10 Performing Post-Deployment Configuration

10.2.1 Update Oracle Unified Directory Change Log Access

If you are using Oracle Unified Directory and Oracle Identity Manager, grant access to the change log by performing the following steps on all OUD hosts (LDAPHOST1 and LDAPHOST2).

To grant access to the change log:

1. Remove the existing change log permission by issuing this command on one of the replicated OUD hosts:

   OUD_ORACLE_INSTANCE/bin/dsconfig set-access-control-handler-prop \
   --remove global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version 3.0; acl \"External changelog access\"; deny (all) userdn=\"ldap:///anyone\";)" \
           --hostname OUD_HOST \
           --port OUD_ADMIN_PORT \
           --trustAll \
           --bindDN cn=oudadmin \
           --bindPasswordFile passwordfile \
           --no-prompt 
   

   For example:

   OUD_ORACLE_INSTANCE/bin/dsconfig set-access-control-handler-prop \
   --remove global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version 3.0; acl \"External changelog access\"; deny (all) userdn=\"ldap:///anyone\";)" \
           --hostname LDAPHOST1.mycompany.com \
           --port 4444 \
           --trustAll  \
           --bindDN cn=oudadmin \
           --bindPasswordFile mypasswordfile \
           --no-prompt
   

2. Then add the following new ACI:

   OUD_ORACLE_INSTANCE/bin/dsconfig set-access-control-handler-prop \
   --add global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version 3.0; acl \"External changelog access\"; allow (read,search,compare,add,write,delete,export) groupdn=\"ldap:///cn=OIMAdministrators,cn=groups,dc=mycompany,dc=com\";)" \
           --hostname OUD_HOST \
           --port OUD_ADMIN_PORT \
           --trustAll \
           --bindDN cn=oudadmin \
           --bindPasswordFile passwordfile \
           --no-prompt
   

   For example:

   OUD_ORACLE_INSTANCE/bin/dsconfig set-access-control-handler-prop \
   --add global-aci:"(target=\"ldap:///cn=changelog\")(targetattr=\"*\")(version 3.0; acl \"External changelog access\"; allow (read,search,compare,add,write,delete,export) groupdn=\"ldap:///cn=OIMAdministrators,cn=groups,dc=mycompany,dc=com\";)" \
           --hostname LDAPHOST1.mycompany.com \
           --port 4444 \
           --trustAll \
           --bindDN cn=oudadmin \
           --bindPasswordFile mypasswordfile \
           --no-prompt
   

10.2.2 Update Oracle Unified Directory ACIs for LDAP Synchronization

The following is a workaround for an Oracle Unified Directory operations failure when LDAP synchronization is enabled

In an environment in which LDAP synchronization is enabled, certain operations against Oracle Unified Directory fail with the following error in Oracle Unified Directory logs:

The request control with Object Identifier (OID) "1.2.840.113556.1.4.319" cannot be used due to insufficient access rights

To work around this issue, you must edit a configuration file on both instances of Oracle Unified Directory.

1. Change the ACIs on control 1.2.840.113556.1.4.319 from ldap://all to ldap://anyone in the Oracle Unified Directory config file OUD_ORACLE_INSTANCE/OUD/config/config.ldif, as shown:

   Change:

   ds-cfg-global-aci: (targetcontrol="1.3.6.1.1.12 || 1.3.6.1.1.13.1 || 1.3.6.1.1.13.2 || 1.2.840.113556.1.4.319 || 1.2.826.0.1.3344810.2.3 || 2.16.840.1.113730.3.4.18 || 2.16.840.1.113730.3.4.9 || 1.2.840.113556.1.4.473 || 1.3.6.1.4.1.42.2.27.9.5.9") (version 3.0; acl "Authenticated users control access"; allow(read) userdn="ldap:///all";)
   

   To:

   ds-cfg-global-aci: (targetcontrol="2.16.840.1.113730.3.4.2 || 2.16.840.1.113730.3.4.17 || 2.16.840.1.113730.3.4.19 || 1.3.6.1.4.1.4203.1.10.2 || 1.3.6.1.4.1.42.2.27.8.5.1 || 2.16.840.1.113730.3.4.16 || 2.16.840.1.113894.1.8.31 || 1.2.840.113556.1.4.319") (version 3.0; acl "Anonymous control access"; allow(read) userdn="ldap:///anyone";)
   

2. Restart the Oracle Unified Directory server as described in Section 15.1, "Starting and Stopping Components."

10.3.1 Post Deployment Steps to Address Known Issue

Due to a known issue, node manager SSL is not configured fully. The workaround is to perform the following steps for each administration and managed server in the deployment, in each domain.

1. Login to the WebLogic console for the domain using at the URL listed in Section 15.2, "About Identity and Access Management Console URLs."

2. Click Lock and Edit.

3. Navigate to Environment > Servers

4. Click on a server name, for example: wls_oam1

5. Click on the SSL tab

6. Expand the Advanced Options and change Hostname Verification to BEA Host Name Verifier

7. Click Save.

8. Repeat for each server in the domain.

9. Click Activate Changes

10. Restart the domain.

11. Repeat for the second domain

10.3.2 Update Server Start Parameters

As a workaround for a known issue in the Identity and Access Management Deployment tools, you must add an Oracle Identity Manager property. Perform the following steps:

1. Log in to the WebLogic Console in the IAMGovernanceDomain. (The Console URLs are provided in Section 15.2, "About Identity and Access Management Console URLs.")

2. Navigate to Environment -> Servers.

3. Click Lock and Edit.

4. Click on the server WLS_OIM1.

5. Click on the Server Start subtab.

6. Add the following to the Arguments field:

    -Djava.net.preferIPv4Stack=true
   

7. Click Save.

8. Repeat Steps 4-7 for the managed server WLS_OIM2.

9. Click Activate Changes.

10.5.1 Update Idle Timeout Value

By default the Access Manager idle timeout is set to two hours. This can cause issues with not being logged out after a session has timed out. Update this value to 15 minutes.

To update the idle timeout value:

1. Log in to the Access Management Console at the URL listed in Section 15.2, "About Identity and Access Management Console URLs."

2. Log in as the Access Manager administrator user you created in Section 8.9, "Set User Names and Passwords" for example: oamadmin.

3. Click on Common Settings under Configuration.

4. Change Idle Time out (minutes) to 15.

5. Click Apply.

10.5.2 Update WebGate Agents

After deployment, update existing WebGate Agents. The Identity and Access Management Console URLs are provided in Section 15.2, "About Identity and Access Management Console URLs."

Update the Access Manager Security Model of all WebGate profiles, with the exception of Webgate_IDM and Webgate_IDM_11g, which should already be set. In addition, set a password for the IAMSuiteAgent profile so that it can be used for OAAM for integration. (The IAMSuiteAgent was created when Access Manager was installed.)

To update these WebGate agents:

1. Log in to the Access Management Console as the Access Management administrator user identified by the entry in Section 8.9, "Set User Names and Passwords."

2. Click SSO Agents in the Access Manager box.

3. Ensure that the WebGates tab is selected.

4. Click Search.

5. Click an Agent, for example: IAMSuiteAgent.

6. Set the Security value to the same value defined to OAM Transfer Mode on the Access Manager Configuration screen in Section 8.15, "Configure Oracle Access Manager."

   Click Apply.

7. In the Primary Server list, click + and add any missing Access Manager Servers.

8. If a password has not already been assigned, enter a password into the Access Client Password Field and click Apply.

   Assign an Access Client Password, such as the Common IAM Password (COMMON_IDM_PASSWORD) you used in Section 8.9, "Set User Names and Passwords" or an Access Manager-specific password, if you have set one.

9. Set Maximum Number of Connections to 20 for all of the Access Manager Servers listed in the primary servers list. (This is the total maximum number of connections for the primary servers, which is 10 x WLS_OAM1 connections plus 10 x WLS_OAM2 connections.)

10. If you see the following in the User Defined Parameters:

    logoutRedirectUrl=http://OAMHOST1.mycompany.com:14100/oam/server/logout
    

    Change it to:

    logoutRedirectUrl=https://sso.mycompany.com/oam/server/logout
    

11. Click Apply.

12. Repeat Steps through for each WebGate.

13. Check that the security setting matches that of your Access Manager servers.