Oracle Identity and Access Management Suite Plus Integration with Oracle ADF

Hi All,
Kindly advice if Oracle Identity and Access Management Suite Plus can be integrated with Oracle ADF based applications to manage the end-to-end lifecycle of user accounts specifically addressing to roles/priviledges and security.
Request you to share links to documentation where I can study the steps to integrate both the frameworks.
Looking forward to hear from you soon.
Best Regards,
Ankit Gupta 

Hi Sébastien,
I came across the below link for the required integrations -
Oracle® Fusion Middleware Installation Guide for Oracle Identity and Access Management 11g Release 2 (11.1.2) - …
Oracle® Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management 11g Release 2 (11.1.2) - Co…
Best Regards,
Ankit Gupta

Similar Messages

  • Oracle Identity and Access Management (11.1.1.3.0)   and IM difference?

    What is difference between Oracle Identity and Access Management (11.1.1.3.0) and Identity Management (11.1.1.3.0) ?
    From
    http://www.oracle.com/technetwork/middleware/downloads/oid-11g-161194.html

    When you run the config, you are asked to add some product. Have checked the "Oracle Access Manager with Database Policy Store" product?
    If not, you can add it by extending the domain. Once done you have to start two WLS servers (AdminServer and oam_server1):
    Start AdminServer with $DOMAIN/bin/startWebLogic.sh
    Start oam_server1 with $DOMAIN/bin/startManagedWebLogic.sh oam_server1
    It might be that oam_server1 asks for username and password. This is fine for the first time. During the first start the necessary directory structure is created. Once it came up and enters RUNNING state, kill it and create a file boot.properties in $DOMAIN/servers/oam_server1/security with the entries username=name and password=pw in two lines and start oam_server1 again.
    Starting oam_server1 is recommend to get proper values in the oamconsole.
    HTH,
    --olaf                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

  • Identity and Access Management Training in Bangalore

    Hi,
    I need information if there are any institutes who provide training on Identity and Access Management in Bangalore or Pune? Whats is the basic requirement for starting IAM. I have SQL knowledge.
    Thank you
    [email protected]

    You can check out this link for Oracle University in India:
    http://education.oracle.com/pls/web_prod-plq-dad/db_pages.getpage?page_id=3
    -Kevin

  • Discuss Identity and Access Management in the Cloud

    Identity and access management in the cloud refers to the processes, technologies, and policies for managing cloud systems identities and controlling how these identities can be used to access cloud resources. Three separate processes are used in most cloud
    identity and access management solutions:
    Identity provisioning and storage
    Authentication
    Authorization
    Identity management in a cloud system requires a complex collection of technologies to manage authentication, authorization and access control across distributed environments. These environments might include assets both on the internal cloud, which would
    be an on-premises private cloud, and services accessed on the public cloud. These environments can also cross-security domains, as when two enterprise-level organizations collaborate and enable cross-domain access to users from the partner security domain.
    You can learn more about these topics in the article Identity and Access Management in the Cloud.
    Let's talk about that article and the topics of identity and access management in the cloud! Use this thread to get it started.
    Thanks!
    Tom
    Learn more about Private Cloud at the
    Private Cloud Solutions Hub

    Tom,
    I am a novice and attempting to achieve a proof of concept of single sign on.  One example I read stated one should install Identity and Access on VS2012.  I did this on two different machines.   One was in the office domain and it shows the
    item "Identity and Access..." in the context menu of the MVC project I created.  The other machine is my laptop.  I followed the same procedure that worked on the desktop, yet the Identity and Access item in the project context menu does not show.
     One difference is that the laptop is not part of a domain, but I am attempting this proof of concept in Windows Azure with the laptop, since we do not have a test AD in our corporate domain.
    Is this the right forum to inquire about this issue?  Do you have a recommendation about a better forum?
    Stephen Pidgeon

  • Sizing of Oracle IdentityManager and Access Manager on same Weblogic Server

    Hi ,
    We are planning to deploy Oracle Identity Manager and Access Manager on the same weblogic server in different domains.We have user base of 25000 users.
    We can propose two different weblogic servers for OIM and OAM ?
    Please let me know the best hardware and software requirements for this installation.
    Thanks,
    RBM

    Here is sizing guide for Oracle Identity Manager
    http://www.oracle.com/technetwork/middleware/id-mgmt/oim11g-sizingguide-194346.pdf
    You can use it as a guideline, and it refers to 25000 users similar to your requirement. There are other factors also consider like, failover, performance etc. Feel free to reach out if you need more info [email protected]

  • Oracle EAM - Linear Asset Management Setup n Integration to Oracle Spatial?

    Hello Gurus,
    Need help, if anyone can share Linear Asset Setup on Oracle EAM. It will be of great help.
    Also, some tips on EAM's integration to Oracle Spatial will be of good help to me.
    In advance, thanks a ton!.
    Regards

    Can anyone update this please?

  • Oracle Single Sign on Integration with Oracle EBS  r12

    Hello,
    I am working on a project to integrate Oracle Single Sign On on Oracle r12. There is plenty of information available on Oracle Support but few inter-mixing and confusing terminology keeps popping up and I do not understand how all pieces together work. I am new to Oracle Single Sign On.
    Here are few basic questions.
    1. What is the difference between Oracle Internet Directory, Oracle Virtual Directory and Oracle Active Directory
    2. Are the terms Identity Management and Oracle Single Sign On interchangeable?   What is the difference between two?
    3. What is Oracle Access manager and how different that is from Identity Management?
    4. What is Oracle HTTP Server 11g webgate and how different that is from a normal traditional Oracle HTTP Server?
    5. What is Oracle EBS Accessgate?  Why do I need it?  On metalink some notes do not indicate use of Accessgate at all for OSSO deployment while some makes it look like required.And advise on above will help.
    Thank you
    Darsh

    Hi Darsh,
    1. Oracle Internet Directory (OID) is Oracle LDAP storage solution (more here), Oracle Virtual Directory is Oracle solution that can read identity data (and filter it (mask it) based on policies) from Oracle/non-Oracle databases, Oracle/non-Oracle Directories and files and provide the user profiles as LDAP view (more here), There is nothing called Oracle Active Directory, you must be referring to Microsoft Active Directory.
    2. No, Oracle Single Sign On (OSSO) is a feature in iAS (its obsolete), Identity Management is wide umbrella of solutions and concepts.
    3. Oracle Access Manager is one component of Oracle Identity and Access Management suite of products.
    4. Webgate is Oracle access Manager agent that is installed on a webtier, it intercepts the web requests and collect the credentails, send them to Oracle Access Manager for security evaluation (decide what Authentication is needed, verify collect credentials, etc), webgate then enforce the Access Manager decision.
    5. Oracle EBS AccessGate is a java application that has the same use of OAM Webgate (it is OAM agent) but specific to E Business suite, EBS Access Gate is the new solution replacing OSSO agents, OAM is replacing OSSO server component, EBS and OSSO customers can use OAM server with OSSO agents, or with EBS AccessGate.
    HTH.
    Ghassan

  • Realm of my application for identity and access

    I plan to replace Azure cloud services’ provided subdomain (myapp.cloudapp.net) with our own domain, customDomain.com. I eventually find out that I cannot do that. I have to configure a custom domain name to route traffic to myapp.cloudapp.net. Why does
    not Azure allow me to replace myapp.cloudapp.net with my own custom domain? I end up having two domains for one site. Please look at this site:
    http://azure.microsoft.com/en-us/documentation/articles/cloud-services-custom-domain-name/
    That custom domain name also has an SSL certificate from a CA. In addition to that, I also use single sign on for my application (Identity and Access). In this case, I configure the Identity and Access (realm of my application) with my custom domain name.
    Is this the right way? It does not make sense to configure this with myapp.cloudapp.net. I currently have issues with ADFS but I could not figure out why. 

    Hi,
    Here providing article might helpful for your case.
    Domain mapping, Domain forwarding, SSL certificate for Windows Azure
    http://blogs.msdn.com/b/sriharsha/archive/2012/02/25/domain-mapping-on-windows-azure.aspx
    Hope it helps!
    Thanks.
    Dharmesh Solanki
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • Domain and realm of my application for identity and access

    I plan to replace Azure cloud services’ provided subdomain (myapp.cloudapp.net) with our own domain, customDomain.com. I eventually find out that I cannot do that. I have to configure a custom domain name to route traffic to myapp.cloudapp.net. Why does
    not Azure allow me to replace myapp.cloudapp.net with my own custom domain? I end up having two domains for one site. Please look at this site:
    http://azure.microsoft.com/en-us/documentation/articles/cloud-services-custom-domain-name/
    That custom domain name also has an SSL certificate from a CA. In addition to that, I also use single sign on for my application (Identity and Access). In this case, I configure the Identity and Access (realm of my application) with my custom domain name.
    Is this the right way? It does not make sense to configure this with myapp.cloudapp.net. 

    Hi,
    If you want to configure SSL for azure cloud service, I think this article will help you:
    http://azure.microsoft.com/en-gb/documentation/articles/cloud-services-configure-ssl-certificate/, if you want to ask some issues related to Identity and Access, I would suggest you move to azure Active Directory forum:
    https://social.msdn.microsoft.com/Forums/en-US/home?forum=WindowsAzureAD
    Best Regards,
    Jambor
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • OBIEE 11.1.1.3.0 integrated with Oracle EBS R12

    Hi,
    I have Oracle EBS Vision Instance v R12.1 installed on Redhat 5 and wanted to install OBIEE latest version. Can some please point to system architecture diagram as i am conflicted with installation. I do not have complete idea but writing here what i actually know.
    Oracle EBS R12 on Linux
    OBIEE V 11.X on Linux
    Now install prepackeged analystical function on windows machine and using BI tool deploy/use them with Oracle EBS.
    Please point me to a note which describes the components and what does it take to make up and running in conjuction with Oracle.
    Thanks in advance
    Prashant

    Please see these docs.
    Integrating Oracle Business Intelligence Applications with Oracle E-Business Suite [ID 555254.1]
    What documentation do I need to review when installing and configuring a OBI Apps 7.9.6.x environment with EBS? [ID 1221764.1]
    Master Note for OBIEE Integration issues with EBS, Siebel, SSO, Portal Server [ID 1248939.1]
    Oracle SSO E-Business Suite Applications Integration with Oracle Business Intelligence [ID 553423.1]
    Oracle EBS integration with OBIEE [ID 733137.1]
    Document for implementing security OBIEE Apps with EBS and Siebel CRM as sources [ID 756851.1]
    What Application must be chosen for Responsibility within EBS when integrating with OBIEE [ID 1246464.1]
    Also, search Steven Chan's Blog and you should get couple of hits -- http://blogs.oracle.com/stevenChan/
    Thanks,
    Hussein

  • Oracle Access Manager, ADAM & UCM integration? Help please..

    I`m currently investigating the potential of using Oracle Access Manager (OAM) as a tool that allows connections to multiple Active Directory(AD) or ADAM servers providing a single point to author and manage users with a good easy to use GUI.
    The UCM will connect directly to OAM and authenticate users connecting from AD accounts..
    At the moment we use Quest software to manage users, but the cost for setting up users is £15/user where as OAM is only £3. I believe..
    Right the questions I have :)
    1. Has any one set this type of environment up?
    2. ls OAM stand alone or will I need additional software to set it up?
    Reading the installation guide it says I need the following:
    # Oracle Internet Directory 10g (10.1.4.0.1)
    # Microsoft Active Directory
    # Oracle Virtual Directory Server 10.1.4.0.1
    # Oracle Virtual Directory Manager 10.1.4.0.1
    # Oracle Virtual Directory Patch 10.1.4.0.1 (P5667977)
    # Stand-alone Oracle HTTP Server 2.x (This needs to be preinstalled in your environment. You can download the OHS 2.x standalone from the Oracle SOA Suite 10g Companion (10.1.3.1.0) release from here.)
    3. Can I use IIS instead of Oracle HTTP Server?
    4. Can I install OAM on 1 server or do I need multiple servers, I`v been looking at the diagrams and reading through the guides I`m getting a little confused with Identity and Access server?

    Hi,
    Have you got information reg UCM & OAM integration?
    Could you please help me with the integration guide?
    Regards,
    Ashish

  • OBIEE Integration with Oracle Access Manager (OAM)

    Hi All,
    I am new to OBIEE and not familiar with Security part. We have one request from the client to have OBIEE Integration with Oracle Access Manager (OAM) through eternal identity management tool (OID/other LDAP).
    I tried google and found some information, but non of them has Step-by-Step process.
    Does anyone has document or know good portal which gives step by step information on how to Integrate OBIEE with OAM using external identity management tool?
    Appreciate if you share the information.

    Hi,
    You can use this note/doc attached in the note to configure:
    Oracle Access Manager (OAM) and Oracle Business Intelligence (OBI) Integration [ID 1217103.1]
    Regards,
    Jay

  • Difference between Identity Manager and Access Manager

    hi,
    Can any body tell me the difference between Identity manager and Access Manager.
    thanks in advance
    regards
    dhawanmayur

    Access Manager is for access control (web authentication, authorization), Identity Manager is for identity (userid,profile,role, password etc) provision/management across multi resources (such as unix, active directory, peoplesoft, SAP) etc.

  • UWC/CE 6.3 and Access Manager 7.1 SSO sometimes fails (seems like a bug)

    PREAMBULA: I started writing this post thinking that our AM SSO setup was at fault in some step. As I was gathering data, checking the doc-links and config files and finally sniffed the servers for HTTP dialogs, I grew pretty sure there's a bug in UWC/CE, AM SDK or Web Server Policy Agent, whatever implements the AM SSO session checking.
    In short, as written below, our "sunmail" server can POST a broken cookie to AM server, if the cookie originally contained a "plus" character. The "plus" is replaced by a "space", invalidating the session check. As we know, "+" is often used in URLs to "escape" the space character. Perhaps some URL cleanup routine backfired here. I have double-checked, it is not the reverse proxy on "psam" breaking things. It is "sunmail" (UWC/CE or Policy Agent, don't know for certain) supplying the broken request. On the few occasions when the AM cookie contains no "plus" characters, the SSO works like a charm (also checked by a sniffer). Whenever there is a "plus", it breaks.
    Is there some known bug or workaround that matches this description?
    Nevertheless, for completeness' sake I kept the description of our setup. Maybe it's at fault after all :)
    We have an installation of JCS5 with the latest patches as of early July 2008. And as the subject implies, we have problems with AM SSO in UWC/CE web-interface. I have reported them before, then they seemed fixed (not occuring for several tests in a row), but as time has shown, something wrong is still there.
    So I'll try to go into deeper detail now, as we've may have overlooked some nuance... Then again, as my sniffer research below shows, this may be an engine bug and these setup details are irrelevant.
    Our setup is split into several Solaris 10 full-root zones hosted on several servers, some of the components are enroute to HA (perhaps we made some mistakes on this part of the way?)
    So, we have the following software stack:
    1) two MMR Directory Servers (DSEE 6.3 = DSEE 6.2 from JCS5 + 125278-07__DSEE_6.3__x86x64 + 125277-07__DSEE_6.3__x86_sol9 patches) working in zones on two different servers. Except for one time when a manually forced ZFS rollback corrupted one of the server instances, no problems here.
    2) two zones with Directory Proxy Servers (6.3, exact versions as above) running at port 389 provide the clients with an illusion that they have a stable Directory Server, even if one of the actual servers is currently rebooting ;)
    These DPS zones are hosted on two different servers as well and are primarily used by LDAP clients (JCS components) running in other zones on the same respective servers.
    3) A zone with Sun Web Server 7.0U1 and Access Manager 7.1 (+ 126357-01__AM71_x86 patch) and Delegated Admin 6.4-4.01 (from JCS5 + 121582-18__COMMCLI64__x86 patch).
    At the moment there is one such zone (named "cos-psam-01.domain.ru" in the logs below), but we expect(-ed) it to become two similar zones as per AM HA setup.
    Zones listed in (1-3) use private IP numbers, they belong in our internal DMZ.
    Zones listed in (4-5) below use public (routed) IP numbers, they belong in our external DMZ.
    4) A zone with Sun Web Server 7.0U1 used primarily as a reverse-proxy server (optionally with a load-balancer libpassthrough.so plugin) successfully used for other hosted projects. One of its configurations now passes connections from an externally routed IP address published as "psam.domain.ru" to "cos-psam-01.domain.ru", per AM HA setup, so HTTP clients believe they work with an Access Manager instance. This zone has a backend interface with a private IP address to communicate with the actual AM instance.
    In AM configuration (both LDAP and file-based) we have configured a site ID with the publicly known name and mentioned both names (psam and cos-psam-01) in organization's realm/dns aliases.
    5) A zone with the rest of the Sun Java Communications Suite 5, as in Messaging Server 6.3 (6.3-6.03 64-bit: ci-5.0-1.03_solx86_x64__Messaging_Server_6.3-2 + patch 126480-09__MSG63__x86-64), UWC/CE 6.3 (from JCS5 + 122794-17__UWC63-4.01_core__x86), Instant Messaging 7.2 (from JCS5 + 118790-29__IM72__x86-1 + 118787-28__IM72__x86-2), Calendar Server 6.3 (from JCS5 + 121658-28__iCS63__x86). The web-components (UWC/CE, IM, /httpbind) are deployed in a Sun Web Server 7.0U1 as well.
    This zone is named "sunmail.domain.ru" and has a routed IP address for direct external access to its servicess.
    The AM SDK part is also patched (126357-01__AM71_x86); it points to the load-balancer name ("psam.domain.ru") as an actual AM server.
    # imsimta version
    Sun Java(tm) System Messaging Server 6.3-6.03 (built Mar 14 2008; 64bit)
    libimta.so 6.3-6.03 (built 17:15:08, Mar 14 2008; 64bit)
    SunOS sunmail 5.10 Generic_127112-07 i86pc i386 i86pc
    While setting up this server set we tried to use AM SSO as the user login method, but it works unreliably.
    "Unreliably" means that while most of the time entering a correct uid and password in Access Manager login page ("http://psam.domain.ru/amserver/UI/Login") does redirect a user back to "http://sunmail.domain.ru/uwc/auth" along with a new cookie, and the user is redirected again to his or her mailbox, sometimes the user receives the UWC/CE login page. Entering the same uid and password here does log him in, but it breaks the whole point of SSO and only increases the end-user routine required to log in :\
    We have also seen the "missing mail tab" problem - if the users point the browser to any hostname different from "sunmail.domain.ru" (i.e. www.mail.domain.ru which is equivalent in DNS), they have only the Address book, Calendar and Options tabs; no webmail. So far this is resolved by Policy Agent forcing The One name of the server.
    Here's the configuration we did specifically for AM SSO:
    1) in AMConfig.properties of "sunmail" and "cos-psam-01" we set up
    com.iplanet.am.cookie.encode=false
    am.encryption.pwd=<the same value>
    all hostname-related parameters point to "psam.domain.ru"
    2) in AMConfig.properties of "cos-psam-01" a number of FQDN equivalence entries are added (so it does not redirect to a server hostname unknown to visitors):
    com.sun.identity.server.fqdnMap[publicname-or-ip]=psam.domain.ru
    com.sun.identity.server.fqdnMap[cos-psam-01.domain.ru]=cos-psam-01.domain.ru
    3) in "msg.conf" on "sunmail" (entries added via configutil):
    local.webmail.sso.amcookiename = iPlanetDirectoryPro
    local.webmail.sso.amnamingurl = http://psam.domain.ru:80/amserver/namingservice
    local.webmail.sso.singlesignoff = yes
    local.webmail.sso.uwcenabled = 1
    service.http.ipsecurity = no
    (perhaps some more options are required? Looking for confirmation about: local.webmail.sso.uwclogouturl local.webmail.sso.uwccontexturi local.webmail.sso.uwchome service.http.allowadminproxy )
    4) Configured Web Policy Agent for Sun Web Server, so that users without an AM session are required to get one. Set up per [http://msg.wikidoc.info/index.php/AM_redirection_using_Policy_Agent], except that com.sun.am.policy.agents.config.notenforced_list points to the many names our server can go known by.
    5) Updated the logout URL in /opt/SUNWuwc/webmail/main.js:
    --- main.js.orig        Sat Jan 26 07:52:09 2008
    +++ main.js     Mon Jul 21 01:06:29 2008
    @@ -667,7 +667,8 @@
    function cleanup() {
       if(laurel)
    -      top.window.location =  getUWCHost() + "/base/UWCMain?op=logout"
    +//      top.window.location =  getUWCHost() + "/base/UWCMain?op=logout"
    +      top.window.location =  "http://sunmail.domain.ru:80/base/UWCMain?op=logout"
       else
           exec('logout', '', 'exit()')
    @@ -1707,7 +1708,8 @@
       if(lg) {
             url = document.location.href
             url = url.substr(0,url.indexOf('webmail'))
    -        uwcurl = url + 'base/UWCMain?op=logout'        
    +//      uwcurl = url + 'base/UWCMain?op=logout'        
    +        uwcurl = "http://sunmail.domain.ru:80/base/UWCMain?op=logout"
       exit()
    }6) Calendar SSO - per docs...
    According to ngrep sniffing,
    1) the browser goes to "http://sunmail.domain.ru/uwc/auth" without any cookies
    2) receives a redirect and goes to "http://psam.domain.ru/amserver/UI/Login?gotoOnFail=http://sunmail.domain.ru:80/uwc&goto=http%3A%2F%2Fsunmail.domain.ru%3A80%2Fuwc%2Fauth"; sends no cookies either.
    3) The first response from the "psam" server (as redirected from "cos-psam-01") sets a few cookies while rendering the login page:
    Set-cookie: JSESSIONID=7EF8F2810D2071CA03CFEAE9972735B2; Path=/
    Set-cookie: AMAuthCookie=AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1+xTqH7C3I=@AAJTSQACMDI=#; Domain=.domain.ru; Path=/
    Set-cookie: amlbcookie=02; Domain=.domain.ru; Path=/
    4) The browser requests the login page resources (javascripts, images, etc) using these cookies, as in this header line:
    Cookie: JSESSIONID=7EF8F2810D2071CA03CFEAE9972735B2; AMAuthCookie=AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1+xTqH7C3I=@AAJTSQACMDI=#; amlbcookie=02
    5) The browser POSTs the login request to "/amserver/UI/Login" and receives a redirection to http://sunmail.domain.ru:80/uwc/auth
    Set-cookie: iPlanetDirectoryPro=AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1+xTqH7C3I=@AAJTSQACMDI=#; Domain=.domain.ru; Path=/
    Set-cookie: AMAuthCookie=LOGOUT; Domain=.domain.ru; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
    6) The browser requests "http://sunmail.domain.ru/uwc/auth" using the newly set cookie (looks like the old one to me though):
    Cookie: amlbcookie=02; iPlanetDirectoryPro=AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1+xTqH7C3I=@AAJTSQACMDI=#
    7) The "sunmail" web-server checks the AM session validity with the same "psam.domain.ru". It sends a series of POSTs to /amserver/namingservice:
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <RequestSet vers="1.0" svcid="com.iplanet.am.naming" reqid="685">
    <Request><![CDATA[
    <NamingRequest vers="1.0" reqid="324" sessid="AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1+xTqH7C3I=@AAJTSQACMDI=#">
    <GetNamingProfile>
    </GetNamingProfile>
    </NamingRequest>]]>
    </Request>
    </RequestSet>(receives a large XML list of different Access Manager configuration parameters and URLs)
    ...then a double-request to /amserver/sessionservice:
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <RequestSet vers="1.0" svcid="Session" reqid="686">
    <Request><![CDATA[
    <SessionRequest vers="1.0" reqid="678">
    <GetSession reset="true">
    <SessionID>AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1+xTqH7C3I=@AAJTSQACMDI=#</SessionID>
    </GetSession>
    </SessionRequest>]]>
    </Request>
    <Request><![CDATA[
    <SessionRequest vers="1.0" reqid="679">
    <AddSessionListener>
    <URL>http://sunmail.domain.ru:80/UpdateAgentCacheServlet?shortcircuit=false</URL>
    <SessionID>AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1+xTqH7C3I=@AAJTSQACMDI=#</SessionID>
    </AddSessionListener>
    </SessionRequest>]]>
    </Request>
    </RequestSet>As a result it receives an XML with a lot of user-specific information (the username, LDAP DN, preferred locale, auth module used, etc.)
    !!!*** Now, the problem part ***!!!
    8) And then "sunmail" POSTs a broken cookie to "psam" (note the space in mid-text, where the "plus" sign was previously). As we know, "+" is often used in URLs to "escape" the space character. Perhaps some URL cleanup routine backfired here.
    I have double-checked, it is not the reverse proxy on "psam" breaking things. It is "sunmail" (UWC/CE or Policy Agent, don't know for certain) supplying the broken request. I looked over the large XML responses to the two previous requests, whenever they mention the session cookie value, the "plus" is there.
    For the most detail I can provide, I'll even paste the whole HTTP packet:
    POST /amserver/sessionservice HTTP/1.1
    Proxy-agent: Sun-Java-System-Web-Server/7.0
    Cookie: iPlanetDirectoryPro=AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1 xTqH7C3I=@AAJTSQACMDI=#;amlbcookie=null
    Content-type: text/xml;charset=UTF-8
    Content-length: 336
    Cache-control: no-cache
    Pragma: no-cache
    User-agent: Java/1.5.0_09
    Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
    Host: cos-psam-01.domain.ru
    Client-ip: 194.xxx.xxx.xxx
    Via: 1.1 https-weblb.domain.ru
    Connection: keep-alive
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <RequestSet vers="1.0" svcid="session" reqid="258">
    <Request><![CDATA[<SessionRequest vers="1.0" reqid="254">
    <GetSession reset="true">
    <SessionID>AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1 xTqH7C3I=@AAJTSQACMDI=#</SessionID>
    </GetSession>
    </SessionRequest>]]></Request>
    </RequestSet> The server's error response is apparent:
    HTTP/1.1 200 OK
    Server: Sun-Java-System-Web-Server/7.0
    Date: Thu, 31 Jul 2008 05:49:50 GMT
    Content-type: text/html
    Transfer-encoding: chunked
    19b
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <ResponseSet vers="1.0" svcid="session" reqid="258">
    <Response><![CDATA[<SessionResponse vers="1.0" reqid="254">
    <GetSession>
    <Exception>AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1 xTqH7C3I=@AAJTSQACMDI=# Invalid session ID
    AQIC5wM2LY4SfcwuT2ASCrsfO78nXdceEHXeH1 xTqH7C3I=@AAJTSQACMDI=#</Exception>
    </GetSession>
    </SessionResponse>]]></Response>
    </ResponseSet>On the few occasions when the AM cookie contains no "plus" characters, the SSO works like a charm (also checked by a sniffer). Whenever there is a "plus", it breaks.
    For reference, here's a working final request-response (one with a good cookie, as received by the load-balancer web-server). Request looks a bit different:
    POST /amserver/sessionservice HTTP/1.1
    Cookie: iPlanetDirectoryPro=AQIC5wM2LY4Sfcy/5sEzVmuq9z1ggdHOkBDgVFAwfhqvn4U=@AAJTSQACMDI=#;amlbcookie=null
    Content-Type: text/xml;charset=UTF-8
    Content-Length: 379
    Cache-Control: no-cache
    Pragma: no-cache
    User-Agent: Java/1.5.0_09
    Host: psam.domain.ru
    Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
    Connection: keep-alive
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <RequestSet vers="1.0" svcid="session" reqid="281">
    <Request><![CDATA[<SessionRequest vers="1.0" reqid="277">
    <SetProperty>
    <SessionID>AQIC5wM2LY4Sfcy/5sEzVmuq9z1ggdHOkBDgVFAwfhqvn4U=@AAJTSQACMDI=#</SessionID>
    <Property name="uwcstatus" value="active"></Property>
    </SetProperty>
    </SessionRequest>]]></Request>
    </RequestSet> ...and the response is OK:
    <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
    <ResponseSet vers="1.0" svcid="session" reqid="281">
    <Response><![CDATA[<SessionResponse vers="1.0" reqid="277">
    <SetProperty>
    <OK></OK>
    </SetProperty>
    </SessionResponse>]]></Response>
    </ResponseSet>

    There have been a few reports of the same behaviour with other customers - specifically with the handling of the encoding of "+" characters to " ". It relates to how cookie encoding/decoding is performed (as you have already observed).
    The solution for these customers was the following:
    => AM server/client side:
    Ensure that com.iplanet.am.cookie.encode=false in AMConfig.properties and AMAgent.properties on all systems.
    => AM client (UWC) side:
    - Set <property name="encodeCookies" value="false"/> in /var/opt/SUNWuwc/WEB-INF/sun-web.xml. This will prevent UWC from trying to urldecode the cookie it receives and therefore stops it turning the + into a space e.g.
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE sun-web-app PUBLIC '-//Sun Microsystems, Inc.//DTD Sun ONE Application Server 7.0 Servlet 2.3//EN' 'file:///net/wajra.india.sun.com/export/share/dtd/sun-web-app_2_3-1.dtd'>
    <sun-web-app>
       <property name="encodeCookies" value="false"/>
       <session-config>
          <session-manager/>
       </session-config>
       <jsp-config/>
    <property name="allowLinking" value="true" />
    </sun-web-app>Regards,
    Shane.

  • Fusion Middleware Control "Identity and Access" menu missing

    Hi.
    I have a problem with one of the fussion middleware control menus which is missing.
    The environment is as follows:
    - One server with OVD + OID
    - One server with Weblogic + ODSM + Fussion Middleware Control
    (All idm fmw 11.1.1.2.0)
    ODSM can connect to OVD / OID on the other server without any problems.
    On Fussion middleware Control I can not see the menu "Identity and Access". In previous installations where all the components where installed together in the same server, that menu appeared without any extra configuration.
    The menu i'm talking about is the one referred here: http://download.oracle.com/docs/cd/E15523_01/oid.1111/e10046/basic_started.htm#CIHHAJJH
    "2.In the left panel topology tree, expand the farm, then Identity and Access. Alternatively, from the farm home page, expand Fusion Middleware, then Identity and Access. Oracle Virtual Directory components are listed in both places"
    Which are the steps to get that menu back? How do i get "linked" fusion middleware control with ovd/oid from the other server?
    Any extra configuration, any steps during installation...
    There's something probably very simple i'm missing but i haven't found any reference about creating/configuring that menu...
    Thanks in advance.

    Hi. i tried what i posted on my last message but i can't pass next step of the installation.
    If i try to install oid+ovd in <host 2> i can select "extend existing domain" and it connects correctly to the weblogic domain (IDMDomain creating during installation of odsm & em fmw control) that is up un running on <host 1>.
    But on the next step it asks for the "Weblogic Server Directory"... If i enter the path where weblogic resides on <host 1> it fails because it looks for it in the host i'm installing oid+ovd <host 2>.
    - First of all, is it really possible to have oid+ovd on one host and weblogic+odsm+enterprise manager fmw control in a different host in a way that makes possible to manage oid+ovd with enterprise manager fmw control?
    - Is it possible to tell the installer that the path for the weblogic server is in a different host? something like host:path?
    - If it's not possible, is it documented anywhere? i haven't found anything regarding that possible limitation.
    Please, any help would be appreciated as this is becoming critical for us.

Maybe you are looking for