Choosing Applications for Oracle Access Manager SSO Scenarios and Solutions

15 Configuring Single Sign-On with Oracle Access Manager 11g 15-1 15 Configuring Single Sign-On with Oracle Access Manager 11g The chapter provides information on configuring single sign-on using Oracle Access Manager 11g. It includes the following major sections: ■ Introduction to Oracle Access Manager 11g SSO ■ Deploying the Oracle Access Manager 11g SSO Solution ■ Configuring Centralized Log Out for Oracle Access Manager 11g ■ Synchronizing the User and SSO Sessions: SSO Synchronization Filter ■ Troubleshooting Tips

15.1 Introduction to Oracle Access Manager 11g SSO

Oracle Access Manager 11g is part of Oracles enterprise class suite of security products. Intended for use in new and existing SSO deployments, Oracle Access Manager 11g provides a full range of Web perimeter security functions that include Web single sign-on; authentication and authorization; policy administration, and more. Oracle Access Manager 11g single sign-on SSO and single log-out SLO supports a variety of application platforms including: ■ SOA ■ WebCenter Oracle Access Manager 11g supports integration with a variety of applications, as described in the Oracle Fusion Middleware Integration Guide for Oracle Access Manager. ■ Oracle Identity Navigator ■ Oracle Identity Federation ■ Oracle Identity Manager ■ Oracle Adaptive Access Manager As described in the Oracle Fusion Middleware Administrators Guide for Oracle Access Manager with Oracle Security Token Service, Oracle Access Manager 11g differs from Oracle Access Manager 10g in that identity administration features have been transferred to Oracle Identity Manager 11g. This includes user self-service and self registration, workflow functionality, dynamic group management, and delegated identity administration. 15-2 Oracle Fusion Middleware Application Security Guide Console Protection for Oracle Identity Management Applications Oracle Access Manager 11g and other Oracle Identity Management applications are deployed in a WebLogic container. Individual administration consoles include Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Identity Navigator, Oracle Identity Manager, Oracle WebLogic Server, and Oracle Entitlements Server. These are protected by default using pre-configured Authentication Providers in the WebLogic Administration Console and a pre-registered IAMSuiteAgent with Oracle Access Manager 11g. OAM 11g SSO policies are pre-seeded. No further configuration is needed for the consoles. Preview of OAM 11g Deployments You can configure Oracle Access Manager in a new WebLogic administration domain or in an existing WebLogic administration domain using the Oracle Fusion Middleware Configuration Wizard. See Requirements for the Provider with Oracle Access Manager on page 14-12 Oracle Access Manager 11g provides new server-side components that maintain backward compatibility with new or existing policy-enforcement agents. Dynamic Server-initiated updates are performed for any policy or configuration changes. ■ Oracle Access Manager Console installed on WebLogic Administration Server replaces the OAM 10g Policy Manager ■ OAM Server installed on a WebLogic Managed Sever replaces the OAM 10g Access Server Oracle Access Manager 11g provides single sign-on SSO, authentication, authorization, and other services to registered Agents in any combination protecting resources: ■ 11g WebGates ■ 10g WebGates ■ Java-based IAMSuiteAgent ■ OSSO Agents 10g mod_osso You can integrate with Oracle Access Manager 11g, any Web applications currently using Oracle ADF Security and the OPSS SSO Framework. Only users with sufficient privileges can log in to the Oracle Access Manager Administration Console or use OAM administrative command-line tools. Your enterprise might require independent sets of administrators: one set of users responsible for OAM administration and a different set for WebLogic administration. For more information, see Defining a New OAM Administrator Role in the Oracle Fusion Middleware Administrators Guide for Oracle Access Manager with Oracle Security Token Service. Overview of OAM 11g The following outlines some of the basic features of Oracle Access Manager 11g: See Also: Oracle Fusion Middleware Administrators Guide for Oracle Access Manager with Oracle Security Token Service See Also: Oracle Fusion Middleware Installation Guide for Oracle Identity Management Configuring Single Sign-On with Oracle Access Manager 11g 15-3 ProvisioningRemote Registration : A new remote registration tool enables administrators inside or outside the network to register agents and policies. A username and password must be set in the primary User Identity Store for OAM 11g. Authentication : Oracle Access Manager 11g application domains aggregate resources and security policies one policy per resource. Oracle Access Manager 11g authentication policies include a specific scheme. Supported authentication modules include LDAP, X.509, and Kerberos. Authentication user mapping is performed against the primary user-identity provider by the centralized credential collector. Authorization : Oracle Access Manager 11g performs authorization based on security policies defined in the application domain and persisted in the database. Authorization policies define the resource and constraint evaluation. Responses : Administrators can set session attributes using authentication and authorization Responses. Aside from session attributes, a Response can also obtain user-related data and request-related data. Responses, once set, are then sent as either HTTP Headers or Cookies to the agent that helps manifest them. For cookie values and header variables, Responses can retrieve session attributes previously set by another Response. For example, session attributes set by a Response upon authentication can be retrieved as a header value during authorization. Session Management : Oracle Access Manager 11g session management services track active user sessions through a high performance distributed cache system based on technology from Oracle Coherence. Each Oracle Access Manager runtime instance is a node within the distributed cache system. Secure communication between the nodes is facilitated using a symmetric key. The Oracle Access Manager runtime instances move user session data in the local cache into the distributed cache for other nodes to pick up. Each Oracle Access Manager runtime instance can also configure the replication factor and determine how session data is distributed. Administrators can configure the session lifecycle, locate and remove specific active sessions, and set a limit on the number of concurrent sessions a user can have at any time. Out-of-band session termination prevents unauthorized access to systems when a user has been terminated. Keys : The Oracle Access Manager 11g runtime is deployed as an application to a WebLogic Managed Server or Cluster. New Oracle Access Manager 11g WebGates support a shared secret per agent trust model. 11g WebGates use agenthost specific cookies, which offers superior security. Oracle Access Manager 11g WebGates are all trusted at the same level; a cookie specific for the WebGate is set and cannot be used to access any other WebGate-protected applications on a users behalf. Cookie-replay types of attacks are prevented. SSO and SLO : The Oracle Access Manager 11g Server Session Token forms the basis for SSO between Oracle Access Manager and OSSO Agents. Logout is driven through Oracle Access Manager 11g Server Global Logout, which terminates the central session and logs out the user from each agent that was visited. ■ With Oracle Access Manager 10g WebGates, logout removes the ObSSOCookie and then redirects to the Global Logout page. ■ With Oracle Access Manager 11g WebGates and mod_osso agents, logout redirects to the Global Logout page and each agent is called back to remove the agent-specific cookie. Logging and Auditing : Oracle Access Manager 11g components use the same logging infrastructure and guidelines as any other component in Oracle Fusion Middleware 11g. Oracle Access Manager 11g provides agent and server monitoring functions. Oracle Access Manager 11g auditing functions are based on the Common Audit