{"id":4285,"date":"2012-09-21T03:07:27","date_gmt":"2012-09-21T07:07:27","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=4285"},"modified":"2012-09-21T03:18:52","modified_gmt":"2012-09-21T07:18:52","slug":"oim-oam-oaam-integration-using-tap-request-flow-you-must-understand","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2012\/09\/21\/oim-oam-oaam-integration-using-tap-request-flow-you-must-understand\/","title":{"rendered":"OIM-OAM-OAAM integration using TAP – Request Flow you must understand !!"},"content":{"rendered":"

This post cover key points and request flow that you must understand when integrating three Oracle Identity Management product OIM<\/strong>, OAM<\/strong>, and OAAM<\/strong><\/p>\n

a) OIM – Oracle Identity Manager
\nb) OAM – Oracle Access Manager
\nc) OAAM – Oracle Adaptive Access Manager<\/p>\n

For an overview of features available by integrating OIM, OAM, and OAAM click here<\/a><\/p>\n

1.<\/strong> OAM can be integrated with OAAM using<\/p>\n

a) Basic<\/strong> – using authentication scheme as OAAMBasic<\/strong> (for OAM 11.1.1.3.0) – works only with 10g webgate<\/strong> and OSSO Agent<\/strong>
\nor
\nb)<\/strong> Advanced<\/strong> – using authentication scheme as OAAMAdvanced<\/strong> (for 11.1.1.3.0) – works with 10g WebGate<\/strong>
\nor
\nc) Advanced with TAP<\/strong> – using authentication scheme as TAP<\/strong> (for 11.1.1.5)- works with 10g<\/strong> and 11g WebGates<\/strong><\/p>\n

where TAP<\/strong> is Trusted Authentication Protocol<\/strong>.<\/p>\n

More on various integration options between OAM<\/strong> & OAAM<\/strong> click here<\/a><\/p>\n

2.<\/strong> Advanced with TAP<\/strong> is recommended option to integrate OAM with OAAM<\/p>\n

3.<\/strong> With OAM-OIM-OAAM integration you additionally get password management flows using OAAM<\/strong> (via KBA<\/strong>).<\/p>\n

4.<\/strong> KBA stands for Knowledge Based Authentication<\/strong> (functionality provided by OAAM) and with OIM-OAAM integration, KBA is used as
\na)<\/strong> Second factor authentication for change password
\nb)<\/strong> First authentication for forgot password<\/p>\n

5.<\/strong> When you integrate OAM , OIM, and OAAM using advanced integration, this is what happens when user try to access OIM screens (or resource protected by TAP Scheme)<\/p>\n

a)<\/strong> OAM checks URL is protected by TAP Scheme<\/strong> and as user is not authenticated yet<\/strong> so user is redirected to OAAM login page<\/p>\n

(This is because URL is protected by TAP scheme and TAP authentication scheme redirects user to OAAM server for login)<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

b)<\/strong> OAM (based on challenge URL defined in TAP scheme) forwards request to OAAM<\/strong> Server<\/p>\n

c)<\/strong> OAAM server presents user with username page where user submits his username<\/p>\n

\"\"<\/a><\/p>\n

d)<\/strong> OAAM records (fingerprints<\/strong>) user device and runs pre-authentication<\/strong> rules before showing password page to user<\/p>\n

\"\"<\/a><\/p>\n

Note: Device fingerprint is mechanism where where OAAM recognises what device user logs in with like Desktop, Laptop, PDA, Cell Phone, web bases device, etc<\/span><\/p>\n

e) Virtual Authenticator Device<\/strong> (VAD) rules are run during Authentication Pad checkpoint<\/strong> and decides which Virtual Authenticator device to display for password page<\/p>\n

f) At this stage<\/strong>
\n— i) For registered user<\/strong>\u00a0in OAAM, Password page with personalised TestPad\/KeyPad is displayed<\/p>\n

\"\"<\/a>
\n<\/a><\/p>\n

— ii) a- For unregistered users<\/strong> (in OAAM) password page with generic TextPad is displayed follow section for first time logon<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

ii b)<\/strong> -: For unregistered users login for first time, system presents user to reset password on first logon. System also presents user with option to set challenge question (KBA), image on virtual device , phrase on virtual device.<\/p>\n

\"\"<\/a><\/p>\n

g)<\/strong> OAAM collects username\/passwordand then sends NAP API call for Authentication to OAM<\/p>\n

h)<\/strong> OAM makes a ldap call to OID (identity store configured with OAM). More on OAM identity store configuration (steps mentioned here are manual integration)\u00a0here<\/a> and\u00a0here<\/a><\/p>\n

Note: Oracle Internet Directory (OID) is LDAP compliant store from Oracle to store enterprise users<\/span>.<\/p>\n

i)<\/strong> After successful authentication OAM issues TAP token<\/strong> to OAAM<\/p>\n

j)<\/strong> OAAM then executes post authentication<\/strong> rules<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

based on rule\/risk<\/strong> could present user with second authentication (KBA<\/strong> or OTP<\/strong>)<\/p>\n

\"\"<\/a><\/p>\n

Note: Knowledge Based Authentication (KBA) and One Time Password (OTP) are features available in OAAM. OTP by default is disabled in OAAM<\/span><\/p>\n

k)<\/strong> OAAM then sets the OAM cookie and redirects user to resource requested in step a)<\/strong><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

 <\/p>\n

Related<\/strong><\/span><\/p>\n