Validating Oracle Identity Federation Configure the Enterprise Manager Agents Enabling Oracle Identity Federation Integration with LDAP Servers

15-10 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management cd MW_HOMEoracle_commoncommonbin .setNMProps.sh 7. Restart the Node Manager on OIFHOST1 and OIFHOST2 by following the steps in Section 20.1, Starting and Stopping Oracle Identity Management Components. 8. Restart the Administration server by following the steps in Section 20.1, Starting and Stopping Oracle Identity Management Components. 9. Validate that the Administration Server started up successfully by opening a browser accessing the Administration Console at http:ADMINVHN.mycompany.com:7001console. Also validate Enterprise Manager by opening a browser and accessing Oracle Enterprise Manager Fusion Middleware Control at http:ADMINVHN.mycompany.com:7001em. 10. Restart the Managed Servers on OIFHOST1 and OIFHOST2 by using the Administration Console as described in Section 20.1, Starting and Stopping Oracle Identity Management Components. 11. Delete the MW_HOMEadminIDMDomainaserver directory on OIFHOST1 and OIFHOST2. This directory is created by the Oracle Universal Installer when the domain is originally configured and is no longer required after the provisioning the Managed Server to the local disk.

15.5 Validating Oracle Identity Federation

Validate the configuration of Oracle Identity Federation on OIFHOST1 and OIFHOST2 by accessing the SP and IdP metatadata on each host. Proceed as follows on OIFHOST1: 1. Access the SP metadata by going to: http:oifhost1.mycompany.com:7499fedspmetadata 2. Access the IdP metadata by going to: http:oifhost1.mycompany.com:7499fedidpmetadata Proceed as follows on OIFHOST2: 1. Access the SP metadata by going to: http:oifhost2.mycompany.com:7499fedspmetadata 2. Access the IdP metadata by going to: http:oifhost2.mycompany.com:7499fedidpmetadata

15.6 Configure the Enterprise Manager Agents

All the Oracle Fusion Middleware components deployed in this enterprise deployment are managed by using Oracle Enterprise Manager Fusion Middleware Control. To manage Oracle Identity Federation with this tool, you must configure the EM agents with the correct monitoring credentials. Update the credentials for the EM agents associated with OIFHOST1 and OIFHOST2. Follow these steps to complete this task: 1. Use a web browser to access Oracle Enterprise Manager Fusion Middleware Control at http:ADMINVHN.mycompany.com:7001em. Log in as the WebLogic user. Extending the Domain with Oracle Identity Federation 15-11 2. From the Domain Home Page, navigate to the Agent-Monitored Targets page using the menu under Farm - Agent-Monitored Targets. ■ Click the Configure link for the Target Type Identity Federation Server to go to the Configure Target Page. ■ On the Configure Target Page, click Change Agent and choose the correct agent for the host. ■ Update the WebLogic monitoring user name and the WebLogic monitoring password . Enter weblogic as the WebLogic monitoring user name and the password for the weblogic user as the WebLogic monitoring password. ■ Click OK to save your changes.

15.7 Enabling Oracle Identity Federation Integration with LDAP Servers

By default, Oracle Identity Federation is not configured to be integrated with LDAP Servers deployed in a high availability configuration. To integrate Oracle Identity Federation with highly available LDAP Servers to serve as user data store, federation data store, or authentication engine, you must configure Oracle Identity Federation based on the LDAP servers function. Proceed as follows to integrate Oracle Identity Federation with an LDAP Server deployed in a high availability configuration 1. On IDMHOST1, set the DOMAIN_HOME and IDM_ORACLE_HOME environment variables to the Administration Server Domain home. 2. On IDMHOST1, set the environment using the setOIFEnv.sh script. This script is located under the IDM_ORACLE_HOMEfedscripts directory. For example: IDMHOST1 export DOMAIN_HOME=u01apporacleadminIDMDomainaserverIDMDomain IDMHOST export IDM_ORACLE_HOME=IDM_ORACLE_HOME IDMHOST1 cd IDM_ORACLE_HOMEfedscripts IDMHOST1 . setOIFEnv.sh 3. On IDMHOST1, run the WLST script located under the ORACLE_COMMON_HOMEbin directory. IDMHOST1 cd ORACLE_COMMON_HOMEcommonbin IDMHOST1 .wlst.sh 4. Connect to one of the Oracle Identity Federation Managed Servers: wls:offline connect Enter the username and password to connect to the Oracle Identity Federation Managed Servers. This is the same as the WebLogic Administration user name and password. Enter the URL to connect to the Oracle Identity Federation Managed Server: t3:OIFHOST1.mycompany.com:7499 5. Then enter the following properties, as needed: ■ To integrate the user data store with a highly available LDAP Server, set the userldaphaenabled boolean property from the datastore group to true: wls:IDMDomainserverConfig setConfigPropertydatastore,userldaphaenabled, true, boolean 15-12 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management Update was successful for: userldaphaenabled ■ Validate the user data store is integrated with a highly available LDAP store by running: wls:IDMDomainserverConfig getConfigPropertydatastore, userldaphaenabled Values for property: true The userldaphaenabled property must return true. ■ To integrate the federation data store with a highly available LDAP Server, set the fedldaphaenabled boolean property from the datastore group to true: wls:IDMDomainserverConfig setConfigPropertydatastore, fedldaphaenabled,true, boolean Update was successful for: fedldaphaenabled ■ Validate the federation data store is integrated with a highly available LDAP store by running: wls:IDMDomainserverConfig getConfigPropertydatastore, fedldaphaenabled Values for property: true The fedldaphaenabled property must return true. ■ To integrate the LDAP authentication engine with a highly available LDAP Server, set the ldaphaenabled boolean property from the authnengines group to true: wls:IDMDomainserverConfig setConfigPropertyauthnengines,ldaphaenabled, true, boolean Update was successful for: ldaphaenabled ■ Validate the LDAP authentication engine is integrated with a highly available LDAP store by running: wls:IDMDomainserverConfig getConfigPropertyauthnengines,ldaphaenabled Values for property: true The ldaphaenabled property for the authnengines group must return true. Note: On IDMHOST1, delete the following directories: ■ ORACLE_ BASE adminIDMDomainaserverIDMDomainconfigfmw configserverswls_oif1applications ■ ORACLE_ BASE adminIDMDomainaserverIDMDomainconfigfmw configserverswls_oif2applications Extending the Domain with Oracle Identity Federation 15-13

15.8 Configuring Oracle Identity Federation to work with the Oracle Web Tier