{"id":4884,"date":"2013-01-05T14:51:04","date_gmt":"2013-01-05T18:51:04","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=4884"},"modified":"2013-01-05T14:51:04","modified_gmt":"2013-01-05T18:51:04","slug":"oracle-privileged-account-manager-opam-installation-and-configuration","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2013\/01\/05\/oracle-privileged-account-manager-opam-installation-and-configuration\/","title":{"rendered":"Oracle Privileged Account Manager (OPAM) Installation and Configuration"},"content":{"rendered":"

\"\"<\/a><\/p>\n

 <\/p>\n

Oracle Privileged Account Manager<\/strong> (OPAM) is a new product introduced in Oracle Identity Management 11gR2<\/strong> (More on IdM 11gR2 \u00a0here<\/a>, here<\/a>, and here<\/a>. For new features in IdM 11gR2 click here<\/a>,\u00a0here<\/a>, and here<\/a>\u00a0). OPAM server is part of Oracle Identity Governance Suite<\/strong> and topic 13 of\u00a0certification Identity Governance Suite 11g Essentials<\/a><\/p>\n

OPAM<\/strong> is password management tool<\/strong> that manages access to passwords for privileges shared accounts<\/strong> (like root<\/strong> user on Unix<\/strong> or application super user or user with sysdba or dba access in database ) . OPAM supports check-out<\/strong> and check-in<\/strong> of password and can be configured to automatically change the password on check-in<\/strong>.<\/p>\n

 <\/p>\n

This post covers steps to install and configure OPAM<\/strong>.<\/p>\n

Note:<\/strong> If you install OIM and OPAM in same domain you could face issue finding user in OINAV (Identity Navigator)<\/span>. Check more in Release Notes\u00a0here<\/a><\/p>\n

 <\/p>\n

High Level Installation and configure OPAM 11gR2 (11.1.2)<\/strong><\/span><\/p>\n

1.<\/strong> Create Schema for OPAM using RCU 11.1.2 , More on RCU\u00a0here<\/a><\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

2.<\/strong> Install JDK 1.6.29 (or higher)<\/p>\n

3.<\/strong> Install WebLogic 10.3.6, more on WebLogic installation here<\/a> and\u00a0here<\/a><\/p>\n

4.<\/strong> Install Identity & Access Management 11gR2 (11.1.2) software under middleware home (created during WebLogic installation) using runInstaller -jreLoc [jdk_location]<\/span><\/strong><\/p>\n

5.<\/strong> Create WebLogic Domain<\/strong>\u00a0by running $MW_HOME\/ oracle_common\/ common\/ bin\/\u00a0config.sh<\/strong> \u00a0, More on WebLogic Domain\u00a0here<\/a> and\u00a0here<\/a><\/p>\n

Note<\/strong>: During Domain creation select Oracle Privileged Account Manager<\/strong> template\u00a0<\/span><\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

Note: OPAM will be deployed under managed server opam_server1 running on port 18101 and 18102 (non SSL port)<\/span><\/strong><\/p>\n

6.<\/strong> Configure Database Security Store<\/strong> for OPAM Domain using\u00a0ORACLE_COMMON_HOME\/ common\/ bin\/ wlst.sh<\/strong> $ORACLE_HOME\/common\/tools\/configureSecurityStore.py<\/strong> -d \u00a0$DOMAIN_HOME -c IDM -m create -p opss_schema_password<\/p>\n

More here<\/a><\/p>\n

This step will migrate policy & credential store from XML file (and files) to database under OPSS schema.<\/span><\/strong><\/p>\n

Note<\/strong>: In 11gR1 you could keep policy store to XML, OID, or in Database . From 11gR2 onwards policy store must be migrated to Database under OPSS Schema.<\/span><\/span><\/p>\n

7.<\/strong> Start WebLogic Admin Server<\/strong> for OPAM domain. More on WebLogic Admin Server<\/strong> startup\u00a0here<\/a><\/p>\n

\"\"<\/a><\/p>\n

8.<\/strong> Configure OPAM by running $ORACLE_HOME\/opam\/bin\/opam-config.sh<\/strong>\u00a0More here<\/a><\/p>\n

9.<\/strong> Assign Application Configurator Role<\/strong> to User from OINNAV (This user will be used to configure OPAM server in OPAM web console<\/span>) http:\/\/<adminserver-host>:<adminserver-port>\/oinav \u00a0 \u00a0\u00a0Steps here<\/a><\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

If in OINAV you don’t see any users then check Admin Server log file and if you see errors like below then check\u00a0Release Notes<\/a><\/p>\n

Error message in logs when OIM and OPAM\/OIN are in same domain<\/p>\n

_____<\/p>\n

<Jan 2, 2013 9:35:51 PM UTC> <Error> <com.oracle.ovd.arisid.IdentityStoreConfig> <BEA-000000> <Failed to get IdentityStore properties from OPSS – org.openliberty.arisid.IGFException><\/span>
\n java.lang.NullPointerException<\/span>
\n at com.oracle.ovd.arisid.ArisIdStackProvider.doFind(ArisIdStackProvider.java:153)<\/span>
\n_____<\/p>\n

 <\/p>\n

10.<\/strong> Start OPAM Managed Server and ensure that it is running<\/p>\n

\"\"<\/a><\/p>\n

11.<\/strong> Configure OPAM console and update OPAM server details \u00a0http:\/\/<adminserver-host>:<adminserver-port>\/oinav\/opam<\/strong><\/p>\n

\"\"<\/a><\/div>\n
<\/div>\n
Note<\/strong>: If you see invalid connection during OPAM server configuration , check Admin Server logs and<\/div>\n
\n

a) Ensure that OPAM managed server is running
\nb) SSL certificate is valid<\/strong> or disable host name verification <\/strong>in Admin and OPAM server<\/p>\n

<Jan 3, 2013 11:35:33 PM UTC> <Warning> <Security> <BEA-090482> <BAD_CERTIFICATE alert was received from innowave21.focusthread.com – 81.142.109.132. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.><\/span><\/p>\n<\/div>\n

<\/div>\n
This completes OPAM installation and configuration<\/div>\n
<\/div>\n
<\/div>\n

References\/Related<\/strong><\/span><\/p>\n