{"id":2773,"date":"2011-11-23T19:00:30","date_gmt":"2011-11-23T23:00:30","guid":{"rendered":"http:\/\/onlineappsdba.com\/index.php\/2011\/11\/23\/idmconfigtool-oimoamfusionapps-integration-preconfigidstore-prepareidstore-configoam-configoim\/"},"modified":"2011-11-24T15:04:54","modified_gmt":"2011-11-24T19:04:54","slug":"idmconfigtool-oimoamfusionapps-integration-preconfigidstore-prepareidstore-configoam-configoim","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2011\/11\/23\/idmconfigtool-oimoamfusionapps-integration-preconfigidstore-prepareidstore-configoam-configoim\/","title":{"rendered":"IdmConfigTool : OIM\/OAM\/FusionApps Integration – preConfigIDStore, prepareIDStore, configOAM, configOIM"},"content":{"rendered":"

If you are integrating OIM with OAM or installing\u00a0Oracle Fusion Applications<\/a>\u00a0then you must read this post carefully.<\/p>\n

This post covers overview of idmConfigTool<\/strong> (used extensively in Fusion Applications and OIM-OAM integration) and options available including what happens behind the scenes.<\/p>\n

Here are acronyms used in this post<\/p>\n

ACL<\/strong> – Access Control List
\nAD<\/strong> – Active Directory
\nCSF<\/strong> – Credential Store Framework
\nIAM<\/strong> – Identity and Access Management (OIM & OAM)
\nIDM<\/strong> – Identity Management (OID, OVD, OIF)
\nLDAP<\/strong> – Lightweight Directory Access Protocol
\nOAM<\/strong> – Oracle Access Manager
\nOID<\/strong> – Oracle Internet Directory
\nOIF <\/strong>– Oracle Identity Federation
\nOIM<\/strong> – Oracle Identity Manager
\nOVD<\/strong> – Oracle Virtual Directory
\nWLST<\/strong> – WebLogic Scripting Tool<\/p>\n

 <\/p>\n

idmConfigTool<\/strong> (.sh <\/strong>for Unix\/Linux and .bat<\/strong> for Windows) is tool to configure Oracle Identity Management components that prepare LDAP Server (OID, OVD or AD) so that OIM can be integrated with OAM and also used to prepare Oracle Identity Management for Oracle Fusion Applications.<\/p>\n

 <\/p>\n

IdmConfigTool <\/strong>(.sh or .bat) is available in IAM ORACLE_HOME<\/strong>\/idmtools\/bin (where IAM ORACLE_HOME is directory in which OIM<\/strong> and OAM <\/strong>are installed). Note<\/strong>: This IAM ORACLE HOME is different from ORACLE_HOME that contains OID\/OVD\/OIF binaries<\/font>.<\/p>\n

 <\/p>\n

Key points in OIM\/OAM integration – idmConfigTool.sh (bat)<\/u><\/strong> ?<\/p>\n

1. <\/strong>idmConfigTool from $IDAM_ORACLE_HOME\/idmtools\/bin is main utility which prepares LDAP server so that OIM\/OAM products can be integrated (creating users, groups, extending OID attributes and objectless, more on OID objects here<\/a>\u00a0). idmConfigTool is also used to extend objects required in OID to install Fusion Applications.<\/p>\n

2.<\/strong> When you run idmConfigTool.sh<\/strong> (bat) , it creates or appends to file idmDomainConfig.param<\/strong> hence this tool must be run from same directory always (so that idmDomainConfig.param<\/strong> is updated properly). (idmDomainConfig.param is used during Fusion Applications Provisioning<\/font>)<\/p>\n

3.<\/strong>\u00a0idmConfigTool.sh (bat) creates or appends to log file automation.log<\/strong>\u00a0. After each execution of idmConfigTool, verify that there are no error messages in automation.log<\/strong>\u00a0(Error message during idmConfigTool<\/strong> are not reported on screen but are logged in automation.log<\/strong>)<\/p>\n

4.<\/strong>\u00a0variable IAM _ORACLE_HOME<\/strong> should point to ORACLE_HOME in which OIM\/OAM is installed where as IDM_ORACLE_HOME<\/strong> should point to ORACLE_HOME directory in which OID\/OVD is installed.<\/p>\n

5.<\/strong> idmConfigTool (in current version) supports only simple LDAP <\/strong>connection. i.e. LDAPS <\/strong>(secure)\u00a0is NOT supported.<\/p>\n

6.<\/strong> Options with\u00a0 idmConfigTool.sh (bat) are: –configPolicyStore<\/strong>, –preConfigIDStore<\/strong>, –prepareIDStore<\/strong>, –configOAM<\/strong>, –configOIM<\/strong>, –upgradeLDAPUsersForSSO<\/strong><\/p>\n

a) configPolicyStore<\/strong> – This will create group two groups and two users in LDAP Server
\ni)\u00a0OrclPolicyAndCredentialReadPrivilegeGroup<\/strong> (user\u00a0PolicyROUser<\/strong> as its member)
\nii)\u00a0OrclPolicyAndCredentialReadPrivilegeGroup <\/strong>(user\u00a0PolicyRWUser <\/strong>as its member)<\/p>\n

You can then migrate Policy and Credential store of Fusion Middleware from XML file<\/strong> to LDAP Server using reassociateSecurityStore<\/strong> (WLST) or from EM Console<\/strong> (\/em) .<\/p>\n

 <\/p>\n

Policy store contains application specific roles where as Credential Store contains system accounts (including password and certificates) that are used internally to communicate between components (OracleBISystem user in OBIEE or SOA User in OIM are two such accounts stored in credential). More on Policy and Credential Store<\/font>\u00a0here<\/a><\/p>\n

 <\/p>\n

b) preConfigIDStore<\/strong> – This will create<\/p>\n

i)<\/strong> group orclFAUserReadPrivilegeGroup, orclFAUserWritePrivilegeGroup, orclFAUserWritePrefsPrivilegeGroup, orclFAGroupReadPrivilegeGroup, orclFAGroupWritePrivilegeGroup<\/p>\n

ii) <\/strong>Create password policy for OIM admin user & Fusion Applications<\/p>\n

iii)<\/strong> add object class specific to Fusion Applications in LDAP server<\/p>\n

 <\/p>\n

c) prepareIDStore<\/strong> – depending on mode used (OAM<\/strong>, OIM<\/strong>, WLS<\/strong>, fusion<\/strong>, all<\/strong>) will create object in LDAP Server<\/p>\n

i) mode=OAM<\/strong> – This will<\/p>\n

— create user OblixAnonymous<\/strong>, oamadmin<\/strong>, oamLDAP
\n<\/strong>— Set ACL on user objects
\n–Add PolicyStore user\u00a0 to group “cn=OID Schema Admin, cn=groups, dc=OracleContext”<\/p>\n

Note: oamadmin<\/strong> is used to login to oamconsole<\/strong> where as oamLDAP <\/strong>is used to connect from OAM to Identity Store for authentication<\/font><\/p>\n

 <\/p>\n

ii) mode=OIM<\/strong> –\u00a0This will
\n–create group OIMAdministrators<\/strong> and user oimLDAP <\/strong>as its member
\n–create container cn=reserve
\n–creates user xelsysadm<\/strong> (this is superuser in OIM)<\/p>\n

iii) mode=WLS<\/strong> – This will create group IDM Administrators<\/strong>\u00a0and user weblogic_idm<\/strong> as its member<\/p>\n

 <\/p>\n

d) configOAM<\/strong> – This will<\/p>\n

i)<\/strong> create an WebGate instance in OAM and generate output files in $DOMAIN_HOME\/output\/<WebGateName><\/p>\n

ii)<\/strong> Create Identity store pointing to OID and migrate default identity store of OAM from weblogic embedded LDAP server to OID<\/p>\n

 <\/p>\n

e) configOIM<\/strong> – This will create<\/p>\n

— Three providers in security realm of WebLogic domain (OIDAuthenticator<\/strong>, OAMIDAsserter<\/strong>, OIMSignatureAuthenticator<\/strong>)
\n— Create credentials in CSF (containing credentials for OIM to connect to OAM)
\n— Updates configuration in MDS (details of OAM server)<\/p>\n

.<\/p>\n

References<\/u><\/strong><\/p>\n

 <\/p>\n