Figure 24-1 Password Policy Configuration Page

Description of "Figure 24-1 Password Policy Configuration Page"

Note: Use Password Policy Configuration page to configure only Global Password Policies. Multiple Password Policies can be configured using REST API’s .

Table 24-2 describes the configurable Password Policy options (as read from left to right in the console). These elements are used by both the ECC and DCC.

The specifications in this example are for illustration only. Your environment will be different.

1. In the Oracle Access Management Console, click Configuration at the top of the window.

2. In the Configuration console, click User Identity Stores.

3. Set the System Store: Administrator roles and credentials must reside in this store.

   1. Open the page of the store to designate as the System Store.

   2. Check Set as system store (for domain wide authentication and authorization operations).

   3. Click Apply.

   4. Add Administrators: See "Managing Administrator Roles".

   5. Authentication Module: Set the LDAP Authentication Module used by the OAMAdminConsoleScheme (authentication scheme) to use this System Store.

   6. Configure one or more authentication plug-ins to use this store, as described in "Orchestrating Multi-Step Authentication with Plug-in Based Modules".

4. Set Default Store: This store is required for Password Policy and migration when patching.

   1. Open the page of the store to designate as the Default Store.

   2. Check the box beside Set as default store.

   3. Authentication Module: Locate OAMAdminConsoleScheme and confirm that the LDAP module does not refer to this store. See "Managing Native Authentication Modules".

   4. Authorization Policy Conditions: Choose the desired user identity store when setting Identity Conditions in Authorization Policies. See "Defining Authorization Policy Conditions".

5. Close the registration page.

Prerequisites

Register a supported LDAP store and designate it as the Default Store. Ensure that the user you add is defined within the Default Store.

1. In the Oracle Access Management Console, click Configuration at the top of the window.

2. In the Configuration console, click Administration.

3. Add a New Administrator:

   1. In the Administration page, click Grant.

   2. In the dialog that appears, click Search.

   3. Select the desired role from the Roles drop-down list and click Add Selected to grant it to the selected user.

   4. Click Apply to submit the changes.

4. Proceed with "Configuring Password Policy Authentication".

A sample module is shown in Figure 24-2. The User Password Status Step is the unique step that relies on the UserPasswordPolicyPlugin.

Figure 24-2 Password Policy Validation Authentication Module with Orchestrated Plug-ins

Description of "Figure 24-2 Password Policy Validation Authentication Module with Orchestrated Plug-ins"

Each step identifies the action provided by a specific named plug-in.

Figure 24-3 shows the orchestration of steps within the authentication module. For more information on modules and steps, see "Pre-populated Plug-ins for Configuring Access Manager with Multi-Step Authentication".

Figure 24-3 Step Orchestration for Password Policy Validation Module

Description of "Figure 24-3 Step Orchestration for Password Policy Validation Module"

Table 24-8 describes the Password Policy Validation module step details that you specify.

Prerequisites

Defining Your Global Password Policy

1. In the Oracle Access Management Console, click Application Security at the top of the window.

2. In the Application Security console, click Authentication Modules. in the Plug-ins section.

3. In the Authentication Modules page, click Search, then click Password Policy Authentication Module.

4. Select the Steps tab; for each of the three steps add the Default Store name in the field beside KEY_IDSTORE_REF (Save after each change). For example:

   1. User Identification Step

      KEY_IDSTORE_REF: OID

      Save.

   2. User Authentication Step

      KEY_IDSTORE_REF: OID

      Save.

   3. User Password Status Step

      KEY_IDSTORE_REF: OID

      Save.

5. Click Apply.

6. Proceed to "Configuring the PasswordPolicyValidationScheme".

You can have multiple authentication schemes for use with the global password policy.

Prerequisites

Password Policy Validation Module

Prerequisites

Configuring the PasswordPolicyValidationScheme

1. ECC: In the console, search for and open the appropriate Application Domain. (See "Searching for an Existing Application Domain").

   See Also:

   "Adding Your PasswordPolicyValidationScheme to ECC Authentication Policy"

2. ECC: Protect Resources using the PasswordPolicyValidationScheme:

   1. Find and open your Protected Resource Policy on the Authentication Policies tab (see "Viewing or Editing an Authentication Policy"):

      • Authentication Policies
      • Protected Resource Policy

   2. Select PasswordPolicyValidationScheme for the Protected Resource Policy (Authentication Scheme) and click Apply.

   3. Finish updating your Authentication and Authorization policies, as desired (Managing Policies to Protect Resources and Enable SSO).

3. Proceed as needed for your environment:

   • ECC: Completing Password Policy Configuration

   • DCC: Configuring OAM WebGate and Authentication Policy for DCC

Figure 24-4shows the Access Manager settings.

Figure 24-4 Server Error Mode for Password Management

Description of "Figure 24-4 Server Error Mode for Password Management"

Prerequisites

• Managing Global Password Policy

• Configuring Password Policy Authentication

• Optional: Configuring OAM WebGate and Authentication Policy for DCC

For example, with Oracle Internet Directory registered for Oracle Access Management, native password policy is generally located as follows:

dn: cn=default,cn=pwdPolicies,cn=Common,cn=Products,cn=OracleContext,<DOMAIN_CONTAINER>

dn: cn=default,cn=pwdPolicies,cn=Common,cn=Products,cn=OracleContext

You can disable the Oracle Internet Directory password policy by setting the orclpwdpolicyenable parameter to zero (0).

The following procedure is only an example. Your environment will be different.

Prerequisites

Setting the Error Message Mode for Password Policy Messages

Prerequisites

Configuring OAM WebGate and Authentication Policy for DCC

1. Confirm access after login:

   1. Open a new browser and request a resource.

   2. Log in with your user credentials.

   3. Confirm that you have access to the resource.

2. Confirm no access on incorrect login:

   1. Open a new browser and request a resource.

   2. Log in with incorrect user credentials.

   3. Confirm that you must re-authenticate.

3. Confirm lockout after exceeding maximum incorrect login attempts:

   1. Open a new browser and request a resource.

   2. Log in with incorrect user credentials repeatedly.

   3. Confirm that the user account is locked.

4. Modify and evaluate your password expiry policy:

   1. Log in to the Oracle Access Management Console.

   2. In your password policy, reset the expiry and lockout periods (Table 24-2) so that you will see warnings on your next login.

   3. Save the policy updates.

   4. Open a new browser and request a resource.

   5. Verify the warning page appears advising that the password will expire.

   6. Click the link to continue without password change.

5. Change your password:

   1. Open a new browser and request a resource.

   2. On the password expiry warning page, click the link to change your password.

   3. On the password change page, enter your correct old password.

   4. In the new password field, enter a different new password that does not follow the password policy and confirm the password validation error.

   5. Enter a new password that meets requirements and confirm success and access to the resource.

See Accessing Password Policy Configuration Page for details. It is up to the administrator to ensure that the policies are indeed the same and consistent.

Table 24-9 documents the LDIF file to use with supported LDAP directories.

The administrator can setup forgot password URL by following the procedure documented in Administering the Forgot Password URL.

OTP (One Time Pin) can be generated for a OAM user by using Adaptive Authentication Plugin. Once enabled, users can change their passwords using OTP and password change REST APIs through application which can orchestrate these REST calls.

The forgot password feature in OAM can be accomplished using One Time Pin (OTP) generation and ChangePassword using OTP REST APIs.

See also,

REST API for Password Management in Oracle Access Manager

REST API for OTP Forgot Password in Oracle Access Manager

The sample forgot password application can be downloaded from the OTN location. Please create a support request to get the forgot password sample application.

Directory Setup

1. Create an OID profile in OAM, add the required objectclasses() and add it as the default idstore in OAM. See Creating an Identity Directory Service Profile for more information on creating an ID profile.

2. Run the following command to add ldif files. See Extending the LDAP Definitions for more information.

   ldapadd -D <DIRECTORY_USERNAME> -w <DIRECTORY_PASSWORD> -h <DIRECTORY_HOST_NAME> -p <DIRECTORY_PORT> -f $MW_HOME/idm/modules/oracle.idm.ipf_14.1.2.0.0/scripts/ldap/OID_OblixSchema.ldif
   ldapadd –D <DIRECTORY_USERNAME> -w <DIRECTORY_PASSWORD> -h <DIRECTORY_HOST_NAME> -p <DIRECTORY_PORT> -f $MW_HOME/idm/modules/oracle.idm.ipf_14.1.2.0.0/scripts/ldap/OID_OracleSchema.ldif
   

   Note:

   Ensure that the LDAP directory has password management enabled.

   Ensure that the LDAP profile is configured as the default store in the User Identity Stores

Setup Related to OTP Rest API

These steps are required to be able to use the OTP Rest service for creating and validating the OTP for users successfully.

1. Add otprestusergroup to OAM admin user in the LDAP directory.

   In case of admin user being weblogic, add the privilege in embedded ldap in weblogic console. Add a group called otprestusergroup to groups and add weblogic user to this group.

2. Enable UMS in Adaptive Auth Plugin. See Configuring the Adaptive Authentication Plug-in in the Oracle Access Management Console

   Note:

   Ensure the settings UmsAvailable = true and UmsClientUrl = < has the relevant client url>

   Use the following WLST command line script to set the credentials for the Oracle User Messaging Service

   cd <MW_HOME>/oracle_common/common/bin 
    ./wlst.sh
       connect()
       createCred(map="OAM_CONFIG", key="umsKey", user="weblogic", password="welcome1")
   

Setup for forgot password link on default login page

On the OAM console, Enable the Adaptive Authentication Service. This is a pre-requisite for enabling the OTP forgotpassword link on OAM login pages. For information on available services , See Available Services of the Common Configuration Section.

Use the following Rest API command with the relevant hostname:port to enable the OTP forgot password link on the default login page in OAM

curl -X PUT \

  http://hostname:port/oam/services/rest/access/api/v1/config/otpforgotpassword/ \
  -H 'authorization: Basic d2VibG9naWM6d2VsY29tZTE=' \
  -H 'content-type: application/json' \
  -d '{"displayOTPForgotPassworLink":"true","defaultOTPForgotPasswordLink":"false","localToOAMServer":"false","forgotPasswordURL": "http://hostname:port/otpfp/pages/fp.jsp", "mode":"userselectchallenge"}'

The following table describes the values for the mode parameter in the Curl command.

Adding Rest admin credentials to CSF

Use the following WLST command to add the Rest admin credentials to the Credential Store Framework (CSF). The credential is required for accessing OAM Rest services.

cd <MW_HOME>/oracle_common/common/bin 
 ./wlst.sh
    connect()
    createCred(map="OAM_CONFIG", key="umsKey", user="Adminusername", password="password")

About Credential Store Framework Keys

Once all the above steps are completed, the default login page also shows the OTP forgot password link that the user can click to change the forgotten password based on a one-time-pin and login to access the protected page thereafter.