Viewing Audit Data Auditing

8-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation

8.1.1.1 Setting up SSL on Oracle WebLogic Server

Take these steps to configure the SSL port and keystore for the Oracle WebLogic Server for which you are setting up SSL:

1. Log in to the Oracle WebLogic Server administration console and navigate to

Environment , then Servers.

2. Select the server for which you want to set up SSL.

3. Check SSL Listen Port Enabled and enter an SSL listening port number for

example. 443. We will subsequently refer to this port as SSL_PORT.

4. Click Save.

5. Go to the Keystores tab, and click Lock Edit.

6. In Keystores, select an option that includes Custom Identity.

7. In the Identity section, fill in properties as follows:

■ Custom Identity Keystore: location of keystore containing the SSL private key and certificate ■ Custom Identity Keystore type: jks ■ Custom Identity Keystore Passphrase: storepassword

8. Click Save.

9. Go to the SSL tab.

10. In the Identity section, fill in properties as follows:

■ Private Key Alias: keyalias ■ Private Key Passphrase: keypassword

11. Click Save, then click Activate Changes.

12. Restart the server.

13. To verify that SSL was set up correctly, go to https:HOSTNAME:SSL_PORT;

a certificate should be presented. View the certificate; the subject should match the cn entered when creating the certificate. If you wish to configure Oracle WebLogic Server to require a client SSL certificate, take the following steps:

1. Log in to the Oracle WebLogic Server administration console and navigate to

Environment, then Servers.

2. Select the server for which you want to set up SSL.

3. Go to the SSL tab, then Advanced.

Notes: ■ The CN of the SSL server certificate must be the fully qualified hostname, for example eaevma1302.de.mycorp.com, not eaevma1302. ■ For complete information on how to set up SSL on Oracle Weblogic Server, refer to Configuring SSL in Oracle Fusion Middleware Securing Oracle WebLogic Server. Security 8-3 4. For the property Two Way Client Cert Behavior, select Client Certs Requested and Enforced.

5. Click Save.

6. Go to the Keystores tab. 7. In Keystores, select an option that has the type of Trust Keystore type you wish to configure, and populate the fields in the Trust section.

8. Click Save, and click Activate Changes.

9. Restart the server. You will need to import the CA that issued the client certificate into the Trust Keystore you specified in the Oracle WebLogic Configuration. If it is a Java Keystore, you can use the following command: keytool -import -alias aliasfortrustedca -trustcacerts -file trustedcafile.pem -keystore keystorelocation -storepass truststorepassword

8.1.1.2 Configuring Oracle Identity Federation

Once you have enabled an SSL listening port and uploaded the server and trusted certificates to the respective keystores, you will need to configure Oracle Identity Federation to use SSL. Follow these steps:

1. Log in to Fusion Middleware Control and locate the Oracle Identity Federation

instance.

2. Navigate to Server Properties.

3. Update the port and SOAP port, if necessary to reflect the SSL port configured in

the Oracle Weblogic Server administration console.

4. Check the SSL Enabled checkbox.

5. To force the use of SSL if a request is received at a non-SSL port, check the Force

SSL box. Leave unchecked otherwise.

6. To force client authentication, check the Require Client Certificate box. Leave

unchecked otherwise.

7. Click Apply.

You must re-generate and re-distribute metadata to peer providers after enabling SSL.

8.1.2 Configuring Oracle Identity Federation as an SSL Client

There are two ways to configure Oracle Identity Federation as an SSL client to connect to remote SSL servers: ■ Set up Oracle Identity Federation to use the Oracle WebLogic Server keystores as its identity and trust repositories. This approach is described in Section 8.1.2.1, Notes: ■ Changing the port and SOAP port modifies the server’s metadata to reflect the correct service URLs. ■ The metadata at the peer providers sites must be updated with the new version.