Skip to main content

Configuring Oracle Access Manager(OAM) with Window Native Authentication(WNA) for Windows Single Active Directory Domain

Prerequisites:- A windows active directory domain is installed on a Windows 2008 server. OAM 11g R2 OAM server is installed and a target is protected with OAM deployed on a webserver through a webgate agent.
  1. Login to the Active Directory server and create a user oam for WNA integration.


2. Execute ktpass command to generate a keytab file. The princ parameter needs to be HTTP/hostnameofOAMServer@DomainName. It should map to a user (oam)of AD. 

ktpass -princ HTTP/oam.example.com@EXAMPLE.COM -mapuser oam -pass password -out c:\oam.keytab 

3. Once ktpass has been executed successfully you will see that parameter User Logon Name has been modified.

4. On oam server at /etc/ directory krb5.conf file is present. Modify the file for domain name and AD server name. If File is not there please create a file with same name and provide the details as below:
5. After krb5.conf file is modified run the klist command to check the contents of oam.keytab file. Also run kinit command to authenticate to Kerberos server.

klist -k -t -K -e FILE:/app/u01/oam.keytab
kinit –V HTTP/oam.example.com@EXAMPLE.COM -k -t /app/u01 /oam.keytab

6. Create new User Identity Store which points to Active Directory(AD) server. It is not mandatory to have AD Server as a user store you can have OVD as a user store with Adapters pointing to AD server or you can have OID as a User Identity Store with Synchronization with AD Server. This AD can be set as default store if needed.
7. Modify the Kerberos Module by browsing to System Configuration --> Access Manager --> Authentication Modules --> Kerberos Authentication Module --> Kerberos. Set required parameters as per your environment configuration.
Parameter Name
Parameter Values
Name
Kerberos
Key Tab file
/app/u01/oam.keytab
Principal
HTTP/oam.example.com@EXAMPLE.COM
KRB Config File
/etc/krb5.conf


8. Go to Policy Configuration --> Application Domains --> ApplicationDomainName --> Protected Resource Policy and change the Authentication Scheme to Kerberos Scheme. This resource is the one which is already protected with OAM through existing deployed webgate.

9.  Login to the machine which Is connected to domain and open IE browser. Open Internet option and select Local Intranet from security tab. Add oam server host name in the Local Intranet sites.

10. Create a test user in Active Directory and login with that user in domain. OAM protected resource page can be accessed without any authentication asked.





    Labels:

    Comments

    Post a Comment

    Popular posts from this blog

    Adding UDF (User Defined Field) on create user page OIM 11g R2 PS1:-

        Login to Sysadmin console and create a Sandbox and activate it. Click on Form Designer and search for user form. 2.      Create a new field of desired type. 3.      Provide the Required Values for UDF creation and click save and close. UDF field will be added then publish the sand box. 4.      Login to Identity console now and create another sandbox and activate it. After sandbox is activated click on users link and the click on create user. 5.      Provide the mandatory values on the form and then click the customize button on top. Select source from the view. 6.      Select the panel where the field has to be added. Select panel form lay out click add content. Select Data component Catalog from the box. 7.      Select UserVO from the bottom. ...
    12 comments
    Read more

    OIM Tuning

    Application Module tuning is a critical setting which will affect the UI performance. Following are the recommended application module settings for OIM and these are already set out-of-box (OOB) in later releases of OIM 11g R2. Ensure that these settings are implemented as recommended in your environment. -Djbo.ampool.doampooling=true -Djbo.ampool.minavailablesize=1 -Djbo.ampool.maxavailablesize=120 -Djbo.recyclethreshold=60 - Djbo.ampool.timetolive=-1 -Djbo.load.components.lazily=true - Djbo.doconnectionpooling=true -Djbo.txn.disconnect_level=1 - Djbo.connectfailover=false -Djbo.max.cursors=5 - Doracle.jdbc.implicitStatementCacheSize=5 - Doracle.jdbc.maxCachedBufferSize=19 open DOMAIN_HOME/bin/setDomainEnv.sh file for the WebLogic Server instance.find these lines: JAVA_OPTIONS="${JAVA_OPTIONS}" export JAVA_OPTIONS and change it to: JAVA_OPTIONS="-Djbo.ampool.doampooling=true -Djbo.ampool.minavailablesize=1 -Djbo.ampool.maxavailablesize=120 -D...
    Post a Comment
    Read more

    OIM Reports : PS3

    Oracle Business Intelligence Publisher is Oracle's primary reporting tool for authoring, manag-ing, and delivering all your highly formatted reports. BI Publisher is shipped with Oracle Identity Manager 11g Release 2 PS3. BI Publisher is deployed and configured as a separate managed server within the same Oracle Identity Manager domain. You have the choice of either leveraging the embedded BI Publisher or a standalone BI Publisher. It is recommended that you use the embedded BI Publisher if there are no other reporting requirements and you only need reporting for Oracle Identity Manager. After BI Publisher configuration, you can take advantage of the standard features of BI Publisher, such as:  Access Policy Reports  Request and Approval Reports  Password Reports  Resource and Entitlement Reports  User Reports  Certification Reports  Identity Audit Reports  Exception Reports The Screenshot of all the reports can be seen below: Every Report uses a Da...
    Post a Comment
    Read more