Relay State in OAM

·            'Relay state’ parameter is used to automate the redirection of a user to a specific target page URL as soon as authentication against IDP is completed successfully and SAML assertion is posted to SP.

·            If it is required to show the user a specific landing page other than the home page we can configure it through Relay state.

·            E.g. If we want to take directly the user to a particular training course; we can configure it as /sf/learning/training_module_ 5 etc.

·            We can pass this value using UpdatePrtnerProperty command using wlst as below:  

  

updatePartnerProperty(partnerName="salesforce",partnerType="SP",propName="providerrelaystate",propValue="https:sf/learning/training/internal ",type="string")  

Steps:

cd /opt/oracle/middleware/Oracle_IDM1/common/bin

./wlst.sh

connect ('weblogicuser','password','t3://host:port')

domainRuntime()

updatePartnerProperty(partnerName="SalesforceSP",partnerType="sp", propName="providerrelaystate", propValue="/sf/learning")

·            Relay state values can’t be seen in SAML response but it can be observed in network trace.

·            Press F12 ànetwork àpreserve logàhit the urlàscroll down

·            At the end we can see the parameter as shown below:

RelayState: /sf/learning




 **** Thanks for visiting ****

Configure OUD as a new SYSTEMSTORE for OAM(PS2/PS3)

·         OAM has two User Identity Stores System Store and Default Store.

·    Generally, Default store is used for Authentication of protected Applications and System  Store is used for self-authentication of OAM into /oamconsole as well authentication of protected applications.

·  By Default, in OAM both Default and System store is UserIdentityStore1 which is Embedded_LDAP of WebLogic.

·    Here we want to change the system store to OUD which will be used for login to both oamconsole as well for authenticating into applications. 

 Steps:

1.   First configure OUD as a User Identity store as shown below: 

(host & port in location; user and group search base as per the project) 

·    After configuring OUD as user identity store it should look as below:

·    Check the connection and make it default store; check if it is working.

2.  Then take a backup of oam-config.xml file and weblogic config.xml file before proceed further.

3.   Then Go to weblogic àsecurity realms àmyrealmàproviders

·    Create a new provider for OUD 

     Name: OUDAuthenticator 

     Type: IPlanetAuthenticator 

      Control flag: Sufficient 

·     Provide provider specific details (host, port, user base dn etc.) as shown below. 

·         Reorder the providers as shown below keeping OUDAuthenticator at 2nd position:

·     Restart Admin and Managed servers. 

4.  Then create an oamadmin user for OAM in OUD in the user_search_base specified earlier and also create a oamadmin group in OUD in the group_search_base and keep that user which is needed to be used as system store user.

·   Here cn=OAMAdministrators and uid=oamadmin is used as system store user for OAM.  

 5.  Go to /oamconsole àModulesàLDAPàchange it to OUD from UserIdentityStore1  (Because OAM itself authenticated by LDAP Module(OAMAdminAuthentication scheme points to    LDAP Module which protects OAM); so need to change it to our     new system store)                                                   

6.   Now in oamconsole àUserIdentityStores àchange the system store to OUD and press apply.

 

·    It will ask for add user & group àprovide both the user & group and validate àit should come as successful.  

7.   Now try to access /oamconsole in different browser with oamadmin credentials instead of weblogic user and it should authenticate successfully into oamconsole. 

ISSUES:

Ø  If getting below error in /oamconsole->UserIdentityStore page

MBean operation access denied. MBean: com.oracle.igf:type=Xml,name=IDSConfig Operation: listAllIdentityDirectoryService() Detail: Access Denied. Required roles: Admin, Operator, Monitor, executing subject: principals=[oamadmin, oamadmin_group, OAMSystemAdminGroup]

To resolve this issue, complete the following steps:

1. Login to WebLogic Console (/console) as weblogic user.

2. Navigate to Security Realms -> myrealm

3. Click the Roles and Policies tab.

4. Expand Global Roles and then Roles.

5. Click View Role Conditions on the line for Admin role.

6. Click Add Conditions and add both of the following groups:

  oamadmin_group

  OAMSystemAdminGroup

7. Click Save.

8. Restart both AdminServer and OAM managed servers 

Ø  If getting 2 login pages while accessing /oamconsole URL then:

·         Add the oamadmin user in weblogic users and groups as an Administrator of OAM.

 **** Thanks for visiting ****

Configure Logout in OAM using Rewrite Rule

• This blog is to configure logout for an application in OAM 11g which already have a application specific logout page/url.
• This can be achieved by rewrite rule in web server level without doing any configuration changes in the application.
• It is required to add the RewriteRule directives to the httpd.conf file inside the virtual host that was configured to listen on mentioned .

     Example:
    Similar script as below is required if configuring logout for a test application whose logout url is        likely /testapp/logout and your custom logout page is under htdocs of ohs then

     <VirtualHost *:7778>
      RewriteEngine on
     RewriteRule ^/testapp/logout$  /mycustomlogoutpage.html [R]
    </VirtualHost>

    E.g: Similarly if configuring logout for OIM  /identity console with DCC webgate then:

     <VirtualHost *:7777>
     RewriteEngine on
     RewriteRule ^/identity/logout$  /oamsso-bin/logout.pl [R]
    </VirtualHost>

                                               **** Thanks for visiting ****

Kerberos Configuration in OAM PS3

 Below steps should be followed to configure kerberos for OAM :

1.      Create user in Active Directory which OAM will use during WNA

2.      Generate the keytab file

3.      Transfer the keytab file to OAM server

4.      Configure krb5.conf file

5.      Check the keytab file and the SPN

6.      Configure the Kerberos scheme

7.      Configure Kerberos Authentication Module

8.      Protect the resource with the Kerberos scheme

9.      Enabling the Browser to Return Kerberos Tokens

10.  Issues and work-around

1.      Create user in Active Directory which OAM will use during WNA

·      Login to devcorp.Test.com by Remote Desktop connection.

·      Navigate to Active Directory Users and Groups.

·      Create a new user as below:

·      Provide password and check password never expire option.

·      Provide the user Domain Admins privilege so that the user can login by RDP.

·      The newly created user now should be able to login with his credentials.

2.      Generate the keytab file

·      Open cmd in RDP and run below command to create the keytab file :

ktpass /princ HTTP/dev-sso.Test.com@DEVCORP.TEST.COM /mapuser Oamssouser /pass Oracle@12345 /ptype KRB5_NT_PRINCIPAL /out C:\oraclesso1.keytab /kvno 0

·      It should create the oraclesso1.keytab file in C directory.

3.      Transfer the keytab file to OAM server

·      Copy the keytab file into local system from RDP and transfer it into OAM server in location /appl/iam/middleware/oam/server/config.

4.      Configure krb5.conf file

·      Configure krb.conf file located in /etc/krb5.conf.

# Configuration snippets may be placed in this directory as well

includedir /etc/krb5.conf.d/

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

default_realm = DEVCORP.TEST.COM

dns_lookup_realm = false

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = true

rdns = false

udp_preference_limit = 1

default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac

default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac

permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac

[realms]

DEVCORP.TEST.COM = {

kdc = w2ddcw0011003.devcorp.Test.com

admin_server = w2ddcw0011003.devcorp.Test.com

default_domain = DEVCORP.TEST.COM

}

[domain_realm]

devcorp.Test.com = DEVCORP.TEST.COM

.devcorp.Test.com = DEVCORP.TEST.COM

.Test.com = DEVCORP.TEST.COM

dev-sso.Test.com = DEVCORP.TEST.COM

5.      Check the keytab file and the SPN

·      We can verify the Keytab and SPN using klist and kinit command as below:

klist -k -t -K -e FILE:/appl/iam/middleware/oam/server/config/oraclesso1.keytab

kinit -V -k -t /appl/iam/middleware/oam/server/config/oraclesso1.keytab HTTP/dev-sso.Test.com@DEVCORP.TEST.COM

6.      Configure the Kerberos scheme

·      An authentication scheme is created as TESTKerberosScheme as below:

7.      Configure Kerberos Authentication Module

·      An authentication module is created as TESTKerberos as below:

Name                           TESTKerberos

Key Tab File               /appl/iam/middleware/oam/server/config/oraclesso1.keytab

Principal                      HTTP/dev-sso.Test.com@DEVCORP.TEST.COM

KRB Config File         /etc/krb5.conf

 8.      Protect the resource with the Kerberos scheme

·      Create an Authentication Policy TESTWNAPolicy as below:

·      Protect the resource /WNA.html with the policy created above.

9.      Enabling the Browser to Return Kerberos Tokens

·         Make sure Enable Integrated Windows Authentication option is enabled in IE under Advanced section.

·      Add sites under Security -> Local intranet zone

·      Then the application should be accessible without any prompt for authentication.

10.      Issues and work-around :

 i) Kerberos Application keeps on waiting state for a long time and then giving timeout error:

  Soln:

  Providing below parameter in krb5.conf file:

  udp_preference_limit = 1

 ii)<Aug 24, 2017 3:15:38 AM CDT> <Error> <oracle.oam.engine.authn> <BEA-000000>                   <Defective token detected (Mechanism level: GSSHeader did not find the right                                 tag)GSSException:  Defective token detected (Mechanism level: GSSHeader did not find the

   right tag)

      Soln:

DNS issue: After adding the below entry in AD hosts etc file this issue resolved.

References:

http://idm-world.blogspot.in/2013/09/configuring-oracle-access-manageroam.html

http://www.ateam-oracle.com/part-2-how-to-configure-oam11g-wna-for-multiple-ad-forests/

http://onlineappsdba.com/index.php/2012/05/01/oam-11g-integration-with-microsoft-windows-active-directory-wna-iwa-kerberos-for-zero-sign-on/



                                                  **** Thanks for visiting ****