Creating Policy Store Users and the Policy Container

10-2 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management

10.3.1 Creating Policy Store Users and the Policy Container

Perform the following tasks on IDMHOST1:

1. Set the environment variables: MW_HOME, JAVA_HOME, IDM_HOME, and ORACLE_

HOME . Set IDM_HOME to IDM_ORACLE_HOME Set ORACLE_HOME to IAM_ORACLE_HOME Set MW_HOME to MW_HOME. Set JAVA_HOME to MW_HOMEjrockit-jdk1.6.0.

2. Create a properties file, called policystore.props with the following contents:

POLICYSTORE_HOST: policystore.mycompany.com POLICYSTORE_PORT: 389 POLICYSTORE_BINDDN: cn=orcladmin POLICYSTORE_READONLYUSER: PolicyROUser POLICYSTORE_READWRITEUSER: PolicyRWUser POLICYSTORE_SEARCHBASE: dc=mycompany,dc=com POLICYSTORE_CONTAINER: cn=jpsroot Where: ■ POLICYSTORE_HOST and POLICYSTORE_PORT are, respectively, the host and port of your Policy Store directory. ■ POLICYSTORE_BINDDN Is an administrative user in the Policy Store directory ■ ■ POLICYSTORE_READONLYUSER and POLICYSTORE_READWRITEUSER are the names of Users you want to create in the Policy Store with Read Only and ReadWrite privileges. ■ POLICYSTORE_SEARCHBASE is the location in the directory where Users and Groups are stored. ■ POLCYSTORE_CONTAINER is the name of the container used for OPSS policy information. After creating the group, the tool adds the readonlyuser as a member of the OrclPolicyAndCredentialReadPrivilegeGroup and readwriteuser as a member of OrclPolicyAndCredentialWritePrivilegeGroup. 3. Configure the Policy Store using the command idmConfigTool which is located at: IAM_ORACLE_HOME idmtoolsbin The syntax of the command on Linux is: idmConfigTool.sh -configPolicyStore input_file=configfile Note: When you run the idmConfigTool, it creates or appends to the file idmDomainConfig.param. This file is generated in the same directory that the idmConfigTool is run from. To ensure that each time the tool is run, the same file is appended to, always run the idmConfigTool from the directory: IAM_ORACLE_HOME idmtoolsbin Preparing Identity and Policy Stores 10-3 The syntax on Windows is: idmConfigTool.bat -configPolicyStore input_file=configfile For example: idmConfigTool.sh -configPolicyStore input_file=policystore.props When the command runs you are prompted to enter the password of the account you are connecting to the Policy Store with. You are also asked to specify the passwords you want to assign to the accounts: ■ POLICYSTORE_READONLYUSER ■ POLICYSTORE_READWRITEUSER Sample command output: Enter Policy Store Bind DN password: Creation of PolicyROUser Apr 5, 2011 4:23:49 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidpolicystore_user.ldif Enter User Password for PolicyROUser: Confirm User Password for PolicyROUser: Creation of PolicyRWUser Apr 5, 2011 4:23:58 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidpolicystore_user.ldif Enter User Password for PolicyRWUser: Confirm User Password for PolicyRWUser: Apr 5, 2011 4:24:07 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidpolicystore_group.ldif Apr 5, 2011 4:24:07 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidpolicystore_ container.ldif Apr 5, 2011 4:24:07 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidpolicystore_group_read_ member.ldif Apr 5, 2011 4:24:07 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidpolicystore_group_ write_member.ldif Apr 5, 2011 4:24:07 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidpolicystore_tuning.ldif Apr 5, 2011 4:24:07 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidoid_schemaadmin.ldif Apr 5, 2011 4:24:07 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidpolicystore_user_ aci.ldif The tool has completed its operation. Details have been logged to homeoracleidmtoolsautomation.log 4. Check log file for any errors or warnings and correct them. The file with the name automation.log is created in the directory from where you run the tool. 10-4 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management

10.3.2 Reassociating the Policy and Credential Store