2 Setting Up Your Infrastructure

Setting Up Named Credentials

To create a named credentials, follow these steps:

1. In Cloud Control, from the Setup menu, select Security, then select Named Credentials.

2. On the Named Credentials page, click Create.

3. On the Create Credentials page, in the General Properties section, provide the following details:

   1. Enter a unique Credential Name, and provide a description.

   2. Select Host as the Authentication Target Type, and Host Credentials as the Credential type

   3. Select Global to use the same credentials for all the targets.

4. On the Create Credentials page, in the Credential Properties section, enter the UserName and Password required to access the host machine, and from the Run Privilege drop down list, do one of the following:

   • Select None, if you are using operating system host credentials (like Oracle) or the Oracle Home Owner credentials.

   • When you do not have access to the operating system host credentials or the root credentials of the host machine, then select Sudo or PowerBroker to sudo (or pbrun)to the host machine using the credentials of another operating system user. To use the credentials of other users, in the Run As field, you need to enter operating system host credentials (like Oracle) or Oracle Home owner credentials of the host user.

   
   

5. On the Create Credentials page, in the Access Control section, click Add Grant to grant privileges on the named profile to the selected Administrators or roles. By default the selected Administrator is granted View privilege.

   Note:

   To enable Administrators (or users) to access, and leverage an OMS Agent Filesystem Software Library Location, the owner of the Named Credential must ensure that an explicit View privilege is granted to all the Administrators accesssing the OMS Agent location. To do so, you can either click Add Grant and add the names of the administrators while creating the Named Credential as mentioned in this section, or edit an existing Named Credential to grant privileges to other Administrators (or users) by following these steps:

   1. In Cloud Control, from the Setup menu, select Security, then select Named Credentials.

   2. On the Named Credentials page, click Manage Access.

   3. On the Manage Access page, click Add Grant to add a user, or Change Privilege to edit the privileges of an existing user.

   4. Click Save.

   For example, if you have a Cloud Plug-in installed, and are using the Cloud features in Enterprise Manager, then ensure that the CLOUD_ENGINE_USER is also granted View privileges on credentials associated with Software Library. Since the CLOUD_ENGINE_USER is a hidden user account, the owner of the named credential will not be able to grant him View privileges from the Enterprise Manager UI. To handle this situation, (especially on a Windows host where OMS Agent Filesystem is the recommended approach for setting up Software Library) you can run the following EMCLI commands:

   emcli login -username=<username -password =<>
   emcli grant_privs -name=CLOUD_ENGINE_USER -privileges="GET_CREDENTIAL;CRED_ANME=<>:CRDED_OWNER=<>
   

   To change the privilege, select the administrator, and click Change Privilege. In the Select Privilege dialog box, change the privilege to Edit or Full, and then click OK.

6. After entering all the details, click Test and Save. If the host credentials are correct, then the test is successful and the credentials get saved.

Setting Up Privileged Credentials

To create a privileged credentials, follow these steps:

1. Create the Named credentials using the steps mentioned in Setting Up Named Credentials.

2. On the Named Credentials page, select the credential, and then click Edit.

3. On the Edit Credential Properties page, in the Credential Properties section, edit the existing UserName and Password required to access the host machine, and from the Run Privilege drop down list, do one of the following:

   • Select None, if you are using operating system host credentials (like Oracle) or the Oracle Home Owner credentials.

   • When you do not have access to the operating system host credentials or the root credentials of the host machine, then select Sudo or PowerBroker to sudo (or pbrun)to the host machine using the credentials of another operating system user. To use the credentials of other users, in the Run As field, you need to enter operating system host credentials (like Oracle) or Oracle Home owner credentials of the host user.

Configuring Privilege Delegation Settings

Cloud Control allows you to run Deployment Procedures using authentication utilities such as SUDO, PowerBroker, and so on. This support is offered using the Privilege Delegation mechanism available in Cloud Control. Privilege Delegation is a framework that allows you to use either SUDO or PowerBroker to perform an activity with the privileges of another user (locked accounts).

All the Deployment Procedures offered by Cloud Control require administrator privileges to run. While most steps within a Deployment Procedure can be run as a normal user, there are some steps that require special permissions and privileges, and unless you provide the administrator's credentials, you cannot proceed with the deployment.

Under such circumstances, you can do one of the following. Although the former option is recommended, you are always free to use the latter option to suit your needs.

• Customize the Deployment Procedure to disable the steps that require special privileges, run the other steps as a normal user, and have the administrator run the disabled steps later.

• Use authentication utilities to run some steps within the Deployment Procedure with the privileges of another user. The authentication utilities supported by Cloud Control are SUDO and PowerBroker. This support is offered using the Privilege Delegation mechanism available in Cloud Control. For more information, see Creating Privilege Delegation Templates.

In particular, this section covers:

• Using Privilege Delegation

• Setting up Privilege Delegation

• Creating Privilege Delegation Templates

• Testing Privilege Delegation Settings

Setting up Privilege Delegation

Using Privilege Delegation you can ensure that the host user has enough privileges to become a root user, and run root scripts for completing any lifecycle management requirements for your enterprise.

Primarily, there are two approaches for delegating privileges:

• Updating the SUDOERS File or PBRUN Config File

• Setting Privileges From Oracle Enterprise Manager Cloud Control

Updating the SUDOERS File or PBRUN Config File

You can either use SUDO or Pluggable Authentication Module (PAM) (for example : pbrun (PowerBroker), suexec, and so on) as an authentication tool to perform activity over an Oracle Home, when the owner of the Oracle home is not known or locked.

This section covers both the approaches:

• Using SUDO Authentication Utility

• Using PBRUN (PowerBroker) Authentication Utility

Using SUDO Authentication Utility

If you want to use SUDO authentication utility, then before editing a Deployment Procedure, update the /etc/sudoers file to allow a normal user to switch to another user who has the privileges to run the Deployment Procedure. Also, if you want to restrict the normal user to have SUDO access only to certain commands, then specify a list of those commands for which SUDO access is required.

Host level setup can be done manually using Privilege Delegation. If a user running a procedure requires SUDO access to Oracle user and Root user for running the some commands, then you must edit the Sudoers file to add privileges to these commands.

In Enterprise Manager Cloud Control 12c Release 1 (12.1.0.1) [with or without Bundle Patch 1], nmosudo was located in the agent instance directory. For example, /u01/oracle/agent/agent_inst/bin/nmosudo.

In Enterprise Manager Cloud Control 12c Release 2 (12.1.0.2), this location has changed. Now, nmosudo is present in the sbin directory, which is in the agent base directory. For example, /u01/oracle/agent/sbin/nmosudo.

Therefore, when you install or upgrade to Enterprise Manager Cloud Control 12c Release 2 (12.1.0.2), you must modify the PDP configuration files to update the new location of nmosudo.

For example, if you use SUDO as your PDP, the configuration file for sudo is typically /etc/sudoers. In this file, update the following entry with the new location to nmosudo.

sudouser ALL : oracle /eminstall/basedir/sbin/nmosudo * 

#Sample sudoersfile should have following entry#

If you do not have access to oracle and root accounts, then add the following entries into the file:
johndoe ALL=(oracle) /u01/oracle/agent/sbin/nmosudo
johndoe ALL=(root) /u01/oracle/agent/sbin/nmosudo

If you have access to the oracle account, but not to the root account, then only add the following entry into the file:
johndoe ALL=(root) /u01/oracle/agent/sbin/nmosudo

Where,
johndoe refers to the user who has been given the SUDO access to Oracle and Root accounts for running the nmsudo command.

Note:

To preserve the environment variable details, update privilege delegation settings to include -E parameter. However, to use the -E option in the SUDO command, you must upgrade to the SUDO version 1.7.2 or higher. The following examples describes the usage of -E option:

sudo -E -u %RUNAS% %COMMAND%.

Using PBRUN (PowerBroker) Authentication Utility

If you want to use PBRUN authentication utility, then before editing a Deployment Procedure, update the /etc/pb.conf file to allow a normal user to switch to another user who has the privileges to run the Deployment Procedure.

For example, a typical PBRUN config file must look like this:

A typical pbrun config file from /etc/pb.conf file config

if(user=="johndoe")
if(command=="/usr/oracle/agent/agent12c/agent_inst/bin/nmosud" ) 
// /usr/oracle/agent/agent12c/ is the Agent Home
{
   switch (requestuser
   {
      case "root":
         runuser="root";
         break;
      case "oracle":
         runuser="oracle";
         break;
      default:
      reject;
     }
 accept;
}

Setting Privileges From Oracle Enterprise Manager Cloud Control

For setting privileges from Cloud Control, follow these steps:

1. In Cloud Control, from the Setup menu, select Security, then select Privilege Delegation.

2. On the Manage Privilege Delegation Setting page, select the host name, and then click Edit.

3. On the Host Privilege Delegation Setting: <target name> page, select Sudo or PowerBroker, and specify the location where SUDO or PowerBroker is located (for PowerBroker, you can optionally provide the password prompt) to configure the host with a Privilege Delegation setting.

4. Click Update.

Creating Privilege Delegation Templates

If you want to use Privilege Delegation authentication utility, then before editing a Deployment Procedure, create a Privilege Delegation template with the required settings for a host.

To do so, follow these steps:

1. In Cloud Control, from the Setup menu, select Security, then select Privilege Delegation.

2. On the Manage Privilege Delegation Settings page, from the Related Links section, click Manage Privilege Delegation Settings Template.

3. On the Manage Privilege Delegation Settings Templates page, from the Create list, select a privilege delegation type, either Sudo or PowerBroker, and click Go.

4. On the Create '<delegation type>' Setting Template page, provide a name for the template and specify the location where SUDO or PowerBroker is located (for PowerBroker, you can optionally provide the password prompt), and click Save.

   For example, if you select SUDO, and if sudo is located in the /usr/sbin/directory, then in the Sudo Command field you need to enter /usr/sbin/sudo -E -u %RUNAS% %COMMAND%.

5. On the Manage Privilege Delegation Setting page, select the template you created and click Go.

6. On the Apply '<delegation type>' Setting: New page, click Add Targets to apply the privilege delegation template settings to selected hosts, and click Apply.

   Note:

   If you do not apply the privilege delegation template to a target, and if you configure a step in the deployment procedure to run in Privilege Delegation mode, then the deployment procedure for that target runs the step in normal mode instead.

Saving Preferred Credentials

Cloud Control allows you the flexibility of saving the Named and the Privileged Credentials for future use as Preferred Credentials.

This section includes:

• Saving Preferred Credentials for Hosts and Oracle Homes

• Saving Preferred Credentials to Access My Oracle Support

Overview of User Accounts

From the Cloud Control, you can create and manage new Enterprise Manager Administrator accounts. Each administrator account includes its own login credentials, as well as a set of roles and privileges that are assigned to the account.

Based on the accesses, the users can be classified as follows:

• Super Administrator

• Designers (EM_ALL_DESIGNER)

• Operators (EM_ALL_OPERATOR)

Super Administrators

Super Administrators are powerful Cloud Control administrators with full access privileges on all targets. They are responsible for creating and administering accounts within the Cloud Control environment. For example, Super Administrators create the Designer and Operator roles, and grant these roles to different users and groups within their enterprise.

Designers

Designers are lead administrators with increased privileges on Deployment Procedures and Software Library. Starting with Cloud Control, designers can create deployment procedure templates using the Lock down feature, and save these templates to enforce standardization and consistency. Operator privileges are granted on these templates so that administrators who login as Operators can launch these templates, and run the Deployment Procedure successfully. Doing this ensures that the procedures are less error prone, and more consistent.

For more information about saving deployment procedures using lock downs, see Saving and Launching the Deployment Procedure with Lock Down

Designers are responsible for performing all the design-time activities like:

• Creating the provisioning profiles in the Software Library.

• Creating components, directives, and images, and storing them in Oracle Software Library.

• Customizing the default deployment procedures according to the needs of the organization.

• Creating patch plans and patch templates.

The predefined Oracle role for a Designer is EM_ALL_DESIGNER, this role in turn includes fine grained roles where you can specifically set EM_PROVISIONING_DESIGNER for provisioning tasks, and EM_PATCH_DESIGNER for patching tasks. For more information about privilege grants to Designers, see Granting Roles and Privileges to Administrators.

Operators

Operators are administrators who have restricted privileges on a Deployment Procedure and Software Library. Normally, operators can view and submit a deployment procedure. The Designer user may also grant the Operator the necessary privileges on any targets or entities.

Operators use the infrastructure created by designers and perform run-time activities like:

• Accessing the provisioning profiles present in the Software Library for provisioning procedures.

• Launching software deployments to provision software on selected targets.

• Patching software deployments using patch plans and patch templates.

The predefined Oracle role for an Operator is EM_ALL_OPERATOR, this role in turn includes fine grained roles where you can specifically set EM_PROVISIONING_OPERATOR for provisioning tasks, and EM_PATCH_OPERATOR for patching tasks. For more information about privilege grants to Operators, see Granting Roles and Privileges to Administrators.

Creating Designer User Account

To create a Designer user account, follow these steps:

1. In Cloud Control, from the Setup menu, select Security, then select Administrators.

2. On the Administrators page, click Create.

3. In the Create Administrator wizard, do the following:

   1. On the Properties page, specify the name Designer and provide a password. Leave the other fields blank, and click Next.

   2. On the Roles page, select EM_ALL_DESIGNER, and click Next.

      Note:

      You can alternately restrict the Designer access to either Provisioning or Patching domains. For granting privileges explicitly for Provisioning, select the EM_PROVISION_DESIGNER role. Similarly, for granting designer privileges explicitly for Patching, select the EM_PATCH_DESIGNER role.

   3. On the Target Privileges page, select the targets privileges that must be granted to a Designer user account. For information about the target privileges available to an Administrator with Designer role, see Granting Roles and Privileges to Administrators on the Deployment Procedure

   4. On the Resource Privileges page, select the privileges to be explicitly granted for each of the resource types.

   5. On the Review page, review the information you have provided for this user account, and click Finish.

Creating Operator User Account

To create an Operator user account, follow these steps:

1. In Cloud Control, from the Setup menu, select Security, then select Administrators.

2. On the Administrators page, click Create.

3. In the Create Administrator wizard, do the following:

   1. On the Properties page, specify the name Operator and provide a password. Leave the other fields blank and click Next.

   2. On the Roles page, select EM_ALL_OPERATOR, and click Next.

      Note:

      You can alternately restrict the Operator access to either Provisioning or Patching domains. For granting privileges explicitly for Provisioning, select the EM_PROVISION_OPERATOR role. Similarly, for granting designer privileges explicitly for Patching, select the EM_PATCH_OPERATOR role.

   3. On the Target Privileges page, select the targets privileges that must be granted to an Operator user account. For information about the target privileges available to an Administrator with Operator role, see Granting Roles and Privileges to Administrators on the Deployment Procedure

   4. On the Resource Privileges page, select the privileges to be explicitly granted for each of the resource types.

   5. On the Review page, review the information you have provided for this user account, and click Finish.