Oracle Entitlement Server 11g Release 2: Creating the OES Administration Domain

Oracle Entitlement Server 11g Release 2: Creating the OES Administration Domain

Prior to creation of domain, please ensure that you follow the following steps:

Installation Of Oracle Entitlement Server 11g Rel 2

OES 11g Rel 2 Installing OES Administration Software

In a terminal window, perform the following commands to create the OES Administration Domain:


$ cd /u01/app/oracle/fmw/Oracle_IDM1/common/bin
$ ./config.sh

After the Configuration Wizard opens, perform the following steps to create the domain:

• Welcome: Select "Create a new WebLogic domain" and click Next.
  
  
  
• Select Domain Source: Select Oracle Entitlements Server for Admin Server - 11.1.1.0 [Oracle_IDM1], accept the automatically selected Oracle Platform Security Service - 11.1.1.0 [Oracle_IDM1], and click Next.
  
  
  
• Specify Domain Name and Location: Enter the following information and then click Next:
  Domain name: oes_admin
  Domain location: /u01/app/oracle/fmw/user_projects/domains
  
  
  
• Configure Administrator User Name and Password: Enter the following information and then click Next:
  Name: weblogic
  User password: welcome1
  
  
  
• Configure Server Start Mode and JDK: Perform the following actions:
  1. Select Development Mode.
  2. Select Available JDKs and Sun SDK 1.6.0_34.
  3. Click Next.
  
  
  
  
• Configure JDBC Component Schema: Perform the following actions:
  
  1. Select the OPSS Schema.
  2. Enter localhost as the host name.
  3. Enter oracle as the Schema password.
  4. Leave the rest as the default values.
  5. Click Next.
  
  
  
  
• Test JDBC Component Schema: Verify that the test was successful and click Next.
  
  
  
• Select Optional Configuration: Click Next.
  
  
  
• Configuration Summary: Click Create and wait for installation processing to complete.
  
  
  
• Creating Domain: When the Progress bar displays 100%, click Done.
  
  
  

Now that you have created the OES Administration domain, you can configure it to use the database for the security store.
Assume the following:

$MW_HOME=/u01/app/oracle/fmw
$IDM_HOME=$MW_HOME/Oracle_IDM1

In a terminal window, perform the following commands to configure OES to use a database security store:
$ cd /u01/app/oracle/fmw/Oracle_IDM1/common/bin
$ $MW_HOME/oracle_common/common/bin/wlst.sh $MW_HOME/Oracle_IDM1/common/tools/configureSecurityStore.py -d $MW_HOME/user_projects/domains/oes_admin -t DB_ORACLE -j cn=jpsroot -m create -p oracle


Option	Purpose
-d	Specifies the name and location of the OES Administration domain
-t	Specifies the type of security store to associate with the OES Administration server
-j	Specifies the jpsroot value of the OES security store
-m	Specifies the tool mode, which indicates if the tool will create, drop, or join an OES database security store
-p	Specifies the password to the OES database

Your output should be similar to the following:


Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

Info: Data source is: opss-DBDS
Info: DB JDBC driver: oracle.jdbc.OracleDriver
Info: DB JDBC URL: jdbc:oracle:thin:@localhost:1521/orcl
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator] checkServiceSetup - done
Dec 1, 2012 3:52:30 AM oracle.security.jps.internal.config.ldap.LdapCredStoreServiceConfigurator schemaCompatibleHandler
INFO: Credential store schema upgrade not required. Store Schema version 11.1.1.6.0 is compatible to the seed schema version 11.1.1.4.0
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator] checkServiceSchema - Store schema has been seeded completely
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator] updateServiceConfiguration - done
Dec 1, 2012 3:52:36 AM oracle.security.jps.internal.tools.utility.JpsUtilMigrationCredImpl migrateCredentialData
INFO: Migration of Credential Store data in progress.....
Dec 1, 2012 3:52:37 AM oracle.security.jps.internal.tools.utility.JpsUtilMigrationCredImpl migrateCredentialData
INFO: Migration of Credential Store data completed, Time taken for migration is 00:00:00
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator] migrateData - done
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator] testJpsService - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator] checkServiceSetup - done
Dec 1, 2012 3:52:37 AM oracle.security.jps.internal.config.ldap.LdapKeyStoreServiceConfigurator schemaCompatibleHandler
INFO: Keystore schema upgrade not required. Store Schema version 11.1.1.6.0 is compatible to the seed schema version 11.1.1.4.0
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator] checkServiceSchema - Store schema has been seeded completely
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator] updateServiceConfiguration - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator] migrateData - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator] testJpsService - done
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator] checkServiceSetup - done
Dec 1, 2012 3:52:40 AM oracle.security.jps.internal.config.ldap.LdapPolicyStoreServiceConfigurator schemaCompatibleHandler
INFO: Policy schema upgrade not required. Store Schema version 11.1.1.6.0 is compatible to the seed schema version 11.1.1.4.0
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator] checkServiceSchema - Store schema has been seeded completely
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator] updateServiceConfiguration - done
WLS ManagedService is not up running. Fall back to use system properties for configuration.
Dec 1, 2012 3:52:52 AM oracle.security.jps.internal.tools.utility.destination.apibased.JpsDstPolicy migrateData
INFO: Migration of Admin Role Members started
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator] migrateData - done
Dec 1, 2012 3:52:53 AM oracle.security.jps.internal.tools.utility.destination.apibased.JpsDstPolicy migrateData
INFO: Migration of Admin Role Members completed in 00:00:00
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator] testJpsService - done
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator] checkServiceSetup - done
Dec 1, 2012 3:52:53 AM oracle.security.jps.internal.config.ldap.LdapAuditServiceConfigurator schemaCompatibleHandler
INFO: Audit store schema upgrade not required. Store Schema version 11.1.1.6.0 is compatible to the seed schema version 11.1.1.4.0
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator] checkServiceSchema - Store schema has been seeded completely
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator] updateServiceConfiguration - done
Dec 1, 2012 3:52:53 AM oracle.security.jps.internal.tools.utility.JpsUtilMigrationAuditStoreImpl migrateAuditStoreData
INFO: Migration of Audit Store data in progress.....
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator] migrateData - done
Dec 1, 2012 3:53:15 AM oracle.security.jps.internal.tools.utility.JpsUtilMigrationAuditStoreImpl migrateAuditStoreData
INFO: Migration of Audit Store data completed, Time taken for migration is 00:00:21
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator] testJpsService - done
persist to output: /u01/app/oracle/fmw/user_projects/domains/oes_admin/config/fmwconfig - done
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator] checkServiceSetup - done
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator] updateServiceConfiguration - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator] checkServiceSetup - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator] updateServiceConfiguration - done
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator] checkServiceSetup - done
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator] updateServiceConfiguration - done
Dec 1, 2012 3:53:25 AM oracle.security.jps.internal.config.ldap.LdapAuditServiceConfigurator checkIfConfigurationValid
INFO: Audit store re-association not supported.
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator] checkServiceSetup - Audit store re-association not supported.
persist to output: /u01/app/oracle/fmw/user_projects/domains/oes_admin/config/fmwconfig - done
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
Using default context in /u01/app/oracle/fmw/user_projects/domains/oes_admin/config/fmwconfig/jps-config-migration.xml file for credential store.
Credential store location : jdbc:oracle:thin:@localhost:1521/orcl
Credential with map Oracle-IAM-Security-Store-Diagnostics key Test-Cred stored successfully!
Credential for map Oracle-IAM-Security-Store-Diagnostics and key Test-Cred is:
GenericCredential
Info: diagnostic credential created in the credential store.
Info: Create operation has completed successfully.

OES 11g Rel 2 Installing OES Administration Software

OES 11g Rel 2 Installing OES Administration Software

Prior to installation of OES Admin Server, please ensure that the the database has been create using RCU. Please refer to the URL http://oraclesoaandoim.blogspot.com/2014/06/installation-of-oracle-entitlement.html for details

In a terminal window, execute the OES Administration Server installation program as follows:


$ cd /stage/fmw/iamsuite/Disk1
$ ./runInstaller -jreLoc /u01/app/oracle/fmw/jdk1.6.0_34

The OES Administration installation window opens. Perform the following steps to install the OES Administration Server product:

• Welcome: Click Next.
  
  
  
• Install Software Updates: Select Skip Software Updates and click Next.
  
  
  
• Prerequisite Checks: Verify that all prerequisites passed and click Next.
  
  
  
• Specify Installation Location: Accept the default values (/u01/app/oracle/fmw for Oracle Middleware Home and Oracle_IDM1 for Oracle Home Directory) and click Next.
  
  
  
• Installation Summary: Click Install.
  
  
  
• Installation Progress: When the Progress bar displays 100%, click Next.
  
  
  
• Installation Complete: Click Finish.
  
  
  

Now that you have installed the OES Administration product, you can install, create, and configure the OES Administration Server domain.

Installation Of Oracle Entitlement Server 11g Rel 2

Installation Of Oracle Entitlement Server 11g Rel 2

You create the OES database schema by using RCU.

 In a terminal window, execute RCU as follows:


$ /stage/fmw/rcu/bin/rcu

After the RCU installation window opens, perform the following steps to create the OES schemas:

• On the Welcome page, click Next.
  
  
  
• On the Create Repository page, accept Create (the default option) and click Next.
  
  
  
• On the Database Connection Details page, accept the default setting for Database Type (Oracle Database), enter the fields in the following table, and then click Next.
  

  Parameter	Value
  Host Name:	localhost
  Port:	1521
  Service Name:	orcl
  Username:	sys
  Password:	oracle
  Role:	SYSDBA

  
  
  
  
• In the Repository Creation Utility - Checking Prerequisites dialog box, ensure that all prerequisite checks passed (look for green check marks in the first column), and click OK.
  
  
  
• On the Select Components page, perform the following actions:
1. accept the default setting of DEV for the "Create a new Prefix" value.
2. In the Component column, expand AS Common Schemas and the select Metadata Services, Audit Services for OES, and Oracle Platform Security Services (OPSS) check boxes.
3. Ensure that the schema names are DEV_MDS for Metadata Services and DEV_OPSS for Oracle Platform Security Services.
4. Click Next.





• In the Repository Creation Utility - Checking Prerequisites dialog box, click OK.
  
  
  
• On the Schema Passwords page, accept the default selection ("Use the same passwords for all schemas"), enter oracle in the Password and Confirm Password fields, and then click Next.
  
  
  
• On the Map Tablespaces page, a row for Metadata Services and OPSS is displayed.
  
  Because OES provides authorization features for OPSS, use this entry  to create the schema used for OES.
  
  Perform the following actions:
  1. Accept the default settings for tablespaces.
  2. Click Next.
  
  
• The Repository Creation Utility dialog box indicates that the tablespaces do not exist and will be created.
  
  Click OK to create the tablespaces.
  
  
  
• In the Repository Creation Utility - Creating Tablespaces dialog box, click OK.
  
  
  
• On the Summary page, confirm that the settings are correct and click Create.
  
  
  
• On the Completion Summary page, confirm successful creation of the component schemas and click Close.
  
  

Now that you have created the OES database schemas, you can install the OES Administration Server.

Configuring an OID Authentication Provider in WebLogic 10.3.6

Configuring an OID Authentication Provider in WebLogic 10.3.6

This is the architecture that depicts the configuration of an OID LDAP-based authentication provider used by OPSS applications deployed on a WebLogic Server environment. 

Follow the steps below to configure an OID authentication provider using the Weblogic Administration Console:

1.	Open the Firefox web browser using the  icon on the launch panel. Make sure the WebLogic Server is running before continuing on to the next step.
2.	Open the WebLogic Administration Console by browsing to http://localhost:7001/console. Login using the following credentials: Username: weblogic Password: welcome1
3.	Click the Security Realms link in the Domain Structure pane to show the list of security realms for the domain.
4.	Click the myrealm link in the Realms pane to show the settings for the domain's security realm.
5.	Click the Providers tab to show the security providers configured for myrealm.
6.	Click the Authentication tab to list the currently configured authentication providers for this domain's security realm. The default out-of-the-box providers are shown for the embedded LDAP authentication provider and identity asserter. This is where you configure the new OID authentication provider.
7.	Click New to create a new authentication provider for this domain.
8.	The Create a new Authentication Provider page is displayed. Give your new authentication provider a name, such as OID Authenticator, select the type called OracleInternetDirectoryAuthenticator, and click OK.
9.	You should now see your new OID authenticator in the list of authentication providers, at the bottom of the list.
10.	Click the link for your OID authentication provider to configure its settings.
11.	The Settings for OID Authenticator is displayed. Click the Provider Specific tab to configure the detailed settings for this provider.
12.	This step guides you through all of the settings for configuring your new OID authentication provider. All the settings are made on a single configuration page, however we go through them one section at a time in this instruction. The first section contains the Connection settings for the OID server. Use the values from the table below for this section: Name Value Purpose Host: localhost The OID host name Port: 3060 The standard OID listening port Principal: cn=orcladmin The LDAP user that logs into OID on behalf of your authentication provider Credentials: welcome1 Password for the principal user Confirm Credentials: welcome1 Confirmation of the password SSL Enabled: Unchecked Enables or disables SSL connectivity Validate your settings against the screen shot below: The next section contains the Users settings for the OID provider. Use the values from the table below for this section: Name Value Purpose User Base DN: cn=Users,dc=us,dc=oracle,dc=com The root (base DN) of the LDAP tree where searches are performed for user data All Users Filter: Leave as default The LDAP search filter that is used to show all the users below the User Base DN User From Name Filter: Leave as default The LDAP search filter used to find the LDAP user by name User Search Scope: Leave as default Specifies how deep in the LDAP tree to search for users User Name Attribute: Leave as default The attribute of the LDAP user that specifies the user name User Object Class: Leave as default The LDAP object class that stores users Use Retrieved User Name as Principal: Checked Specifies if the user name retrieved from the LDAP directory will be used as the Principal in the Subject Validate your settings against the screen shot below: The next section contains the Groups settings for the OID provider. Use the values from the table below for this section: Name Value Purpose Group Base DN: cn=Groups,dc=us,dc=oracle,dc=com The root (base DN) of the LDAP tree where searches are performed for group data All Groups Filter: Leave as default The LDAP search filter that is used to show all the groups below the Group Base DN Group From Name Filter: Leave as default The LDAP search filter used to find the LDAP group by name Group Search Scope: Leave as default Specifies how deep in the LDAP tree to search for groups Group Membership Searching: Leave as default Specifies whether group searches into nested groups are limited or unlimited Max Group Membership Search Level: Leave as default Specifies how many levels of group membership can be searched. This setting is only valid if GroupMembershipSearching is set to limited Ignore Duplicate Membership: Unchecked Determines whether duplicates members are ignored when adding groups. Validate your settings against the screen shot below: Click Save to persist your changes.
13.	Click the Common tab in the Settings for OID Authenticator pane to show settings common to all authentication providers.
14.	Change the Control Flag setting to SUFFICIENT and click Save. This setting allows this provider to participate in the authentication process without requiring the user to be in its identity store.
15.	Click the Providers link the breadcrumb displayed near the top of the page to quickly navigate back to theAuthentication Providers page.
16.	Click the DefaultAuthenticator link to display its common settings so you can change its control flag toSUFFICIENT as well.
17.	Change the Control Flag setting to SUFFICIENT and click Save. This setting allows this provider to participate in the authentication process without requiring the user to be in its identity store.
18.	Click the Providers link the breadcrumb displayed near the top of the page to quickly navigate back to theAuthentication Providers page.
19.	Click Reorder to change the order of your configured authentication providers. If you remember from the OPSS Concepts self-study course, OPSS obtains its authentication configuration from the authentication provider configuration found in the WebLogic Server domain. It also states that OPSS first looks at all of the LDAP-based authentication providers in the list, and chooses the first one in the list with the highest control flag setting. Because we configured both LDAP-based authentication providers to use the SUFFICIENTcontrol flag setting, OPSS would use the default authenticator if we left the configuration as it is now. In order to ensure that OPSS recognizes your new OID authenticator as its authentication provider, you must reorder your list of authentication providers so that the OID authentication provider is first in the list.
20.	Select the OID Authenticator and use the arrows on the right to move it into the first position. Click OK.

Weblogic 10.3.6: Export data from a security provider

Security data (authentication, authorization, credential map, and role data) from one security realm can be exported into a file and then imported into another security realm. This feature allows you to develop and test new security realms without recreating all the security data (for example, when moving a development security realm to production). Only information from the WebLogic security providers can be exported and imported. Two options are available:

• Export all security data from all of the security providers in a security realm. 
• Export specific data (for example, user and groups or roles) from a specific provider, as described in this topic.

To export security data from a security provider to a file:

1. In the left pane, select Security Realms and then select the name of the realm you are configuring (for example, myrealm).
2. Select the type of provider from which you want to export security data (for example, Authentication).
3. Select the security provider from which you want to export security data.

    4. Select Migration > Export.

    5. Specify the directory and filename in which to export the security data in the Export File on Server field. The directory must exist.

Note: The directory and file into which you export the security data should be carefully protected with operating system security as they contain secure information about your deployment.

6.Optionally, define a specific set of security data to be exported in the Export Constraints box.

7. Click Save.

Note: Once the data is exported from the security provider, it can be imported at any time.

Java Key Store Commands

Common Keytool Commands

Following table lists keytool commands you use when creating and using JKS keystores with WebLogic Server.

 

Table  Commonly Used keytool Commands 

Command	Description
keytool -genkey -keystore keystorename -storepass keystorepassword	Generates a new private key entry and self-signed digital certificate in a keystore. If the keystore does not exist, it is created.
keytool -import -alias aliasforprivatekey -file privatekeyfilename.pem-keypass privatekeypassword-keystore keystorename -storepass keystorepassword	Updates the self-signed digital certificate with one signed by a trusted CA.
keytool -import -alias rootCA -trustcacerts -file RootCA.pem -keystore trust.jks -storepass keystorepassword keytool -import -alias intermediate -trustcacerts -file Intermediate.pem -keystore keystorename -storepasskeystorepassword	Creates a custom keystore to be used for holding an intermediate CA certificate.  The first keytool command creates the keystore, trust.jks, which holds the root CA certificate.  The second keytool command imports the intermediate CA certificate into trust.jks. This enables WebLogic Server’s SSL implementation to transmit the intermediate certificate with the server’s public certificate to the client during the SSL handshake.
keytool -import -alias aliasfortrustedca -trustcacerts -file trustedcafilename.pem -keystore keystorename -storepass keystorepassword	Loads a trusted CA certificate into a keystore. If the keystore does not exist, it is created.
keytool -certreq -alias alias -sigalg sigalg-file certreq_file-keypass privatekeypassword-storetype keystoretype-keystore keystorename-storepass keystorepassword	Generates a Certificate Signing Request (CSR), using the PKCS#10 format, and a self-signed certificate with a private key. Stores the CSR in the specified certreq_file, and the certificate/private key pair as a key entry in the specified keystore under the specified alias.
keytool -list -keystore keystorename	Displays what is in the keystore.
keytool -delete -keystore keystorename -storepass keystorepassword -alias privatekeyalias	Deletes the entry identified by the specified alias from the keystore.
keytool -help	Provides online help for keytool.

OIM 11.1.2.2 : Check OIM Scheduler Status Without Logging In

OIM 11.1.2.2 :  Check OIM Scheduler Status Without Logging In 

Change the localhost and port 8080 below to your OIM server's hostname and port number

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.net.URLConnection;

public class CheckSchedulerStatus{

  public CheckSchedulerStatus(){

  }

  public void SchedulerStatus(){

   try{

    URL url = null;
    URLConnection urlconn = null;
    url =new URL("http://mindtelligent-d:14000/xlScheduler/ddstatus");
    urlconn = url.openConnection();

    urlconn.connect();
    InputStream response =urlconn.getInputStream();
    StringBuffer buffer = new StringBuffer();
    BufferedReader dataInput =
     new BufferedReader(new InputStreamReader(response));
    String line;
    while ((line = dataInput.readLine()) != null) {
     buffer.append(line);
     buffer.append('\n');
    }   if(buffer.toString().toUpperCase().indexOf("STARTED")!=-1){
System.out.println("Scheduler Status: " + "STARTED");
    }
    else    if(buffer.toString().toUpperCase().indexOf("STOPPED")!=-1){
System.out.println("Scheduler Status: " + "STOPPED");

     int stackTraceLocation = buffer.toString().indexOf("Detaild Stack Trace follows");
     if (stackTraceLocation > -1) {
      int stackTraceBeingIndex = buffer.toString().indexOf("<PRE>",stackTraceLocation)+5; 
      int stackTraceEndIndex = buffer.toString().indexOf("</PRE>",stackTraceLocation); 
      String stackTrace = buffer.toString().substring(stackTraceBeingIndex,stackTraceEndIndex);
System.out.println(stackTrace);
     }


    }
  }

  catch(Exception e){
   e.printStackTrace();

  }

 }
  public static void main(String[] args){

   CheckSchedulerStatus chckSch = new CheckSchedulerStatus();
   chckSch.SchedulerStatus();
  }
}