Oracle WebGate is a web server plug-in that intercepts HTTP requests and forwards them to an existing Oracle Access Manager instance for authentication and authorization.

For Oracle Fusion Middleware 12c, the Oracle WebGate software is installed as part of the Oracle HTTP Server 12c software installation. See Registering and Managing OAM 11g Agents in Adminstrator’s Guide for Oracle Access Management.

In Oracle Access Manager 12c, WebGate interacts with Oracle Access Manager through REST API calls. In order for WebGate to have unrestricted access to these Rest APIs, you need to update the WEB_CONFIG_DIR/webgate.conf file.

/u02/private/oracle/config/domains/ohsDomain/config/fmwconfig/components/OHS/ohs1/webgate.conf

1. Add the following lines:

   <LocationMatch "/iam/access/binding/api/v10/oap">
       require all granted
   </LocationMatch>

2. To enable a health check, add the following lines:

   Note:

   This step is applicable if you have created a health check described in Creating a Health Check.

   
   <LocationMatch "/health-check.html">
       require host webtier.com
       request ip IP ADDRESS OF LOADBALANCER
   </LocationMatch>

   Note:

   In above mentioned example webtier.com, a require host is used to restrict access to a particular subnet where your load balancer resides. Alternatively, you can use the clause request IP address of the load balancer to specify the address of the load balancer. This is the IP address of the load balancer and not the floating IP address assigned to the load balancer. This ensures that the OHS returns only health check tests to the load balancer.

   If your load balancer indicates that the webserver is down, then you must check the OHS access log to confirm the cause of the rejected requests which can occur if you are not restricting it to the right IP address of domain.

   You must not set your request host to your internet domain to avoid exposing your health check outside of the organisation.

3. Save the file.

• Copying the LoadBalancer Certificates to WebGate Config
  
• Ensuring that the REST Endpoints are Set Correctly
  

When you created your Oracle Access Management installation, a WebGate called Webgate_IDM was created. In order for WebGate to communicate with the Access servers, you must copy the artifacts associated with this WebGate to the web tier.

• Copying Generated Artifacts to the Oracle HTTP Server WebGate Instance Location
  

To set up the WebLogic Server authentication providers, back up the configuration files, set up the Oracle Access Manager Identity Assertion Provider and set the order of providers.

• Backing Up the Configuration Files
  You should first back up the relevant configuration files to ensure their safety.
• Setting Up the Oracle Access Manager Identity Assertion Provider
  
• Updating the Default Authenticator and Setting the Order of Providers
  

Some Oracle Fusion Middleware management consoles use Oracle Application Development Framework (Oracle ADF) security, which can integrate with Oracle Access Manager Single Sign-on (SSO). These applications can take advantage of Oracle Platform Security Services (OPSS) SSO for user authentication, but you must first configure the domain-level jps-config.xml file to enable these capabilities.

1. Connect to the AdminServer container using the following command:

   kubectl exec -n oamns -ti accessdomain-adminserver -- /bin/bash

2. Start the WebLogic Server Scripting Tool (WLST):

   ORACLE_COMMON_HOME/common/bin/wlst.sh

   For example:

   /u01/oracle/oracle_common/common/bin/wlst.sh

3. Connect to the Administration Server, by using the following WLST command:

   connect('<OAM_WEBLOGIC_USER>','<OAM_WEBLOGIC_PWD>','t3://<OAM_DOMAIN_NAME>-adminserver.<OAMNS>.svc.cluster.local:<OAM_ADMIN_PORT>')

   For example:

   connect('weblogic','<password>','t3://accessdomain-adminserver.oamns.svc.cluster.local:7001')

4. Run the addOAMSSOProvider command, as shown:

   addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi="/oam/logout.html")

5. Disconnect from the Administration Server by entering the following command:
   exit()
6. Exit from the container using the exit command.

You should first back up the relevant configuration files to ensure their safety.

DOMAIN_HOME/config/config.xml
DOMAIN_HOME/config/fmwconfig/jps-config.xml
DOMAIN_HOME/config/fmwconfig/system-jazn-data.xml

DOMAIN_HOME/servers/AdminServer/security/boot.properties