For production environments that require increased application performance, throughput, or high availability, you can configure two or more Managed Servers to operate as a cluster. A cluster is a collection of multiple WebLogic Server server instances running simultaneously and working together to provide increased scalability and reliability.

In a cluster, most resources and services are deployed identically to each Managed Server (as opposed to a single Managed Server), enabling failover and load balancing. A single domain can contain multiple WebLogic Server clusters and multiple Managed Servers that are not configured as clusters. The key difference between clustered and non-clustered Managed Servers is support for failover and load balancing. These features are available only in a cluster of Managed Servers.

By default, Access Manager has a single OAM Server to which all login and logout requests are sent. In a high-availability deployment, you must change this setup so that login and logout requests are first sent to the load balancer.

Figure 13-1 shows the Load Balancing Settings section of the Access Manager Settings page. In earlier releases this was part of the SSO Engine settings; the SSO Engine being the controller for sessions.

Figure 13-1 Access Manager Settings: Load Balancer

Description of "Figure 13-1 Access Manager Settings: Load Balancer"

Table 13-1 describes each element and how it is used. Settings are global and common to all OAM Servers in the WebLogic administration domain.

Users with valid Administrator credentials can modify Access Manager load balancing settings using Oracle Access Management Console.

1. From the Access Manager Settings, open Load Balancing:
2. Expand the Load Balancing area:

   • View Only: Close the page when you finish.

   • Modify: Edit Load Balancing settings for your deployment (Table 13-1).

3. Click Apply to submit the changes (or close the page without applying changes).
4. Dismiss the Confirmation window.

The OAM Server Error Mode appears on the Load Balancing Settings area of the Access Manager Settings page.

Figure 13-1 shows the Server Error Mode function.

Figure 13-2 Access Manager Settings: Server Error Mode

Description of "Figure 13-2 Access Manager Settings: Server Error Mode"

Table 13-2 describes the options you can choose to configure Server Error Mode for your deployment.

Users with valid Administrator credentials can view or edit Access Manager secure error mode settings for OAM Servers using the Oracle Access Management Console.

1. In the Configuration console, select Access Manager from the View menu in the Settings section.
2. On the Access Manager Settings page, expand the Load Balancing section.
3. Server Error Mode:

   • Modify: Choose the desired Server Error Mode for your deployment (Table 13-2 and Table 13-4).

   • View Only: Close the page when you finish.

4. Click Apply to submit the changes (or close the page without applying changes).
5. Dismiss the Confirmation window.
6. Proceed to "Managing SSO Tokens and IP Validation".

The Access Manager Settings page include information such as IP Validation and SSO token version.

Users with valid Administrator credentials can view or edit Access Manager SSO settings using the Oracle Access Management Console.

1. In the Oracle Access Management Console, click Configuration at the top of the window.
2. In the Configuration console, select Access Manager from the View menu in the Settings section.
3. Expand the SSO section:

   • View Only: Close the page when you finish.

   • Modify: Perform remaining steps to edit the configuration.

4. Edit settings as needed for your deployment, based on details in Table 13-6.
5. Click Apply to submit the changes (or close the page without applying changes).
6. Dismiss the Confirmation window.
7. Proceed to "Managing the Access Protocol for OAM Proxy Cert Mode Security".

Open and Cert are the modes of secure communication and there are similarities between these modes.

Table 13-7 outlines the similarities between Cert and Open modes.

openssl rsa -in aaa_key.pem -passin pass: -out aaa_key.pem -passout pass: passphrase -des

You can the configure settings of Common OAM Proxy Page for Secure Server Communications.

Administrators can use view or edit Cert mode settings for the common OAM Proxy.

1. In the Oracle Access Management Console, click Configuration at the top of the window.
2. In the Configuration console, select Access Manager from the View menu in the Settings section.
3. Expand the Access Protocol section.
4. Cert Mode Configuration: Specify the following details.

   • PEM Keystore Alias

   • PEM Keystore Alias Password

5. Click Apply to submit the changes and dismiss the Confirmation window (or close the page without applying changes).
6. Update Agent registration pages as needed to regenerate artifacts, and then replace the earlier artifacts as described in Introduction to Agents and Registration or Registering and Managing OAM Agents.

64-bit WebGates now support SHA2 (256,384 & 512 bit) certificates.

<Oracle Middleware Home>/oracle_common/bin/orapki wallet add 
 -wallet $DOMAIN_HOME/output/$Agent_Name/cwallet.sso -trusted_cert 
 -cert <Root CA path .i.e. aaa_chain.pem> -auto_login_only

The Resource Matching Cache and the Authorization Result Cache are set and required during policy evaluation at run time.

Figure 13-4 illustrates the Policy section of the Access Manager Settings page.

Figure 13-4 Common Policy Evaluation Caches

Description of "Figure 13-4 Common Policy Evaluation Caches"

Table 13-9 outlines these global settings that apply to all servers and requests.

Administrators manage the Access Manager common run time policy evaluation cache settings.

1. In the Oracle Access Management Console, click Configuration at the top of the window.
2. In the Configuration console, select Access Manager from the View menu in the Settings section.
3. Expand the Policy section.
4. Resource Matching Cache: Specify details and click apply (Table 13-9).
5. Authorization Result Cache: Specify details and click apply (Table 13-9).
6. Click Apply to submit the changes and dismiss the Confirmation window (or close the page without applying changes).