Integration between Oracle Access Manager and Oracle Entitlement Server

This post describes the aspects of the integration between Oracle Entitlement Server and Oracle Access Manager. As we know that from 11g onwards, Oracle recommends OAM for authentication, SSO and OES for Authorization. Hence it's always good to know how this integration works.

Frankly, there is no integration between OAM and OES. The ease of the product OES allows us to integrate with various applications and utilise OES for ATZ. 

In my case, I have implemented the scenario as explained below.

The Weblogic Portal 10.2 will be authenticated using OAM and the authentication scheme can be used as Basic over Ldap or Form (I have done Basic Over LDAP for timebeing). 

Upon successful authentication using OAM, access server generates obssocookie and sends it to browser. However the front end here is the OHS proxy server for weblogic portal resource.
Hence the plugin in proxy server (mod_weblogic) will forward this request to the Weblogic Security Framework. WLS framework will inturn trigger the SSPI interface where the weblogic server SSM is being configured (as SSM realm). 

The providers that are configured are:
1. OAM Identity Asserter
2. LDAP Authenticator

The OAM 10.1.4.3 package provides the oamAuthnProvider.jar which should be copied to the weblogic server directory (wls_server103\mbeantypes\lib).
Once the request is passed to the SSPI interface of OES, the OAM identity Asserter (flagged as REQUIRED) kicks in and checks for ObSSOCookie in the request. If it exists then weblogic will validate the user against the LDAP using LDAP Authenticator. 

At this point, the resource is authorised at page level by OAM.
Now, its time for OES to do the page level and content level authorization.
Based on the resources and policies (ATZ and Role) configured in OES, it fetches the user accessing the resource and executes Role and ATZ policies. If the user is allowed GRANT, then the user will be shown the requested page.
If there are any ALES tags specified in the application for content level atz, it gets executed.

I will attach the architecture diagram soon.
Various products used in this integration are:
1. Oracle Access Manager 10.1.4.3
2. Oracle Entitlement Server 10.1.4.3 (Admin CP3, SSM CP3)
3. Weblogic Portal 10.2.0

Uninstall ALES Schema or Re-running DB Config tool

          As we know that it is pretty straight forward to create the ALES schema using DB Config tool. I am writing here something which is not documented anywhere as to how to re-run the DB config tool if wrong values are specified for oes username or password etc.,
               Here are the steps to be followed to revert and re-run the DB config tool. This assumes that the user created is oesdbuser while running the dbconfig tool.

1. Connet to sqlplus as sys user.
2. Execute the command "revoke asi_role from oesdbuser; "
3. Execute the command Execute the command "drop user oesdbuser cascade; "
4. Execute the command "revoke create trigger from asi_role;"
5. Execute the command "revoke create sequence from asi_role;"
6. Execute the command "revoke create table from asi_role;"
7. Execute the command "revoke create session from asi_role;"
8. Execute the command "drop tablespace ales_oracle including contents and datafiles;" 

Now, you can re-run the DB config tool safely.

Fine grained authorization of Weblogic Portal using Oracle Entitlement Server

Hi all,
This time I have come up with a viewlet which shows the fine grained atz of weblogic portal using OES. Fine grained atz includes page (portlet) level access and content level access based on roles specified in the OES.

I would also like to share some of the gotchas that I came up with during this OES-WLP integration. I followed the OOTB SimplePortalExample that is provided in examples folder of WL-SSM. I have found few differences with my application and SimplePortalExample. The resource PortalDefinitionManager should be created in netuix.jar which is under ejb resource.
So the final resource structure should look like ejb -> netuix.jar -> PortalDefinitionManager -> create. The authorization policy should be defined to provide execute permission to Administrator users which are weblogic and portaladmin.

Products used:
Oracle Entitlement Server 10.1.4.3 (CP3 for Admin WL-SSM)
Weblogic Portal 10.2.0

Note: Only weblogic Portal 10.2.0 is certifed with OES at the moment. I tried with Weblogic Portal 10.3.0 to test it and it failed to start the portal server after SSM instance creation.

For Viewlet and sample portal application with OES tags, please contact me.