1 Oracle Delegated Administration Services

1.2.1 Delegation of Directory Data Administration

Applications built by using Oracle Delegated Administration Services enable you to grant a specific level of directory access to each type of user. For example, look at Figure 1-1, which shows the various administrative levels in a hosted environment.

Figure 1-1 Administrative Levels in a Hosted Environment

Description of the illustration oidag104.gif

The global administrator, with full privileges for the entire directory, can delegate to realm administrators the privileges to create and manage the realms for hosted companies. These administrators can, in turn, delegate to end users and groups the privileges to change their application passwords, personal data, and preferences. Each type of user can thus be given the appropriate level of privileges.

1.2.2 How Oracle Delegated Administration Services Works

Oracle Delegated Administration Services uses an Oracle Application Server Containers for J2EE (OC4J) that is enabled for small Java programs, called servlets. Together, the OC4J and the servlets:

1. Receive requests from clients

2. Process those requests—by either retrieving or updating data in Oracle Internet Directory—and compile the LDAP result into an HTML page

3. Send the HTML page back to the client Web browser

Figure 1-2 shows the flow of information between components in a Oracle Delegated Administration Services environment.

Figure 1-2 Flow of Information Between Components in a Oracle Delegated Administration Services Environment

As Figure 1-2 shows:

1. The user, from a browser and using HTTP, sends to Oracle Delegated Administration Services a request containing a directory query.

2. Oracle Delegated Administration Services receives the request and launches the appropriate servlet. This servlet interprets the request, and sends it to Oracle Internet Directory by using LDAP.

3. Oracle Internet Directory sends the LDAP result to the Oracle Delegated Administration Services servlet.

4. The Oracle Delegated Administration Services servlet compiles the LDAP result into an HTML page, and sends it to the client Web browser.

1.2.3 How Oracle Delegated Administration Services Provides Secure Access to the Directory

When a user logs into an Oracle component, that component may need to obtain information from the directory on the end user's behalf—for example, the password verifier. To do this, the component typically logs into the directory as a proxy user, a feature that enables it to switch its identity to that of the end user.

A problem, however, is that the greater the number of components logging into the directory as proxy users, the greater the risk of a malicious user accessing the directory as a proxy user. To prevent this security problem, the Oracle Delegated Administration Services centralizes proxy user access.

In a Oracle Delegated Administration Services environment, each component, instead of logging into the directory as a proxy user, logs into the central Oracle Delegated Administration Services. Oracle Delegated Administration Services then logs into the directory as a proxy user, switches its identity to that of the end user, and performs operations on that user's behalf. Centralizing proxy user directory access in this way replaces the less secure strategy of granting proxy user access to every component accessing the directory.

Figure 1-3 shows the proxy user feature in an Oracle Delegated Administration Services environment. End users or delegated administrators log in to a central Oracle Delegated Administration Services. They do this by using the Oracle Internet Directory Self-Service Console, the consoles of other Oracle components such as OracleAS Portal, or those of third-party applications. The Oracle Delegated Administration Services then logs into Oracle Internet Directory as a proxy user.

Figure 1-3 Centralization of the Proxy User Feature in the Oracle Delegated Administration Services

1.3.1 Task 1: Install Oracle Delegated Administration Services

By default, Oracle Delegated Administration Services is installed as part of Oracle Internet Directory 10g Release 2 (10.1.2). However, during the installation process you can also choose to install Oracle Delegated Administration Services by itself. In this manner, you can install multiple instances of Oracle Delegated Administration Services on separate servers that communicate with a single instance of Oracle Application Server.

1.3.2 Task 2: Verify that Oracle Delegated Administration Services Is Running

You can use Oracle Enterprise Manager 10g Application Server Control Console to verify that Oracle Delegated Administration Services is running as follows:

1. On the main Application Server Control Console page, select the name of the Oracle Application Server instance you want to manage in the Standalone Instances section. The Oracle Application Server home page opens for the selected instance.

2. Locate OC4J_SECURITY in the System Components table. The Status column will contain one of the following:

   • An up arrow, which indicates the component is up and running

   • A down arrow, which indicate the component is down and not running

   • An icon in the shape of a stopwatch, which indicates that the Application Server Control Console is unable to determine the status of the component

If Oracle Delegated Administration Services is not running, then start it by following the instructions in Starting and Stopping Oracle Delegated Administration Services.

Alternatively, you can verify that Oracle Delegated Administration Services are running using the following command-line procedures:

ps -ef | grep http

ps -ef | grep java

http://host_name:port_number/orasso/

http://host_name:port_number/oiddas/

1.3.3 Task 3: Configure the Default Identity Management Realm

To do this, follow the instructions in the section "Configuring an Identity Management Realm by Using the Self-Service Console".

1.3.4 Task 4: Configure User Entries

To do this, follow the instructions in the section "Configuring User Entries by Using the Self-Service Console".

1.3.5 Location of Log Files for Components in the Oracle Delegated Administration Services Environment

Table 1-1 tells you where to find the log files for components in the Oracle Delegated Administration Services environment.

1.4.1 Starting and Stopping Oracle Delegated Administration Services by Using the Command Line

To start Oracle Delegated Administration Services by using the command line, enter:

$ORACLE_HOME/opmn/bin/opmnctl startproc type=oc4j instancename=OC4J_SECURITY

To stop Oracle Delegated Administration Services by using the command line, enter:

$ORACLE_HOME/opmn/bin/opmnctl stopproc type=oc4j instancename=OC4J_SECURITY

1.4.2 Starting, Stopping, and Restarting Oracle Delegated Administration Services by Using Oracle Enterprise Manager 10g Application Server Control Console

To start, stop, or restart a component from the Oracle Enterprise Manager 10g Application Server Control Console:

1. On the main Application Server Control Console page, select the name of the Oracle Application Server instance you want to manage in the Standalone Instances section. The Oracle Application Server home page opens for the selected instance.

2. In the System Components table, select OC4J_SECURITY in the Name column. This OC4J_SECURITY page opens.

3. In the General section, select the Start, Stop, or Restart button.

1.5.1 Oracle Delegated Administration Services for User Entries

Oracle Delegated Administration Services can perform these operations regarding user entries:

• Search for a user entry

• Create a user entry

• Self-edit a password

• Select a user entry and edit it

• Select a user entry and delete it

• Select a user entry and assign a privilege to that user

• View profile of the user who is logged in

• User list of values (LOV), a popup window that enables you to lookup and select a user

• Edit a user by passing the orclguid attribute to the URL. The entry is then displayed without the user needing to perform a search.

• Delete a user by passing the orclguid attribute to the URL. The entry is then displayed without the user needing to perform a search.

• Assign a privilege to a user by passing the orclguid attribute to the URL. The entry is then displayed without the user needing to perform a search.

1.5.2 Oracle Delegated Administration Services for Group Entries

Oracle Delegated Administration Services can perform these operations regarding group entries:

• Search for a group entry

• Create a group entry

• Select a group entry and edit it

• Select a group entry and delete it

• Select a group entry and assign a privilege to that group

• Group list of values (LOV), a popup window that enables you to lookup and select a group

• Edit a group by passing the orclguid attribute to the URL. The entry is then displayed without the user needing to perform a search.

• Delete a group by passing the orclguid attribute to the URL. The entry is then displayed without the user needing to perform a search.

• Assign a privilege to a group by passing the orclguid attribute to the URL. The entry is then displayed without the user needing to perform a search.

1.7.1 Performing a Standalone Oracle Delegated Administration Services Installation

To perform a standalone Oracle Delegated Administration Services installation, when prompted by the Oracle Installer, select the Identity Management installation type. On the Configuration Options screen, select Delegated Administration Service.

1.7.2 Manually Deploying Oracle Delegated Administration Services in a New Oracle Home

To manually deploy Oracle Delegated Administration Services in a separate Oracle home, follow these steps:

1. Verify that the computer has at least a core installation that points to an existing Oracle Internet Directory and Oracle Application Server Single Sign-On.

2. Navigate to the ORACLE_HOME/dcm/bin directory.

3. Create a new component by using the following command:

   dcmctl createcomponent -verbose -debug -ct oc4j -co OC4J_SECURITY
   
   

4. Start the component by using the following command:

   dcmctl start -verbose -debug -co OC4J_SECURITY
   
   

5. Deploy the oiddas.ear file by using the following command:

   dcmctl deployApplication -debug -verbose -a oiddas -f
   ORACLE_HOME/ldap/das/oiddas.ear -co OC4J_SECURITY
   
   

6. Perform the following steps to add the LD_LIBRARY_PATH and DISPLAY environment variables to the opmn.xml file:

   1. Navigate to the ORACLE_HOME/opmn/conf directory and open opmn.xml in a text editor.

   2. Add the following lines in the OC4J_SECURITY section of opmn.xml:

      For a UNIX environment:

      <environment>
      <prop name="LD_LIBRARY_PATH" value="%ORACLE_HOME%/lib"/>
      </environment>
      
      

      For a Windows environment:

      <environment>
      <prop name="PATH" value="%ORACLE_HOME%/bin"/>
      </environment>
      

      Note the placement of the section <environment> in the following example.

      <oc4j maxRetry="3" instanceName="OC4J_DAS" gid="OC4J_SECURITY"
      numProcs="1">
      <config-file path="/home/ias902/j2ee/OC4J_
      DAS/config/server.xml"/>
      <oc4j-option value="-properties"/>
      <port ajp="3001-3100" jms="3201-3300"
      rmi="3101-3200"/>
      <environment>
      <prop name="LD_LIBRARY_PATH" value="/home/ias902/lib"/>
      </environment>
      </oc4j>
      
      

   3. Navigate to the ORACLE_HOME/dcm/bin directory.

   4. Save the changes to the repository by using the following command:

      dcmctl updateconfig -verbose -debug -ct opmn
      
      

   5. Restart OPMN by using the following command:

      dcmctl restart -verbose -ct opmn
      
      

   6. Stop and start the OC4J_SECURITY instance by using the following commands:

      dcmctl stop -verbose -debug -ct oc4j -co OC4J_SECURITY
      

      dcmctl start -verbose -debug -ct oc4j -co OC4J_SECURITY
      
      

   7. Set the necessary permissions for Oracle Delegated Administration Services. Modify the group by using either Oracle Directory Manager or the command-line tool. Add the DN of the new Oracle Application Server instance where Oracle Delegated Administration Services is currently being deployed as the uniquemember.

      DN of the group to be modified: cn=Associated Mid-tiers,orclApplicationCommonName=DASApp,cn=DAS,cn=Products,cn=OracleContext
      

      The DN on the Oracle Application Server instance is:

      orclApplicationCommonName=name of Oracle Application Server instance,cn=IAS Instances, cn=IAS, cn=Products, cn=OracleContext 
      
      

      where name of Oracle Application Server instance is obtained from $ORACLE_HOME/config/ias.properties.