18 Configuring Oracle Adaptive Access Manager

18.4.1 Appropriate Deployment Environment

Perform the configuration in this topic if you want to install Oracle Adaptive Access Manager in an environment where you may install other Oracle Identity Management 11g components, such as Oracle Identity Navigator, Oracle Access Manager, or Oracle Identity Manager at a later time in the same domain.

You can use the Oracle Identity Navigator interface and dashboard to discover and launch the Oracle Adaptive Access Manager console from within Oracle Identity Navigator.

18.4.2 Components Deployed

Performing the configuration in this section deploys the following:

• WebLogic Administration Server

• Managed Servers for Oracle Adaptive Access Manager, depending on the Oracle Adaptive Access Manager Domain Configuration template you choose.

• Oracle Adaptive Access Manager Console and Oracle Identity Navigator application on the Administration Server.

18.4.3 Dependencies

The configuration in this section depends on the following:

• Oracle WebLogic Server.

• Installation of the Oracle Identity Management 11g software.

• Database schema for Oracle Adaptive Access Manager. For more information about schemas specific to Oracle Adaptive Access Manager, see Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).

18.4.4 Procedure

Perform the following steps to configure only Oracle Adaptive Access Manager in a new WebLogic domain:

1. Ensure that all prerequisites, listed in Prerequisites, are satisfied. In addition, see Important Notes Before You Begin.

2. Run the <Oracle_IDM2>/common/bin/config.sh script (on UNIX). (<Oracle_IDM2>\common\bin\config.cmd on Windows). The Oracle Fusion Middleware Configuration Wizard appears.

3. On the Welcome screen, select the Create a new WebLogic domain option. Click Next. The Select Domain Source screen appears.

4. On the Select Domain Source screen ensure that the Generate a domain configured automatically to support the following products: option is selected. Select Oracle Adaptive Access Manager Admin Server - 11.1.1.3.0 [Oracle_IDM2], which is mandatory.

   In addition, you can select Oracle Adaptive Access Manager - Server - 11.1.1.3.0, which is optional. Click Next. The Select Domain Name and Location screen appears.

   Note:

   When you select the Oracle Adaptive Access Manager Admin Server - 11.1.1.3.0 [Oracle_IDM2] option, the Oracle JRF 11.1.1.0 [oracle_common] option and the Oracle Identity Navigator - 11.1.1.3.0 [Oracle_IDM2] option are also selected, by default.

5. Enter a name and a location for the domain to be created, and click Next. The Configure Administrator User Name and Password screen appears.

6. Configure a user name and a password for the administrator. The default user name is weblogic. Click Next.

7. Choose JRockit SDK 160_17_R28.0.0-679 and Production Mode in the Configure Server Start Mode and JDK screen of the Oracle Fusion Middleware Configuration Wizard. Click Next. The Configure JDBC Component Schema screen is displayed.

8. On the Configure JDBC Component Schema screen, select a component schema, such as the OAAM Admin Server Schema or the OAAM Admin MDS Schema, that you want to modify.

   You can set values for Schema Owner, Schema Password, Database and Service, Host Name, and Port. Click Next. The Test JDBC Component Schema screen appears. After the test succeeds, the Select Optional Configuration screen appears.

9. On the Select Optional Configuration screen, you can configure the Administration Server and Managed Servers, Clusters, and Machines, and Deployments and Services, and RDBMS Security Store. Click Next.

10. Optional: Configure the following Administration Server parameters:

    • Name

    • Listen address

    • Listen port

    • SSL listen port

    • SSL enabled or disabled

11. Optional: Configure Managed Servers, as required.

12. Optional: Configure Clusters, as required.

    For more information about configuring clusters for Oracle Identity Management products, see the "Configuring High Availability for Identity Management Components" topic in the guide Oracle Fusion Middleware High Availability Guide.

13. Optional: Assign Managed Servers to Clusters, as required.

14. Optional: Configure Machines, as needed. This step is useful when you want to run the Administration Server on one machine and Managed Servers on another physical machine.

    Tip:

    Before configuring a machine, use the ping command to verify whether the machine or host name is accessible.

15. Optional: Assign the Administration Server to a machine.

16. Optional: Select Deployments, such as applications and libraries, and Services to target them to a particular cluster or server.

17. Optional: Configure RDBMS Security Store, as required.

18. On the Configuration Summary screen, review the domain configuration, and click Create to start creating the domain.

A new WebLogic domain to support Oracle Adaptive Access Manager is created in the <MW_HOME>\user_projects\domains directory (on Windows). On UNIX, the domain is created in the <MW_HOME>/user_projects/domains directory.

18.5.1 Appropriate Deployment Environment

Perform the configuration in this topic if you want to install Oracle Adaptive Access Manager in an environment where you may want to set up integration between Oracle Identity Manager and Oracle Adaptive Access Manager. You may use Oracle Access Manager for Single Sign-On and access management. Oracle Identity Navigator enables you to discover and launch Consoles for these products from within the Oracle Identity Navigator user interface.

18.5.2 Components Deployed

Performing the configuration in this section deploys the following:

• Managed Server for Oracle Adaptive Access Manager

• Oracle Adaptive Access Manager Console on the existing Administration Server

18.5.3 Dependencies

The configuration in this section depends on the following:

• Oracle WebLogic Server.

• Installation of the Oracle Identity Management 11g software.

• Database schema for Oracle Adaptive Access Manager. For more information about schemas specific to Oracle Adaptive Access Manager, see Creating Database Schema Using the Oracle Fusion Middleware Repository Creation Utility (RCU).

18.5.4 Procedure

To configure Oracle Adaptive Access Manager in an existing Oracle Identity Management domain that contains Oracle Access Manager, Oracle Identity Manager, and Oracle Identity Navigator, complete the following steps:

1. Ensure that all prerequisites, listed in Prerequisites, are satisfied. In addition, see Important Notes Before You Begin.

2. Ensure that Oracle Access Manager, Oracle Identity Manager, and Oracle Identity Navigator are configured in a new WebLogic domain, as described in OIM, OAM, and OIN in a New WebLogic Domain.

3. Run the <Oracle_IDM2>/common/bin/config.sh script (on UNIX). (<Oracle_IDM2>\common\bin\config.cmd on Windows). The Oracle Fusion Middleware Configuration Wizard appears.

4. On the Welcome screen, select the Extend an existing WebLogic domain option. Click Next.

5. On the Select a WebLogic Domain Directory screen, browse to the domain directory that contains Oracle Access Manager, Oracle Identity Manager, and Oracle Identity Navigator. Click Next. The Select Domain Source screen appears.

6. On the Select Extension Source screen, ensure that the Extend my domain automatically to support the following products: option is selected. Select Oracle Adaptive Access Manager Admin Server - 11.1.1.3.0 [Oracle_IDM2], which is mandatory.

   When you select the Oracle Adaptive Access Manager Admin Server - 11.1.1.3.0 [Oracle_IDM2] option, the Oracle Identity Navigator - 11.1.1.3.0 [Oracle_IDM2] option is also selected, by default.

   In addition, you can select Oracle Adaptive Access Manager - Server - 11.1.1.3.0 [Oracle_IDM2], which is optional. Click Next. The Configure JDBC Component Schema screen appears.

   The screen lists the following component schemas:

   • SOA Infrastructure

   • OAAM Admin Schema

   • User Messaging Service

   • OAAM Admin MDS Schema

   • OIM MDS Schema

   • OWSM MDS Schema

   • SOA MDS Schema

   • OIM Schema

7. On the Configure JDBC Component Schema screen, select a component schema that you want to modify. You can set values for Schema Owner, Schema Password, Database and Service, Host Name, and Port. Click Next. The Test JDBC Component Schema screen appears. After the test succeeds, the Select Optional Configuration screen appears.

8. On the Select Optional Configuration screen, you can configure Managed Servers, Clusters, and Machines, Deployments and Services, and JMS File Store. Select the relevant check boxes, and Click Next.

9. Optional: Configure Managed Servers, as required.

10. Optional: Configure Clusters, as required.

    For more information about configuring clusters for Oracle Identity Management products, see the "Configuring High Availability for Identity Management Components" topic in the guide Oracle Fusion Middleware High Availability Guide.

11. Optional: Assign Managed Servers to Clusters, as required.

12. Optional: Configure Machines, as needed. This step is useful when you want to run the Administration Server on one machine and Managed Servers on another physical machine.

    Tip:

    Before configuring a machine, use the ping command to verify whether the machine or host name is accessible.

13. Optional: Assign the Administration Server to a machine.

14. Optional: Select Deployments, such as applications and libraries, and Services to target them to a particular cluster or server, such as oaam_server1 (default value).

15. On the Configuration Summary screen, review the domain configuration, and click Extend to start extending the domain.

    Your existing Oracle Identity Management domain with Oracle Access Manager, Oracle Identity Manager, and Oracle Identity Navigator is extended to support Oracle Adaptive Access Manager.

18.9.1 Creating JPS Root

Create the jpsroot in Oracle Internet Directory using the command line ldapadd command as shown in these steps:

1. Create an ldif file similar to this:

   dn: cn=jpsroot_idm
   cn: jpsroot_idm_idm
   objectclass: top
   objectclass: orclcontainer
   

2. Use ORACLE_HOME/bin/ldapadd to add these entries to Oracle Internet Directory. For example:

   ORACLE_HOME/bin/ldapadd -h oid.mycompany.com -p 389 -D cn="orcladmin" -w
   welcome1 -c -v -f jps_root.ldif
   

18.9.2 Reassociating the Policy and Credential Store

To reassociate the policy and credential store with Oracle Internet Directory, use the WLST reassociateSecurityStore command. Follow these steps:

1. From IDMHOST1, start the wlst shell from the ORACLE_HOME/common/bin directory. For example:

   ./wlst.sh
   

2. Connect to the WebLogic Administration Server using the wlst connect command shown below.

   connect('AdminUser',"AdminUserPassword",t3://hostname:port')
   

   For example:

   connect("weblogic_idm,"welcome1","t3://idmhost-vip.mycompany.com:7001")
   

3. Run the reassociateSecurityStore command as shown below:

   Syntax:

   reassociateSecurityStore(domain="domainName",admin="cn=orcladmin",
   password="orclPassword",ldapurl="ldap://LDAPHOST:LDAPPORT",servertype="OID",
   jpsroot="cn=jpsRootContainer")
   

   For example:

   wls:/IDMDomain/serverConfig> reassociateSecurityStore(domain="IDMDomain",
   admin="cn=orcladmin",password="password",
   ldapurl="ldap://oid.mycompany.com:389",servertype="OID",
   jpsroot="cn=jpsroot_idm_idmhost1")
   

   The output for the command is as follows:

   {servertype=OID, jpsroot=cn=jpsroot_idm, admin=cn=orcladmin,
   domain=IDMDomain, ldapurl=ldap://oid.mycompany.com:389, password=password}
   Location changed to domainRuntime tree. This is a read-only tree with
   DomainMBean as the root.
   For more help, use help(domainRuntime)
   
   Starting Policy Store reassociation.
   LDAP server and  ServiceConfigurator setup done.
   
   Schema is seeded into LDAP server
   Data is migrated to LDAP server
   Service in LDAP server after migration has been tested to be available
   Update of jps configuration is done
   Policy Store reassociation done.
   Starting credential Store reassociation
   LDAP server and  ServiceConfigurator setup done.
   Schema is seeded into LDAP server
   Data is migrated to LDAP server
   Service in LDAP server after migration has been tested to be available
   Update of jps configuration is done
   Credential Store reassociation done
   Jps Configuration has been changed. Please restart the server.
   

4. Restart the Administration Server after the command completes successfully. For information about restarting the Administration Server, see Starting the Servers.