PingOne Identity Tool for IAM Engineers

 If you work with PingOne, here’s a lightweight utility that makes identity operations faster and easier. The PingOne Identity Tool helps you inspect environments, retrieve user details, validate configurations, and streamline troubleshooting — all from a simple command‑line interface.

👉 Reference the tool here:

https://github.com/cybermahkris/PingOne-Identity-Tool/blob/main/README.md

It’s open‑source, easy to use, and built for identity engineers, architects, and developers who want quicker visibility into PingOne resources. Check out the README, try the commands, and feel free to reference it in your IAM documentation or scripts.

Coming Soon: White Paper on Disaster Recovery in Healthcare

I'm currently working on my next white paper focused on disaster recovery mechanisms in the healthcare industry—a critical yet often overlooked area that directly impacts patient safety, regulatory compliance, and data integrity.

I'd love your input! If there are specific areas, applications, or systems you'd like to see covered—such as EHR platforms, telemedicine infrastructure, cloud-based backups, or real-time failover strategies—please drop a comment below.

Your feedback will help shape a more relevant and valuable resource for the community.

Cutting-Edge AI Techniques for Securing Healthcare IAM: A Novel Approach to SAML and OAuth Security

 

I'm excited to share my latest research exploring how AI can revolutionize identity security in healthcare environments — specifically strengthening SAML and OAuth frameworks against evolving cyber threats.

🔗 Read the full paper here

This paper introduces an AI-driven approach to real-time anomaly detection, adaptive authentication, and proactive threat mitigation within healthcare IAM systems. It also addresses challenges unique to protecting sensitive health data while maintaining compliance and usability.

🔹 I welcome feedback, insights, or discussion points from cybersecurity professionals, IAM architects, and healthcare IT experts.
🔹 Let’s collaborate on advancing secure, AI-powered identity ecosystems in healthcare!

Thank you for taking the time to read and engage!

#Cybersecurity #HealthcareSecurity #IAM #OAuth #SAML #AI #DigitalHealth #IdentityManagement

Future-Proofing Enterprise Security: Transitioning Legacy Authentication to Modern IAM

 

I’m excited to share my latest research paper that addresses a critical need facing many organizations today — migrating from legacy authentication systems to modern, scalable Identity and Access Management (IAM) frameworks.

🔗 Read the full paper here

In this paper, I explore strategies, real-world challenges, and architectural considerations for future-proofing enterprise security. I also dive into how organizations can adopt passwordless authentication, Zero Trust models, and adaptive risk-based access while ensuring minimal disruption during migration.

🔹 If you're involved in IT modernization, IAM transformation, or enterprise cybersecurity, I would love for you to read through and share your feedback or experiences!
🔹 Your insights will be valuable for evolving best practices around secure digital transformation.

Thank you for your support and interest in securing the future of enterprise identity!

#Cybersecurity #IdentityManagement #IAM #DigitalTransformation #ZeroTrust #SecurityArchitecture #Modernization

How to implement security for Healthcare applications and systems using Passkeys

 

Dear experts, 

I am pleased to share my latest white paper published on ResearchGate:

 "Next-Generation Identity Security in Healthcare: A Passkey-Based Approach"

https://www.researchgate.net/publication/391591235_Next-Generation_Identity_Security_in_Healthcare_A_Passkey-Based_Approach

In this paper, I explore how passkeys and asymmetric cryptography can revolutionize authentication frameworks in healthcare — moving beyond traditional passwords towards phishing-resistant, device-bound, and biometrics-enabled security models. I also discuss integration strategies with existing healthcare IAM systems, real-world deployment challenges, and future directions like quantum-resilient passkey evolution.

🔹 I would greatly appreciate feedback, insights, or discussion points from cybersecurity, healthcare IT, and identity management professionals.

 🔹 Your perspectives on real-world challenges, emerging trends, and implementation considerations would be highly valuable!

Thank you in advance to all the cybersecurity experts and IAM practitioners willing to give this a read!

AI-Powered Cybersecurity for Safeguarding Electronic Health Records from Deepfake Biometric Attacks

 

 

 I’m excited to share my latest research publication now available on ResearchGate:
🔗 Read the full paper here

In this white paper, I explore a critical and emerging threat in healthcare cybersecurity — the risk of deepfake biometric attacks targeting Electronic Health Record (EHR) systems.
As healthcare organizations increasingly adopt biometrics like facial recognition and voice authentication for user access, adversaries are beginning to exploit AI-generated deepfakes to impersonate legitimate users.

This paper introduces an AI-powered cybersecurity framework designed to safeguard sensitive healthcare data by integrating real-time liveness detection, behavioral biometrics, and anomaly risk scoring into EHR authentication workflows.
I also discuss key challenges, system architecture, and future directions for securing healthcare identity systems against evolving deepfake threats.

🔹 If you are working in healthcare cybersecurity, identity management, or AI risk mitigation, I welcome your feedback and thoughts on this important and fast-evolving area!

Thank you for reading and engaging with this important topic.
Feel free to share your insights or experiences related to biometric security!

PingFederate: OAuth implementation approaches

Hello IAM Learners

It is common to use claims based authentication in recent times for any SSO integrations using OAuth/OpenID connect standards. 

For OAuth implementation in PingFederate, you could create multiple Access Token Manager and map it to adapter if you have multiple HTML adapters in the deployment, otherwise if you just single HTML Adapter used by all OAuth applications then you don't need any of these I am referring to below.

OAuth request coming from Application can be intercepted and processed in PingFederate using two approaches; OAuthSelector or HTTP Header selector. Both of these approaches requires to use Ping authentication policies.

OAuth Client Set Authentication Selector: All OAuth client IDs should be added in this selector as Client.   

HTTP Request Parameter Name: All OAuth client IDs should be added in this selector as parameter values.

There is another selector OAuth Scope Authentication Selector that will be used for OAuth implementations if you have a requirement to trigger the authentication flow based on client scope. 

 

Identifier First Adapter: PingFederate

Hello IAM Experts

Today, I would like to talk about Identifier First Adapter and how it can be addressed for variety of use cases.

Identifier First Adapter is available out-of-the-box in PingFederate 9.3 version and above. This adapter uses HTML template in the back-end which can be customized as per Org needs and it captures the user identifier (could be email or userid) and it uses two attributes Subject and Domain. 

Domain is typically the user email address. Additional attributes can be added to this adapter as needed. 

Some of the use cases:

1. This adapter can be used if the organization has a requirement to display separate branded login page based on email address or user domain.  
2. This adapter can be used if you need to separate the authentication flow or trigger additional security mechanism based on userid or email address. 

HTML template also uses velocity template which can be customized with HTML/JS as per Org needs. 

PingFederate redirect URL after logout

Readers

Logout is a typical requirement in Single Sign-On world. In the interest of today's post, PingFederate can perform SAML single logout or individual adapter logout and I will talk about these topics in detail in separate post.

It is also a common requirement to be able to redirect user to login page post logout. Today, I will explain the PingFederate capabilities to redirect user to different url post SAML logout.

PingFederate SAML logout end-point is https://<>/startSLO.ping, and this URL will perform SAML single logout. 

TargetResource parameter should be appended to logout URL to redirect the user to login page or to land onto different page.

https://<>/idp/startSLO.ping?TargetResource=https://<> 

This TargetResource should be whitelisted as shown below. 

Add the new <> under Security -> Redirect Validation section by specifying the domain name as abc.domain.com and select TargetResource for SLO and Other checkbox. This setting should be added only when ENABLE TARGETRESOURCE VALIDATION check box is enabled for SLO AND OTHER OPTION.


Without whitelisting the redirect URL, you will see below error 

Tomcat "Cannot recover key" SSL error

Tomcat has been enabled with SSL port. While renewing the SSL certificate, Tomcat server is throwing below error.

java.io.IOException: Cannot recover key
        at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:507)
        at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:218)
        at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:400)
        at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:650)
        at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:434)
        at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:978)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:821)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:642)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:667)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)

The error indicates that key can't be recovered using the password specified in server.xml. SSL section in server.xml is as shown below. If you have wallet pfx/p12 file, then you may convert it to java keystore using the same wallet password to use for java keystore password. 

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"  maxThreads="100" SSLEnabled="true" scheme="https" secure="true"            keystoreFile="/u01/app.jks" keystorePass="XXXXX"  clientAuth="false" SSLProtocol="TLS" sslEnabledProtocols="TLSv1.2" />

The keystorePass value is different from passphrase used while creating private key/cert. After recreating the java keystore with same password as key and updated server.xml with new password and Tomcat started working fine. 

Azure AD SAML Integration issue with PingFederate : AADSTS75011

Readers, I'm back!

I would like to resume blogging my working experiences and best possible solutions on technologies that I come across every day.

Today, I would like to share some limitation that I came across on Azure AD SAML integration.

Scenario:

A cloud application is integrated with PingFederate where Ping is IDP and app is SP.
PingFederate is delegating authentication to Azure AD; so Ping is SP and Azure AD is IDP.

Issue:
As per the scenario, all three systems Application, PingFederate and Azure AD are configured with SAML integration.

When Application is accessed, it is throwing an error when it is landing on Azure AD for authentication.

Cause:
As per Azure error code AADSTS75011, the problem seems to be Authentication Context parameter sent by the Application in SAML Authentication request as shown below.

<saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>

Refer this article, https://techcommunity.microsoft.com/t5/azure-active-directory/aadsts75011-by-which-the-user-authenticated-with-the-service/m-p/196130#

Azure AD supports only urn:oasis:names:tc:SAML:2.0:ac:classes:Password as authentication context value in SAML requests. Refer this article, https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol

Fix:
Ensure that application would send AuthnContextClassRef parameter as urn:oasis:names:tc:SAML:2.0:ac:classes:Password

Best practices for Oracle Access Manager deployment

Readers,

It is very important to follow best practices for OAM deployment for either single DC setup, or MDC setup or HA functionality etc., Some of the best practices are mentioned below and I will keep updating this post based on comments/feedback.

1. Verify the certification matrix for OAM deployment before beginning installation.
2. Use the latest Java, WebLogic Servers based on certification matrix.
3. Use the same path for Weblogic Home, Oracle Home and Oracle Common Home across environments.
4. For WebServers, use environment specific instance names rather than default names. For eg., while installing and configuring OHS instances, the default instance name is ohs1. It is suggested to use name denoting environment name and server name such as DEV_OHS1 or PROD_OHS1. 
5. For WebServers in HA, if you are installing OHS on multiple boxes then it is suggested to use different OHS instance names. For eg., PROD_OHS1 (on 1st box), PROD_OHS2 (on 2nd box). This will help associating OHS instances with unique instance names in EM console for monitoring purpose. 
6. Ensure that Non-Prod (or QA) and Prod environments identical for all IAM components in order to reproduce Production issues and make future deployments easier and better for operations.
7. Ensure to configure OMSM, Policy Manager and OAM servers in different clusters during initial WebLogic domain configuration.
8. Use load balancers for backend LDAP servers for user store. 
9. Use custom authentication plugins only as per needs. Custom Plugins have maintenance nightmares for Ops team. 
10. Schedule regular backups for oam-config.xml, policy exports and partners export along with DB backups.
11. While configuring user store, specify Referral policy as FOLLOW. Also, specify Min/Max pool size and timeout parameters as per load testing results. 
12. Selectively configure required audit events only.  
13. Avoid creating sample cgi or server side pages that would print headers information. For eg., cgi-bin/printenv script is a common script that's protected through OAM for validation purpose. After Production go-live, remove those test pages. 
14. Exclude images, css files and other static contents in policies instead of using Unprotected policies. 
15. Try to update WebLogic CPU patches and JDK CPU patches based on sensitivity of the fixes. Thorough testing is required before pushing these patches to Production. Sometimes these patches may break OAM functionality. 
16. Use similar RCU versions across environments.
17. Use certain security headers X-XSS-Protection, Strict-Transport-Security etc., in Login WebGate WebServers for better protection. 
18. Use Log rotation for OAM and other WebLogic servers to prevent complete disk usage. 
19. Ensure that only required firewall ports are opened to and from OAM servers instead of opening it through entire subnets. This is to provide better security.
20. Use WebGate CERT mode only if needed otherwise it will degrade performance. 
21. Use SSL at Node Manager and WebLogic Servers are only as needed. 
22. Ensure that Login WebGate has SSL enabled.
23. Ensure that 3rd party cert is used for OAM deployment in Prod and non-prod environments. 
24. Do periodic rolling restarts of OAM server for better system performance.
25. Associate OHS and OAM components with EM 12c for performance and system alerts.
26. Use Min / Max Heap size for OAM tuning. 
27. Use appropriate number of processes, sessions etc., parameters in OAM DB schema.
28. If there are more IAM components in the architecture, it is suggested to use separate DB for OAM component since OAM uses APS for MDC synchronization where as other products requires DG or GG.
29. Ensure to grant admin privileges to LDAP users for OAM console instead of giving generic administrative access to all users.  

 That's it for today. Happy reading!! 

Enabling Multi factor Options for application in Okta

Okta is a simple product to use and it is capable of integrating with more than 5800 applications for Single Sign-On purposes with added security benefits.

In this post I would like to quickly talk about enabling Multi Factor capabilities for an application that is already integrated into Okta. In this case, SalesForce is integrated with Okta using SAML 2.0 protocol.

Follow the below steps to enable MFA capabilities for salesforce application (or this would apply for any other application)

1. Login to Okta Admin Console as admin user.
2. Goto Applications.
3. Goto Sign On Policy section.
   
4. Click Add Rule.
5. Specify Rule Name, Conditions (users /group rule assignment), Location . 
   
6. Specify Actions. Select the option to allow or deny the access after conditions are met. For this exercise I would choose Allow. Select MFA frequency such as prompting MFA every login or once a day etc.,
7. Click on Multifactor Settings.
   
8. Select the desired authenticators. 
   
9. Click Save. 

Now the desired configuration changes are completed. It is time to test. 

1. Login to Okta application console. 
2. Click on SalesForce application.
   
3. User is redirected to MFA page for setup (if its already setup, this page is not seen). In this case, I have selected Google Authenticator setup. Click Setup.
   
4. Select device Type. Install app on mobile device. Click Next.
   
5. Specify the code generated on mobile device here. Click Verify.
   
6. User is redirected to salesforce application. 
   

PasteConfig failed in OAM MDC

Do you have OAM, OMSM and Policy Manager servers in your environment? Are they all tied to same OAM WebLogic cluster or different clusters?

Well, the recommended approach is to tie respective weblogic server to respective cluster. Therefore, OAM servers should be associated with OAM Cluster, OMSM servers should be with OMSM cluster and so are Policy manager servers.

This post will explain about an issue that you may come across when WLS servers are associated in their respective cluster.

I will skip the steps for T2P commands on the Master DC as they are not relevant to this post. After running extraceMovePlan.sh script on Clone DC, it generates moveplan.xml which is the basis for pushing configurations into Clone DC and creating weblogic domain.

moveplan.xml contains server details and cluster details etc., for OAM servers, OMSM servers and Policy Manager servers.

The default xml template would look like as shown below.

With this moveplan.xml, pasteConfig is failed.

After commenting out the omsm and policy manager server definitions in moveplan.xml, pasteConfig has worked.

Also, the weblogic domain was created for omsm and policy manager servers even though it was commented in moveplan.xml.

Specifics of Multi Data Center using Oracle Access Manager

Readers,

This is a very generic post for understanding some specifications of designing and implementing Multi Data Center solution using Oracle Access Manager.

• If you are designing an IAM solution in a single Production data center involving multiple IAM products, then it is mandated for separate Database for OAM component alone. This is because OAM uses Automated Policy Synchronization feature to sync artifacts/policies from Master to Clone DCs without the need of database replication unlike OIM and OAAM etc., Therefore, if OAM and other products are using same database then OAM database should be separated before deploying a new OAM data center. 
• In a typical IAM deployment, login pages are either served from OAM or through DCC. In both case, front end web server is employed with WebGate. It is preferred to use Global LBR for OHS data center along with load VIP. Therefore, a global LBR will also be assigned as OAM server hostname. If N number of data centers are added in the future, a new local LBR can be assigned to Global LBR without changing the OAM hostname.
• It is advised to employ Global LBR for OAM servers (default 5575 TCP port) for WebGates to OAM server connections. 
• Server affinity and sticky session is mandatory for all Global LBRs in a MDC solution. 
• OAM to database connection should have direct connection instead of Global LBR for all databases since each OAM talks to its respective DC database.
• In the event of using Virtual Host concepts at web server layers, it is advised to have Global LBR with sticky session and server affinity for OAM server 14100 port too. 
• OAM LBR for 5575 port should be TCP and OAM LBR for 14100 port should be HTTP.
• If mod weblogic plugin is used in the deployment for MDC, it is advised to use OAM LBR for 14100 port using WebLogicCluster parameter. Some of the nuances of using WebLogicHost and WebLogicCluster for mod weblogic plugin will be explained in detail in separate post.
• Before running T2P commands on Master DC, it is mandated to remove IAMSuite agent password and mark Embedded LDAP as system /default stores.
• In an MDC solution, Primary DC OAM is designated as Master thus allowing write operations only in this OAM server. All the policy updates from Master DC will be pulled into Clone DCs using APS feature.
• When a new DC to be brought into the existing MDC deployment, perform T2P on master DC to generate binaries rather than using old T2P binaries because something might have changed since initial T2P deployment. 
• Ensure to run pasteConfig and pasteBinary only on Administrator node of OAM component and use pack/unpack for other OAM nodes.
• It is usually recommended to have single Middleware on a host to avoid jar conflicts etc., even though we had seen OAM and OUD binaries co-existing on same Middleware. 
• It is always advised to add a new OAM server on separate host instead of adding OAM server on an existing OAM host as this would provide better CPU and server performance. However, this can be decided after thoroughly analyzing performance metrics. 
• Attain due diligence with Transformation rules as incorrect rules or incomplete rules will result in abnormal behaviors and corrupt the Clone DC environment in the worst scenarios. Thus, thorough testing with APS is required.
• Session control parameters define the user behavior during run time in an MDC deployment. Therefore, thoroughly test the MDC solution using these parameters. Below parameter values allow users to access SSO protected applications even though the sessions are created in Remote OAM DCs by creating local sessions in the event of session retrieval failures. 

          SessionMustBeAnchoredToDataCenterServicingUser=true

          SessionDataRetrievalOnDemand=false

          Reauthenticate=false

          SessionContinuationOnSyncFailure=false

• Designing Global LBRs at every component OHS, OAM and LDAPs will provide 100% high availability and failover even when one of the component in a data center fails. 
• Ensure that firewall connectivity is open from one DC component layer to all other DCs as cross over functionality.
• Perform the load testing in MDC deployment before going live as this will provide the SLAs and response time for each and ever component and its LBR to fail over to other available local VIP.  
• There is no MDC support for OAM OAuth tokens. Therefore oauth access token generated in one data center is not validated by remote DC. 

As always, TEST, TEST , TEST the component MDC solution. 

Automated Policy Synchronization for Federation

Readers,

Today I would like to discuss specifics about Automated Policy Synchronization feature for Federation. As you might know APS feature has been introduced in 11g for syncing agents, policies and other OAM artifacts from Master to Clone data center in Multi Data center deployment.

However the federation topics were not documented properly from APS perspective. When a new SAML partner is created in Master DC, the partner details will be updated in oam-config.xml (be it an IDP or SP) along with federation partner profiles.

In order to sync federation artifacts for proper functioning of partner application in Clone DC, ensure that below lines are added in transformation rules XML.

1. <changes-to-include entity-path="/config/NGAMConfiguration/DeployedComponent/Federation/IdentityProvider"/>
2. <changes-to-include entity-path="/config/NGAMConfiguration/DeployedComponent/Federation/ServiceProvider"/>
3. <changes-to-include entity-path="/config/NGAMConfiguration/DeployedComponent/Server/NGAMServer/Profile/STS/fedattributeprofiles"/>
4. <changes-to-include entity-path="/config/NGAMConfiguration/DeployedComponent/Server/NGAMServer/Profile/STS/serverconfig"/>

Failing to sync all the necessary artifacts to Clone will result in NullPointerException in Clone OAM logs (pertaining to Token Policy issue only) as shown below when partner application is accessed.

[2018-04-13T12:31:28.871-04:00] [oam_server1] [WARNING] [OAMSSA-06364] [oracle.oam.engine.policy] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: ] [ecid: d543f813b7c4a66e:75fed341:162bf95f333:-8000-000000000000257f,0] [APP: oam_server#11.1.2.0.0] No Token Issuance Policy found for "Type: TokenServiceRP Operation: ISSUE Name: null URL: GoogleApps Host: null Port: 0".

Recommendations while using custom federation

Suppose you are the Service Provider using COTS federation product and your partner is Identity Provider using custom federation solution. Here are some personal recommendations for achieving SAML Single Sign-On in a smooth manner.

1. Identify the features you are implementing with your partner upfront such as HTTP Binding, Signing, encryption, logout, Query Attributes, Account Linking etc., 
2. Discuss and agree the certificate, private key, encryption algorithms etc., 
3. Setup local environment to do proof of concept with COTS products and make sure you implement all the agreed features.
4. Make sure your partner having custom federation solution has done POC so that you are sure that they are adhering to SAML standards. 
5. If your partner has not done any POC in their local environment then you will need to validate the metadata manually before importing it to Service Provider.
6. When partner metadata is validated and make sure it is imported in your Service Provider properly. Be heedful of syntactical errors. 
7. If your partner has SAML response tested by dummy client, then ask for SAML response. If the response is encoded, use a SAML decoder and verify if all the elements are present. This is where we ended up wasting lot of time while running the test and identifying each and every element missing in SAML response. 
8. It is always suggested to test the basic federation without Signing/Encryption/Attribute Query etc.,
9. Once basic federation is tested, signing is next step.
10. Then test the encryption.

wlst.sh failed to connect in SSL

We have enabled SSL for WebLogic Admin Server and disabled the non-SSL port. We wanted to run some WLST commands and ran wlst.sh from
While trying to connect to wlst.sh with SSL port to admin server, the connection failed. I've tried various combinations of hosts with/without domain name and localhost too. See the below screenshot.

The actual fix is to add -Dweblogic.security.SSL.ignoreHostnameVerification=true parameter in startWebLogic.sh script. This parameter will essentially disable the hostname verification and required for stand alone clients connecting to weblogic server.

Restarted the WebLogic servers after making the script changes and wlst.sh connection worked with SSL.

Upgrading OAM from 11gR2 PS2 to 11gR2 PS3

In my previous posts, I have shared information about documentation and binaries of PS3 release. In this post I would like to briefly share my experiences of upgrading OAM from PS2 to PS3.

I have WebLogic 10.3.6 and JRockit 6 before upgrade and there is no change in those components even after upgrade.

Here are the pre-requisites required before upgrade:

1. Backup Middleware home and Policy database/schemas.
2. Stop all weblogic servers.

Here are the high level steps upgrading OAM to PS3 in a pure OAM 11g environment (without involving OAAM/OES etc.,).

1. Upgrade OAM binaries to PS3 : This step is a typical OAM installation process and it installs all binaries that are part of IAM package. Ensure that below screen appears that implies binaries are upgraded successfully.
   
2. Upgrade OAM, IAU and OPSS schemas : This step upgrades OPSS, IAU and OAM schemas to latest version to be compatible with OAM PS3 binaries. Verify the schema versions post upgrade, find the below screenshot.
   
3. Upgrade OPSS : This step upgrades the OPSS with configuration and policy stores to PS3. It upgrades jps-config.xml and policy stores. Note that it does not upgrade the OPSS schema which was upgraded in previous step already.
4. Undeploying Coherence : This step un-deploys Coherence module from OAM deployment. 
5. Upgrading System Configuration : This step is required to enable the PS3 features in OAM deployment. Ensure that message "System Configurations have been successfully upgraded to version: 11.1.2.3.0" in the end of script output.
   

If you intend to use Federation in Oracle Access Management then follow the below steps to enable it.

1. Goto <>/common/bin
2. Run the wlst.sh command
3. Connect to admin server.
4. Connect to domainRuntime()
5. Run the command upgradeFedSTS111230(). Ensure that message "command was successful" was displayed as shown in below screenshot.
   

Post Authentication rules are disabled by default. If you intend to use it, enable them by following below steps:

1. Login to OAM Admin Console.
2. Select Configuration
3. Select Available Services.
4. Enable Adaptive Authentication Service as shown below.

Login to OAM Admin Console to see the new look and feel :)

I will talk about my experiences with PS3 and its features in the future posts. 

OAM 11gR2 PS3 has been released

Oracle has released the Oracle Identity Management 11gR2 PS3 and here it is http://www.oracle.com/technetwork/middleware/id-mgmt/downloads/oid-11gr2-2104316.html

I would say they did well for PS3 documentation by branching different features into different sections such as Single Sign-On, policy model, Multi Data centers and installation steps and this looks clean.