Disabling and Enabling Oracle Security Token Service Troubleshooting Oracle Security Token Service Log File Location Additional Considerations

8-130 Oracle Fusion Middleware High Availability Guide If a WebLogic Server node fails, external connection failover is based on the configuration, the retry timeout, and the number of retries. Oracle Access Manager Agent-Access Server failover is based on a timeout. When the load balancing router or proxy server detects a WebLogic Server node failure, subsequent client connections route to the active instance, which picks up the session state from the Coherence Distributed Object Cache and continues processing. Front Channel HTTP bindings use a load balancing router for failover When it receives an exception from another service, Oracle Access Manager retries external connection requests. The number of retries is configurable and includes a no retries option. See the following topics for more information: ■ Section 8.8.2.2.1, WebLogic Server Crash ■ Section 8.8.2.2.2, Node Failure ■ Section 8.8.2.2.3, Database Failure

8.8.3.5.1 Death Detection and Restart OAMOracle Security Token Service Access

Servers support a heartbeat check in the form of a ping request sent over HTTP. Also, the WebLogic Node Manager on the managed server can monitor the application and restart if the event isn’t running. Restarting an OAM Access Server does not affect any other cluster components or members.

8.8.3.5.2 Node Failure External Connection failover is based on the configuration, retry

timeout, and the number of retries. The LBR or Proxy Server detects node failure and subsequent client connections are routed to the active instance, which picks up the session state from the Coherence DOC and continues with the processing.

8.8.3.6 Disabling and Enabling Oracle Security Token Service

Oracle Security Token Service is enabled by default. To disable Oracle Security Token Service, you use the Oracle Access Manager Console. See Enabling or Disabling Available Services in the Oracle Fusion Middleware Administrators Guide for Oracle Access Manager with Oracle Security Token Service.

8.8.3.7 Troubleshooting Oracle Security Token Service

Oracle Security Token Service logs are logged to the Managed Servers log files. However, you can edit the logging.xml so that it logs OSTS information to a separate log file, diagnostic.log, in the folder DomainHomeconfigfmwconfigserversservernamestslog. To create an Oracle Security Token Service log file to troubleshoot Oracle Security Token Service: 1. Open the file DomainHomeconfigfmwconfigserversservernamelogging.xm l 2. Add the following in the appropriate sections: log_handler name=sts-handler class=oracle.core.ojdl.logging.ODLHandlerFactory property name=path value=stslog property name=maxFileSize value=10485760 property name=maxLogSize value=104857600 log_handler Configuring High Availability for Identity Management Components 8-131 logger name=oracle.security.fed level=TRACE:32 handler name=sts-handler logger

8.8.3.8 Log File Location

All log messages go to the server log file of the WebLogic Server that the application is deployed on. The default location of the server log is: WL_HOME user_projectsdomainsdomainNameserversserverNamelogs serverName -diagnostic.log

8.8.3.9 Additional Considerations

The Oracle Security Token Service server can detect fake requests, such as replay attacks, that can occur if a user tries to steal token data from a request and send another request with the same token. In this case, the server detects the second fake request. The second issuance request with the same token in Env: Body goes to the Oracle Security Token Service server. The server denies the request after checking its UNT token cache, which indicates a replay attack.

8.8.4 Oracle Access Manager High Availability Configuration Steps