Reading OAM Http header variables through CGI script

I was working on providing single sign-on for one of the CGI applications. I had set header variables in Authorization Rule Actions for User ID and other attributes as say AUTH_USER etc., While trying to read the headers in CGI app with name AUTH_USER, it is not available.

Upon reading/displaying all the headers in CGI application, it was reading with HTTP_AUTH_USER instead of AUTH_USER. I'm wondering if this is the default behavior of CGI app for reading headers! You can post your thoughts too...

OAM WebGates in SELINUX environments

I have recently worked on OAM SSO integration issue in RHEL 6.3+ environment which is SELINUX enabled.
There is Apache 2.2 Server 64-bit and respective webgate is installed. After restarting the Apache Server, we are seeing the error messages given below:

 Oblix: 2014/02/03@20:20:41.155559#01115170#01115183#011ACCESS_GATE#011FATAL#0110x00001520#011/scratch/alnguyen/Oblix/coreid1014/palantir/webgate2/src/apache2entry_web_gate.cpp:433#011"Exception thrown during WebGate initialization"#011

 Oblix: 2014/02/03@20:20:41.161535#01115170#01115183#011ACCESS_GATE#011FATAL#0110x0000182A#011/scratch/alnguyen/Oblix/coreid1014/palantir/webgate2/src/apache2entry_web_gate.cpp:434#011"An internal ObError exception was caught."#011raw_code^219#011

Essentially, the webgate is not working and hence the web page access is resulting with error "This webpage has a redirect loop".

We have tried to look below options:

1. Upon enabling the webgate log in TRACE, nothing interesting was found except that webgate initialization error. Verified the webgate folder level permissions to match the web server user group permissions.
2. Reconfigured the webgate using configureWebGate command.
3. Verified the connectivity from WebGate to OAM host.

Finally, we found some denied errors in web server audit log while accessing the webgate protected pages. These errors are due to insufficient permissions at the Unix level. After modifying those permissions, webgate has started working fine.

I will post the Unix level changes made to fix the issue soon.

Impersonation feature is not available in OAM 11g WebGates

If you are using .Net based applications to be protected by OAM 10g, you can certainly do it with IIS WebGates without custom coding/filters. This can be achieved using Impersonation feature in OAM 10g WebGates. However if you are using OAM 11g WebGate, impersonation feature is not available/supported.
In this case, the best way to approach is to use 10g WebGate with OAM 11g. I have read a beautiful post here on the same.

OAM 11g integration with OBIEE 10g for Single Sign-On

I have already done a detailed write up on Oracle Access Manager 10g integration with OBIEE 10g for Single Sign-On here.
I have read another post here that has detailed description about Oracle Access Manager 11g integration with OBIEE 10g.  That was pretty good!!

In fact I could not notice much difference with the integration steps with OAM 10g and OAM 11g.

Oracle Portal 11g is not certified with OAM 10g

Please be aware that Oracle Portal 11g is not certified with Oracle Access Manager 10g, please read the OAM 10g FAQ here. The certified version is OAM 11.1.1.4 and Oracle Portal 11.1.1.4.0. For more information, please read the detailed post here written by me.

How to setup Oracle Access Manager in disaster recovery mode?

In every real time environment, you would use two production sites i.e., Active , Stand-by. At a time, only one site will be up and running. This means all the transactional data with respect to Oracle Access Manager will be present in LDAP (user data, configuration data, policy store). However I am going to talk about providing disaster recovery setup for LDAP used by OAM. I would like to stress the key points involved in setting up OAM 10g for disaster recovery with less or no manual intervention.
I have explained much detailed here.

How clustering works with Access Server and WebGates

This post talks about webgate communicating with multiple access servers which are deployed in Primary/Secondary scenario. I have explained in detail about this post here.
Please feel free to reach me if you have any queries.

Global Logout in Oracle Access Manager 10g

This post covers the Global Logout operation to be performed in Oracle Access Manager 10g. If you look at the OAM 10g documentation for Global Logout, it just talks about having logout keyword in the logout URL (except logout images etc.,).
In reality, achieving Logout is not an easy job with Oracle Access Manager. If there are multiple products integrated with OAM 10g, killing obssocookie alone will not suffice the job. The cookies or sessions of applications that are integrated with OAM 10g needs to be implicitly killed and this is all customization. This is explained in detail in the post.

The most challenging part of this Global Logout is : User logs into Portal 11g and access multiple applications (custom and Legacy) within same session so is different cookies/sessions gets created for respective applications. Logout link is enabled only in Portal 11g but not in any of the other downstream applications. The concept is simple that single Logout at a single place. When the logout is performed in Portal 11g, Portal and OSSO related cookies/sessions gets cleared. However, cookies/sessions pertaining to other apps are not deleted and hence logging in a different user with in same browser session pertains old user session. Easy way to overcome this is to close all the IE browsers. An exception to this is to use < IE6 as there is a browser session sharing feature implemented in IE7 and above.

Now let us talk about the actual scenario.

To talk about our environment, there are almost 8 applications which is a mix of Custom applications and Legacy applications such as PEOPLESOFT, SIEBEL, ORACLE PORTAL 11g. Since Oracle Portal 11g integrates with OSSO - OAM 10g directly, there is a Logout page in OSSO (of Portal) which has functionality to delete OSSO related sessions for Portal. Since we used logout URL which calls logout.jsp, the OAM treats as logout call by default and sets the ObSSOCookie to loggedoutcontinue.

Custom applications has Apache based servers in front-end and Tomcat/WebLogic in backend where target applications are deployed. Each custom application has their own Logout functionality implemented. Same is the case with Legacy applications which has their own Logout pages with specific logout functionality.

How is Logout implemented then? Primary source for all applications is Oracle Portal for which performing logout is an easy job and clears all Portal related cookies. So from Portal logout.jsp, a call is made to the other application say PEOPLESOFT to clear Peoplesoft related sessions. The chain goes like this until all cookies/sessions pertaining to all applications are cleared.
The negative side of this approach is that the latency because calls are made to all the applications in the architecture. You can take this granted for a single reason : Logout is performed as heavily as Login or other transactions.