OVD and OAM 11 GR 2

Similar Questions

• Federation and OAM 11 g R2

  We currently have IOM and OAM 11 g R1 installed. Our migration path is as well to the OIF. I read in OAM 11 g R2 documentation that OIF is now a service of OAM. Is this true? With R1, I configured hosts for OIF, so now I guess I didn't need. In the Federation we only act as a service provider for federated partners.

  If you only need the capabilities of the service provider, then you can use Service of Federation which is delivered in 11 GR 2 OAM.

  If you need to the ability to the identity provider then you must separate OIF

  hope this helps

• integration of Shibboleth and OAM

  We strive to integrate Shibboleth OAM, i.e., using Shibboleth for authentication and authorization for .NET applications OAM. I put in place basic OAM for the application and it works very well and wonder if it is possible to integrate Shibboleth and OAM for Shibboleth can support authentication?
  
  We use Windows 2003 server and OAM version 10.1.4.0.1.

  You need OIF at the top of the OAM then integration with Shibboleth via SAML is easy. With plain OAM, I guess it's possible, but you'll be reinventing the wheel from the OIF

• OAM: password policy coherence between the Server LDAP and OAM

  Customer has an OAM installed using an LDAP server, say MS - AD 2003, as users, policies, and the configuration data store.
  
  The customer has configured their LDAP server, password policies claiming for example that the users passwords expire 60 days after they have been fixed and this departure 5 days before they expire, users, at the opening of the session, should be warned that their passwords are about to expire.
  
  Customer has configured identical policies inside the OAM.
  
  (A) consider the following sequence:
  
  Day X: user connects to the 'User Manager' component of OAM in the identity and, through 'My profile' admin console, changes his password.
  
  Day X + Y (1 < = Y < 55): the user connects to the MS - AD domain and sets its password interfacing directly the LDAP server, outside of OAM (for example: by pressing CTRL-ALT-DEL and invoking 'Change Password' in a field of MS-Windows, MS - AD-controlled).
  
  Question A.1) day X + 56: user tries to access a web resource protected by OAM: OAM made realize that the user has changed the password recently (through the LDAP server), and that should NOT be notified?
  
  Question A.2) day X + 61: user tries to access a web resource protected by OAM: OAM made realize that the user changed the password recently (through the LDAP server), and that should NOT be asked to change his or her password again?
  
  (B) consider the following sequence:
  
  Day X: user connects to the MS - AD domain and sets its password interfacing directly the LDAP server, outside of OAM (for example: by pressing CTRL-ALT-DEL and invoking 'Change Password' in a field of MS-Windows, MS - AD-controlled).
  
  Day X + Y (1 < = Y < 55): the user connects to the 'User Manager' component of OAM in the Administration of identity and through 'My profile' console, changes his password.
  
  Question B.1) day X + 56: the user is trying to connect to the MS - AD domain: MS - AD made realize that the user has changed his password to recently (OAM), and as it should NOT be notified?
  
  Question B.2) day X + 61: the user is trying to connect to the MS - AD domain: MS - AD made realize that the user has changed his password to recently (OAM), and that should NOT be asked to change his or her password again?
  
  
  
  Kind regards
  
  
  Angelo Carugati

  (A) you're done. OAM is not aware of changes in password performed at the entrance to the user if the change does not take place through OAM. There is no good solution because you have two different versions of the truth, even if they are logically equivalent policies with us will tell the expiry of 60 days, apply to the same person. A possible solution is to be synchronized with the attributes that store things password policies in AD (as when the user has changed the password) to the attributes of the political equivalents of associated storage stuff in OAM password (as when the user has changed the password - oblastsomething). I don't know if this synchronization is still possible, but it's an idea. AD and OAM attributes can both live in AD, but they are distinct attributes in separate containers.

  (B) you are ok. AD is aware of the change, and is aware of the change.

• Benefits of IOM and OAM...

  Hello friends...
  
  I am new to IOM and OAM but I know java and Struts. If I decided to learn the OIM/OAM then what will be the future scope of these technologies for me. And what I'm going to work. Currently to work as a Java developer and ready to learn IOM and OAM.
  
  Please know me if anyone knows...
  
  
  Thanks and greetings
  DB

  This is my understanding of how the products relate to each other:

  Oracle Identity Management is not a real product, it's a generic term, Oracle use to describe products Oracle Identity and Access Management. Please take a look at the link below:

  http://www.Oracle.com/technology/products/id_mgmt/index.html

  Oracle Identity Manager and Oracle Access Manager are separate products.

  Oracle Identity Manager is a product of commissioning and compliance formerly Xellerate Identity Manager of Thor.

  Oracle Access Manager is a product of access and authentication used to fix and providing single sign-on to web-based applications.

  Both products have other features in addition to what is described above some of these overlap of features such as workflows, user self service and password.

  I hope this helps.

• WLST Script to create the domain weblogic for IOM and OAM

  Hello

  I intend to set up PS3 IOM - OAM in the new environment. We intend to perform the installation in silent mode. Does anyone have example WLST to create the domain weblogic for IOM or OAM?

  Thank you

  Here is an example of OUD. I post this one since it's the simplest and shortest, but it is the same for OAM and IOM except that the script is much longer because they ask a lot more questions. You will need to export the variables used or replace them with the appropriate values for your system.

  wait-<>

  the value of timeout 600

  spawn ${OUD_BASE}/${WLS_NAME}/common/bin/config.sh mode = console

  # Create a WebLogic domain

  wait {}

  {"Enter the index number to select GOLD *" {send "1\n"}}

  # Choose the components of the Weblogic Platform

  wait {}

  {"Enter the index number to select GOLD *" {send "1\n"}}

  # | ___Oracle directory Services Manager - 11.1.2.3.0 [Oracle_OUD1] [3]

  wait {}

  {"Enter number exactly as it appears in the media *" {send "3\n"}}

  wait {}

  {"Enter number exactly as it appears in the media *" {send "n"}}

  # Change the domain information

  wait {}

  "" Enter the value of * "{send" ${OUD_DOMAIN_NAME} \n "}}"

  wait {}

  {"Enter the number of the option to select GOLD *" {send "n\n"}}

  # Select the target area for this domain directory

  wait {}

  {'Enter' new target location GOLD * {send "${OUD_BASE} / user_projects/domains\n"}}

  wait {}

  {'Enter' new target location GOLD * {send "n\n"}}

  # Configure password and username administrator

  wait {}

  {"Enter the number of the option to select GOLD *" {send "2\n"}}

  wait {}

  "" Enter new * "{send" ${WLS_PASS} \n "}}"

  wait {}

  {"Enter the number of the option to select GOLD *" {send "3\n"}}

  wait {}

  "" Enter new * "{send" ${WLS_PASS} \n "}}"

  wait {}

  {"Enter the number of the option to select GOLD *" {send "n\n"}}

  # Configuration mode field-> 1 | Development mode

  wait {}

  {"Enter the index number to select GOLD *" {send "1\n"}}

  # Java SDK selection

  wait {}

  {"Enter the index number to select GOLD *" {send "2\n"}}

  wait {}

  {'Enter' new JVM Directory GOLD * {send "${JAVA_HOME} \n"}}

  wait {}

  {'Enter' new JVM Directory GOLD * {send "n\n"}}

  # Select Optional Configuration

  wait {}

  {"Enter the index number to select GOLD *" {send "1\n"}}

  wait {}

  {"Enter the index number to select GOLD *" {send "n"}}

  # Configure the Administration Server

  # Change "Listen port.

  wait {}

  {"Enter the number of the option to select GOLD *" {send "3\n"}}

  wait {}

  "" Enter the value of * "{send" ${ODSM_PORT} \n "}}"

  # Change 'SSL enabled.

  wait {}

  {"Enter the number of the option to select GOLD *" {send "4\n"}}

  wait {}

  {"Enter the index number to select GOLD *" {send "1\n"}}

  # Change 'SSL listening Port.

  wait {}

  {"Enter the number of the option to select GOLD *" {send "4\n"}}

  wait {}

  "" Enter the value of * "{send" ${ODSM_SPORT} \n "}}"

  # Then

  wait {}

  {"Enter the number of the option to select GOLD *" {send "n\n"}}

  # wait for install

  wait {}

  {"Successfully created * field *" {send "\n"}}

  EXPRESSIONS OF FOLKLORE

• EPUB3 InDesign fixed layout and .oam files

  Were there any progress on that? the help files to:

  http://helpx.Adobe.com/InDesign/using/export-content-EPUB-cc.html

  Say clearly:

  • You can include video, audio and edge animate content (files with extension .oam).

  Yes you can and you can preview them, but they do not appear in iBooks on the iPad. If InDesign epub 3 fixed layouts are to make any impact probably edge animate .oam files should work in?

  Let me know if Miss me something, or how you get them to work on an iPad via iBooks.

  My understanding is the fact that the OAM files do not work on an iPad in iBooks is a bug in the iOS7 software or iBooks for iPad.

  If you view the EPUB3 FLX files in iBooks on a Macintosh in Mavericks (Mac OSX 10.9), the animation of the OAM will play well.

  You could try them in 4 new digital editions on Adobe, which just came out:

  Adobe Digital Editions 4

• OSH and OAM

  OHS 11.1.1.5
  11.1.1.5 OAM
  
  I am able to protect resources in the folder htdocs OSH by OAM. But there are web pages in the htdocs directory that does not need to be protected by the means of the OAM.
  
  Thus, I did not define policies for OAM resources. But when I have access to these resources, I get a 404 not found error page. Homepage even to access the OHS is return 404 error.
  
  http://localhost:7777 /-404 page not found
  
  Why is this behavior? My 11g indicator a deny on unprotected webgate is enabled. What is the origin of the problem?

  Hi Kestar,

  Yes, it is expected with 11g WebGates behavior (and 10g WebGates with refuse together on not protected). When resources are not included in any policy OAM, then the WebGate said the web server do not allow access. If you want OAM to redirect under these circumstances, then resources need to be in an Application domain and you can then take the action with an authentication (or authorization) success or failure url parameter. An alternative might be to change the behavior of the web server, possibly using directives ErrorDoc.

  I expect the WebGate to query the OAM server to check whether or not the resource is protected, but this happens behind the scenes - not in the http stream. It must be visible in the OAM (server and webgate) newspapers.

  Kind regards
  Colin

• Need help with OSSO and OAM

  Hello
  
  I'm new to OAM and trying to integrate oracle Access Manager (OAM) with Oracle Application Server.
  I'm following the steps listed in http://download-west.oracle.com/docs/cd/B28196_01/idmanage.1014/b25347/osso.htm#BJFHIACI
  In the document a step to Configure OracleAS Single Sign-On for external authentication is specified.
  I do not have any procedure to above mentioned.
  
  Can someone help me with this
  
  Thanks in advance

  Hello

  I did not understand what "even user is connected to the OAM, OSSO request username and password."

  Ideally, you access the deployed OAM protected application on the OAS, you should get authenticated using the configured authentication scheme for this policy area.
  So you see the plugin called oblix after user entering into details, other, where the uid will come from?

  So here's how you should approach.

  First, go to your web app (OAM or OAS) and see you get basic authentication appeared.
  Enter you details, plugin is recalled, recovers the uid mind and checks with the server of the OAS, if the user is correct.
  Then the cookie is created.
  This will be followed by the authorization.

  -Mahendra.

• Correct mapping between OID and OAM

  Hello
  I installed Oracle Internet Directory and Oracle Access Manager. I am able to connect to Oracle Access Manager and Administration of Oracle identity using my default Admin ID - sleep. Now, when I am trying to add a new user, I get the error report that action is down and "waiting for Participant.
  
  Also, when I add a new user via, DIO he did not reflected in OAM and OIA.
  
  I don't know what is the error, as I am new to Oracle tools.
  
  Also, I think that the mapping is fine, otherwise I wouldn't have been able to connect in MSO, using sleep.
  
  You can help as soon as POSSIBLE.
  
  Kind regards
  Niranjan

  You can list all the details on your workflow of creating user you use?

  You have a custom user objectclass? It is configured in OAM? When adding the user in OID which user OC are you using?

  -shetty2k

• IOM and OAM

  Hello
  
  
  I would like to install a server with a solution IMO + the solution of the OAS.
  We are on the AIX 5.3 platform.
  
  
  
  From the download page, we have CDs to IOM: Oracle and Oracle Identity Federation identity management Infrastructure
  But what is the OAM installation. (* Oracle Access Manager * OR Oracle Access Manager-3rd party integration)
  
  
  
  Oracle Access Manager is not scheduled to AIX.
  So, the only way is to use OAM - 3rd party integration. Right?
  
  Thank you
  Den
  
  

  Access Manager (10.1.4.2) is not supported on Aix. The integration of the thrid group is just for webgate or webpass. I think it has been supported on Aix (I just downloaded oblix 7 SDK access server because we need a custom solution on Aix for webgate)...

• OAM11g-Ondaaah and OVD

  Hello, I'm testing OAM11g/Ondaaah (Native Windows without IIS authentication). I have OVD configured as storage of primary identity that virtualizes against areas from 16:00. Most of the documents/blogs around this tip of topic to creating identity AD save with associated Kerberos configurations in OAM. Can I pass the authentication Kerberos OVD and avoid creating the identity AD store. OAM 11.1.1.5 support store of multiple identities, because I have 4 domains, keeping separate krb5.conf and SPN file seems to be get complicated. Has anyone tried this before? Please, share your ideas.
  
  Thank you
  Sunil.

  Yes, Sunil, you can certainly do.

  Make sure that the TPM is default user store and ensure that this attribute of the user that you select here is similar to UserPrincipalName.

  HTH,
  REDA Mareddi
  http://www.freeoraclehelp.com

• Creation of OAM authentication Plugins, plans and policy responses by command line

  Hi all

  I was plenty around, search the internet and MOS but did not find anything so far.

  In OAM (11.1.2.2.4) I am trying to create a PlugIn for authentication, specify the step, the config params, orchestration, and so on. It works pretty well through the GUI. However, as I have a lot of different situations to deal with, I would like to automate this, using a command line tool (wlst.sh I think).

  Does anyone know how I could do?

  Side, I would also seek the same for patterns of authentication and responses, but I hope that as soon as I know how to do it on the plugin from I can derive from those others here.

  It is doable but completely undocumented. What you need to do is wlst write scripts that access the mbean OAM, who is responsible for the update of oam - config.xml to add the required parameters.

  What I do is to capture the current settings (IE make a backup of oam-config. (XML), and then perform the configuration via oamconsole. Then, compare the oam - current config.xml with the backup and note the differences. Using wlst and OAM mbean to add these entries. This wil you require to understand how to upgrade the config.XML of oam - via the mbean and involves a bit of understanding of jython to do the job.

  For policy responses and enforcement strategies, you can use the OAM REST interface which you can drive from curl or anything that can handle http requests. It is much easier to use than rreg.

• Integration of OAM (11.1.2.0.0) with the OIF (11.1.1.2.0) and the Protection of resources

  Hi Oracle community!  It's my first post here on the forums, so please bear with me.

  I have a question about the integration between the IOF, acting as an IdP and OAM as the authentication engine.  I'll start with our Setup and the way we protect resources and then finally to deliver my ultimate question.

  First things first:

  We use the OIF 11.1.1.2.0 and OAM 11.1.2.0.0 (looking at upgrading OAM/OIF soon to 11.1.2 patch set 2, so we get full OIF blown in OAM packet and not only the part of MS).

  I essentially was self-taught in the integration of the products and did the best that I can.  We have that in the production running the full blown federations now, so that we know that we are doing something good.  I won't say that we have done is the perfect solution, but it is the way in which we understand how products interact and worked at the time.

  We have OIF, acting as an IdP (without SP yet), configured to use our OAM authentication search engine.  According to the documentation, we read through, when this configuration occurs, when the IOF receives a request to start the process of Federation (/ fed/PDI/initiatesso? providerid = XXXXXX), she sees the user is not authenticated and will forward to the authentication engine.  In our case, this means that we forwards the request to an internal flow in the OIF (/ fed/user/authnoam11g) which crosses the webgate, then check with OAM, if it is a resource that is protected or not.  In OAM, we defined a resource to protect/fed/user/authnoam11g so she who collects and authenticates the user via the policy regime, etc.  Once that ends, she goes back to the OIF to finish the assertion.

  Keep in mind, I'm aware of a lot more of what's going on in the process, but it's the main room that will be the basis of my question.

  So than stated above, we have a single policy protected for all federations from the OIF since "out of the box" OIF doesn't have several URL structures that it will send to OAM based on service provider being accessible.  For me, this is a small problem because I want to perform specific authorization controls in OAM based on the providerid who had been requested to the OIF.  OIF, as far as I know, completely removes the URL of origin that was requested and query parameters (for example providerid) which means that I have little or no information of the initial request to any robust condition checks in the policies of the OAM.

  My question to the community would be:

  Is it possible for the headers of the OIF or query string parameters to be going to OAM via header variables/session variables/etc. and then accessible through licensing of OAM requirements to do solid state audits in order to allow/deny access based on rules?

  A small example:

  I am a customer who asks the following Federation on OIF:

  1. https://oifhost/fed/IDP/initiatesso?ProviderID=partnerAlias GOLD https://oifhost/FED/IDP/samlv20 <-the samlv20 would include a request for authentication with the good provider
  2. IOF receives the request and begins creating processes and the SAML assertion.  It is determined that the user is not authenticated, so OIF will forward to the authentication engine.
  3. OIF transmits to the https://oifhost/fed/user/authnoam11g
  4. OAM protects the url "/ fed/user/authnoam11g" to make the authentication/authorization.
  5. The point of authorization, I want to build conditions that are basically looking for the "providerid" in initial demand to run specific rules to allow/deny cons.  Currently, it is not possible that I know, and that's what I want to know.
  6. Once the authentication/authorization, OAM refers the request to the OIF where he finished the SAML flow and sends the statement to MS.

  In step 5, I would need a mechanism to find the providerid (value of the header, cookie, session, etc.)

  I posted this same question on another blog of Oracle and received a reply that I want to do with the current configuration is not supported.  In order for me to get the desired result, I need to upgrade to patch set 2 of OAM with the fully integrated OIF.

  See response to blog here:

  https://blogs.Oracle.com/dcarru/entry/authorization_in_oif_idp#comments

• What is the best way of updating OID and similar attributes via OIM OAM LDAP?

  Our environment uses IOM provisioning of an OID LDAP that is used by OAM.
  
  Purposes of inheritance, must complete the Oracle "orcl *" attributes and OAM "ob * ' in cases where they use the same or similar.
  
  Example: When a user is disabled in IOM we define orclisenabled = 'false' and obUserAccountControl = 'DISABLED' in OID
  
  What is the best way to achieve the IOM? My first thought was to write a custom adapter, similar to the OID adapter change user out-of-the-box, which takes in charge the changing multiple attributes.
  
  Is there a better way?

  You can create two tasks that will modify two attributes to OID.

  On the task of the user to disable call task1, success of task1, Task2 (using the task to feature generate).

  You can make use of OOTB connector only.