Connecting to an SSO-Enabled Directory as an SSO-Authenticated User

Getting Started with Administering Oracle Virtual Directory 8-11 ORACLE_HOME commonbinwlst.sh 2. After seeing the Welcome screen, enter connect and provide the username, password, and URL to the Admin Server. A message displays confirming a successful connection. 3. Enter the following listCred method to retrieve Oracle Directory Services Managers Java Key Store password: listCred map=ODSMMap, key=ODSMKey.Wallet

8.3.7.3 Listing the Contents of odsm.cer Java Key Store

After you retrieve the Java Key Store password, you can manage it using the keytool command. To list contents of odsm.cer:

1. Move cd to the directory containing the odsm.cer, for example:

cd DOMAINconfigfmwconfigserversAdminServerapplicationsodsmconf

2. Use keytool to list the contents of odsm.cer, for example:

ORACLE_HOME jdkjrebinkeytool -list -keystore odsm.cer \ -storepass MS86RB -v Keystore type: JKS Keystore provider: SUN Your keystore contains 2 entries Alias name: serverselfsigned Creation date: Dec 26, 2008 Entry type: PrivateKeyEntry Certificate chain length: 1 Certificate[1]: Owner: CN=OVD, OU=Development, O=Oracle, L=Redwood Shores, ST=California, C=US Issuer: CN=OVD, OU=Development, O=Oracle, L=Redwood Shores, ST=California, C=US Serial number: 495586b6 Valid from: Fri Dec 26 17:36:54 PST 2008 until: Wed Jun 24 18:36:54 PDT 2009 Certificate fingerprints: MD5: 6C:11:16:F3:88:8D:18:67:35:1E:16:5B:3E:03:8A:93 SHA1: F4:91:39:AE:8B:AC:46:B8:5D:CB:D9:A4:65:BE:D2:75:08:17:DF:D0 Signature algorithm name: SHA1withRSA Version: 3 Alias name: cn=rootca, o=oracle, c=us 0 Creation date: Dec 31, 2008 Entry type: trustedCertEntry Owner: CN=RootCA, O=Oracle, C=US Issuer: CN=RootCA, O=Oracle, C=US See Also: The Managing Credentials with WLST Commands section in the Oracle Fusion Middleware Security Guide for more information. 8-12 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory Serial number: 0 Valid from: Tue Dec 30 02:33:11 PST 2008 until: Mon Jan 24 02:33:11 PST 2050 Certificate fingerprints: MD5: 72:31:7B:24:C9:72:E3:90:37:38:68:40:79:D1:0B:4B SHA1: D2:17:84:1E:19:23:02:05:61:42:A9:F4:16:C8:93:84:E8:20:02:FF Signature algorithm name: MD5withRSA Version: 1

8.3.7.4 Managing Expired Certificates

All of a user’s trusted certificates are stored in the Oracle Directory Services Manager Java Key Store. Because Oracle Directory Services Manager does not provide a web-based user interface for managing the keystore, and cannot automatically remove expired certificates from the JKS, administrators must use keytool to find and delete any expired certificates. As described in Listing the Contents of odsm.cer Java Key Store , the keytool lists the validity of each certificate, enabling you to find all expired certificates. For example, the following certificate is valid until Saturday, October 31, 09:41:23 PDT 2008. Alias name: cn=ovd, ou=development, o=MyCompany, l=redwood shores, st=california, c=us 1241455283 Creation date: May 5, 2008 Entry type: trustedCertEntry Owner: CN=OVD, OU=Development, O=MyCompany, L=Redwood Shores, ST=California,C=US Issuer: CN=OVD, OU=Development, O=Oracle, L=Redwood Shores, ST=California,C=US Serial number: 49ff1ab3 Valid from: Mon May 04 09:41:23 PDT 2008 until: Sat Oct 31 09:41:23 PDT 2008 Certificate fingerprints: MD5: 93:0E:41:5E:95:88:71:BD:8A:49:ED:A9:29:3B:0A:1E SHA1: 84:C6:75:60:D9:BE:7B:CA:D6:8B:B5:4B:97:E4:20:39:44:82:FE:93 Signature algorithm name: SHA1withRSA Version: 3 To delete expired certificates, see Deleting Trusted Certificates .

8.3.7.5 Deleting Trusted Certificates

To delete trusted certificates inodsm.cer: 1. Move cd to the directory containing the odsm.cer, for example: cd DOMAIN_HOME configfmwconfigserversAdminServer 2. Use keytool to delete the contents of odsm.cer, for example: ORACLE_HOME jdkjrebinkeytool -delete -keystore odsm.cer \ -storepass PASSWORD_OBTAINED_FROM_CSF -alias cn=rootca, o=oracle, c=us 0 [Storing odsm.cer]

8.3.8 Configuring Oracle Directory Services Manager Session Timeout

The default session timeout for Oracle Directory Services Manager is 35 minutes. You can change this default value by editing the file web.xml, which resides in DOMAIN_