Alternative Way to Configure Oracle Identity Federation as SSL Client

Security 8-7 When Searching LDAP Server over SSL If the user andor federation data stores are LDAP servers using SSL, and you wish to use the search operations in Fusion Middleware Control navigate to Administration, then Identities, you will need to import the LDAPs CA certificate to the JVMs cacert keystore. When performing the search operation, you will see the following error printed in the logs: SEVERE: NamingException: error while interacting with an LDAP server or JNDI module javax.naming.NameNotFoundException: remaining name: envjmxruntime This is expected and will not affect the search.

8.1.2.5 Ensuring that Fusion Middleware Control can Manage an Oracle Identity Federation Target

Take these steps to enable Fusion Middleware Control to manage an Oracle Identity Federation server target: 1. Locate INSTANCE_HOMEEMAGENTEMAGENTsysmanemdtargets.xml. Change the protocol for the serviceURL property to the correct protocol. If you have more than one Oracle Identity Federation target besides host and oracle_ emd, you need to modify the serviceURL for each target. 2. Locate INSTANCE_ HOMEEMAGENTEMAGENTsysmanconfigemd.properties. If necessary, update the protocol for REPOSITORY_URL to the correct protocol. The EM Agent uses this property to connect to Fusion Middleware Control. 3. Stop the EM Agent using the command: INSTANCE_HOMEbinopmnctl stopproc ias-component=EMAGNET 4. Secure the EM Agent using the command: INSTANCE_HOMEEMAGENTEMAGENTbinemctl secure fmagent -admin_host host -admin_port port -admin_user username [-admin_pwd pwd] 5. Restart the EM Agent using the command: INSTANCE_HOMEbinopmnctl startproc ias-component=EMAGNET

8.2 Managing Signing and Encryption Wallets

Oracle Identity Federation provides a way to update signing andor encryption wallets smoothly, without interrupting service. Notes: ■ Oracle Identity Federation does not support client authentication when connecting to LDAP servers. ■ Oracle Identity Federation will only use the WLS trust keystore when connecting to LDAP servers. 8-8 Oracle Fusion Middleware Administrators Guide for Oracle Identity Federation When you need to replace a signing or encryption wallet and a new one is uploaded, Oracle Identity Federation saves the old wallet. The server then continues to use the old wallet in all transactions until it is removed. However, generated metadata will contain the new wallet information and the old information. This allows time to notify remote providers about the change. Once new metadata has been created and distributed to all remote providers, the old wallet can be deleted and Oracle Identity Federation will use the newly uploaded wallet for all subsequent transactions. This section contains these topics: ■ Signing and Encryption Passwords ■ Replacing a Signing or Encryption Wallet

8.2.1 Signing and Encryption Passwords

As of 11g Release 1 11.1.1 Patch Set 3, the keystore signing key password and the encryption key password do not need to be the same. The treatment of passwords is as follows: ■ You can configure distinct store password and key password. ■ If not configured, the key password is assumed to be the same as the store password.

8.2.2 Replacing a Signing or Encryption Wallet

Follow these steps when replacing a signing or encryption wallet: 1. Upload the new wallet. a. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

b. Navigate to Administration, then Security and Trust.

c. In the Wallets tab, click Update.

d. Check the Update checkbox for the wallet you want to update.

e. Select the keystore type, wallet location, password, and alias.

f. Click OK.

2. Generate and distribute new metadata. a. Log in to Fusion Middleware Control and navigate to the Oracle Identity Federation instance.

b. Navigate to Administration, then Security and Trust.

c. In the Provider Metadata tab, under the Generate Metadata section, select the

provider type and the protocol of the metadata to be generated, and click Generate . d. Save the generated metadata. e. Distribute the generated metadata to all remote peer providers. 3. Delete the old wallet. See Also: Managing Keystores, Wallets, and Certificates in the Oracle Fusion Middleware Administrators Guide for details about keystore management.