Authentication and Password Management Integration Migration and Lifecycle Management Custom Development TroubleshootingFAQ

1-4 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager Flash Fingerprinting Oracle Adaptive Access Manager uses device fingerprinting along with many other types of data to determine the risk associated with a specific access request. Outlines of calls needed to perform the flash fingerprinting are presented in Chapter 15, Flash Fingerprinting.

1.4 Authentication and Password Management Integration

Benefits of the Oracle Access Manager-Oracle Adaptive Access Manager-Oracle Identity Manager integration is presented in Chapter 16, Access and Password Management Integration.

1.5 Migration and Lifecycle Management

Because of integrated deployment of Oracle Adaptive Access Manager with other applications, migration or configuration changes in those applications might be required in Oracle Adaptive Access Manager. For the steps involved in migrating an existing natively integrated 10.1.4.5 application that is currently using SOAP authentication to 11g, refer to Chapter 17, Migrating Native Applications to OAAM 11g. . For examples for handling lifecycle configuration changes, refer to Chapter 18, Handling Lifecycle Management Changes.

1.6 Custom Development

Custom development instructions are in the following chapters: ■ Chapter 19, Creating OAAM Oracle BI Publisher Reports ■ Chapter 20, Developing Custom Challenge Processors ■ Chapter 21, Creating a View of a Non-OAAM Database ■ Chapter 22, Developing a Custom Loader for OAAM Offline

1.7 TroubleshootingFAQ

Chapter 23, FAQTroubleshooting provides troubleshooting tips and answers to frequently asked questions. Part I Part I Native Integration Part 1 contains information about APIs used to integrate Oracle Adaptive Access Manager in the following chapters: ■ Chapter 2, Natively Integrating with Oracle Adaptive Access Manager ■ Chapter 3, Integrating Native .NET Applications ■ Chapter 4, Integrating Native Java Applications ■ Chapter 5, Native API for OTP Challenge 2 Natively Integrating with Oracle Adaptive Access Manager 2-1 2 Natively Integrating with Oracle Adaptive Access Manager Oracle Adaptive Access Manager provides APIs to fingerprint devices, collect authentication and transaction logs, run security rules, challenge the user to answer pre-registered questions correctly, and generate virtual authentication devices such as KeyPad, TextPad, or QuestionPad. Native Oracle Adaptive Access Manager integration involves customizing your application to include OAAM API calls at various stages of the login process. The application invokes Oracle Adaptive Access Manager directly and the application itself manages the authentication and challenge flows. Using the Oracle Adaptive Access Manager APIs, you can: ■ Change the default user registration flow ■ Control and manage the authentication process flow This chapter contains guidelines to integrate a client application with Oracle Adaptive Access Manager using the APIs the server exposes. The typical process flows for the authentication and challenge scenarios are presented in this chapter. Within these flow sections, there are details about which API should be called at each stage. The integration options are presented in the following sections: ■ Using Web Services and SOAP API ■ Using Static Linking ■ Integrating with Virtual Authentication Devices and Knowledge-Based Authentication ■ Integrating with Knowledge-Based Authentication Example Application The example application is available as a form of documentation to illustrate how to call the product APIs. It is not intended as production code. For example, the sample application does not have proper error handling; it only provides basic elements of API usage. Customers implementing a native integration should develop their own application using the sample application as a reference only. 2-2 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager

2.1 Overview

To integrate with Oracle Adaptive Access Manager, the application can use the native API. Choose one of the following native API options: ■ SOAP service wrapper API for Java or .NET applications. Refer to Using Web Services and SOAP API . ■ Link libraries statically for Java applications only Refer to Using Static Linking .

2.1.1 Using Web Services and SOAP API

In this scenario, the application communicates with Oracle Adaptive Access Manager using the Oracle Adaptive Access Manager native client API SOAP service wrapper API or via Web services. The SOAP service wrapper API enables you to create SOAP objects and invoke SOAP calls and abstracts the SOAP Web Service Definition Language WSDL and other Web services details from the application code. Libraries for this API are available for the following languages: Java, .NET, and C++. Using this API is recommended over making direct SOAP calls. The reasons are as follows: ■ The client library constructs the SOAP objects, and the details involved in SOAP calls is abstracted from the client application. ■ A SOAP API signature change does not require any change in the client code. ■ The API provides higher-level utility methods to extract parameters directly from the HTTP request and HTTP session objects. ■ It provides methods to encode and decode fingerprint data. This integration requires adding lightweight client libraries JARs or DLLs to the client library. Figure 2–1 illustrates how an application communicates with Oracle Adaptive Access Manager using Web services and the server API. Note: Custom applications developed for these deployments are not supported directly. However, Oracle Support Services can assist customers with product issues, such as if customers encounter problems when using the provided APIs. Natively Integrating with Oracle Adaptive Access Manager 2-3 Figure 2–1 Client Application Using Web Services and Server API

2.1.2 Using Static Linking

Java applications can be static-linked. This scenario only involves local API calls and therefore no remote server risk engine calls SOAP calls. The integration imbeds the processing engine for Oracle Adaptive Access Manager with the application and enables it to leverage the underlying database directly for processing. In this scenario, the application must include the server JARs and configured properties, as appropriate. Even though static linking may provide slightly better performance, it is not suitable for all Java clients. Static linking is recommended for clients developing their own applications with Oracle Adaptive Access Manager built in their J2EE or application. Static-linking an application has several advantages: ■ The application makes no SOAP calls, thus eliminating the need to create and delete TCPIP connections. ■ It experiences no network latencies. ■ It does not require a load balancer.

2.2 Integration Options

This section describes the following integration options: ■ Integrating with Virtual Authentication Devices and Knowledge-Based Authentication ■ Integrating with Knowledge-Based Authentication

2.2.1 Integrating with Virtual Authentication Devices and Knowledge-Based Authentication

This integration consolidates virtual authentication devices and knowledge-based authentication. Globalized virtual authentication device image files including registration flows must be developed by the deployment team.