How to setup Oracle Access Manager in disaster recovery mode?

In every real time environment, you would use two production sites i.e., Active , Stand-by. At a time, only one site will be up and running. This means all the transactional data with respect to Oracle Access Manager will be present in LDAP (user data, configuration data, policy store). However I am going to talk about providing disaster recovery setup for LDAP used by OAM. I would like to stress the key points involved in setting up OAM 10g for disaster recovery with less or no manual intervention.
I have explained much detailed here.

How clustering works with Access Server and WebGates

This post talks about webgate communicating with multiple access servers which are deployed in Primary/Secondary scenario. I have explained in detail about this post here.
Please feel free to reach me if you have any queries.

Global Logout in Oracle Access Manager 10g

This post covers the Global Logout operation to be performed in Oracle Access Manager 10g. If you look at the OAM 10g documentation for Global Logout, it just talks about having logout keyword in the logout URL (except logout images etc.,).
In reality, achieving Logout is not an easy job with Oracle Access Manager. If there are multiple products integrated with OAM 10g, killing obssocookie alone will not suffice the job. The cookies or sessions of applications that are integrated with OAM 10g needs to be implicitly killed and this is all customization. This is explained in detail in the post.

The most challenging part of this Global Logout is : User logs into Portal 11g and access multiple applications (custom and Legacy) within same session so is different cookies/sessions gets created for respective applications. Logout link is enabled only in Portal 11g but not in any of the other downstream applications. The concept is simple that single Logout at a single place. When the logout is performed in Portal 11g, Portal and OSSO related cookies/sessions gets cleared. However, cookies/sessions pertaining to other apps are not deleted and hence logging in a different user with in same browser session pertains old user session. Easy way to overcome this is to close all the IE browsers. An exception to this is to use < IE6 as there is a browser session sharing feature implemented in IE7 and above.

Now let us talk about the actual scenario.

To talk about our environment, there are almost 8 applications which is a mix of Custom applications and Legacy applications such as PEOPLESOFT, SIEBEL, ORACLE PORTAL 11g. Since Oracle Portal 11g integrates with OSSO - OAM 10g directly, there is a Logout page in OSSO (of Portal) which has functionality to delete OSSO related sessions for Portal. Since we used logout URL which calls logout.jsp, the OAM treats as logout call by default and sets the ObSSOCookie to loggedoutcontinue.

Custom applications has Apache based servers in front-end and Tomcat/WebLogic in backend where target applications are deployed. Each custom application has their own Logout functionality implemented. Same is the case with Legacy applications which has their own Logout pages with specific logout functionality.

How is Logout implemented then? Primary source for all applications is Oracle Portal for which performing logout is an easy job and clears all Portal related cookies. So from Portal logout.jsp, a call is made to the other application say PEOPLESOFT to clear Peoplesoft related sessions. The chain goes like this until all cookies/sessions pertaining to all applications are cleared.
The negative side of this approach is that the latency because calls are made to all the applications in the architecture. You can take this granted for a single reason : Logout is performed as heavily as Login or other transactions.

How to find Apache Version in Oracle Application Server

Oracle HTTP Server is developed using Apache server as base. So if you have Oracle Application Server installed in your environment and if you want to know the in built Apache version then you can use either of the approaches.

1. Goto $ORACLE_HOME/Apache/Apache/bin and execute ./httpd -v or ./httpd -version.
In most of the environments you may not be succesful with the above command then you can use 2nd approach as given below.
2. UNIX:
$ORACLE_BASE/oraInventory/Components/oracle.apache.apache/
or
$ORACLE_HOME/inventory/Components/oracle.apache.apache/

WINDOWS:
INST_LOC\Components\oracle.apache.apache\

INST_LOC is a regitry entry, which was used by the Installation:
HKEY_LOCAL_MACHINE\SOFTWARE\ORACLE\inst_loc

If you dont find Components folder, then traverse to the folder Components21.

To know more about OHS, you can see the metalink note: 260449.1

How to add custom fields in OIM Self Registration page

I have read this article  which talks about adding custom field (email confirmation for 2nd time) in the Self Registration page. The scenario is simple:

To add field Confirm Email for 2nd time in the Self Registration page. This behavior can been seen in many of the websites. So, what would you do when you are using OIM for this purpose? By default, OIM supports adding custom fields to custom self registration page by modifying the FormMetaData.xml file. However, the problem arises when you want to add logic to the form to have the Email confirm field match the Email field. This can be done easily (either by adding javascript or by adding custom code) if it is a custom Self Registration Page and not OIM self registration page. The workaround is so simple: Decompile the tcSelfRegistrationAction.class java file deployed in the XellerateFull.ear file and copy the function of confirming the password and change the field name to email. 

Identity propogation in a flow involving OAM, OWSM and OSB

I have recently gone through this article and found very interesting.
The scenario is this:
OAM is protecting a Portal UI application which is making WebService calls. WebService is protected by OWSM and the communication is made through OSB. Two approaches were discussed in detail in that article.

Performance tuning of Oracle Access Manager

I am glad that I got an opportunity to perform the tuning process of a real time IAM project implementation.
This is one area which I found very interesting and challenging.

Well, I would like to talk & give directions about various tuning aspects of Oracle Access Manager.
The Oracle Access Manager deployment guide and sizing guide (also called capacity planning) are references for this.

The tuning process has to be in the following order:

• Tuning the Database: In my case, we have used Oracle database and tuning guide is here.
• Tuning the LDAP: In my case, we have used Oracle Internet Directory as user store. OID tuning guide is here. No matter how well you tune the Oracle Access Manager, it makes to trip to LDAP for authentication and authorization calls. So, it is vital to tune the LDAP prior to Oracle Access Manager.
• Tuning the Web Server: Oracle Access Manager web components such as webpass and webgate webserver components has to be tuned well. In my case, we have used OHS WebServer (tuning documentation) and Apache WebServer (tuning documentation) for webgates and webpass components.
• Tuning the Oracle Access Manager: Components to be tuned here are Identity System and Access Server.
• Tuning the network: The performance of the overall network, or network latency, is a major factor in the performance of the system. A reduction in network latency will be reflected in the performance of Oracle Access Manager. Documentation is here.

I will explain tuning of every component in details in next posts. So, keep tuned to this!