Run the following validation steps to verify if the integration between Oracle Identity Manager and OpenSSO is successful:

1. User Login to Oracle Identity Governance Through SSO:

   Prerequisite: Create a user, for example ENDUSER001 in Oracle Identity Manager and LDAP.

   Step: Try logging in to Oracle Identity Manager through SSO as the user you created, for example ENDUSER001, and check if the login is successful.

   Expected output: Login is successful.

2. Client-Based Login to Oracle Identity Governance:

   Prerequisite: Make sure that the Design Console is installed and configured.

   Step: Try logging in to the Design Console as system administrator with SSO password.

   Expected output: Login to the Design Console is successful, assuming that LDAPAuthenticator is configured properly for SSO login.

3. Signature-Based Authentication:

   To test signature-based authentication:

   1. Try accessing the scheduler service URL. It should be running on Oracle Identity Manager Managed Server port, as shown:

      http://OIM_HOST:OIM_PORT/SchedulerService-web

   2. Login as system administrator with SSO password.

   3. If the login is successful and you can see the following details on the screen, then signature login is successful:

      Scheduler Current Status: STARTED

      Last Error: NONE

   4. Click Start on the page if the following is displayed:

      Scheduler Current Status: STOPPED

      If no errors are displayed on the page, then signature login is successful.

To integrate Oracle Identity Governance 12c (12.2.1.4.0) with IBM Tivoli Access Manager for e-business 6.1:

1. Start IBM Tivoli Access Manager.

2. Start Oracle Identity Governance.

3. Setup connection between webseal and WebLogic. To do so:

   1. Create junctions to connect webseal to Oracle Identity Governance WebLogic Server.

   2. Configure webseal logout and login page.

   3. Deploy weblogic security providers.

      Refer to TAM-weblogic integration documentation provided as part of IBM Tivoli Access Manager Adapter for Oracle WebLogic Server. The additional details are as follows:

      • Keep both non-SSL and SSL ports on Oracle Identity Governance into consideration while creating junctions.

      • While creating webseal junction(s) for protected resources, make sure to use the "-c iv-user" (insert iv-user HTTP header) option.

      • List of resources that needs to be protected/unprotected:

        Protect the following resources:

        /oim

        /xlWebApp

        /Nexaweb

        /identity

        /sysadmin

        Unprotect following uris:

        /identity/faces/register

        /identity/faces/forgotpassword

        /identity/faces/trackregistration

        /identity/faces/forgotuserlogin

        /identity/faces/accountlocked

        /identity/adfAuthentication

        /identity/afr/blank.html

        /sysadmin/adfAuthentication

        /sysadmin/afr/blank.html

        /sysadmin/faces/noaccess

        /oim/afr/blank.html

        Unprotect following resources:

        /workflowservice

        /callbackResponseService

        /spml-xsd

      • Only configure Tivolli Access Manager Identity assertion provider (AMIdentityAsserterLite). Select the iv-user option while configuring it.

      • Do not configure Tivolli Access Manager Identity authentication provider.

      • Configure WebLogic authentication provider for LDAP server corresponding to the LDAP registry used by TAM. For example, if TAM uses Sun DSEE, then configure iPlanet authentication provider. Set its control flag as SUFFICIENT. Ensure that all usersin Oracle Identity Manager are synchronized to this LDAP server. If any Oracle Identity Manager user is not present in the LDAP server, then that user will not be able to login to Oracle Identity Manager.

      • Configure Oracle Identity Governance signature authentication provider (OIMSignatureAuthenticationProvider). Provide the Oracle Identity Manager database details while configuring it. You can use the same details as specified in OIMAuthenticationProvider. Set its control flag as SUFFICIENT.

      • Arrange the authenticator chain in the following order:

        TAMIdentityAsserter

        OIMSignatureAuthenticator - SUFFICIENT

        LDAPAuthenticator - SUFFICIENT

        DefaultAuthenticator - SUFFICIENT

        DefaultIdentityAsserter

        Note:

        If you cannot use TAMIdentityAsserter, then you can use the OAMIdentityAsserter, as described in Simplifying Third-Party SSO Integration

4. Change the Oracle Identity Manager logout to execute TAM logout URL by using the following commands:

   cd <IDM_ORACLE_HOME>/common/bin
   ./wlst.sh
   connect()
   addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi="http(s)://<webseal-host:port>/pkmslogout", autologinuri="/obrar.cgi")
   exit()
   

5. Set OIM ssoenabled flag to true. To do so:

   1. Login to Enterprise Manager. Open System Mbean Broswer.

   2. Open the oracle.iam:Location=OIM_SERVER_NAME,name=SSOConfig,type=XMLConfig.SSOConfig,XMLConfig=Config,Application=oim,ApplicationVersion=11.1.2.0.0 mbean.

   3. At the value of ssoEnabled to true.

6. Restart Oracle Identity Manager.

7. Test the configuration by navigating to the following URL:

   http(s)://WEBSEAL_HOST:WEBSEAL_PORT/identity/faces/home

   TAM login page is displayed. Login as valid Oracle Identity Governance user, and the login should be successful.

Run the following validation steps to verify if the integration Oracle Identity Manager and TAM is successful:

1. User Login to Oracle Identity Governance Through SSO:

   Prerequisite: Create a user, for example ENDUSER001, in Oracle Identity Manager and LDAP.

   Step: Try logging in to Oracle Identity Manager through SSO as the user that you created, for example ENDUSER001, and check if the login is successful.

   Expected output: Login should be successful.

2. Client-Based Single Login to Oracle Identity Governance:

   Prerequisite: Make sure that the Design Console is installed and configured.

   Step: Try logging in to the Design Console as system administrator with SSO password.

   Expected output: Login to the Design console must be successful, assuming that LDAPAuthenticator is configured properly for SSO login.

3. Signature-Based Authentication:

   To test signature-based authentication:

   1. Try accessing the scheduler service URL. It should be running on Oracle Identity Manager Managed Server port, as shown:

      http://OIM_HOST:OIM_PORT/SchedulerService-web

   2. Login as system administrator by providing SSO password.

   3. If the login is successful and you can see the following details on the screen, then signature login is successful:

      Scheduler Current Status: STARTED

      Last Error: NONE

   4. Click Start on the page if the following is displayed:

      Scheduler Current Status: STOPPED

      If there are no errors on the page, then the signature login is successful.

To integrate Oracle Identity Manager with CA SiteMinder:

1. Install Siteminder WebLogic Agent by referring to Siteminder installation documentation. Follow install GUI instructions.

2. Edit the setDomainEnv.sh file to set the variables, as shown:

   ASA_HOME='PATH_TO_SITEMINDER_AGENT_HOME'
   export ASA_HOME
   
   SMASA_CLASSPATH="$ASA_HOME/conf:$ASA_HOME/lib/smagentapi.jar:$ASA_HOME/lib/smjavasdk2.jar:$ASA_HOME/lib/sm_jsafe.jar:$ASA_HOME/lib/smclientclasses.jar:$ASA_HOME/lib/sm_jsafeJCE.jar"
   export SMASA_CLASSPATH
   
   SM_JAVA_OPTIONS=" -Dsmasa.home=$ASA_HOME"
   export SM_JAVA_OPTIONS
   
   CLASSPATH=${SMASA_CLASSPATH}:${CLASSPATH}
   export CLASSPATH
   

3. Edit the startWebLogic.sh file to add SM_JAVA_OPTIONS to the JAVA command, as shown:

   $JAVA_HOME/bin/java ${JAVA_VM} ${MEM_ARGS} -Dweblogic.Name=${SERVER_NAME} -Djava.security.policy=${WL_HOME}/server/lib/weblogic.policy ${JAVA_OPTIONS}
   ${SM_JAVA_OPTIONS} ${PROXY_SETTINGS} ${SERVER_CLASS}
   

4. Edit the ASA_HOME/conf/WebAgent.conf file to change the value of the EnableWebAgent parameter to YES.

5. Restart all Managed and Admin servers.

6. Add/Configure SiteminderIdentityAsserter and SiteminderAuthenticationProvider in the Weblogic authentication chain. In Identity Asserter common configuration, select SMSESSION.

7. In the Provider Specific subtab, set the "SMIdentity Asserter Config File:" field to ASA_HOME/conf/WebAgent.conf.

8. In SiteminderAuthenticationProvider 'ProviderSpecific', update "SMAuth Provider Config File:" to ASA_HOME/conf/WebAgent.conf.

9. Remove existing OIMAuthenticationProvider from the authentication chain.

10. Add OIMSignatureAuthenticator to the authentication chain. Set the control flag to SUFFICIENT. This authenticator is added only to handle signature based login to Oracle Identity Manager.

11. Add LDAP Authenticator (OID, Iplanet, and so on) to the authentication chain, and set its control flag as SUFFICIENT. Ensure that this authenticator is configured to point to the same LDAP provider, that is :

    1. Synchronized with Oracle Identity Manager, that is, have all the OIM Identity population

    2. Used by the Siteminder server for authentication purposes

       LDAPAuthenticator needs to be added in order to handle non-http based login requests (For example, login to OIM design console, or any other OIM client login) and OPSS based Assertion requests.

12. Rearrange the authentication chain, as listed in Table B-1:

    Table B-1 Authentication Chain

    Authentication Provider	Control Flag
    SiteminderIdentityAsserter
    OIMSignatureAuthenticator	SUFFICIENT
    SiteminderAuthenticationProvider	SUFFICIENT
    LDAPAuthenticator	SUFFICIENT
    DefaultAuthenticator	SUFFICIENT
    DefaultIdentityAsserter

13. Restart Admin server and all the Managed Servers in the domain.

14. Configure SSO logout for oim by using the following command:

    cd <IDM_ORACLE_HOME>/common/bin
     
    ./wlst.sh
     
    connect()
     
    addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi="SITEMINDER_LOGOUT_URL", autologinuri="/obrar.cgi")
     
    exit()
    

    Note:

    The connect() call will ask for Admin server URL and WebLogic Admin username and password.

15. Set the ssoenabled flag for Oracle Identity Manager to true. To do so:

    1. Login to Enterprise Manager, and open System MBean Browser.

    2. Open the oracle.iam:Location=OIM_SERVER_NAME,name=SSOConfig,type=XMLConfig.SSOConfig,XMLConfig=Config,Application=oim,ApplicationVersion=11.1.2.0.0 mbean.

    3. Set the value of ssoEnabled to true.

16. Restart Admin Server and all Managed Servers in the domain.

17. Protect/unprotect the following Oracle Identity Manager resources:

    • Protect following resources:

      /identity

      /sysadmin

      /oim

      /xlWebApp

      /Nexaweb

    • Unprotect the following URIs:

      /identity/faces/register

      /identity/faces/forgotpassword

      /identity/faces/trackregistration

      /identity/faces/forgotuserlogin

      /identity/faces/accountlocked

      /identity/adfAuthentication

      /identity/afr/blank.html

      /sysadmin/adfAuthentication

      /sysadmin/afr/blank.html

      /sysadmin/faces/noaccess

      /oim/afr/blank.html

    • Unprotect the following resources:

      /workflowservice

      /callbackResponseService

      /spml-xsd

      /reqsvc

      /sysadmin/logout

      /identity/logout

      /identity/notification/secure

      /SchedulerService-web

      /wsm-pm

      /workflow

      /soa-infra

      /integration

      /b2b

      /sdpmessaging/userprefs-ui

18. To support client-based login to Oracle Identity Manager, the smclientclasses.jar must be added to the client classpath. To set the client classpath:

    1. Go to the OIM_ORACLE_HOME/server/bin/ directory using the cd command.

    2. Open the setEnv.sh file in VI Editor.

    3. Add smclientclasses.jar to the CLASSPATH variable at the end. This setting ensures successful client login to Oracle Identity Manager while executing most of the client utilities present in OIM_ORACLE_HOME/server/bin.

       However, client classpath must be separately set for the Design Console login to work. To do so:

    1. Go to the OIM_ORACLE_HOME/designconsole directory.

    2. Open the classpath.sh file in VI Editor.

    3. Add smclientclasses.jar to the CLASSPATH variable at the end.

Run the following validation steps to verify if the integration Oracle Identity Manager and CA SiteMinder is successful:

1. User Login to Oracle Identity Governance Through SSO:

   Prerequisite: Create a user, for example ENDUSER001, in Oracle Identity Manager and LDAP.

   Step: Try logging in to Oracle Identity Manager through SSO as the user that you created, for example ENDUSER001, and check if the login is successful.

   Expected output: Login should be successful.

   Step: Try logging in to Oracle Identity Manager System Administration console (/sysadmin) as OIM Administrator (typically XELSYSADM), and check if login is successful.

   Expected output: Login should be successful.

2. Client-Based Login to Oracle Identity Governance:

   Prerequisite: Make sure that the Design Console is installed and configured.

   Step: Try logging in to the Design Console as the system administrator with SSO password.

   Expected output: Login to the Design console should be successful, assuming that SiteminderAuthenticationProvider is configured properly for SSO login.

3. Signature-Based Authentication:

   To test signature-based authentication:

   1. Try accessing the scheduler service URL. It should be running on Oracle Identity Manager Managed Server port, as shown:

      http://OIM_HOST:OIM_PORT/SchedulerService-web

   2. Login as system administrator by providing SSO password.

   3. If the login is successful and you can see the following details on the screen, then signature login is successful:

      Scheduler Current Status: STARTED

      Last Error: NONE

   4. Click Start on the page if the following is displayed:

      Scheduler Current Status: STOPPED

      If there are no errors on the page, then the signature login is successful.

To configure SSO logout and the authenticator:

1. Set OIM ssoenabled flag to true. To do so:

   1. Login to Oracle Enterprise Manager, and navigate to OIM_DOMAIN.

   2. Right click OIMDomain, and select System MBean Browser.

   3. Click the search icon, enter ssoconfig, and search.

   4. In the details page, look for SSOEnabled flag, and select true from the drop down. Click Apply to save the configuration change.

2. Configure SSO logout for oim, as shown:

   <IDM_ORACLE_HOME>/common/bin/wlst.sh
       connect()
       addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi="/oamsso/logout.html", autologinuri="/obrar.cgi")
       exit()
   

   Note:

   The connect() call prompts for Admin server URL and WebLogic administrator username and password.

3. Configure authentication providers. To do so:

   Note:

   This step configures the security providers in OIM domain in such a way that the SSO login, and OIM-client based login works fine. For this, OAMIDAsserter and OIDAuthenticator must be setup. OIDAuthenticator is configured to authenticate/assert users against OID. To authenticate/assert users against any other Directory server, which is also used by OAM for authentication, corresponding authenticator must to be configured instead of OIDAuthenticator.

   1. Login to Oracle WebLogic Administrative Console, and navigate to Security realms, myrealm, Providers, Authentication.

   2. Click New to add OAMIDAsserter of type OAMIdentityAsserter. Click OK.

      Edit OAMIDAsserter that you added, and set the control flag to REQUIRED.

      Ensure that Chosen Active Type is set to OAM_REMOTE_USER, and then save the configuration.

   3. Click New to add OIMSignatureAuthenticator of type OIMSignatureAuthenticator. Click OK. Edit OIMSignatureAuthenticator and set the Control flag to SUFFICIENT. Save the configuration.

   4. Click New to add OIDAuthenticator of type OracleInternetDirectoryAuthenticator. Click OK. Edit OIDAuthenticator and set the Control flag to SUFFICIENT. Save the configuration. Open the Provider specific tab, and set the following attributes (only), and then save the configuration.

      • Host: OID_HOST_NAME

      • Port: OID_PORT

      • Principal: cn=orcladmin

      • Credential/Confirm Credential: orcladmin_password

      • User Base DN: cn=Users,dc=us,dc=oracle,dc=com

      • All Users Filter: (&(uid=*)(objectclass=inetOrgPerson))

      • User From Name Filter: (&(uid=%u)(objectclass=inetOrgPerson))

      • UserNameAttribute: uid

      • User Object class: inetOrgPerson

      • Use retrieved use name as principal: true

      • Group Base DN: cn=Groups,dc=us,dc=oracle,dc=com

      • All groups filter: (&(cn=*)(objectclass=groupOfUniqueNames))

      • Group from name filter: (&(cn=%g)(objectclass=groupOfUniqueNames))

   5. Remove OIMAuthenticationProvider that is already configured.

   6. Re-order the remaining authentication providers in the following order:

      OAMIDAsserter

      OIMSignatureAuthenticator

      OIDAuthenticator

      DefaultAuthenticator

      DefaultIdentityAsserter

   7. Activate all the changes done, and then restart all the servers configured in OIM domain.

Validate the SSO logout and authenticator configuration by running the following validation tests:

1. User Login to Oracle Identity Governance Through SSO

   Prerequisites: Create a user, for example, ENDUSER001, in Oracle Identity Manager and LDAP.

   Step: Try logging in to Oracle Identity Self Service through SSO URL as the user you created, for example ENDUSER001, and check if the login is successful. Also try to login to Oracle Identity System Administration as the system administrator, and try accessing various links, such as Access Polices. Try logging out from either of the consoles, and re-login with same or different users.

   Expected output: Login is successful, and all the links work as expected.

2. Client-Based Login to Oracle Identity Governance:

   Prerequisites: The Design Console is installed and configured.

   Step: Try logging in to the Design Console as the system administrator with SSO password.

   Expected output: Login to the Design console as the system administrator is successful, assuming that LDAPAuthenticator is configured properly for SSO login.

3. Signature-Based Authentication:

   To test signature-based authentication:

   1. Try accessing the Scheduler service URL running on Oracle Identity Manager Managed server port, as shown:

      http://OIM_HOST:PORT/SchedulerService-web

   2. Login as system administrator with SSO password.

   3. If the login is successful and you can see the following details on the screen, then signature login is successful:

      Scheduler Current Status: STARTED

      Last Error: NONE

   4. Click Start on the page if the following is displayed:

      Scheduler Current Status: STOPPED

      If there are no errors on the page, then signature login is successful.