Oracle Identity Management Web Tier

1-10 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle ECM Suite This section covers these topics: ■ Section 1.7.1, Oracle Identity Management ■ Section 1.7.2, Web Tier ■ Section 1.7.3, Application Tier ■ Section 1.7.4, Data Tier ■ Section 1.7.5, Unicast Requirement

1.7.1 Oracle Identity Management

Integration with the Oracle Identity Management IDM system is an important aspect of the enterprise deployment architecture. This integration provides features such as single sign-on, integration with OPSS, centralized identity and credential store, authentication for the WebLogic domain, and so on. The Oracle IDM enterprise deployment is separate from the Oracle ECM enterprise deployment and exists in a separate domain by itself. See Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management for more information on identity management in an enterprise deployment context. The primary interface to the Oracle IDM enterprise deployment is the LDAP traffic to the LDAP servers, the OAP Oracle Access Protocol to the OAM Access Servers, and the HTTP redirection of authentication requests.

1.7.2 Web Tier

Nodes in the web tier are located in the DMZ public zone. In this tier, two nodes WEBHOST1 and WEBHOST2 run Oracle HTTP Server configured with WebGate and mod_wl_ohs. Through mod_wl_ohs, which allows requests to be proxied from Oracle HTTP Server to WebLogic Server, Oracle HTTP Server forwards the requests to WebLogic Server running in the application tier. WebGate which is an Oracle Access Manager component in Oracle HTTP Server uses Oracle Access Protocol OAP to communicate with Oracle Access Manager running on OAMHOST2, in the Identity Management DMZ. WebGate and Oracle Access Manager are used to perform operations such as user authentication. The web tier also includes a load balancer router to handle external requests. External requests are sent to the virtual host names configured on the load balancer. The load balancer then forwards the requests to Oracle HTTP Server. The WebGate module in Oracle HTTP Server uses Oracle Access Protocol OAP to communicate with Oracle Access Manager to perform operations such as querying user groups. On the firewall protecting the web tier, only the HTTP ports are open: 443 for HTTPS and 80 for HTTP. Load Balancer Requirements This enterprise topology uses an external load balancer. This external load balancer should have the following features: ■ Ability to load-balance traffic to a pool of real servers through a virtual host name: Clients access services using the virtual host name instead of using actual host names. The load balancer can then load-balance requests to the servers in the pool. Enterprise Deployment Overview 1-11 ■ Port translation configuration should be possible so that incoming requests on the virtual host name and port are directed to a different port on the back-end servers. ■ Monitoring of ports on the servers in the pool to determine availability of a service. ■ Virtual servers and port configuration: Ability to configure virtual server names and ports on your external load balancer, and the virtual server names and ports must meet the following requirements: – The load balancer should allow configuration of multiple virtual servers. For each virtual server, the load balancer should allow configuration of traffic management on more than one port. For example, for Oracle HTTP Server in the web tier, the load balancer needs to be configured with a virtual server and ports for HTTP and HTTPS traffic. – The virtual server names must be associated with IP addresses and be part of your DNS. Clients must be able to access the external load balancer through the virtual server names. ■ Ability to detect node failures and immediately stop routing traffic to the failed node. ■ Fault-tolerant mode: It is highly recommended that you configure the load balancer to be in fault-tolerant mode. ■ It is highly recommended that you configure the load balancer virtual server to return immediately to the calling client when the back-end services to which it forwards traffic are unavailable. This is preferred over the client disconnecting on its own after a timeout based on the TCPIP settings on the client machine. ■ Sticky routing capability: Ability to maintain sticky connections to components. Examples of this include cookie-based persistence, IP-based persistence, and so on. ■ The load balancer should be able to terminate SSL requests at the load balancer and forward traffic to the back-end real servers using the equivalent non-SSL protocol for example, HTTPS to HTTP. Typically, this feature is called SSL acceleration and it is required for this EDG.

1.7.3 Application Tier