1-8 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle WebCenter
This section covers these topics:
■
Section 1.5.1, Oracle Identity Management
■
Section 1.5.2, Web Tier
■
Section 1.5.3, Application Tier
■
Section 1.5.4, Data Tier
■
Section 1.5.5, What to Install
■
Section 1.5.6, Unicast Requirement
1.5.1 Oracle Identity Management
Integration with the Oracle Identity Management system is an important aspect of the enterprise deployment architecture. This integration provides features such as single
sign-on, integration with Oracle Platform Security Services, centralized identity and credential store, authentication for the WebLogic domain, and so on. The Oracle
Identity Management enterprise deployment is separate from this enterprise deployment and exists in a separate domain by itself. For more information on Oracle
Identity Management in an enterprise deployment context, see Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management.
The primary interface to the Oracle Identity Management enterprise deployment is the LDAP traffic to the LDAP servers, the OAP Oracle Access Protocol to the OAM
Access Servers, and the HTTP redirection of authentication requests.
1.5.2 Web Tier
Nodes in the web tier are located in the DMZ public zone. In this tier, two nodes WEBHOST1 and WEBHOST2 run Oracle HTTP Server
configured with WebGate and mod_wl_ohs. Through mod_wl_ohs, which allows requests to be proxied from Oracle HTTP Server
to WebLogic Server, Oracle HTTP Server forwards the requests to WebLogic Server running in the application tier.
WebGate which is an Oracle Access Manager component in Oracle HTTP Server uses Oracle Access Protocol OAP to communicate with Oracle Access Manager running
on OAMHOST2, in the Identity Management DMZ. WebGate and Oracle Access Manager are used to perform operations such as user authentication.
The web tier also includes a load balancer router to handle external requests. External requests are sent to the virtual host names configured on the load balancer. The load
balancer then forwards the requests to Oracle HTTP Server.
The WebGate module in Oracle HTTP Server uses Oracle Access Protocol OAP to communicate with Oracle Access Manager to perform operations such as querying
user groups.
On the firewall protecting the web tier, only the HTTP ports are open: 443 for HTTPS and 80 for HTTP.
1.5.2.1 Load Balancer Requirements
This enterprise topology uses an external load balancer. This external load balancer should have the following features:
■
Ability to load-balance traffic to a pool of real servers through a virtual host name: Clients access services using the virtual host name instead of using actual host
Enterprise Deployment Overview 1-9
names. The load balancer can then load balance requests to the servers in the pool.
■
Port translation configuration should be possible so that incoming requests on the virtual host name and port are directed to a different port on the backend servers.
■
Monitoring of ports on the servers in the pool to determine availability of a service.
■
Virtual servers and port configuration: Ability to configure virtual server names and ports on your external load balancer, and the virtual server names and ports
must meet the following requirements:
– The load balancer should allow configuration of multiple virtual servers. For
each virtual server, the load balancer should allow configuration of traffic management on more than one port. For example, for Oracle HTTP Server in
the web tier, the load balancer needs to be configured with a virtual server and ports for HTTP and HTTPS traffic.
– The virtual server names must be associated with IP addresses and be part of
your DNS. Clients must be able to access the external load balancer through the virtual server names.
■
Ability to detect node failures and immediately stop routing traffic to the failed node.
■
Fault-tolerant mode: It is highly recommended that you configure the load balancer to be in fault-tolerant mode.
■
It is highly recommended that you configure the load balancer virtual server to return immediately to the calling client when the backend services to which it
forwards traffic are unavailable. This is preferred over the client disconnecting on its own after a timeout based on the TCPIP settings on the client machine.
■
Sticky routing capability: Ability to maintain sticky connections to components. Examples of this include cookie-based persistence, IP-based persistence, and so on.
■
The load balancer should be able to terminate SSL requests at the load balancer and forward traffic to the backend real servers using the equivalent non-SSL
protocol for example, HTTPS to HTTP. Typically, this feature is called SSL acceleration and it is required for this Enterprise Deployment.
1.5.3 Application Tier
