An interview on OpenSSO's identity services

Read a new interview article on SDN starring Aravindan Ranganathan, software architect: "From the Trenches at Sun Identity, Part 6: Identity Services for Securing Web Applications" at http://developers.sun.com/identity/reference/techart/identity-services.html. You'll learn the reasons why OpenSSO's identity services are an ideal architecture for protecting applications from unauthorized access, the related tasks, the benefits, and the plans for integrating identity services with the federation capability in OpenSSO.

Sprint would be the best source of information on how their service works.

Similar Messages

How to create a user in Opensso Identity Service Webservices api?

Hi All,
I am getting struck with the creation of user in OpenSSO through the webservices api they are providing.
I used the following wsdl link to create the API's. http://localhost:8080/opensso/identityservices?WSDL
Now my requirement is, i have to create a user profile through the program which has the api create(identity,admin) created by the WSDL link.
Here identity is the com.sun.idsvcs.IdentityDetails and admin is the com.sun.idsvcs.Token. I want to append givenName,cn,sn,userPassword in that. But dont have any idea how to given these details in IdentityDetails. If anyone give any sample solution i can follow.
Any Help Greatly Appreciated.
Thanks in Advance.
With Regards,
Nithya.

Hey, I've managed to implement OpenSSO user registration through SOAP.
My code is:
package ru.vostrets.service.implementation.helper.opensso;
import ru.vostrets.model.person.Person;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import ru.vostrets.dao.PropertiesDao;
import ru.vostrets.exception.FatalError;
import com.sun.identity.idsvcs.opensso.*;
import java.util.HashMap;
import java.util.Map;
import org.slf4j.LoggerFactory;
import org.slf4j.Logger;
import ru.vostrets.exception.ConfigurationError;
* @author Kuchumov Nikolay
* email: [email protected]
@Service
public class OpenSsoPersonServiceHelper
     private enum AttributeName
          USER_NAME("uid"),
          PASS_WORD("userpassword"),
          GIVEN_NAME("givenname"),
          FAMILY_NAME("sn"),
          FULL_NAME("cn"),
          EMAIL("mail");
          private final String name;
          AttributeName(String name)
               this.name = name;
          public String getName()
               return name;
     private static final Logger LOG = LoggerFactory.getLogger(OpenSsoPersonServiceHelper.class);
     private PropertiesDao propertiesDao;
     public void create(Person person)
          try
               IdentityServicesImplService service = new IdentityServicesImplService();
               IdentityServicesImpl servicePort = service.getIdentityServicesImplPort();
               java.util.List<java.lang.String> attributeNames = null;
               Token subject = new Token();
               subject.setId(request.getParameter("token"));
               UserDetails results = servicePort.attributes(attributeNames, subject);
               for (Attribute attribute : results.getAttributes())
                    LOG.info("************ Attribute: Name = " + attribute.getName() + ", Values = " + attribute.getValues());
               LOG.info("Roles = " + results.getRoles());
               IdentityDetails identity = newIdentity
                         person.getCredentials().getUserName(),
                         getAttributes(person)
                * Creates an identity object with the specified attributes.
                * @param admin Token identifying the administrator to be used to authorize
                * the request.
                * @param identity object containing the attributes of the object
                * to be created.
                * @throws NeedMoreCredentials when more credentials are required for
                * authorization.
                * @throws DuplicateObject if an object matching the name, type and
                * realm already exists.
                * @throws TokenExpired when subject's token has expired.
                * @throws GeneralFailure on other errors.
               servicePort.create
                         identity,
                         authenticateAdministrator()
          catch (DuplicateObject_Exception exception)
               throw new UserAlreadyExistsError();
          catch (Exception exception)
               //GeneralFailure_Exception
               //NeedMoreCredentials_Exception
               //TokenExpired_Exception
               throw new FatalError(exception);
     private Token authenticateAdministrator()
          try
               IdentityServicesImplService service = new IdentityServicesImplService();
               IdentityServicesImpl servicePort = service.getIdentityServicesImplPort();
               if (propertiesDao.get().getAuthentication().getOpenSso().getAdministrator().getUserName() == null
                         || propertiesDao.get().getAuthentication().getOpenSso().getAdministrator().getPassWord() == null)
                    throw new ConfigurationError("OpenSSO administration properties not initialized");
                * Attempt to authenticate using simple user/password credentials.
                * @param username Subject's user name.
                * @param password Subject's password
                * @param uri Subject's context such as module, organization, etc.
                * @return Subject's token if authenticated.
                * @throws UserNotFound if user not found.
                * @throws InvalidPassword if password is invalid.
                * @throws NeedMoreCredentials if additional credentials are needed for
                * authentication.
                * @throws InvalidCredentials if credentials are invalid.
                * @throws GeneralFailure on other errors.
               Token token = servicePort.authenticate
                         propertiesDao.get().getAuthentication().getOpenSso().getAdministrator().getUserName(),
                         propertiesDao.get().getAuthentication().getOpenSso().getAdministrator().getPassWord(),
               LOG.info("******************************** Admin token: " + token.getId());
               return token;
          catch (Exception exception)
               throw new FatalError(exception);
          com.sun.identity.idsvcs.opensso.IdentityServicesImplService service = new com.sun.identity.idsvcs.opensso.IdentityServicesImplService();
          QName portQName = new QName("http://opensso.idsvcs.identity.sun.com/" , "IdentityServicesImplPort");
          String request = "<authenticate xmlns=\"http://opensso.idsvcs.identity.sun.com/\"><username>ENTER VALUE</username><password>ENTER VALUE</password><uri>ENTER VALUE</uri></authenticate>";
          try
               // Call Web Service Operation
               Dispatch<Source> sourceDispatch = null;
               sourceDispatch = service.createDispatch(portQName, Source.class, Service.Mode.PAYLOAD);
               Source result = sourceDispatch.invoke(new StreamSource(new StringReader(request)));
          catch (Exception exception)
               // TODO handle custom exceptions here
     private Attribute newAttribute(AttributeName name, Object value)
          Attribute attribute = new Attribute();
          attribute.setName(name.getName());
          attribute.getValues().add(value.toString());
          return attribute;
     private Map<AttributeName, Object> fillAttributes(Map<AttributeName, Object> attributes, Person person)
          attributes.put(AttributeName.USER_NAME, person.getCredentials().getUserName());
          attributes.put(AttributeName.PASS_WORD, person.getCredentials().getPassWord());
          attributes.put(AttributeName.GIVEN_NAME, person.getPersonal().getGivenName());
          attributes.put(AttributeName.FAMILY_NAME, person.getPersonal().getFamilyName());
          attributes.put(AttributeName.FULL_NAME, person);
          attributes.put(AttributeName.EMAIL, person.getContacts().getEmail());
          return attributes;
     private Map<AttributeName, Object> getAttributes(Person person)
          return fillAttributes(new HashMap<AttributeName, Object>(), person);
     private IdentityDetails newIdentity(Object name, Map<AttributeName, Object> attributes)
          IdentityDetails identity = new IdentityDetails();
          identity.setName(name.toString());
          return fillAttributes(identity, attributes);
     private IdentityDetails fillAttributes(IdentityDetails identity, Map<AttributeName, Object> rawAttributes)
          for (Map.Entry<AttributeName, Object> rawAttribute : rawAttributes.entrySet())
               identity.getAttributes().add(
                         newAttribute(rawAttribute.getKey(), rawAttribute.getValue()));
          return identity;
     @Autowired
     public void setPropertiesDao(PropertiesDao propertiesDao)
          this.propertiesDao = propertiesDao;
}

Download location of Oracle OpenSSO Security Token Service

I am not finding the war file for Oracle OpenSSO Security Token Service, where can I download it from? The docs say that it is part of OpenSSO server but I dont find that in oracle_opensso_80U2.zip also. Please let me know where can I get it from?

http://download.oracle.com/otn/nt/middleware/11g/oracle_openssosts_11gr1.zip
Just so you know, Oracle has released its Oracle STS server as part of the 11.1.1.5 distribution of Identity and Access Management as well.

Issue in setting custom identity service for soa 11.1.1.4

Hello,
I am facing issue in setting custom identity service for soa 11.1.1.4
It is not picking up the implemented UserManager (in custom IDM) implemented via ServiceProvider and IdentityStoreService.
This is configured in jps-config.xml
The same setup was working in soa 11.1.1.2
I believe there is a change done in JpsProvider in bpm-service.jar to authenticate via default login context from oracle.security.jps.internal.jaas.module.authentication.JpsUserAuthenticationLoginModule
If my uderstanding is correct,
Please guide me in implementing custom identity store and services for bpm services for soa 11.1.1.4
Tried various work arounds but no luck.
Thanks
Bala

Hi...
Can u tell me how did u set up custom identity service for 11.1.1.2 ?
Thanks

Custom Identity Service configuration in SOA Suite 11g

Has anyone been successfull in using custom identity service (available in 10.1.3.X) as a identity store in soa suite 11g human workflow component? If yes, please guide me.

Can you make sure your helloworld is using adf bindings as mentioned in thread Re: Urgent :: 11g Invoking Composite from Java/From Webservice Proxy

Ask the Expert: Integrating Cisco Identity Service Engine (ISE) 1.2 for BYOD

With Eric Yu and Todd Pula
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about integrating Cisco ISE 1.2 for BYOD with experts Eric Yu and Todd Pula.
Cisco Bring Your Own Device (BYOD) is an end-to-end architecture that orchestrates the integration of Cisco's mobile and security architectures to various third-party components. The session takes a deep dive into the available tools and methodologies for troubleshooting the Cisco BYOD solution to identify root causes for problems that stem from mobile device manager integration, Microsoft Active Directory and certificate authority services, and Cisco Enterprise Mobility integration to the Cisco Identity Services Engine (ISE).
Todd and Eric recently delivered a technical workshop that helps network designers and network engineers understand integration of the various Cisco BYOD components by taking a deep dive to analyze best practice configurations and time-saving troubleshooting methodologies. The content consisted of common troubleshooting scenarios in which TAC engineers help customers address operational challenges as seen in real Cisco BYOD deployments.
Eric Yu is a technical leader at Cisco responsible for supporting our leading-edge borderless network solutions. He has 10 years of experience in the telecommunications industry designing data and voice networks. Previous to his current role, he worked as a network consulting engineer for Cisco Advance Services, responsible for designing and implementing Cisco Unified Communications for Fortune 500 enterprises. Before joining Cisco, he worked at Verizon Business as an integration engineer responsible for developing a managed services solution for Cisco Unified Communications. Eric holds CCIE certification in routing and switching no. 14590 and has two patents pending related to Cisco's medianet.
Todd Pula is a member of the TAC Security and NMS Technical Leadership team supporting the ISE and intrusion prevention system (IPS) product lines. Todd has 15 years of experience in the networking and information security industries, with 6 years of experience working in Cisco's TAC organization. Previous to his current role, Todd was a TAC team lead providing focused technical support on Cisco's wide array of VPN products. Before joining Cisco, he worked at Stanley Black & Decker as a network engineer responsible for the design, configuration, and support of an expansive global network infrastructure. Todd holds his CCIE in routing and switching no. 19383 and an MS degree in IT from Capella University.
Remember to use the rating system to let Eric and Todd know if you have received an adequate response.
Because of the volume expected during this event, Eric and Todd might not be able to answer every question. Remember that you can continue the conversation in the Security community, subcommunity AAA, Identity and NAC, shortly after the event. This event lasts through November 15, 2013. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi Antonio,
Many great questions to start this series. For the situation that you are observing with your FlexConnect configuration, is the problem 100% reproducible or is it intermittent? Does the problem happen for one WLAN but not another? As it stands today, the CoA-Ack needs to be initiated by the management interface. This limitation is documented in bug CSCuj42870. I have provided a link for your reference below. If the problem happens 100% of the time, the two configuration areas that I would check first include:
On the WLC, navigate to Security > RADIUS > Authentication. Click on the server index number for the associated ISE node. On the edit screen, verify that the Support for RFC 3576 option is enabled.
On the WLC, navigate to the WLANs tab and click on the WLAN ID for the WLAN in question. On the edit screen, navigate to Security > AAA and make sure the Radius Server Overwrite interface is unchecked. When this option is checked, the WLC will attemp to send client authentication requests and the CoA-Ack/Nak via the dynamic interface assigned to the WLAN vs. the management interface. Because of the below referenced bug, all RADIUS packets except the CoA-Ack/Nak will actually be transmitted via the dynamic interface. As a general rule of thumb, if using the Radius NAC option on a WLAN, you should not configure the Radius Server Overwrite interface feature.
Bug Info: https://tools.cisco.com/bugsearch/bug/CSCuj42870
For your second question, you raise a very valid point which I am going to turn into a documentation enhancement request. We don't currently have a document that lists the possible supplicant provisioning wizard errors that may be encountered. Please feel free to post specific errors that you have questions about in this chat and we will try to get you answers. For most Android devices, the wizard log file can be found at /sdcards/downloads/spw.log.
As for product roadmap questions, we won't be able to discuss this here due to NDA. Both are popular asks from the field so it will be interesting to see what the product marketing team comes up with for the next iterration of ISE.
Related Info:
Wireless BYOD for FlexConnect Deployment Guide

Not Working-central web-authentication with a switch and Identity Service Engine

on the followup the document "Configuration example : central web-authentication with a switch and Identity Service Engine" by Nicolas Darchis, since the redirection on the switch is not working, i'm asking for your help...
I'm using ISE Version : 1.0.4.573 and WS-C2960-24PC-L w/software 12.2(55)SE1 and image C2960-LANBASEK9-M for the access.
The interface configuration looks like this:
interface FastEthernet0/24
switchport access vlan 6
switchport mode access
switchport voice vlan 20
ip access-group webauth in
authentication event fail action next-method
authentication event server dead action authorize
authentication event server alive action reinitialize
authentication order mab
authentication priority mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
spanning-tree portfast
end
The ACL's
Extended IP access list webauth
    10 permit ip any any
Extended IP access list redirect
    10 deny ip any host 172.22.2.38
    20 permit tcp any any eq www
    30 permit tcp any any eq 443
The ISE side configuration I follow it step by step...
When I conect the XP client, e see the following Autenthication session...
swlx0x0x#show authentication sessions interface fastEthernet 0/24
           Interface: FastEthernet0/24
          MAC Address: 0015.c549.5c99
           IP Address: 172.22.3.184
            User-Name: 00-15-C5-49-5C-99
               Status: Authz Success
               Domain: DATA
       Oper host mode: single-host
     Oper control dir: both
        Authorized By: Authentication Server
           Vlan Group: N/A
     URL Redirect ACL: redirect
         URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
      Session timeout: N/A
         Idle timeout: N/A
    Common Session ID: AC16011F000000490AC1A9E2
      Acct Session ID: 0x00000077
               Handle: 0xB7000049
Runnable methods list:
       Method   State
       mab      Authc Success
But there is no redirection, and I get the the following message on switch console:
756005: Mar 28 11:40:30: epm-redirect:IP=172.22.3.184: No redirection policy for this host
756006: Mar 28 11:40:30: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
I have to mention I'm using an http proxy on port 8080...
Any Ideas on what is going wrong?
Regards
Nuno

OK, so I upgraded the IOS to version
SW Version: 12.2(55)SE5, SW Image: C2960-LANBASEK9-M
I tweak with ACL's to the following:
Extended IP access list redirect
    10 permit ip any any (13 matches)
and created a DACL that is downloaded along with the authentication
Extended IP access list xACSACLx-IP-redirect-4f743d58 (per-user)
    10 permit ip any any
I can see the epm session
swlx0x0x#show epm session ip 172.22.3.74
     Admission feature: DOT1X
     ACS ACL: xACSACLx-IP-redirect-4f743d58
     URL Redirect ACL: redirect
     URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
And authentication
swlx0x0x#show authentication sessions interface fastEthernet 0/24
     Interface: FastEthernet0/24
     MAC Address: 0015.c549.5c99
     IP Address: 172.22.3.74
     User-Name: 00-15-C5-49-5C-99
     Status: Authz Success
     Domain: DATA
     Oper host mode: multi-auth
     Oper control dir: both
     Authorized By: Authentication Server
     Vlan Group: N/A
     ACS ACL: xACSACLx-IP-redirect-4f743d58
     URL Redirect ACL: redirect
     URL Redirect: https://ISE-ip:8443/guestportal/gateway?sessionId=AC16011F000000510B44FBD2&action=cwa
     Session timeout: N/A
     Idle timeout: N/A
     Common Session ID: AC16011F000000160042BD98
     Acct Session ID: 0x0000001B
     Handle: 0x90000016
     Runnable methods list:
     Method   State
     mab      Authc Success
on the logging, I get the following messages...
017857: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_qualify ...
017858: Mar 29 11:27:04: epm-redirect:epm_redirect_cache_gen_hash: IP=172.22.3.74 Hash=271
017859: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: CacheEntryGet Success
017860: Mar 29 11:27:04: epm-redirect:IP=172.22.3.74: Ingress packet on [idb= FastEthernet0/24] matched with [acl=redirect]
017861: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Enqueue the packet with if_input=FastEthernet0/24
017862: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: In epm_host_ingress_traffic_process ...
017863: Mar 29 11:27:04: epm-redirect:IDB=FastEthernet0/24: Not an HTTP(s) packet
What I'm I missing?

Integration of custom identity services with JDeveloper BPEL designer

Hi,
I'd like to know if a custom user repository plugin will cause the 'Identity Lookup Dialog' (Step 6 of Human Workflow Wizard to generate a user task) to utilize the list of users and groups from a third party provider, when used as the Custom Identity Service provider.
I'd like to have the custom list of users and groups at 'design time' of the BPEL process itself, as well as process runtime. Is this possible?
This is with respect to both BPEL PM v10.2.0.2 and v 10.1.3.1.0.
Regards,
Vineet

ok, thank you for the reply.
But the installation of the Oracle BPEL Process Manger for Developers which includes the JDeveloper and the BPEL Designer doesn't come with 10.1.3.1.0?
I have to install the JDeveloper and the BPEL Process Manager seperate?
Thx

[Urget Help] [BPEL 11g] How to use Database 11g as Identity Service source?

Dear all,
My customer is using BPEL 11g for current project. They have a legacy user database (Oracle DB 11g) which store all accounts info.
Now we want to connect BPEL with this database as identity service and pick up the users and groups as approver. I saw following graph from below link, but I don't know how to implement it. It seems a huge change in BPEL 11g.
Can you give me an idea on it? Any suggestions are welcome.
http://download.oracle.com/docs/cd/E12839_01/integration.1111/e10224/bp_workflow.htm#BABEIHDD
Thanks in advance.

repost

Cisco Identity Services Engine (ISE) Version 1.2: What's New in Features and Troubleshooting Options

With Ali Mohammed
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about what’s new in Cisco Identity Services Engine (ISE) Version 1.2 and to understand the new features and enhanced troubleshooting options with Cisco expert Ali Mohammed.
Cisco ISE can be deployed as an appliance or virtual machine to enforce security policy on all devices that attempt to gain access to network infrastructure. ISE 1.2 provides feature enrichment in terms of mobile device management, BYOD enhancements, and so on. It also performs noise suppression in log collection so customers have greater ability to store and analyze logs for a longer period.
Ali Mohammed is an escalation engineer with the Security Access and Mobility Product Group (SAMPG), providing support to all Cisco NAC and Cisco ISE installed base. Ali works on complicated recreations of customer issues and helps customers in resolving configuration, deployment, setup, and integration issues involving Cisco NAC and Cisco ISE products. Ali works on enhancing tools available in ISE/NAC that are required to help troubleshoot the product setup in customer environments. Ali has six and a half years of experience at Cisco and is CCIE certified in security (number 24130).
Remember to use the rating system to let Ali know if you have received an adequate response.
Because of the volume expected during this event, Ali might not be able to answer each question. Remember that you can continue the conversation on the Security community, sub-community shortly after the event. This event lasts through September 6, 2013. Visit this forum often to view responses to your questions and the questions of other community members.

Hi Ali,
We currently have a two-node deployment running 1.1.3.124, as depicted in diagram:
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_010.html#ID89
Question 1:
After step 1 is done, node B becomes the new primary node.
What's the license impact at that stage, when the license is mainly tied to node A, the previous primary PAN?
Step 3 says to obtain a new license that's tied to both node A & node B, as if it's implying an issue would arise, if we leave node B as the primary PAN, instead of reverting back to node A.
=========
Question 2:
When step 1 is completed, node B runs 1.2, while node A runs 1.1.3.124.
Do both nodes still function as PSN nodes, and can service end users at that point? (before we proceed to step 2)
Both nodes are behind our ACE load balancer, and I'm trying to confirm the behavior during the upgrade, to determine when to take each node out of the load balancing serverfarm, to keep the service up and avoid an outage.
===========
Question 3:
According to the upgrade guide, we're supposed to perform a config backup from PAN & MnT nodes.
Is the config backup used only when we need to rollback from 1.2 to 1.1.3, or can it be used to restore config on 1.2?
It also says to record customizations & alert settings because after the upgrade to 1.2, these settings would change, and we would need to re-configure them.
Is this correct? That's a lot of screen shots we'll need to take; is there any way to avoid this?
It says: "
Disable services such as Guest, Profiler, Device Onboarding, and so on before upgrade and enable them after upgrade. Otherwise, you must add the guest users who are lost, and devices must be profiled and onboarded again."
Exactly how do you disable services? Disable all the authorization policies?
http://www.cisco.com/en/US/docs/security/ise/1.2/upgrade_guide/b_ise_upgrade_guide_chapter_01.html#reference_4EFE5E15B9854A648C9EF18D492B9105
==================
Question 4:
The 1.1 user guide says the maximum number of nodes in a node group was 4.
The 1.2 guide now says the maximum is 10.
Is there a hard limit on how many nodes can be in a node group?
We currently don't use node group, due to the lack of multicast support on the ACE-20.
Is it a big deal not to have one?
http://www.cisco.com/en/US/customer/docs/security/ise/1.2/user_guide/ise_dis_deploy.html#wp1230118
thanks,
Kevin

Identity service cannot find user

Installed BPEL 10.1.2
added user using jazn.jar
Now trying to log into worklist sample application
and I get identity service cannot find user. Do I need to assign any role(s) to new user.
Let me know.
I am seeing simple questions not getting answers. Is this an Active Forum?
Thanks
Raghu

closed
for OAS 10.1.2.0.2. & BPEL PM 10.1.2.0.2
I Install BPEL in MiddleTire
1. ./runInstaller
2. home = OAS home
3. tea
4. emctl stop em
emctl start em
5. Oracle_Home\opmn\bin\opmnctl stopproc ias-component=OraBPEL
Oracle_Home\opmn\bin\opmnctl startproc ias-component=OraBPEL
6. if OID working throw SSL, then 7,8 else 9
7. edit file Oracle_Home\j2ee\OC4J_BPEL\config\jazn.xml
     <jazn provider="LDAP" location="ldap://host:636" default-realm="us">
          <property name="ldap.user" value="cn=orcladmin"/>
          <property name="ldap.password" value="!welcome1"/>
          <property name="ldap.protocol" value="ssl"/>
     </jazn>
8. edit file Oracle_Home\integration\orabpel\system\services\config\is_config.xml
     <BPMIdentityServiceConfig
     xmlns="http://www.oracle.com/pcbpel/identityservice/isconfig">
          <provider providerType="JAZN" name="oid" >
               <connection url="ldap://host:636" binddn="cn=orcladmin"
                    password="welcome1" encrypted="false">
                    <property name="securityProtocol" value="ssl" />
               </connection>
          </provider>
     </BPMIdentityServiceConfig>
then 11
9. edit file Oracle_Home\j2ee\OC4J_BPEL\config\jazn.xml
     <jazn provider="LDAP" location="ldap://host:389" default-realm="us">
          <property name="ldap.user" value="cn=orcladmin"/>
          <property name="ldap.password" value="!welcome1"/>
     </jazn>
10. edit file Oracle_Home\integration\orabpel\system\services\config\is_config.xml
     <provider providerType="JAZN" name="oid" >
          <connection url="ldap://host:389" binddn="cn=orcladmin"
               password="welcome1" encrypted="false"/>
          </connection>
     </provider>
11. edit file Oracle_Home\j2ee\OC4J_BPEL\application-deployments\hw_services\orion-application.xml
     <jazn provider="LDAP" location="ldap://host:389" default-realm="us" >
          <jazn-web-app auth-method="SSO"/>
     </jazn>
12. Oracle_Home\opmn\bin\opmnctl stopproc ias-component=OraBPEL
Oracle_Home\opmn\bin\opmnctl startproc ias-component=OraBPEL
II Deploy BPEL portlets
1. throw EM add EAR to OC4J_BPEL:
     fie: $ORACLE_HOME/integration/orabpel/system/services/lib/bpelportlet.ear
     а. Parent app = orabpel
     б. User Manager = Use JAZN LDAP User Manager
2. edit file Oracle_Home\j2ee\OC4J_BPEL\application-deployments\bpelPortlet\orion-application.xml
     <jazn provider="LDAP" location="ldap://host:port" default-realm="us" >
          <jazn-web-app auth-method="SSO"/>
     </jazn>
3.Oracle_Home\opmn\bin\opmnctl stopproc ias-component=OraBPEL
Oracle_Home\opmn\bin\opmnctl startproc ias-component=OraBPEL
4. Register BPEL provider
     http://bpel_host:bpel_port/BPELPortlet/providers
     а. Login Frequency = Once Per User Session
636 - OID SSL port
389 - OID non SSL port

Identity Services Engine 1.1.4: REPLICATION DISABLED

Hey, guys.
Has anyone accountered the problem, that replication between ISE nodes stops after an unpredictable timeframe ???
This is the result after one day:
I have set up a distributed deployment of ISE nodes, seven in total, split up into two nodes for each service (monitoring, administration, policy and profiling).
Each of the nodes is running in an ESX 5.x environment, ESX itself is running on two hosts (two UCS with lots of ram and CPUs), each node has 8 virtual CPUs and 16GB ram, the virtual harddisks are 750GB and on some nodes even 2000GB .....
This is a testing environment, radius accounting data is sent to the ISEs by a small number of switches only (but production switches, so that I can see profiling of our real clients), no authentication or authorization is done by the ISEs (yet).
Profiling is configured in the following way:
- a single node receives the HTTP probe (via a spanned port of our proxy server) on gig 1 (box does nothing else)
- two nodes listen to the DHCP, DNS, RADIUS and SNMP probes, these two nodes have the policy service enabled also (but do nothing with it)
All nodes run the same version of ISE:
Cisco Application Deployment Engine OS Release: 2.0
ADE-OS Build Version: 2.0.4.120
ADE-OS System Architecture: i386
Copyright (c) 2005-2011 by Cisco Systems, Inc.
All rights reserved.
Hostname: ise-worf
Version information of installed applications
Cisco Identity Services Engine
Version      : 1.1.4.218
Build Date   : Wed Apr 10 22:20:22 2013
Install Date : Fri May 3 19:16:05 2013
Cisco Identity Services Engine Patch
Version      : 1
Install Date : Wed May 29 08:16:58 2013
The database on this deployment contains about 5100 clients at this time:
which is very little compared with the number of the rest of the endpoints that are connected to all the switches that do not send radius-accounting to the ISE deployment yet ....
Anyone has a solution or a clue what to do ???
In this state, ISE seems not capable to handle enterprise environments ....
Btw, backups of the database do not work either, when you have more than 50% diskspace occupied ......
Rgs
Frank

Hey, guys.
Here is a little update, repication is still disabled, but it seems to be getting even worse:
This happens when trying to connect via SSH AND via the vCenter Console window ......
A reboot of the box enabled ssh again, but the application cannot be started again ...
Disk full .... but full with what ???
Replication is disabled, so no new database entries etc. can make the db grow, I guess .. ??
The virtual disk that has been assigned to this vm is the largest size, that vmware can handle:
The only thing I can do now, is to reimage the machine (again).
Sadly, I do not expect things to be any different with the new installed ise, because I have done this three times before already...
At this point I feel the urgent need to throw this whole project onto the dumpster and take another look at ISE when version 3.0 is released, because in this state it is not enterprise scalable software ....
Rgs
Frank

Ask the Expert: Identity Services Engine - 802.1x, Identity Management and BYOD

Welcome to this Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Cisco Identity Service Engine (ISE) with subject matter expert Nicolas Darchis.
Cisco Identity Service Engine is a security policy management and control platform that automates and simplifies access control and security compliance for wired, wireless, and VPN connectivity. It is primarily used to provide secure access and guest access, support BYOD initiatives, and enforce usage policies in conjunction with Cisco TrustSec.
Nicolas Darchis is a wireless and authentication, authorization, and accounting expert for the Technical Assistance Center at Cisco Europe. He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, since 2007. He also focuses on filing technical and documentation bugs. Darchis holds a bachelor's degree in computer networking from the Haute Ecole Rennequin Sualem and a master's degree in computer science from the University of Liege. He also holds CCIE Wireless certification (no. 25344).
Remember to use the rating system to let Nicolas know if you have received an adequate response.
Because of the volume expected during this event, our expert might not be able to answer every question. Remember that you can continue the conversation in the Security community under subcommunity AAA, Identity, and NAC shortly after the event. This event lasts through June 20, 2014. Visit this forum often to view responses to your questions and the questions of other Cisco Support Community members.

Hi.
1) It is not "ISE loses the credentials and asks for web portal again". Once a user is authenticated, it is authenticated as long as it stays connected. Possibilities are :
-You are returning a session timeout (attribute radius 27) in the authz profile of the user. Therefore user has to reauthenticate after X seconds. But you would see a pattern, then.
-Over wireless, many clients are not capable of doing fast roaming (smartphones is the biggest example) and will therefore reauthenticate with dot1x everytime they roam. A small coverage hole would be enough for the cached credentials to disappear and web portal to show up again
-Over wired, this cannot really occur but the idea is that it's probably the switch resetting the connection and contacting ISE again. The idea to troubleshoot this is to monitor the access device (WLC/switch) and check if the port goes up/down, if the MAB session gets reset or something and why.
2) The captive bypass issue is that Apple devices will probe apple.com website to check if there is internet connectivity. If they can reach it, then fine, if they sense that they are redirected, they open a small window pop up with the login portal. The problem (and I still cannot understand why) is that this is not Safari, it's some nameless feature-less browser that doesn't work properly.
By enabling the captive bypass feature, the WLC intercepts the requests to the Apple testpage and replies with HTTP OK. The apple device then thinks "ok I have internet connectivity" and it's up to the user to bring up a real browser to login to the portal page.
It therefore does not affect non-Apple device to have the feature enabled.
The problem is that in IOS 7.x, Apple decided to not just use Apple.com anymore but a whole list of testpages on different websites.
3) "whether it would solve the issue if I added certificate authentication as a secondary option, with eap-tls as the primary"
=> This is disturbing because EAP-TLS is a certificate authentication method. But ISE message seems to imply that the user is hitting an authnetication rule that only provides PEAP or EAP-FAST with mschap or something similar ...
If you have the windows default supplicant you have close to no control on what the client will submit. I can imagine that moving from wired to wireless, the laptop would sometimes try to send password instead of certificate and/or vice-versa. Anyconnect with fixed network profiles would solve the problem elegantly.
I cannot comment on your auth policies as I do not know them :-)
Regards,
Nicolas

Ask the Expert: BYOD with Identity Services Engine

with Cisco Expert Bernardo Gaspar
Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Identity Services Engine (ISE) and its various usage scenarios and integrations such as BYOD, Active Directory, profiling, posture and radius authentication with Cisco subject matter expert Bernardo Gaspar.
Bernardo Gaspar is Customer Support Engineer at the Technical Assistance Center at Cisco Europe especialized in wireless and authentication, authorization, and accounting (AAA). He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, NAC and Identity Services Engine as part of the escalation TAC team since 2007. He also focuses on filing technical and documentation bugs. Bernardo Gaspar holds a degree from the University of Porto.
Remember to use the rating system to let Bernardo know if you have received an adequate response.
Bernardo might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community, AAA, Identity and NAC discussion forum shortly after the event.
This event last through Friday July 12, 2013. Visit the community often to view responses to youe questions of other community members.

My customer is limited in his VM space. Although he would like to have a active/standby for his administration node, he doesn't need this for his logging. Is it recommended to roll this in production. With a limited HDD space, what would be the recommended space (300 GB?)
administration
monitoring
policy service
Machine VM
primary
Not enabled
enabled
Machine HW
secondary
primary
enabled

Ask the Expert: BYOD with Identity Services Engine with Cisco Expert Bern

Welcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and ask questions about Identity Services Engine (ISE) and its various use scenarios and integrations such as BYOD, Active Directory, profiling, posture and radius authentication with Cisco subject matter expert Bernardo Gaspar.
Bernardo Gaspar is Customer Support Engineer at the Technical Assistance Center at Cisco Europe especialized in wireless and authentication, authorization, and accounting (AAA). He has been troubleshooting wireless networks, wireless management tools, and security products, including Cisco Secure Access Control Server, NAC and Identity Services Engine as part of the escalation TAC team since 2007. He also focuses on filing technical and documentation bugs. Bernardo Gaspar holds a degree from the University of Porto.
Remember to use the rating system to let Bernardo know if you have received an adequate response.
Bernardo might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security sub-community, AAA, Identity and NAC discussion forum shortly after the event.
This event last through Friday July 12, 2013. Visit the community often to view responses to youe questions of other community members.
Posted by WebUser Krishnakant Dixit from Cisco Support Community App

Feedback will be highly appreciated
Posted by WebUser Krishnakant Dixit from Cisco Support Community App

An interview on OpenSSO's identity services

Similar Messages

Maybe you are looking for