Test SPML to Oracle Identity Manager Request Invocation SPML Attributes to Oracle Identity Manager Attributes

21 Installing and Configuring a Remote Manager 21-1 21 Installing and Configuring a Remote Manager This chapter describes how to configure the remote manager in the following topics: ■ Overview of the Remote Manager Configuration ■ Configuring the Remote Manager ■ Stopping and Starting the Remote Manager ■ Troubleshooting Remote Manager

21.1 Overview of the Remote Manager Configuration

While performing provisioning or reconciliation actions, Oracle Identity Manager must communicate with the target to perform the business operations. To do so, Oracle Identity Manager uses the target APIs to directly communicate with the target during provisioning and reconciliation. However, Oracle Identity Manager cannot directly communicate with the target in some instances, such as: ■ The target is behind a firewall, and the target communication port is not exposed. ■ The target does not provide APIs that can be invoked over the network. ■ The target APIs cannot be invoked over a secure connection. In these instances, instead of directly communicating with the target system, Oracle Identity Manager must use an Oracle Identity Manager component that acts like a proxy. This component is known as remote manager. The remote manager is used for: ■ Invoking non-remotable target APIs through Oracle Identity Manager ■ Invoking target APIs that do not support SSL over secure channel

21.2 Configuring the Remote Manager

Remote manager configuration consists of the following steps: 1. Install the remote manager. See Oracle Fusion Middleware Installation Guide for Oracle Identity Management for information about installing the remote manager. 2. Establish trust relationship with remote manager and Oracle Identity Manager. See Adding the Trust Relation on page 21-2 and Configuring the Remote Manager by Using Your Own Certificate on page 21-3 for details. 21-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager 3. Test the remote manager. See Testing the Remote Manager Connection on page 21-5 for details. This section contains the following topics: ■ Adding the Trust Relation ■ Configuring the Remote Manager by Using Your Own Certificate ■ Testing the Remote Manager Connection ■ Updating the xlconfig.xml File to Change the Port for Remote Manager

21.2.1 Adding the Trust Relation

The remote manager and Oracle Identity Manager communicate by using SSL. You must enable a trust relationship between Oracle Identity Manager and the remote manager. Oracle Identity Manager must trust the remote manager certificate. To achieve this, you must import the remote manager certificate into the Oracle Identity Manager keystore and set it up as a trusted certificate. If required, you can also enable client-side authentication in which the remote manager trusts the server certificate. For client-side authentication, import the certificate for Oracle Identity Manager into the remote manager keystore and set it up as a trusted certificate. You might have to manually edit the configuration file xlconfig.xml associated with Oracle Identity Manager and the remote manager. Perform the following steps to ensure that the trust relation between the application server and the remote manager is established through the certificate. The keytool utility is used to importexport the certificates. 1. Using a command prompt, navigate to the XLREMOTE_HOME directory and use the keytool utility to list the certificate fingerprints. 2. Enter the following command: JAVA_HOMEjrebinkeytool -list -keystore .configdefault-keystore.jks On running the keytool command shown in this step, you will be prompted to enter the default password for the keystore. When you enter the keystore password, the entries in the keystore along with their certificate fingerprints MD5 hashes are displayed, as follows: Enter the default password for xellerate keystore: KEYSTORE_PASSWORD Your keystore contains 1 entry xell, Jan 7, 2005, keyEntry, Certificate fingerprint MD5: B0:F2:33:C8:69:E4:25:A3:CB:59:E8:51:27:EE:5C:52 Note: The Oracle Identity Manager keystore is called default-keystore.jks. In Oracle Identity Manager, it is located in the DOMAIN_HOMEconfigfmwconfig directory. For the remote manager, the keystore is located in the XLREMOTE_HOMEconfig directory. The keystore name is default-keystore.jks.