OAM 11g R2 Basic Lab

Tasks
Task 1-configure OUD as Default Store and System Store
Task 2-configure LDAP provider for OUD in weblogic Security Realms
Task 3-create and configure webgate 11g instances
Task 4-configure webgate11g_2 to act as DCC using Password Policy Validation Module
Task 5-Verify if DCC webgate works fine and validate LDAP errors for failed login
Task 6-Configure and validate Password Policy
Task 7-Configure and verify Session management features
Task 8-deploying and configuring custom WAR login page
Task 9-OAAM advanced integration with OAM using TAP


Task 1-configure OUD as Default Store and System Store

Data Sources -> User Identity Stores 
store name : OUDStore1
store type : OUD : Oracle Unified Direcory

Store Type     OUD: Oracle Unified Directory
Location     oam.example.com:1389
Bind DN     cn=Directory Manager
Password     Oracle123
Username Attribute     uid
User Search Base     dc=example,dc=com
Group Name Attribute     cn
Group Search Base     dc=example,dc=com


Default Store : UserIdentityStore1
System Store : UserIdentityStore1

Change OUDStore1 as the Default and System Store

Access System Administrators : tom.dole
Access System Group : Administrators

Go to 
System Configuration -> Access Manager -> Authentication Modules -> LDAP Authentication Module -> LDAP 
Name : LDAP
User Identity Store : Change from UserIdentityStore1 to OUDStore1

Task 2-Configure LDAP Provider for OUD in Weblogic Security Realms

WebLogic Console -> Create a new Provider
be default 3 : DefaultAuthenticator, DefaultIdentityAsserter, IAMSuiteAgent

New Authentication Provider
Name: OUDAuthenticator
Type : IPlanetAuthenticator (No OUD Authenticator by default)

Change Order : DefaultAuthenticator(Sufficient),OUDAuthenticator(Sufficient) DefaultIdentityAsserter, IAMSuiteAgent

Configure OUDAuthenticator with Provider Specific Details

Restart Admin and Managed Server

Login to OAM Console using the OUD's user tom.dole

Task 3 - Create and configure Webgate 11g instances

System Configuration -> Access Manager -> SSO Agents -> OAM Agents

Name : webgate11g_1
Access Client Password
Security : Open, Simple, Cert
Auto Create Policies

Name : webgate11g_2
Access Client Password
Security : Open, Simple, Cert
Auto Create Policies


cd /app/u01/middleware/Oracle_OAMWebGate1/webgate/ohs/tools/deployWebGate

export LD_LIBRARY_PATH=/app/u01/middleware/Oracle_WT1/lib:/app/u01/middleware/Oracle_OAMWebGate1/webgate/ohs/lib 

./deployWebGateInstance.sh -w /app/u01/middleware/Oracle_WT1/instances/instance1/config/OHS/ohs1 -oh /app/u01/middleware/Oracle_OAMWebGate1 

cd /app/u01/middleware/Oracle_OAMWebGate1/webgate/ohs/tools/setup/InstallTools/ 

./EditHttpConf -w /app/u01/middleware/Oracle_WT1/instances/instance1/config/OHS/ohs1 -oh /app/u01/middleware/Oracle_OAMWebGate1

cp /app/u01/middleare/user_projects/domains/idm_domain/output/webgate11g_1/* /app/u01/middleware/Oracle_WT1/instances/instance1/config/OHS/ohs1/webgate/config/

Repeat same steps for webgate11g_2

cd /app/u01/middleware/Oracle_OAMWebGate1/webgate/ohs/tools/deployWebGate
./deployWebGateInstance.sh -w /app/u01/middleware/Oracle_WT1/instances/instance2/config/OHS/ohs1 -oh /app/u01/middleware/Oracle_OAMWebGate1
cd /app/u01/middleware/Oracle_OAMWebGate1/webgate/ohs/tools/setup/InstallTools/
./EditHttpConf -w /app/u01/middleware/Oracle_WT1/instances/instance2/config/OHS/ohs1 -oh /app/u01/middleware/Oracle_OAMWebGate1
cp /app/u01/middleare/user_projects/domains/idm_domain/output/webgate11g_2/* /app/u01/middleware/Oracle_WT1/instances/instance2/config/OHS/ohs1/webgate/config/

Change the port of 2nd instance of OHS web server in SSL.conf or httpd.conf
Listen    24444
./opmnctl stopall startall

Access both the webservers to see if OAM intercepts

Cookies
1. OAM_ID
2. OAM_REQ
3. OAMAuthnCookie

Task 4 - Configure Webgate11g_2 to act as DCC using Password Policy Validation Module

cd /app/u01/middleware/Oracle_OAMWebGate1/webgate/ohs/oamsso-bin

Configuring 2nd instance of OHS webgate to act as DCC
Modify all perl files to use proper path of perl

/app/u01/middleware/Oracle_OAMWebGate1/webgate/ohs/oamsso-bin
vi login.pl
#!/usr/bin/perl

For DCC to work , change the webgate profile of webgate11g_2
check mark all the below options
1. Allow Management Operations
2. Allow Token Scope Operations
3. Allow Master Token Retrieval 
4. Allow Credential Collector Operations

Use always FQDN for SSO configuration

System Configuration -> Access Manager -> Access Manager Settings
Load Balancing
OAM Server Host : oam.example.com
OAM Server Port : 14100
OAM Server Protocol : http
Server Error Mode : Internal (we can show LDAP error messages on Login Page.)

Go to 
Policy Configuration -> Authentication Schemes -> PasswordPolicyValidationScheme

* Name : PasswordPolicyValidationScheme
Description
* Authentication Level : 2
Default : No
* Challenge Method : FORM
Challenge Redirect URL : http://oam.example.com:7778/
* Authentication Module : Password Policy Validation Module
* Challenge URL : /oamsso-bin/login.pl
* Context Type : external
Challenge Parameters : OverrideRetryLimit=0

In Application Domain of webgate11g_2 create 2 new resources. Protection Level Excluded

Resource 1
Type : HTTP
Host Identifier : webgate11g_2
Resource URL : /favicon.ico
Query : (.) Name Value List , String
Operations Available : ALL , CONNECT , OPTIONS , PUT , POST , GET
Protection Level : Excluded

Resource 2
Type : HTTP
Host Identifier : webgate11g_2
Resource URL : /oamsso-bin/login.pl
Query : (.) Name Value List , String
Operations Available : ALL , CONNECT , OPTIONS , PUT , POST , GET
Protection Level : Excluded

Change the Authentication Policy of webgate11g_2 to use the PasswordPolicyValidationScheme as its Authentication Scheme

Authentication Policy
Name : Protected Resource Policy
Authentication Scheme : PasswordPolicyValidationScheme
Resources : Resource Type=HTTP,Host Identifier=webgate11g_2,Resource URL=/**

Modification of Plugin Parameters is optional as we have already set OUDStore1 as default Store

Common Configuration -> Plugins -> UserIdentificationPlugin

KEY_IDENTITY_STORE_REF : OUDStore1

UserAuthenticationPlugin
KEY_IDENTITY_STORE_REF : OUDStore1

UserPasswordPolicyPlugin
KEY_IDENTITY_STORE_REF : OUDStore1

Access Manager -> Authentication Modules -> Custom Modules -> Password Policy Validation Module 
Change KEY_IDENTITY_STORE_REF for all 3 plugins used

User Identification Step
Plugin Name : UserIdentificationPlugin
KEY_IDENTITY_STORE_REF
KEY_LDAP_FILTER
KEY_SEARCH_BASE_URL

User Authentication Step
Plugin Name : UserAuthenticationPlugin
KEY_IDENTITY_STORE_REF
KEY_PROP_AUTHN_EXCEPTION

User Password Status Step
Plugin Name : UserPasswordPolicyPlugin
KEY_IDENTITY_STORE_REF
PLUGIN_EXECUTION_MODE : PSWDONLY
URI_ACTION : REDIRECT_POST

Modify System Configuration -> Password Policy
Set 
Password Service URL : /oamsso-bin/login.pl
Restart OAM Managed Server

Task 5 - Verify if DCC webgate works fine and validate LDAP errors for failed login.

Access OHS 2 on 7778 
Get Redirected to oam.example.com:7778/oamsso-bin/login.pl
instead of OAM Server login page
Provide wrong password
You will notice error message from the server as well as LDAP error message is displayed along with the code because the server error mode is set as internal
Provide right password to see if all works fine

DCC Cookies set
DCCCtxCookie_oam.example.com
OAMAuthnCookie_oam.example.com

Task 6 - Configure and validate Password Policy

Set maximum attempts to 1 and Lockout duration to 1 minute

Access the OHS 2 , DCC and try out the wrong password and wait more than 1 minute and try again with the right password.

Using any LDAP browser, set value of attribute obpasswordchangeflag to 1
if not available then add this attribute manually .
This will force the user to change password at his next login.

Try access OHS 2 (7778) with test user

you will be forced to change the password after authentication (old password, new password, confirm password)

Task 7 - Configure and verify Session Management Features

System Configuration -> Common Settings -> 
Maximum Number of sessions per user = 2
Idle Timeout (minutes) = 2

Test 
System Configuration -> Session Management 
Search for Logged in users
Delete the test user session
You will be immediately logged out and should see a login page

Test 2 sessions by opening multiple browsers and testing out the 2 session limit

After login sit idle for 2 minutes and refresh the browser to test the 2 minute idle timeout setting

Task 8 - Deploying and configuring Custom WAR Login Page

Create Login.jsp, style.css, validate.jsp file for custom login page
Key point : action URL, request_id, username and password

action="http://oam.example.com:14100/oam/server/auth_cred_submit" method="post"

<input type="hidden" name="request_id" value="<%=reqId%>">
<input type="text" name="username" class="inputbox">
<input type="text" name="password" class="inputbox">

create war using jar command
Deploy war on weblogic server
Deploy on AdminServer and oam_server1

Create a new Authentication Scheme

* Name : Custom Page Authentication Scheme
Description : Custom Page Authentication Scheme
* Authentication Level : 2
Default : No
* Challenge Method : FORM
Challenge Redirect URL : /oam/server
* Authentication Module : LDAP
* Challenge URL : /login.jsp
* Context Type : customWar
Challenge Parameters : 

Modify the Authentication Policy of webgate11g_1 to use the newly created custom login page Authentication Scheme

webgate11g_1
Authentication Policy : Protected Resource Policy
Authentication Scheme : Custom Page Authentication Scheme
Resource URL : /**
Host Identifier : webgate11g_1

Test
Access the OHS 1
Get redirected to custom login page 
Authenticate and get the requested page

Cookies
OAMRequestContext_oam.example.com
JSESSIONID
OAM_ID
OAM_REQ
OAMAuthnCookie_oam.example.com

Task 9-OAAM advanced integration with OAM using TAP

Login to OAAM Admin Console
oam.example.com:14200/oaam_admin

Go to Environment -> System Snapshots -> Load from File
Uncheck backup current system now
upload oaam_base_snapshot.zip from /app/u01/middleare/Oracle_IDM1/oaam/init
After successful loading , shutdown oaam_admin_server1
Start oam_server1 and oaam_server_server1

create a directory where you will store the Keystore file
/app/Middleware/keystore/TAP_OAAM_OAM

Connect to wlst 

/app/u01/middleare/Oracle_IDM1/common/bin
./wlst.sh

wls:/idm_domain/serverConfig> registerThirdPartyTAPPartner(partnerName="OAAMTAPPartner",keystoreLocation="/app/Middleware/keystore/TAP_OAAM_OAM/TAPkeystore.jks",password="Oracle123",tapTokenVersion="v2.0", tapScheme="TAPScheme",tapRedirectUrl="http://oam.example.com:14300/oaam_server/oamLoginPage.jsp")

Update the TAPScheme to have the MatchLDAPAttribute=uid

Authentication Scheme : TAPScheme
Description : TAPScheme
Authentication Level : 2
Default : No
Challenge Method : DAP
Challenge Redirect URL : /oam/server/
Authentication Module : DAP
Challenge URL : /oaam_server/oamLoginPage.jsp
Context Type : external
Challenge Parameters : 
TAPPartberId=OAAMTAPPartner
SERVER_HOST_ALIAS=HOST_ALIAS_1
MatchLDAPAttribute=uid

Update IAMSuiteAgent's Access Client Password

Update the IAMSuiteAgent's password in Weblogic Security Realms

Realms -> myrealm -> Providers -> IAMSuiteAgent -> Provider Specific -> Agent Password 

3 items must be restarted

Copy the cli directory to temporary location from  /app/Middleware/Oracle_IDM1/oaam/cli to a temporary location like /app/u05/tmp

go to /app/u05/tmp/cli/conf/bharosa_properties
edit oaam_cli.properties

Parameter Name    Parameter Values
ooaam.csf.useMbeans     true
oaam.adminserver.protocol     t3
oaam.adminserver.hostname     oam.example.com
oaam.adminserver.port     7001
oaam.db.toplink.useCredentialsFromCSF     true
oaam.db.url     jdbc:oracle:thin:@oam.example.com:1521:orcl
oaam.db.driver     oracle.jdbc.driver.OracleDriver
oaam.uio.oam.tap.keystoreFile     /app/u01/middleware/keystore/TAP_OAAM_OAM/TAPKeystore.jks
oaam.uio.oam.tap.partnername     OAAMTAPPartner
oaam.uio.oam.host     oam.example.com
oaam.uio.oam.port     5575
oaam.uio.oam.webgate_id     IAMSuiteAgent
oaam.uio.oam.rootcertificate.keystore.filepath     /app/u01/middleware/user_projects/domains/idm_domain/output/webgate-ssl/oamclient-truststore.jks
oaam.uio.oam.privatekeycertificate.keystore.filepath     /app/u01/middleware/user_projects/domains/idm_domain/output/webgate-ssl/oamclient-truststore.jks

pwd
/app/u05/tmp/cli
./setupOAMTapIntegration.sh /app/u05/tmp/cli/conf/bharosa_properties/oaam_cli.properties

Enter Weblogic Server Home Directory : /app/u01/middleare/wlserver_10.3
Enter OAAM AdminServer User Name : weblogic
Enter OAAM AdminServer Password :
Enter OAAM DB User Name : DEV_OAAM
Enter OAAM DB User password :
Enter OAM WebGate credentials to stored in the CSF :
Enter OAM TAP Key Store file password and press Enter :
SetupOAMIntegration script ran successfully

if setCliEnv.sh file not found fails with path error then fix the setupOAMTapIntegration.sh file
chmod 777 findjar.sh
give absolute path of findjar.sh in script file

Change the Application Domain : webgate11g_1
Change the Authentication Policy : Protected Resource Policy
Authentication Scheme : TAPScheme

Access OHS 1 (7777/index.html) 
Redirected oaam_server login page
oam.example.com:14300/oaam_server/oamLoginPage.jsp

1st Page User 
2nd Page Password
Hello World

Cookies
ora_oaam_vsc
JSESSIONID
OAM_ID
OAM_REQ
OAMAuthnCookie_oam.example.com

if User login fails 
In oaam_admin , Set the Environment -> property
bharosa.uio.default.username.case.sensitive=false