Prerequisites Copying OAM Keystore Files to OAAMHOST1 and OAAMHOST2 Registering OAAM as a Third Party Application

Integrating Components 18-17

18.2.1 Prerequisites

Before starting this association, ensure that the following tasks have been performed:

1. Install and configure Oracle Access Manager OAM as described in

Chapter 11, Extending the Domain with Oracle Access Manager 11g.

2. Configure Oracle Access Manager to work with an LDAP store as described in

Chapter 11, Extending the Domain with Oracle Access Manager 11g.

3. Install Oracle Adaptive Access Manager as described in

Chapter 12, Extending the Domain with Oracle Adaptive Access Manager.

18.2.2 Copying OAM Keystore Files to OAAMHOST1 and OAAMHOST2

If you are using Oracle Access Manager with the Simple Security Transport model, you must copy the OAM keystore files oamclient-truststore.jks and ssoKeystore.jks that were generated in Section 11.11, Creating Oracle Access Manager Key Store to OAAMHOST1 and OAAMHOST2. Copy these files to the directory DOMAIN_HOME configfmwconfig on OAAMHOST1 and OAAMHOST2.

18.2.3 Registering OAAM as a Third Party Application

If you have configured Oracle Access Manager to use the Simple Security Transportation protocol, you must register OAAM as a third-party application. To do this, proceed as follows: 1. From IDMHOST1, start the wlst shell from the IAM_ORACLE_ HOME commonbin directory. For example, on Linux and UNIX-based systems, you would type: .wlst.sh On Windows you would type: .wlst.cmd 2. Connect to the WebLogic Administration Server using the following wlst connect command: connectAdminUser,AdminUserPassword,t3:hostname:port For example: connectweblogic,admin_password,t3:ADMINVHN.mycompany.com:7001 3. Run the registerThirdPartyTAPPartner command as follows: registerThirdPartyTAPPartnerpartnerName = partnerName, keystoreLocation= path to keystore , password=keystore password, tapTokenVersion=v2.0, tapScheme=TAPScheme, tapRedirectUrl=OAAM login URL Where ■ partnerName is a unique name. If the partner exists in Oracle Access Manager, the configuration will be overwritten. ■ keystoreLocation is an existing Key Store location. If the directory path you specified is not present, you get an error. On Windows, the patch needs to be escaped, for example: C:\\oam-oaam\\tap\keystore\store.jks 18-18 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management ■ password is the password specified to encrypt the key store. Remember this, as you will need it later. ■ tapTokenVersion is always v2.0. ■ tapScheme is the authentication scheme to be updated. ■ tapRedirectUrl is a reachable URL. If it is not, registration fails with the message: Error Hyperlink reference not valid. ■ tapRedirectUrl is constructed as follows: http:OAAM_SERVER_HOST:OAAM_SERVER_PORToaam_serveroamLoginPage.jsp For example: registerThirdPartyTAPPartnerpartnerName = OAAMTAPPartner, keystoreLocation= IAM_ORACLE_HOMETAPTapKeyStoremykeystore.jks , password=password, tapTokenVersion=v2.0, tapScheme=TAPScheme, tapRedirectUrl=http:oaamhost1.mycompany.com:14300oaam_ serveroamLoginPage.jsp ■ 4. Copy the file IAM_ORACLE_HOMETAPTapKeyStoremykeystore.jks to the same location on OAAMHOST1 and OAAMHOST2. For example: scp IAM_ORACLE_HOMETAPTapKeyStoremykeystore.jks OAAMHOST2:IAM_ORACLE_ HOME TAPTapKeyStoremykeystore.jks 5. Log in to the OAM Admin Console at: http:admin.mycompany.com:80oamconsole.

6. Click TAPScheme under Authentication Schemes.

Click Open. 7. Change the Challenge URL to: https:sso.mycompany.com:443oaam_serveroamLoginPage.jsp. Add the following Challenge Parameter: MatchLDAPAttribute=uid 8. Click Apply. 9. Restart WLS_OAAM1 and WLS_OAAM2 as described in Section 20.1, Starting and Stopping Oracle Identity Management Components. Note: Due to a bug, tapRedirectURL must be an http url. This is changed to https later. Note: mykeystore.jks is always created on the WebLogic Administration Server host. Integrating Components 18-19

18.2.4 Adding Password to IAMSuiteAgent Profile