Prerequisites Configuring Oracle Identity Manager Encryption Keys in CSF Setting OAAM properties for Oracle Identity Manager

18-24 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management

18.3 Integrating Oracle Adaptive Access Manager 11g with Oracle Identity Manager 11g

OAAM provides a comprehensive set of challenge questions. Its functionality includes: ■ Challenging the user before and after authentication, as required, with a series of questions. ■ Presenting the questions as images and seeking answers through various input devices. ■ Asking questions one after another, revealing subsequent questions only if correct answers are provided. Oracle Identity Manager also has basic challenge question functionality. It enables users to answer a set of configurable questions and reset their password if they forgot the password. Unlike OAAM, Oracle Identity Manager also has a rich set of password validation capabilities, and it enables policies to be set based on the accounts owned, in addition to simple attributes. In an Identity Management deployment, best practice is to register only a single set of challenge questions, and to use a single set of password policies. OAAM can be integrated with Oracle Identity Manager so that OAAM provides the challenge questions and Oracle Identity Manager provides password validation, storage and propagation. This enables you to use OAAM fraud prevention at the same time you use Oracle Identity Manager for password validation. When OAAM is integrated with Oracle Identity Manager, Oracle Identity Manager is used to help users who have forgotten their username or password. This section contains the following topics: ■ Section 18.3.1, Prerequisites ■ Section 18.3.2, Configuring Oracle Identity Manager Encryption Keys in CSF ■ Section 18.3.3, Setting OAAM properties for Oracle Identity Manager ■ Section 18.3.4, Setting Oracle Identity Manager properties for OAAM ■ Section 18.3.5, Changing Domain to TAP Scheme Protection ■ Section 18.3.6, Restarting Oracle Adaptive Access Manager and Oracle Identity Manager ■ Section 18.3.7, Validating Oracle Identity Manager-OAAM Integration

18.3.1 Prerequisites

Before starting this association, ensure that the following tasks have been performed: 1. Install and configure Oracle Identity Management. 2. Install Oracle Adaptive Access Manager. 3. Install and configure Oracle Access Manager. 4. Integrate Oracle Identity Manager with Oracle Access Manager, as described in Section 18.1, Integrating Oracle Identity Manager and Oracle Access Manager 11g. 5. Integrate Oracle Access Manager with Oracle Adaptive Access Manager as described in Section 18.2, Integrating Oracle Adaptive Access Manager with Oracle Access Manager 11g. Integrating Components 18-25

18.3.2 Configuring Oracle Identity Manager Encryption Keys in CSF

1. Go to Oracle Enterprise Manager Fusion Middleware Control at

http:admin.mycompany.comem using a web browser.

2. Log in using the WebLogic administrator account, for example weblogic_idm.

3. Expand the weblogic_domain icon in the navigation tree in the left pane.

4. Select the IDMDomain, right click, and select the menu option Security and then

the option Credentials in the sub menu. 5. Click oaam to select the map and then click Create Key. 6. In the pop-up window, ensure Select Map is oaam. 7. Enter: ■ Key Name : oim.credentials ■ Type : Password ■ UserName : xelsysadm ■ Password : Password for xelsysadm account,

8. Click OK to save the secret key to the Credential Store Framework.

18.3.3 Setting OAAM properties for Oracle Identity Manager

Go to the OAAM Administration Console at: http:admin.mycompany.comoaam_admin. Log in using the oaamadmin account you created in Section 10.4.3, Creating Users and Groups for Oracle Adaptive Access Manager. Then proceed as follows:

1. In the navigation tree, click Environment and double click Properties. The

properties search page is displayed.

2. To set a property value, enter its name in the Name field and click Search. The

current value is shown in the search results window.

3. Click Value. Enter the new value and click Save.

4. Set the following properties to enable OAAM to integrate with Oracle Identity Manager: ■ bharosa.uio.default.user.management.provider.classname : com.bharosa.vcrypt.services.OAAMUserMgmtOIM ■ bharosa.uio.default.signon.links.enum.selfregistration.url : h ttps:sso.mycompany.com:443oimfacespagesUSelf.jspx?E_ TYPE=USELFOP_TYPE=SELF_ REGISTRATIONbackUrl=https:sso.mycompany.com:443oimfac espagesSelf.jspx ■ bharosa.uio.default.signon.links.enum.trackregistration.enab led : true ■ bharosa.uio.default.signon.links.enum.selfregistration.enabl ed : true ■ bharosa.uio.default.signon.links.enum.trackregistration.url : https:sso.mycompany.com:443oimfacespagesUSelf.jspx?E _TYPE=USELFOP_TYPE=UNAUTH_TRACK_ 18-26 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management REQUESTbackUrl=https:sso.mycompany.com:443oimfacespa gesSelf.jspx ■ oaam.oim.csf.credentials.enabled : true ■ oaam.oim.url : t3:oimhost1.mycompany.com:14000,oimhost2.mycompany.com:1 4000

18.3.4 Setting Oracle Identity Manager properties for OAAM