Q: Can Oracle Access Manage achieve the following? WS-Fed(RP) - SAML2(IdP)

Can Oracle Access Manager do protocol translation and act as a gateway for multiple SAML2 IdP's talking back to a WS-Fed (RP/SP) ?
<-> SAML2 (IdP) (multiple namespaces)
WS-Fed (RP) <-> SAML2 (IdP) (multiple namespaces)
<-> SAML2 (IdP)
Sincerely,
Adam

Similar Messages

Can Oracle Access Manager (OAM) be used for configuring data-level access?

Hi,
Can OAM 10gR3 or 11g be used for configuring data-level access in PS 9.10 and OBI 11g.
This would mean that data-level configuration are stored centrally within OAM database and PS 9.10 pulls these settings for its appropriate Row and ChartField security and OBI 11g queries OAM database tables to populate the initialization blocks during login.
If you have configured this successfuly, please feel free to provide highlevel details/steps about the configuration and any complexities that can pre present.
Thanks.

I recently worked on an interesting implementation that utilized OAM configured against OID in which OAM was configured to control authentication/authorization and then all applications that were serviced by OAM utilized the users login to pass to the database at which point the Oracle database utilized VPD, which was configured against the same OID instance, to leverage user attributes/groups in order to configure fine-grained access control to data within the database. Not sure if this would work for you unless your requirements are similar but it worked very well for this particular implementation as it allowed them to have SSO for their own apps and for BI Publisher which then could pass allong the userid to be leveraged by the database to do fine grained access control.
Edited by: oblix_fan on Jun 23, 2011 8:10 AM

Issues integrating WebCenter with Oracle Access Manager

Hi All,
I am trying to integrate WebCenter 10.1.3.2 with Oracle Access Manager (CoreId). Followed the steps described in the Chapter 11 of the OC4J Security Guide.
I was able to successfully authenticate WebCenter using IWA with Access Manager.
Then I proceeded with the below steps:
- Implemented ADF Security in the application. Created application roles and login page and worked fine on my local machine.
- Provide the auth-method of "COREIDSSO" in orion-application.xml
- Renamed the app-jazn-data.xml to give the OID groups
- Mapped the OID groups to application roles in orion-application.xml
- Used the jazn migration tool to populate the system-jazn-data.xml
When trying to access the application, it looks like the ADF Context identifies that this is an authenticated user.
ADFContext.getCurrent().getSecurityContext().isAuthenticated() retruns true
ADFContext.getCurrent().getSecurityContext().isAuthorizationEnabled() returns true
I get the below error message on the server console:
[CoreIDLoginModule::getUserSessionFromCookie]: This user session for F3iwZhUGgjej9RSrMLSo0wjH5Ec6c2oeC0OBRH12y7%2FvfPVncz6dYoBoFD6q8DWAlMtzah%2FYV4T1t7jztVFYbxwfOyu0VOMXMEIosRrFicfJwoPRrM8MOkFsziQxpUqo98XrC9iBRHffdWSItNHZRZK4ZoCJMi6HZZ6noOc4Z%2BGJDGj3kWndYHTWjiG0cJhkSbL95wMmrXCDElzZHjPMdkuNQUHW1TfAJvgSlDeX6hhhIThlc%2BGmxMP3MQ%2FZoxUysbKieIJgDXo1%2FEMmLmTVjA%3D%3D is not valid or user is not logged in.
I also tried using the "Headervar" variable to display the obmygroups value, but it comes as blank.
Any help would be appreciated.
Thanks
Aneesh

We recently integrated Webcenter Application (with ADF Authentication and Authorization) with OAM. May be the following will be of some help to you.
We did the following steps documented in Chapter 11 Oracle Access Manager in Oracle J2EE security guide.
OAM
1. Created ALL specified policies , authentication schemes, protection specified in OAM section of the document.
OC4J
1. Ran all configuration listed for the OC4J section.
Webcenter
1. Developed the Webcenter Application
2. Enabled ADF Security (Authentication & Authorization)
3. Deployed the application. While deploying chose File based provider.
4. After the deployment, changed orion-application.xml to have COREIDSSO as documented in Oracle documentation
system-jazn-data.xml
1. Added login module details as specified in the document. (Changed only the application name. Rest all was same as we used names as specified in the earlier steps of the document)
OID Migration
Reference document: "Configuring a WebCenter Application to Use Oracle Access Manager" in Webcenter Framework Developer guide.
1. Located app-jazn-data.xml in the deployed application
2. Removed "realm-name" and "type" subelements of "grantee" tags. Removed any realm details in user name.
3. changed references to "class oracle.security.jazn.spi.xml.XMLRealmRole" to "oracle.security.jazn.realm.CoreIDPrincipal"
4. ran the JAZN migration tool with "all" options. Migration from app-jazn-data.xml to OID.
OAM
Created policies for protecting our application.
Test the application.
Debugging.
1. Enable oracle.adf.share.security , oracle.j2ee.security & oracle.j2ee.security.oc4j loggers to debug if the application is not working the way you expect to work.
2. Set log level in Enterprise manager.
3. All logging information are written in log.xml in $ORACLE_HOME/j2ee/OC4J_Webcenter/log/OC4J_WebCenter_default_group_1/oc4j
Thanks

WCI single sign on(SSO) configurations with Oracle Access Manager(OAM)

I have to integrate the oracle access manager with the WCI(ALUI) for the SSO implementation.What are the configurations required to implement SSO with oracle access manager in WCI/ALUI

Any answer to the last question on..?
No, better explain my query with 2 scenarios:
Scenario 1:
Usual scenario authentication of a user to a web application without the single web functionality on the acces single manager:
Login screen of the web application ====> Access to the web application home
Scenario 2:
Scenario authentication of a user to a single web application with web functionality on the acces single manager:
Login screen oracle access manager ====> Display login web application ====> Access to the web application home
My query is:
You can configure the functionality of single sign on to access manager with a web application that does not have its login screen of the web application. For example:
Login screen oracle access manager ====> Access to the web application home

Oracle Access Manager - Identity Injectors

Hello,
One of my customer has a critical requirement for Oracle Access Manager.
At present they are using Novell Access Manager
With Novell Access Manager they are able to create custom headers with information pulled from LDAP.
such as x-employeeName=Jason
Example :
Some Web applications require more than a name and a value to be injected into the custom header.
Sometimes they require a custom name, a tag, and a value. Sometimes the application requires a
custom name with multiple tags and values. The Inject into Custom Header with Tags option
provides you with the flexibility to add such values to the custom header. For example, your
application could be expecting the following custom header with tag:
X-Custom_Role Role=Manager
You can inject this information by setting the Custom Header Name to X-Custom, the Tag Name to
Role, and the Tag Value to Manager. The value can be set as a static variable or you can retrieve it
from various sources such as a Liberty User Profile attribute or the roles assigned to the current user.
Thanks,
Ram

Hi
Thanks for your reply.
Can you explain me in steps how it can be achieved in OAM 11g?
Thanks,
Ram

Error during execution of SSO with Oracle Access Manager 11gR2

Hello friends,
I have a problem with SSO using Oracle Access Manager 11g R2, then describes the steps taken in this test:
1. Is accessed by the OAM protected application through IE browser, Chrome and Firefox for testing purposes.
2. The OAM protected application, here is redirected to the OAM page to enter the credentials for the application.
3. Shows the application, and again reorders authentication credentials.
Here the details of the cookie:
a. cookie1: ADMINCONSOLESESSION
b. cokkie2: OAMAuthnCookie_webgate11g.domain.com: 7777
We also found an error when starting the node oam_server in WebLogic Server 11g (10.3.6)
Log:
[2012-11-29T18:16:02.411-05:00] [oam_server1] [ERROR] [JPS-03156] [oracle.jps.authorization.framework] [tid: [ACTIVE].ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000JhEStpUFW7WFLzRL8A1GhylJ000002,0] [APP: oam_server#11.1.2.0.0] The exception has been thrown by ARME. The authorization result is set to deny.[[
com.bea.security.providers.authorization.asi.InvocationException: ArmeRUNTIME Exception: null
     at com.bea.security.providers.authorization.asi.AuthorizationProviderImpl.isAccessAllowed(AuthorizationProviderImpl.java:396)
     at com.bea.security.ssal.micro.MicroAuthorizationManagerWrapper.isAccessAllowed(MicroAuthorizationManagerWrapper.java:73)
     at com.bea.security.impl.AuthorizationServiceImpl.isAccessAllowed_internal(AuthorizationServiceImpl.java:914)
     at com.bea.security.impl.AuthorizationServiceImpl.isAccessAllowed(AuthorizationServiceImpl.java:745)
     at com.bea.security.impl.AuthorizationServiceImpl.isAccessAllowed(AuthorizationServiceImpl.java:668)
     at com.bea.security.impl.AuthorizationServiceImpl.isAccessAllowed(AuthorizationServiceImpl.java:622)
     at com.bea.security.AuthorizationService.isAccessAllowed(AuthorizationService.java:365)
     at oracle.security.am.common.policy.runtime.provider.oes.proxy.OESRuntimeProxy.wait4OESRuntimeDBPolicyRefreshCompletion(OESRuntimeProxy.java:263)
     at oracle.security.am.common.policy.runtime.provider.oes.proxy.OESRuntimeProxy.init(OESRuntimeProxy.java:193)
     at oracle.security.am.common.policy.runtime.provider.oes.OESPolicyRuntimeProvider.init(OESPolicyRuntimeProvider.java:167)
     at oracle.security.am.common.policy.runtime.PolicyRuntimeFactory.getNewInstance(PolicyRuntimeFactory.java:162)
     at oracle.security.am.common.policy.runtime.PolicyRuntimeFactory.init(PolicyRuntimeFactory.java:93)
     at oracle.security.am.common.policy.runtime.PolicyRuntimeFactory.getPolicyRuntime(PolicyRuntimeFactory.java:84)
     at oracle.security.am.common.policy.util.PolicyComponentLifecycle.initialize(PolicyComponentLifecycle.java:100)
     at oracle.security.am.lifecycle.ApplicationLifecycle.initComponentBootstrap(ApplicationLifecycle.java:156)
     at oracle.security.am.lifecycle.ApplicationLifecycle.contextInitialized(ApplicationLifecycle.java:86)
     at weblogic.servlet.internal.EventsManager$FireContextListenerAction.run(EventsManager.java:481)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
     at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
     at weblogic.servlet.internal.EventsManager.notifyContextCreatedEvent(EventsManager.java:181)
     at weblogic.servlet.internal.WebAppServletContext.preloadResources(WebAppServletContext.java:1868)
     at weblogic.servlet.internal.WebAppServletContext.start(WebAppServletContext.java:3154)
     at weblogic.servlet.internal.WebAppModule.startContexts(WebAppModule.java:1518)
     at weblogic.servlet.internal.WebAppModule.start(WebAppModule.java:484)
     at weblogic.application.internal.flow.ModuleStateDriver$3.next(ModuleStateDriver.java:425)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:52)
     at weblogic.application.internal.flow.ModuleStateDriver.start(ModuleStateDriver.java:119)
     at weblogic.application.internal.flow.ScopedModuleDriver.start(ScopedModuleDriver.java:200)
     at weblogic.application.internal.flow.ModuleListenerInvoker.start(ModuleListenerInvoker.java:247)
     at weblogic.application.internal.flow.ModuleStateDriver$3.next(ModuleStateDriver.java:425)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:52)
     at weblogic.application.internal.flow.ModuleStateDriver.start(ModuleStateDriver.java:119)
     at weblogic.application.internal.flow.StartModulesFlow.activate(StartModulesFlow.java:27)
     at weblogic.application.internal.BaseDeployment$2.next(BaseDeployment.java:671)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:52)
     at weblogic.application.internal.BaseDeployment.activate(BaseDeployment.java:212)
     at weblogic.application.internal.EarDeployment.activate(EarDeployment.java:59)
     at weblogic.application.internal.DeploymentStateChecker.activate(DeploymentStateChecker.java:161)
     at weblogic.deploy.internal.targetserver.AppContainerInvoker.activate(AppContainerInvoker.java:79)
     at weblogic.deploy.internal.targetserver.BasicDeployment.activate(BasicDeployment.java:184)
     at weblogic.deploy.internal.targetserver.BasicDeployment.activateFromServerLifecycle(BasicDeployment.java:361)
     at weblogic.management.deploy.internal.DeploymentAdapter$1.doActivate(DeploymentAdapter.java:51)
     at weblogic.management.deploy.internal.DeploymentAdapter.activate(DeploymentAdapter.java:200)
     at weblogic.management.deploy.internal.AppTransition$2.transitionApp(AppTransition.java:30)
     at weblogic.management.deploy.internal.ConfiguredDeployments.transitionApps(ConfiguredDeployments.java:261)
     at weblogic.management.deploy.internal.ConfiguredDeployments.transitionApps(ConfiguredDeployments.java:220)
     at weblogic.management.deploy.internal.ConfiguredDeployments.activate(ConfiguredDeployments.java:169)
     at weblogic.management.deploy.internal.ConfiguredDeployments.deploy(ConfiguredDeployments.java:123)
     at weblogic.management.deploy.internal.DeploymentServerService.resume(DeploymentServerService.java:180)
     at weblogic.management.deploy.internal.DeploymentServerService.start(DeploymentServerService.java:96)
     at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Caused by: com.wles.InternalException: ArmeRUNTIME Exception: null
     at com.wles.arme.Credentials_ca.exceptionTransport(Credentials_ca.java:606)
     at com.wles.arme.Credentials_ca._accessAllowed(Credentials_ca.java:343)
     at com.wles.arme.CredentialsImpl._accessAllowed(CredentialsImpl.java:400)
     at com.wles.arme.CredentialsImpl._accessAllowed(CredentialsImpl.java:422)
     at com.wles.arme.CachingCredentialsImpl._accessAllowed(CachingCredentialsImpl.java:225)
     at com.wles.arme.CredentialsImpl.accessAllowed(CredentialsImpl.java:452)
     at com.wles.arme.CachingCredentialsImpl.accessAllowed(CachingCredentialsImpl.java:68)
     at com.bea.security.providers.authorization.asi.AuthorizationProviderImpl.ARMEisAccessAllowed(AuthorizationProviderImpl.java:977)
     at com.bea.security.providers.authorization.asi.AuthorizationProviderImpl.isAccessAllowed(AuthorizationProviderImpl.java:347)
     ... 52 more
causal exception is:
com.wles.InternalException: ArmeRUNTIME Exception: null
     at com.wles.arme.Credentials_ca.exceptionTransport(Credentials_ca.java:606)
     at com.wles.arme.Credentials_ca._accessAllowed(Credentials_ca.java:343)
     at com.wles.arme.CredentialsImpl._accessAllowed(CredentialsImpl.java:400)
     at com.wles.arme.CredentialsImpl._accessAllowed(CredentialsImpl.java:422)
     at com.wles.arme.CachingCredentialsImpl._accessAllowed(CachingCredentialsImpl.java:225)
     at com.wles.arme.CredentialsImpl.accessAllowed(CredentialsImpl.java:452)
     at com.wles.arme.CachingCredentialsImpl.accessAllowed(CachingCredentialsImpl.java:68)
     at com.bea.security.providers.authorization.asi.AuthorizationProviderImpl.ARMEisAccessAllowed(AuthorizationProviderImpl.java:977)
     at com.bea.security.providers.authorization.asi.AuthorizationProviderImpl.isAccessAllowed(AuthorizationProviderImpl.java:347)
     at com.bea.security.ssal.micro.MicroAuthorizationManagerWrapper.isAccessAllowed(MicroAuthorizationManagerWrapper.java:73)
     at com.bea.security.impl.AuthorizationServiceImpl.isAccessAllowed_internal(AuthorizationServiceImpl.java:914)
     at com.bea.security.impl.AuthorizationServiceImpl.isAccessAllowed(AuthorizationServiceImpl.java:745)
     at com.bea.security.impl.AuthorizationServiceImpl.isAccessAllowed(AuthorizationServiceImpl.java:668)
     at com.bea.security.impl.AuthorizationServiceImpl.isAccessAllowed(AuthorizationServiceImpl.java:622)
     at com.bea.security.AuthorizationService.isAccessAllowed(AuthorizationService.java:365)
     at oracle.security.am.common.policy.runtime.provider.oes.proxy.OESRuntimeProxy.wait4OESRuntimeDBPolicyRefreshCompletion(OESRuntimeProxy.java:263)
     at oracle.security.am.common.policy.runtime.provider.oes.proxy.OESRuntimeProxy.init(OESRuntimeProxy.java:193)
     at oracle.security.am.common.policy.runtime.provider.oes.OESPolicyRuntimeProvider.init(OESPolicyRuntimeProvider.java:167)
     at oracle.security.am.common.policy.runtime.PolicyRuntimeFactory.getNewInstance(PolicyRuntimeFactory.java:162)
     at oracle.security.am.common.policy.runtime.PolicyRuntimeFactory.init(PolicyRuntimeFactory.java:93)
     at oracle.security.am.common.policy.runtime.PolicyRuntimeFactory.getPolicyRuntime(PolicyRuntimeFactory.java:84)
     at oracle.security.am.common.policy.util.PolicyComponentLifecycle.initialize(PolicyComponentLifecycle.java:100)
     at oracle.security.am.lifecycle.ApplicationLifecycle.initComponentBootstrap(ApplicationLifecycle.java:156)
     at oracle.security.am.lifecycle.ApplicationLifecycle.contextInitialized(ApplicationLifecycle.java:86)
     at weblogic.servlet.internal.EventsManager$FireContextListenerAction.run(EventsManager.java:481)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
     at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
     at weblogic.servlet.internal.EventsManager.notifyContextCreatedEvent(EventsManager.java:181)
     at weblogic.servlet.internal.WebAppServletContext.preloadResources(WebAppServletContext.java:1868)
     at weblogic.servlet.internal.WebAppServletContext.start(WebAppServletContext.java:3154)
     at weblogic.servlet.internal.WebAppModule.startContexts(WebAppModule.java:1518)
     at weblogic.servlet.internal.WebAppModule.start(WebAppModule.java:484)
     at weblogic.application.internal.flow.ModuleStateDriver$3.next(ModuleStateDriver.java:425)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:52)
     at weblogic.application.internal.flow.ModuleStateDriver.start(ModuleStateDriver.java:119)
     at weblogic.application.internal.flow.ScopedModuleDriver.start(ScopedModuleDriver.java:200)
     at weblogic.application.internal.flow.ModuleListenerInvoker.start(ModuleListenerInvoker.java:247)
     at weblogic.application.internal.flow.ModuleStateDriver$3.next(ModuleStateDriver.java:425)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:52)
     at weblogic.application.internal.flow.ModuleStateDriver.start(ModuleStateDriver.java:119)
     at weblogic.application.internal.flow.StartModulesFlow.activate(StartModulesFlow.java:27)
     at weblogic.application.internal.BaseDeployment$2.next(BaseDeployment.java:671)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:52)
     at weblogic.application.internal.BaseDeployment.activate(BaseDeployment.java:212)
     at weblogic.application.internal.EarDeployment.activate(EarDeployment.java:59)
     at weblogic.application.internal.DeploymentStateChecker.activate(DeploymentStateChecker.java:161)
     at weblogic.deploy.internal.targetserver.AppContainerInvoker.activate(AppContainerInvoker.java:79)
     at weblogic.deploy.internal.targetserver.BasicDeployment.activate(BasicDeployment.java:184)
     at weblogic.deploy.internal.targetserver.BasicDeployment.activateFromServerLifecycle(BasicDeployment.java:361)
     at weblogic.management.deploy.internal.DeploymentAdapter$1.doActivate(DeploymentAdapter.java:51)
     at weblogic.management.deploy.internal.DeploymentAdapter.activate(DeploymentAdapter.java:200)
     at weblogic.management.deploy.internal.AppTransition$2.transitionApp(AppTransition.java:30)
     at weblogic.management.deploy.internal.ConfiguredDeployments.transitionApps(ConfiguredDeployments.java:261)
     at weblogic.management.deploy.internal.ConfiguredDeployments.transitionApps(ConfiguredDeployments.java:220)
     at weblogic.management.deploy.internal.ConfiguredDeployments.activate(ConfiguredDeployments.java:169)
     at weblogic.management.deploy.internal.ConfiguredDeployments.deploy(ConfiguredDeployments.java:123)
     at weblogic.management.deploy.internal.DeploymentServerService.resume(DeploymentServerService.java:180)
     at weblogic.management.deploy.internal.DeploymentServerService.start(DeploymentServerService.java:96)
     at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
We appreciate your support in solving the case. Thanks...
JLK
Edited by: JLK on Nov 30, 2012 9:43 AM

Hi Viju,
Did you executed the python script to register OPSS. If not then you will get the mentioned error:
I have mentioned couple of workarounds. Can you try those and let me know the results. Take the backup of your entire environment before you follow the steps:::
1. For the ARME issue patch can be applied for 11.1.2
OAM Bundle Patch Release History (Doc ID 736372.1)
Yes. This is a benign message. ( the ARME issue)
OAM 11R2 After Upgrade The Managed Server Start With Error ArmeRUNTIME Exception: Null (Doc ID 1509559.1)
The other issue is under investgation and is benign.
<oracle.adfinternal.view.faces.renderkit.rich.RegionRenderer> WARNING when accessing oamconsole (Doc ID 1511967.1)
The final message is spoken to here:
WLS 10.3.3: "Auto-Ref-By: WebApp" deployed as shared library is affecting other web applications. (Doc ID 1210393.1)
Action Plan:
=========
1. For the ARME issue patch can be applied for 11.1.2
OAM Bundle Patch Release History (Doc ID 736372.1)
Hope this helps.

Discuss Identity and Access Management in the Cloud

Identity and access management in the cloud refers to the processes, technologies, and policies for managing cloud systems identities and controlling how these identities can be used to access cloud resources. Three separate processes are used in most cloud
identity and access management solutions:
Identity provisioning and storage
Authentication
Authorization
Identity management in a cloud system requires a complex collection of technologies to manage authentication, authorization and access control across distributed environments. These environments might include assets both on the internal cloud, which would
be an on-premises private cloud, and services accessed on the public cloud. These environments can also cross-security domains, as when two enterprise-level organizations collaborate and enable cross-domain access to users from the partner security domain.
You can learn more about these topics in the article Identity and Access Management in the Cloud.
Let's talk about that article and the topics of identity and access management in the cloud! Use this thread to get it started.
Thanks!
Tom
Learn more about Private Cloud at the
Private Cloud Solutions Hub

Tom,
I am a novice and attempting to achieve a proof of concept of single sign on. One example I read stated one should install Identity and Access on VS2012. I did this on two different machines. One was in the office domain and it shows the
item "Identity and Access..." in the context menu of the MVC project I created. The other machine is my laptop. I followed the same procedure that worked on the desktop, yet the Identity and Access item in the project context menu does not show.
One difference is that the laptop is not part of a domain, but I am attempting this proof of concept in Windows Azure with the laptop, since we do not have a test AD in our corporate domain.
Is this the right forum to inquire about this issue? Do you have a recommendation about a better forum?
Stephen Pidgeon

Oracle Access Manager, ADAM & UCM integration? Help please..

I`m currently investigating the potential of using Oracle Access Manager (OAM) as a tool that allows connections to multiple Active Directory(AD) or ADAM servers providing a single point to author and manage users with a good easy to use GUI.
The UCM will connect directly to OAM and authenticate users connecting from AD accounts..
At the moment we use Quest software to manage users, but the cost for setting up users is £15/user where as OAM is only £3. I believe..
Right the questions I have :)
1. Has any one set this type of environment up?
2. ls OAM stand alone or will I need additional software to set it up?
Reading the installation guide it says I need the following:
# Oracle Internet Directory 10g (10.1.4.0.1)
# Microsoft Active Directory
# Oracle Virtual Directory Server 10.1.4.0.1
# Oracle Virtual Directory Manager 10.1.4.0.1
# Oracle Virtual Directory Patch 10.1.4.0.1 (P5667977)
# Stand-alone Oracle HTTP Server 2.x (This needs to be preinstalled in your environment. You can download the OHS 2.x standalone from the Oracle SOA Suite 10g Companion (10.1.3.1.0) release from here.)
3. Can I use IIS instead of Oracle HTTP Server?
4. Can I install OAM on 1 server or do I need multiple servers, I`v been looking at the diagrams and reading through the guides I`m getting a little confused with Identity and Access server?

Hi,
Have you got information reg UCM & OAM integration?
Could you please help me with the integration guide?
Regards,
Ashish

Oracle Access Manager, ADAM & Oracle ECM - UCM integration?

I`m currently investigating the potential of using Oracle Access Manager (OAM) as a tool that allows connections to multiple Active Directory(AD) or ADAM servers providing a single point to author and manage users with a good easy to use GUI.
The UCM will connect directly to OAM and authenticate users connecting from AD accounts..
At the moment we use Quest software to manage users, but the cost for setting up users is £15/user where as OAM is only £3. I believe..
Right the questions I have :)
1. Has any one set this type of environment up?
2. ls OAM stand alone or will I need additional software to set it up?
Reading the installation guide it says I need the following:
# Oracle Internet Directory 10g (10.1.4.0.1)
# Microsoft Active Directory
# Oracle Virtual Directory Server 10.1.4.0.1
# Oracle Virtual Directory Manager 10.1.4.0.1
# Oracle Virtual Directory Patch 10.1.4.0.1 (P5667977)
# Stand-alone Oracle HTTP Server 2.x (This needs to be preinstalled in your environment. You can download the OHS 2.x standalone from the Oracle SOA Suite 10g Companion (10.1.3.1.0) release from here.)
3. Can I use IIS instead of Oracle HTTP Server?
4. Can I install OAM on 1 server or do I need multiple servers, I`v been looking at the diagrams and reading through the guides I`m getting a little confused with Identity and Access server?

The OAM identity system (identity server and WebPass) sound like a good fit for what you want to do. One constraint is that if you want to create/manage users in different directory instances via a single OAM identity system installation, you would also need OVD.
And yes you definitely can have IIS host the WebPass - OHS, OID etc are not required.
-Vinod

Oracle Access Manager and Passing Cert Info to HTML or JSP

Friends,
We are trying to pass the CN information from our smartcard (CAC) that looks i.e. john.doe.123456789 as a parameters to an Oracle Forms using the staticHTML implementation utilizing the OBLIX SSO OR utilizing a JSP or HTML file to read these parameters and update OID. We can pass the UID but since we will have First-time Registration of the Smartcards, the UID doesn't count since the CN information from the Smartcard has not been populated at this point to the OID, we are trying to get the functionality going to get the user first to put in their login and password but at submit time, to update the OID with the CN information to a separate column of OID and not the UID.
Utilizing the OAM, we have been able to proof concept the authentication using the UID by using the Policy Manager and the Access System Console --> Access System Configuration. It's works well with the plugin that comes with the OAM (SSOOblixAuth.java) and thx to Oracle Support, but we need to be able to pass other parameters that are specified as a part of the Resource - Action as headervars such as
HeaderVar OBLIX_SN or
hearderVar OBLIX_MAIL
Our Oracle Access Implementation is in halt until we find a way to pass these return Attributes to our Oracle Forms. The Oracle Forms running SSO is working greatly with just the userlogin and password (UID is passed as a header) without the Oracle Access Manager (OBLIX) but now we have shifted to this product for reading and processing Smartcard information.
Any help we can get, we very much appreciate it.
KA

O.K.
I am getting closer but still not getting the ssooblixuser or ssooblixcn. I have
the following jsp to fire after a successful authentication.
The following code is utilized in our SSO environment for changing passwords.
The bolded line should get the ssooblixuser but it is not..
<%
response.setHeader("Cache-Control", "no-cache");
response.setHeader("Pragma", "no-cache");
response.setHeader("Expires", "Thu, 29 Oct 1969 17:04:19 GMT");
request.setCharacterEncoding("UTF-8");
response.setContentType("text/html; charset=UTF-8");
String remoteUser = null;
String userDn = null;
String referer = null;
String oblixheader = null;
remoteUser = request.getRemoteUser();
userDn=request.getHeader("OSSO-USER-DN");
referer=request.getHeader("referer");
oblixuser = request.getHeader("ssooblixuser");
%>
<HTML>
<HEAD>
<SCRIPT language="JavaScript">
function validatePasswordsMatch()
var frm = document.forms["changePassword"];
if(frm.newpwd.value != frm.confirm_newpwd.value)
alert('The Password and verified password do not match!');
return false;
else
document.changePassword.submit();
return false;
function cancelButton()
document.close();
</SCRIPT>
</HEAD>
<BODY bgcolor="#cae3ff" >
<table width="750" height="10" border="0" cellspacing="0" cellpadding="0">
</table>
<TABLE ALIGN="Center">
<TR><TD>User Name</TD><TD> <%=remoteUser%> </TD></TR>
<TR><TD>OBLIX USER</TD><TD> <%=oblixuser%> </TD></TR>
Edited by: user10130371 on Sep 17, 2009 8:09 AM
Edited by: user10130371 on Sep 17, 2009 8:10 AM

Oracle Access Manager 10.1.4.0.1 WebPass

Hi,
Where can I download Oracle Access Manager WebPass for Sparc machine. I downloaded the whole Access Manager package when I unpack it i found the following webpass file;
Oracle_Access_Manager10_1_4_0_1_sparc-s2_NSAPI_WebPass
During installtion of above file it requires a obj.conf file absolute path instead of httpd.conf. I think I need following file
Oracle_Access_Manager10_1_4_0_1_sparc-s2_OHS2_WebPass
Where can I find above installation file????
Note: I have downloaed the OHS server from following link as I couldn't found any link for 10g version of OHS and the example given on Oracle website is using OHS 2.x for identity manager and following met the requirements.
http://www.oracle.com/technology/software/products/middleware/htdocs/111110_fmw.html
Oracle instruction page to install Identity Manager --> http://www.oracle.com/technology/obe/fusion_middleware/im1014/ovd-oam/oam-ovd/install_oam/install_oam.htm
Please help.

Hi Sheeraz,
The OHS2 WebPass can be found in the file oam_int_solaris_v2_cd2.zip which can be downloaded here:
http://www.oracle.com/technology/software/products/ias/htdocs/101401.html
Click the CD3 link in the 3rd Party Integration row in the Solaris column.
Regards,
Colin

Oracle Access Manager Webgate

Hi All,
I have a little confutation about Oracle Access Manager webgate. Please help me to figure it out.
There are five web server I need to protected using OAM. Three are IIS 6.0/7.0 in Wondows 2008, one is Apache v2 in RHEL 5 and one in Apache Tomcat in Cent OS 5. All OS are 64 bit platform.
I need to know which webgate I have to download and install for IIS and Apache? Please provide me the download link.
I have seen following documentation, but I am unable to find Oracle_Access_Manager10_1_4_3_0_Win64_ISAPI_Webgate.exe or Oracle_Access_Manager10_1_4_3_0_platform_OHS_Webgate
http://docs.oracle.com/cd/E28271_01/doc.1111/e15478/apch2ihs.htm
http://docs.oracle.com/cd/E21764_01/doc.1111/e15478/iis_wg.htm
Thanks
Tamim Khan

Hi Chinni,
Thanks for you help.
I am downloading oam_int_win_v11_cd1.zip, I have few more question on webgate?
1. How can I determine which webgate use for which web server considering the version of the server (ie: IIS6/7). I have found oam-3rd.xls file. is it the way to chose webgate for some platform.
2. Is there any official documentation to perform this operation for third pary webgate.
3. Please consider the following senior:
We have one Web application that authentication of RCPS performs from Data base tables. After successfully login, user got different types of roles like Admin, Manager, Guest User, Internal User etc, Base on the that role user menu is populate. For example Admin user has 7 menus but internal user has 4 menus. That menu item load from Database tables after login in to the application.
As because the application are not authenticating from Database after implementation of OAM, so after authenticating from OAM how the user menu is populate?
Thanks
Tamim Khan

Problem in customizing Oracle Access Manager 10g

HI,
I am facing some problem while incorporating customizations into Oracle Access Manager 10g.
When trying to access the url with a particular style name.... i am getting the following error :
obhtmlpage.cpp:160: Error:
obhtmlpage.cpp:277: Error: ExXSLTProcessingGeneric: Exception processing stylesheet. Root stylesheet ID: ../../../lang/en-us/style0/login.xsl
obxdkxsl.cpp:224: Error: ObXDKTransform
obxdkcache.cpp:528: Error:
obxdkcache.cpp:565: Error:
../obcacheof.cpp:429: Error:
../obcacheof.cpp:795: Error:
../obcacheof.cpp:932: Error:
obxdkcache.cpp:291: Error: ObXdkObject::ObXdkObject
Front Page Admin
Sun Microsystems Solaris
Could someone please provide some help as to how to solve the problem.
Thanks.

One good way to debug the XSL stylesheet issue is to apply the XSL outside of OAM with input XML and see if you get the results. You can use tools such as XML SPy for XSL development and testing.
This error is more in line with XSL syntax and processing.
Thanks
Ram

Configure Oracle Access Manager - from weblogic OIF instance page bombs out

I am trying to integrate OIF with Oracle Access Manager as SP integration module. But, when clicked on "Configure Oracle Access Manager" it throws the following error:
Oracle Access Manager cannot be configured properly. Make sure the Oracle Access Manager SDK Server has been configured properly and the required environment variables have been set. Details can be found on Online Help and Administrative Guide.
I have updated the environment variables and classpath, also confirmed the Access Server SDK to work properly by testing java JAccessGate.
any help is greatly appreciated.
The diagnostic logs show these errors:
========================
Login of admin identity cn=usca_iam_admin failed. Please check to make sure the admin user ID is valid.
at com.oblix.accessmgr.ObAccessManager.sendRequest(ObAccessManager.java:163)
at com.oblix.accessmgr.ObAccessManager.setAdmin(ObAccessManager.java:195)
at oracle.security.fed.admin.config.mbeans.OAMConfigUtils.configureOAM(Unknown Source)
at oracle.security.fed.admin.config.mbeans.AdminUtilMXBeanImpl.configureOAM(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at oracle.as.jmx.framework.standardmbeans.spi.OracleStandardEmitterMBean.doInvoke(OracleStandardEmitterMBean.java:889)
at oracle.as.jmx.framework.generic.spi.interceptors.ContextClassLoaderMBeanInterceptor.internalInvoke(ContextClassLoaderMBeanInterceptor.java:94)
at oracle.as.jmx.framework.generic.spi.interceptors.AbstractMBeanInterceptor.doInvoke(AbstractMBeanInterceptor.java:245)
at oracle.as.jmx.framework.generic.spi.interceptors.MBeanRestartInterceptor.internalInvoke(MBeanRestartInterceptor.java:116)
at oracle.as.jmx.framework.generic.spi.interceptors.AbstractMBeanInterceptor.doInvoke(AbstractMBeanInterceptor.java:245)
at oracle.as.jmx.framework.generic.spi.security.AbstractMBeanSecurityInterceptor.internalInvoke(AbstractMBeanSecurityInterceptor.java:174)
at oracle.as.jmx.framework.generic.spi.interceptors.AbstractMBeanInterceptor.doInvoke(AbstractMBeanInterceptor.java:245)
at oracle.as.jmx.framework.standardmbeans.spi.OracleStandardEmitterMBean.invoke(OracleStandardEmitterMBean.java:803)
at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:836)
at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:761)
at weblogic.management.jmx.mbeanserver.WLSMBeanServerInterceptorBase$16.run(WLSMBeanServerInterceptorBase.java:449)
at java.security.AccessController.doPrivileged(Native Method)
at weblogic.management.jmx.mbeanserver.WLSMBeanServerInterceptorBase.invoke(WLSMBeanServerInterceptorBase.java:447)
at weblogic.management.mbeanservers.internal.JMXContextInterceptor.invoke(JMXContextInterceptor.java:268)
at weblogic.management.jmx.mbeanserver.WLSMBeanServerInterceptorBase$16.run(WLSMBeanServerInterceptorBase.java:449)
at java.security.AccessController.doPrivileged(Native Method)
at weblogic.management.jmx.mbeanserver.WLSMBeanServerInterceptorBase.invoke(WLSMBeanServerInterceptorBase.java:447)
at weblogic.management.mbeanservers.internal.SecurityInterceptor.invoke(SecurityInterceptor.java:444)
at weblogic.management.jmx.mbeanserver.WLSMBeanServer.invoke(WLSMBeanServer.java:323)
at weblogic.management.mbeanservers.internal.JMXConnectorSubjectForwarder$11$1.run(JMXConnectorSubjectForwarder.java:663)
at java.security.AccessController.doPrivileged(Native Method)
at weblogic.management.mbeanservers.internal.JMXConnectorSubjectForwarder$11.run(JMXConnectorSubjectForwarder.java:661)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
at weblogic.management.mbeanservers.internal.JMXConnectorSubjectForwarder.invoke(JMXConnectorSubjectForwarder.java:654)
at javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.java:1426)
at javax.management.remote.rmi.RMIConnectionImpl.access$200(RMIConnectionImpl.java:72)
at javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(RMIConnectionImpl.java:1264)
at java.security.AccessController.doPrivileged(Native Method)
at javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(RMIConnectionImpl.java:1366)
at javax.management.remote.rmi.RMIConnectionImpl.invoke(RMIConnectionImpl.java:788)
at javax.management.remote.rmi.RMIConnectionImpl_WLSkel.invoke(Unknown Source)
at weblogic.rmi.internal.BasicServerRef.invoke(BasicServerRef.java:589)
at weblogic.rmi.internal.BasicServerRef$1.run(BasicServerRef.java:477)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:147)
at weblogic.rmi.internal.BasicServerRef.handleRequest(BasicServerRef.java:473)
at weblogic.rmi.internal.wls.WLSExecuteRequest.run(WLSExecuteRequest.java:118)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
My Oracle Access Manager is 10.1.4.3 and OIF is 11.1.1.3
thanks

Hello,
I'm having the same problem. Did anybody find a solution to fix it?
Any help is appreciated.
Regards,
Ignacio.

Oracle Access Manager 10g3 Blog

Hi Everyone,
I have created a New Blog for Oracle Access Manager and i would like everyone to have a look at it and give me some comments on it like what are the other topics i can keep which can help us all etc....
You can visit it at http://go4oam.blogspot.com/

HI,
I am facing some problem while incorporating customizations into Oracle Access Manager 10g.
When trying to access the url with a particular style name.... i am getting the following error :
obhtmlpage.cpp:160: Error:
obhtmlpage.cpp:277: Error: ExXSLTProcessingGeneric: Exception processing stylesheet. Root stylesheet ID: ../../../lang/en-us/style0/login.xsl
obxdkxsl.cpp:224: Error: ObXDKTransform
obxdkcache.cpp:528: Error:
obxdkcache.cpp:565: Error:
../obcacheof.cpp:429: Error:
../obcacheof.cpp:795: Error:
../obcacheof.cpp:932: Error:
obxdkcache.cpp:291: Error: ObXdkObject::ObXdkObject
Front Page Admin
Sun Microsystems Solaris
Could someone please provide some help as to how to solve the problem.
Thanks.

Q: Can Oracle Access Manage achieve the following? WS-Fed(RP) - SAML2(IdP)

Similar Messages

Maybe you are looking for