2 Installing and Configuring Oracle Identity and Access Management on IBM WebSphere

2.1 Task 1: Review the System Requirements and Certification Information

Before performing any upgrade or installation you should read the system requirements documentation to ensure that your environment meets the minimum installation requirements for the products you are installing.

The system requirements document covers information such as hardware and software requirements, minimum disk space and memory requirements, and required system libraries, packages, or patches:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-requirements-100147.html

In addition, you should read the certification document. The certification document covers supported installation types, platforms, operating systems, databases, JDKs, and third-party products:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

2.2 Task 2: Obtain the Necessary Software Media or Downloads

For this installation and configuration procedure, you will need to obtain the following software:

• IBM WebSphere Application Server - Network Deployment (ND)

  For more information, see Section 2.4.1, "IBM Online Resources for Obtaining and Installing the IBM WebSphere Software."

  For specific information the software requirements, refer to Section 2.1, "Task 1: Review the System Requirements and Certification Information".

• Oracle Database

• Oracle Fusion Middleware Repository Creation Utility 11g Release 2 (11.1.2.2.0)

• Oracle Identity and Access Management Suite 11g Release 2 (11.1.2.2.0)

• Oracle SOA Suite 11g (11.1.1.7.0)

  Note:

  Oracle Identity Manager requires Oracle SOA Suite. If you are installing Oracle Identity Manager, you must install Oracle SOA Suite 11g (11.1.1.7.0).

  After installing Oracle SOA Suite 11.1.1.7.0, you must apply mandatory SOA patches. For more information, see "SOA Patch Requirements for Oracle Identity Manager".

  For information about where to download the software, refer to the Oracle Fusion Middleware Download, Installation, and Configuration Readme Files on the Oracle Technology Network (OTN):

  https://download.oracle.com/docs/cd/E23104_01/download_readme.htm
  

2.3 Task 3: Identify a Database and Install the Required Database Schemas

The following Oracle Fusion Middleware products require a metadata repository with required schemas to be installed in a supported database:

• Oracle Identity and Access Management Suite

• Oracle SOA Suite

You cannot configure these products without first installing the required schemas in a supported database.

To create or update schemas in a database, use the Repository Creation Utility (RCU).

For information about identifying the schemas required for specific Oracle Fusion Middleware products, as well as information about the database requirements and running RCU, refer to Oracle Fusion Middleware Repository Creation Utility User's Guide.

For information on the databases supported by Oracle Fusion Middleware, see the certification information described in Section 2.1, "Task 1: Review the System Requirements and Certification Information".

Make a note of the database connection information along with the name and passwords for the schemas you create with the Repository Creation Utility. You will need these later when you configure the Oracle Fusion Middleware products.

2.4 Task 4: Install the IBM WebSphere Software

To install and configure Oracle Fusion Middleware with IBM WebSphere, you must first install (but not configure) IBM WebSphere Application Server -Network Deployment (ND).

Refer to the following sections for more information:

• IBM Online Resources for Obtaining and Installing the IBM WebSphere Software

• Important Considerations Before Installing the IBM WebSphere Software

DISK/IBM/WebSphere/AppServer

2.5 Task 5: Install Oracle SOA Suite (Oracle Identity Manager Users Only)

If you are installing Oracle Identity Manager, you must install Oracle SOA Suite 11g (11.1.1.7.0). Note that only Oracle Identity Manager requires Oracle SOA Suite. This step is required because Oracle Identity Manager uses process workflows in Oracle SOA Suite to manage request approvals.

Run the Oracle SOA Suite installer, as follows:

SOA_Installer_Home/Disk1/runInstaller -jreLoc WAS_HOME/java/jre

For more information about installing Oracle SOA Suite, see Oracle Fusion Middleware Installation Guide for Oracle SOA Suite and Oracle Business Process Management Suite.

SOA Patch Requirements for Oracle Identity Manager

After installing Oracle SOA Suite 11.1.1.7.0, you must apply mandatory SOA patches before installing Oracle Identity Manager. For information about the patches, refer to the "Mandatory Patches Required for Installing Oracle Identity Manager" topic in the 11g Release 2 Oracle Fusion Middleware Release Notes.

SOA patches are located at the following directory:

IAM_Installer_Home/Disk1

2.6 Task 6: Install Oracle Identity and Access Management Suite

For instructions on installing Oracle Identity and Access Management on IBM WebSphere, refer to the Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

2.7 Task 7: Optional: Enabling TDE in Oracle Privileged Account Manager Data Store (For Oracle Privileged Account Manager Users Only)

Oracle Privileged Account Manager can operate with Oracle Database TDE (Transparent Data Encryption) mode. You can choose to either enable or disable the TDE mode. Oracle strongly recommends to enable the TDE mode for enhanced security.

This section includes the following topics:

• Enabling TDE in the Database

• Enabling Encryption in OPAM Schema

sqlplus DEV_OPAM/welcome1 @IAM_HOME/opam/sql/opamxencrypt.sql

2.8 Task 8: Upgrading OPSS Schema using Patch Set Assistant

You must upgrade the Oracle Platform Security Services (OPSS) schema that you had created using the Repository Creation Utility (RCU) in Section 2.3, "Task 3: Identify a Database and Install the Required Database Schemas".

To upgrade the schemas, complete the following steps:

• Starting Patch Set Assistant

• Using the Patch Set Assistant Graphical Interface

2.9 Task 9: Configure Your Oracle Identity and Access Management Components in a New IBM WebSphere Cell

To configure Oracle Identity and Access Management components in an IBM WebSphere environment, you use the IBM WebSphere version of the Oracle Fusion Middleware Configuration Wizard.

This section includes the following topics:

• General Information About Using the Configuration Wizard on IBM WebSphere

• Configuring Oracle Identity and Access Management Components for Single-Node Setup

2.9.2 Configuring Oracle Identity and Access Management Components for Single-Node Setup

This section describes how to use the Configuration Wizard to configure your Oracle Identity and Access Management products in a simple IBM WebSphere cell. For complete information about using the Oracle Fusion Middleware Configuration Wizard, including information about adding servers and clusters to a cell, refer to the Oracle Fusion Middleware Configuration Guide for IBM WebSphere Application Server.

Note:

The instructions here describe how to use the Configuration Wizard to configure your components. However, you can also use the WebSphere wsadmin command-line utility to configure your Oracle Fusion Middleware components.

• For more information about using the wsadmin command-line utility, see Section 3.1.3, "Using the Oracle Fusion Middleware wsadmin Commands".

• For more information about configuring components with wsadmin, see "Using wsadmin to Configure Oracle Fusion Middleware" in the Oracle Fusion Middleware Configuration Guide for IBM WebSphere Application Server.

To configure your Oracle Identity and Access Management product in a new IBM WebSphere cell, complete the following steps:

1. Start the Oracle Fusion Middleware Configuration Wizard by running the following command from the Oracle Identity and Access Management home:

   On UNIX operating systems:

   ORACLE_HOME/common/bin/was_config.sh
   

2. On the Select Configuration Option screen, select Create and Configure Cell. Then, click Next.

3. On the Specify Cell, Profile, and Node Name Information screen, provide the default name or a new name. The default names are:

   Cell Name: hostCell01

   Deployment Manager Profile Name: Dmgr01

   Deployment Manager Node name: hostCellManager01

   Application Server Profile Name: Custom01

   Application Server Node Name: hostNode01

4. On the Specify Deployment Manager Information screen, enter WebSphere Administration username and password. The WebSphere Administration user name and password provided here will be used for logging into the console and for performing certain configuration steps later. Click Next.

5. On the Add Products to Cell screen, select the required templates based on the components that you want to configure. Table 2-2 provides the name of the Oracle Identity and Access Management templates and their dependencies.

   Table 2-2 Oracle Identity and Access Management Product Templates

   Template Name	Dependency
   Oracle Identity Manager for Webpshere ND - 11.1.2.0.0 [Oracle_IDM1]	Oracle SOA suite for WebSphere ND - 11.1.1.0 [Oracle_SOA1] Oracle Enterprise Manager for WebSphere - 11.1.1.0 [oracle_common] Oracle Workflow Client Extension - 11.1.1.0 [Oracle_SOA1] Oracle WSM Policy Manager - 11.1.1.0 [oracle_common] Oracle JRF Webservices Asynchronous services - 11.1.1.0 [oracle_common] Oracle Platform Security Service - 11.1.1.0 [Oracle_IDM1] Oracle JRF for WebSphere - 11.1.1.0 [oracle_common]
   Oracle Access Management - 11.1.2.0.0 [Oracle_IDM1]	Oracle Platform Security Service - 11.1.1.0 [Oracle_IDM1] Oracle JRF for WebSphere - 11.1.1.0 [oracle_common]
   Oracle Adaptive Access Manager Admin Server - 11.1.2.0.0 [Oracle_IDM1] In addition, you can select the following: Oracle Adaptive Access Manager Offline - 11.1.2.0.0 [Oracle_IDM1] Oracle Adaptive Access Manager - Server - 11.1.2.0.0 [Oracle_IDM1]	Oracle Enterprise Manager for WebSphere - 11.1.1.0 [oracle_common] Oracle Platform Security Service - 11.1.1.0 [Oracle_IDM1] Oracle JRF for WebSphere - 11.1.1.0 [oracle_common] When you select the Oracle Adaptive Access Manager - Server - 11.1.2.0.0 [Oracle_IDM1] option, in addition to the templates mentioned above, the Oracle WSM Policy Manager - 11.1.1.0 [oracle_common] is also selected, by default.
   For Oracle Entitlements Server, the following templates are available: Oracle Entitlements Server for Admin Server- 11.1.1.0 [Oracle_IDM1] Oracle Entitlements Server for Managed Server- 11.1.1.0 [Oracle_IDM1]	Oracle Platform Security Service - 11.1.1.0 [Oracle_IDM1] Oracle JRF for WebSphere - 11.1.1.0 [oracle_common]
   For Oracle Privileged Account Manager, the following templates are available: Oracle Privileged Account Manager (Form auth-mode OINAV) - 11.1.2.1.0 [Oracle_IDM1] Oracle Privileged Account Manager (Client-Cert auth-mode OINAV) - 11.1.2.1.0 [Oracle_IDM1]	When you select the Oracle Privileged Account Manager (Form auth-mode OINAV) - 11.1.2.1.0 [Oracle_IDM1] option, the following options are also selected, by default: Oracle Identity Navigator for Managed Server (Form auth-mode) - 11.1.2.2.0 [Oracle_IDM1] Oracle Platform Security Service - 11.1.1.0 [Oracle_IDM1] Oracle JRF for WebSphere - 11.1.1.0 [oracle_common] When you select the Oracle Privileged Account Manager (Client-Cert auth-mode OINAV) - 11.1.2.1.0 [Oracle_IDM1] option, the following options are also selected, by default: Oracle Identity Navigator for Managed Server (Client-Cert auth-mode) - 11.1.2.2.0 [Oracle_IDM1] Oracle Platform Security Service - 11.1.1.0 [Oracle_IDM1] Oracle JRF for WebSphere - 11.1.1.0 [oracle_common]
   For Oracle Identity Navigator, the following templates are available: Oracle Identity Navigator for Managed Server (Form auth-mode) - 11.1.2.2.0 [Oracle_IDM1] Oracle Identity Navigator for Managed Server (Client-Cert auth-mode) - 11.1.2.2.0 [Oracle_IDM1]	Oracle Platform Security Service - 11.1.1.0 [Oracle_IDM1] Oracle JRF for WebSphere - 11.1.1.0 [oracle_common]

   
   

   Select the required templates, and click Next.

6. On the Configure JDBC Component Schema screen, you can select the required component schemas to modify.

   You can set values for Schema Owner, Schema Password, Database and Service, Host Name, and Port. Click Next. The Test JDBC Component Schema screen appears. After the test succeeds, click Next. The Select Optional Configuration screen appears.

   Note:

   In the Test JDBC Component Schema screen, if the schema test connectivity for Oracle Identity Manager fails, ignore the error message and proceed.

7. On the Select Optional Configuration screen, you can configure the following:

   • Application Servers, Clusters and End Points

   • Deployments and Services

   • JDBC

   Select the desired options, and click Next.

   Note:

   Steps 8-11 will appear based on the options that you select on the Select Optional Configuration screen.

8. Optional step: Configure the Application Server parameters.

9. Optional step: Configure Clusters, as required.

10. Optional step: Configure End Points, as required.

11. Optional step: Select Deployments, such as applications, libraries, and Services to target them to a particular cluster or server.

12. On the Configuration Summary screen, you can view summary of your configuration for deployments, application, and service. Review your configuration summary, and click Create to configure a new IBM WebSphere cell.

A new IBM WebSphere cell is created in the WAS_HOME/profiles/Dmgr01/config/cells directory (on UNIX).

Note:

If you are configuring Oracle Identity Manager, you must run the Oracle Universal Installer Configuration Assistant after configuring a WebSphere cell, to configure Oracle Identity Manager Server, Oracle Identity Manager Design Console, and Oracle Identity Manager Remote Manager. For more information, see Section 4.3.1, "Configuring Oracle Identity Manager for Single-Node Setup".

2.10 Task 10: Configure the Database Security Store

You must run the configureSecurityStoreWas.py script to configure the Database Security Store. The configureSecurityStoreWas.py script is located in the IAM_HOME/common/bin directory. You can use the -h option for help information about using the script.

The policy re-association migrates the OPSS security store from a source to a target LDAP- or DB-based store, and it resets the default policy and credential services to the target repository.

1. To perform policy re-association changes on IBM WebSphere, complete the following steps:

   1. Go to the IAM_HOME/common/bin directory.

   2. Run the following WSADMIN command to perform offline policy re-association:

      On UNIX operating systems:

      ./wsadmin.sh -lang jython -profileName DEPLOYMENT_MANAGER_PROFILE_NAME -f IAM_HOME/common/tools/configureSecurityStoreWas.py -d PATH_TO_DEPLOYMENT_MANAGER_CELL_DIRECTORY -t DB_ORACLE -j cn=jpsroot --wasadmin WAS_ADMINISTRATOR_USERNAME -m create --passcode OPSS_SCHEMA_PASSWORD --config IAM
      

      For example:

      ./wsadmin.sh -lang jython -profileName Dmgr01 -f IAM_HOME/common/tools/configureSecurityStoreWas.py -d IAM_HOME/was/install/was6076/profiles/Dmgr01/config/cells/DefaultCell01 -t DB_ORACLE -j cn=jpsroot --wasadmin wasadmin -m create --passcode opsschemapassword --config IAM
      

      Review the generated output and verify that no error is reported during policy re-association.

2. To verify the re-association of policy, complete the following steps:

   1. Log in to Oracle Identity System Administration. The log in must be successful.

   2. Log in to WAS Administration Console. The login must be successful.

   3. Log in to Oracle Enterprise Manager, and go to Websphere Cell, Security, Security Provider Configuration. Verify that the Store Type is Oracle Database pointing to jdbc/OPSSDBDS jndi.

   4. You can also run the following WSADMIN command to verify the re-association of policy

      On UNIX operating systems:

      ./wsadmin.sh -lang jython -profileName DEPLOYMENT_MANAGER_PROFILE_NAME -f IAM_HOME/common/tools/configureSecurityStoreWas.py -d PATH_TO_DEPLOYMENT_MANAGER_CELL_DIRECTORY -t DB_ORACLE -j cn=jpsroot -m validate --passcode OPSS_SCHEMA_PASSWORD
      

      For example:

      ./wsadmin.sh -lang jython -profileName Dmgr01 -f IAM_HOME/common/tools/configureSecurityStoreWas.py -d IAM_HOME/was/install/was6076/profiles/Dmgr01/config/cells/DefaultCell01 -t DB_ORACLE -j cn=jpsroot -m validate --passcode opsschemapassword
      

3. Stop the Node.

   Navigate to the following directory in the IBM WebSphere home and enter the following command:

   On UNIX operating systems:

   profiles/Server_profileName/bin/stopNode.sh 
   

   For example:

   /disk01/IBM/WebSphere/AppServer/profiles
           /Custom01/bin/stopNode.sh
   

2.11 Task 11: Configure the Identity Store

On IBM WebSphere, Oracle Platform Security Services supports LDAP-based registries only. It does not support WebSphere's built-in file-based user registry.

You must complete the steps mentioned below to configure the OID store for Oracle Platform Security Services.

1. Start the Deployment Manager:

   Navigate to the following directory in the IBM WebSphere home and enter the following command:

   On UNIX operating systems:

   profiles/dmgr_profileName/bin/startManager.sh 
   

   For example:

   /disk01/IBM/WebSphere/AppServer/profiles
           /Dmgr01/bin/startManager.sh
   

   Note:

   If you are running the startManager.sh (or startManager.bat) command from WAS_HOME/bin directory, you must specify the parameter -profileName.

   For example, on a UNIX operating system:

   WAS_HOME/bin/startManager.sh -profileName dmgr_profileName
   

2. cd <oracle_common>/common/bin

3. Run the following wsadmin command:

   ./wsadmin.sh -conntype SOAP -port <port_number> -user <username> -password <passwd>

   The port details are available in the $WAS_HOME/profiles/Dmgr01/logs/AboutThisProfile.txt file.

   You must use the same credentials that you provided when setting up the WAS cell.

4. Opss.configureIdentityStore(propsFileLoc="<location of properties file>")

   A sample properties file is provided below:

   user.search.bases=cn=Users,dc=myhost,dc=mycompany,dc=com
   group.search.bases=cn=Groups,dc=myhost,dc=mycompany,dc=com
   subscriber.name=dc=myhost,dc=mycompany,dc=com
   ldap.host=ldaphost.mycompany.com
   ldap.port=3333
   # admin.id must be the full DN of the user in the LDAP
   admin.id=cn=orcladmin,cn=Users,dc=myhost,dc=mycompany,dc=com
   admin.pass=welcome1
   user.filter=(&(uid=%v)(objectclass=person))
   group.filter=(&(cn=%v)(objectclass=groupofuniquenames))
   user.id.map=*:uid
   group.id.map=*:cn
   group.member.id.map=groupofuniquenames:uniquemember
   ssl=false
   # primary.admin.id indicates a user who has admin permissions in the LDAP, must be the name of the user, for example, for user "cn=tom", the primary.admin.id is "tom"
   primary.admin.id=orcladmin
   # optional, default to "OID"
   idstore.type=OID
   # Optional properties for JPS LDAP identity store can also be configured in the file.
   username.attr=cn
   user.object.classes=person
   

   Note:

   If you are an Oracle Privileged Account Manager user, then you must skip step 5 and continue with the steps described in Section 11.2.2, "Starting Oracle Privileged Account Manager on IBM WebSphere".

5. Stop and restart the Deployment Manager. While stopping the Deployment Manager, use the credentials used while setting up the WAS cell. While restarting the server, use the OID credentials as mentioned in primary.admin.id of the properties file.

2.12 Task 12: Start the IBM WebSphere Servers

After you finish configuring the Oracle Fusion Middleware software successfully, you can start the IBM WebSphere Deployment Manager, Node, and Servers.

The following procedure shows the sequence you must use to start the deployment manager, the node, and the servers in the cell.

In the following examples, replace the names of the deployment manager and profile name with the values you entered in the Configuration Wizard in Section 2.9, "Task 9: Configure Your Oracle Identity and Access Management Components in a New IBM WebSphere Cell":

1. Start the Deployment Manager:

   Navigate to the following directory in the IBM WebSphere home and enter the following command:

   On UNIX operating systems:

   profiles/dmgr_profileName/bin/startManager.sh 
   

   For example:

   /disk01/IBM/WebSphere/AppServer/profiles
           /Dmgr01/bin/startManager.sh
   

   Note:

   If you are running the startManager.sh (or startManager.bat) command from WAS_HOME/bin directory, you must specify the parameter -profileName.

   For example, on a UNIX operating system:

   WAS_HOME/bin/startManager.sh -profileName dmgr_profileName
   

2. Synchronize the node:

   Navigate to the following directory in the IBM WebSphere home and enter the following command:

   On UNIX operating systems:

   profiles/Server_profile_name/bin/syncNode.sh host_name SOAP_Port -username admin_user -password admin_password
   

   For example:

   /disk01/IBM/WebSphere/AppServer/profiles/Custom01/bin/syncNode.sh myhost.mycompany.com 8879 -username wasadmin -password welcome1
   

3. Start the node:

   Navigate to the following directory in the IBM WebSphere home and enter the following command:

   On UNIX operating systems:

   profiles/Server_profile_name/bin/startNode.sh 
   

   For example:

   /disk01/IBM/WebSphere/AppServer/profiles/Custom01/bin/startNode.sh
   

   Note:

   If you are running the startNode.sh (or startNode.bat) command from WAS_HOME/bin directory, you must specify the parameter -profileName.

   For example, on a UNIX operating system:

   WAS_HOME/bin/startNode.sh -profileName Server_profileName
   

4. Start the OracleAdminServer server:

   Navigate to the following directory in the IBM WebSphere home and enter the following command:

   On UNIX operating systems:

   profiles/Server_profile_name/bin/startServer.sh OracleAdminServer
   

   For example:

   /disk01/IBM/WebSphere/AppServer/profiles/Custom01/bin/startServer.sh
            OracleAdminServer 
   

   Note:

   If you are running the startServer.sh (or startServer.bat) command from WAS_HOME/bin directory, you must specify the parameter -profileName.

   For example, on a UNIX operating system:

   WAS_HOME/bin/startServer.sh OracleAdminServer -profileName Server_profileName
   

5. Start any additional servers that were configured as part of your IBM WebSphere cell.

   After you start the OracleAdminServer, you can start the other servers using the IBM WebSphere Administrative Console or Oracle Enterprise Manager Fusion Middleware Control. For more information, see Section 3.1, "Summary of the Oracle Fusion Middleware Management Tools on IBM WebSphere".

   Alternatively, you can use the startServer script, as follows:

   Navigate to the following directory in the IBM WebSphere home and enter the following command:

   On UNIX operating systems:

   profiles/Server_profile_name/bin/startServer.sh server_name
   

   For example, for an Oracle Access Manager cell on a UNIX operating system:

   /disk01/IBM/WebSphere/AppServer/profiles
           /Custom01/bin/startServer.sh oam_server1 
   

   Note:

   If you are running the startServer.sh (or startServer.bat) command from WAS_HOME/bin directory, you must specify the parameter -profileName.

   For example, on a UNIX operating system:

   WAS_HOME/bin/startServer.sh server_name -profileName Server_profileName
   

   The typical servers that are configured for each of the Oracle Fusion Middleware components are listed in Table 2-3.

2.13 Task 13: Verify the Configuration of the IBM WebSphere Cell

To verify the installation, use the IBM WebSphere Administration Console and Oracle Enterprise Manager Fusion Middleware Control to verify that the management tools are working and the servers are up and running.

Refer to Section 3.1, "Summary of the Oracle Fusion Middleware Management Tools on IBM WebSphere" for more information on locating the URLs for these Web-based management tools.

Special Instructions for Oracle Access Management Users

Oracle Access Management Administration Console will be deployed on OracleAdminServer and Oracle Access Management Runtime will be deployed on oam_server1 by default.

You can access the Oracle Access Management console using the following URL:

http://WAS_HOST:OAM_AdminServer_Port/oamconsole