that has Oracle Identity Manager (OIM) installed and configured.
It includes the following sections:
Perform the configuration in this topic if you want to install Oracle Authorization Policy Manager in an environment where Oracle Identity Manager and Oracle SOA Suite are already installed and configured. Note that Oracle Identity Manager requires Oracle SOA Suite. You may install other Oracle Identity Management products, such as Oracle Access Manager, Oracle Identity Navigator, and Oracle Adaptive Access Manager at a later time in the same domain. You can discover and launch Consoles for Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Authorization Policy Manager from within the Oracle Identity Navigator user interface.
Performing the configuration in this section deploys the Oracle Authorization Policy Manager application on the existing WebLogic Administration Server.
The configuration in this section depends on the following:
Oracle WebLogic Server.
Installation of the Oracle Identity Management 11g software.
Oracle SOA Suite (required by Oracle Identity Manager).
Database schemas for Oracle Authorization Policy Manager and Metadata Services (MDS), Oracle Identity Manager, and Oracle SOA Suite. For more information, see Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).
To configure Oracle Authorization Policy Manager in an existing WebLogic domain that has Oracle Identity Manager configured, complete the following steps:
Ensure that all the prerequisites, listed in Prerequisites, are satisfied. In addition, see Important Notes Before You Begin.
Run the <Oracle_IDM2>/common/bin/config.sh
(on UNIX) script. (<Oracle_IDM2>\common\bin\config.cmd
on Windows). The Oracle Fusion Middleware Configuration Wizard appears.
Configure Oracle Identity Manager in a new WebLogic domain, as described in OIM Without LDAP Sync in a New Domain.
Ensure that the WebLogic domain with Oracle Identity Manager is configured correctly. After the domain configuration is complete, on the Creating Domain screen, click Done to dismiss the Oracle Fusion Middleware Configuration Wizard.
A new WebLogic domain to support Oracle Identity Manager is created in the <MW_HOME>\user_projects\domains
directory (on Windows). On UNIX, the domain is created in the <MW_HOME>/user_projects/domains
directory.
Run the <Oracle_IDM2>/common/bin/config.sh
script (on UNIX). (<Oracle_IDM2>\common\bin\config.cmd on Windows). The Oracle Fusion Middleware Configuration Wizard appears.
On the Welcome screen, select the Extend an existing WebLogic domain option. Click Next.
On the Select a WebLogic Domain Directory screen, browse to the <MW_HOME>/user_projects/domains directory that contains your Oracle Identity Manager domain. Click Next. The Select Extension Source screen appears.
On the Select Extension Source screen, ensure that the Extend my domain automatically to support the following products: option is selected.
Select Oracle Application Authorization Policy Manager - 11.1.1.3.0 [Oracle_IDM2]. Click Next. The Configure JDBC Component Schema screen appears.
On the Configure JDBC Component Schema screen, select a component schema that you want to modify.
The screen lists the following component schemas:
SOA Infrastructure
User Messaging Service
APM MDS Schema
APM Schema
OIM MDS Schema
OWSM MDS Schema
SOA MDS Schema
OIM Schema
You can set values for Schema Owner, Schema Password, Database and Service, Host Name, and Port. Click Next. The Test JDBC Component Schema screen appears. After the test succeeds, the Select Optional Configuration screen appears.
On the Select Optional Configuration screen, you can configure Managed Servers, Clusters, and Machines, Deployments and Services, and JMS File Store. Select the relevant check boxes, and Click Next.
Optional: Configure Managed Servers, as required.
Optional: Configure Clusters, as required.
For more information about configuring clusters for Oracle Identity Management products, see the "Configuring High Availability for Identity Management Components" topic in the guide Oracle Fusion Middleware High Availability Guide.
Optional: Assign Managed Servers to Clusters, as required.
Optional: Configure Machines, as needed. This step is useful when you want to run the Administration Server on one machine and Managed Servers on another physical machine.
Tip:
Before configuring a machine, use theping
command to verify whether the machine or host name is accessible.Optional: Assign the Administration Server to a machine.
Optional: Select Deployments, such as applications and libraries, and Services to target them to a particular cluster or server, such as oam_server1
(default value).
Optional: Configure JMS File Stores, as required.
On the Configuration Summary screen, review the domain configuration, and click Extend to start extending the Oracle Identity Manager domain to support Oracle Authorization Policy Manager.
Your existing WebLogic domain with Oracle Identity Manager is extended to support Oracle Authorization Policy Manager.
You must complete the following steps after configuring Oracle Authorization Policy Manager in an Oracle Identity Manager domain:
Browse to the <Extended_Domain_Home>/config/fmwconfig
directory.
Open the jps-config.xml
file in a text editor. Be sure to back up the file before making any changes.
Search for the jpscontexts
section, with the name default
, in the file. The section looks like the following:
<jpsContexts name="default"> <!-- This is the default JPS context. All the mendatory services and Login Modules must be configured in this default context --> <jpsContext name="default"> <serviceInstanceRef ref="credstore"/> <serviceInstanceRef ref="keystore"/> <serviceInstanceRef ref="policystore.xml"/> <serviceInstanceRef ref="audit"/> <serviceInstanceRef ref="idstore.oim"/></jpsContext>
Change the last serviceInstance reference entry from <serviceInstanceRef ref="idstore.oim"/> to <serviceInstanceRef ref="idstore.ldap"/>.
Copy the entire jpscontexts section and paste it after the default jpscontexts section. Modify the default
entry and the serviceInstance
reference entry in the new section as follows:
<jpsContexts default="oim"> <!-- This is the default JPS context. All the mendatory services and Login Modules must be configured in this default context --> <jpsContext name="default"> <serviceInstanceRef ref="credstore"/> <serviceInstanceRef ref="keystore"/> <serviceInstanceRef ref="policystore.xml"/> <serviceInstanceRef ref="audit"/> <serviceInstanceRef ref="idstore.oim"/></jpsContext>
Save the jps-config.xml file after making the changes.
Open the Oracle Enterprise Manager MBean browser after logging in to Oracle Enterprise Manager Fusion Middleware Control
Open the domain oracle.as.soainfra.config
.
Select on the following in order:
WorkflowIdentityConfig -> human-workflow ->
WorkflowIdentityConfig.ConfigurationType -> jazn.com ->
WorkflowIdentityConfig.ConfigurationType.ProviderType -> JpsProvider ->
WorkflowIdentityConfig.ConfigurationType.ProviderType.PropertyType -> jpsContextName
Change the value of the jpsContextName
property to the oim
context created in the jps-config.xml file, as in Step 5. Click the setValue
operation, and change the value to oim.
Restart the Administration Server and all Managed Servers for the changes to take effect, as described in Starting the Servers.
This topic describes how to configure Oracle Authorization Policy Manager (OAPM) in an existing Oracle Identity Management domain that contains Oracle Identity Manager (OIM), Oracle Access Manager (OAM), Oracle Adaptive Access Manager (OAAM), and Oracle Identity Navigator (OIN).
It includes the following sections:
Perform the configuration in this topic if you want to install Oracle Authorization Policy Manager in an environment where Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Navigator are installed and configured.
Performing the configuration in this section deploys the Oracle Authorization Policy Manager application on the existing WebLogic Administration Server.
The configuration in this section depends on the following:
Oracle WebLogic Server.
Installation of the Oracle Identity Management 11g software.
Installation of the latest version of Oracle SOA Suite (required by Oracle Identity Manager.
Database schema for Oracle Authorization Policy Manager and Metadata Services (MDS) schema. For more information about schemas specific to Oracle Authorization Policy Manager, see Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).
To configure Oracle Authorization Policy Manager in an existing WebLogic domain that contains Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Navigator, complete the following steps:
Ensure that all the prerequisites, listed in Prerequisites, are satisfied. In addition, see Important Notes Before You Begin.
Run the <Oracle_IDM2>/common/bin/config.sh
script (on UNIX). (<Oracle_IDM2>\common\bin\config.cmd
on Windows). The Oracle Fusion Middleware Configuration Wizard appears.
Create a new WebLogic domain to support Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Navigator. For more information, see Simultaneous configuration of OIN, OAPM, OAAM, OAM, and OIM.
Note:
On the Select Domain Source screen, do not select the Oracle Authorization Policy Manager - 11.1.1.3.0 [Oracle_IDM2] option.Ensure that the WebLogic domain with Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Navigator is configured correctly. After the domain configuration is complete, on the Creating Domain screen, click Done to dismiss the Oracle Fusion Middleware Configuration Wizard.
A new WebLogic domain to support Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Navigator is created in the <MW_HOME>\user_projects\domains
directory (on Windows). On UNIX, the domain is created in the <MW_HOME>/user_projects/domains
directory.
Run the <Oracle_IDM2>/common/bin/config.sh
script (on UNIX). (<Oracle_IDM2>\common\bin\config.cmd on Windows). The Oracle Fusion Middleware Configuration Wizard appears.
On the Welcome screen, select the Extend an existing WebLogic domain option. Click Next.
On the Select a WebLogic Domain Directory screen, browse to the <MW_HOME>/user_projects/domains directory where you created the domain with Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Navigator. Click Next.
The Select Extension Source screen appears.
On the Select Extension Source screen, ensure that the Extend my domain automatically to support the following products: option is selected. Select Oracle Application Authorization Policy Manager - 11.1.1.3.0 [Oracle_IDM2]. Click Next. The Configure JDBC Component Schema screen appears.
On the Configure JDBC Component Schema screen, select a component schema that you want to modify.
The screen lists the following component schemas:
SOA Infrastructure
OAAM Admin Schema
OAAM Server Schema
User Messaging Service
APM MDS Schema
APM Schema
OAAM Admin MDS Schema
OIM MDS Schema
OWSM MDS Schema
SOA MDS Schema
OIM Schema
You can set values for Schema Owner, Schema Password, Database and Service, Host Name, and Port. Click Next. The Test JDBC Component Schema screen appears. After the test succeeds, the Select Optional Configuration screen appears.
On the Select Optional Configuration screen, you can configure Managed Servers, Clusters, and Machines, Deployments and Services, and JMS File Store. Select the relevant check boxes, and Click Next.
Optional: Configure Managed Servers, as required.
Optional: Configure Clusters, as required.
For more information about configuring clusters for Oracle Identity Management products, see the "Configuring High Availability for Identity Management Components" topic in the guide Oracle Fusion Middleware High Availability Guide.
Optional: Assign Managed Servers to Clusters, as required.
Optional: Configure Machines, as needed. This step is useful when you want to run the Administration Server on one machine and Managed Servers on another physical machine.
Tip:
Before configuring a machine, use theping
command to verify whether the machine or host name is accessible.Optional: Assign the Administration Server to a machine.
Optional: Select Deployments, such as applications and libraries, and Services to target them to a particular cluster or server, such as oam_server1
(default value).
Optional: Configure JMS File Stores, as required.
On the Configuration Summary screen, review the domain configuration, and click Extend to start extending the existing domain, which contains Oracle Identity Manager, Oracle Access Manager, Oracle Adaptive Access Manager, and Oracle Identity Navigator, to support Oracle Authorization Policy Manager.
After installing and configuring Oracle Authorization Policy Manager, you must run the Oracle WebLogic Administration Server, as described in Starting or Stopping the Oracle Stack.
After installing and configuring Oracle Authorization Policy Manager, you must reassociate Oracle WebLogic Server with LDAP as follows:
Ensure that the WebLogic Administration Server is up and running. For information about starting the WebLogic Administration Server, see Starting or Stopping the Oracle Stack.
Use an LDAP browser or client, such as JXplorer, to add a new node on the LDAP server that Oracle WebLogic Server is going to associate with:
On the File menu in your LDAP browser, click Connect to connect to your LDAP server. The Open LDAP/DSML Connection screen appears.
In the Host text box, enter the host name of your LDAP server.
In the Port text box, enter the port number.
On the Level drop-down list, choose the User + Password option.
In the User DN text box, enter the base distinguished name of the directory to which you want to connect.
In the Password text box, enter the password. Click OK. If the connection is successful, a list of entries in the Directory Information Tree is displayed in the left navigation pane.
Select the parent entry. From the Edit menu, choose New. The Set Entry Object Classes screen appears.
Select the Suggest Classes check box if you want to view the compulsory object classes for the new entry.
Verify that the Distinguished Name of the parent entry in the Parent DN text box is correct.
In the Enter RDN text box, enter the Relative Distinguished Name of the new entry. For example, to add apm_test_name to the new entry, enter cn=apm_test_name
. JXplorer displays the compulsory object classes for the new entry in the Selected Classes pane. Click OK.
If the information about the new entry is correct, click Submit.
Change the association of Oracle WebLogic Server to the new node by using WebLogic Scripting Tool (WLST) or Oracle Enterprise Manager Fusion Middleware Control:
Using WLST
At the command prompt, change your present working directory to the <MW_HOME>/oracle_common/common/bin
directory.
Run the wlst.sh
script.
At the WLS prompt, use the WLST command reassociateSecurityStore
as follows:
wls> reassociateSecurityStore(domain="domainName", admin="cnSpecification", password="passWord", ldapurl="hostAndPort", servertype="ldapSrvrType", jpsroot="cnSpecification" [,join="trueOrfalse"])
Where
Argument | Description |
---|---|
domain |
Specifies the name of the domain where the reassociation occurs. |
admin |
Specifies the user name of the administrator on the LDAP server. The format is cn=usrName . |
password |
Specifies the password for the administrator on the LDAP server. |
ldapurl |
Specifies the Uniform Resource Identifier (URI) of the LDAP server. The format is ldap//:host:port . |
servertype |
Specifies the type of the target LDAP server. The only valid types are Oracle Internet Directory and Oracle Virtual Directory. |
jpsroot |
Specifies the root node in the target LDAP repository under which all data is migrated. The format is cn=nodeName . |
join |
Specifies whether the domain shares a policy store specified in another domain.
Using this argument allows multiple WebLogic domains to point to the same logical policy store. |
Example Usage
reassociateSecurityStore(domain="myDomain", admin="cn=adminName", password="myPass", ldapurl="ldap(s)://myhost.example.com:3060", servertype="OID", jpsroot="cn=testNode")
If you want a domain other than myDomain, such as yourDomain, to share the policy store in myDomain, then you must run the command as follows:
reassociateSecurityStore(domain="yourDomain", admin="cn=adminName", password="myPass", ldapurl="ldap(s)://myhost.example.com:3060", servertype="OID", jpsroot="cn=testNode", join="true")
Using Oracle Enterprise Manager Fusion Middleware Control
Log in to Oracle Enterprise Manager Fusion Middleware Control.
Navigate to your WebLogic domain.
Right-click and choose Security > Security Provider Configuration.
Click Change Association.
On the Set Security Provider page, in the LDAP Server Details section, select the LDAP server type, host name, port number, connection string, and password.
In the LDAP Root Node Details section, enter a distinguished name for the JPS root.
Select the Create New Domain option if you want to create a new policy and credential domain on LDAP.
Note:
To join a specified existing domain, do not select the Create New Domain option.In the Domain Name text box, enter a name for the domain.
Click OK.
Note:
After the reassociation, CredentialStore, SystemPolicy and apm are migrated to the node. You can verify them through an LDAP management tool, such as JXplorer.After completing the installation and configuration of Oracle Authorization Policy Manager (OAPM), including the post-installation steps, you can verify the installation as follows:
Verify whether a login page appears when you access http://<hostname>:<apm-port>/apm.
After you log in, the Authorization Policy Manager Console is displayed. The home page should display three tabs: Authorization Management, System Configuration, and Policy Upgrade Management.
On the home page, ensure that the Authorization Management tab is active. Click Search - External Roles in the Global section on the home page. The Search - External Roles page is displayed.
These results indicate that your installation of Oracle Authorization Policy Manager was successful.
After installing Oracle Authorization Policy Manager (OAPM), refer to the "Getting Started with Oracle Authorization Policy Manager" chapter in the Oracle Fusion Middleware Authorization Policy Manager Administrator's Guide.