How can we do this?

1. Create an LDIF schema file with a new auxiliary object class and two new attributes as shown below.  Here only 1 challenge attribute is used, if your requirement demands, you can add many more.

dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.3.6.1.4.1.9999.1.1094.204 NAME ‘Challenge2′ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15  )
 
dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.3.6.1.4.1.9999.1.1094.205 NAME ‘Response2′ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15  )

dn: cn=schema
changetype: modify
add: objectclasses
objectclasses: ( 1.3.6.1.4.1.9999.1.1094.206 NAME ‘oblixAuxPerson4LPM’ DESC ‘User defined objectclass’ SUP top AUXILIARY MAY ( Challenge2 $ Response2 ) )

2. Import the LDIF file into the LDAP where OAM stores user data.

3. Now we have to configure this new object class in the OAM. Goto the Identity System Console and click on Common Configuration tab. Click on object classes in left pane and Add the new class by selecting the type as Person object class.

4. Goto Identity System Console -> System Configuration. Click password policy.

5. Enter the URL for Lost Password Redirect URL. Please remember to enable both checkboxes of Successful Attempts Attribute and Failed Attempts Attribute with attributes oblastSuccessFulLogin and oblastFailedLogin respectively.

6. Click on Lost Password Policy.

7. Enter the name. You can specify the challenge phrases to be user defined or pre-defined or both. If you wish to have pre-defined, then Enter the challenge phrase in the text box and click Add.

8. Enter the values for Minimum Challenges to be configured which specifies the no. of challenge phrases that will appear.

9. Enter values for Challenge Response Minimum Length and Allow Duplicate Responses appropriately.

10. Enter value for Minimum Challenges to be Answered which specifies the no. of challenges that user has to answer.

11. Select value for Challenge Pose Type. All at Once allows all the challenge phrases to appear at the same time. One after the other allows the challenges to appear after the user answers the first question.

12. Enable Send Email after password change if you want to configure SMTP stuff.

13. In the end, enable check box of password policy.

 In your custom application, you can insert the Lost Password link as shown below.

http://machinename:portnumber/identity/oblix/apps/lost_pwd_mgmt/bin/lost_pwd_mgmt.cgi?program=passwordChallengeResponse&login=%scheme1_uid_parameter_value%%scheme2_uid_parameter_value%%schemeN_uid_parameter_value%&target=top

14. To enable the password policies to the resources protected by the OAM, then modify the authentication scheme that protects those resources. In the validate_password plugin of your Authentication Scheme, add this obReadPasswdMode=”LDAP”,obWritePasswdMode=”LDAP” and the new validate_password plugin appears like this

obCredentialPassword=”password”,obReadPasswdMode=”LDAP”, obWritePasswdMode=”LDAP”

For more information, check this.

References:

Oracle Documentation

Share This

As you might have observed that the integration between Oracle Access Manager and WebLogic server varies with different versions of WebLogic Server and hence it’s architecture varies.

So I would like to give a brief on how the architecture looks like and what are the components needed for this integration.

Until WebLogic Server 10.3.0, the connector used between OAM and WebLogic is the SSPI and is available for download seperately. It is evident that SSPI Connector configuration is not very easy to get it working as customers will end up with running into lot of issues with access privileges or weblogic startup etc., . However there is no difference in components used for this integration in both WebLogic versions except the separate SSPI Connector. You would need a proxy infront of WebLogic if you want to achieve Single Sign-On and just an access gate if you want to authenticate to the WebLogic as an OAM user. If you are just looking for authentication only, then you can’t achieve SSO which demands a proxy server. From architecture perspective, you will need a Connector (installed explicitly) sitting inside the WebLogic server.  The working authentication schemes are Basic and Form.

Moving to the new version, from WebLogic Server 10.3.1 onwards, the connector has been removed. Therefore the integration becomes very easy and so the architecture is.  Here, a jar file called oamAuthnProvider.jar (for OAM 10.1.4.3) has been introduced which acts as an alternative to SSPI connector. Internally, it contains classes to talk to WebLogic Server and OAM access server. This jar file has to be copied to lib directory of weblogic server for which we are attempting to do the integration. An Identity Asserter has to be created in the WebLogic server which listens to the ObSSOCookie. The recommended authentication scheme for WLS 10.3.1 is Form Login.

References:

Blog by Josh Bregman

OAM Documentation

Please reply your comments/suggestion and it is highly appreciated.

Share This

1. Recommendation for Oracle WebLogic Server 11g Disaster Recovery here  which covers File System and Network artifacts.

2. If you are using JMS (Java Messaging services)  and T-Logs in WebLogic server then check recommendations for DR here

3. Whole Server Migration : Read about Server migration in WebLogic server (Automatic and Manual server migration) here

4. Service Migration for pinned services (JMS, JTA and user defined singleton service) here

5. If you are planning to use Virtualization and Partitioning technologies (Non Oracle) with WebLogic server then check this

6. Check High Availability configuration for Oracle WebLogic here

More information on High Availability and Disaster Recovery documentation for Fusion Middleware component - SOA, WebCenter, Identity Management (OID, SSO, Access Manager) coming soon …..

If you know any document regarding WebLogic Disaster Recovery (Failover) configuration then  update it under comments section.

Share This

However, when I used WLS 10.3.1 for Admin server and tried to install the WebLogic Portal sample application (SimplePortalExample present in ales32-ssm/wls-ssm/examples) , I am stuck up with the below specified error.

[exec] com.wles.blm.BLMObjectFindException: Could not set password user //user/RootOrg!PortalDemo!wlp_dir/customer/ does not exist
[exec]     at sun.reflect.GeneratedConstructorAccessor199.newInstance(Unknown Source)
[exec]     at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
[exec]     at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
[exec]     at com.bea.security.blmws.common.ExceptionUtility.handleException(ExceptionUtility.java:36)
[exec]     at com.wles.soap.BLM.BlmBindingImpl.handleException(BlmBindingImpl.java:9673)
[exec]     at com.wles.soap.BLM.BlmBindingImpl.setPasswordUnknown(BlmBindingImpl.java:8749)
[exec]     at com.wles.soap.BLM.BlmBindingSkeleton.setPasswordUnknown(BlmBindingSkeleton.java:10661)
[exec]     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
[exec]     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
[exec]     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
[exec]     at java.lang.reflect.Method.invoke(Method.java:597)
[exec]     at org.apache.axis.providers.java.RPCProvider.invokeMethod(RPCProvider.java:388)
[exec]     at org.apache.axis.providers.java.RPCProvider.processMessage(RPCProvider.java:283)
[exec]     at org.apache.axis.providers.java.JavaProvider.invoke(JavaProvider.java:323)
[exec]     at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
[exec]     at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
[exec]     at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
[exec]     at org.apache.axis.handlers.soap.SOAPService.invoke(SOAPService.java:453)
[exec]     at org.apache.axis.server.AxisServer.invoke(AxisServer.java:281)
[exec]     at org.apache.axis.transport.http.AxisServlet.doPost(AxisServlet.java:699)
[exec]     at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
[exec]     at org.apache.axis.transport.

BUILD FAILED
/tmp/AlesConfig.performAlesChecks5515137296247183624/LoadAdditionalPolicies.xml:108: exec returned: 251

Since Oracle provides support only for Certified versions, I could not have a chance to get it working.

Hence the best approach in case you are using WebLogic Portal and OES is to use the supported WLS i.e., 10.3.0 for Admin Server. When I did so, it worked like a charm.

Share This

From my experience, WebLogic 10.3.1 is also supported by Admin and SSMs. But one should be very careful while using JDK versions while installing. I have tested JDK 6 for Admin Server and SSM while installing and it works fine. Incase you are protecting a WebLogic domain using WebLogic SSM, you would specify the JDK version while creating the domain using config wizard. It is better to use JDK 5 instead of 6. Follow the same for WebLogic Portal as JDK 5 while creating domain.

I have seen weird errors in the scenario where WebLogic Portal is being protected by OES. I created the WebLogic Portal domain with JDK6 and tried to create the SSM instance using ConfigTool. The ConfigTool stopped after the below message is shown in the response.

Checking if default ARME port is free: 8014
Generating policy files based on templates …
Checking if SSM instance already present
Checking to see if SSM ARME port is free.
Checking JDBC parameters…
Checking to see if asipassword was run…
Assuming Domain is Weblogic 9.x and above
Checking WLS version number…
Checking to see if weblogic server is running
Weblogic server not running
Checking to see if weblogic server starts (This may take several min. depending on the host) logging into weblogic server.

The solution is to create the domain using JDK 5 version.

Share This

2.Create the required  DISK groups according to  the needs

DB name DEVEL

SQL> select file_name from dba_data_files;

FILE_NAME
——————————————————————————–
/oracle/DEVEL/system01.dbf
/oracle/DEVEL/undotbs01.dbf
/oracle/DEVEL/sysaux01.dbf
/oracle/DEVEL/users01.dbf
/oracle/DEVEL/example01.dbf

SQL> select name from v$controlfile;

NAME
——————————————————————————–
/oracle/DEVEL/control01.ctl
SQL> select MEMBER from v$logfile;

MEMBER
——————————————————————————–
/oracle/DEVEL/redo03.log
/oracle/DEVEL/redo02.log
/oracle/DEVEL/redo01.log
Shutdown the database.

SQL> SHUTDOWN IMMEDIATE

Start the database in nomount mode.

RMAN> STARTUP NOMOUNT (make sure you start with the spfile )
Restore the controlfile into ASM
RMAN> restore controlfile to ‘+DATA1′ from ‘/oracle/DEVEL/control01.ctl’;

Starting restore at 22-FEB-06
using target database control file instead of recovery catalog
allocated channel: ORA_DISK_1
channel ORA_DISK_1: sid=37 devtype=DISK

channel ORA_DISK_1: copied control file copy
Finished restore at 22-FEB-06

Find the contlrol file in ASM

ASMCMD> find -t CONTROLFILE  +DATA1 *

+DATA1/DEVEL/CONTROLFILE/backup.264.583101555
+DATA1/DEVEL/CONTROLFILE/backup.265.583101651
Modify the spfile for the controlfile new path
SQL> alter system set control_files=’+DATA1/DEVEL/CONTROLFILE/backup.264.583101555′,’+DATA1/DEVEL/CONTROLFILE/backup.265.583101651′ scope=spfile;

System altered.
shutdown  the database and restart in mount state
SQL> shutdown
ORA-01507: database not mounted
ORACLE instance shut down.
SQL> startup mount
ORACLE instance started.

Total System Global Area  473956352 bytes
Fixed Size                  1220072 bytes
Variable Size             142606872 bytes
Database Buffers          327155712 bytes
Redo Buffers                2973696 bytes
Database mounted.

SQL> select name from v$controlfile;

NAME
——————————————————————————–
+DATA1/devel/controlfile/backup.264.583101555
+DATA1/devel/controlfile/backup.265.583101651
Now move the datafiles to ASM

(here as my DB size was too small  i used this simple method, where as in big sized DB you should implement some other strategies to do everything in  in parallel  as the downtime will be minimal)
RMAN> BACKUP AS COPY DATABASE FORMAT ‘+DATA1′;

Starting backup at 22-FEB-06
allocated channel: ORA_DISK_1
channel ORA_DISK_1: sid=37 devtype=DISK
channel ORA_DISK_1: starting datafile copy
input datafile fno=00001 name=/oracle/DEVEL/system01.dbf

output filename=+DATA1/devel/datafile/system.256.583100553 tag=TAG20060222T202229 recid=5 stamp=583100614
channel ORA_DISK_1: datafile copy complete, elapsed time: 00:01:05
channel ORA_DISK_1: starting datafile copy
input datafile fno=00003 name=/oracle/DEVEL/sysaux01.dbf
output filename=+DATA1/devel/datafile/sysaux.257.583100615 tag=TAG20060222T202229 recid=6 stamp=583100652
channel ORA_DISK_1: datafile copy complete, elapsed time: 00:00:45
channel ORA_DISK_1: starting datafile copy
input datafile fno=00005 name=/oracle/DEVEL/example01.dbf
output filename=+DATA1/devel/datafile/example.258.583100661 tag=TAG20060222T202229 recid=7 stamp=583100675
channel ORA_DISK_1: datafile copy complete, elapsed time: 00:00:15
channel ORA_DISK_1: starting datafile copy
input datafile fno=00002 name=/oracle/DEVEL/undotbs01.dbf
output filename=+DATA1/devel/datafile/undotbs1.259.583100677 tag=TAG20060222T202229 recid=8 stamp=583100680
channel ORA_DISK_1: datafile copy complete, elapsed time: 00:00:07
channel ORA_DISK_1: starting datafile copy
input datafile fno=00004 name=/oracle/DEVEL/users01.dbf
output filename=+DATA1/devel/datafile/users.260.583100683 tag=TAG20060222T202229 recid=9 stamp=583100684
channel ORA_DISK_1: datafile copy complete, elapsed time: 00:00:01
channel ORA_DISK_1: starting datafile copy
copying current control file
output filename=+DATA1/devel/controlfile/backup.261.583100685 tag=TAG20060222T202229 recid=10 stamp=583100686
channel ORA_DISK_1: datafile copy complete, elapsed time: 00:00:03
channel ORA_DISK_1: starting full datafile backupset
channel ORA_DISK_1: specifying datafile(s) in backupset
including current SPFILE in backupset
channel ORA_DISK_1: starting piece 1 at 22-FEB-06
channel ORA_DISK_1: finished piece 1 at 22-FEB-06
piece handle=+DATA1/devel/backupset/2006_02_22/nnsnf0_tag20060222t202229_0.262.583100689 tag=TAG20060222T202229 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:03
Finished backup at 22-FEB-06

RMAN>
RMAN> SWITCH DATABASE TO COPY;

datafile 1 switched to datafile copy “+DATA1/devel/datafile/system.256.583100553″
datafile 2 switched to datafile copy “+DATA1/devel/datafile/undotbs1.259.583100677″
datafile 3 switched to datafile copy “+DATA1/devel/datafile/sysaux.257.583100615″
datafile 4 switched to datafile copy “+DATA1/devel/datafile/users.260.583100683″
datafile 5 switched to datafile copy “+DATA1/devel/datafile/example.258.583100661″
RMAN> ALTER DATABASE OPEN;

database opened

SQL> select file_name from dba_data_files;

FILE_NAME
——————————————————————————–
+DATA1/devel/datafile/system.256.583100553
+DATA1/devel/datafile/undotbs1.259.583100677
+DATA1/devel/datafile/sysaux.257.583100615
+DATA1/devel/datafile/users.260.583100683
+DATA1/devel/datafile/example.258.583100661
Move the redo logs to ASM

SQL> select * from v$log;

    GROUP#    THREAD#  SEQUENCE#      BYTES    MEMBERS ARC STATUS
———- ———- ———- ———- ———- — —————-
FIRST_CHANGE# FIRST_TIM
————- ———
         1          1          5  104857600          1 YES INACTIVE
       567335 22-FEB-06

         2          1          6  104857600          1 YES INACTIVE
       567340 22-FEB-06

         3          1          7   52428800          1 NO  CURRENT
       567343 22-FEB-06

SQL> alter database drop logfile group 1;

Database altered.

SQL> alter database add logfile group 1 (’+DATA1′) size 100M;

Database altered.

SQL> alter database drop logfile group 2;

Database altered.

SQL> alter database add logfile group 2 (’+DATA1′) size 100M;

Database altered.
SQL> alter system switch logfile;

System altered.

SQL> select * from v$log;

    GROUP#    THREAD#  SEQUENCE#      BYTES    MEMBERS ARC STATUS
———- ———- ———- ———- ———- — —————-
FIRST_CHANGE# FIRST_TIM
————- ———
         1          1          8  104857600          1 NO  CURRENT
       567349 22-FEB-06

         2          1          6  104857600          1 YES INACTIVE
       567340 22-FEB-06

         3          1          7   52428800          1 YES INACTIVE
       567343 22-FEB-06
SQL> alter database drop logfile group 3;

Database altered.

SQL> alter database add logfile group 3 (’+DATA1′) size 100M;

Database altered.
SQL> select member from v$logfile;

MEMBER
——————————————————————————–
+DATA1/devel/onlinelog/group_3.268.583102251
+DATA1/devel/onlinelog/group_2.267.583102163
+DATA1/devel/onlinelog/group_1.266.583102121
RMAN> BACKUP AS COPY SPFILE FORMAT ‘+DATA1′;

Starting backup at 22-FEB-06
using target database control file instead of recovery catalog
allocated channel: ORA_DISK_1
channel ORA_DISK_1: sid=32 devtype=DISK
channel ORA_DISK_1: starting full datafile backupset
channel ORA_DISK_1: specifying datafile(s) in backupset
including current SPFILE in backupset
channel ORA_DISK_1: starting piece 1 at 22-FEB-06
channel ORA_DISK_1: finished piece 1 at 22-FEB-06
piece handle=+DATA1/devel/backupset/2006_02_22/nnsnf0_tag20060222t211333_0.270.583103615 tag=TAG20060222T211333 comment=NONE
channel ORA_DISK_1: backup set complete, elapsed time: 00:00:02
Finished backup at 22-FEB-06

Now find the spfile in the ASM

ASMCMD> find -t parameterfile +DATA1 *
+DATA1/DEVEL/PARAMETERFILE/spfile.273.583106111

Now make an entry in the pfile, like below
[oracle@RAC2 dbs]$ cat initDEVEL.ora
spfile=’+DATA1/DEVEL/PARAMETERFILE/spfile.273.583106111′
[oracle@RAC2 dbs]$

so now all the  DB files are stored in ASM.

Please let me if you have some questions or doubts.

Share This

The database names used here

database names:

Primary Database SID:       PROD  server RAC1
Duplicate Database SID:     DEVEL server RAC2

Steps involed 
1.  Backup the primary database.

2.  Determine how much disk space will be required.

3.  Ensuring you have enough space on your target server.

4.  Making the backup available for the duplicate process.

5.  Creating the init.ora & administration directories for the duplicate database.

6.  Ensuring SQL*NET connections to primary database and RMAN catalog are working.

7.  Execute the RMAN script

1. Backup the primary database
Before creating a duplicate database, we must create a backup of the production DB including archivelogs also.Here i have used backup media as disk  and i am not using a recovery catalog DB

connect to the target database and take a fresh  backup

[oracle@RAC1 backup]$ export ORACLE_SID=PROD
[oracle@RAC1 backup]$ rman target /

RMAN> run
2> {
3> allocate channel d1 type disk;
4> allocate channel d2 type disk;
5> backup format ‘/oracle/backup/df_prodt%t_s%s_p%p.bak’ database;
6> sql ‘alter system archive log current’;
7> backup format ‘/oracle/backup/df_archive%t_s%s_p%p.arc’ archivelog all
8> release channel d1;
9>  release channel d2;
10> }

2.  Ensure enough space is available on the target server for Db and backup pieces

3.  Ensuring you have enough space on your target server.

4.  Making the backup available for the duplicate process.
     copy  the database from source server to target server

5.Creating the pfile  file  for the duplicate database

create a pfile and add the below contents  and start the DB in nomount mode

[oracle@RAC2 dbs]$ cat initDEVEL.ora
audit_file_dest =/oracle/DEVEL/adump
background_dump_dest =/oracle/DEVEL/bdump
core_dump_dest =/oracle/DEVEL/cdump
user_dump_dest =/oracle/DEVEL/udump
db_name =”DEVEL”
instance_name =DEVEL
control_files =(’/oracle/DEVEL/control01.ctl’)

db_file_name_convert =(”/oracle/PROD/”, “/oracle/DEVEL/”)
log_file_name_convert =(”/oracle/PROD/”, “/oracle/DEVEL/”)

undo_management =AUTO
undo_retention =10800
undo_tablespace =UNDOTBS1
db_block_size = 8192
compatible = 10.2.0.1.0

[oracle@RAC2 dbs]$ export ORACLE_SID=DEVEL
[oracle@RAC2 dbs]$ sqlplus ‘/ as sysdba’

SQL*Plus: Release 10.2.0.1.0 - Production on Sat Feb 18 21:01:50 2006

Copyright (c) 1982, 2005, Oracle.  All rights reserved.

Connected to an idle instance.

SQL> startup nomount
ORACLE instance started.

Total System Global Area  113246208 bytes
Fixed Size                  1218004 bytes
Variable Size              58722860 bytes
Database Buffers           50331648 bytes
Redo Buffers                2973696 bytes

SQL> exit

6.  Ensuring SQL*NET connections to primary database and RMAN catalog are working.

  Add  the conection descriptors in the tnsnames.ora and check the connectivity

7.  Execute the RMAN script
[oracle@RAC2 backup]$ rman target sys/oracle@prod

Recovery Manager: Release 10.2.0.1.0 - Production on Sat Feb 18 21:28:31 2006

Copyright (c) 1982, 2005, Oracle.  All rights reserved.

connected to target database: PROD (DBID=4289561465)

RMAN> connect auxiliary /

connected to auxiliary database: DEVEL (not mounted)
RMAN> run
2> {
3> allocate auxiliary channel C1 device type disk;
4> allocate auxiliary channel C2 device type disk;
5> duplicate target database to DEVEL;
6> release channel C1;
7> release channel C2;
8> }

The above script will do the duplication and it will open up the development database.

Please let me know if you have some doubts or issues.
 

Share This

The policies are present in the XML config file policyIX_config.xml in the location BEA_HOME/ales32-admin/bin.

To export policies from Database to an XML file:

Assume you are running from the location  BEA_HOME/ales32-admin/bin.

./policyIX.sh -export ../config/policyIX_config.xml policies_export.xml -passwdPrompt

-passwdPrompt is optional field and is the OES admin password.

The <export_configuration> element present in policyIX_config.xml specifies which policies, roles, identities etc., to be exported to the file policies_export.xml. If you are interested, open the  policyIX_config.xml and check for the various elements available.

The stuff that gets exported are Organizations, Resources, Policies, Roles, Actions etc.,

To import policies from XML file to the Database:

Assume you are running from the location  BEA_HOME/ales32-admin/bin.

./policyIX.sh -import -disableTransaction ../config/policyIX_config.xml policies_export.xml  -passwdPrompt

disableTransaction is used to prevent loading of policies in single transaction. This is recommended when loading a large policy set. It improves loading performance, but loaded policy data will not be rolled back if the loading fails.

References:

OES Docs

Share This

CP1:

SSM : 7716200

ADMIN : 7716188

DBConfigTool : 7716171

CP2:

SSM : 8393978

ADMIN : 8393965

DBConfigTool : 8393975

CP3 :

Admin Server: 9171320

SSM:  9171016

Note: There is no DBConfigTool released in CP3.

Share This

Oracle has released Oracle SOA Governance 11g(component of Fusion Middleware)  which consists of following sub components

• Oracle Enterprise Repository (single source of truth for SOA assets)
• Oracle Service Registry (UDDI v3 compliant registry)
• Oracle Enterprise Manager Pack Plus for SOA (pack to monitor runtime services)
• Oracle Web Services Manager (tool to secure web services)

For press release about SOA Governance 11g click here

• Two major components released as part of SOA Governance 11g are Oracle Service Registry 11g and Oracle Enterprise Repository 11g
• Oracle SOA Governance 11g supports Oracle Applications including Oracle E-Business Suite and Siebel along with Oracle Application Integration Architecture (AIA).
• Oracle Service Registry 11g software can be downloaded from here (Need Oracle/3rd Party Database)
• Oracle Enterprise Repository 11g can be downloaded from here  (Need Oracle/3rd Party Database and Oracle/3rd Party Application Server)
• For documentation on Oracle Service Registry 11g and Oracle Enterprise Repository 11g click here and go to end of page at OER Guides

Related/References 

• Oracle SOA Governance
• SOA Governance 11g Press Release

Share This