Troubleshooting Tips Oracle Fusion Middleware Online Documentation Library

Configuring Single Sign-On Using Oracle Access Manager 10g 16-5

3. Optional

: Install a Fusion Middleware product Oracle Identity Manager, Oracle SOA Suite, or Oracle Web Center for example: a. Confirm the location of required JAR files in the following Fusion Middleware path: ORACLE_INSTANCEmodulesoracle.oamprovider_11.1.1oamAuthnProvider.jar ORACLE_INSTANCEmodulesoracle.oamprovider_11.1.1oamcfgtool.jar b. Locate the console-extension WAR file in the following path: ORACLE_INSTANCEmodulesoracle.oamprovider_11.1.1oamauthenticationprov ider.war c. Copy the WAR file to the following path in the WebLogic Server home: WL_HOMEserverlibconsole-extautodeployoamauthenticationprovider.war 4. Install OHS 11g for the Oracle Access Manager 10g 10.1.4.3 WebGate, if needed: ■ Authenticator or Oracle Web Services Manager : No Web server is required for the custom AccessGate. The protected resource is accessed using its URL on the Oracle WebLogic Server. ■ Oracle Access Manager Identity Asserter : Requires Oracle HTTP Server 11g Web server configured as a reverse proxy in front of Oracle WebLogic Server. 5. Install Oracle Access Manager 10g 10.1.4.3 components and perform initial setup as follows: a. Install an Identity Server; install a WebPass; set up the Identity System. b. Install and set up Policy Manager. Ensure that the policy protecting the Policy Manager, access, is created and enabled, as well as the default authentication schemes. c. Install Access Servers one as a primary server and one as a secondary server for WebGate. – Add an Access Server configuration profile in the Access System Console for the primary server for WebGate. Ensure that the Access Management Service is On also known as Policy Manager API Support Mode. – Add a secondary Access Server configuration profile with the Access Management Service On. – Install the primary Access Server instance and then install the secondary Access Server instance.

d. WebGate for Identity Asserter for Single Sign-On

: In an existing Web Tier with one or more WebGates, no new WebGates or profiles are needed. Note: Without a Fusion Middleware application, you must acquire the required JAR and WAR files as described in later procedures. See Also: About Oracle Access Manager 10g Installation and Setup on page 16-2 Note: Only one secondary Access Server is supported 16-6 Oracle Fusion Middleware Application Security Guide In a fresh Web Tier, you must create a profile to define the WebGate for perimeter authentication, as follows: – Create an AccessGate configuration profile to define the WebGate for perimeter authentication. Ensure that the Access Management Service is On . You can use the OAMCfgTool or Access System Console. – Associate the WebGate profile with a primary and a secondary Access Server. – Install a WebGate for Oracle HTTP Server 11g configured as a reverse proxy for every application. – Repeat until you have a profile and a WebGate protecting each application.

e. AccessGate

: For the Authenticator, or when you have Oracle Web Services, Manager you must add a new profile for custom AccessGates in the Access System Console – Add an AccessGate configuration profile in the Access System Console and ensure that the Access Management Service is On. – Associate the AccessGate profile with a primary and a secondary Access Server. – Deploy the custom AccessGate in oamAuthnProvider.jar. – Repeat until you have a profile and a AccessGate protecting each application. 6. Proceed as follows: ■ Simple or Cert Mode : Converting Oracle Access Manager Certificates to Java Keystore Format ■ Authenticator or Oracle Web Services Manager : Creating Resource Types in Oracle Access Manager 10g on page 16-9 must be performed if you use the Oracle Access Manager Authenticator or if you have Oracle Web Services Manager policies protecting Web services. ■ Identity Asserter for Single Sign-On : Perform tasks in Configuring OAM Identity Assertion for SSO with Oracle Access Manager 10g on page 16-34.

16.1.1.3 Converting Oracle Access Manager Certificates to Java Keystore Format

Oracle recommends that all Java components and applications use JKS as the keystore format. This topic provides steps to convert Oracle Access Manager X.509 certificates to Java Keystore JKS format. These steps, when followed properly, generate the JKS stores that can be used while the Java NAP client wants to communicate with an Oracle Access Manager Access Server in Simple or Cert certificate mode. When communicating in Simple or Cert mode, the Access Server uses a key, server certificate, and CA chain files: See Also: Introduction to OAMCfgTool on page 16-15 See Also: About OAM 10g WebGateAccessGate Profiles and Policy Domains on page 16-2 Configuring Single Sign-On Using Oracle Access Manager 10g 16-7 ■ aaa_key.pem: the random key information generated by the certificate-generating utilities while it sends a request to a Root CA. This is your private key. The certificate request for WebGate generates the certificate-request file aaa_req.pem. You must send this WebGate certificate request to a root CA that is trusted by the Access Server. The root CA returns the WebGate certificates, which can then be installed either during or after WebGate installation. ■ aaa_cert.pem: the actual certificate for the Access Server, signed by the Root CA. ■ aaa_chain.pem: the public certificate of the Root CA. This is used when peers communicating in Simple or Cert mode perform an SSL handshake and exchange their certificates for validity. In Simple Mode, the aaa_chain.pem is the OpenSSL certificate located inAccessServer_install_ diraccessoblixtoolsopensslsimpleCAcacert.pem Here, aaa is the name you specify for the file applicable only to Cert and chain files. You can edit an existing certificate with a text editing utility to remove all data except that which is contained within the CERTIFICATE blocks. You then convert the edited certificate to JKS format, and import it into the keystore. Java KeyTool does not allow you to import an existing Private Key for which you already have a certificate. You must convert the PEM format files to DER format files using the OpenSSL utility. To convert an Oracle Access Manager certificate to JKS format and import it 1. Install and configure Java 1.6 or the latest version. 2. Copy the following files before editing to retain the originals: ■ aaa_chain.pem ■ aaa_cert.pem ■ cacert.pem, only if configuring for Simple mode 3. Edit aaa_chain.pem using TextPad to remove all data except that which is contained within the CERTIFICATE blocks, and save the file in a new location to retain the original. -----BEGIN CERTIFICATE----- ... CERTIFICATE ... -----END CERTIFICATE----- 4. Run the following command for the edited aaa_chain.pem: JDK_HOME \bin\keytool -import -alias root_ca -file aaa_chain.pem -keystore rootcerts Here you are assigning an alias short name root_ca to the key. The input file aaa_chain.pem is the one that you manually edited in step 3. The keystore name is rootcerts . You must give a password to access the keys stored in the newly created keystore. Note: To ensure security, Oracle recommends that you allow the keytool to prompt you to enter the password. This prompt occurs automatically when the “-storepass” flag is omitted from the command line.