If a Managed Server fails, Node Manager attempts to restart it locally

Ongoing requests from Oracle HTTP Server timeout and new requests are directed to the other Managed Server. After the server's restart completes on the failed node, Oracle HTTP Server resumes routing any incoming requests to the server.

Node failures are treated in the same way as WebLogic Server fails.

Multi data sources protect Access Manager service Infrastructure against failures. When an Oracle RAC database instance fails, connections are reestablished with available database instances. The multi data source enables you to configure connections to multiple instances in an Oracle RAC database.

For more on multi data source configuration, see Section 4.1.3, "Using Multi Data Sources with Oracle RAC".

• If Node Manager is not running, start it with the following command:

  OAMHOST1>ORACLE_HOME/user_projects/domains/domainName/bin/startNodeManager.sh
  

1. Log into the WebLogic Administration Console using this URL using WebLogic administrator credentials:

   http://oamhost1.example.com:7001/console
   

2. Start the WLS_OAM1 Managed Server using the WebLogic Server Administration Console, as follows:
   1. Expand the Environment node in the Domain Structure tree on the left.
   2. Click Servers.
   3. On the Summary of Servers page, open the Control tab.
   4. Select WLS_OAM1, and then click Start.
   5. Click YES to confirm that you want to start the server.
   6. Then select OAM_POLICY_MGR1, and then click Start.
   7. Click YES to confirm that you want to start the server.

1. Log into the WebLogic Administration Console using this URL:

   http://OAMHOST1.example.com:7001/console
   

2. Supply the WebLogic administrator username and password.
3. Select Environment - Servers from the Domain Structure menu.
4. Click the Control tab.
5. Click the server WLS_OAM2.
6. Click Start.
7. Click OK to confirm that you want to start the server.

1. Log into the Oracle Access Management Console at this URL as the weblogic user:

   http://OAMHOST1.example.com:7001/oamconsole
   

2. Click on the Configuration tab.
3. Click the Access Manager Settings link.
4. Enter the following information:

   • OAM Server Host: login.example.com

   • OAM Server Port: 7777

   • OAM Server Protocol: http(s)

5. Click Apply.
6. Restart managed servers WLS_OAM1 and WLS_OAM2.

1. Set the Environment Variables: JAVA_HOME, IDM_HOME and ORACLE_HOME.

   Set IDM_HOME to IDM_ORACLE_HOME

   Set ORACLE_HOME to IAM_ORACLE_HOME

2. Create a properties file extend.props that contains the following:

   IDSTORE_HOST : idstore.example.com
   IDSTORE_PORT : 389
   IDSTORE_BINDDN : cn=orcladmin
   IDSTORE_USERNAMEATTRIBUTE: cn
   IDSTORE_LOGINATTRIBUTE: uid
   IDSTORE_USERSEARCHBASE:cn=Users,dc=example,dc=com
   IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=us,dc=oracle,dc=com
   IDSTORE_SEARCHBASE: dc=example,dc=com
   IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com

   Where:

   • IDSTORE_HOST and IDSTORE_PORT are, respectively, the host and port of your Identity Store directory. Specify the back-end directory here rather than OUD.

   • IDSTORE_BINDDN Administrative user in the Identity Store Directory

   • IDSTORE_USERSEARCHBASE Location in your Identity Store where users are placed.

   • IDSTORE_GROUPSEARCHBASE Location in your Identity Store where groups are placed.

   • IDSTORE_SEARCHBASE Location in the directory where Users and Groups are stored.

   • IDSTORE_SYSTEMIDBASE Location in your directory where the Oracle Identity Manager reconciliation users are placed.

   • IDSTORE_SYSTEMIDBASE Location of a container in the directory where you can place users when you do not want them in the main user container. This happens rarely. For example, if Oracle Identity Manager reconciliation user which is also used for the bind DN user in Oracle Virtual Directory adapters.

3. Configure the Identity Store using the command idmConfigTool, located at IAM_ORACLE_HOME/idmtools/bin.

   The command syntax is:

   idmConfigTool.sh -preConfigIDStore input_file=configfile

   For example:

   idmConfigTool.sh -preConfigIDStore input_file=extend.props

   The system prompts you for the account password with which you are connecting to the Identity Store.

   Sample command output:

   Enter ID Store Bind DN password : 
   Apr 5, 2011 3:39:25 AM oracle.ldap.util.LDIFLoader loadOneLdifFile
   INFO: -> LOADING:

   /u01/app/oracle/product/fmw/IAM/idmtools/templates/oid/idm_idstore_groups_template.ldif
   Apr 5, 2011 3:39:25 AM oracle.ldap.util.LDIFLoader loadOneLdifFile
   INFO: -> LOADING: 

   /u01/app/oracle/product/fmw/IAM/idmtools/templates/oid/idm_idstore_groups_acl_template.ldif
   Apr 5, 2011 3:39:25 AM oracle.ldap.util.LDIFLoader loadOneLdifFile
   INFO: -> LOADING: 

   /u01/app/oracle/product/fmw/IAM/idmtools/templates/oid/systemid_pwdpolicy.ldif
   Apr 5, 2011 3:39:25 AM oracle.ldap.util.LDIFLoader loadOneLdifFileINFO: -> LOADING: 

   /u01/app/oracle/product/fmw/IAM/idmtools/templates/oid/idstore_tuning.ldifApr 5, 2011 3:39:25 AM oracle.ldap.util.LDIFLoader loadOneLdifFileINFO: -> LOADING: 

   /u01/app/oracle/product/fmw/IAM/idmtools/templates/oid/oid_schema_extn.ldif
   The tool has completed its operation. Details have been logged to automation.log

4. Check the log file for errors and warnings and correct them.

1. Set the Environment Variables JAVA_HOME, IDM_HOME, and ORACLE_HOME.

   • Set IDM_HOME to IDM_ORACLE_HOME.

   • Set ORACLE_HOME to IAM_ORACLE_HOME.

2. Create a properties file oam.props that contains the following parameters shown in the following example:

   IDSTORE_HOST: host.example.com
   IDSTORE_PORT: 9389
   IDSTORE_BINDDN: cn=directory manager
   IDSTORE_PASSWD: secret12
   IDSTORE_USERNAMEATTRIBUTE: cn
   IDSTORE_LOGINATTRIBUTE: uid
   IDSTORE_USERSEARCHBASE: ou=people,dc=example,dc=com
   IDSTORE_GROUPSEARCHBASE: ou=groups,dc=example,dc=com
   IDSTORE_SEARCHBASE: dc=example,dc=com
   IDSTORE_SYSTEMIDBASE: cn=systemids,dc=example,dc=com
   IDSTORE_OAMSOFTWAREUSER: oamSoftwareUser
   IDSTORE_PWD_OAMSOFTWAREUSER: example_pwd
   IDSTORE_OAMADMINUSER: oamAdminUser
   IDSTORE_PWD_OAMADMINUSER: example_pwd
   IDSTORE_PWD_OBLIXANONYMOUSUSER: example_pwd
   IDSTORE_PWD_ANONYMOUSUSER: example_pwd
   OAM11G_IDSTORE_ROLE_SECURITY_ADMIN: OAMAdministrators
   POLICYSTORE_SHARES_IDSTORE: true

3. Configure the Identity Store using the command idmConfigTool which is located at IAM_ORACLE_HOME/idmtools/bin.

   The command syntax is as shown in the following example:

   $ORACLE_HOME/idmtools/bin/idmConfigTool.sh -prepareIDStore mode=OAM input_file=prepareIDStore.properties log_level=ALL log_file=log_idstore1.out dump_params=true

   After the command runs, the system prompts you to enter the password for the account with which you are connecting to the ID Store.

4. Check the log file for any errors or warnings and correct them.

1. Go to the Oracle Access Management Console at the URL:

   http://adminvhn.example.com:7001/oamconsole
   

2. Log in using the WebLogic administration user.
3. Select Configuration tab and click User Identity Stores.
4. Under OAM ID Stores, click Create. Enter the following information:

   • Store Name: LDAP_DIR

   • Store Type: OUD

   • Description: Enter a description of the Directory Store

   • Enable SSL: Select this if you communicate with your directory over SSL

   • Location: Enter the location, for example oud.example.com:389

   • Bind DN: Enter the user permitted to search the LDAP store. For example, cn=Directory Manager

   • Password: Enter the LDAP admin password

   • User Name Attribute: For example: uid

   • User Search Base: Enter the location of users in the LDAP store. For example, cn=Users,dc=example,dc=com

   • Group Name Attribute: For example: orclguid

   • Group Search Base: Enter the location of groups in the LDAP store. For example, cn=Groups,dc=example,dc=com

   • OAM Administrator Role: OAMAdministrators

5. Click Apply.
6. Click Test Connection to validate the connection to the LDAP server.

1. From the Configuration tab, click User Identity Stores.
2. Select LDAP_DIR as Default Store.
3. Select LDAP_DIR as System Store.
4. Click the Add [+] icon in Access System Administrators.
5. Enter OAM* in the search name field and click Search.
6. Select OAMAdministrators from the search results and click Add Selected.
7. Click Apply.
8. In the Validate System Administrator window, enter the username and password of the OAM administrator, for example, oamadmin.
9. Click Validate.
10. Test the connection by clicking Test Connection.

1. Under Application Security tab, select Authentication Modules and click Search.
2. Click LDAP.
3. Select Open from the Actions menu.
4. Set User Identity Store to LDAP_DIR.
5. Click Apply.
6. Restart the Managed Servers Admin Server, WLS_OAM1 and WLS_OAM2.

1. Log in to the Administration Console at http://hostname.example.com:7001/console. From the Domain Structure window, expand the Environment node and then Servers.
2. In the Change Center, click Lock & Edit.
3. Select a server on the host you want to extend, for example: WLS_OAM1.
4. Click Clone.
5. Enter the following information:

   • Server Name: A new name for the server, for example: WLS_OAM3.

   • Server Listen Address: The name of the host on which the managed server will run.

   • Server Listen Port: The port the new managed server will use, this port must be unique within the host.

6. Click OK.
7. Click on the newly created server WLS_OAM3
8. Set the SSL listen port. This should be unique on the host that the managed server will run on.

   Note:

   Enable the SSL listen port 14101.

9. Click Save.
10. Disable hostname verification for the new managed server. You must do this before you start and verify the WLS_OAM3 Managed Server. You can re-enable it after you configure server certificates for the communication between the Administration Server and Node Manager in OAMHOSTn.

    If the source server from which the new one was cloned had already disabled hostname verification, you do not need to take this step because the hostname verification settings propagated to the cloned server.

    To disable hostname verification, set Hostname Verification to None then click Save.

11. Click Activate configuration from the Change Center menu.

1. Log in to the Oracle Access Management Console as the oamadmin user at http://oamhost1.example.com:7001/oamconsole
2. Click the Configuration tab. Click Server Instances.
3. Select Create from the Actions menu.
4. Enter the following information:

   • Server Name: WLS_OAM3

   • Host: Host that the server will run on

   • Port: Listen port that was assigned when the managed server was created, for example, 14100

   • Proxy Server ID: AccessServerConfigProxy

   • Port: Port you want the OAM proxy to run on. This is unique for the host, for example, 5575

   • Mode: Open

5. Click Apply when a prompt requests that you confirm the edit.
6. Ensure that the OAM_ORACLE_HOME property <ORACLE_HOME>/oam is set while starting server nodes (OAM1, OAM2 etc). In this environment, startWeblogic script is edited to pass -DOAM_ORACLE_HOME=<ORACLE_HOME>/oam while starting the Java process.

1. Verify that Node Manager is running on the new Access Server WLS_OAM3.
2. Start the Managed Server using the Administration Console. See the Start the Managed Server
3. Inform WebGates about the new Managed Server. See Inform WebGates of the New Managed Server

• Start the Managed Server
  
• Inform WebGates of the New Managed Server
  

1. Log in to the Oracle Access Management Console at http://OAMHOST1.example.com:7001/oamconsole as the oamadmin user.
2. Click the Configuration tab. Click Server Instances.
3. Select Create from the Actions menu.
4. Enter the following information:

   • Server Name: Enter the same server name you entered while cloning the OAM server node in the WebLogic Console.

   • Host: Host that the server will run on, OAMHOST3.

   • Port: Listen port that was assigned when you created the managed server.

   • OAM Proxy Port: Port you want the OAM proxy to run on. This is unique for the host.

   • Proxy Server ID: AccessServerConfigProxy

   • Mode: Select the appropriate mode: Open or Cert.

5. Click Apply.
6. Edit oam-config.xml as described in Modifying OAM Configuration Properties ] to set the IP range of nodes that get added dynamically.

   The Settings Map for the following example is SetWellKnownAddress>AuthorizedSubnets >Range1 >From [value of start ip range]]>To [value of end ip range].

   <Setting Name="AuthorizedSubnets" Type="htf:map">
   <Setting Name="Range1" Type="htf:map">
   <Setting Name="From" Type="htf:map">
   <Setting Name="Key"
   Type="xsd:string">oam.coherence.auth.range.from.1</Setting>
   <Setting Name="Value"
   Type="xsd:string">10.229.139.20</Setting>
   </Setting>
   <Setting Name="To" Type="htf:map">
   <Setting Name="Key"
   Type="xsd:string">oam.coherence.auth.range.to.1</Setting>
   <Setting Name="Value"
   Type="xsd:string">10.229.139.40</Setting>
   </Setting>
   </Setting>
   </Setting>

7. Ensure that the OAM_ORACLE_HOME property <ORACLE_HOME>/oam is set while starting server nodes (OAM1, OAM2 etc). In this environment, startWeblogic script is edited to pass -DOAM_ORACLE_HOME=<ORACLE_HOME>/oam while starting the Java process.

1. Log into the Web server where the WebGate was updated previously.
2. Go to the directory OHSDomain/config/fmwconfig/components/OHS/<instancename>/webgate/config
3. Open ObAccessClient.xml with a text editor. Verify that primary_server_list or secondary_server_list shows that the new OAM Access Server is updated.

<Location /oam>
   SetHandler weblogic-handler
   WebLogicCluster OAMHOST1.example.com:14100,OAMHOST2.example.com:14100
</Location>

<Location /oam>
   SetHandler weblogic-handler
   WebLogicCluster OAMHOST1.example.com:14100,OAMHOST2.example.com:14100,OAMHOST1.example.com:14101
</Location>