Ora Training Blog

Installing Oracle Fusion Applications > Setting up Identity and Access Management Node > Perform Post-Provisioning Configuration

Previous: Provision Identity Management

Pro Oracle Fusion Applications – Installation and Administration

Now you can buy the first and only comprehensive book on Oracle Fusion Applications Installation and Administration which covers end to end information on introduction, planning, installation and troubleshooting guides for implementing Fusion Applications on premise. Buy it now from any of the following stores.

http://www.amazon.com/Pro-Oracle-Fusion-Applications-Administration/dp/1484209842

http://www.barnesandnoble.com/w/pro-oracle-fusion-applications-tushar-thakker/1121094340

http://www.apress.com/9781484209844

http://www.springer.com/us/book/9781484209844

Correcting Datasource Configuration

Due to Bugs 17075699 and 17076033 in Identity Management Provisioning, you must make changes to the following datasources:

• EDNLocalTxDataSource*
• mds-oim*
• mds-owsm*
• mds-soa*
• oamDS*
  
• oimJMSStoreDS*
• OraSDPMDataSource*
• SOALocalTxDataSource*

 

To make the changes, proceed as follows:

1. Log in to the WebLogic Administration Console at http://idmhost.paramlabs.com:7777/console

Use weblogic_idm username and password which you provided before provisioning.

2. Click Lock & Edit.

3. Navigate to Services -> Data Sources

4. Click on the data source to be updated, for example, EDNLocalTxDataSource

5. Click the Transaction tab

6. Deselect Supports Global Transactions if not already deselected. In our case it is already deselected.

7. Click Save.

8. Repeat Steps 4 through 7 for all the listed datasources.

Note: We had to change the checkbox only or oamDS. All other were already deselected.

9. Click Activate Changes.

10. Restart all servers.

 

Updating Oracle HTTP Server Runtime Parameters

By default, the Oracle HTTP Server contains parameter values that are suitable for most applications. These values, however, must be adjusted in IDM Deployments

 

Proceed as follows:

1. Edit the file httpd.conf, which is located in: WEB_ORACLE_INSTANCE/config/OHS/component_name

[fusion@idmhost ~]$ cd /app/oracle/config/instances/ohs1/config/OHS/ohs1/

[fusion@idmhost ohs1]$ cp -pr httpd.conf httpd.conf.bak

[fusion@idmhost ohs1]$ vi httpd.conf

 

2. Find the entry that looks like this:

<IfModule mpm_worker_module>

3. Update the values in this section as follows:

<IfModule mpm_worker_module>

ServerLimit 20

MaxClients 1000

MinSpareThreads 200

MaxSpareThreads 800

ThreadsPerChild 50

MaxRequestsPerChild 10000

AcceptMutex fcntl

</IfModule>

4. Leave all remaining values unchanged.

5. Save the file.

 

[fusion@idmhost ohs1]$ diff httpd.conf httpd.conf.bak

164,169c164,168

< ServerLimit 20

< MaxClients 1000

< MinSpareThreads 200

< MaxSpareThreads 800

< ThreadsPerChild 50

< MaxRequestsPerChild 10000

—

> MaxClients 150

> MinSpareThreads 25

> MaxSpareThreads 75

> ThreadsPerChild 25

> MaxRequestsPerChild 0

1036c1035

< include “/app/oracle/config/instances/ohs1/config/OHS/ohs1/webgate.conf”

—

> include “/app/oracle/config/instances/ohs1/config/OHS/ohs1/webgate.conf”

\ No newline at end of file

 

Creating ODSM Connections to Oracle Virtual Directory

Before you can manage Oracle Virtual Directory you must create connections from ODSM to each of your Oracle Virtual Directory instances. To do this, proceed as follows:

1. Access ODSM at: http://idmhost.paramlabs.com:7777/odsm

 

2. Follow these steps to create connections to Oracle Virtual Directory:

To create connections to Oracle Virtual Directory, follow these steps. Create connections to each Oracle Virtual Directory node separately. Using the Oracle Virtual Directory load balancer virtual host from ODSM is not supported:

 

Create a direct connection to Oracle Virtual Directory on idmhost providing the following information in ODSM:

Host: idmhost.paramlabs.com

Port: 8899 (The Oracle Virtual Directory proxy port, OVD_ADMIN_PORT)

Enable the SSL option.

User: cn=orcladmin

Password: password_to_connect_to_OVD

 

Creating ODSM Connections to Oracle Internet Directory

Before you can manage Oracle Internet Directory you must create connections from ODSM to each of your Oracle Internet Directory instances. To do this, proceed as follows:

1. Access ODSM at: http://idmhost.paramlabs.com:7777/odsm

 

 

2. Follow these steps to create connections to Oracle Internet Directory:

 

To create connections to Oracle Internet Directory, follow these steps.

Create a direct connection to Oracle Internet Directory on idmhost providing the following information in ODSM:

Host: idmhost.paramlabs.com

Port: 3060

Deselect the SSL option.

User: cn=orcladmin

Password: password_to_connect_to_OID

 

Post-Provisioning Steps for Oracle Identity Manager

Perform the following task to ensure that Oracle Identity Manager works correctly after provisioning.

Add an Oracle Identity Manager Property

As a workaround for a bug in the Identity Management Provisioning tools (Bug 16667037), you must add an Oracle Identity Manager property. Perform the following steps:

 

1. Log in to the WebLogic Console.

2. Navigate to Environment -> Servers.

3. Click Lock and Edit.

 

4. Click on the server wls_oim1

5. Click on the Server Start subtab

 

6. Add the following to the Arguments field:

-Djava.net.preferIPv4Stack=true

7. Click Save.

9. Click Activate Changes.

10. Restart the managed server wls_oim1

 

 

Post-Provisioning Steps for Oracle Access Manager

Updating Existing WebGate Agents

 

Update the OAM Security Model of all WebGate profiles, with the exception of Webgate_IDM and Webgate_IDM_11g, which should already be set

To do this, perform the following steps:

1. Log in to the Oracle Access Manager Console as the Oracle Access Manager Administration user (oamadmin)

http://idmhost.paramlabs.com:7777/oamconsole

 

 

2. Click the System Configuration tab.

3. Expand Access Manager Settings – SSO Agents.

4. Click OAM Agents and select Open from the Actions menu.

5. In the Search window, click Search.

6. Click an Agent, for example: IAMSuiteAgent.

7. Set the Security value to the security model in the OAM Configuration screen of the Identity Management Provisioning Wizard

Click Apply.

8. Restart the managed server wls_oam1

 

Update WebGate Configuration

 

To update the maximum number of WebGate connections, proceed as follows.

1. In the Oracle Access Manager Console, select the System Configuration tab.

2. Select Access Manager -> SSO Agents -> OAM Agent from the directory tree. Double-click or select the Open Folder icon.

3. On the displayed search page, click Search to perform an empty search.

4. Click the Agent Webgate_IDM.

5. Select Open from the Actions menu.

6. Set Maximum Number of Connections to 20

7. Set AAA Timeout Threshold to 5.

8. In the User Defined Parameters box, set client_request_retry_attempts to 11.

9. If the following Logout URLs are not listed, add them:

/oamsso/logout.html

/console/jsp/common/logout.jsp

/em/targetauth/emaslogout.jsp

 

 

 

10. Click Apply.

Repeat Steps 4 through 7 for each WebGate

 

Creating Oracle Access Manager Policies for WebGate 11g

 

In order to allow WebGate 11g to display the credential collector, you must add /oam to the list of public policies.

Proceed as follows:

 

1. Log in to the OAM console at: http://idmhost.paramlabs.com:7777/oamconsole

2. Select the Policy Configuration tab.

3. Expand Application Domains – IAM Suite

4. Click Resources.

5. Click Open.

 

6. Click New resource.

7. Provide the following values:

Type: HTTP

Description: OAM Credential Collector

Host Identifier: IAMSuiteAgent

Resource URL: /oam

Protection Level: Unprotected

Authentication Policy: Public Policy

8. Leave all other fields at their default values.

9. Click Apply

 

Passing Configuration Properties File to Oracle Fusion Applications

 

[fusion@idmhost ~]$ cd /app/oracle/config/fa/

[fusion@idmhost fa]$ ls -ltr idmsetup.properties

-rw-r–r– 1 fusion dba 3548 Oct 26 02:42 idmsetup.properties

[fusion@idmhost fa]$ cp -pr idmsetup.properties idmsetup.properties.backup

 

OIF Configuration

OIF is optional and we will skip configuring it

We will also skip “updating node manager for enterprise deployment” since we do not want to configure SSL yet\

 

Let’s confirm if OID and OHS are running fine.

[fusion@idmhost ~]$ /app/oracle/config/instances/oid1/bin/opmnctl status

Processes in Instance: oid1

———————————+——————–+———+———

ias-component | process-type | pid | status

———————————+——————–+———+———

ovd1 | OVD | 14778 | Alive

oid1 | oidldapd | 15011 | Alive

oid1 | oidldapd | 14999 | Alive

oid1 | oidldapd | 14910 | Alive

oid1 | oidmon | 14780 | Alive

EMAGENT | EMAGENT | 14777 | Alive

 

[fusion@idmhost ~]$ /app/oracle/config/instances/ohs1/bin/opmnctl status

Processes in Instance: ohs1

———————————+——————–+———+———

ias-component | process-type | pid | status

———————————+——————–+———+———

ohs1 | OHS | 16798 | Alive

 

Validate OID and OVD

[fusion@idmhost bin]$ ldapbind -h idmhost.paramlabs.com -p 6501 -D “cn=orcladmin” -q

Please enter bind password:

bind successful

 

[fusion@idmhost bin]$ ldapbind -h idmhost.paramlabs.com -p 7501 -D “cn=orcladmin” -q -U 1

Please enter bind password:

bind successful

 

[fusion@idmhost bin]$ ldapbind -h idmhost.paramlabs.com -p 3060 -D “cn=orcladmin” -q

Please enter bind password:

bind successful

[fusion@idmhost bin]$ ldapbind -h idmhost.paramlabs.com -p 3131 -D “cn=orcladmin” -q -U 1

Please enter bind password:

bind successful

 

Validate Admin and managed Servers

Login to Weblogic console at http://idmhost:7777/console using weblogic_idm user. Click on Servers.

 

 

You can see that all servers except OIF are running. This is default configuration after IDM provisioning since OIF is optional and we will not start it.

Login to Enterprise Manager at http://idmhost:7777/em using weblogic_idm user.

 

All components except OIF should be green.

Validate OIM by logging into http://idmhost:7777/oim using xelsysadm user

 

 

This concludes our IDM host related setup. We will now move on to Fusion Applications host.

 

Next: Install Fusion Applications Provisioning Framework on FA Host

 

Installing Oracle Fusion Applications – steps

A. Setting up Identity and Access Management Node

1. Install Fusion Applications Provisioning Framework

2. Install Oracle 11g Database (Identity management database)

3. Run Repository Creation Utility (RCU) for Oracle Identity Management components

4. Install Identity Management Provisioning Wizard

5. Create IDM provisioning Response File

6. Provision Identity Management

7. Perform Post-Provisioning Configuration

B. Setting up Fusion Applications Node

1. Install Fusion Applications Provisioning Framework

2. Install Oracle 11g Database (Fusion Apps Database)

3. Run Oracle Fusion Applications Repository Creation Utility (Applications RCU)

4. Create new Applications Provisioning Response File

5. Provision an Applications Environment