An object is a representation of a design-time or run-time artifact handled through Oracle Data Integrator. Examples of objects include agents, projects, models, data stores, scenarios, mappings, and even repositories. Specific objects have a double name, such as Agent/Context and Profile/Method. These objects represent links between objects. These links are also objects. For instance, Agent/Context corresponds to a physical/logical agent association made through the contexts. Privileges on this object enable the ability to change this association in the topology.

An instance is a particular occurrence of an object. For example, the Datawarehouse project is an instance of the Project object.

A method is an action that can be performed on an object, such as edit, delete, and so on. Each object has a predefined set of methods.

A profile contains a set of privileges for working with Oracle Data Integrator. You can assign one or more profiles to a user, or to a role, to grant the sum of the privileges in those profiles to that user or role.

A profile method is an authorization granted to a profile on a method of an object type. Each granted method allows a user with this profile to perform an action on all instances of an object type.

In Oracle Data Integrator Studio, methods granted to a profile appear under this profile in the Profiles navigation tree of the Security Navigator. When a method does not appear for a given profile, this profile does not have access to this method.

A method can be granted as a generic or nongeneric privilege:

• A method granted as a generic privilege is granted by default on all the instances of this object.

• A method granted as a nongeneric privilege is not granted by default on all object instances, but may be granted on a per instance basis.

A user is an Oracle Data Integrator user. A user inherits the following privileges:

• All the privileges granted to its various profiles

• Privileges on objects or instances, or both, given to this user

A user method is a privilege granted to a user on a method of an object type. Each granted method allows the user to perform an action (edit, delete, and so forth) on instances of an object type (project, model, data store, and so forth). These methods are similar to profiles methods, but applied to users.

You can grant users with privileges on instances on specific work repositories where these instances exist. For example, you may grant a developer user with the edit privilege on the LOAD_DATAWAREHOUSE scenario on the a DEVELOPMENT repository and not on a PRODUCTION repository.

You grant an authorization by object instance to a user on an object instance. It allows you to grant to this user certain methods of this object instance.

An authorization by object instance for a given instance that appears in a user's tree indicates that the user is granted specific privileges on the object methods for the given instance. You specify these privileges in the object instance editor. If an instance is not visible in the tree of the user instances, then the User Method or Profile Method privileges for the object type apply.

Because an instance may be replicated over the different work repositories that are attached to the master repository, you can define authorizations by object instances for one, several, or all your work repositories that are attached to this master repository. For example, you can replicate a LOAD_DATAWAREHOUSE scenario instance (using, for example, versioning) in the DEVELOPMENT, TEST, and PRODUCTION repositories. Privileges on the instance can change depending on the repository. For example, it is common to replicate projects from a development repository to a test repository. You can grant edit privileges to a developer for that developer's project in the development repository, but not in the test repository. In the test repository, the developer is granted with only view privileges on the project.

If Oracle Data Integrator is configured to use external authentication (see Configuring External Authentication), you can leverage the enterprise role integration feature in Oracle Data Integrator. Enterprise role integration in Oracle Data Integrator is based on the authorization model in Oracle Platform Security Services (OPSS). This feature allows you to map enterprise roles to Oracle Data Integrator roles, enabling enterprise users of a particular enterprise role to access Oracle Data Integrator through the permissions granted to the Oracle Data Integrator roles in the mapping.

Enterprise role integration in Oracle Data Integrator enables you to:

• Create a set of Oracle Data Integrator roles.

• Grant Oracle Data Integrator privileges (instance level and type level) and profiles to Oracle Data Integrator roles.

• Map enterprise principals — that is, users or roles — defined in an external identity store to Oracle Data Integrator roles.

• Determine the privileges granted to a user who is authenticated into Oracle Data Integrator by evaluating all the Oracle Data Integrator roles to which the user is mapped directly or indirectly through enterprise roles. (Privileges are automatically calculated during authorization.).

For an introduction to enterprise roles, see the Understanding Users and Roles chapter in Securing Applications with Oracle Platform Security Services. For details about how enterprise role integration works in Oracle Data Integrator and how you can manage roles in Oracle Data Integrator Studio, see Mapping Principals Defined in an Identity Store to Oracle Data Integrator Roles.

Two main approaches are available for defining the security in Oracle Data Integrator:

• The strongly secured approach, where users have no default authorizations on objects. This approach uses only nongeneric profiles. The security administrator must grant users authorizations on object instances. This policy is complex to configure because it requires managing privileges by instance.

• The generic approach, where users inherit the privileges of the profiles they have. This policy is suitable in most cases and is simple to configure.

To implement a strongly secured approach:

1. Create the users.

2. Give the users nongeneric profiles (built-in or customized).

3. Grant the users privileges on object instances after those instances are created. This operation must be repeated for every new instance.

To implement a generic approach:

1. Create the users.

2. Give the users the generic profiles (built-in or customized).

You can create, delete, or duplicate profiles. Creating and duplicating profiles enables you to customize the profiles assigned to users. The following topics provide the steps for performing these procedures in Oracle Data Integrator Studio.

The way in which you manage users depends, in part, on where the user is defined. By default, a user corresponds to the login name used to connect to a repository and is persisted in the internal repository of Oracle Data Integrator. However, if external authentication is enabled for Oracle Data Integrator components:

• Users authenticated into Oracle Data Integrator are created and managed in an external identity store, such as Oracle Internet Directory. You use the tools and utilities provided with that store to create, update, and delete users.

• To let external users access Oracle Data Integrator, you can do any of the following:

  • Map the external user to an Oracle Data Integrator role.

  • Map any of the enterprise roles to which this external user belongs to an Oracle Data Integrator role.

  • Register the external user in Oracle Data Integrator using the Security Navigator as in prior releases.

• You can assign profiles or other security privileges directly to external users who are registered in Oracle Data Integrator. Or you can assign profiles or other security privileges to an Oracle Data Integrator role, and then map external users (or any of the external users' enterprise roles) to that Oracle Data Integrator role. By doing the latter, an external user can inherit all the profiles or privileges granted to the Oracle Data Integrator role.

  You can also map an enterprise user (or the user's enterprise roles) to multiple Oracle Data Integrator roles. When a user is authenticated, Oracle Data Integrator calculates the user's privileges as a union of all the privileges granted to all the Oracle Data Integrator roles in the mapping.

For more information about external authentication, see Configuring External Authentication. For more information about enterprise role integration, see Mapping Principals Defined in an Identity Store to Oracle Data Integrator Roles.

After creating users and profiles, you can grant privileges to these users and profiles. You can grant profile methods and user methods that apply to object types, and you can also grant authorizations by object instances (for users only) that apply to specific object instances.

1. Create the root directory on your machine for storing the wallet, if it does not already exist.

   Windows:

   On Windows machines, you must create the root directory path odi\oracledi in the location represented by the environment variable %APPDATA%. For example:

   c:\> mkdir %APPDATA%\odi\oracledi
   

   UNIX:

   On UNIX machines, you must create the root directory path .odi/oracledi in the location represented by the environment variable $HOME. For example:

   prompt> mkdir -p $HOME/.odi/oracledi/
   

2. Change to the ORACLE_HOME/odi/studio directory.
3. Launch Oracle Data Integrator Studio by running the following command:

   Windows:

   odi.exe
   

   UNIX:

   ./odi.sh
   

   The Studio main window is displayed.

4. Click Connect to Repository...

   The New Wallet Password dialog box is displayed, shown in Figure 11-1.

   Figure 11-1 New Wallet Password Dialog Box

   
   Description of "Figure 11-1 New Wallet Password Dialog Box"
5. Choose the default option, Store passwords in a secure wallet, then enter the password in the Wallet Password and Confirm Wallet Password fields.

   Optionally, you can change the password expiration.

6. Click OK.

   You are then prompted to enter login credentials for the master repository. For more information about the required credentials, see Creating the Master Repository.

To give Oracle Data Integrator users access to the repository, you can distribute the password-protected wallet to them in either of the following ways:

• Provide each user with a copy of the ewallet.p12 file you created, along with the password you specified.

• Create an individual password-protected wallet for each Oracle Data Integrator user. This allows you to set a different password for each wallet.

When creating a wallet for other users, be sure to do the following:

1. Prior to creating a new wallet, move the existing ewallet.p12 file to a different directory.

2. When creating a wallet for other users, set the expiration to 0 days. This way, when users connect to the repository for the first time, they are prompted to set a new password for their wallets (see Changing the Wallet Password).

All password-protected wallet files for Oracle Data Integrator Studio must be named ewallet.p12 and must be placed in the ~oracledi/ewallet directory on each machine from which it is used, as explained in Creating the Password-Protected Wallet.

1. Launch Oracle Data Integrator Studio.
2. From the ODI menu, choose Change Wallet Password....

   The Change Wallet Password dialog box is displayed, shown in Figure 11-2.

   Figure 11-2 Change Wallet Password Dialog Box

   
   Description of "Figure 11-2 Change Wallet Password Dialog Box"
3. Enter the current password and the new password, then confirm your new password.

   Optionally, you can also change the expiration.

4. Click OK.

1. Launch Oracle Data Integrator Studio.
2. From the Tools menu, choose Preferences...

   The Preferences dialog box is displayed.

3. In the Preferences dialog box, expand the ODI node, then select User Interface.

   The Preferences dialog box, shown in Figure 11-3, displays the following options for saving login credentials:

   • Save Login Credentials — Select this option to save credentials.

   • Save Login Credentials into Wallet — Select this option to store the Oracle Data Integrator login credentials in a password-protected wallet.

     If Save Login Credentials is selected, but Save Login Credentials into Wallet is deselected, login credentials are saved in a login XML file.

   By default, both options are selected, which is the setting recommended by Oracle.

4. If you change any preferences, click OK.

There are four ways to set or modify the password storage:

• Importing the master repository (see the Importing the Master Repository section in Developing Integration Projects with Oracle Data Integrator) allows you to change the password storage.

• Creating the master repository (see Creating the Master Repository) allows you to define the password storage.

• Switching the Password Storage modifies the password storage for an existing master repository.

• Recovering the Password Storage allows you to recover from a credential store crash.

Switching the password storage of the Oracle Data Integrator repository changes how data servers and contexts passwords are stored. This operation must be performed by a SUPERVISOR user.

Use the Switch Password Storage wizard to change the password storage options of the data server passwords.

Before launching the Switch Password Storage wizard perform the following tasks:

• Disconnect Oracle Data Integrator Studio from the repository.

• Shut down every component using the Oracle Data Integrator repository.

To launch the Switch Password Storage wizard:

1. From the ODI main menu, select Password Storage > Switch...

2. Specify the login details of your Oracle Data Integrator master repository as defined when connecting to the master repository (see: Connecting to the Master Repository).

3. Click Next.

4. Select the password storage:

   • Select Internal Password Storage if you want to store passwords in the Oracle Data Integrator repository.

   • Select External Password Storage if you want use OPSS Credential Store Framework (CSF) to store the data server and context passwords.

     If you select external password storage, you must provide the MBean Server Parameters to access the credential store described in Table 11-2, and then click Test Connection check the connection to the MBean Server.

     Table 11-2 MBean Server Parameters

     Server	Host	JMX Port	User	Password
     From the list, select the application server.	MBeans server host. For example, machine.example.com	MBeans Server Port. For example, 7001	MBeans Server user name. For example, weblogic	MBean server password

5. Click Finish.

The password storage options have been changed. You can now reconnect to the Oracle Data Integrator repository.

1. From the ODI main menu, select Password Storage > Recover...
2. Specify the login details of your Oracle Data Integrator master repository defined when connecting to the master repository (see: Connecting to the Master Repository).
3. Click Finish.
4. Re-enter manually data server and context passwords. Refer to Setting Up a Topologyfor more information.

There are two ways to set the authentication mode:

• When you create the master repository. The Master Repository Creation Wizard contains options for setting the authentication mode. For information about how to set external authentication when creating the master repository, see Set External Authentication when Creating the Master Repository. For general information, see also Creating the Master Repository.

• When you switch the authentication mode from Studio. The Switch Authentication Mode Wizard allows you to change the authentication mode used by an existing master repository. For detailed steps to switch to external authentication mode in Studio, using this wizard, see Switching an Existing Master Repository to External Authentication Mode.

To configure Oracle Data Integrator Studio with external authentication, you must do the following:

1. Set Up the OPSS Configuration File

2. Create a Wallet File for an LDAP Bootstrap User

3. Set External Authentication when Creating the Master Repository

<!-- OID LDAP Identity Store Service Instance -->
  <serviceInstance name="idstore.oid" provider="idstore.ldap.provider">
  <property name="subscriber.name" value="dc=us,dc=oracle,dc=com" />
  <property name="idstore.type" value="OID" />
   <property name="bootstrap.security.principal.map" value="BOOTSTRAP_JPS"/>
   <property name="bootstrap.security.principal.key" value="bootstrap_idstore"/>
  <property name="username.attr" value="uid"/>
  <property name="groupname.attr" value="cn"/>
  <property name="ldap.url" value="ldap://hostname:port" />
  <extendedProperty>
   <name>user.search.bases</name>
   <values>
    <value>cn=users,dc=us,dc=oracle,dc=com</value>
   </values>
  </extendedProperty>
  <extendedProperty>
   <name>group.search.bases</name>
   <values>
    <value>cn=groups,dc=us,dc=oracle,dc=com</value>
   </values>
  </extendedProperty>
 </serviceInstance>
  .
  .
  .
 <serviceInstanceRef ref="idstore.oid"/>

The credentials have been successfully added to the boostrap credential store.

1. Change to the ORACLE_HOME/odi/studio directory.
2. Launch Oracle Data Integrator Studio by running the following command:

   Windows:

   odi.exe
   

   UNIX:

   ./odi.sh
   

3. In Oracle Data Integrator Studio, select ODI > Switch Authentication Mode....

   The Login screen of the Switch Authentication Mode wizard is displayed, as shown in Figure 11-4.

   Figure 11-4 Login Screen of Switch Authentication Mode Dialog Box

   
   Description of "Figure 11-4 Login Screen of Switch Authentication Mode Dialog Box"
4. Enter the login name of the master repository, the JDBC connection parameters, and the user name and password for the master repository database user, then click Next.

   The Credentials screen of the Switch Authentication Mode wizard is displayed, as shown in Figure 11-5.

   Figure 11-5 Credentials Screen of Switch Authentication Mode Wizard

   
   Description of "Figure 11-5 Credentials Screen of Switch Authentication Mode Wizard"
5. Click the Add button, which is shown as the green plus symbol adjacent to the search field, to display the Enterprise Roles and Users Retrieval dialog box, shown in Figure 11-6.

   Figure 11-6 Enterprise Roles and Users Retrieval Dialog Box

   
   Description of "Figure 11-6 Enterprise Roles and Users Retrieval Dialog Box"

   You can use the Enterprise Roles and Users Retrieval dialog box to either:

   • Enter a filter expression to display the roles and users in the identity store that match the filter.

   • Search the identity store for a specific role or user name.

   You can expand the Enterprise Roles and Enterprise Users nodes to browse the available enterprise roles and users in the identity store.

6. Select the user or role you wish to assign to the SUPERVISOR_ROLE role, then click Finish.

1. In the Security Navigator, expand the Users navigation tree.
2. From the list of users displayed, select the user that you want to re-enable.
3. Right-click and select Open. The User editor appears, shown in Figure 11-8.

   Figure 11-8 Open USER Administrator Dialog Box

   
   Description of "Figure 11-8 Open USER Administrator Dialog Box"

   The Name field displays the user you selected in Step 2.

4. Click Retrieve GUID. If the user name has a match in the identity store, this external user's GUID appear in the External GUID field.
5. From the File main menu, select Save and disconnect.
6. Reconnect as this user (for example, the user SUPERVISOR shown in Figure 11-8) using the password in the external identity store.

1. Copy the following files into the DOMAIN_HOME/config/fmwconfig directory, if they do not already exist there, where DOMAIN_HOME represents the root directory of your Oracle Data Integrator domain.

   • ORACLE_HOME/oracle_common/modules/oracle.jps_12.1.2/domain_config/jse/jps-config.xml

   • ORACLE_HOME/oracle_common/modules/oracle.jps_12.1.2/domain_config/jse/system-jazn-data.xml

   Note:

   For information about creating an Oracle Data Integrator domain, see Installing and Configuring Oracle Data Integrator.

2. Change to the DOMAIN_HOME/config/fmwconfig directory.
3. Rename jps-config.xml to jps-config-jse.xml.
4. Open jps-config-jse.xml in an editor.
5. Add a service instance for the identity store provider and include the following properties:

   • The service instance name. For example, for Oracle Internet Directory, name="idstore.oid".

   • The idstore.type property.

   • The bootstrap.security.principal.map property.

   • The bootstrap.security.principal.key property.

   For an example service instance configuration, see Example 11-1.

   For details about specifying these properties for your identity store, see the LDAP Identity Store Properties section in Securing Applications with Oracle Platform Security Services.

6. In the default jps context, change the serviceInstanceRef name="idstore.xml" value to "idstore.<your-idstore-type>", as in the following example that sets the identity store type for Oracle Internet Directory:

    <serviceInstanceRef ref="idstore.oid"/>
   

7. Comment out the keystore and audit service instance references in the default jps context element. For example:

   <jpsContext name="default"> 
    <serviceInstanceRef ref="credstore"/>
   <!--  <serviceInstanceRef ref="keystore"/>  --> 
   <serviceInstanceRef ref="policystore.xml"/> 
   <!--  <serviceInstanceRef ref="audit"/>  -->
   

8. Save your changes to jps-config-jse.xml and exit from your editor.
9. Change to the DOMAIN_HOME/bin directory.
10. Run the odi_credtool script.

    You are prompted to enter the following parameters:

    For the following parameter . . .	. . . enter the following value
    User name	This is the Distinguished Name (DN) of the bootstrap user account used to connect to the identity store with Administrator privileges. For example, for Microsoft Active Directory, specify this user as follows: CN=Administrator,CN=Users,DC=ad,DC=vm,DC=company,DC=com
    Password	The password for the bootstrap user account that is used to connect to the identity store.

    After you enter the correct credentials for the bootstrap user account, the following message is displayed:

    The credentials have been successfully added to the boostrap credential store.

Oracle Data Integrator's enterprise role integration feature leverages the authorization model in Oracle Platform Security Services (OPSS) to allow you to map enterprise roles to Oracle Data Integrator roles. Enterprise users who belong to the mapped enterprise role can access Oracle Data Integrator by inheriting the privileges that are granted to the mapped Oracle Data Integrator role. Enterprise role integration simplifies both the management of users and also of privileges because you do not need to register users individually in Oracle Data Integrator to grant them access, and you do not need to manage privileges on a per user basis.

The following sections explain how enterprise role integration works and how you can use it to manage the privileges that are assigned to objects, instances, and profiles.

• How Enterprise Role Integration Works

• Defining and Managing Oracle Data Integrator Roles

1. Remove the default SSL certificate demoidentity from the keystore, using the following command:

   keytool –delete –alias demoidentity -keystore <domain>/security/DemoIdentity.jks
   Enter the keyStore password, DemoIdentityKeyStorePassPhrase

   Note:

   The keyStore, key, and trustStore passwords are DemoIdentityKeyStorePassPhrase, DemoIdentityPassPhrase, and DemoTrustKeyStorePassPhrase respectively. However, the keyStore and key passwords must be DemoIdentityKeyStorePassPhrase.

2. Substitute the alias name with demoidentity for a default certificate or agent for a user defined certificate and generate the certificate.

   Default Certificate <aliasName>: demoidentity
   User defined Certificate <aliasName>: agent

3. Generate a key for the agent using the Keytool utility. The agent uses its fully qualified hostname to fetch the key from the keystore.

   keytool -genkey -alias <aliasName> -keyalg RSA -keystore <domain>/security/DemoIdentity.jks
   Enter keystore password:  DemoIdentityKeyStorePassPhrase
   What is your first and last name?
     [Unknown]:agenthostname.us.example.com
   What is the name of your organizational unit?
     [Unknown]:  ODI
   What is the name of your organization?
     [Unknown]:  company name
   What is the name of your City or Locality?
     [Unknown]:  San Jose 
   What is the name of your State or Province?
     [Unknown]:  CA
   What is the two-letter country code for this unit?
     [Unknown]:  US
   Is CN=agent.us.example.com, OU=ODI, O=company name, L=San Jose, ST=CA, C=US correct?
     [no]:  yes
   Enter key password for <agent>
           (RETURN if same as keystore password) : <return>

   A key is created with an alias name <aliasName>.

4. Export the key using the following keytool command syntax:

   keytool -export -alias <aliasName> -keystore <domain>/security/DemoIdentity.jks
   -rfc -file public.cert
   Enter keystore password:  DemoIdentityKeyStorePassPhrase
      Certificate stored in file <public.cert>

5. Import the key into a client truststore using the following keytool command syntax:

   keytool -import -alias <aliasName> -file public.cert -storetype JKS -keystore      
      <MW_HOME>/Oracle_Home/wlserver/server/lib/DemoTrust.jks
   Enter keystore password: DemoTrustKeyStorePassPhrase
    
    
   ...
   …
   Trust this certificate? [no]:  yes

   The self-signed certificate is created and added to the client truststore.

1. Create the Oracle Data Integrator domain and configure the agent template:

   • If using the ODI Standalone install type, create an ODI domain and configure the Oracle Data Integrator - Standalone Agent template to create an ODI Instance configuration.

   • If using the ODI Enterprise install type, create an ODI domain and configure the Oracle Data Integrator - Standalone Colocated Agent template to create an ODI Instance configuration.

   See Installing and Configuring Oracle Data Integrator for more information.

2. Create an agent in the master repository with the HTTPS protocol. If the agent already exists, modify the agent's protocol to https in the master repository. See Creating a Physical Agentfor more information.
3. Edit the instance.properties file at the following location and set PROTOCOL to https:

   <domain>/config/fmwconfig/components/ODI/<agentName>

   Set the SSL password parameters in an encrypted format, as shown below:

   ODI_KEYSTORE_ENCODED_PASS=<Encrypted password>
   ODI_KEY_ENCODED_PASS=<Encrypted password>
   ODI_TRUST_STORE_ENCODED_PASS=<Encrypted password>

   For information on how to encrypt a password, see Encoding a Password.

4. Configure other Keystore Location and Truststore SSL parameters' location and type in the instance.sh file, as shown below:

   ODI_INSTANCE_JAVA_OPTIONS="
   -Djavax.net.ssl.keyStore=<domain>/security/DemoIdentity.jks
   -Djavax.net.ssl.keyStoreType=JKS -Djavax.net.ssl.trustStore= <MW_HOME>/Oracle_Home/wlserver/server/lib/DemoTrust.jks
   -Djavax.net.ssl.trustStoreType=JKS $ODI_ADDITIONAL_JAVA_OPTIONS"

5. Enter the following command to start the agent:

   <domain>/bin/agent.sh -INSTANCE=agentName

1. Go to Tools > Preferences > Credentials.
2. Edit the Client Trusted Certificate Keystore and Client Trusted Keystore Password fields.

ODI client tools do not have access to the master repository, and therefore cannot decrypt the SSL passwords stored in the instance.properties file.

ODI truststore and keystore are configured via instance.sh or instance.cmd, corresponding to the standalone/collocated server.

The passwords are to be given either in plain text or as ODI-encoded passwords.

For tool invocations to succeed, truststore configuration is needed.

This includes importing the necessary certificates into the truststore, and configuring the truststore password.

instance.sh/cmd may already have code that points to a specific truststore.

In that case, work with the specified truststore.

If there is not truststore configured, the JVM truststore will be used.

To run Oracle Data Integrator client tools that connect to an SSL-enabled agent, set a plain text/ODI-encoded password for the trustStorePassword system property. The trustStorePassword system property must be appended to the ODI_INSTANCE_JAVA_OPTIONS variable in the following location:

<domain>/config/fmwconfig/components/ODI/OracleDIAgent1/bin/instance.sh

Append the parameter using the following command:

ODI_INSTANCE_JAVA_OPTIONS="-Djavax.net.ssl.trustStorePassword=<plain_text-password>
-Djavax.net.ssl.trustStore=<domain>/security/DemoIdentity.jks   -Djavax.net.ssl.trustStoreType=JKS
-Djavax.net.ssl.trustStore=<Domain>/oracle/work/middleware/wlserver/server/lib/DemoTrust.jks
-Djavax.net.ssl.trustStoreType=JKS $ODI_ADDITIONAL_JAVA_OPTIONS"

Sample ODI client tools that require the trustStorePassword system property are listed below:

./agentstop.sh -NAME= OracleDIAgent1
./startcmd.sh -INSTANCE=OracleDIAgent1 OdiPingAgent -AGENT_NAME=OracleDIAgent1
./startcmd.sh -INSTANCE=OracleDIAgent1 OdiKillAgent -NAME=OracleDIAgent1 -IMMEDIATE=YES -MAX_WAIT=0
./startscen.sh -INSTANCE=OracleDIAgent1 OdiStartScen -SCEN_NAME=SAM -SCEN_VERSION=001 -CONTEXT=GLOBAL -SYNC_MODE=1
./startscen.sh -INSTANCE=OracleDIAgent1 SAM 001 GLOBAL -AGENT_URL=https://<hostname>:<port>/oraclediagent

For information on ODI client tools, see Oracle Data Integrator Tools Reference.

1. Execute the following script with agentName:

   <domain>/bin/encode.sh -INSTANCE=<agentName> 

2. Enter the password in the prompt, as shown below:

   Enter password to encode: <password> 

   The encrypted password is displayed.

1. Set the cipher suites that must be excluded in the instance.properties file. For example:

   ODI_EXCLUDED_CIPHERS=TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5,TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA

2. Invoke the agent in SSL mode, using the following command:

   ./agent.sh-NAME=OracleDIAgent -PORT=20910

   A list of available cipher suites is displayed and a list of cipher suites that can be used by the SSL-enabled Standalone agent or Standalone Colocated agent is also displayed.