Oracle® Identity & Access Manager / SOA Stack : Find the password for default-keystore.jks and .xldatabasekey keystores and stored keys.

The passwords for the keystores are saved in CSF - Credential Store Framework - filestore ($DOMAIN_ROOT/config/fmwconfig/cwallet.sso) and thus it's accessible via CSF API / Mbeans.

The easiest way to find the password in cleartext is to use the JpsCredentialStore MBean via Enterprise Manager:

1. Login to EM
2. Browse to

   WebLogic Domain -> <Domain> -> System MBean Browser

3. In MBean Browser browse to

   Application Defined MBeans -> com.oracle.jps -> Domain: <Domain>
     -> JpsCredentialStore

4. From Operations tab execute the getPortableCredentialMap operation with
   following parameter:

   Name     Type              Value
   -------- ----------------  ---------------------
   p1       java.lang.String  oim

5. Browse through the provided credential list to get the password
   in human readable form for the entry you are interested in.

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) - Steps to Setup Auditing for OES

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) - Steps to Setup Auditing for OES

1Create an Oracle database for Audit purposes

2Run ./rcu to load the OES Audit schema, in database created in step number 1 Make sure to Select "AS Common Schema -> Audit Services for OES" set prefix -> AUDIT (important for next step)

3-Start APM domain and open weblogic console -> http://host:7001/console Create a JDBC connection, setting values according to your database Under JDBC, click the Data Sources link Create new jdbc Data Source JNDI Name -> jdbc/AuditDB user is the prefix set in RCU process + _IAUOES -> AUDIT_IAUOES  

password set during RCU -> welcome1

Make sure "Test Connection" is successful

4-Stop APM domain

5-Edit Oracle/Middleware/user-projects/domains/APM/config/fmwconfig/jps-config.xml,

Set Audit properties as follows

<serviceInstance name="audit" provider="audit.provider"> 

<property name="audit.filterPreset" value="All"/> 

<property name="audit.maxDirSize" value ="500000"/> 

<property name="audit.maxFileSize" value ="50000"/> 

<property name="audit.loader.jndi" value="jdbc/AuditDB"/>

 <property name="audit.loader.interval" value="15" /> 

<property name="audit.loader.repositoryType" value="Db" /> 

</serviceInstance>

6-Start APM Domain

7-Go to your Audit schema, and check the information stored Connect based your user info, for example -> ./sqlplus audit_iauoes/welcome1 run a sql to test, 

SELECT * FROM IAU_BASE WHERE ROWNUM<2, 

to check a couple of records where the information was stored

For more information on Audit schema refer to the  following documentation link in Oracle Fusion Middleware Application Security Guide (12.5 Advanced Management of Database Store):

8.) Ensure that your jps-config.xml is configured accurately as follows

<?xml version="1.0" encoding="UTF-8" standalone='yes'?>

<jpsConfig xmlns="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd" 

          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 

 xsi:schemaLocation="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd" 

 schema-major-version="11" schema-minor-version="1">

    <serviceProviders>

     <serviceProvider name="audit.provider" type="AUDIT" class="oracle.security.jps.internal.audit.AuditProvider">

     </serviceProvider>

    </serviceProviders>

  <serviceInstances>

   <serviceInstance name="audit" provider="audit.provider">

      <property name="audit.filterPreset" value="Low"/>

      <property name="audit.specialUsers" value ="admin, fmwadmin" />

      <property name="audit.customEvents" value ="JPS:CheckAuthorization, CreateCredential; OIF:UserLogin"/>

      <property name="audit.loader.jndi" value="jdbc/AuditDB"/>

      <property name="audit.loader.interval" value="15" />

      <property name="audit.maxDirSize" value="102400" />

      <property name="audit.maxFileSize" value="10240" />      

      <property name=" audit.loader.repositoryType " value="Db" />      

   </serviceInstance>

  </serviceInstances>

    <jpsContexts default="default">

        <jpsContext name="default">

            <serviceInstanceRef ref="audit"/>

        </jpsContext>

    </jpsContexts>

</jpsConfig>

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) - Secure the XACML Authorization Web Service

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) - Secure the XACML Authorization Web Service 

To associate a WS-Policy file with a Web service:

• If you have not already done so, in the Change Center of the Administration Console, click Lock & Edit  
• In the left pane of the Administration Console, select Deployments.
• In the right pane, navigate within the Deployments table until you find the Web service for which you want to configure a WS-Policy file.Note: Web services are deployed as part of an Enterprise application, Web application, or EJB. To understand how Web services are displayed in the Administration Console.

• In the Deployments table, click the name of the Web service.

• Select Configuration -> WS-Policy.The table lists the WS-Policy files that are currently associated with the Web service. The top level lists all the ports of the Web service. Click the + next to a Web service port to see its operations and associated WS-Policy files.

• To associate a WS-Policy file with an entire Web service endpoint (port):
• Click the name of the Web service port. A page appears which includes two columns: one labelled Available Endpoint Policies that lists the names of the WS-Policy files that you can attach to a Web service endpoint and one labelled Chosen Endpoint Policies that lists the WS-Policy files that are currently configured for this endpoint.
• Use the arrows to move WS-Policy files between the available and chosen columns. The WS-Policy files that are in the Chosen column are attached to the Web service endpoint.
• Click OK.If your Web service already has a deployment plan associated to it, then the newly attached WS-Policy files are displayed in the Policies column in the table.
  If the J2EE module of which the Web service is a part does not currently have a deployment plan associated with it, the assistant asks you for the directory that should contain the deployment plan. Use the navigation tree to specify a directory, then click Finish.

• To associate a WS-Policy file with a Web service operation:
• Click the name of the operation. A page appears which includes two columns: one labeled Available Message Policies that lists the names of the WS-Policy files that are available to attach to the inbound (request) and outbound (response) SOAP message of the operation invoke and one labeled Chosen Message Policies that lists the WS-Policy files that are currently attached to the inbound and outbound SOAP message of the operation invoke.
• Use the arrows to move WS-Policy files between the available and chosen columns. The WS-Policy files that are in the Chosen column are the ones that are attached to the inbound and outbound SOAP message when this operation is invoked by a client application.
• Click Next.
• A page appears which includes two columns: one labeled Available Inbound Message Policies that lists the names of the WS-Policy files that are available to attach to the inbound (request) SOAP message of the operation invoke and one labeled Chosen Outbound Message Policies that lists the WS-Policy files that are currently attached to the inbound SOAP message of the operation invoke.
• Use the arrows to move WS-Policy files between the available and chosen columns. The WS-Policy files that are in the Chosen column are the ones that are attached to the inbound (request) SOAP message when this operation is invoked by a client application.
• Click Next.
• A page appears which includes two columns: one labeled Available Outbound Message Policies that lists the names of the WS-Policy files that are available to attach to the outbound (response) SOAP message of the operation invoke and one labeled Chosen Outbound Message Policies that lists the WS-Policy files that are currently attached to the outbound SOAP message of the operation invoke.
• Use the arrows to move WS-Policy files between the available and chosen columns. The WS-Policy files that are in the Chosen column are the ones that are attached to the outbound (response) SOAP message when this operation is invoked by a client application.
• Click Finish.If your Web service already has a deployment plan associated with it, the attached WS-Policy files are displayed in the Policies column in the table.
  If the J2EE module of which the Web service is a part does not currently have a deployment plan associated with it, the assistant asks you for the directory that should contain the deployment plan. Use the navigation tree to specify a directory, then click Finish.

• To activate these changes, in the Change Center of the Administration Console, click Activate Changes.

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) Create delegated administrator

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) Create delegated administrator 

• Expand the Applications node in the Navigation Panel.
• Select the Application to modify.
• Right-click the Application name and select Open from the menu. The General, Delegated Administrators, Policy Distribution and Simulation tabs are all active.
• Click the Delegated Administrators tab. The Application name is listed in the displayed table. Click the arrow next to the Application name to see the default ApplicationPolicyAdmin created when the Application object was created. Click the Administrator Role name to display its details, in tabs, below the Delegated Administrators table. 
• Role Details
• External Role Mapping
•  External User Mapping
• Click New to create a new Administrator Role. Be sure to select the name of the Application to activate New. Alternately, select the Application and select New from the Actions menu. A New Administrator Role dialog is displayed.

• Provide the following values for the new Administrator Role and click OK. Delegating Application Administration  Name: The entry must be a unique.  Display Name and  Description

• Select the new Administrator Role to activate its configuration tabs. The Role Details tab is active.
• Click Edit to define the role details. An Edit Administrator Role dialog is displayed.
•  Grant View or Manage privileges for the appropriate policy objects and click Save.

Select View or Manage for the listed policy objects. For example, Admin Policy allows the administrator to assign new permissions to an Admin Role. Admin Role, however, allows the administrator to assign members to an Admin Role. 

• Click the External Role Mapping tab to grant the Administrator Role to members of External Roles. User and groups displayed are from the first LDAP provider with sufficient flag defined in WebLogic Server.
• Click Add to display the Search Principals dialog.
•  Complete the query fields in the External Roles search box and click Search. Empty strings fetch all roles. The results display in the Search Results table.
• Select the external role to map to by clicking its name in the table. Use Ctrl+click to select multiple roles.
• Click Add Principals. The selected roles display in the External Role Mapping tab.

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) Steps to create an obligation

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) Steps to create an obligation

The Security Module PDP evaluates the request and returns a response (and applicable obligations) to the PEP in the form of an authorization decision to grant or deny access. 

The PEP fulfills any obligations, if applicable. An obligation is information returned with the decision upon which the PEP may or may not act. For example, an obligation may contain additional information concerning a decision to deny. The PEP entity is responsible for obligation fulfillment based on its settings. Oracle Entitlements Server is only responsible for forwarding the obligation based on policy configuration.

This thread discusses steps to create an Obligation for a policy.

• Create an attribute as shown in the examples getChildPersons. The attribute should of Category: Dynamic; Input Values:  Multiple; Type: String

• Navigate to the authorization policy and create a new obligation by choosing the getChildPersons from the List of Attributes from the window.

•        In the PIP AttributeRetriever code populate the attribute to return the obligation "getChildPersons" 
          } else if ("getChildPersons".equals(string)) {            return ( ............);
          }

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) Add the PIP JAR files to CLASSPATH

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) Add the PIP JAR files to CLASSPATH

• Build the directories where the JAR files will be stored.
• Copy necessary .jar files that are needed to by the attribute retrievers/PIP.
• Add the following lines to the $DOMAIN_HOME/bin/setDomainEnv.sh file.  Setting of the CLASSPPATH variable is toward the bottom of the file, these line should be added immediately following the definition of the variable.

MIND_DOMAIN_APP_DIR=/u01/app/oracle/admin/PIP_LIBS

export MIND_DOMAIN_APP_DIR

CLASSPATH=${CLASSPATH}:${MIND_DOMAIN_APP_DIR}/lib/*:${MIND_DOMAIN_APP_DIR}/lib/dependent/

export CLASSPATH

• Restart the Admin and SM Servers

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) - Secure the XACML Authorization Web Service

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) - Secure the XACML Authorization Web Service

Migrating From Database to XML

Following is the procedure to migrate policies from a database to an XML-based

policy store.

Note: The value of the bootstrap.security.principal.key property needs to be populated with the key generated during reassociation of the policy, credential, and key stores from one repository type to another



1. On the OES server  installed box create a folder migration. Eg: /OES/migration

2. Create a file jps-config.xml Eg: /OES/migration/jps-config.xml

3. Copy the content below to the jps-config.xml file create above and edit the DB connection parameters.

4. Copy the bootstrap folder

5. Copy the system-jazn-data.xml from the following location
$ORACLE_HOME/user_projects/domains/oes_domain/config/fmwconfig to /OES/migration

<!-- Source DB-based policy store instance -->

<serviceInstance provider="policystore.provider"
name="policystore.db.source">
<description>DB Based Policy Store Service Instance</description>
<property name="policystore.type" value="DB_ORACLE"/>
<property name="jdbc.url"
value="jdbc:oracle:thin:@sc.domainexample.com:1722:orcl"/>
<property name="jdbc.driver" value="oracle.jdbc.driver.OracleDriver"/>
<property name="bootstrap.security.principal.key"
value="bootstrap_DWgpEJgXwhDIoLYVZ2OWd4R8wOA=" />
<property name="oracle.security.jps.ldap.root.name" value="cn=jpsTestNode"/>
<property name="oracle.security.jps.farm.name" value="cn=view_steph.atz"/>
</serviceInstance>

<!-- Destination XML-based policy store instance -->
<serviceInstance name="dst.xml" provider="policystore.xml.provider"
location="/scratch/divyasin/WithPSR/jazn-data-fscm.xml">
<description>File Based Policy Store Service Instance</description>
</serviceInstance>


<!-- Bootstrap credentials to access source and destination stores -->
<serviceInstance location="./bootstrap" provider="credstoressp"
name="bootstrap.cred">
<description>Replace location with the full path of the directory where
the bootstrap file cwallet.sso is located; typically found in
destinationDomain/config/fmwconfig/</description>

</serviceInstance>

<jpsContext name="sourceContext">
<serviceInstanceRef ref="policystore.db.source"/>

</jpsContext>

<jpsContext name="destinationContext">
<serviceInstanceRef ref="dst.xml"/>
</jpsContext>

<jpsContext name="bootstrap_credstore_context">
<serviceInstanceRef ref="bootstrap.cred"/>

</jpsContext>

6. On the OES server  installed box navigate to the following location $ORACLE_HOME/Oracle_IDM1/common/bin/

7. Run the follwing command ./wlst.sh

8. If you need to migrate entire policystore use this command:
Eg: migrateSecurityStore(type=”policyStore”,src=”sourceContext”,dst=”destinationContext”,configFile=”OES/migration/jps-config.xml”)

If you need to migration only a specific application policy:

 migrateSecurityStore
(type="policyStore", src="sourceContext",
dst="destinationContext",
configFile="/scratch/divyasin/WithPSR/jps-config.xml")

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0)-Configure Oracle Entitlements Server WebLogic Security Module High Availability

 

1. Run OESCLIENT_HOME/oessm/bin/config.sh to create a WebLogic Security Module and a WebLogic Server domain.
   For example: ./config.sh -smType wls -smConfigId <wls_name> -serverLocation <wls_home> -pdServer <oes_admin_server> -pdPort <oes_admin_ssl_port>

2. On the Welcome screen, select Create a WebLogic Domain then click Next.

3. On the Select Domain Source screen, select Generate a domain configured automatically to support the following added products. From the list, select Oracle Entitlements Server WebLogic Security Module on Weblogic For Managed Server.

4. On the Specify Domain Name and Location screen, enter the name and location for the domain and all its applications.

5. On the Configure Administration Server Username and Password screen, enter the admin user name and password

6. On the Configure Server Start Mode and JDK screen, select Production Mode and JDK.

7. On the Configure Administration Server screen, enter the following:
    Name: AdminServer
    Listen address: All Local Addresses
    Listen port: 7001
    SSL listen port: 7002
    Select SSL Enabled then click Next.

8. Create two managed servers as the following:
    Name           Listen Address      Port     SSL
   wlssm_server1  All Local Addresses  14610   14611  
   wlssm_server2  All Local Addresses  14612   14613

9. Create a cluster and add wlssm_server1, wlssm_server2 to the cluster.

10. Finish to create the domain.

11. Start the admin Server,  wlssm_server1 and wlssm_server2, make sure to have Node Manager Running, 

having StartScriptEnabled=true

12. Check in deployments => oracle.oes.client.pd.ssl (11.1.1.3.0) Active

13. You will see "PDP registration succeeded".

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0)- PEP Query API Example

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0)- PEP Query API Example

Oracle Entitlements Server offers two types of query requests. You can request a list of all actions for a particular Resource (and its children), or you can request complete authorization results for a particular Resource (and its children). Both types of queries will retrieve results for all instantiated Resources of a given Resource Type.

package com.mindtelligent.oes.util;

import java.util.*;

import com.bea.security.*;

import java.io.FileWriter;
import java.io.PrintWriter;

import org.openliberty.openaz.azapi.constants.PepRequestQueryType;

import weblogic.security.principal.*;

import javax.security.auth.*;

import java.security.*;

import java.security.acl.Group;

import weblogic.security.principal.WLSUserImpl;
import weblogic.security.principal.WLSGroupImpl;

import javax.security.auth.spi.LoginModule;

import oracle.security.jps.openaz.pep.PepRequestFactoryImpl;

import org.openliberty.openaz.azapi.pep.Obligation;

import org.openliberty.openaz.azapi.pep.PepException;
import org.openliberty.openaz.azapi.pep.PepResponse;


public class PEPQuery {
    public static void main(String[] args) {      
        Subject user = new Subject();
        Principal p = new WLSUserImpl("hsaluja");
        user.getPrincipals().add(p);
        Principal g = new WLSGroupImpl("MindTelligentCRMUsers");
        user.getPrincipals().add(g);
        // Resource being accessed AppName/ResourceType/ResouceName
        String resourceString = "CRMApplication/CRMResourceType/CRMResource";
        // Action initiated by the user
        String action = "access";
        // String action = "close";
        // Environmental/Context attributes
        Map env = new HashMap();
        env.put("isEmployee","true");
        //   Simple grant-deny call
        while (true) {
            try {
                // get Authorization response from OES
                long start = System.currentTimeMillis();
                PepResponse response;                
                response =
                        PepRequestFactoryImpl.getPepRequestFactory().newPepRequest(user,
                                                                                   action,
                                                                                   resourceString,
                                                                                   env).decide();
                long end = System.currentTimeMillis();                
                System.out.println("Time: " + (end - start) + "ms");
                System.out.println("Request: {" + user.toString() + ", " +
                                   action + ", " + resourceString +
                                   "} \nResult: " + response.allowed() +
                                   "\n Obligation(s) :");               
                // Process the Obligations and write them to a file
                Map<String, Obligation> obs = response.getObligations();
                if (obs != null && !obs.isEmpty()) {
                    for (Map.Entry<String, Obligation> entry :
                         obs.entrySet()) {
                        PrintWriter out =
                            new PrintWriter(new FileWriter("/home/oracle/obligation.txt"));
                            System.out.println(entry.getValue().getStringValues().values());
                        //out.close();
                    }
                }
            } catch (PepException e) {
                System.out.println("***** Caught exception: " +
                                   e.getMessage());
                e.printStackTrace();
                System.exit(1);
            } catch (Exception ex) {

                StackTraceElement[] elements = ex.getStackTrace();
                for (int i = 0; i > elements.length; i++) {
                    System.out.println(elements[i]);
                }
                ex.printStackTrace();
            }
            Runtime rt = Runtime.getRuntime();
            long usedMB = (rt.totalMemory() - rt.freeMemory()) / 1024 / 1024;
            System.out.println("memory usage: " + usedMB + "MB");
            System.out.println("sleeping 5 sec. Hit Ctrl-C to quit\n");
            try {
                Thread.currentThread().sleep(5000);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }

}

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0)- How to configure custom Attribute Retriever

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0)- How to configure custom Attribute Retriever

Create a java code, convert to a jar, and add it to the CLASSPATH.

Here is the sample of custom attribute retriever:

package com.mindtelligent.oes.customproviders;
import com.bea.security.providers.authorization.asi.AttributeRetriever;
import weblogic.security.spi.Resource;
import weblogic.security.service.ContextHandler;

import javax.security.auth.Subject;
import java.util.*;
import java.io.*;

public class MyAttributeRetriever implements AttributeRetriever {
private static final String TestCustomAttribute = "TestCustomAttribute";
private String[] attributes = {"TestCustomAttribute"};
private static boolean switchStatus = true;
public String[] getHandledAttributeNames() {
return attributes;
}
public Object getAttributeValue(String name,Subject subject,Map roles,Resource resource,ContextHandler contextHandle) {
ArrayList listValues = new ArrayList();
String attrValue = "default";
if (name.equals("TestCustomAttribute")) {
System.out.println("Name"+name);
attrValue = "TestCustomAttribute";
System.out.println( "attrValue value is TestCustomAttribute "); }
else { System.out.println( "attrValue value is NotTestCustomAttribute "); }
return attrValue;}

Modify jps-config.xml, located in the Security Module

For Example:

<serviceProvider class="oracle.security.jps.az.internal.runtime.provider.PIPServiceProvider" name="pip.service.provider" type="PIP"/>

<serviceInstance name="pip.service.MyAttributeRetriever" provider="pip.service.provider">
      <property name="type" value="CUSTOM_PIP"/>
      <property name="application" value="TestCustomAttribute"/>
      <property name="description" value="MyAttributeRetriever"/>
      <property name="classnames" value="com.mindtelligent.oes.customproviders.MyAttributeRetriever"/>
  </serviceInstance>

<serviceInstanceRef ref="pip.service.MyAttributeRetriever"/>

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) Configure Web Service Security Module

Oracle Fusion Middleware OES-11g Release 2 (11.1.2.2.0) Configure Web Service Security Module

To configure RMI Security Module instance in a controlled distribution mode, then do the following:

Open smconfig.rmi.controlled.prp file (located in OES_CLIENT_HOME/oessm/SMConfigTool) in a text editor, and then specify the parameters described in following table

Parameter	Description
oracle.security.jps.runtime.pd.client.policyDistributionMode	Accept the default value controlled-push as the distribution mode.
oracle.security.jps.runtime.pd.client.RegistrationServerHost	Enter the address of the Oracle Entitlements Server Administration Server.
oracle.security.jps.runtime.pd.client.RegistrationServerPort	Enter the SSL port number of the Oracle Entitlements Server Administration Server. You can find the SSL port number from the WebLogic Administration console.

Run the config.sh (located in OES_CLIENT_HOME/oessm/bin on UNIX) or config.cmd (located in OES_CLIENT_HOME\oessm\bin on Windows) as follows: 

config.sh -smType ws -smConfigId ws -WSListeningPort 9410 -prpFileName /data/app/Oracle/Middleware/oesclient/oessm/SMConfigTool/smconfig.ws.controlled.prp

When prompted, specify the following:

• New key store password for enrollment
• Oracle Entitlements Server user name (This is the Administration Server's user name)
• Oracle Entitlements Server Password (This is the Administration Server's password)

Creation of OES SM (Security Module) instance

The requirements for creating an OES SM instance depend on the type of SM that you create. Detailing the configuration settings for each type of SM is beyond the scope of this tutorial. For this reason, you will focus on creating a WebLogic SM because it is one of the most common SM types.
When creating a WebLogic SM instance, consider these points:

1. The SM configuration file (often referred to as the SMConfig file) contains the configuration used to set up the OES SM aspect of the configuration. It provides the policy distribution, policy decision, and policy enforcement points.
2. The WebLogic domain is the application server used to deploy your applications. When creating an OES WebLogic SM, you run WebLogic Configuration Wizard as part of the process.
3. Although WebLogic Configuration Wizard runs automatically, you must select one of the following SM options. This tutorial shows you how to create a non-JRF WebLogic SM.
   • Non-JRF WebLogic SM
   • JRF WebLogic SM
   • Web Service SM on WebLogic
   • Oracle Service Bus (OSB) SM on WebLogic
   • Other options for Managed Servers
 

Configuring the SMConfig Properties File

You create all OES SMs by using the SMConfigTool. This tool uses a configuration file called SMConfig, which contains the settings used to configure an SM instance. This section guides you through configuring an SM and running the SMConfigTool to create a WebLogic SM instance and domain.


In a terminal window, navigate to the OES folder that contains sample SMConfig files, copy the smconfig.prp file to a new file named wls_smconfig.prp, and open the new file for editing:
$ cd $MW_HOME/oes_client/oessm/SMConfigTool
$ cp smconfig.prp wls_smconfig.prp
$ gedit wls_smconfig.prp &

Use the following table to change the settings in the file:

Property	Value	Purpose
oracle.security.jps.runtime.pd.client. policyDistributionMode	controlled-push	Sets the distribution mode for how the SM obtains its OES policy set
oracle.security.jps.runtime.pd.client. RegistrationServerHost	localhost	The host of the OES Administration Server that is used for registering the SM instance with the Administration side.
oracle.security.jps.runtime.pd.client. RegistrationServerPort	7002	The SSL port of the OES Administration Server that is used for registering the SM instance with the Administration side.
oracle.security.jps.policystore.type	DB_ORACLE	Specifies the repository type used for the OES security store. OES policies and related artifacts are stored in this store.
oracle.security.jps.farm.name	cn=oes_admin	Defines the root distinguished name (RDN) format of the domain node in the LDAP policy store. This name matches the domain name used when the OES Administration Server was created. If the name does not match, policy distribution does not work properly, and the policy set does not work.
oracle.security.jps.ldap.root.name	cn=jpsroot	Defines the top (root) entry of the LDAP policy store directory information tree (DIT).
oracle.security.jps.pd.clientPort	8002	The SSL port used by the SM instance for policy distribution in a controlled-push distribution model.
oracle.security.jps.runtime.pd.client. sm_name	people	The name of the SMConfigID that correlates a policy set defined in an application to a particular SM instance. This ID is configured within the OES Administration console and is bound to the People application that contains the policy used for this tutorial.







Save and close the file.

 

Running the SMConfigTool

After the SMConfig file is ready, you run the SMConfigTool, which reads the SMConfig file and some parameters for instructions about creating your SM instance.


In a terminal window, execute the following steps to create a WebLogic SM instance by using the OES SMConfigTool:


• Navigate to the OES SM Client bin folder:
  
  $ cd ../bin
• Execute the SMConfigTool as follows to create the SM instance and invoke the WebLogic domain Configuration Wizard:
  
  $ ./config.sh -smConfigId people -smType wls -onWLS -serverLocation $WL_HOME -prpFileName ../SMConfigTool/wls_smconfig.prp
  
  First, this creates an SM instance in the $MW_HOME/oes_client/oes_sm_instances folder called people. The first thing you must know about a WebLogic SM is that the files in this folder are mainly ignored and are not used by your WebLogic domain. The files for your domain are created for this type of SM in the$DOMAIN_HOME/config/oeswlssmconfig folder. Each server configured for the domain will have a folder that matches its server name within this folder. Each folder contains the OES SM configuration for that particular server. In this case, there will be only an AdminServer folder because you are creating a single server domain.
• Welcome: Select "Create a new WebLogic domain" and click Next.
  
  
• Select Domain Source: Select Oracle Entitlements Server WebLogic Security Module - 11.1.1.0 [oes_client] and click Next.
  
  
• Specify Domain Name and Location: Enter the values listed in the following table and then click Next:
  

  Field	Value
  Domain name:	mydomain
  Domain location:	/u01/app/oracle/fmw/user_projects/domains

  
  
  
• Configure Administrator User Name and Password: Enter weblogic as the user name and welcome1 as the password, and click Next.
  
  
• Configure Server Start Mode and JDK: Leave all default values, and click Next.
  
  
• Select Optional Configuration: Select Administration Server and click Next.
  
  
• Configure the Administration Server: Enter the values listed in the following table and then click Next:
  

  Field	Value
  Listen Port:	8001
  Enable SSL:	True
  SSL Listen Port:	8002

  
  
  
• Configuration Summary: Click Create.
  
  
• Creating Domain: Click Done.
  
  

Now that you have created your domain, you can start it and deploy an application to it for testing.