5 Installing and Configuring IHS WebGate for OAM
This chapter contains the following sections:
Installation Overview of IHS WebGate
Installing IHS WebGate for Oracle Access Manager involves the following steps:
Prerequisites for Installing IHS WebGate
This section discusses the following topics:
Oracle Fusion Middleware Certification
The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management.
You can access the Oracle Fusion Middleware Supported System Configurations document at:
http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html
Installing and Configuring IHS
For information about installing and configuring IHS, see the IBM HTTP Server product documentation.
Installing and Configuring OAM 14c (14.1.2.0.0)
For information about installing Oracle Access Manager (OAM), see Installing and Configuring Oracle Identity and Access Management Software in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.
For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see Configuring Oracle Access Management in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.
For information about configuring Oracle Access Manager in Open or Cert mode, see Securing Communication in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager .
Installing IHS WebGate
This section contains the following topics:
Obtaining the Software
For information about obtaining the IHS software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.
Starting the IHS WebGate Installer
To start the installation wizard, do the following:
After the Installer starts, the Welcome screen appears. Continue by referring to the section Installation Flow and Procedure of IHS WebGate for installing IHS WebGate for Oracle Access Manager.
Installation Flow and Procedure of IHS WebGate
To install IHS WebGate for Oracle Access Manager, follow the instructions in Table 5-1.
If you need additional help with any of the installation screens, then click Help to access the online help.
Table 5-1 Installation Flow of IHS WebGate
No. | Screen | Description and Action Required |
---|---|---|
1. |
Welcome Screen |
Click Next to continue. |
2. |
Prerequisite Checks Screen |
Click Next to continue. |
3. |
Specify Installation Location Screen |
Specify the Middleware home and Oracle home locations. For more information about these directories, see Understanding Your Installation Starting Point in Planning an Installation of Oracle Fusion Middleware. Click Next to continue. |
4. |
Installation Summary Screen |
Verify the information on this screen. Click Install to begin the installation. |
5. |
Installation Progress Screen |
Click Next to continue. |
6. |
Installation Complete Screen |
Click Finish to dismiss the Installer. |
Post-Installation Steps for IHS WebGate
This section includes the following topics:
Deploying the IHS WebGate Instance
Create an IHS WebGate instance by using the deployWebGateInstance.sh
tool from the WebGate Oracle home directory. The WebGate instance directory that you are creating or have provided must be empty.
To deploy the WebGate instance, do the following:
Setting the Environment Variables
Set the environment variable LD_LIBRARY_PATH
on Linux, and LIBPATH
on AIX, to WebGate_Oracle_Home
/webgate/ihs/lib
.
Example:
On Linux
export LD_LIBRARY_PATH=/home/Oracle_OAMWebGate1/webgate/ihs/lib
On AIX
export LIBPATH=/home/Oracle_OAMWebGate1/webgate/ihs/lib
export LDR_PRELOAD64=libclntsh.so
Verifying the Installation and Configuration of IHS WebGate
After installing HIS WebGate for Oracle Access Manager, you can examine the
installDATE-TIME_STAMP.out
log file to
verify the installation. The default location of the log is in the
following file:
WebGate_Home
/oraInst.loc
Getting Started with a New IHS WebGate
Before you can use the new IHS WebGate agent for Oracle Access Manager, you must complete the following tasks:
Registering the New IHS WebGate
Oracle Access Manager WebGate component utilizes a high availability environment to eliminate a single point of failure and to distribute the workload using a load balancer (LBR). OAM needs to be registered only once, the same resulting artifacts are used by all the OAM WebGates that are behind the LBR.
You can register the new WebGate agent with Oracle Access Manager using any one of the following options:
Oracle Access Manager Administration console
For complete information about registering WebGate agent using Oracle Access Manager console, see Registering an OAM Agent Using the Console in Administrator's Guide for Oracle Access Management.
RREG tool
For complete information about registering WebGate agent using RREG tool, see:
Locating and Preparing the RREG Tool
To set up the RREG tool, complete the following steps:
-
Log in to one of the Oracle Access Manager hosts in the Application tier.
-
Change directory to the following directory in the Oracle Access Manager Oracle home:
Note:
The location is required only for the out-of-band mode.OAM_ORACLE_HOME/oam/server/rreg/client
In this example, OAM_ORACLE_HOME refers to the Oracle home on the system where the Oracle Access Manager software was installed.
Note:
If the Oracle Enterprise Deployment Guide for IDM was used, OAM_ORACLE_HOME may be/u01/oracle/products/access/iam
.Note:
If you do not have privileges or access to the Oracle Access Manager server, then you can use out-of-band mode to generate the required files and register the WebGate with Oracle Access Manager. See About RREG In-Band and Out-of-Band Mode. -
Unzip the
RREG.tar.gz
file to the required directory. -
From the unzipped directory, open the
oamreg.sh
file and set the following environment variables in the file, as follows:-
Set
OAM_REG_HOME
to the absolute path to the directory in which you extracted the contents of RREG archive.Set
JAVA_HOME
to the absolute path of the directory in which a supported JDK is installed on your machine.
-
Running the RREG Tool
The following topics provide information about running the RREG tool to register your IHS Webgate with Oracle Access Manager.
About RREG In-Band and Out-of-Band Mode
You can run the RREG Tool in one of two modes: in-band and out-of-band.
Use in-band mode when you have the privileges to access the Oracle Access Manager server and run the RREG tool yourself from the Oracle Access Manager Oracle home. You can then copy the generated artifacts and files to the Web server configuration directory after you run the RREG Tool.
Use out-of-band mode if you do not have privileges or access to the Oracle Access Manager server. For example, in some organizations, only the Oracle Access Manager server administrators have privileges access the server directories and perform administration tasks on the server. In out-of-band mode, the process can work as follows:
-
The Oracle Access Manager server administrator provides you with a copy of the RREG archive file (RREG.tar.gz).
The server administrator can find it in the location described in Updating the Standard Properties in the OAMRequest.xml File.
-
Untar the
RREG.tar.gz
file that was provided to you by the server administrator.For example:
gunzip RREG.tar.gz
tar -xvf RREG.tar
After you unpack the RREG archive, you can find the tool for registering the agent in the following location:
RREG_HOME
/bin/oamreg.sh
In this example,
RREG_Home
is the directory in which you extracted the contents of RREG archive. -
Use the instructions in Updating the Standard Properties in the OAMRequest.xml File to update the
OAM14cRequest.xml
file, and send the completedOAM14cRequest.xml
file to the Oracle Access Manager server administrator. -
The Oracle Access Manager server administrator then uses the instructions in Running the RREG Tool in Out-Of-Band Mode to run the RREG Tool and generate the
AgentID_response.xml
file. -
The Oracle Access Manager server administrator sends the
AgentID_response.xml
file to you. -
Use the instructions in Running the RREG Tool in Out-Of-Band Mode to run the RREG Tool with the
AgentID_response.xml
file and generate the required artifacts and files on the client system.
Running the RREG Tool in Out-Of-Band Mode
To run the RREG Tool in out-of-band mode on the WEBHOST server, the administrator uses the following command:
RREG_HOME/bin/oamreg.sh outofband input/OAM12cRequest.xml
In this example:
-
Replace RREG_HOME with the location where the RREG archive file was unpacked on the server.
-
The edited
OAM14cRequest.xml
file is located in theRREG_HOME/input
directory. -
The RREG Tool saves the output from this command (the
AgentID_response.xml
file) to the following directory:RREG_HOME/output/
The Oracle Access Manager server administrator can then send the
AgentID_response.xml
to the user who provided theOAM14cRequest.xml
file.
To run the RREG Tool in out-of-band mode on the Web server client machine, use the following command:
RREG_HOME/bin/oamreg.sh outofband input/AgentID_response.xml
In this example:
-
Replace RREG_HOME with the location where you unpacked the RREG archive file on the client system.
-
The
AgentID_response.xml
file, which was provided by the Oracle Access Manager server administrator, is located in the RREG_HOME/input directory. -
The RREG Tool saves the output from this command (the artifacts and files required to register the Webgate software) to the following directory on the client machine:
RREG_HOME/output/
Running the RREG Tool in In-Band Mode
To run the RREG Tool in in-band mode:
-
Navigate to the RREG home directory.
If you are using in-band mode, the RREG directory is inside the Oracle Access Manager Oracle home:
OAM_ORACLE_HOME/oam/server/rreg
If you are using out-of-band mode, then the RREG home directory is the location where you unpacked the RREG archive.
-
In the RREG home directory, navigate to the bin directory:
cd RREG_HOME/bin/
-
Set the permissions of the
oamreg.sh
command so you can execute the file:chmod +x oamreg.sh
-
Run the following command:
./oamreg.sh inband RREG_HOME/input/OAM14cRequest_edg.xml
In this example:
-
It is assumed the edited
OAM14cRequest.xml
file is located in theRREG_HOME/input
directory. -
The output from this command will be saved to the following directory:
RREG_HOME/output/
The following example shows a sample RREG session:
Welcome to OAM Remote Registration Tool!
Parameters passed to the registration tool are:
Mode: inband
Filename: /u01/oracle/products/fmw/iam_home/oam/server/rreg/client/rreg/input/OAM14cRequest_edg.xml
Enter admin username:
Username:
Enter admin password:
Do you want to enter a Webgate password?(y/n):
n
Do you want to import an URIs file?(y/n):
n
----------------------------------------
Request summary:
OAM14c Agent Name:SOA14120_EDG_AGENT
Base URL:
URL String:null
Registering in Mode:inband
Your registration request is being sent to the Admin server at:
----------------------------------------
Jul 08, 2024 7:18:13 PM oracle.security.jps.util.JpsUtil disableAudit
INFO: JpsUtil: isAuditDisabled set to true
Jul 08, 2024 7:18:14 PM oracle.security.jps.util.JpsUtil disableAudit
INFO: JpsUtil: isAuditDisabled set to true
Inband registration process completed successfully! Output artifacts are created in the output folder.
Updating the Standard Properties in the OAMRequest.xml File
Before you can register the Webgate agent with Oracle Access Manager, you must
update some required properties in the OAMRequest.xml
file.
Note:
If you plan to use the default values for most of the parameters in the provided XML
file, then you can use the shorter version (OAMRequest_short.xml
,
in which all non-listed fields will take a default value.
Note:
In the primary server list, the default names are mentioned as OAM_SERVER1 and OAM_SERVER2 for OAM servers. Rename these names in the list if the server names are changed in your environment.To perform this task:
-
If you are using in-band mode, then change directory to the following location on one of the OAM Servers:
OAM_ORACLE_HOME/oam/server/rreg/input
If you are using out-of-band mode, then change directory to the location where you unpacked the RREG archive on the WEBHOST1 server.
-
Make a copy of the
OAM14cRequest.xml
file template with an environment-specific name.cp OAM14cRequest.xml OAM14cRequest_edg.xml
-
Review the properties listed in the file, and then update your copy of the
OAM14cRequest.xml
file to make sure the properties reference the host names and other values specific to your environment.
OAM14cRequest.xml Property | Set to... |
---|---|
serverAddress |
The host and the port of the Administration Server for the Oracle Access Manager domain. |
agentName |
Any custom name for the agent. Typically, you use a name that identifies the Fusion Middleware product you are configuring for single sign-on. |
applicationDomain |
A value that identifies the Web tier host and the FMW component you are configuring for single sign-on. |
security |
Must be set to the security mode configured on the Oracle Access Management server. This will either be open or certificate. Note: In most cases, avoid using open mode, because in open mode, traffic to and from the Oracle Access Manager server is not encrypted. For more information using certificate mode or about Oracle Access Manager supported security modes in general, see Securing Communication Between OAM Servers and WebGates in the Administrator's Guide for Oracle Access Management. |
cachePragmaHeader |
private |
cacheControlHeader |
private |
ipValidation |
0 <ipValidation>0</ipValidation>
|
ipValidationExceptions |
The IP address of the front-end load balancer. For example: <ipValidationExceptions>
<ipAddress>130.35.165.42</ipAddress>
</ipValidationExceptions> |
agentBaseUrl |
Fully-qualified URL with the host and the port of the front-end Load Balancer VIP in front of the WEBHOSTn machines on which Oracle HTTP WebGates are installed. For example: |
virtualHost |
Set to true when protecting more than the |
hostPortVariationsList
|
Add For
example:
|
Copying Generated Files and Artifacts to the HIS WebGate Instance Location
After RREG generates these files and artifacts, you must manually copy them, based on the security mode you are using, from the RREG_Home
/output/
Agent_ID
directory to the WebGate_Instance_Home
directory.
Do the following according to the security mode you are using:
-
In OPEN mode, copy the following files from the
RREG_Home
/output/
Agent_ID
directory to theWebGate_Instance_Home
/webgate/config
directory:-
ObAccessClient.xml
-
cwallet.sso
-
-
In CERT mode, copy the following files from the
RREG_Home
/output/
Agent_ID
directory to theWebGate_Instance_Home
/webgate/config
directory:-
ObAccessClient.xml
-
cwallet.sso
-
password.xml
-
Restarting the IHS Instance
Use the startserv
command to start or
stopserv
command to stop your Apache instance.
To stop the server, run the following command:
/
home
/bin/stopserv
To start the server, run the following command:
On Linux
export
LD_LIBRARY_PATH=/
WebGate_Home
/lib
/
home
/bin/startserv
On AIX
export
LIBPATH=/
home
/Oracle_OAMWebGate1/webgate/ihs/lib
export LDR_PRELOAD64=libclntsh.so
/
home
/bin/startserv
To restart the IHS instance, stop all running instances, and then run the start command.
Starting the IHS Web Server and Accessing the IHS Resource
To start the IHS web server:
-
On Linux
Run the following command:
/IBM/HTTPServer/bin/apachectl -k start
-
On AIX
-
Go to the
httpd.conf
file at/IHS/HTTPServer/conf/httpd.conf
, open it in a text editor, and add the following:ThreadStackSize 2097152
-
Run the following command:
/IBM/HTTPServer/bin/apachectl -k start
-
WebGate intercepts the request and redirects you to the Oracle Access Manager console. Enter the username and password, and you are redirected to the IBM HTTP Server.
Deinstalling IHS WebGate
You should always use the instructions provided in this section for removing the IHS WebGate. If you try to remove the software manually, thne you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this chapter will ensure that the software is properly removed.
To deinstall the IHS WebGate, do the following:
After the Installer starts, the Welcome screen is displayed, proceed with deinstallation.
Deinstallation Screens and Instructions
Follow the instructions in Table 5-2 to complete the deinstallation.
If you need additional help with any of the deinstallation screens, then click Help to access the online help.
Table 5-2 Deinstallation Flow
Sl. No. | Screen | Description | Action Required |
---|---|---|---|
1. |
Welcome |
Each time the deinstaller starts, the Welcome screen is displayed. |
Click Next. |
2. |
Deinstall Oracle Home |
The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall. |
Verify the Oracle home you are about to deinstall. Click Deinstall. On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory in addition to removing the software. Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen. If you select No, go to Manually Removing the Oracle Home Directory for instructions on how to manually remove your Oracle home directory. |
3. |
Deinstallation progress |
The Deinstallation Progress screen shows the progress and status of the deinstallation. |
Wait until the Deinstallation Complete screen appears. |
4. |
Deinstallation Complete |
The Deinstallation Complete screen appears when the deinstallation is complete. |
Click Finish to dismiss the screen. |
Manually Removing the Oracle Home Directory
If you have selected No on the warning screen during deinstallation, then you must manually remove your WebGate_Home
directory and any sub-directories. For example: if your Oracle WebGate home directory was /home/Oracle/Middleware/Oracle_OAMWebGate1
, run the following command:
cd /home/Oracle/Middleware/
rm -rf Oracle_OAMWebGate1
On Windows, if your Oracle Common home directory was C:\Oracle\Middleware\Oracle_OAMWebGate1
, then use a file manager window, go to the C:\Oracle\Middleware
directory, right-click on the Oracle_OAMWebGate1
folder, and then select Delete.