Skip to main content

OAM 11g R2 - Mobile and Social - Protecting Application with Google

  1. Login to OAM Console and Go to System Configuration > Common Configuration and double click on Available Services. Enable Mobile and social.
  2.  Go to Mobile And Social and double click Internet Identity Services.On the right hand side select Google click Edit.Verify the details and close the tab.
  3. Now Select OAMApplication under Application Profiles and click on Edit.
  4. Ensure that a Shared Secret is entered. 
  5. Scroll down, and ensure that User Registration is enabled.
     
  6.  Scroll down to the bottom, and ensure that Google is checked. Click on Apply.
  7. Go to System Configuration > Access Manager > Access Manager Settings.
    Set host to <OAM_HOST>.Set port to 14100.Set protocol to HTTP and apply the changes.
  8. Go to Mobile and Social and click "User Profile Service providers". Click create and create a new User Profile Service Provider.
  9. Provide the repository details like Bind DN, Root Context, User Base, Group Base and test the connection.
  10. Under the Attributes section add the attribute "proxyAuth" to false. Which is required for some of the Directory servers like OUD.
  11. Under the Entities tab provide the user and group Create and search base correctly.
  12. Click on save. Then click User Profile Service providers again. Under Service profiles click create User Profile Service.
  13. Provide name and service end point and select service provider as recently created Service Provider.
  14. Go to Policy Configuration > Authentication Schemes > OICScheme and double click it. Set challenge URL to use the above parameters. e.g. http://<OAM_HOST>:14100/oic_rp/login.jsp.
  15. Go to System Configuration > Mobile and Social >  Internet Identity Services > OAMApplication.
  16. Set Return URL = http://<OAM_HOST>:14100/oam/server/dap/cred_submit. 
    Set Registration URL = http://<OAM_HOST>:14100/oic_rp/register.jsp.
  17. Go to Registration Service Details with Application User Attribute Mapping.
    Uncheck read only checkbox for first and lastname.
  18. Go to Policy Configuration > Application Domains > click on Search.
  19. Either create new Application Domain (OAMApplication) or change existing domain name as OAM Application.
  20. Open OAMApplication domain > Authentication Policies tab.
    Open Protected Resource Policy and set Authentication Scheme as OICScheme and Click on Apply.
  21. Restart the OAM managed server and Webserver.
  22. For Some directories we even need to provide the Admin user privilege of Proxy Authorization.
  23. Login to ODSM and select Configuration tab. Under root users select Directory Manager. then select privilege and enable the Proxied Authorization.

Labels:

Comments

  1. Sudipto Desmukh15 September 2014 at 16:21

    This comment has been removed by the author.

    ReplyDelete
  2. Sudipto Desmukh15 September 2014 at 16:22

    Hi, Thanks for your useful post.
    I am getting the following error after following all your steps. Using OAM 11.1.2.2.
    OpenID auth request contains an unregistered domain: http://demo02.com:14100/oic_rp

    Looks like new OpenId providers cannot be registered per google, any workarounds you know of ?

    ReplyDelete

Post a Comment

Popular posts from this blog

Developing Prepopulate Adapter with OIM 11g R2

1.      Prepopulate Adapter in OIM uses the plugin point oracle.iam.request.plugins.PrePopulationAdapte r. 2.      Write the Java code which returns the value which has to be populated on the form. 3.      This code will implement the plugin point oracle.iam.request.plugins.PrePopulationAdapte r. Code Snippet: - package com.oracle.oim.utility.eventhandler; import java.io.Serializable; import java.util.Iterator; import java.util.List; import java.util.logging.Logger; import oracle.iam.identity.exception.NoSuchUserException; import oracle.iam.identity.exception.UserLookupException; import oracle.iam.identity.usermgmt.api.UserManager; import oracle.iam.identity.usermgmt.vo.User; import oracle.iam.platform.Platform; import oracle.iam.platform.authz.exception.AccessDeniedException; import oracle.iam.request.exception.RequestServiceException; import oracle.iam.request.vo.Beneficiary; import oracle.iam.request.vo.RequestData; public c
5 comments
Read more

OIM Tuning

Application Module tuning is a critical setting which will affect the UI performance. Following are the recommended application module settings for OIM and these are already set out-of-box (OOB) in later releases of OIM 11g R2. Ensure that these settings are implemented as recommended in your environment. -Djbo.ampool.doampooling=true -Djbo.ampool.minavailablesize=1 -Djbo.ampool.maxavailablesize=120 -Djbo.recyclethreshold=60 - Djbo.ampool.timetolive=-1 -Djbo.load.components.lazily=true - Djbo.doconnectionpooling=true -Djbo.txn.disconnect_level=1 - Djbo.connectfailover=false -Djbo.max.cursors=5 - Doracle.jdbc.implicitStatementCacheSize=5 - Doracle.jdbc.maxCachedBufferSize=19 open DOMAIN_HOME/bin/setDomainEnv.sh file for the WebLogic Server instance.find these lines: JAVA_OPTIONS="${JAVA_OPTIONS}" export JAVA_OPTIONS and change it to: JAVA_OPTIONS="-Djbo.ampool.doampooling=true -Djbo.ampool.minavailablesize=1 -Djbo.ampool.maxavailablesize=120 -D
Post a Comment
Read more

What is Application Instance

Application instance is a provisionable entity. It is a combination of IT resource instance (target connectivity and connector configuration) and resource object (provisioning mechanism) . Creating and managing application instances are performed by using the Oracle Identity System Administration. Once Created Application Instance can be requested from the catalog. Application instances can be connected or disconnected.  Connected application  instance -It has a connector defined for the provisioning of entities. Account is created in the target system real time in case of connected Application Instance. Disconnected  application instance - It is used for the provisioning of a disconnected resource, for which  a connector is not defined, and therefore, the provisioning is performed manually by the administrator. A mail trigger system can also be attached which sends the account creation/modification/deletion mails to the application owner.
Post a Comment
Read more