Home / Middleware / Oracle Fusion Middleware Online Documentation Library, 11g Release 1 (11.1.1.1) / Administration Guides
Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management
ContentsOpens a new window
Opens a new window
Page 20 of 25

15 Extending the Domain with Oracle Identity Federation

This chapter contains the following topics:

Oracle Identity Federation is a self-contained, standalone federation server that enables single sign-on and authentication in a multiple-domain identity network and supports the broadest set of federation standards. This allows users to federate in heterogeneous environments and business associations, whether they have implemented other Oracle Identity Management products in their solution set or not.

It can be deployed as a multi-protocol hub acting as both an Identity Provider (IdP) and Service Provider (SP).

Acting as an SP, Oracle Identity Federation enables you to manage your resources while off loading actual authentication of users to an IdP, without having to synchronize users across security domains out of band. Once authenticated at the IdP, the SP can allow or deny access to users for the SP's applications depending upon the local access policies.

15.1 Prerequisites

Before proceeding with Oracle Identity Federation configuration, ensure that the following tasks have been performed.

  1. Installing and upgrading the software on OIFHOST1 and OIFHOST2 as described in Section 4.5.3Opens a new window, Section 4.5.4Opens a new window, and Section 4.6.1Opens a new window .

  2. Running the Repository Creation Utility (RCU) to create and configure the collection of schemas used by OIF as described in Chapter 3Opens a new window.

  3. Creating the Identity Management Domain as described in Chapter 6Opens a new window.

  4. Installing and configuring Oracle Internet Directory as described in Chapter 7Opens a new window. Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory is used as the User Store and the Federation Store

  5. Installing and configuring Oracle HTTP Server on WEBHOST1 and WEBHOST2 as described in Chapter 5Opens a new window

  6. Associating the Identity Management Domain created with an External LDAP Store as describd in Section 17.1Opens a new window. This is required because Oracle Identity Federation is being extended on a node where the Administration Server is not running.

15.2 Configuring Oracle Identity Federation on OIFHOST1

1. Ensure that the system, patch, kernel and other requirements are met. These are listed in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management manual in the Oracle Fusion Middleware documentation library for the platform and version you are using.

2. If you plan on provisioning the Instance Home or the Managed Server domain directory on shared storage, ensure that the appropriate shared storage volumes are mounted on IDMHOST1 as described in Section 2.4, "Shared Storage and Recommended Directory Structure."

On UNIX:

  1. Ensure that port 7499 is not in use by any service on the computer by issuing these commands for the operating system you are using. If a port is not in use, no output is returned from the command.

    On UNIX:

    netstat -an | grep "7499"

    If the port is in use (if the command returns output identifying the port), you must free it.

    On UNIX:

    Remove the entries for port 7499 in the /etc/services file and restart the services, as described in Section 18.1, "Starting and Stopping Oracle Identity Management Components,"Opens a new window or restart the computer.

  2. If you plan to provision the Instance Home or the Managed Server domain directory on shared storage, ensure that the appropriate shared storage volumes are mounted on IDMHOST1 as described in Section 2.4, "Shared Storage and Recommended Directory Structure."Opens a new window

  3. Copy the staticports.ini file from the Disk1/stage/Response directory to a temporary directory.

  4. Edit the staticports.ini file that you copied to the temporary directory to assign the following custom port:

    #The port for OIF Server port
OIF Server Port No = 7499

  5. Start the Oracle Identity Management 11g Configuration Assistant located under the ORACLE_HOME/bin directory as follows:

    On UNIX, issue this command:

     ./config.sh

    On Windows, double-click config.exe

  6. On the Welcome screen, click Next.

  7. On the Select Domain screen, select Extend Existing Domain and specify these values:

    • HostName: adminvhn.mycompany.com

    • Port: 7001

    • UserName: weblogic

    • User Password: weblogic_user_password

    Click Next.

  8. A dialog box with the following message appears:

    The selected domain is not a valid Identity Management domain or the installer cannot determine if it is a valid domain. If you created the domain using the Identity Management installer, you can ignore this message and continue. If you did not create the domain using the Identity Management installer, refer to the Identity Management documentation for information on how to verify the domain is valid.

    This is a benign warning that you can ignore.

    Click Yes to continue.

  9. On the Specify Installation Location screen, specify the following values:

    • Oracle Middleware Home Location: /u01/app/oracle/product/fmw

      This value is prefilled and cannot be updated.

    • Oracle Home Directory: idm

      This value is prefilled and cannot be updated

    • WebLogic Server Directory: /u01/app/oracle/product/fmw/wlserver_10.3

    • Oracle Instance Location: /u01/app/oracle/admin/oif_inst1

    • Instance Name: oif_inst1

    Note:

    Ensure that the Oracle Home Location directory path for OIFHOST1 is the same as the Oracle Home Location path for OIFHOST2. For example, if the Oracle Home Location directory path for OIFHOST1 is: /u01/app/oracle/product/fmw/oif, then the Oracle Home Location directory path for OIFHOST2 must also be /u01/app/oracle/product/fmw/oif.

    Click Next.

  10. On the Specify Oracle Configuration Manager Details screen, specify the values shown in the example below:

    • Email Address: Provide the email address for your My Oracle Support account.

    • Oracle Support Password: Provide the password for your My Oracle Support account.

    • Select I wish to receive security updates via My Oracle Support.

    Click Next.

  11. On the Configure Components screen, de-select all the components except Oracle Identity Federation components. Select only Oracle Identity Federation from the Oracle Identity Federation components. Do not select Oracle HTTP Server. Select Clustered.

    Click Next.

  12. On the Configure Ports screen, select Specify Ports using Configuration File. Provide the path to the staticports.ini file that you copied to the temporary directory.

    Click Next.

  13. On the Specify OIF Details screen, specify these values:

    • PKCS12 Password: password

    • Confirm Password: Confirm the password

    • Server Id: oif_server1

    Click Next.

  14. On the Select OIF Advanced Flow Attributes screen, specify these values:

    • Authentication Type: LDAP

    • User Store: LDAP

    • Federation Store: LDAP

    • User Session Store: RDBMS (default selection, which cannot be changed for a cluster)

    • Message Store: RDBMS (default selection, which cannot be changed for a cluster.

    • Configuration Store: RDBMS (default selection, which cannot be changed for a cluster.

    Note:

    When you choose RDBMS for the session, message, and configuration data stores during an Advanced installation, the installer creates one data source for all three data stores. If you want to have separate databases for each of these stores, you must configure this after the installation.

    Click Next.

  15. On the Authentication LDAP Details screen, specify the following values:

    • LDAP Type: Select Oracle Internet Directory from the drop down.

    • LDAP URL: The LDAP URL to connect to your LDAP store in the format: ldap://host:port or ldaps://host:port. For example: ldaps://oid.mycompany.com:636

    • LDAP Bind DN: cn=orcladmin

    • LDAP Password: orcladmin_password

    • User Credential ID Attribute: uid

    • User Unique ID Attribute: orclguid

    • Person Object Class: inetOrgPerson

    • Base DN: dc=us,dc=oracle,dc=com

    Click Next.

  16. On the LDAP Attributes for User Data Store screen, specify the following values:

    • LDAP Type: Select Oracle Internet Directory from the drop down.

    • LDAP URL: The LDAP URL to connect to your LDAP store in the following format: ldap://host:port or ldaps://host:port. For example: ldaps://oid.mycompany.com:636

    • LDAP Bind DN: cn=orcladmin

    • LDAP Password: orcladmin_password

    • User Description Attribute: uid

    • User ID Attribute: orclguid

    • Person Object Class: inetOrgPerson

    • Base DN: dc=mycompany,dc=com

    Click Next.

  17. On the LDAP Attributes for Federation Data Store screen, specify the following values:

    • LDAP Type: Select Oracle Internet Directory from the drop down.

    • LDAP URL: Provide the LDAP URL to connect to your LDAP store in the following format: ldap://host:port or ldaps://host:port. For example: ldaps://oid.mycompany.com:636

    • LDAP Bind DN: cn=orcladmin

    • LDAP Password: orcladmin_password

    • User Federation Record Context: cn=myfed,dc=mycompany,dc=com

    • Container Object Class: The type of User Federation Record Context that Oracle Identity Federation should use when creating the LDAP container, if it does not exist already. If that field is empty, its value will be set to applicationprocess. For Microsoft Active Directory this field must be set to container.

    Click Next.

  18. On the Transient Store Database Details screen, specify the values shown in the example below:

    • Host Name: The connect string to your database. For example:

      infradbhost1-vip.mycompany.com:1521:idmdb1^infradbhost2-vip.mycompany.com:1521:idmdb2@idmedg.mycompany.com

      Note:

      The Oracle RAC database connect string information needs to be provided in the format host1:port1:instance1^host2:port2:instance2@servicename. During this installation, it is not required for all the Oracle RAC instances to be up. If one Oracle RAC instance is up, the installation can proceed.It is required that the information provided above is complete and accurate. Specifically, the correct host, port, and instance name must be provided for each Oracle RAC instance, and the service name provided must be configured for all the specified Oracle RAC instances.Any incorrect information entered in the Oracle RAC database connect string has to be corrected manually after the installation.

    • UserName: The username for the OIF Schema. For example: edg_oif

    • Password: oif_user_password

    Click Next.

  19. On the Installation Summary screen, review the selections to ensure that they are correct. If they are not correct, click Back to modify selections on previous screens. Then click Configure.

  20. On the Configuration Progress screen, view the progress of the configuration.

  21. On the Configuration Complete screen, click Finish to confirm your choice to exit.

15.3 Configuring Oracle Identity Federation on OIFHOST2

  1. Ensure that the system, patch, kernel and other requirements are met. These are listed in the Oracle Fusion Middleware Installation Guide for Oracle Identity ManagementOpens a new window in the Oracle Fusion Middleware documentation library for the platform and version you are using.

  2. If you plan to provision the Instance Home or the Managed Server domain directory on shared storage, ensure that the appropriate shared storage volumes are mounted on IDMHOST1 as described in Section 2.4, "Shared Storage and Recommended Directory Structure."Opens a new window

  3. Ensure that port 7499 is not in use by any service on the computer by issuing these commands for the operating system you are using. If a port is not in use, no output is returned from the command.

    On UNIX:

    netstat -an | grep "7499"

    If the port is in use (if the command returns output identifying the port), you must free it.

    On UNIX:

    Remove the entries for port 7499 in the /etc/services file and restart the services, as described in Section 18.1, "Starting and Stopping Oracle Identity Management Components,"Opens a new window or restart the computer.

  4. Copy the staticports.ini file from the Disk1/stage/Response directory to a temporary directory.

  5. Edit the staticports.ini file that you copied to the temporary directory to assign the following custom port:

    #The port for OIF Server portOIF Server Port No = 7499

  6. Start the Oracle Identity Management 11g Configuration Assistant located under the ORACLE_HOME/bin directory as follows:

    On UNIX, issue this command:

    ./config.sh

    On Windows, double-click config.exe

  7. On the Welcome screen, click Next.

  8. On the Select Domain screen, select the Expand Cluster option and specify these values:

    • HostName: ADMINVHN.mycompany.com

    • Port: 7001

    • UserName: weblogic

    • User Password: weblogic_user_password

    Click Next.

  9. A dialog box with the following message appears:

    The selected domain is not a valid Identity Management domain or the installer cannot determine if it is a valid domain. If you created the domain using the Identity Management installer, you can ignore this message and continue. If you did not create the domain using the Identity Management installer, refer to the Identity Management documentation for information on how to verify the domain is valid.

    This is a benign warning that you can ignore.

    Click Yes to continue.

  10. On the Specify Installation Location screen, specify the following values:

    • Oracle Middleware Home Location: /u01/app/oracle/product/fmw (This value is prefilled and cannot be updated.)

    • Oracle Home Directory: oif (This value is prefilled and cannot be updated.)

    • WebLogic Server Directory: /u01/app/oracle/product/fmw/wlserver_10.3

    • Oracle Instance Location: /u01/app/oracle/admin/oif_inst2

    • Instance Name: oif_inst2

    Note:

    Ensure that the Oracle Home Location directory path for OIFHOST1 is the same as the Oracle Home Location path for OIFHOST2. For example, if the Oracle Home Location directory path for OIFHOST1 is: /u01/app/oracle/product/fmw/oif, then the Oracle Home Location directory path for OIFHOST2 must also be /u01/app/oracle/product/fmw/oif.

    Click Next.

  11. On the Specify Oracle Configuration Manager Details screen, specify the following values:

    • Email Address: The email address for your My Oracle Support account

    • Oracle Support Password: The password for your My Oracle Support account

    • Select: I wish to receive security updates via My Oracle Support

    Click Next.

  12. On the Configure Components screen, de-select all the components except for Oracle Identity Federation components. Select only Oracle Identity Federation from the Oracle Identity Federation components. Do not select Oracle HTTP Server.

    Click Next.

  13. On the Installation Summary screen, review the selections to ensure that they are correct. If they are not correct, click Back to modify selections on previous screens. Then click Configure.

  14. On the Configuration Progress screen, view the progress of the configuration.

  15. On the Installation Complete screen, click Finish to confirm your choice to exit.

15.4 Post-Installation Steps for Oracle Identity Federation

Follow the post-installation steps in this section to complete the installation and configuration of the Oracle Identity Federation application

15.4.1 Copying the Oracle Identity Federation Configuration Directory from OIFHOST1 to OIFHOST2

Copy the Oracle Identity Federation configuration directory from OIFHOST1 to OIFHOST2. That is, copy the directory:

MW_HOME /user_projects/domains/IDMDomain/config/fmwconfig/servers/wls_oif1/applications

on:

OIFHOST1

to:

MW_HOME/user_projects/domains/IDMDomain/config/fmwconfig/servers/wls_oif2/applications

on:

OIFHOST2.

For example, from OIFHOST1, execute the following is command:

scp -rp MW_HOME/user_projects/domains/IDMDomain/config/fmwconfig/servers/wls_oif1/applicationsuser@OIFHOST2:/MW_HOME/user_projects/domains/IDMDomain/config/fmwconfig/servers/wls_oif2/applications

15.4.2 Set the Listen Address for the Managed Servers

Set the listen address for the WLS_OIF1 and WLS_OIF2 Managed Servers to the host name of their respective nodes using the Oracle WebLogic Administration Server:

  1. Using a web browser, bring up the Oracle WebLogic Administration Server console and log in using the weblogic user credentials.

  2. In the left pane of the WebLogic Administration Server Console, click Lock & Edit to edit the server configuration.

  3. In the left pane of the WebLogic Server Administration Console, expand Environment and select Servers.

  4. On the Summary of Servers page, click the link for the wls_oif1 Managed Server.

  5. On the Settings page for the wls_oif1 Managed Server, update the Listen Address to oifhost1.mycompany.com. This is the host name of the server where wls_ods1 is running.

  6. Click Save to save the configuration.

  7. Repeat Steps 2 to 6 to update the Listen Address for the wls_oif2 Managed Server to oifhost2.mycompany.com. This is host name of the server where wls_oif2 is running.

  8. Click Activate Changes to update the server configuration.

15.4.3 Starting the Managed Server on OIFHOST2

Follow these steps to start the newly created wls_oif2 Managed Server in a cluster on OIFHOST2:

  1. In the left pane of the Oracle WebLogic Server Administration Console, expand Environment and select Clusters.

  2. Click the cluster (cluster_oif) containing the Managed Server (wls_oif2) you want to stop.

  3. Select Control.

  4. Under Managed Server Instances in this Cluster, select the Managed Server (wls_oif2) you want to start and click Start.

  5. On the Cluster Life Cycle Assistant page, click Yes to confirm.

WebLogic Node Manager starts the server on the target machine. When the Node Manager finishes its start sequence the server's state is indicated in the State column in the Server Status table.

15.5 Provisioning the Managed Servers on the Local Disk

Due to certain limitations, the Oracle Configuration Wizard creates the domain configuration under the ORACLE_HOME. In this EDG, the Oracle Home is on shared disk and it is a best practice recommendation to separate the domain configuration from the Oracle Home. This section provides the steps to seperate the domain. Proceed as follows:

  1. Stop the Administration Server and the Managed Servers (wls_ods1 and wls_ods2) as described in Section 18.1, "Starting and Stopping Oracle Identity Management Components."Opens a new window

  2. On IDMHOST1, pack the Managed Server domain using the pack command located under the ORACLE_HOME/common/bin directory. Make sure to pass the managed=-true flag to pack the managed server. Type:

    ORACLE_HOME/common/bin/pack.sh -managed=true \
   -domain=path_to_adminServer_domain -template=templateName.jar \
   -template_name=templateName

    For example

    ORACLE_HOME/common/bin/pack.sh -managed=true \
  -domain=/u01/app/oracle/admin/IDMDomain/aserver/IDMDomain \
  -template=/u01/app/oracle/product/fmw/templates/managedServer.jar \
  -template_name=ManagedServer_Template

  3. Copy the Managed Server template directory from IDMHOST1 to both OIFHOST1 and OIFHOST2. For Example:

    Copy to OIFHOST1:

    scp -rp /u01/app/oracle/products/fmw/templates user@OIFHOST1://u01/app/oracle/products/fmw/templates

    Copy to OIFHOST2:

    scp -rp /u01/app/oracle/products/fmw/templates user@OIFHOST2://u01/app/oracle/products/fmw/templates

  4. Unpack the Managed Server to the local disk on OIFMHOST1 using the unpack command located under the ORACLE_COMMON_HOME/common/bin directory.

    ORACLE_HOME/common/bin/unpack.sh -domain=path_to_domain_on_localdisk \     -template=templateName.jar -app_dir=path_to_appdir_on_localdisk

    For example:

    ORACLE_HOME/common/bin/unpack.sh \-domain=/u01/app/oracle/admin/IDMDomain/mserver/IDMDomain \-template=/u01/app/oracle/product/fmw/templates/managedServer.jar \-app_dir=/u01/app/oracle/admin/IDMDomain/mserver/applications

  5. Unpack the Managed Server to the local disk on IDMHOST2 using the unpack command located under the ORACLE_HOME/common/bin directory.

    ORACLE_HOME/common/bin/unpack.sh -domain=path_to_domain_on_localdisk \     -template=templateName.jar -app_dir=path_to_appdir_on_localdisk

    For example:

    ORACLE_HOME/common/bin/unpack.sh \-domain=/u01/app/oracle/admin/IDMDomain/mserver/IDMDomain \-template=/u01/app/oracle/product/fmw/templates/managedServer.jar \-app_dir=/u01/app/oracle/admin/IDMDomain/mserver/applications

  6. Start the Node Manager on OIFHOST1 and OIFHOST2 using the startNodeManager.sh script located under the WL_HOME/server/bin directory. For Example:

    /u01/app/oracle/product/fmw/wlserver_10.3/server/bin/startNodeManager.sh > /tmp/nm.log &

  7. Start the Administration server by following the steps in Section 18.1, "Starting and Stopping Oracle Identity Management Components."Opens a new window

  8. Validate that the Administration Server started up successfully by opening a browser accessing the Administration Console at http://ADMINVHN.us.oracle.com:7001/console.

    Also validate Enterprise Manager by opening a browser and accessing Oracle Enterprise Manager Fusion Middleware Control at http://ADMINVHN.us.oracle.com:7001/em.

  9. Start the Managed Servers on IDMHOST1 and IDMHOST2 by using the Administration Console. Follow the steps in the Starting Managed Servers section

  10. Delete the MW_HOME/user_projects directory on OIFHOST1 and OIFHOST2. This directory is created by the Oracle Universal Installer when the domain is originally configured and is no longer required after the provisioning the Managed Server to the local disk.

15.6 Enabling Oracle Identity Federation Integration with LDAP Servers

By default, Oracle Identity Federation is not configured to be integrated with LDAP Servers deployed in a high availability configuration. To integrate Oracle Identity Federation with highly available LDAP Servers to serve as user data store, federation data store, or authentication engine, you must configure Oracle Identity Federation based on the LDAP server's function.

Enter the WLST script environment for Oracle Identity Federation, then set the following properties as needed:

  • To integrate the user data store with a highly available LDAP Server, set the userldaphaenabled boolean property from the datastore group to true; otherwise set it to false:

    setConfigProperty('datastore','userldaphaenabled', 'true', 'boolean')

  • To integrate the federation data store with a highly available LDAP Server, set the fedldaphaenabled boolean property from the datastore group to true; otherwise set it to false:

    setConfigProperty('datastore', 'fedldaphaenabled','true', 'boolean')

  • To integrate the LDAP authentication engine with a highly available LDAP Server, set the ldaphaenabled boolean property from the authnengines group to true; otherwise set it to false:

    setConfigProperty('authnengines','ldaphaenabled', 'true', 'boolean')

15.7 Configuring Oracle Identity Federation to work with the Oracle Web Tier

This section describes how to configure Oracle Access Manager to work with the Oracle Web Tier

15.7.1 Prerequisites

Before proceeding, ensure that the following tasks have been performed:

  1. Oracle Web Tier has been installed on WEBHOST1 and WEBHOST2.

  2. Oracle Access Manager has been installed and configured on IDMHOST1 and IDMHOST2.

  3. Loadbalancer has been configured with a virtual hostname (sso.myconpany.com) pointing to the webservers on WEBHOST1 and WEBHOST2.

  4. Loadbalancer has been configured with a virtual hostname (admin.mycompany.com) pointing to webservers WEBHOST1 and WEBHOST2.

15.7.2 Making OIF aware of the Load Balancer

To configure the Oracle Identity Federation application to use the load balancer VIP, follow these steps:

  1. From the OIF menu in Oracle Enterprise Manager Fusion Middleware Control, select Administration, and then Server Properties.

  2. Change the host name and port to reflect the load balancer host and port.

  3. From the OIF menu in Oracle Enterprise Manager Fusion Middleware Control, select Administration, and then Identity Provider.

  4. Change the URL to http://LoadBalancerHost:LoadBalancerPort.

  5. From the OIF menu in Oracle Enterprise Manager Fusion Middleware Control, select Administration, and then Service Provider.

  6. Change the URL to http://LoadBalancerHost:LoadBalancerPort.

  7. Repeat these steps for each Managed Server where Oracle Identity Federation is deployed.

15.7.3 Configuring Oracle HTTP Servers To Front End the OIF Managed Servers

On each of the web servers on WEBHOST1 and WEBHOST2, create a file called oif.conf in the directory ORACLE_INSTANCE/config/OHS/component/moduleconf. Edit this file and add the following lines:

<Location /fed>
SetHandler weblogic-handler
WebLogicCluster oifhost1.mycompany.com:7499,oifhost2.mycompany.com:7499
</Location>

Restart the Oracle HTTP Server, as described inSection 18.1, "Starting and Stopping Oracle Identity Management Components."Opens a new window

15.8 Validating

  1. If the configuration is correct, you can access the following URLs from a web browser:

    • https://sso.mycompany.com/fed/sp/metadata

    • https://sso.mycompany.com/fed/idp/metadata

  2. Follow the instructions in the "Obtain Server Metadata" and "Add Trusted Providers" sections of Oracle Fusion Middleware Administrator's Guide for Oracle Identity FederationOpens a new window to import metadata from the Service Provider into the Identity Provider and the Identity Provider metadata into the Service Provider

  3. Go to the following URL and do a Single Sign-On operation:

    http://SP_Host:SP_port/fed/user/testspsso