Change the values for attributes Rmiurl, Soapurl, and click Apply to save the

12-16 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager

12.3.5.7 Configuring SSL for MDS Utilities

All Oracle Identity Manager MDS Utilities which contains WLST scripts must be set to the following environment variable in the shell in which you are running the script: WLST_PROPERTIES=-Dweblogic.security.SSL.ignoreHostnameVerification=true-Dwe blogic.security.TrustKeyStore=DemoTrust

12.3.5.8 Configuring SSL for SPMLCallback Domain

To configure SSL for SPMLcallback domain: 1. Ensure that Oracle Identity Manager port is SSL enabled with HostName verification set to false. 2. Enable SSL on Fusion Applications including callback domain. 3. If you are using WebLogic default trust store, you must not change anything other than enabling the SSL mode. 4. If you have certificates other than default, then the trusted certificates should be exchanged between them to establish two-way trust. See Signing the Certificates on page 12-10 and Exporting the Certificate on page 12-10 for information about signing and exporting certificates.

5. If you are using a stand-alone client for sending SPML requests for testing

purpose, then you must:

a. Add the following system properties to SPML client command to send the

request to SSL enabled OIM port. – Djavax.net.ssl.trustStore=D:\Oracle\Middleware1\wlserver_10.3\server\lib \DemoTrust.jks – -Djava.protocol.handler.pkgs=weblogic.net – -Dweblogic.security.TrustKeyStore=DemoTrust b. Add webserviceclient+ssl.jar to your client classpath. Note: Once this property is set, WLST works fine. You will see INFONOTICE messages, which you can ignore. See Also: Enabling SSL for Oracle Identity Manager By Using Custom Keystore on page 12-11 for information about enabling SSL for Oracle Identity Manager by using custom keystore See Also: Configuring SSL in the Oracle Fusion Middleware Securing Oracle WebLogic Server for detailed information about configuring SSL for Oracle WebLogic Server Note: Change the value of the Djavax.net.ssl.trustStore parameter to point to the truststore used to configure SSL. See Configuring SSL for Design Console on page 12-15 for information about the location of the trust store used in WebLogic to configure SSL. Handling Lifecycle Management Changes 12-17

12.3.6 Enabling SSL for Oracle Identity Manager DB

You need to perform the following configurations to enable SSL for Oracle Identity Manager DB: ■ Setting Up DB in Server-Authentication SSL Mode ■ Creating KeyStores and Certificates ■ Updating Oracle Identity Manager ■ Updating WebLogic Server

12.3.6.1 Setting Up DB in Server-Authentication SSL Mode

To set up DB in Server-Authentication SSL mode: 1. Stop the DB server and the listener. 2. Configuring the listener.ora file as follows: a. Navigate to the path: DB_ORACLE_HOMEnetworkadmin directory For example: scratchuser1production-databaseproduct11.1.0db_1networkadmin b. Edit the listener.ora file to include SSL listening port and Server Wallet Location. The following is the sample listener.ora file: listener.ora Network Configuration File: scratchrbijjaproduction-databaseproduct11.1.0db_1networkadminliste ner.ora Generated by Oracle configuration tools. SSL_CLIENT_AUTHENTICATION = FALSE WALLET_LOCATION = SOURCE = METHOD = FILE METHOD_DATA = DIRECTORY = scratchrbijjaproduction-databaseproduct11.1.0db_1binserver_keystore _ssl.p12 LISTENER = DESCRIPTION_LIST = DESCRIPTION = ADDRESS = PROTOCOL = TCPSHOST = dadvmh0175.us.oracle.comPORT = 2484 DESCRIPTION = ADDRESS = PROTOCOL = TCPHOST = dadvmh0175.us.oracle.comPORT = 1521 TRACE_LEVEL_LISTENER = SUPPORT