13 Configuring Security

13.2.3.1 Registering Enterprise Manager as a Partner Application

To register Enterprise Manager as a partner application manually, follow these steps:

1. Stop all OMSs by running emctl stop oms on each OMS.

2. Enter the following URL to navigate to the SSO Administration page.

   https://sso_host:sso_port/pls/orasso
   

3. Log in as orcladmin user and click on SSO Server Administration.

4. Click Administer Partner Applications and then click Add Partner Application.

5. Enter the following information on the Add Partner Application page.

   Name: <EMPartnerName>
   Home URL: protocol://em_host:em_port
   Success URL: protocol://em_host:em_port/osso_login_success 
   Logout URL: protocol://em_host:em_port/osso_logout_success
   Administrator Email: user@host.com
   

   Note1: host, port, and protocol refer to the Enterprise Manager host, port and the protocol (http or https) used.

   Note2: The em_host, em_port, email and Enterprise Manager Partner Name must be replaced with the appropriate values and not typed as shown in this example.

6. Go back to Administer Partner Applications page and click on the Edit icon for <EMPartnerName>.

   Record the values of ID, Token, Encryption Key, Login URL, Single Sign-Off URL, Home URL and write the following in a file osso.txt:

   sso_server_version= v1.2
   cipher_key=<value of EncryptionKey>
   site_id=<value of ID>
   site_token=<value of Token>
   login_url=<value of Login URL>
   logout_url=<value of Single Sign-Off URL>
   cancel_url=<value of Home URL>
   sso_timeout_cookie_name=SSO_ID_TIMEOUT
   sso_timeout_cookie_key=9E231B3C1A3A808A
   

7. Set the ORACLE_HOME environment variable to WebTier Oracle Home location.

   setenv ORACLE_HOME /scratch/12c/MWHome/Oracle_WT

   Then, run the following:

   $ORACLE_HOME/ohs/bin/iasobf <location of osso.txt> <location of osso.conf>

8. Run the following command on each OMS:

   emctl config auth sso -ossoconf <osso.conf file loc> -dasurl <DAS URL> [-unsecure] [-sysman_pwd <pwd>] [-domain <domain>]-ldap_host <ldap host> -ldap_port <ldap port> -ldap_principal <ldap principal> [-ldap_credential <ldap credential>] -user_base_dn <user base DN> -group_base_dn <group base DN> [-logout_url <sso logout url>]
   

   where ldap_host, ldap_port, ldap_principal and ldap_credential are the details of SSO's LDAP.

   The sample output for this command is shown below:

   Oracle Enterprise Manager Cloud Control 12c Release 12.1.0.1.0
   Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
   SSO Configuration done successfully. Please restart Admin & Managed Servers.
   

9. Run the following commands on each OMS:

   emctl stop oms -all
   emctl start oms
   

13.2.3.2 Removing Single Sign-On Configuration

To remove the single sign-on configuration, perform the following:

1. Run the following command on each OMS:

   emctl config auth repos [-sysman_pwd <pwd>]
   

   Sample command output:

   Oracle Enterprise Manager Cloud Control 12c Release 12.1.0.1.0
   Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
   Configuring Repos Authentication ... Started
   Configuring Repos Authentication ... Successful
   
   

   If you have updated files such as, for example, httpd.conf (when installing WebGate) or any other required files should be backed up prior in order to rolled back during this step.If you are using multi-OMS environment, you must execute emctl config auth repos on the remaining servers.

2. Bounce all OMSs by issuing the following on each OMS:

   emctl stop oms -all
   emctl start oms
   

13.2.3.3 Registering Single Sign-On Users as Enterprise Manager Administrators

After you have configured Enterprise Manager to use the Single Sign-On logon page, you can register any Single Sign-On user as an Enterprise Manager administrator. You can register single sign-on users using:

• Enterprise Manager Graphical User Interface

• Enterprise Manager Command Line Interface

emcli create_user
         -name="new_admin"
         -email="first.last@oracle.com;joe.shmoe@shmoeshop.com"
         -roles="public"
         -privilege="view_job;923470234ABCDFE23018494753091111"
         -privilege="view_target;<host>.com:host" 

emcli create_user
         -name="User1"
         -type="EXTERNAL_USER"
         -input_file="privilege:/home/user1/priv_file"

         Contents of priv_file are:
           view_target;<host>.com:host

emcli create_user
         -name="User1"
         -desc="This is temp hire."
         -prevent_change_password="true"
         -profile="MGMT_ADMIN_USER_PROFILE"

emcli create_user
         -name="User1"
         -desc="This is temp hire."
         -expire="true" 

13.2.3.4 Bypassing the Single Sign-On Logon Page

If the OMS is configured with SSO or OAM or some other authentication method, you may want to by-pass the Single Sign-On or OAM authentication under certain circumstances.To bypass the SSO logon page, connect to the following URL:

1. Connect to https://ms_host:ms_https_port/em

   ms_host & ms_https_port are WLS-managed server's hostname & port#. These parameters can be found in the EM_INSTANCE_HOME/emgc.properties file. They are listed as EM_INSTANCE_HOST & MS_HTTPS_PORT in this file.

2. Log in using a repository user's credentials.

13.2.3.5 Restoring the Default Authentication Method

1. Run the following command on each OMS:

   emctl config auth repos [-sysman_pwd <pwd>]
   

   Sample command output:

   Oracle Enterprise Manager Cloud Control 12c Release 12.1.0.1.0
   Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
   Configuring Repos Authentication ... Started
   Configuring Repos Authentication ... Successful
   If you have updated files like httpd.conf (for example, while installing WebGate), rollback them.
   If this is a multi-OMS environment, execute this command on remaining servers.
   After that, restart OMS(s) using: 'emctl stop oms -all' and 'emctl start oms'
   

2. Run the following commands on each OMS:

   emctl stop oms -all
   emctl start oms
   

13.2.4.1 Registering Enterprise Users as Enterprise Manager Users

After you have configured Enterprise Manager to use Enterprise Users, you can register existing enterprise users as Enterprise Manager Users and grant them the necessary privileges so that they can manage Enterprise Manager effectively.

You can register existing enterprise users by using:

• Enterprise Manager Graphic User Interface

• Enterprise Manager Command Line Interface

emcli create_user -name=eususer -type=DB_EXTERNAL_USER

13.2.6.1 Configuring WebLogic Server Authentication

Use the following procedure to update

1. As the Weblogic/Enterprise Manager administrator, back up the WLS config.xml file at the following location:

   ../gc_inst/user_projects/domains/GCDomain/config/config.xml

2. Log in to the WebLogic Administration Console as WebLogic. The WebLogic Administration Console URL can be found in the setupinfo.txt file at the following location:

   $ORACLE_HOME/install/setupinfo.txt

3. Under Domain Structure, click Security Realms.

4. Click myrealm and then click the Providers tab.

5. Click Lock & Edit to enable editing.

6. Click New to add a Provider.

7. Enter a Name for your Provider (for example, MS Active Directory).

8. Select ActiveDirectoryAuthenticator for Type and then click OK.

   
   

9. On the Providers screen, click the New Provider link to begin editing.

10. Set the Control Flag to Sufficient and then click Save.

11. Click the Provider Specific tab

12. In the Connection section, enter the following:

    Host: AD Server Host

    Port: 389 (default for LDAP, or 636 for LDAPS)

    Principal:CN=EMGCADMIN,CN=Users,DC=Cloudcontrol,DC=local

    Note:

    This is the User created in AD steps above and added to Administrators group. The CN/DC string must be confirmed with your Active Directory administrator.

    Credential: pwd for principal

    
    

13. In the Users section, set the User Base DN to the value provided by your Active Directory administrator. This is the Group or Organization Unit that will have access to Enterprise Manager. To restrict access to a specific set of users, you must use an Organization Unit.

    User Base DN: cn=users,dc=Cloudcontrol,dc=local

    
    

    Note:

    This information must be obtained from the AD Administrator.

14. If you want to use the Login Name instead of the Account Name (which is typically First Last) then you need to set the User From Name Filter and User Name Attribute as follows:

    User Name Attribute: sAMAccountName

    User From Name Filter: (&(sAMAccountName=%u)(objectclass=user))

15. In the Groups section, enter the following:

    Group Base dn: cn=Users,dc=Cloudcontrol,dc=local

    Note: This information must be obtained from the AD Administrator

16. In the General section, click Propagate Cause For Login Exception.

17. Click Save.

18. In the Authentication Providers section, click Reorder and move your new provider to the top of the list.

    
    

19. Click Apply & Activate Changes.

20. There are two options to provision users to Enterprise Manager. You can set a flag to auto-provision all users, or you can manually create them as external users using EM CLI.

    1. To set Auto Provisioning to true, run the following:

       $ bin/emctl set property -name "em.security.auth.autoprovisioning" -value "true"
       Oracle Enterprise Manager Cloud Control 12c Release 12.1.0.1.0Copyright (c) 1996, 2012 Oracle Corporation.  All rights reserved.
       SYSMAN password:
       

       The property em.security.auth.autoprovisioning for the OMS server.oracle.com:4890_Management_Service has been set to value true

       OMS restart is required to reflect the new property value.

    2. If you do not want all users created automatically, you must manually create them using the EM CLI (after restart).

       $ bin/emcli create_user -name='TEST' -type='EXTERNAL_USER'
       User "TEST" created successfully
       

21. Restart the OMS.

    $ bin/emctl stop oms -all
    $ bin/emctl start oms
    

22. The users will not show up in the Enterprise Manager Administrators UI until they have logged in once.

13.2.6.2 Manage Active Directory Users with External Roles

To assign a group of privileges to the LDAP users, you can create an external role with the same name as the LDAP group. Once the users are authenticated, they will inherit the permissions and privileges granted to the external role automatically.

1. Create a Group in the Active Directory and assign users to the group.

2. From the Setup menu, select Security, then select Roles.

3. Click Create .

4. Enter the name of the Active Directory group and a brief description.

5. Check the box for External, and then click Next.

6. Assign additional Roles, and then click Next.

7. Assign target privileges, and then click Next.

8. Assign resource privileges, and then click Next.

9. Review the settings and click Finish.

13.2.6.3 Password Management for Active Directory Users

Password management for Active Directory users must be handled through Active Directory. Password changes are not allowed via Enterprise Manager or WebLogic Server.

13.2.6.4 Remove Active Directory Users

An Active Directory user must be deleted from Enterprise Manager to remove access to Cloud Control. If the user remains in Active Directory, they should be removed from any Groups assigned privileges through External Roles to ensure they cannot log in again if auto-provisioning is enabled.

13.2.6.5 Remove Active Directory Authentication

Removing Active Directory authentication will remove all Active Directory user accounts from Enterprise Manager.

1. Log in to the WebLogic Server console.

2. Under Domain Structure, click on Security Realms.

3. Click myrealm, then click on the Providers tab.

4. Click Lock & Edit to enable editing.

5. Click the NT Authenticator provider.

6. Click Delete.

7. Click Save and Activate.

8. Restart the OMS.

13.3.3.1 Granting Privileges

A privilege is a right to perform management actions within Enterprise Manager. Privileges can be divided into two categories:

• Target Privileges

• Resource Privileges

Target Privileges: These privileges allow an administrator to perform operations on a target. The Target Privileges page shows a list of targets for which privileges can be granted. Select the check box to specify the privileges that are to be granted and click Next.

Resource: These privileges allow a user to perform operations against specific types of resources. To set Resource Privileges, from the Setup menu, choose Administrators. Select an administrator from the list and click Edit. The Edit Administrator wizard is displayed. Click Next to navigate through the wizard to see the System Privileges page. The following table lists all available resource privileges.

Select the check box to select the resource privilege to be granted to the administrator and click Next.

13.4.2.1 Creating a New Certificate Authority

You may need to create a new Certificate Authority (CA) if the current CA is expiring or if you want to change the key strength. A unique identifier is assigned to each CA. For instance, the CA created during installation may have an identifier as ID 1, subsequent CAs will have the IDs 2,3, and so on. At any given time, the last created CA is active and issues certificates for OMSs and Agents.

emctl secure createca [-sysman_pwd <pwd>] [-host <hostname>] [-key_strength<strength>] [-cert_validity <validity>] [-root_dc <root_dc>] [-root_country <root_country>] [-root_email <root_email>] [-root_state <root_state>] [-root_loc <root_loc>] [-root_org <root_org>] [-root_unit <root_unit>] 
Oracle Enterprise Manager 12c Release 1 Cloud Control
Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
Creating CA... Started.
Successfully created CA with ID 2

emcli get_ca_info -ca_id="1;2" -details
Info about CA with ID: 1
CA is not configured
DN: CN=myhost.example.com, C=US
Serial# : 3423643907115516586
Valid From: Tue Mar 16 11:06:20 PDT 2011
Valid Till: Sat Mar 14 11:06:20 PDT 2020
Number of Agents registered with CA ID 1 is 1
myhost.mydomain.com:3872

Info about CA with ID: 2
CA is configured
DN: CN=myhost.example.com, C=US, ST=CA
Serial# : 1182646629511862286
Valid From: Fri Mar 19 05:17:15 PDT 2011
Valid Till: Tue Mar 17 05:17:15 PDT 2020
There are no Agents registered with CA ID 2

The WebLogic Administrator and Node Manager passwords are stored in the Administration Credentials Wallet. This is present in the EM_INSTANCE_HOME/sysman/config/adminCredsWallet directory. To recreate Administrator Credentials wallet, run the following command on each machine on which the Management Service is running:

emctl secure create_admin_creds_wallet [-admin_pwd <pwd>] [-nodemgr_pwd <pwd>]

13.4.2.2 Viewing the Security Status and OMS Port Information

To view the security status and OMS port information, use the following command

> emctl status oms -details
Oracle Enterprise Manager Cloud Control 12c Release 12.1.0.1.0
Copyright (c) 1996, 2011 Oracle Corporation. All rights reserved.
Enter Enterprise Manager Root (SYSMAN) Password : ******
Console Server Host : omshost1.example.com
HTTP Console Port : 7802
HTTPS Console Port : 5416
HTTP Upload Port : 7654
HTTPS Upload Port : 4473
OMS is not configured with SLB or virtual hostname
Agent Upload is locked.
OMS Console is locked.
Active CA ID: 1
Console URL: https://omshost1.example.com:5416/em
Upload URL: https://omshost1.example.com:4473/empbs/upload
 
WLS Domain Information
Domain Name : EMGC_DOMAIN
Admin Server Host: omshost1.example.com
 
Managed Server Information
Managed Server Instance Name: EMGC_OMS1
Managed Server Instance Host: omshost1.example.com

13.4.2.3 Configuring Transparent Layer Security

The Oracle Management Service can be configured in the following modes:

• TLSv1-only mode: To configure the OMS to use only TLSv1 connections, do the following:

  1. Stop the OMS by entering the following command:

     OMS_ORACLE_HOME/bin/emctl stop oms
     

  2. Enter the following command:

     emctl secure oms -protocol TLSv1
     

  3. Append -Dweblogic.security.SSL.protocolVersion=TLS1 to JAVA_OPTIONS in Domain_Home/bin/startEMServer.sh/cmd. If this property already exists, update the value to TLS1.

  4. Restart the OMS with the following command:

     OMS_ORACLE_HOME/bin/emctl start oms
     

• SSLv3 Only Mode: To configure the OMS to use SSLv3 connections only, do the following:

  1. Stop the OMS by entering the following command:

     OMS_ORACLE_HOME/bin/emctl stop oms
     

  2. Enter the following command:

     emctl secure oms -protocol SSLv3
     

  3. Append -Dweblogic.security.SSL.protocolVersion=SSL3 to JAVA_OPTIONS in Domain_Home/bin/startEMServer.sh or startEMServer.cmd on Windows. If this property already exists, update the value to SSL3.

  4. Restart the OMS with the following command:

     OMS_ORACLE_HOME/bin/emctl start oms
     

• Mixed Mode: To configure the OMS to use both SSLv3 and TLSv1 connections, do the following:

  1. Stop the OMS by entering the following command:

     OMS_ORACLE_HOME/bin/emctl stop oms
     

  2. Enter the following command:

     emctl secure oms
     

  3. Append -Dweblogic.security.SSL.protocolVersion=ALL to JAVA_OPTIONS in Domain_Home/bin/startEMServer.sh. If this property already exists, update the value to ALL.

  4. Restart the OMS with the following command:

     OMS_ORACLE_HOME/bin/emctl start oms
     

13.4.6.1 Using the Cloud Control Console to Manage Agent Registration Passwords

You can use the Cloud Control Console to manage your existing registration passwords or create additional registration passwords:

1. From the Setup menu, select Security, then select Registration Passwords.

2. Enterprise Manager displays the Registration Passwords page (Figure 13-3). The registration password you created when you ran the emctl secure oms command appears in the Registration Passwords table.

3. Use the Registration Passwords page to change your registration password, create additional registration passwords, or remove registration passwords associated with the current Management Repository.

Figure 13-3 Managing Registration Passwords in the Cloud Control Console

When you create or edit an Agent Registration Password on the Registration Passwords page, you can determine whether the password is persistent and available for multiple Management Agents or to be used only once or for a predefined period of time.

For example, if an administrator requests to install a Management Agent on a particular host, you can create a one-time-only password that the administrator can use to install and configure one Management Agent.

On the other hand, you can create a persistent password that an administrator can use for the next two weeks before it expires and the administrator must ask for a new password.

13.4.6.2 Using emctl to Add a New Agent Registration Password

To add a new Agent Registration Password, use the following emctl command on the machine on which the Management Service has been installed:

emctl secure setpwd [sysman pwd] [new registration pwd]

The emctl secure setpwd command requires that you provide the password of the Enterprise Manager super administrator user, sysman, to authorize the addition of the Agent Registration Password.

If you change the Agent Registration Password, you must communicate the new password to other Enterprise Manager administrators who need to install new Management Agents, enable Enterprise Manager Framework Security for existing Management Agents, or install additional Management Services.

As with other security passwords, you should change the Agent Registration Password on a regular and frequent basis to prevent it from becoming too widespread.

13.4.8.1 About Oracle Advanced Security and the sqlnet.ora Configuration File

You enable security for the Management Repository by using Oracle Advanced Security. Oracle Advanced Security ensures the security of data transferred to and from an Oracle database.

To enable Oracle Advanced Security for the Management Repository database, you must make modifications to the sqlnet.ora configuration file. The sqlnet.ora configuration file is used to define various database connection properties, including Oracle Advanced Security parameters.

The sqlnet.ora file is located in the following subdirectory of the Database home:

ORACLE_HOME/network/admin

After you have enabled Security for the Management Repository and the Management Services that communicate with the Management Repository, you must also configure Oracle Advanced Security for the Management Agent by modifying the sqlnet.ora configuration file in the Management Agent home directory.

It is important that both the Management Service and the Management Repository are configured to use Oracle Advanced Security. Otherwise, errors will occur when the Management Service attempts to connect to the Management Repository. For example, the Management Service might receive the following error:

ORA-12645: Parameter does not exist

To correct this problem, be sure both the Management Service and the Management Repository are configured as described in the following sections.

13.4.8.2 Configuring the Management Service to Connect to a Secure Management Repository Database

If you have enabled Oracle Advanced Security for the Management Service database—or if you plan to enable Oracle Advanced Security for the Management Repository database—use the following procedure to enable Oracle Advanced Security for the Management Service:

1. Stop the Management Service:

   ORACLE_HOME/bin/emctl stop oms
   

2. Set Enterprise Manager operational properties by using the emctl set property command.

3. Restart the Management Service.

   ORACLE_HOME/bin/emctl start oms
   

13.4.8.3 Enabling Oracle Advanced Security for the Management Repository

To ensure your database is secure and that only encrypted data is transferred between your database server and other sources, review the security documentation available in the Oracle Database documentation library.

The following instructions provide an example of how you can confirm that Oracle Advanced Security is enabled for your Management Repository database and its connections with the Management Service:

1. Locate the sqlnet.ora configuration file in the following directory of the database Oracle Home:

   ORACLE_HOME/network/admin
   

2. Using a text editor, look for the following entries (or similar entries) in the sqlnet.ora file:

   SQLNET.ENCRYPTION_SERVER = REQUESTED
   SQLNET.CRYPTO_SEED = "abcdefg123456789"
   

   See Also:

   "Configuring Network Data Encryption and Integrity for Oracle Servers and Clients in the Oracle Application Server 10g Administrator's Guide.

3. Save your changes and exit the text editor.

13.4.8.4 Enabling Security for a Management Agent Monitoring a Secure Management Repository or Database

After you have enabled Oracle Advanced Security for the Management Repository, you must also enable Advanced Security for the Management Agent that is monitoring the Management Repository:

1. Locate the sqlnet.ora configuration file in the following directory inside the home directory for the Management Agent that is monitoring the Management Repository:

   AGENT_HOME/network/admin (UNIX)
   AGENT_HOME\network\admin (Windows)
   

2. Using a text editor, add the following entry to the sqlnet.ora configuration file:

   SQLNET.CRYPTO_SEED = "abcdefg123456789"
   

   The SQLNET.CRYPTO_SEED can be any string between 10 to 70 characters.

   See Also:

   "Configuring Network Data Encryption and Integrity for Oracle Servers and Clients in the Oracle Application Server Administrator's Guide.

3. Save your changes and exit the text editor.

4. Restart the Management Agent.

13.4.9.1 Create a Java Keystore for each OMS

1. Create a java keystore (JKS) for each OMS in the environment.

   Regardless of whether the OMS is configured with a server load balancer or not, specify the OMS machine name for CN (Example: CN=myoms.mydomain.com) while generating the Certificate Signing Request (CSR). The OMS machine name can be found from value of EM_INSTANCE_HOST property in the emgc.properties file, which can be found at the following location:

   <EM_Instance_Home>/emgc.properties

   Make a note of the keystore password, private key entry's alias, and private key password of each keystore.

   Note: Use only the signature algorithms supported by WLS.

2. Copy the keystores to corresponding OMS machines or place them in a location accessible from OMS machines.

   Example: The keystores are /scratch/oms1.jks, /scratch/oms2.jks , /scratch/oms3.jks

3. Write the CA certificates to individual files (one CA certificate per file). Either copy these certificate files to the OMS machines or place them in a location accessible from the OMS machines.

   Example: The filenames are /scratch/ca1cert.cer, /scratch/ca2cert.cer, /scratch/ca3cert.cer

13.4.9.2 Import Custom CA Certificates into the Agent's Monitoring Trust Store

Execute the following steps for all Management Agents that are installed on the OMS machines:

1. Stop the Agent

   emctl stop agent

2. Import the custom CA certificate into Agent:

   <Agent_Instance_Home>/bin/emctl secure add_trust_cert_to_jks -trust_certs_loc <ca_cert_file>-alias <certalias> [-password <montrust_jks_pwd>]
   

   Example:

   emctl secure add_trust_cert_to_jks -trust_certs_loc /scratch/ca1cert.cer-alias ca1certalias [-password welcome]
   

   Repeat this step for each CA involved in issuing the custom certificate.

   Specify different alias each time.

3. Start the Agent.

   emctl start agent

13.4.9.3 Configure the Custom Certificate for each OMS

Execute the following steps on each OMS:

1. Stop the OMS.

   <OMS_Home>/bin/emctl stop oms

2. Run the following cmd:

   <OMS_OH>/bin/emctl secure wls 
   -jks_loc <location of jks containing the custom certificate> 
   -jks_pvtkey_alias <pvtkey alias> 
   [-jks_pwd <jks pwd>] 
   [-jks_pvtkey_pwd <pvtkey pwd>]
   

   Example:

   <OMS_OH>/bin/emctl secure wls 
   -jks_loc /scratch/oms1.jks -jks_pvtkey_alias pvtkey1alias
   

3. Stop the OMS.

   <OMS_Home>/bin/emctl stop oms -all

4. Start the OMS.

   <OMS_Home>/bin/emctl start oms

13.4.9.4 Rolling back to the Demonstration Certificate

If you need to switch an OMS back to using the default WebLogic demonstration certificates, execute the following steps on each OMS.

1. Stop the OMS.

   <OMS_Home>/bin/emctl stop oms

2. Run the following command:

   <OMS_Home>/bin/emctl secure wls -use_demo_cert
   

3. Stop the OMS.

   <OMS_Home>/bin/emctl stop oms -all

4. Start the OMS.

   <OMS_Home>/bin/emctl start oms

13.4.10.1 Configuring a Third Party Certificate for HTTPS Console Users

To configure the third party certificate for HTTPS WebTier Virtual Host:

1. Create a wallet for each OMS in the Cloud. Specify the host name of the machine where the OMS is installed or the Load Balancer Name if the OMS is behind the Server Load Balancer for Common Name.

2. Run the following command on each OMS and the restart that OMS:

   emctl secure console -wallet <location of wallet>
   

   Note:

   Only single-sign-on wallets are supported.

13.4.10.2 Configuring Third Party Certificate for HTTPS Upload Virtual Host

You can configure the third party certificate for the HTTPS Upload Virtual Host in two ways:

Method I

1. Create a wallet for each OMS in the Cloud.

2. While creating the wallet, specify the host name of the machine where the OMS is installed or the Load Balancer Name if the OMS is behind the Load Balancer for Common Name.

3. Write the certificates of all the Certificate Authorities in the certificate chain (like the Root Certificate Authority, Intermediate Certificate Authority) into a file named trusted_certs.txt.

4. Download or copy the trusted_certs.txt file to the host machines on which each Agent that is communicating with the OMS is running.

5. Run the add_trust_cert command on each Agent and then restart that Agent.

   emctl secure add_trust_cert -trust_certs_loc <location of the trusted_certs.txt file>
   

6. Secure the OMS and restart it.

   emctl secure oms -wallet <location of wallet> -trust_certs_loc <loc of trusted_certs.txt> [any other options]
   

Method 2

1. Create a wallet for each OMS in the Cloud.

2. Specify the host name of the machine where the OMS is installed or the Load Balancer Name if the OMS is behind the Server Load Balancer for Common Name (CN).

3. Write the certificates of all the Certificate Authorities in the certificate chain (like the Root Certificate Authority, Intermediate Certificate Authority) into a file named trusted_certs.txt.

4. Restart the OMS after it has been secured.

   emctl secure oms -wallet <location of wallet> -trust_certs_loc <loc of trusted_certs.txt> [any other options]
   

5. Either re-secure the Agent by running the emctl secure agent command (should be run on all Agents) or import the trust points by running the emctl secure add_trust_cert -trust_certs_loc <location of the trusted_certs.txt file> command. The -trust_certs_loc parameter must contain the path and the filename of the trusted_certs.txt file.

   Note:

   This file must only contain certificates in base64 format and no special characters or empty lines.

13.5.1.1 Named Credential

Credentials are stored within Enterprise Manager as "named" entities. Administrators define and store credentials within Enterprise Manager and refer to the credential by a credential name. Named credentials can be a username/password, or a public key-private key pair. An Enterprise Manager administrator can then use the named credential for performing operations like running jobs, patching and other system management tasks. For example, an administrator can store the username and password they want to use for patching as "MyPatchingCreds". He can later submit a patching job that uses "MyPatchingCreds" to patch a production databases.

There are two categories of named credentials:

• Global Named Credential

  A global named credential is an entity, which is not associated with any Enterprise Manager object. Global named credentials consist of the authentication scheme along with any authentication parameters. Because these are independent entities, an Enterprise Manger administrator can associate these credentials with objects at a later time.

• Target Named Credentials

  Target named credential is an entity which are associated with individual targets at the time of creation. This entity will also contain authentication scheme along with authentication parameters for a specific target.

Access Control for Named Credentials

The access control model for credentials adhere to the following rules:

• Only credential owners can grant privileges on their credential objects to other users.

• Enterprise Manager Super Administrators cannot obtain any privileges on a newly created credential until he is explicitly granted privileges on the credential object.

• Enterprise Manager administrators, regardless of privilege level, cannot see the sensitive fields such as passwords and private keys from the console UI.

• Credentials privileges cannot be assigned to a role. This eliminates back door entry by Enterprise Manager Super Administrators to grant themselves privileges on the credentials for which they do not have explicit access.

• An Enterprise Manager administrator cannot view other administrators' credentials unless an explicit grant is provided. Even Enterprise Manager Super Administrators cannot view other users' credentials.

• Any Enterprise Manager administrator can create his own credentials and have FULL privileges on the credentials owned.

Enterprise Manager Administrators will be able to grant privileges to other administrators while creating the credential or by granting the privileges when editing the credential.

All the credentials owned by an Enterprise Manager administrator will be deleted if that administrator is deleted from Enterprise Manager. Since access to shared credentials is not automatically granted to Super Administrators, re-assigning named credentials belonging to a regular Enterprise Manager administrator by a Super Administrator is not allowed.

Credential Privilege Levels

The following privilege levels are available for all credentials:

• VIEW: An administrator with VIEW privileges on other administrator's credentials will be able to view the structure and username of the credential. Sensitive information of the credential such as the password will never be shown. Administrators with VIEW privilege on a credential will also be able to use the credentials for running jobs, patching and other system management operations within Enterprise Manager.

• EDIT: Allows an Enterprise Manager administrator to change a sensitive information such as the password, or the public/private key pair of the credential. The administrator will not be able to change the Authentication Scheme of the credential. The username for the credential cannot be changed.

• FULL: Allows an Enterprise Manager administrator to change the credential username, sensitive information such as the password or the public/private key pair, and authentication scheme. An administrator with FULL privilege on a named credential will be able to delete the named credential.

To create or edit a named credential, from the Setup menu, choose Security and then Named Credential. The Named Credential page displays as shown in the following figure.

Figure 13-4 Named Credentials Page

From the Named Credential page, you can Create a new named credential, Edit an existing credential, Manage Access (grant/revoke privileges), Delete, Test, View References, or click the Query by Example icon to filter the list of named credentials.

13.5.1.2 Job Credentials

The job system uses the credential subsystem to retrieve the credentials required to submit a job on the targets. The administrator can define their preferred and default credentials from the Setup menu, choose Security and then Preferred Credentials page. As an administrator, you can perform the following when submitting a job:

• Use Preferred Credentials

• Use Named Credentials

• Create new credentials

13.5.1.3 Monitoring Credentials

These credentials are used by the Management Agent to monitor certain types of targets. For example, most database monitoring involves connecting to the database, which requires a username, password, and optionally, a role. Monitoring credentials, if stored in the repository, can also be potentially used by management applications to connect directly to the target from the OMS.

To create or edit a monitoring credentials, from the Setup menu, choose Security and then Monitoring Credentials. The Monitoring Credentials page displays as shown in the following figure.

Figure 13-5 Monitoring Credentials

To modify monitoring credentials, select the desired target type and click Manage Monitoring Credentials. The monitoring credentials page for the selected target type displays.

13.5.1.4 Collection Credentials

These credentials are associated with metric extensions and older user-defined metrics.

13.5.1.5 Preferred Credentials

Preferred credentials are used to simplify access to managed targets by storing target login credentials in the Management Repository. With preferred credentials set, users can access an Enterprise Manager target that recognizes those credentials without being prompted to log in to the target. Preferred credentials are set on a per user basis, thus ensuring the security of the managed enterprise environment.

• Default Credentials: Default credentials can be set for a particular target type and will be available for all the targets of the target type. It will be overridden by target preferred credentials.

• Target Credentials: Target credentials are preferred credentials set for a particular target. They could be used by applications such as the job system, notifications, or patching. For example, if the user chooses to use preferred credentials while submitting a job, then the preferred credentials set for the target (target credentials) will be used. If the target credentials are not present, the default credentials (for the target type) will be used. If the default credentials are not present, the job will fail. If not specified, by default, preferred credentials refer to preferred target credentials"

For example, to set the host preferred credentials, from the Setup menu, choose Security and then Preferred Credential. In the Preferred Credentials page, select the Host target type from the table and click Manage Preferred Credentials. The Host Preferred Credentials are displayed.

Figure 13-6 Host Preferred Credentials

On this page, you can set both default and explicit preferred credentials for the host target types.

13.5.1.6 Managing Credentials Using EM CLI

You can manage passwords using EM CLI verbs. Using EM CLI, you can:

• Change the database user password in both the target database and Enterprise Manager.

  emcli update_db_password -change_at_target=Yes|No -change_all_reference=Yes|No
  

• Update a password which has already been changed at the host target.

  emcli update_host_password -change_all_reference=Yes|No
  

• Set preferred credentials for given users.

  emcli set_preferred_credential
  -set_name="set_name"
  -target_name="target_name"
  -target_type="ttype"
  -credential_name="cred_name"
  [-credential_owner ="owner]"
  

  And

  emcli set_preferred_credential
  -set_name="set_name"
  -target_name="target_name"
  -target_type="ttype"
  -credential_name="cred_name"
  [-credential_owner ="owner]"
  

For detailed descriptions of these verbs, refer to the Enterprise Manager Command Line Interface guide.

13.5.2.1 Setup Example Session

To generate, manage, or convert SSH authentication keys, you use the SSH-keygen utility available on UNIX systems. This utility SSH-keygen tool provides different options to create with different strengths RSA keys for SSH protocol version 1 and RSA or DSA keys for use by SSH protocol version 2.

$ ssh-keygen -t rsa      

Generating public/private rsa key pair.
Enter file in which to save the key (/home/myhome/.ssh/id_rsa):  

Enter passphrase (empty for no passphrase)

Enter same passphrase again: (empty for no passphrase)
Your identification has been saved in /home/admin1/.ssh/id_rsa.
Your public key has been saved in /home/admin1/.ssh/id_rsa.pub.
The key fingerprint is:
bb:da:59:7a:fc:24:c6:9a:ee:dd:af:da:1b:1b:ed:7f admin1@myhost2170474

$ ls   
id_rsa  id_rsa.pub

$ cp id_rsa.pub  authorized_keys   

$ ssh myhost  
The authenticity of host 'myhost (10.229.147.184)' can't be established.
RSA key fingerprint is de:a0:2a:d5:23:f0:8a:72:98:74:2c:6f:bf:ad:5b:2b.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'myhost,10.229.147.184' (RSA) to the list of known hosts.
Last login: Mon Aug 29 16:48:45 2012 from anotherhost.example.com
$

You are now ready to add the credential to Enterprise Manager.

1. From the Setup menu, select Security, then select Named Credentials.

2. On the Named Credentials page, click Create. The Create Credential page displays.

3. Enter a Credential Name. For example, SSHCRED1.

   Note: The SSHCRED1 credential set will be used in Section 13.5.2.2, "Setting Up Host Preferred Credentials Using SSH Key Credentials"

4. Select Host from the Authenticating Target Type drop-down menu.

5. Select SSH Key Credentials from the Credential Type drop-down menu as shown in the following figure.

   
   

6. Ensure that the SSH private key/public key files have been copied to the host on which the browser is running.

7. From the Credential Properties region, click Browse for Public Key and Private Key to upload the generated public key/private key files.

8. Click Test and Save to verify the credentials and save them. The new named credential will appear as shown in the following figure.

Figure 13-7 Named Credential Using SSH Keys

13.5.2.2 Setting Up Host Preferred Credentials Using SSH Key Credentials

You can set up host preferred credentials to use SSH keys by creating a new credential set that uses the HostSSHCreds credential type. Enterprise Manager administrators then set up preferred credentials that use this credential set. Each Enterprise Manager target type can have one or more preferred credential sets of pre-defined credential types.

The following steps use EM CLI to create a host preferred credential set which supports SSH key credentials. This example assumes the existence of the named credential SSHCRED1 of type SSH Key Credentials created in the previous section.

1. Log into EM CLI as an Enterprise Manager Super Administrator.

2. Create a new credential set of type HostSSHCreds.

   $ emcli create_credential_set -set_name=HostSSHCredSet -target_type=host -supported_cred_types=HostSSHCreds
   
   Credential set "HostSSHCredSet" created successfully.
   

   Once the credential set is created, Enterprise Manger administrators can set up preferred credentials for this newly created credential set using either EM CLI or the Enterprise Manager console.

3. Set up Preferred Credentials for the newly created credential set. You can use EM CLI or the Enterprise Manger console. The following EM CLI example assumes a named credential called SSHCRED1 of type SSH Key Credentials has already been created.

   $ emcli set_preferred_credential -target_type=host -target_name=myhost.oracle.com -set_name=HostSSHCredSet -credential_name=SSHCRED1
   
   Successfully set preferred credentials for target myhost.oracle.com:host.
   

Once the credential set is created and preferred credentials have been set up, whenever the HostSSHCredSet credential set is used for any of the Enterprise Manager operation, that operation will use SSH credentials as defined in the named credential SSHCRED1. The following graphic shows the HostSSHCredSet credential set listed as a default preferred credential for host targets.

You can now set the preferred credentials of regular regular Enterprise Manager administrators to use the SSHCRED1 named credential by editing/creating an administrator and granting Named Credential resource privileges. The following graphic shows the manage privilege grants UI for named credentials.

13.5.3.1 Configuring PAM for RHEL4 Users

For users on RHEL4, the PAM file configuration is as follows:

#%PAM-1.0
auth required pam_ldap.so
account required pam_ldap.so
password required pam_ldap.so
session required pam_ldap.so

For more details, see https://www.redhat.com/docs/manuals/enterprise/RHEL-4-Manual/ref-guide/s1-pam-format.html

13.5.3.2 Configuring PAM for AIX Users

For AIX users, use the edit/etc/pam.conf file and add the following lines:

emagent auth    required        /usr/lib/security/pam_aix
emagent account required        /usr/lib/security/pam_aix
emagent password  required      /usr/lib/security/pam_aix
emagent session required        /usr/lib/security/pam_aix

After editing the file, apply patch 5527130 and run root.sh

13.5.4.1 Creating a Privilege Delegation Setting

Enterprise Manager allows you to create privilege delegation settings either by creating the setting directly on a host target, or by creating a Privilege Delegation Setting Template that you can apply to multiple hosts.

Administrators with Full privileges on host targets can create privilege delegation settings for that host. Administrators with View privileges on these host targets will be able to view those privilege delegation settings. Enterprise Manager Super Administrators can configure privilege delegation settings for any host target.

To create a privilege delegation setting directly on a host:

1. From the Setup menu, select Security, then select Privilege Delegation. The following screen is displayed:

   Figure 13-8 Manage Privilege Delegation Settings

   
   

2. For any host target appearing in the table, click Edit. Enterprise Manager takes you to the Host Privilege Delegation Setting page.

3. Select a privilege delegation type (Sudo or PowerBroker).

4. Enter the privilege delegation command to be used and, in the case of PowerBroker, the optional Password Prompt.

5. Click Update to apply the settings to the host. The following figure shows the Host Privilege Delegation Setting window that you can use to create a PowerBroker setting.

   Figure 13-9 Host Privilege Delegation Setting - PowerBroker

   
   

   Once you have created a privilege delegation setting, you must apply this setting to selected targets. This setting can be applied to one more hosts or to a composite (Group) target (the group must contain at least one host target). You can apply a Privilege Delegation setting using the Cloud Control console. From the Setup menu, choose Security and then Privilege Delegation.

13.5.4.2 Sudo Configuration

Enterprise Manager uses a trust-based model that permits specification of responsibilities with a high degree of granularity. Administrators can set up sudo or pbrun configuration entries to assign specific Enterprise Manager functional privileges to their OS users. The Management Agent executable nmosudo allows administrators to configure sudo/pbrun such that a less privileged user can run nmosudo as a more privileged user.

In the following example, an administrator wants user 'joe' to run any Enterprise Manager job as user 'oracle'. The corresponding entry in the /etc/sudoers file would be:

(JOB_USERS) ALL : (RUNAS_USERS) AGENT_INSTANCE_HOME/bin/nmosudo *

Where 'joe' is in the JOB_BACKUP_USERS list and 'oracle' is in the RUNAS_USERS list.

Enterprise Manager guarantees that the nmosudo executable only honors requests to run remote operation requests from the OMS via the Agent. nmosudo will not run the remote operation if it cannot validate that the request came from the Agent. Thus, as shown in the example above, it will not be possible for user 'joe' to invoke nmosudo directly from the command line and run a Perl script as user 'oracle'.

13.5.4.3 Updating the PDP Configuration File

The Management Agent uses nmosudo to run Trusted Jobs in Enterprise Manager. For PDP configuration settings, you should enter the location of nmosudo in your configuration file.

In Enterprise Manager Cloud Control 12c Release 1 (12.1.0.1) [with or without Bundle Patch 1], nmosudo was located in the agent instance directory. For example, /u01/oracle/agent/agent_inst/bin/nmosudo.

In Enterprise Manager Cloud Control 12c Release 2 (12.1.0.2), this location has changed. Now, nmosudo is present in the sbin directory, which is in the agent base directory. For example, /u01/oracle/agent/sbin/nmosudo.

Therefore, when you install or upgrade to Enterprise Manager Cloud Control 12c Release 2 (12.1.0.2), you must modify the PDP configuration files to update the new location of nmosudo.

For example, if you use SUDO as your PDP, the configuration file for sudo is typically /etc/sudoers. In this file, update the following entry with the new location to nmosudo.

sudouser ALL : oracle /eminstall/basedir/sbin/nmosudo *

13.6.2.1 emctl status emkey

This command shows the health or status of the emkey. Depending on the status of the emkey, the following messages are displayed:

• When the emkey has been correctly configured in the Credential Store, the following message is displayed.

  Example 13-12 emctl status emkey - Example 1

  Oracle Enterprise Manager 12c Release 1 Cloud Control
  Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
  The EmKey is configured properly, but is not secure. Secure the EmKey by running "emctl config emkey -remove_from_repos"
  

• When the emkey has been correctly configured in the Credential Store and has been removed from the Management Repository, the following message is displayed.

  Example 13-13 emctl status emkey - Example 2

  Oracle Enterprise Manager 12c Release 1 Cloud Control
  Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
  The EMKey is configured properly.
  

• When the emkey is corrupted in the Credential Store and removed from the Management Repository, the following message is displayed.

  Example 13-14 emctl status emkey - Example 3

  Oracle Enterprise Manager 12c Release 1 Cloud Control
  Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
  The EMKey is not configured properly or is corrupted in the credential store and does not exist in the Management Repository. To correct the problem:1) Get the backed up emkey.ora file.
  2) Configure the emkey by running "emctl config emkey -copy_to_credstore_from_file"
  

13.6.2.2 emctl config emkey -copy_to_credstore

This command copies the emkey from the Management Repository to the Credential Store.

emctl config emkey -copy_to_credstore [-sysman_pwd <pwd>]
Oracle Enterprise Manager 12c Release 1 Cloud Control  
Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
The EMKey has been copied to the Credential Store.

13.6.2.3 emctl config emkey -copy_to_repos

This command copies the emkey from the Credential Store to Management Repository.

emctl config emkey -copy_to_repos [-sysman_pwd <pwd>]Oracle Enterprise Manager 12c Release 1 Cloud Control  Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.The EMKey has been copied to the Management Repository. This operation will cause the EMKey to become unsecure.After the required operation has been completed, secure the EMKey by running "emctl config emkey -remove_from_repos".

13.6.2.4 emctl config emkey -copy_to_file_from_credstore

This command copies the emkey from the Credential Store to a specified file.

emctl config emkey -copy_to_file_from_credstore -admin_host <host> -admin_port
<port> -admin_user <username> [-admin_pwd <pwd>] [-repos_pwd <pwd>] -emkey_file
<emkey file>
Oracle Enterprise Manager 12c Release 1 Cloud Control  
Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
The EMKey has been copied to file.

13.6.2.5 emctl config emkey -copy_to_file_from_repos

This command copies the emkey from the Management Repository to a specified file.

emctl config emkey -copy_to_file_from_repos (-repos_host <host> -repos_port <port>
-repos_sid <sid> | -repos_conndesc <conn desc>) -repos_user <username> [-repos_pwd
<pwd>] [-admin_pwd <pwd>] -emkey_file <emkey file>Oracle Enterprise Manager 12c Release 1 Cloud Control  Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.The EMKey has been copied to file.

13.6.2.6 emctl config emkey -copy_to_credstore_from_file

This command copies the emkey from a specified file to the Credential Store.

emctl config emkey -copy_to_credstore_from_file -admin_host <host> -admin_port <port> -admin_user <username> [-admin_pwd <pwd>] [-repos_pwd <pwd>] -emkey_file <emkey file>
Oracle Enterprise Manager 12c Release 1 Cloud Control  
Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
The EMKey has been copied to the Credential Store.

13.6.2.7 emctl config emkey -copy_to_repos_from_file

This command copies the emkey from a specified file to the repository.

emctl config emkey -copy_to_repos_from_file (-repos_host <host> -repos_port <port>
-repos_sid <sid> | -repos_conndesc <conn desc>) -repos_user <username> [-repos_pwd
<pwd>] [-admin_pwd <pwd>] -emkey_file <emkey file>
Oracle Enterprise Manager 12c Release 1 Cloud Control  
Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
The EMKey has been copied to the Management Repository. This operation will cause
the EMKey to become unsecure.
After the required operation has been completed, secure the EMKey by running "emctl config emkey -remove_from_repos".

13.6.2.8 emctl config emkey -remove_from_repos

This command removes the emkey from the repository.

emctl config emkey -remove_from_repos [-sysman_pwd <pwd>]
Oracle Enterprise Manager 12c Release 1 Cloud Control  
Copyright (c) 1996, 2011 Oracle Corporation.  All rights reserved.
The EMKey has been removed from the Management Repository.

13.6.3.1 Installing the Management Repository

A new emkey is generated as a strong random number when the Management Repository is installed.

13.6.3.2 Installing the First Oracle Management Service

When the Oracle Management Service is installed, the Installer copies the emkey to Credential Store and removes it from repository (emkey is secured out-of-box).

13.6.3.3 Upgrading from 10.2 or 11.1 to 12.1

The Management Repository is upgraded as usual. When upgrading the OMS, the omsca (OMS Configuration Assistant) copies the emkey to Credential Store and removes from repository. If the emkey is already secured before upgrade or has been removed from repository, then omsca reads the emkey from emkey.ora file present in old OMS Oracle Home and copies it to Credential Store.

• Note:

  After all the Oracle Management Service have been upgraded, you can secure the emkey, that is, remove it from the Management Repository by running the following command:

  emctl config emkey -remove_from_repos

13.6.3.4 Recreating the Management Repository

When the Management Repository is recreated, a new emkey is generated. This new key will not be in synchronization with the existing emkey in the Credential Store.

1. Copy the new emkey to Credential Store by using the emctl config emkey -copy_to_credstore command.

2. Take a backup by entering the emctl config emkey -copy_to_file_from_repos command or the emctl config emkey -copy_to_file_from_credstore command.

3. Secure the emkey by using the emctl config emkey -remove_from_repos command.

13.8.1.1 Changing the SYSMAN User Password

To change the password of the SYSMAN user, you use the following command:

emctl config oms -change_repos_pwd [-old_pwd <old_pwd>] [-new_pwd <new_pwd>] [-use_sys_pwd [-sys_pwd <sys_pwd>]]

1. Stop all OMS instances.

   emctl stop oms

2. For each OMS, run the following command:

   emctl config oms -change_repos_pwd'

3. Restart the Administration Server and all OMS instances.

   emctl stop oms -all

   emctl start oms

13.8.1.2 Changing the MGMT_VIEW User Password

To change the password of the MGMT_VIEW user, you use the following command:

emctl config oms -change_view_user_pwd [-sysman_pwd <sysman_pwd>] [-user_pwd <user_pwd>] [-auto_generate] 

Important: In order to change the MGMT_VIEW password, you must ensure that the password of the WebLogic administrative user in the credential store matches the actual password of the user SYSMAN. If the credentials do not match, the connection to the Repository Database fails and the SYSMAN password cannot be modified

1. Stop all OMS instances.

   emctl stop oms -all

2. Execute the following command to update the WebLogic and nodemanager passwords in the Credential store:

   cd <OMS_HOME>/bin
   emctl secure create_admin_creds_wallet -admin_pwd <existing weblogic pwd> -nodemgr_pwd <existing nodemanager pwd>
   

3. Log in to the Management Repository database as a DBA user and execute the following to manually modify the password of the sysman_mds schema to the new password that will be set for the sysman user:

   SQL> alter user sysman_mds identified by <new_pwd of sysman user>;
   

4. For ONE of the OMSs, run the following command to modify the SYSMAN password::

   cd <OMS_HOME>/bin
   emctl config oms -change_repos_pwd -change_in_db -old_pwd <new_pwd> -new_pwd <new_pwd>
   

5. Restart the AdminServer and all the OMSs.

   emctl stop oms -all

   emctl start oms

13.8.2.1 Responding to the Internet Explorer Security Alert Dialog Box

Security is enabled by default for the Management Service. However, if you have not enabled the more extensive security features of your web tier, you will likely receive the following warning: "There is a problem with this Web site's security certificate." This occurs when you first attempt to display the Cloud Control console using the HTTPS URL in Internet Explorer.

Figure 13-12 Internet Explorer Security Alert

When Internet Explorer displays the certificate warning page, use the following instructions to install the certificate and avoid viewing this page again in future Enterprise Manager sessions:

1. From the certificate warning page, click Continue to this Web site (not recommended).

   Internet Explorer displays a Security Warning dialog.

   
   

2. Click Yes. Internet Explorer may display a Security Alert dialog if you have not selected In the future, do not show this warning. in a previous Internet Explorer session. Click OK to dismiss the dialog.

   
   

3. The Enterprise Manager console logon page displays.

4. At the top of the browser, click Certificate Error to display the Security Report pop-up.

   
   

5. Click View Certificates. The Certificates dialog appears.

   
   

6. Click the Certificate Path tab and select the first entry in the list of certificates as shown in the following graphic.

   
   

7. Click View Certificate to display a second Certificate dialog box.

8. Click Install Certificate to display the Certificate Import wizard.

9. Accept the default settings in the wizard, click Finish when you are done.

   Internet Explorer displays a Security Warning asking if you want to install the certificate. Click Yes. Internet Explorer will display a message stating that the certificate was imported successfully.

10. Click OK to close each of the security dialog boxes and click Yes on the Security Alert dialog box to continue with your browser session.

    You should no longer receive the Security Alert dialog box in any future connections to Enterprise Manager when you use this browser.

13.8.2.2 Responding to the Mozilla Firefox New Site Certificate Dialog Box

Firefox will also issue a connection warning if you have not enabled its more extensive security features. When you first attempt to display the Cloud Control console using the HTTPS URL in Mozilla Firefox, you will receive a warning because the connection is untrusted.

When Firefox displays the Untrusted Connection page, use the following instructions to install the certificate and avoid viewing this page again in future Enterprise Manager sessions:

1. Review the instructions and information. Click I Understand the Risks. Firefox displays additional information and the opportunity to add the certificate.

2. Click Add Exception... . Firefox displays the Add Security Exception dialog.

   
   

3. Ensure that the Permanently store this exception option is selected.

   You should no longer receive the New Site Certificate dialog box when using the current browser.

4. Click Confirm Security Exception. The Enterprise Manager console displays.

You will no longer receive the untrusted connection warning in any future connections to Enterprise Manager when you use this browser

13.8.2.3 Responding to the Google Chrome Security Alert Dialog Box

Google Chrome issues a warning if the security certificate of the Website is not trusted. When you first attempt to display the Cloud Control console using the HTTPS URL in Google Chrome, you will receive a warning because the connection is mistrusted.

When Google Chrome displays the Untrusted Connection page, use the following instructions to install the certificate and avoid viewing this page again in future Enterprise Manager sessions:

1. Click the Certificate Error icon on the left hand side of the URL address bar.

   
   

2. Click Certificate Information in the menu.

3. Select the Certification Path tab.

4. Select the OMS host name (a red cross icon).

5. Click View Certificate.

   
   

6. Select the Details tab.

7. Click Copy to File...

   
   

   A wizard guides you through the process. Follow the wizard and select all the default options.

8. Save the certificate on your Desktop. For example, you can save it as:

   adc1110000.cer
   

9. From the Google Chrome menu, go to Tools, click Settings, and then select Show Advanced Settings.

10. Click Manage Certificates.

11. Select the Trusted Root Certification Authority tab.

12. Click Import.

    A wizard guides you through the process of importing the saved certificate.

    A warning window displays a message that the certificate you are importing cannot be verified and asks if you want to continue. Click Yes to proceed.

13. Check if the saved certificate appears in the Trusted Root Certification Authority table.

14. Restart the Google Chrome browser and load the Enterprise Manager URL. If the Certificate Error icon is not visible in the address bar, then the certificate is valid and trusted.

13.8.2.4 Responding to Safari Security Dialog Box

Safari does not support the option to install a certificate individually. To solve this issue, you have to obtain a trusted certificate from a vendor of your choice.