Oracle® Identity and Access Manager / SOA Workflows OWSM default-keystore.jks

Oracle® Identity and Access Manager / SOA Workflows  OWSM default-keystore.jks

Regenerate the default-keystore.jks following the steps descrided in the document below :  

1.In an empty working folder execute the following in order to generate a new keystore file:

keytool -genkey -alias xell -keyalg RSA -keysize 1024 -dname "CN=Customer, OU=Customer, O=Customer, L=City, ST=NY, C=US" -validity 3650 -keypass <password> -keystore default-keystore.jks -storepass <password> -storetype jks -provider sun.security.provider.Sun

Please ensure that JDK_HOME\jre\bin is in your PATH environment variable.

2.Generate a certifcate request:

keytool -certreq -alias xell -file xell.csr -keypass <password> -keystore default-keystore.jks -storepass <password> -storetype jks -provider sun.security.provider.Sun

3.Export the certificate:

keytool -export -alias xell -file xlserver.cert -keypass <password> -keystore default-keystore.jks -storepass <password> -storetype jks -provider sun.security.provider.Sun

4.Trust the certificate:

keytool -import -trustcacerts -alias xeltrusted -noprompt -keystore default-keystore.jks -file xlserver.cert -storepass <password>

5.Copy all the 3 generated files (default-keystore.jks, xell.csr, xlserver.cert) in MIDDLEWARE_HOME\user_projects\domains\<OIM Domain>\config\fmwconfig

You should repeat this step for each node in a clustered environment.

6.Change the values of the CSF keys for default-keystore.jks and xell:

- Login to Enterprise Manager
  - Right-click the domain
  - Navigate to Security, and then Credential
  - Expand oim
  - Edit default-keystore.jks and xell and change the password for both keys with the values used in steps 1-4.

Note: You should NOT change the passwords for other CSF keys!

7.Restart OIM server and check if everything is working fine.

One should do the following, saving in between :

1) Go to EM --> --> Security --> Credentials
2) Expand oracle.wsm.security map
3) Change paswords of the following keys
  - keystore-csf-key (user=owsm, password=keystore password)
  - enc-csf-key (user=xell, password)
  - sign-csf-key (user=xell, password)
  - recipient-alias-key (user=xell, password)

Oracle® Identity Manager 11.1.2.2 and SOA 11.1.1.7: Callback and ReqSvc Service Discovery

In a recent project we had to face the challenge of debugging the issues with Callback and Reqsvc Services from SOA to OIM. The  URL doe the services is set during the install and configuration time, however this can be changed by using the following JMX Bean

• Using the EM console, Navigate to Identity And Access 
• Right Click on oim(11.1.2.0)
• Go to the System MBean Browser
• Navigate to Application Defined MBeans
• Navigate to oracle.iam
• Navigate to server_xxxxx (server name)
• Navigate to XML Config
• Navigate to Discovery Config

• On the RHS, for the OimFrontEndURL and OIMExternalFacingFrontEndURL, set the URL of the desired server https:://identitymindtelligent.com:14001

Oracle® Identity and Access Manager:: Develop a Custom SOA Composite

Create a JDeveloper application for custom SOA composite by running the helper utility:

1. Set up the environment (for Linux machines)

cd <BEAHOME>/wlserver_10.3/server/bin

bash

source setWLSEnv.sh

2. Run the utility by executing following commands:

cd <OIMHOME>/server/workflows/new-workflow

ant -f new_project.xml

3. Enter the JDeveloper application name (AssignRoleApprovalApp) when the following prompt is displayed:

Please enter application name

4. Enter the JDeveloper project name (AssignRoleApproval) when the following prompt is displayed:

Please enter project name

5. Enter the name of the ADF binding service (AssignRoleApprovalService) for the composite when the following prompt is displayed:

Please enter the service name for the composite. This needs to be unique across applications

The following screenshot (Figure 1) shows creation of AssignRoleApprovalApp.

Oracle® Identity & Access Manager / SOA Stack : Find the password for default-keystore.jks and .xldatabasekey keystores and stored keys.

The passwords for the keystores are saved in CSF - Credential Store Framework - filestore ($DOMAIN_ROOT/config/fmwconfig/cwallet.sso) and thus it's accessible via CSF API / Mbeans.

The easiest way to find the password in cleartext is to use the JpsCredentialStore MBean via Enterprise Manager:

1. Login to EM
2. Browse to

   WebLogic Domain -> <Domain> -> System MBean Browser

3. In MBean Browser browse to

   Application Defined MBeans -> com.oracle.jps -> Domain: <Domain>
     -> JpsCredentialStore

4. From Operations tab execute the getPortableCredentialMap operation with
   following parameter:

   Name     Type              Value
   -------- ----------------  ---------------------
   p1       java.lang.String  oim

5. Browse through the provided credential list to get the password
   in human readable form for the entry you are interested in.

SOA 11.1.1.7 Garbage Collection

# WLST script which calls GC.

from java.util import *
from javax.management import *
import javax.management.Attribute

print 'starting the script .... '

# please replace userid and password with your AdminServer userid and password
# plz change the IP adresss and port number accordingly
connect('userid','password',url='t3://localhost:port')

state('AdminServer')

# For Force GC ....
domainRuntime()
cd('/ServerRuntimes/AdminServer/JVMRuntime/AdminServer')
print ' Performing Force GC...'
cmo.runGC()

disconnect()
print 'End of script ...'
exit()

 

Setup Heap Limits for JDeveloper 12c/11g

The reasons JDeveloper can run out of memory include heap limits and large files.

Heap Limits

Files that control the amount of memory afforded to the JVM for JDeveloper upon startup, relative to the jdeveloper/ide/bin/ directory, include:

• jdev.conf
• ide.conf

Update these files as follows:

1. Quit JDeveloper.
2. Edit ide.conf.
3. Append the following

   AddVMOption -Xms256M
   AddVMOption -Xmx1024M
   

4. Edit jdev.conf.
5. Find the AddVMOption for the "heap size."
6. Change the values as follows:

   AddVMOption -Xmx1024M
   AddVMOption -XX:MaxPermSize=1024M

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) - Steps to Setup Auditing for OES

Oracle® Fusion Middleware OES-11g Release 2 (11.1.2.2.0) - Steps to Setup Auditing for OES

1Create an Oracle database for Audit purposes

2Run ./rcu to load the OES Audit schema, in database created in step number 1 Make sure to Select "AS Common Schema -> Audit Services for OES" set prefix -> AUDIT (important for next step)

3-Start APM domain and open weblogic console -> http://host:7001/console Create a JDBC connection, setting values according to your database Under JDBC, click the Data Sources link Create new jdbc Data Source JNDI Name -> jdbc/AuditDB user is the prefix set in RCU process + _IAUOES -> AUDIT_IAUOES  

password set during RCU -> welcome1

Make sure "Test Connection" is successful

4-Stop APM domain

5-Edit Oracle/Middleware/user-projects/domains/APM/config/fmwconfig/jps-config.xml,

Set Audit properties as follows

<serviceInstance name="audit" provider="audit.provider"> 

<property name="audit.filterPreset" value="All"/> 

<property name="audit.maxDirSize" value ="500000"/> 

<property name="audit.maxFileSize" value ="50000"/> 

<property name="audit.loader.jndi" value="jdbc/AuditDB"/>

 <property name="audit.loader.interval" value="15" /> 

<property name="audit.loader.repositoryType" value="Db" /> 

</serviceInstance>

6-Start APM Domain

7-Go to your Audit schema, and check the information stored Connect based your user info, for example -> ./sqlplus audit_iauoes/welcome1 run a sql to test, 

SELECT * FROM IAU_BASE WHERE ROWNUM<2, 

to check a couple of records where the information was stored

For more information on Audit schema refer to the  following documentation link in Oracle Fusion Middleware Application Security Guide (12.5 Advanced Management of Database Store):

8.) Ensure that your jps-config.xml is configured accurately as follows

<?xml version="1.0" encoding="UTF-8" standalone='yes'?>

<jpsConfig xmlns="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd" 

          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 

 xsi:schemaLocation="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd" 

 schema-major-version="11" schema-minor-version="1">

    <serviceProviders>

     <serviceProvider name="audit.provider" type="AUDIT" class="oracle.security.jps.internal.audit.AuditProvider">

     </serviceProvider>

    </serviceProviders>

  <serviceInstances>

   <serviceInstance name="audit" provider="audit.provider">

      <property name="audit.filterPreset" value="Low"/>

      <property name="audit.specialUsers" value ="admin, fmwadmin" />

      <property name="audit.customEvents" value ="JPS:CheckAuthorization, CreateCredential; OIF:UserLogin"/>

      <property name="audit.loader.jndi" value="jdbc/AuditDB"/>

      <property name="audit.loader.interval" value="15" />

      <property name="audit.maxDirSize" value="102400" />

      <property name="audit.maxFileSize" value="10240" />      

      <property name=" audit.loader.repositoryType " value="Db" />      

   </serviceInstance>

  </serviceInstances>

    <jpsContexts default="default">

        <jpsContext name="default">

            <serviceInstanceRef ref="audit"/>

        </jpsContext>

    </jpsContexts>

</jpsConfig>