OAM Identity System Setup

Hi All,
I have installed Identity Server and WebPass on two different linux boxes in simple mode. I have setup the identity system successfully, but when I try to login I am redirecting to a blank page. The identity server logs show that "Failed to retrieve sharedsecret".
Please let me know whether I need to update the passphrase in any of the configuration files, or any other solution to overcome this error.
Thanks.

Is it happening on one setup or both identity server instances.
Were you able to login after setting up one identity server and webpass. Did you followed the OAM HA guide for installing multiple identity server instances.
What procedure did you used to install two identity servers with one ldap. I am assuming that you have two identity servers installed with same LDAP. Plz correct me if I am wrong.

Similar Messages

Install of 10.1.4.0.1 OAM Identity System Console link blank AGAIN

I am now having a similar problem to the one that started the following thread:
Install of 10.1.4.0.1 OAM Identity System Console link goes to blank page
When I click "Identity System Console" I get a blank page.
This is a different problem than that thread because I have verified the Identity Server is up and running (which solved my problem last time). I have also checked the log file at NetPoint\WebComponent\identity\oblix\logs\oblog.log and found the following error being reported over and over:
2008/05/14@18:14:26.359000     1288     6112     CONN_MGMT     ERROR     0x00001C06     watcher_thread.cpp:52     "Unable to create wrapper for socket"     Error^Socket read error during simple authentication
...AND this warning:
2008/05/14@18:14:26.453000     1288     3524     CONNECTIVITY     WARNING     0x00002101     ois_service_client.cpp:1304     "The server this component is trying to establish a connection to is not available"     function^ObOISServiceClient::SendMessage
What changed from my previous successfull install is I rolled back to a snapshot of the Windows 2003 Server VM where it is in a workgroup rather than the domain and reinstalled the Oracle Identity Server and WebPass over the OID that had been installed previously.
You may ask why I did this...Because OID was installed outside the domain and I could not use OID DAS because the configuration of OID must have assumed at install that it would be in that workgroup and I could not successfully log into OID DAS.

I did the telnet to "OHSTest 6022" and it responds with "SMPL" which I assume stands for Simple which is what I configured. Looking at the webpass.xml file - it does have 6022 as the port (See Below). I do notice that there is no primary server defined but there is a secondary server. Could that be the problem (See the portion of the config file below)?
    <ValList
        xmlns="http://www.oblix.com"
        ListName="primary_server_list">
        <ValListMember
            Value="server1"></ValListMember>
    </ValList>
    <ValList
        xmlns="http://www.oblix.com"
        ListName="secondary_server_list"></ValList>
    <ValNameList
        xmlns="http://www.oblix.com"
        ListName="server1">
        <NameValPair
            ParamName="host"
            Value="OHSTest"></NameValPair>
        <NameValPair
            ParamName="port"
            Value="6022"></NameValPair>
        <NameValPair
            ParamName="numOfConnections"
            Value="1"></NameValPair>
    </ValNameList>

Install of 10.1.4.0.1 OAM Identity System Console link goes to blank page

I am installing OAM in order to test a .Net Application Integration (IPM 10g). I have been working from the install doc for 10.1.4.0.1 and have got to the point of installing WebPass (Chapter 5 of the install doc). I have installed that component and the "http://ohstest:7777/identity/olbix" page comes up. I am running against an OID install on the same VM running windows 2003 R2.
I headed into chapter 6 and "Setting Up the Identity System". Unfortunatly, when I click the "Identity System Console" link, after a long delay a blank page comes up and the URL is:
http://ohstest:7777/identity/oblix/apps/admin/bin/front_page_admin.cgi
It does this for the User Manager link as well. A blank page at:
http://ohstest:7777/identity/oblix/apps/userservcenter/bin/userservcenter.cgi
I am not sure where to look to identify the problem. Anyone have any suggestions?
John

I looked in windows event viewer and found that there was more than just the information that was displayed in the dialog. The event viewer says "Oracle Access Manager Identity Server (OracleIdentityServer_0789) is not a valid Win32 application". This indicates to me that it probably was not even able to load the service provider server.
The path to the service exe is --> "C:\Program Files\NetPoint_01\identity\oblix\apps\common\bin\ois_server.exe"
Message was edited by: John Jumper - added path
JohnJ

Unable to modify user password through OAM identity system console.

HI,
I am trying to reset the password of a user through OAM Identity console.
I had logged in through orcladmin(admin), and tried to update the password for users, as well as orcladmin also.
After clicking save, its giving me error "Modify User Entry Failed" and password is not updated in LDAP
Also note that I am able to modify any other attribute of that user like last name, title, firstname etc through identity console.
Its only user password attribute which is not geting updated.
I am user OVD, which is integrated with OID & AD for user store.
Also I tried to set "Access Attribute control" for modifying user password, but that didnt help.
Kinldy suggest if you have came across this kind of issue.
Regards,
Ankit.

HI,
Thanks for the replies.
As my OVD is integrated with OID & AD both, I am picking up the users from OID for update.
Also the SSL is configured betveen OVD & AD, but still AD user password is also not successfull.
Niether of two is working.
I am not able to create a user through Identity System console, as I had not configured workfllow.
I believe for updating user attibute, workflow defination need not to be define.
Also As I had mentioned before, I am able to modify all the other attributes other than user password.
Also Schema is extended properly.
Thanks & Regards,
Ankit

Not able to create users in identity system -OAM

Hi all,
I am new to OAM and trying to create users from identity system -OAM.
I have logged in as 'orcladmin', who is my 'Master Administrator' and 'Master identity Administrator'.
To create the user, I click on 'User Manager' tab and then 'Create user identity' tab but I get a message saying
"*You do not have sufficient access rights*."
Same message comes up when I try to create groups also.
Please guide me on how I can give these rights to 'orcladmin'.
It will be helpfull if you can specify some links where I can learn the basic consepts of OAM(identity system and access system).
Thanks in advance
Roopa

Hi,
Before you attempt to create a user, you would need to create a workflow in OAM Identity System.
Below is the link which will get you started -
http://download.oracle.com/docs/cd/E15217_01/doc.1014/e12489/workflow.htm#BABEFGAA
-- Pramod Aravind

OIM & OAM's identity system?

Hi all,
1.I want to know the main differences between OIM & OAM's identity system.
2.OAM includes identity system & access system,can i use OAM's identity system only without installing access system to handle user identity management ?
thanks.need r help.

Yes. You can install only OAM Identity System to do User/Group/Org Identity Management, without installing Access System. (Although Oracle always recommends using OIM for User Identity Management)
The difference between OIM and OAM is that OIM is used for User Provisioning, Reconciliation and Identity Management across multiple data stores, while OAM does User Provisioning and Identity management on a single data store.
From my experience, OAM Identity System takes an edge over OIM in the following ways:
1. Attribute Access Control: This function lets you specify permissions that determine who can read and modify the values for each LDAP attribute. It also lets you create a list of users or groups to be notified when an attribute is changed. The audience can be defined using a role, rule(ldap filter), person or group definition.
2. Set Searchbase: The searchbase determines the part of the directory tree that is available to a user during a search. You must set a searchbase for each structural object class configured for the Identity System before a user can view its entries. You can set multiple searchbases for each structural object class. When you set a searchbase, you determine who can search what (an object class, at a particular level of the directory tree), optionally using a search filter. The audience can be defined using a role, rule(ldap filter), person or group definition.
3. Delegated Administration: Delegating administration allows the Master Administrator and Master Identity Administrator to delegate their responsibilities to other, more local administrators. This is particularly useful in large organizations, where it may be necessary to administer thousands or millions of users. By doing this, you determine what rights you want to grant to another user.
4. Easy-to-use workflows: The workflow applet lets you create different kinds of workflows in minutes. Following are the interesting features in OAM workflows:
- Email notification: On execution of each workflow step, an email notification can be sent to the participants of the next step.
- Dynamic Participants: Instead of specifying static participants when you create a workflow, you can have a workflow plug-in or application choose dynamic participants according to runtime conditions.
- Out-Of-Office Participants: If a static or dynamic participant is going to be out of the office or otherwise unable to process workflow tickets, he or she can set an Out of Office flag in his or her user profile so that all incoming tickets are redirected to a surrogate participant for as long as the flag remains activated.
- Escalation Participant: If the participants receiving a given workflow ticket fail to process it within a specified interval, that ticket can be sent to an escalation participant, who assumes full responsibility for the ticket.
5. OAM deployment is usually faster than an OIM deployment.
One of the disadvantages of OAM Identity System is that it can manage identities in a single (LDAP only) data store. This can be overcome by the use of Oracle Virtual Directory on top of all the identity data stores being used in the enterprise.
Let me know if you have any more questions.
-shetty2k

Can not login to the Identity System Console

Hi,
I forgot username and password for logging into OAM Identity System Console. Is there any admin user which can connect?
How can I find user able to connect and change password.
Tnx!

I will answer to myself.
I have reconfigured IC (change setup.xml status to incomplete) and restart OIM.

Time difference between the Identity system and Access System: OAM

I was installing OAM. Performed the below steps.
-installed identity server
-installed webpass
-setup of identity system console
-installed policy manager
-setup of access system console
The above steps were successfull. Then when i was logging into Access system console, i am getting the below error:
Error:there was a problem obtaining the userid. One possible reason for this is a time difference between the Identity system and Access systems (Policy Manager and Access system console).+
The Identity Server, WebPass and Policy Manager are installed on the same machine.
Userdata repository: OVD 10.1.4.3
Policy and Config Data Repository: OID 11.1.1.3
OAM: 10.1.4.3
Windows2008 - 64bit
Found document in metalink similar to this issue. suggested to change ldapmaxofreties. but didn't help.
Any idea on this error. Please Advise.
Thanks in advance.

Try this::
Check Time Difference Between Identity and Access Manager Systems
Check the logfile in the Access Manager install directory. The default location is <$AMinstall_dir>/access/oblix/logs/oblogfile.
If the file exists and it contains following line "skew = slack = " that means the Identity and Access Manager Web Servers are on different machines and have not synchronized time within a minute.
Either synchronize times between the two machines within a minute's accuracy or you can increase the slack by modifying these two files: <$AMinstall_dir>/access/oblix/apps/common/bin/oblixbaseparams.lst: loginslack: <$IMinstall_dir>/identity/oblix/apps/common/bin/oblixbaseparams.xml: loginslack: where numofseconds is more than skew found in the oblogfile.
For example, if you have following line in oblogfile "skew = 121 slack = 60", set numofseconds in the two parameter files to 130. After doing this, Stop the Identity Manager Web Server. Then stop the Identity Server. Start the Identity Server.
Then start the Identity Manager Web Server. Start a new browser session and see if you get the same error.

OAM 10g attribute is not visible in object class in Identity System console

Hi All,
This is about OAM 10g environment with OID used as user/config/policy store. There are one custom user object class and custom attributes defined in Identity System console already. Now there is a requirement to add another custom attribute to that already existing custom user object class.
I have created the attribute in schema through ldap command and I am able to see it in LDAP browser as well. However even after restarting OAM identity server and webpass services, the attribute is not visible in Identity System console -> Common Configuration -> Objectclasses -> Custom object class.
Appreciate any help. Please treat this as urgent.
Thanks
Mahendra.

The solution is to add the attributes in OVD schema as OVD is the user store.

Unable to Install Identity Server : Error 20: Identity System Configuration

HI I am trying to setup IDM system as per below order.
Oracle DB -> OID (two Instance OID1 & OID2 on separate RHEL5 box) -> OVD ( OVD1 & OVD2) -> OAM
I have successfully installed this setup upto OVD. But once I started Identity Server installation, installation is breaking with Error " Setup.product.install, com.oblix.installshield.ObExecWizardAction, err, There is an error. Please try again. Error 20: Identity System Configuration already exists on the specified LDAP directory server."
Earlier Few of my tea-mates Tried installing Identity server unsuccessfully thats why may be now I am not able to install it again.
Let me tell you at what point I got above error.
Identity server installation asks two time Directory server information. First time I selected option as "Data Anywhere" and after that I have given the details of OVD (IP/Ports/cn=orcladmin/password) and I got above error. I ignored that error and continue installation and second time I selected options as " Oracle Internet Directory" and gave OID details. again I got same kind of information.
So I have droped RCU and reinstalled OID ( not OVD) and tired Identity installation but no luck got same error at first stage (OVD/Data Anywhere). This time I did not continue installation.
Please help me to resolve this issue and I also want to know how can I remove Idenitity Server Information from OVD ( and OID too for future reference).
Thanks.
Edited by: 985360 on Feb 1, 2013 9:57 AM

Hi Parmar,
The error message "Identity System Configuration already exists on the specified LDAP" is complaining that the schema objects required by OAM already exsit on the specified ldap. The schema update needs only to be performed once (usually the first Identity Server installation, although it can be performed manually as a standalone operation) on each ldap instance, after which subsequent installation of Identity Servers do not need that step, which can be avoided by answering "No" when asked if it is the first Identity Server to be installed.
In order to check if these schema objects are in your ldap, look at the schema for a lot of oblix* object classes and ob* attributes - if they are there then the schema has been added. OAM only supports OVD as the User ldap store, not the configuration store. When you first install an Identity Server, it is necessary to give OID (in your environment) as the configuration store, and the installation will usie the OID_oblix_schema_add.ldif file to update the OID schema. When you specify the user store as OVD, OAM adds VDE_user_schema_add.ldif to the OVD schema.
I suspect that your schema objects may be fine, but if you want to clean them from your directory you can use the *delete.ldif files supplied (all the ldif files are in identity/oblix/data/common) for the ldap servers, and start again.
Regards,
Colin

How to configure ADF application to use OAM Identity Assertion ? web.xml

We have a web application developed using ADF (application development framework) and deployed on WebCenter 11.1.1.2 (weblogic 10.3.2)
OID Authentication and OAM identity assertion is configured in WebLogic 10.3.2 .
How to configure security in ADF application (web.xml or weblogic.xml) so that it uses OAM identity assertion (already configured as authentication providers in weblogic server)
Any pointers or documentation so that application (developed using ADF) check for identity tocken and verifies it with one of identity assertion providers.

John,
I have to concur. With OAM you don't need this. OAM intercepts the calls and inserts a cookie for WLS to get user information from.
I strongly advise to go through the above mention OFM Security Guide. Esp. Chapter 10 tells you in every detail how to implement OAM SSO with WLS (with or without OHS as a proxy).
Reading this chapter saves you time and turnarounds on this topic...
--olaf

How to do initialization for new system setup?

Hi, Experts:
I need your help! Can you tell me your suggestion please?
This is a new system setup. We are about to test on the Initialization/Delta process.
The data source is 2LIS_13_VDITM 7.0 version. The test is on the PSA.
I have done an EARLY Initialization. On R3 system, if a billing record is canceled, we are able to capture it in the RSA7. Then, we did a delta load which were successfully tranferred to BW system.
However, if I created a new order and push it to Billing, I am NOT able to find it on RSA7 of the Delta queue.
That would mean, the delta queue could not capture any new billing records.
Then, besides the early init, we tried to do an Initialization without Data Transfer in the hope that this could resolve the new records issue, it doesn't allow to do it, saying "no 2 initialization".
What is the right way to do initialization??
Thanks guys!!

Hello Sylvia,
Changing it to new delta mode need not clean out everything in BW.
its a change in R/3 side on how delta records will be pushed.
Delta queue will remain the same in R/3.
But since you have already missed some records and you are not sure which one.
Also the existing records in the delta queue are not the correct one as these are not bringing new records according to you.
So I will suggest you after you have done the changes to queued delta....do a fresh start.
Delete the data from the DSO.
1)delete the existing and do a new init without data transfer so that a new delta queue is created.
2)Fill the set up tables first and start the full repair loads to DSO.
3)once all the history is loaded then you can schedule the delta.
Thanks
Ajeet

OAM Identity Asserter Provider Error:Unable to create the AccessGate entry

Hi All,
I have installed Oracle Access Manager and trying to protect an application deployed on weblogic application server.
I have added the jar oamAuthnProvider in weblogic server lib mbeantypes and configured an OAM Identity Asserter Provider in myrealm. When I restart the weblogic server, I encounter the following error:
<Error> <> <BEA-000000> <OAMAP-60516:Unableto create the AccessGate entry for identity assertion/authentication.>
<Error> <Security> <BEA-090870> <The realm "myrealm" failed to be loaded: weblogic.security.service.SecurityServiceException
: com.bea.common.engine.ServiceInitializationException: java.lang.RuntimeException.weblogic.security.service.SecurityServiceException: com.bea.common.engine.ServiceInitializationException: java.lang.RuntimeException
When I remove the following section from config.xml, the server starts fine:
<sec:authentication-provider xmlns:ext="http://www.bea.com/ns/weblogic/90/security/extension" xsi:type="ext:oam-identity-asserterType">
<n1:name xmlns:n1="http://www.bea.com/ns/weblogic/90/security">OAMID</n1:name>
<n2:control-flag xmlns:n2="http://www.bea.com/ns/weblogic/90/security">REQUIRED</n2:control-flag>
<ext:access-gate-name>MYAPP</ext:access-gate-name>
<ext:primary-access-server>AccessServer</ext:primary-access-server>
<ext:application-domain>MYDOMAIN.com</ext:application-domain>
<ext:access-gate-password-encrypted>{AES}P3UIYbQpYupPs=</ext:access-gate-password-encrypted>
</sec:authentication-provider>
Has anyone come across this error before? Please suggest a workaround..
Software versions being used:
OAM 10.1.4.3
Weblogic: 10.3.2
Thanks
Joe

I am having the same problem on my WLS 10.3.4. running OSB 11g. I get the following error:
tuning)'> <<WLS Kernel>> <> <> <1296595010528> <BEA-000000> <OAMAP-60516:Unable to create the AccessGate entry for identity assertion/authentication.>
####<Feb 1, 2011 1:16:50 PM PST> <Info> <Security> <WD-OR14P5A5W624> <AdminServer> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1296595010528> <BEA-090511> <The following exception has occurred:
com.bea.common.engine.ServiceInitializationException: java.lang.RuntimeException
     at com.bea.common.engine.internal.ServiceEngineImpl.findOrStartService(ServiceEngineImpl.java:365)
     at com.bea.common.engine.internal.ServiceEngineImpl.findOrStartService(ServiceEngineImpl.java:315)
     at com.bea.common.engine.internal.ServiceEngineImpl.lookupService(ServiceEngineImpl.java:257)
     at com.bea.common.engine.internal.ServicesImpl.getService(ServicesImpl.java:72)
     at weblogic.security.service.internal.WLSIdentityServiceImpl.initialize(WLSIdentityServiceImpl.java:47)
     at weblogic.security.service.CSSWLSDelegateImpl.initializeServiceEngine(CSSWLSDelegateImpl.java:300)
     at weblogic.security.service.CSSWLSDelegateImpl.initialize(CSSWLSDelegateImpl.java:222)
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.InitializeServiceEngine(CommonSecurityServiceManagerDelegateImpl.java:1784)
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initializeRealm(CommonSecurityServiceManagerDelegateImpl.java:445)
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.loadRealm(CommonSecurityServiceManagerDelegateImpl.java:840)
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initializeRealms(CommonSecurityServiceManagerDelegateImpl.java:870)
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1030)
     at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:881)
     at weblogic.security.SecurityService.start(SecurityService.java:142)
     at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
I looked the error number up and it says:
OAMAP-60516: Unable to create the AccessGate entry for identity assertion/authentication.
Cause: AccessGate instance creation failed.
Action: See the Identity Asserter/Authenticator log for details.
Level: 1
Type: ERROR
Impact: Configuration
This seems to indication my identity assertion is incorrect. My oam authentication provider is pretty simple.
I am using OPEN transport security so the provider config is pretty simple. I provided an AccessGate pwd, primary and secondary access gate servers and Access Gate name provided by my administrator.
I'm not sure about what the Application Domain field refers to. Can someone provide guidance on that?

Third party dropshipment process and system setup

Hi gentlemen,
I have a few question to check with you.
1 - What is the difference between Third Party Shipment, and Third Party Drop Shipment in term of process?
2 - What is the system setup requirement for Third Party Drop shipment (I know TAS is require for 3rd party, but what about 3rd party drop shipment)?
thanks
tuff

Hi Tuffy,
I did'nt quite get the context of what you mean by third party in this case. Is it a third party delivery which uses TAS item cat on the sales order.
Or we have scenarios where order is done by for example my company but there is an external ware house which receives my dleivery number probably through EDI who does the shipment and confirms back to SAP to trigger PGI.
Drop shipment in general business terms is used reduce the cost of inventory stocking. Like I just take orders and book it to a company, they do the shipment to the address I mention ( this goes as part of ship to party address ). Since the company does not from who all I can book orders they just maintain a drop ship customer.
You might find the below blog useful:
[One Time Ship To Party|/people/sadhu.kishore2/blog/2008/12/12/working-with-one-time-ship-to-party]
Regards
Sadhu Kishore

Certificate error on only one of two identical systems?

I recently installed two COMPLETELY identical Ubuntu 12.04 systems, PC01 and PC02. The browser is latest version of Mozilla Firefox.
When visiting https://www.komplett.dk/k/signin.aspx with PC01, the connection is secure and everything is OK, no error messages. When visiting the same URL with PC02, the following error message is shown:
This Connection is Untrusted
You have asked Firefox to connect securely to www.komplett.dk, but we can't confirm that
your connection is secure.
Normally, when you try to connect securely, sites will present trusted identification to prove
that you are going to the right place. However, this site's identity can't be verified.
What Should I Do?
If you usually connect to this site without problems, this error could mean that someone is
trying to impersonate the site, and you shouldn't continue.
Get me out of here!
Technical Details
www.komplett.dk uses an invalid security certificate.
The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)
I understand the Risks
Why is this happening when the systems are COMPLETLY identical? i have tried to delete the profile folder on both systems, but the result is the same. NO certificates has been manually installed on PC01, so that is not the reason. The file size of cert8.db on PC01 is 94K and on PC02 it is 64K, I do not understand how the size can be different when the profiles are newly created.
I would really like to find out why I am experiencing different behaviour with Firefox, on two identical systems, so any suggestions or ideas are very welcome.

The Technical Details show:
<blockquote>www.komplett.dk uses an invalid security certificate.
The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)
</blockquote>
The www.komplett.dk server doesn't send a required intermediate certificate.
*VeriSign Class 3 Extended Validation SSL SGC CA
You can inspect the certificate chain via a site like this:
*http://www.networking4all.com/en/support/tools/site+check/
You can install the intermediate certificate from networking4all site or from this VeriSign page (it is the second one).
*http://www.verisign.com/support/verisign-intermediate-ca/extended-validation-pro/index.html
Copy the certificate text to a .cer text file and import this file in the Certificate Manager.
*Options/Preferences > Advanced > Encryption: Certificates - View Certificates

OAM Identity System Setup

Similar Messages

Maybe you are looking for