Identity and Access management

   Oracle Identity Cloud Service i s the next generation comprehensive security and identity platform that is cloud-native and designed to be an integral part of the enterprise security fabric, providing modern identity for modern applications.  IDCS is a cloud-based identity management system that works by associating specific rights and restrictions with each user’s established identity. User provisioning, access control, and directory services are critical components of Oracle’s cloud-based security portfolio. Oracle Identity Cloud Service has been designed to meet the needs of organizations in a number of typical use-case scenarios, such as the cloud (allowing both on-premise and cloud resources to be secured from a single set of controls), mobile access (providing sign on for native or browser-based apps), employee-facing intranet and customer-facing extranet solutions.  Key Features: Oracle Identity Cloud Service provides the following functionali...

Application Module tuning is a critical setting which will affect the UI performance. Following are the recommended application module settings for OIM and these are already set out-of-box (OOB) in later releases of OIM 11g R2. Ensure that these settings are implemented as recommended in your environment. -Djbo.ampool.doampooling=true -Djbo.ampool.minavailablesize=1 -Djbo.ampool.maxavailablesize=120 -Djbo.recyclethreshold=60 - Djbo.ampool.timetolive=-1 -Djbo.load.components.lazily=true - Djbo.doconnectionpooling=true -Djbo.txn.disconnect_level=1 - Djbo.connectfailover=false -Djbo.max.cursors=5 - Doracle.jdbc.implicitStatementCacheSize=5 - Doracle.jdbc.maxCachedBufferSize=19 open DOMAIN_HOME/bin/setDomainEnv.sh file for the WebLogic Server instance.find these lines: JAVA_OPTIONS="${JAVA_OPTIONS}" export JAVA_OPTIONS and change it to: JAVA_OPTIONS="-Djbo.ampool.doampooling=true -Djbo.ampool.minavailablesize=1 -Djbo.ampool.maxavailablesize=120 -D...

I have Used Certgen utility to generate certificates. Copy the certgen utility on server and generate a ca authority. Run the below command to generate the ca. ./certgen ca ca-key.pem ca.pem Generate the server certificate as below: ./certgen.sh server ca-key.pem ca.pem Generated server certs and key. Generated files: key: server_key.pem , cert: server_cert.pem convert this cert into pkcs format using below command: openssl pkcs12 -export -in server_cert.pem -inkey server_key.pem -out myserver. p12 -name "Server" Create 2 Custom Keystores to store Server and Root Certs on OAM server. You can generate Keystore using Keytool or other tools like Keystore Explorer on windows. Once these Keystores are created put them on OAM server. Below is the command to generate the keystore using keytool: keytool -genkey -alias mydomain -keyalg RSA -keystore Server.jks -keysize 2048 Login to WebLogic Admin Console. Navigate to OAM server instance >...

Decide which OAM will act as SP and which one will act as Idp. Access the Idp metadata from by accessing the below URL: http://<IDP-OAM-Host>:14100/oamfed/idp/metadata Please not that this metadata also contains the SP metadata so remove the SP metadata tags from the metadata else it will give 'Invalid format error' while importing it in SP. Once the IDP metadata is downloaded and modified. Login to the SP-OAM and click on federation --> Service provider management. Click on create identity provider partner. Provide a name and select the metadata file to import. Provide the name of the id store from where it will be mapped. Also mention the attribute which will be mapped with the Name ID attribute from Assertion. Click on 'Create Authentication Scheme and module'. This will create the required scheme and module in the OAM. Below is the Authentication scheme: Use this Authentication Scheme to protect any existing resource. ...

If below error occurs while applying bundle patch on OIM deployed on windows then check the  patch_oim_wls.bat file:  Exit Code is 1" "Automation Failed. All the paths in this file should be with "/" rather than this "\". Wrong :  D:\apps\middleware\modules\org.apache.ant_1.7.1 RIght :  D:/apps/middleware/modules/org.apache.ant_1.7.1

User Management:- Create User Modify User (PUT) Modify User (PATCH) View Users with Pagination Delete User Lock User Unlock User Reset Password by Providing New Password Reset Password by Auto-Generated Password View User Self Registration Modify Self Profile (PATCH) Modify Profile (PUT) PasswordResetterWithChallenges PasswordValidator UserNameValidator UserNameGenerator UserNameRecoverer Role Management:- View Role Create Role Modify Role (PUT) Modify Role (PATCH) Delete Role Organization Management:- View Organization Create Organization Modify Organization (PUT) Modify Organizations (PATCH) Delete Organization Password Policy Management:- View Password Policy Create Password Policy Modify Password Policy (PUT) Modify Password Policy (PATCH) Delete Password Policy Notification Template Management:- View Notificatio...

Most of the Application use “OAM_REMOTE_USER” or “Proxy-remote-user” for the SSO setup which is sent by OAM in the Header. But some applications (like some Apex apoplications) still use “REMOTE_USER” for SSO with OAM. This Remote_user is generated by Weblogic itself based on the user authenticated and retrieved by method “request.getRemoteUser()”. With version 10.3.x this method was deprecated and not enabled automatically with start of weblogic as it opens a security vulnerability. However this Remote user can be enabled explicitly when weblogic is started with the Run time argument “- Dweblogic.http.enableRemoteUserHeader=true ”. Add this value in JAVA Properties of setDomainenv.sh and Remote user will be enabled. Please note that this is not preferred way to do that as the logged in user can be retrieved with “proxy-remote-user” header but can be solution in the case many applications are using “request.getRemoteUser()” method for SSO setup.