This post describes the aspects of the integration between Oracle Entitlement Server and Oracle Access Manager. As we know that from 11g onwards, Oracle recommends OAM for authentication, SSO and OES for Authorization. Hence it's always good to know how this integration works.
Frankly, there is no integration between OAM and OES. The ease of the product OES allows us to integrate with various applications and utilise OES for ATZ.
In my case, I have implemented the scenario as explained below.
The Weblogic Portal 10.2 will be authenticated using OAM and the authentication scheme can be used as Basic over Ldap or Form (I have done Basic Over LDAP for timebeing).
Upon successful authentication using OAM, access server generates obssocookie and sends it to browser. However the front end here is the OHS proxy server for weblogic portal resource.
Hence the plugin in proxy server (mod_weblogic) will forward this request to the Weblogic Security Framework. WLS framework will inturn trigger the SSPI interface where the weblogic server SSM is being configured (as SSM realm).
The providers that are configured are:
1. OAM Identity Asserter
2. LDAP Authenticator
The OAM 10.1.4.3 package provides the oamAuthnProvider.jar which should be copied to the weblogic server directory (wls_server103\mbeantypes\lib).
Once the request is passed to the SSPI interface of OES, the OAM identity Asserter (flagged as REQUIRED) kicks in and checks for ObSSOCookie in the request. If it exists then weblogic will validate the user against the LDAP using LDAP Authenticator.
At this point, the resource is authorised at page level by OAM.
Now, its time for OES to do the page level and content level authorization.
Based on the resources and policies (ATZ and Role) configured in OES, it fetches the user accessing the resource and executes Role and ATZ policies. If the user is allowed GRANT, then the user will be shown the requested page.
If there are any ALES tags specified in the application for content level atz, it gets executed.
I will attach the architecture diagram soon.
Various products used in this integration are:
1. Oracle Access Manager 10.1.4.3
2. Oracle Entitlement Server 10.1.4.3 (Admin CP3, SSM CP3)
3. Weblogic Portal 10.2.0
Thursday, January 7, 2010
Uninstall ALES Schema or Re-running DB Config tool
As we know that it is pretty straight forward to create the ALES schema using DB Config tool. I am writing here something which is not documented anywhere as to how to re-run the DB config tool if wrong values are specified for oes username or password etc.,
Here are the steps to be followed to revert and re-run the DB config tool. This assumes that the user created is oesdbuser while running the dbconfig tool.
- Connet to sqlplus as sys user.
- Execute the command "revoke asi_role from oesdbuser; "
- Execute the command Execute the command "drop user oesdbuser cascade; "
- Execute the command "revoke create trigger from asi_role;"
- Execute the command "revoke create sequence from asi_role;"
- Execute the command "revoke create table from asi_role;"
- Execute the command "revoke create session from asi_role;"
- Execute the command "drop tablespace ales_oracle including contents and datafiles;"
Fine grained authorization of Weblogic Portal using Oracle Entitlement Server
Hi all,
This time I have come up with a viewlet which shows the fine grained atz of weblogic portal using OES. Fine grained atz includes page (portlet) level access and content level access based on roles specified in the OES.
I would also like to share some of the gotchas that I came up with during this OES-WLP integration. I followed the OOTB SimplePortalExample that is provided in examples folder of WL-SSM. I have found few differences with my application and SimplePortalExample. The resource PortalDefinitionManager should be created in netuix.jar which is under ejb resource.
So the final resource structure should look like ejb -> netuix.jar -> PortalDefinitionManager -> create. The authorization policy should be defined to provide execute permission to Administrator users which are weblogic and portaladmin.
Products used:
Oracle Entitlement Server 10.1.4.3 (CP3 for Admin WL-SSM)
Weblogic Portal 10.2.0
Note: Only weblogic Portal 10.2.0 is certifed with OES at the moment. I tried with Weblogic Portal 10.3.0 to test it and it failed to start the portal server after SSM instance creation.
For Viewlet and sample portal application with OES tags, please contact me.
This time I have come up with a viewlet which shows the fine grained atz of weblogic portal using OES. Fine grained atz includes page (portlet) level access and content level access based on roles specified in the OES.
I would also like to share some of the gotchas that I came up with during this OES-WLP integration. I followed the OOTB SimplePortalExample that is provided in examples folder of WL-SSM. I have found few differences with my application and SimplePortalExample. The resource PortalDefinitionManager should be created in netuix.jar which is under ejb resource.
So the final resource structure should look like ejb -> netuix.jar -> PortalDefinitionManager -> create. The authorization policy should be defined to provide execute permission to Administrator users which are weblogic and portaladmin.
Products used:
Oracle Entitlement Server 10.1.4.3 (CP3 for Admin WL-SSM)
Weblogic Portal 10.2.0
Note: Only weblogic Portal 10.2.0 is certifed with OES at the moment. I tried with Weblogic Portal 10.3.0 to test it and it failed to start the portal server after SSM instance creation.
For Viewlet and sample portal application with OES tags, please contact me.
Installing OES on 11g R1 Weblogic 10.3.1
Now its time to share the information that OES Admin server works with Weblogic server 10.3.1.
The steps followed are as shown in blog.
I have also tried with WLS 10.3.2 and it worked fine with Admin server and patching to CP3 had no problems. We are also able to access the OES consoles. However the problems arised after running configtool for WLS SSM. Hence its good not to try with WLS 10.3.2.
Watch this blog for more info on integrations with Weblogic Portal and Sharepoint coming soon.
The steps followed are as shown in blog.
I have also tried with WLS 10.3.2 and it worked fine with Admin server and patching to CP3 had no problems. We are also able to access the OES consoles. However the problems arised after running configtool for WLS SSM. Hence its good not to try with WLS 10.3.2.
Watch this blog for more info on integrations with Weblogic Portal and Sharepoint coming soon.
Cookie less SSO with OAM
The cookieless single sign-on session support with OAM can be provided by placing the Oracle WebCache between user's browser and web server as depicted in above figure.
End-user can either use separate WebCache instances for each backend web server, or use the common WebCache instance which will be shared by multiple backend web servers.
The Web Cache component provides cookie management, using the SSL session Id as key. The SSL sessions are mandatory for this solution, and they are established between the user’s browser and the OHS servers. The Single Domain single sign-on flow will be very similar to the cookie-based solution. The main difference will be when the Oracle Access Manager WebGate sets a cookie, the cookie will be cached in the Web Cache instance, keyed using the SSL session ID. When the user accesses the servers again later on, Web Cache retrieves the relevant cookies tied to this SSL session ID, and makes them available to the downstream servers and applications.
Note that in this solution, the cookies are never made available to the end-user’s browser. Assuming the Web Cache instances are protected by a firewall, then the cookies never need to go outside the protection of the firewall.
During logout, Oracle Access Manager WebGate will clean up their respective cookies by setting the obssocookie to “loggedoutcontinue”The Web Cache, when received such requests, removes the cookies from its cookie cache.
Oracle SSO provisioning for APEX
This section deals with provisioning Oracle SSO for APEX application.
1. Register APEX as partner application in Oracle Application server.
Note some of the details as shown below.
ID: 80F63272
Token: 51J0903680F63272
Encryption Key: EBBD933BC541FAFF
Login URL: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Single Sign-Off URL: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_logout
Name : APEX
Home URL : http://apex_hostname:8080/apex
Success URL : http://apex_hostname:8080/apex/wwv_flow_custom_auth_sso.process_success
Logout URL :http://apex_hostname:8080/apex
This Application Name APEX will be used in 5th step while associating SSO application name in the Authentication scheme.
2. Next step is to install SDK package and configuration.
Extract the sdk902.zip file present in middle tier to the local machine.
Login as FLOWS_xxxx user and execute @loadsdk.sql.
Then logout and login again, and execute @regapp.sql by inputting some parameters of Partner application.
Enter value for listener_token: HTML_DB:sbpdb.idc.oracle.com:8080
Enter value for site_id: 80F63272
Enter value for site_token: 51J0903680F63272
Enter value for login_url: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Enter value for encryption_key: EBBD933BC541FAFF
Enter value for ip_check: N
It is important that listener_token should be in the format HTML_DB:hostname_where_apex_installed:port_no_apex_listens.
When the registration is successful, then the result will be as shown below:
Registration successful.
Listener token: HTML_DB:sbpdb.idc.oracle.com:8080
Site id : 80F63272
Site token : 51J0903680F63272
Encryption key: EBBD933BC541FAFF
Login URL : http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Logout URL : http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_logout
IP check : N
3. Third step is to execute custom_auth_sso_902.sql and custom_auth_sso_902.plb as FLOWS_xxxx user.
4. Grant execute permissions as shown below:
grant execute on wwv_flow_custom_auth_sso to APEX_PUBLIC_USER;
5. Login to APEX console, and create Authentication scheme with name CUSTOM SSO and map the SSO Partner application as APEX (as in the first step).
Congrats, you have finished SSO configurations for APEX.
Now login to apex application (for eg, http://apex_hostname:8080/apex/f?p=104:2) and check SSO login page will be displayed.
1. Register APEX as partner application in Oracle Application server.
Note some of the details as shown below.
ID: 80F63272
Token: 51J0903680F63272
Encryption Key: EBBD933BC541FAFF
Login URL: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Single Sign-Off URL: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_logout
Name : APEX
Home URL : http://apex_hostname:8080/apex
Success URL : http://apex_hostname:8080/apex/wwv_flow_custom_auth_sso.process_success
Logout URL :http://apex_hostname:8080/apex
This Application Name APEX will be used in 5th step while associating SSO application name in the Authentication scheme.
2. Next step is to install SDK package and configuration.
Extract the sdk902.zip file present in middle tier to the local machine.
Login as FLOWS_xxxx user and execute @loadsdk.sql.
Then logout and login again, and execute @regapp.sql by inputting some parameters of Partner application.
Enter value for listener_token: HTML_DB:sbpdb.idc.oracle.com:8080
Enter value for site_id: 80F63272
Enter value for site_token: 51J0903680F63272
Enter value for login_url: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Enter value for encryption_key: EBBD933BC541FAFF
Enter value for ip_check: N
It is important that listener_token should be in the format HTML_DB:hostname_where_apex_installed:port_no_apex_listens.
When the registration is successful, then the result will be as shown below:
Registration successful.
Listener token: HTML_DB:sbpdb.idc.oracle.com:8080
Site id : 80F63272
Site token : 51J0903680F63272
Encryption key: EBBD933BC541FAFF
Login URL : http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Logout URL : http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_logout
IP check : N
3. Third step is to execute custom_auth_sso_902.sql and custom_auth_sso_902.plb as FLOWS_xxxx user.
4. Grant execute permissions as shown below:
grant execute on wwv_flow_custom_auth_sso to APEX_PUBLIC_USER;
5. Login to APEX console, and create Authentication scheme with name CUSTOM SSO and map the SSO Partner application as APEX (as in the first step).
Congrats, you have finished SSO configurations for APEX.
Now login to apex application (for eg, http://apex_hostname:8080/apex/f?p=104:2) and check SSO login page will be displayed.
Caveats & Bugs identified while installing OAM on Linux
Ensure that following conditions are met while installing OAM on linux. Typically you will face issue after webpass installation while starting HTTP Server.
OAM 10.1.4.3:
1. While starting OIS Server
Error:
/disk1/oracle/Middleware/OAM/identity/oblix/apps/common/bin/ois_server: error while loading shared
libraries: libdl.so.2: cannot open shared object file: No such file or directory
rm: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or
directory
OIS Server started with pid: 21290
[oracle@ATL2-LNX01 bin]$ /bin/sh: error while loading shared libraries: libdl.so.2: cannot open shared
object file: No such file or directory
Solution: comment out all the lines where it is setting LD_ASSUME_KERNEL to 2.4.19 in start_ois_server
script OR run the script start_ois_server_nptl.
2. gcc libraries incompatibilty
Error:
/disk1/oracle/Middleware/WebTier/ohs/bin/apachectl startssl: execing httpd
httpd.worker: Syntax error on line 1047 of
/disk1/oracle/Middleware/WebTier/instances/instance1/config/OHS/ohs1/httpd.conf: Cannot load
/disk1/oracle/Middleware/OAM/ohswebpass/identity/oblix/lib/libgcc_s.so.1 into server:
/disk1/oracle/Middleware/OAM/ohswebpass/identity/oblix/lib/libgcc_s.so.1: wrong ELF class: ELFCLASSS32
Solution: libgcc_s.so.1 will be present in /usr/lib64 or /lib64 directories. So should copy those gcc lib
into the oblix lib location.
Similarly copy libstdc++.so.5 from OS binaries.
OAM 10.1.4.2:
1. Open the httpd.conf file and comment the perl module as shown below.
#LoadModule perl_module libexec/libperl.so
2. Add Kernel param value in OHS/opmn/conf/opmn.xml file as shown below.
.......
3. Disable ssl in OHS/opmn/conf/opmn.xml as shown below for HTTP_Server component tab.
Bugs identified while upgrading to OAM 10.1.4.0.2 BP02:
When installing the 10.1.4.2.0 BP02 patch (Patch 6748699 or 5957301), against a 10.1.4.2.0 installation, you will receive the following error:
For Webpass:
--- Oracle Access Manager install ---
Error: You are trying to apply patch of Oracle WebPass for different server
while the component Oracle WebPass is installed for different server.
This is not supported
For Policy Manager:
--- Oracle Access Manager install ---
Error: You are trying to apply patch of Oracle Policy Manager for different
server while the component Oracle Access Manager is installed for different
server.
This is not supported.
For WebGate :
--- Oracle Access Manager install ---
Error: You are trying to apply patch of Oracle Webgate for different
server while the component Oracle Access Manager is installed for different
server.
This is not supported.
You are sure that you are using the correct patch installer for the component you are trying to patch
It is caused by a long path to the installation binary identified as Bug 6996850.
As a workaround, move the binary for the patch to a location with a shorter path. For example:
This fails:
/scratch/download/OAM10_Release2_BP02_Patch/Oracle_Access_Manager10_1_4_2_0_BP02_Patch_linux_APACHE2_WebPass_binary_parameter
This works:
/u01/orasoft/wgpatch/Oracle_Access_Manager10_1_4_2_0_Patch_linux_OHS_WebGate_binary_parameter
OAM 10.1.4.3:
1. While starting OIS Server
Error:
/disk1/oracle/Middleware/OAM/identity/oblix/apps/common/bin/ois_server: error while loading shared
libraries: libdl.so.2: cannot open shared object file: No such file or directory
rm: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or
directory
OIS Server started with pid: 21290
[oracle@ATL2-LNX01 bin]$ /bin/sh: error while loading shared libraries: libdl.so.2: cannot open shared
object file: No such file or directory
Solution: comment out all the lines where it is setting LD_ASSUME_KERNEL to 2.4.19 in start_ois_server
script OR run the script start_ois_server_nptl.
2. gcc libraries incompatibilty
Error:
/disk1/oracle/Middleware/WebTier/ohs/bin/apachectl startssl: execing httpd
httpd.worker: Syntax error on line 1047 of
/disk1/oracle/Middleware/WebTier/instances/instance1/config/OHS/ohs1/httpd.conf: Cannot load
/disk1/oracle/Middleware/OAM/ohswebpass/identity/oblix/lib/libgcc_s.so.1 into server:
/disk1/oracle/Middleware/OAM/ohswebpass/identity/oblix/lib/libgcc_s.so.1: wrong ELF class: ELFCLASSS32
Solution: libgcc_s.so.1 will be present in /usr/lib64 or /lib64 directories. So should copy those gcc lib
into the oblix lib location.
Similarly copy libstdc++.so.5 from OS binaries.
OAM 10.1.4.2:
1. Open the httpd.conf file and comment the perl module as shown below.
#LoadModule perl_module libexec/libperl.so
2. Add Kernel param value in OHS/opmn/conf/opmn.xml file as shown below.
3. Disable ssl in OHS/opmn/conf/opmn.xml as shown below for HTTP_Server component tab.
When installing the 10.1.4.2.0 BP02 patch (Patch 6748699 or 5957301), against a 10.1.4.2.0 installation, you will receive the following error:
For Webpass:
--- Oracle Access Manager install ---
Error: You are trying to apply patch of Oracle WebPass for different server
while the component Oracle WebPass is installed for different server.
This is not supported
For Policy Manager:
--- Oracle Access Manager install ---
Error: You are trying to apply patch of Oracle Policy Manager for different
server while the component Oracle Access Manager is installed for different
server.
This is not supported.
For WebGate :
--- Oracle Access Manager install ---
Error: You are trying to apply patch of Oracle Webgate for different
server while the component Oracle Access Manager is installed for different
server.
This is not supported.
You are sure that you are using the correct patch installer for the component you are trying to patch
It is caused by a long path to the installation binary identified as Bug 6996850.
As a workaround, move the binary for the patch to a location with a shorter path. For example:
This fails:
/scratch/download/OAM10_Release2_BP02_Patch/Oracle_Access_Manager10_1_4_2_0_BP02_Patch_linux_APACHE2_WebPass_binary_parameter
This works:
/u01/orasoft/wgpatch/Oracle_Access_Manager10_1_4_2_0_Patch_linux_OHS_WebGate_binary_parameter
Subscribe to:
Posts (Atom)