OAM Identity Asserter Configuring Providers in a WebLogic Domain for Oracle Web Services Manager

16-70 Oracle Fusion Middleware Application Security Guide To recover from an Apache Bridge Failure 1. Check the Oracle WebLogic Server to ensure that it is available. 2. Confirm that host and port information is specified correctly in the WebGate’s Web server httpd.conf. For example: ORACLE_INSTANCEconfigOHSohs_namehttpd.conf IfModule mod_weblogic.c WebLogicHost yourHost.yourDomain.com WebLogicPort yourWlsPortNumber IfModule

16.8.3 Authenticated User with Access Denied

It is possible that an authenticated user does not have access rights to the requested resource. If a user login is inconclusive or invalid, the user can be authenticated but not recognized as authorized for the requested resource. In this case, no explicit error message states the issue. Instead, the user is prompted to log in again.

16.8.4 Browser Back Button Results in Error

After successful authentication, if you click the Back button in the browser window, you might get an error for accessoblixappswebgatebinwebgate.so. When form-based authentication is used, Oracle Access Manager creates a form login cookie that holds information about the requested resource. On successful authentication, the state of the cookie changes. When the user clicks the Back button, the login form appears. When re-posted, the form login cookie no longer holds redirection details. The ObSSOCookie is also sent with the form login cookie.The ObSSOCookie is correctly checked. As the form login cookie state changes, the form-based authentication does not occur and the form action is considered as a request for the resource. Solution Retry the request using the original URL.

16.8.5 Cannot Reboot After Adding OAM and OID Authenticators

If the Oracle Access Manager Authenticator flag is set to REQUIRED, or if Oracle Access Manager Authenticator is the only Authentication Provider, perform the next step to ensure that the LDAP user who boots Oracle WebLogic Server is included in the administrator group that can perform this task. By default the Oracle WebLogic Server Admin Role includes the Administrators group. To provide access to any other group, you must create that group in the directory server and add the user who boots WebLogic Server in that group. To ensure you can restart the WebLogic Server 1. Create an Administrators group in the directory server, if one does not already exist or any other group for which you want boot access. 2. Confirm that the LDAP user who boots Oracle WebLogic Server is included in the Administrators or other group. Configuring Single Sign-On Using Oracle Access Manager 10g 16-71

3. From the WebLogic Administration Console, go to Security Realms, myrealm,

Roles and Policies, Global Roles. 4. Select View Conditions for the Admins Role. 5. Add the group and click Save.

16.8.6 Client in Cluster with Load-Balanced WebGates

Out of the box, Oracle Access Manager does not support load balanced AccessGates; you must use a third-party load balancer. Suppose you have two WebGates: WebGateA and WebGateB. You can use the OAMCfgTool to create the profile to be shared by the two WebGates. If you have an Oracle Fusion Middleware Application installed you already have the OAMCfgTool. In this case, skip Step 1. Solution: 1. No Oracle Fusion Middleware Application : Obtain the OAMCfgTool if you have no Oracle Fusion Middleware application installed.

a. Log in to Oracle Technology Network at:

http:www.oracle.comtechnologysoftwareproductsmiddlewareht docs111110_fmw.html

b. Locate the OAMCfgTool ZIP file with Access Manager Core Components

10.1.4.3.0: oamcfgtoolversion.zip

c. Extract and copy oamcfgtool.jar to the computer hosting WebGate:

2. Log in to the computer for WebGateA even if WebGate is not yet installed.

3. Change to the file system directory containing OAMCfgTool and run a command

like the following one to create one AccessGate Profile to be shared by the two WebGates. For example: java -jar oamcfgtool.jar mode=CREATE app_domain=SharedA_B app_agent_password=WebGate_password cookie_domain=preferred_http_cookie_domain ldap_host=wxyz ldap_port=6633 ldap_userdn=orcladmin ldap_userpassword=ldap_userpassword oam_aaa_host=abcd oam_aaa_port=7789 oam_aaa_mode=cert log_file=OAMCfg_date.log log_level=INFO output_ldif_file=LDIF_filename

4. Review the information provided by the tool. For example, the parameters and

values in Step 3 would provide the following information: Processed input parameters Initialized Global Configuration Successfully completed the Create operation. See Also: Introduction to OAMCfgTool on page 16-15