Superior Court of Orange County 08/13/ Civic Center Drive West Santa Ana, CA 92701

Transcription

1 1

2 Contents 1 DOCUMENT DESCRIPTION DISCLAIMER GLOSSARY OVERVIEW OBJECTIVES IDENTITY PROVIDER Colon Issues ARCHITECTURAL OVERVIEW ORACLE PRODUCT MATRIX PREREQUISITES INSTALL ORACLE 11G AND MODIFY DATABASE CONFIGURATION BATCH FILE DB CONFIG TOOL PERFORM CUSTOM INSTALL OF ORACLE WEBLOGIC SERVER (WLS) VERSION 11G WEBLOGIC INSTALLATION PERFORM INSTALL OF ORACLE ENTITLEMENTS SERVER (OES) AND LINK TO WLS SAML 2.0 SERVICE PROVIDER (SP) SOFTWARE OES INSTALLATION INSTALL OES SECURITY SERVICES MODULE (SSM) FOR WLS SAML 2.0 SP SSM INSTALLATION USING WEBLOGIC ADMINISTATION SERVER UPDATE OES WITH BEA SECURITY PATCH CONFIGURE ORACLE DATABASE USING DB CONFIG TOOL CP2 (PATCHED VERSION) UPDATE ORACLE ENTITLEMENTS SERVER WITH THE CP2 ADMIN PATCH UPDATE THE SECURITY SERVICE MODEL USING CP2 PATCH CONFIGURE SECURITY SERVICE MANAGER USING THE CONFIGTOOL WITH THE MYSSM_CONFIG.PROPERTIES FILE CONFIGURE THE OES SAML ATTRIBUTE RETRIEVER LINK TO WLS SAML 2.0 SP DEFINE SAML 2.0 SERVICE PROVIDER METADATA DISABLE OES SAML 2.0 IDENTITY ASSERTER FUNCTIONS LINK THE OES AUTHORIZATION SERVICE TO THE WLS SAML 2.0 SERVICE PROVIDER TO ENABLE RETRIEVING SAML 2.0 ATTRIBUTES FROM WLS SAML 2.0 SP ADD THE CUSTOMATTRIBUTERETRIEVER TO OES AUTHORIZATION SERVICE DEFINE THE CUSTOMATTRIBUTERETRIEVER TO THE WLS SAML 2.0 SP DEFINE XACML POLICY RULES LOGIC AND NEEDED ATTRIBUTES CREATING DYNAMIC ATTRIBUTES CREATE AUTHORIZATION POLICIES APPENDIX A CUSTOM ATTRIBUTE RETRIEVER

3 1 Document Description 1.1 Disclaimer It should be noted that this installation process is a proof-of-concept and not meant for a live production environment. Our team after much deliberation found that the Out-of-the-Box Oracle Middleware Fusion suite is not compatible with the GFIPM model. Consequently in order to create a functioning federated environment with fine-grained policy-based access controls we were required to modify many of the core files in both Oracle Entitlements Server and Oracle WebLogic Server. Due to these changes any new patches, service packs or upgrades may cause the Service Provider to have errors or crash. 1.2 Glossary The table describes the terms used in the document: Term Field Drop-down Check box Radio button Table Column Row Cell Button Path OAS ODB OES OCA OIF GFIPM Permission Policy PDP PEP SSM ASI Description A field describes an area in which a user can enter information A drop-down describes a box which allows the user to choose from a list of selections A check box allows you to select multiple items in a list A radio button allows you to select a single item from a list A table is a group of data organized into columns, rows and cells A column is a vertical list of information usually used to describe cell type A row is a horizontal list of information usually used to describe related cells A cell is a single piece of information in a table A button allows a user to perform an action The full location of a file or folder e.g. C:\WINDOWS\system Oracle Application Server Oracle Database Oracle Entitlements Server (previously named BEA AquaLogic Entitlement Server (ALES)) Oracle Application Server Certificate Authority Oracle Identity Federation (provides IdP capability and/or SP capability) Global Federated Identity and Privilege Management Permission refers to rights given to a user on an application A policy is any guide that establishes the parameters for decision making or actions Policy Decision Point Policy Enforcement Point OES Security Service Module OES Application Security Infrastructure 2

4 Term SSPI XACML SP Description OES Security Service Provider Interfaces extensible Access Control Markup Language GFIPM enabled SAML 2.0 Service Provider 1.3 Overview The Superior Court of California, County of Orange (SCOC) Court Technology Services (CTS) in association with the Georgia Technology Research Institute under the supervision of the Global Justice Information Sharing Initiative has been conscripted to create a proof of concept of the Global Federated Identity and Privilege Management (GFIPM) security technology with a focus on fine grained security using the Oracle Middleware product suite. As the primary focus of the project is to create fine-grained authorization control, CTS will use Oracle s Entitlements Server (OES). In this document, fine-grain authorization control will be defined as control over application permissions based on user attributes submitted using Security Assertion Markup Language (SAML). This installation & configuration guide used the following attributes derived from the inetorgperson user schema structure in OID (Oracle Internet Directory) for demonstrative purposes Departmentnumber Mail Title The GFIPM standard requires the following minimum attributes to be included gfipm:2.0:user:givenname gfipm:2.0:user:surname gfipm:2.0:user:federationid gfipm:2.0:user:telephonenumber gfipm:2.0:user: addresstext gfipm:2.0:user:employername gfipm:2.0:user:identityproviderid Please refer to the GFIPM Metadata 2.0 Spec for a complete listing of all GFIPM attributes. The table below describes the steps to setting up an SP using the Oracle Middleware Suite and how these correlate with GFIPM requirements. SETTING UP A GFIPM SAML 2.0 SERVICE PROVIDER USING ORACLE WEBLOGIC SERVER (WLS) AND OES Oracle Product Specific Installation Steps Overview TOC 2 - Install Oracle 11g and modify database configuration batch file GFIPM and XACML Architecture Functions Provides repository for OES Policy Rules TOC 3 - Perform custom Install of Oracle Weblogic Server (WLS) Version 11g TOC 4 - Perform Install of Oracle Entitlements Server (OES) and link to WLS SAML 2.0 Service Provider (SP) software 3 Provides WLS SAML 2.0 Service Provider software OES provides the software to perform the functions of Policy Decision Point (PDP) and Policy Enforcement Point (PEP) for the XACML rules authored using OES policy authoring tools. OES implements Security and Privacy Policy rules (fine-grained

5 SETTING UP A GFIPM SAML 2.0 SERVICE PROVIDER USING ORACLE WEBLOGIC SERVER (WLS) AND OES Oracle Product Specific Installation Steps Overview GFIPM and XACML Architecture Functions authorization) using GFIPM subject/entity attributes received from the WLS SAML 2.0 Service Provider and the XACML rules engine of OES TOC Install OES Security Services Module (SSM) for WLS SAML 2.0 SP using the Weblogic Administrative Console. (note: Use the OES Administrative Console for configuring SSM s for other execution environments such as Web Services, IIS, Apache Server) TOC Perform a series of customization and configuration steps to complete the linking of OES SSM, Oracle 11g policy base and WLS SAML 2.0 SP TOC 6 Configure the OES SAML Attribute Retriever link to WLS SAML 2.0 SP TOC 7 Define SAML 2.0 Service Provider Metadata TOC 8 Disable OES SAML 2.0 Identity Asserter functions OES Security Services Modules (SSM)execute the specific Authorization Service for the resources accessed and it executes the PDP/PEP function in the execution environment where the resource resides. OES can deploy PDP/PEP SSM s to a variety of execution environments including IIS Web Server, Apache Web Server, Oracle Weblogic, IBM Websphere, Web Services (SOAP interface) and Java API s to integrate PDP/PEP with existing or new Java applications Other functions that can be configured for OES SSM s include an Auditing Provider Service, Role Mapping Service, Security Credential Mapping Service (sometimes called a Security Token Service or STS), and an Authentication Service Follow these steps in order. They consist of the following Applying a Security Patch to OES Updating the Oracle Database Configuration Batch file (note: jdk ) Applying OES Cp2 patch to the Weblogic administration module (Policy Administration Point or PAP) Applying the Cp2 patch to the SSM module, modify SSM configuration properties and the configtool batch file This step enables the OES Authorization Service to retrieve the SAML 2.0 attributes from the WLS SAML 2.0 SP. (note: only attributes from authorized IdP s will be accepted by the WLS SAML 2.0 SP. WLS SAML 2.0 is configured to accept attributes from a SAML2IdentityAsserter and specifies support for the Web Single Sign-on Identity Provider (Web SSO-IdP) Partner interface. This step defines the administrative metadata for the GFIPM SAML 2.0 SP with attributes such as Organization Contact Name, Entity ID, Organization url Oracle also supports the capability of OES being a SAML 2.0 IDP (SSM authentication provider) but this demonstration project has 4

6 SETTING UP A GFIPM SAML 2.0 SERVICE PROVIDER USING ORACLE WEBLOGIC SERVER (WLS) AND OES Oracle Product Specific Installation Steps Overview TOC 9 Link the OES Authorization Service to the WLS SAML 2.0 Service Provider to enable retrieving SAML 2.0 attributes from WLS SAML 2.0 SP TOC 10 Add the CustomAttributeRetriever to OES Authorization Service TOC 11 Define the CustomAttributeRetriever to the WLS SAML 2.0 SP TOC 12 - Define XACML policy rules logic and needed attributes GFIPM and XACML Architecture Functions chosen to configure IdP s with the Oracle Identity Federation product (OIF) in IdP mode. OES supports retrieval of attributes from a wide variety of sources. This attribute retrieval function is referred to as the Policy Information Point (PIP) in the XACML model. Attributes may be retrieved using out-of-the box RDBMSAttributeRetriever, LDAPAttributeRetriever, OES IdentityAttributeRetriever or CustomAttributeRetriever. This CustomAttributeRetriever obtains GFIPM attributes from the WLS SAML 2.0 Service Provider This step defines the CustomAttributeRetriever to the WLS SAML 2.0 SP This step describes using the OES Administration module to define policies for your resources and the attributes required to evaluate the policies. In XACML architecture this administration module is called the Policy Adminstration Point (PAP) 1.4 Objectives This document is intended as a guide that will allow an individual or organization to create a GFIPM SAML 2.0 Service Provider (SP) environment using the Oracle Middleware Suite of products. The Service Provider created using the instructions in this document should provide the following features: Web Browser Single Sign-On for all users authenticated by an authorized Identity Providers (IdP) Fine-Grain Policy-Based permission controls over access to the SP provided resources We will be using the following products: Oracle Database 11g (ODB) WebLogic Application Server (WLS) Oracle Entitlements Server 10g (OES)! Important! Installation should be done in the order listed in this document. If the instructions 5 are not followed in the order given, you may have errors or failures in your Service Provider environment.

7 1.5 Identity Provider An Identity Provider was created in this proof of concept. We used Oracle Identity Federation and WebLogic to create this. This configuration and installation is not documented here and will be documented fully in phase III of the project Colon Issues The IdP created using OIF will not allow colons in keeping with GFIPM s standard for attributes. Before Oracle creates a solution for this issue, we add a couple of attributes to the OIF IDP. This will help identify the attributes in the xml file. To work-around this current limitation, go to a path and file that looks similar to the following: C:\Oracle\Middleware\user_projects\domains\IDMDomain\config\fmwconfig\servers\wls_oif1\applications\OIF_ \c onfiguration\cot.xml. If you are unable to find the file, please search for the cot.xml file within the OIF file system you created when installing OIF. Once found, modify the text that looks similar to the example below: <PropertiesMap name="attributelist"> <PropertiesMap name="givennamegivenname"> <Property type="boolean" name="send-with-sso">true</property> <Property type="string" name="format-attr">urn:oasis:names:tc:saml:2.0:attrname-format:uri</property> <Property type="string" name="assertion-attr">gfipm:2.0:user:givenname</property> <Property type="boolean" name="from-session">false</property> <Property type="string" name="datastore-attr">givenname</property> 6

8 1.6 Architectural Overview The diagram below outlines our SP architecture: 7

9 1.7 Oracle Product Matrix Oracle Product Name Oracle Application Server - Infrastructure ( ) 32 bit Oracle Application Server - Infrastructure patch ( ) 32 bit Oracle Database 11g ( ) 64 bit Oracle Entitlements Server ( ) 32 bit Oracle SSM Installation (wls-ssm) ( ) 32 bit Oracle Identity Federation 11g ( ) 64 bit Weblogic (10.3.2) 64 bit hybrid Weblogic Installation (10.3.1) 32 bit Install Directory / executable per Instructions as_101401_disk_1; as_101401_disk_2 as_101401_disk_patch \database OES _admin_win32.exe OES _ssm_win32.exe ofm_idm_win_ _64_disk1_1of1 wls1032_generic.jar oepe11_wls1031.exe Default unzipped directory / executable as_windows_x86_oim_oif_101401_disk1.zip; as_windows_x86_oim_oif_101401_disk2.zip P _101430_WINNT.zip win64_11gr1_database_1013.zip OES _admin_win32.zip OES _SSM_win32.zip ofm_idm_win_ _64_disk1_1of1.zip wls1032_generic.jar oepe11_wls1031.exe DBConfig Tool 32 bit \dbct OES _DBConfigTool_win32.zip DBConfig Tool dbctcp2 \dbctcp2 p _10300_winnt.zip OES admin cp2 patch \oes admin cp2 p _10300_winnt.zip SSM cp2 patch \oes ssm cp2 p _10300_winnt.zip 1.8 Prerequisites Windows 2003 R2 SP2 64 bit Virtual memory in Windows is set to: Initial size (MB): 2048 Maximum size (MB): 4096 Install JDK 1.6.0_17 32 bit (install JDK in the C:\Oracle\Middleware directory; ie C:\Oracle\Middleware\jdk16017; the path of the JDK cannot contain any spaces). Internet Explorer 7 64 bit IDE such as NetBeans IDE 6.8 8

10 2 Install Oracle 11g and modify database configuration batch file Suggestion: As this is a complex installation, it is recommended that you note all location names, directory paths and username/passwords used when installing these products. This information will be critical during the installation of other components of your Service Provider This Oracle Database must be setup to become the repository for XACML policies. Navigate to the downloaded Oracle Database (ODB) setup file, and double-click on setup.exe You now see the Select Installation Method screen. 9

11 Check the Basic Installation check box. This will install the basic ODB with standard configuration options. Select Enterprise Edition (2.9GB) from the Installation Type drop-down list. Enter the Global Database Name. Names and Locations used in this example: Oracle Base Location e.g. c:\ora11g Oracle Home Location e.g. c:\ora11g\product\11.1.0\db_1 10

12 Installation Type: Enterprise Edition (2.9 GB) Select create starter database Global database name: e.g. asi.ocsuperior.occourts.org Password: e.g. weblogic1$ Enter and confirm your Global Database Password. This password will be needed later in the installation process, when we are configuring and installing OES. Click Next. 11

13 You now see the Product-Specific Prerequisite Checks screen. This checks the server on which we are installing ODB contains all of the required software prerequesites. ODB will check the server you are installing the database on. If all of the prerequisite checks are successful, click Next. If all of the prerequesites are not successful, check your server to verify you have all of the prerequisites. If all prerequisites are on your server, click Cancel then restart the server and begin the installation process again. You now see the Oracle Configuration Manager Registration screen. Make sure that the Enable Oracle Configuration Manager check box is unchecked. This allows us to customize the installation configuration. 12

14 Click Next. You will now see the Summary screen. Verify that all of the information is correct and click Install. Ideally, you will see all of the correct address, language, space and products are being installed. If the information is incorrect, click Back and make any necessary changes. The installation will take a few moments to complete. 13

15 When the installation is complete a window pops up Database Configuration Assistant click on the password management button to check, change passwords, or unlock any desired system accounts. (You would want to make sure that the sys and system accounts are not locked). 2.1 DB Config Tool The DB Configuration Tool (Which can be found on Oracle s download site) is used to create an administrator in the Oracle Database. This is the database administrator that will be used by Oracle Entitlements Server to access ODB Browse to the directory in which you placed the dbconfig.bat file. Make a copy the dbconfig.bat file (Which can be found at Oracle s download site) in the same folder (This will allow you to return to the default configuration if something goes wrong.). Right click on the DBConfig.bat file and click Edit. This will open the file in Notepad. Scroll down the following set JAVA_HOME=@java.home@ set INSTALL_HOME=@install.home@ Replace these lines with the following: set JAVA_HOME=C:\Java\jdk16017 set INSTALL_HOME=<The directory in which you placed the DB Config Tool> This configures the Java and Install home directories for the administrator you creating. Launch the DOS prompt and navigate to the appropriate directory and execute dbconfig.bat. After executing the dbconfig.bat you will receive the following prompts, which will allow the config file to create an admin user with your needed attributes: Please input DB Type: oracle Please input JDBC URL: enter the JDBC URL (Validate the port and SID in tnsnames.ora) Please input JDBC driver: oracle.jdbc.driver.oracledriver Please input new database user name: The user name you wish to add (This will be used again in OES) Please input new database user name pswd: The database password you wish to add (e.g. sys) 14

16 Please input database admin: The database admin name you entered when installing Oracle Database Please input database admin password: The admin password you entered when installing Oracle Database Please input tablespace position: The tablespace position you wish to use (e.g. c:\ora11g\oradata\asi\asi.dbf) Once entered, it will take a few moments to create the table, when the table is successfully created you will see a confirmation. 15

17 3 Perform Custom Install of Oracle Weblogic Server (WLS) Version 11g Oracle's WebLogic Server is based on Java 2 Platform, Enterprise Edition (J2EE). It runs on a middle tier, between ODB and OES and will be both as a web server and to facilitate communication between OIF, the application and OES Because J2EE applications are standardized modules, WebLogic will automate many system-level tasks that would otherwise have to be coded by internal development staff. 3.1 WebLogic Installation If you are installing from disk, insert the WebLogic CD. If you downloaded the file from Oracle s web site, navigate to the downloaded file, and double-click on it. 16

18 You now see the WebLogic Welcome screen. 17

19 Click Next. You now see the Choose Middleware Home Directory screen, select Create New Middleware Home. This will create the home directory, where the Oracle Middleware resides. If you have already created a directory, then click Browse. 18

20 Select the directory you have created. In this instance, we created a folder named Middleware. Click Select. If there are any files in the folder, you will receive a Warning screen stating, the directory is not open. Proceed with installation? This will happen in cases where you have added any documents or applications in the home location. Click Yes. Click Next. 19

21 You will now see the Registration for Security Updates screen. If you wish to register, enter your address and Oracle Support Password. As we have altered OES and WLS we deselected I wish to receive as these changes would likely break the solution if upgrades were allowed. Once Oracle has solved the bugs that do not allow the parsing of attributes, you would check I wish to receive. Click Next. You will now see the Choose Installation Type screen. Select Custom. We choose Custom because we need to control the configuration of the server. 20

22 21

23 Click Next. You now see the Choose Products and Components screen, make sure all products and components are selected. All products were selected for testing purposes. Click Next. 22

24 You now see the JDK Selection screen under Local JDK, click Browse. For this implementation we chose JDK16017 because OES and OID are compatible with different versions of JDK. Browse to directory in which you have placed jdk16017 and select it. Click Select. You will now are returned to the JDK Selection screen. 23

25 Verify that the two Bundled JDKs are unchecked. This is done because the bundled SDKs are not compatible with our solution. Click Next. You will now see the Choose Product Installation Directories, select the directory you wish to have WebLogic installed. We we used the default folder wlserver_10.3. Click Next. 24

26 You will now see the Install Windows Service screen, select Yes and choose Node Manager listen port 5556 (default). Node Manager is a WebLogic Server utility that enables you to start, shut down, and restart the server from a remote location. Although Oracle states that Node Manager is optional, We were unable to run WLS consistently when Node Manager was not runnning. Click Next. You will now see the Choose Shortcut Location screen. Select All Users Start Menu Folder (recommended). This is recommended because it makes it easier for you to find the Node Manager when starting or restarting the server. NOTE: Must have administrative rights to allow install to automatically create all shortcuts. 25

27 Click Next. You will now see the Installation Summary screen. Review the information and verify that it is correct. If any information is missing or incorrect, back through the installation wizard and add or remove as appropriate. Click Next. 26

28 The installation will begin. It should take less than 5 minutes. Once it is finished, you see the Installation Complete screen. Make sure that Run Quickstart is checked. Click Done. In a few moments, you will see the Quickstart screen. Click Getting Started with Weblogic Server

29 You ll now see the WebLogic Welcome screen. Select Create a new WebLogic domain. This will allow us to create a WebLogic domain on which we can place our application. Click Next. You will now see the Select Domain Source screen. Select Generate a domain automatically to support the following products: make sure that Basic WebLogic Server Domain is selected. This will allow you to generate a WLS domain giving you access to the features required to create a fine-grain solution. 28

30 You will now see the Specify Domain Name and Location screen. Enter the desired Domain name and Domain location (Defaults to C:\Oracle\Middleware\user_projects\domains\. If you wish to change from the defaults, please note the name and location of the domain you are installing. Click Next. You will now see the Configure Administrator User Name and Password screen. Enter the User Name and Password then Confirm the password. Give a description of the type of Administrator you are entering. This administrator will be used by OES to access, communicate with and access the tools provided by WLS. Click Next. 29

31 You will now see the Configure Server Start Mode and JDK screen. Select Other JDK and enter the directory path to jdk This is the JDK that was selected when installing ODB. Click Next. You will now see the Select Optional Configuration screen. Select Administration Server. This allows us to configure the domain we are creating to be compatible with OES. 30

32 Click Next. You ll now see the Configure the Administration Server screen. Enter the name of the Administration Server and All Local Addresses. This will allow the Admin Server that we are creating access to all applications on the server. Click Next. You now see the Configuration Summary screen. Verify the Domain Summary is Correct. If anything is missing or incorrect click Previous and adjust the setting as needed. 31

33 Click Create. You will now see the Creating Domain screen. Check the Start Admin Server box. This will start the server when you click Done. Click Done. 32

34 4 Perform Install of Oracle Entitlements Server (OES) and Link to WLS SAML 2.0 Service Provider (SP) Software Oracle Entitlements Server (OES) will be used in this implementation as the fine-grained policy management solution it serves to externalize and centralize policy administration for applications associated with the service provider. It will be used to secure access to the application's resources and software components. Oracle Entitlements Server policies specify which users, groups, and/or roles can access the application resources, allowing those roles to be dynamically managed. 4.1 OES Installation Navigate to the location of the OES setup file and double click setup.exe. You now see the OES Welcome screen. Click Next. 33

35 You now see the Choose BEA Home Directory. Select Use an Existing BEA Home Directory. This is the WLS home directory we created. Click Next. You will now see the Choose Product Installation Directories screen. Enter the directory in which you wish to install OES. The default is ales32-admin, this is because OES is currently not available in 64bit, when Oracle upgrades to 64 bit this will, most likely, change. Click Next. 34

36 You now see the Choose the Application Server for the OES Administrative Application screen. This Administrative Application, sometimes referred to as Policy Administration Point or PAP, will be used to configure, specifiy, store and test XACML policies, Under Web Server Type use the drop down and select Weblogic Server 10. This will cause the wizard to install OES on WLS. Click Next. You now see the Choose Network Interfaces screen. Under Choose SCM Bind Interfaces make sure that a static IP is selected is selected. As our SP was installed with custom coding and is not compliant with Oracle support, we used an internal IP address. Click Next. 35

37 You now see the Configure Administrative Application screen. Enter your HTTP and SSL ports and Certificate Authority Duration. These are the ports with which OES will interact with the application and WLS. Click Next. 36

38 You now see the Configure Database Connection screen. Select ORACLE11 for database type. Enter the JDBC URL and JDBC driver, select and enter the Login ID, Login Password created in the DBConfig tool and check the Install Database Schema box. These are the ports with which OES will interact with the application and WLS. Click Next. You will now see the Key Protection Password Selection screen. Check the Generate Random Passwords box. This is done because otherwise all key passwords would need to be generated manually during the installation process. 37

39 Click Next. You now see the Choose JDK screen. Check the Other JDK and browse to or enter the directory in which you placed jdk Click Next. OES will begin the installation process. When it is completed, click Done. At this point a DOS window will open. It will take a few minutes when it is complete press the enter key to close DOS window. In windows explorer click Start>Administrative Tools> Services. 38

40 39

41 You will now see the Services manager. Right click the ALES Service Control Manager (SCM) and click Stop. This will stop WLS from running. When you start the server WLS will start automatically, and WLS must be shut down to configure SSM. A window will pop up ask if you want to stop other services, click Yes. This will shut down WebLogic. 40

42 5 Install OES Security Services Module (SSM) for WLS SAML 2.0 SP The WLS Security Service Module (SSM) makes use of fine grain access control. This will allow us to define the access policies that restrict access to and rights on the application. 5.1 SSM Installation Using WebLogic Administation Server In windows explorer click Start>Administrative Tools> Services. You will now see the Services manager. Right click the ALES Service Control Manager (SCM) and click Stop. 41

43 A window will pop up ask if you want to stop other services, click Yes. 42

44 Browse to the folder where the SSM executable file is located. Launch the executable and in a moment, you will see the Welcome screen. Click Next. You will now see the Choose BEA Home Directory. Select Create a New BEA Home Directory (e.g. - c:\oracle\middleware). This will create a directory to install the SSM. Click Next. 43

45 You now see the Choose Products and Components screen. Select OES SM Common, OES SM for WLS and OEM SM for Java, these security modules will be used by OES. Click Next. You will now see the Choose Product Installation Directories screen. Browse to or enter the directory into which you will install SSM. (By default you will see OES SM Combo: C:\Oracle\Middleware\ales32-ssm). This is a directory in which the SSM is installed. Click Next. 44

46 You will now see the Configure Enterprise Domain screen. Enter the Primary Server URL and Backup Server URL. These are the names, ports and location of the server that will be utilizing the SSM. Click Next. You will now see the Choose JDK screen. Select Other JDK (WLS SM) and navigate to where you ve place jdk Click Next. 45

47 46

48 Installation will begin, this may take a few moments. When completed Click Done. 5.2 Update OES with BEA Security Patch Verify that OES and WebLogic are not running. Copy the file examplenames.xml to the directory in which you created your WebLogic domain. This will allow you to access the file when you update the application with the patch. An updated security jar file must be installed. Acquire the Oracle com.bea.core.common.security.saml2_ _ jar file. A the time of our implantation this file was sent directly from Oracle to us. It is unclear whether it can be obtained online. This patch is needed to implement a working version of OES.Once you have received the file rename the file from com.bea.core.common.security.saml2_ _ jar to com.bea.core.common.security.saml2_ _ jar and place it in the C:\Oracle\Middleware\modules directory. This is done because the jar file that was initially sent prevented the application from working in our implementation. 47

49 5.3 Configure Oracle Database using DB Config Tool CP2 (patched version) The DB Configuration Tool cp2 is used to create an administrator in the Oracle Database. This is a patched tool that needs to be run in order in order insure all of the installed versions run the same version of the installed products. This is an addition to the DB Configuration Tool. Browse to the directory in which you placed the dbconfig.bat (cp2) file (This patched version can be found on the Oracle downloads site). Make a copy of the dbconfig.bat file in the same folder. Right click on the file and click Edit. This will open the file in Notepad. Scroll down the following set JAVA_HOME=@java.home@ set INSTALL_HOME=@install.home@ Replace these lines with the following: set JAVA_HOME=C:\Java\jdk1.6.0_11 set INSTALL_HOME=<The directory in which you placed the DB Config Tool> These are the Java Home and Install Homes in which are required to run ODB. Launch the DOS prompt and navigate to the appropriate directory and execute dbconfig.bat. After executing the dbconfig.bat you will receive the following prompts: Please input DB Type: oracle Please input JDBC URL: enter the JDBC URL Please input JDBC driver: oracle.jdbc.driver.oracledriver Please input new database user name: The user name you wish to add (This will be used again in OES) Please input new database user name pswd: The database password you wish to add Please input database admin: The database admin name you entered when installing Oracle Database Please input database admin password: The admin password you entered when installing Oracle Database 48

50 Once entered, it will take a few moments to create the table, when the table is successfully created you will see a confirmation. 5.4 Update Oracle Entitlements Server with the cp2 admin patch In order to facilitate the working of OES, the cp2 patch (This patched version can be found on the Oracle downloads site) must be installed. This is yet another patch that must be installed in order for OES to work in our implementation. As stated previously, the cp2 (patched) file must be installed before you install this patch. In windows explorer click Start>Administrative Tools> Services. 49

51 You will now see the Services manager. Right click the ALES Service Control Manager and click Stop. As stated before, this will stop WLS. WLS cannot be running when the patch is installed or the installation will fail and possible corrupt the OES installation. A window will pop up ask if you want to stop other services, click Yes. 50

52 A window will pop up ask if you want to stop other services, click Yes. Browse to the folder where oem admin patch file is located and copy the patches folder from the directory where you placed the patch to the following patches folder C:\Oracle\Middleware\ales32-admin\patches). Then browse to \patches\cp2 folder that you have just created. Right click on ApplyAdminPatch.bat and click Edit. This will open the file in Notepad. Scroll down the following set set Replace these lines with the following: set JAVA_HOME=C:\Java\jdk16017 set INSTALL_HOME=<The directory in which you placed the OES> set IsAdmin=True Launch the DOS prompt and navigate to the appropriate directory and type: ApplyAdminPatch.bat status This will confirm your patch level. If status runs properly type: ApplyAdminPatch.bat upgrade 51

53 5.5 Update the Security Service Model using cp2 patch The SSM cp2 patch is required to allow the Security Service Module to function properly. In windows explorer click Start>Administrative Tools> Services. You will now see the Services manager. Right click the ALES Service Control Manager and click Stop. 52

54 53

55 A window will pop up ask if you want to stop other services, click Yes. A window will pop up ask if you want to stop other services, click Yes. Browse to the folder where SSM cp2 patch file is located and make a copy of the patches folder \oes patch cp2 sm to \ales32-ssm folder. Make a copy of ApplySSMPatch.bat in the same folder. Right click ApplySSMPatch.bat and click edit. Locate the following: set JAVA_HOME=@java.home@ set INSTALL_HOME=@install.home@ Replace these lines with the following: set JAVA_HOME=C:\Java\jdk16017 set INSTALL_HOME=<The directory in which you placed the OES> Launch a DOS prompt and navigate to the directory where ApplySsmPatch.bat was placed. Type: ApplySsmPatch.bat status This will confirm your patch level. If status runs properly type: ApplySsmPatch.bat upgrade Once completed you will see a confirmation message. 54

56 5.6 Configure Security Service Manager using the ConfigTool with the myssm_config.properties file The Service Control Manager (SCM) needs to be running when using this tool. Leave Entitlements server running and shut down WebLogic. In windows explorer click Start>Administrative Tools> Services. You will now see the Services manager. Right click ALES Weblogic Server WLS.oimtest1 and click Start. 55

57 Make a copy of the myssm_config.properties file and configtool.bat in the same folder. Right click on the myssm_config.properties file and click Edit. This will open the file in notepad, modify the wls.domain.dir to: wls.domain.dir=c:/your domain path ssm.conf.id=the database user name created when running the db config tool db.password=the database password created when running the db config tool ales.admin.password=oes Admin password ssm.admin.name=the SSM admin name you entered during the SSM install ssm.admin.password=the SSM password name you entered during the SSM install ssm.type=wls-ssm db=database user name ales.admin.name=oes Admin User Name ssm.instance.name=name of the SSM instance directory ales.organization.scope=the OES organization scope ales.identity.dir=oes identity directory name db.jdbc.url=database JDBC URL db.jdbc.driver=database JDBC Driver arme.port=arme s port number, by default this is 8000 scm.name=name of SCM These locations and other attributes will configure the updated SSM. Save file and close the file. Right click on the the configtool.bat and click Edit. This will open the file in Notepad. Locate the following: set JAVA_HOME=@java.home@ set INSTALL_HOME=@install.home@ Replace these lines with the following: set JAVA_HOME=C:/Java/jdk16017 set INSTALL_HOME=<The directory in which you placed the OES> Launch a DOS prompt and navigate to the directory in which the files are located and type: ConfigTool.bat -check myssm_config.properties 56

58 This will validate all of the information you enetered into the myssm_config.properties file. If all of the locations, and other information match with your SSM properties. If there are any errors found, they will be shown here. Correct any errors and update until the check runs through with no errors. Then type: ConfigTool.bat -process myssm_config.properties After successful completion go to the following: This will open OES s admin window. At this point, OES should launch properly. If OES does not launch properly, the installation and of OES and the component patches has failed, and you must remove OES and reinstall. 57

59 6 Configure the OES SAML Attribute Retriever link to WLS SAML 2.0 SP In order to receive and parse the SAML assertion, attributes must be associated with the attribute retriever. The attribute retriever is, in this case, is a custom application plug-in that will take the SAML attributes and convert them to a format that can be interpreted by OES. Login with the Username and Password entered when installing OES. You now see the OES home screen, click Distribute. This must be done to distribute OES. If this is not done, the configuration will not work. 58

60 You will now see the Save and Distribute screen. Check all of the boxes and click OK. 59

61 60

62 You will now see the OES home page. Check the Auto Save box. This will cause OES to automatically save any changes you make during the configuration process. In Windows Explorer navigate to the domain folder you created when installing WebLogic and make a copy of startweblogic.cmd. Then to the parent directory and go into the config directory and make a copy of the config.xml file. By doing this you can freely make changes to WebLogic without causing permanent damage. Each time you update WebLogic s configuration you go back and delete the old ones and recopy them. This will ensure that you don t get locked out of WebLogic. 61

63 Make sure that the SCM and Entitlements windows services are started. Click Start>Administrative Tools>Services and right click on ALES WLS.oimtest1 and click Start. This will start WLS. WLS must be running in order to successfully configure OES. This will also start the ALES Service Control Manager service. Click Start>All Programs>Oracle Weblogic>User Projects>Your domain name>start Admin Server for WebLogic Server Domain. 62

64 Once the server status is RUNNING click Start>All Programs>Oracle Weblogic>User Projects>Your domain name>admin Server Console. This will start your WebLogic Admin Server Console. You will now see the WebLogic Login screen. Enter the UserName and Password you created when installing WebLogic and click Login. 63

65 You will now see the WebLogic home screen. In the navigation window click Security Realms. You will now see the Security Realms screen. In the right pane under Realms click the application for which you want OES to manage policies (In this example, we used OesApp). 64

66 Select Advanced from the Security Model Default drop-down. 65

67 Click the Providers tab. 66

68 Click the Authentication tab. Click DatabaseAuthenticator. 67

69 You will now see the Database Authenticator Common tab. Scroll down to Control Flag and select Optional from the drop-down list. This sets your application, to not require a control flag. By selecting Optional, this flag is set when authentication is required only by one module. If the module succeeds, the application will not try another module. When authentication fails, the modules with flags set to Sufficient are treated as optional. Click Save. 68

70 Once you re back to Authentication Providers screen and you see the Provider you just added click Save. Click the Provider Specific tab. 69

71 Verify that the Database User Login and Database User Password are populated. These are the ODB Username and Passwords that you entered when creating the database Admin Server. Click the Providers tab. 70

72 Under Authentication Providers select click New. Enter the name of the new Authentication Provider name in the name field, select SAML2IdentityAsserter from the dropdown list. This creates a SAML2 Identity Asserter that will be used to retrieve the SAML assertion containing the user attributes. For this example we will create an asserter called OIF. Click OK. Once you re back to Authentication Providers screen and you see the Provider you just added click Save. 71

73 72

74 Make sure that the Provider appears last on the list of Authentication Providers. If OIF is not listed at the bottom of the Authentication Providers table, click Reorder then highlight the new Provider and click the down arrow until the Provider is at the bottom of the list. This will make the SAML provider just created the primary provider. The primary provider must be the provider that was created in the previous step. Click OK. Click the new Provider that was just created (OIF) in the Authentication Providers table. 73

75 Click the Management tab. You will now see the Identity Provider Partners screen. Click New then New Web Single Sign-On Identity Provider Partner. A web single-sign-on IdP partner will allow WebLogic to communicate with the IdP via a web connection. You will now see the New Web Single Sign-On Identity Provider Partner screen. Browse to the location where the metadata was exported. Select the metadata (e.g. default name = oiftest1_7778_idp_saml20.xml) then click OK. This step allows WebLogic to find the XML schema that was agreed upon by the two partners. 74

76 Click the WebSSO you just created (WebSSO-IdP-Partner-0). You will now see the General Settings tab. Check the Enabled box. Then scroll down to Redirect URI s and add path for the application main screen. This enables the redirect that must be in place to return the user to their IdP. 75

77 Click Save. Restart WebLogic and Close OES before continuing. 76

78 7 Define SAML 2.0 Service Provider Metadata Restart WebLogic and OES then launch the WebLogic Admin Server Console. You will now see the WebLogic home screen. Under Environment, click Servers. You now see the Summary of Servers screen, click AdminServer. 77

79 You will now see the Settings for AdminServer, click the Federation Services tab. You will now see the Federation Services screen click the SAML 2.0 General tab. You now see the SAML 2.0 General screen, we are now going to create a person and add usable attributes that will be used in the SAML assertion. For our purposes, we used fill in the following information: Contact Person Given Name: Contact Person Surname: Contact Person Type: Contact Person Company: Contact Person Telephone Number: 78

80 Contact Person Address: Organization Name: Organization URL: Published Site URL: Entity ID: CJCSP 79

81 Make sure that Recipient Check Enabled box under Bindings is checked. This will allow WLS to check the recipient information when a SAML request is submitted. Once you have entered the information and checked the box, click Save. Click the SAML 2.0 Service Provider tab. 80

82 You will now see the SAML 2.0 Service Provider screen. This creates the SP environment in WLS. Make sure the following are checked: Check Enabled box Check Always Sign Authentication Request box Check Only Accept Signed Assertions box Check POST One Use Check Enabled box Check POST Binding Enabled box Uncheck Artifact Binding Enabled box Select POST from the Preferred Binding drop-down list 81

83 Once settings are verified, click Save. Click the SAML 2.0 General tab. You will now the SAML 2.0 General screen. Click Publish Meta Data. 82

84 You will now see the Publish SAML 2.0 Metadata screen. Navigate to the location where you wish to save the xml file. In the path field and enter your path and file name. (e.g. c:\download\oessp.xml) Then click OK. 8 Disable OES SAML 2.0 Identity Asserter Functions The SAML Identity Asserter that is included with OES does not fit the GFIPM security model. In order to be in compliance with GFIPM it must be modified. Shut down WebLogic and OES. (WebLogic Admin Server and ALES Service Control Manager.) Navigate to the location of the SAML2IdentityAsserter.jar using your unzip tool open the SAML2IdentityAsserter.jar. Once open, right click on the federation.properties at the root of the unzipped file and locate add the following hostname=oimtest1 (WebLogic Server name) oesorganization-crtorg (Oracle Entitlements Server organization) oesdirectory=crtdir (Oracle Entitlements identity directory) oesusetransientwithlogonattribute=true (If true then the address is pushed to OES as the transient log in ID. As an address is unique it makes for an ideal identifier) oestransientlogonattribute= addresstext ( address attribute) For this example, CrtDir is the organization which will contain the policies we created. When you save the file it will ask you File federation.properties was modified. Do you wish to update it in the archive? Click Yes. Once saved place the SAML2IdentityAsserter.jar into the directory C:\Oracle\Middleware\wlserver_10.3\server\lib\mbeantypes. You will replace the existing SAML2IdentityAsserter.jar.! Important! OES will pick up any.jar files in the server\lib\mbeantypes folder. You must overwrite the existing SAML2IdentityAsserter.jar file. Restart the server. 83

85 84

86 9 Link the OES Authorization Service to the WLS SAML 2.0 Service Provider to enable retrieving SAML 2.0 attributes from WLS SAML 2.0 SP Once the server is restarted, start WebLogic and OES. Then start the WebLogic Admin Server and login. You now see the WebLogic home screen. Click Security Realms in the left panel. You now see the Summary of Security Realms screen. Click on the Application you are managing. For this example we created an application called OesApp. 85

87 86

88 Click the Authorization tab. 87

89 You now see the Authorization table. Click ASIAuthorizationProvider. This is the provider we created earlier. You now see the Settings for ASIAuthorizationProvider screen. Click the Attribute Retrievers tab. 88

90 You now see the Attribute Retrievers table. Click New. You now see the New Attribute screen. Enter the name you will give to the Attribute Retriever (e.g. org.occourts.saml.samlattributeretriever) and select CustomAttributeRetriever from the Retriever Type drop-down list. 89

91 Click Next. You now see the Attribute Retriever Configuration screen. In the Attribute Retrievers field, enter the path of the package and class file for the attribute retriever (e.g. org.occourts.saml.samlattributeretriever) you ve created. 90

92 Click Save. 10 Add the CustomAttributeRetriever to OES Authorization Service A custom Attribute Retriever was created. Verify that WebLogic and OES are shut down. Navigate to the directory in which you have placed the custom attribute retriever and load the file into your IDE, modify the SAMLAttributeRetriever.jar file. Modify the jar file s attributes that you are using and compile (To see the code for the custom attribute retriever, please refer to Appendix A Custom Attribute Retriever). After this has been compiled, copy the SAMLAttributeRetriever.jar into the \wls-ssm\lib\providers\wls\v9 directory. Restart the server. 91

93 11 Define the CustomAttributeRetriever to the WLS SAML 2.0 SP Once the attribute retriever has been added to OES, the attributes must be added to WLS. This will allow WLS to extract the attributes from SAML and convert them to a format usable by OES. The assertion is created by direct communication between the organization providing the SP and must be followed by the organization acting as IdP. Start OES and WebLogic Server. Then start WebLogic Admin Server Console and log in. You now see the Welcome screen. Click Security Realms. 92

94 You now see the Summary of Security Realms tab. Click the Providers tab. You now see the Providers screen. Click the Authorization tab. 93

95 You now see the Authorization Providers table. Click ASIAuthorizationProvider. This is the authorization provider created earlier. You now see the Settings for ASIAuthorizationProvider screen. Click the Attributes tab. 94

96 You now see the Attributes table. Click New. You now see the New Attribute screen. For this example we will use the following configuration for this example: Name departmentnumber Retriever drop-down list Select org.courts.saml.samlattributeretriever_custom. This AR was created by Court Technology Services (CTS) for the project, to view the code for SAMLAttributeRetriever_Custom please refer to Appendix A. 95

97 Click Next. You now see the Attribute Information screen. Verify the information. Click Save. 96

98 12 Define XACML Policy Rules Logic and Needed Attributes This section will show you how to create policies in OES. We will give an example of creating a simple policy based on attributes that can be passed via SAML Assertion. Start WebLogic and OES. Then launch a Internet Explorer browser and enter the address Log in to OES. Click Auto Save.! Important! It is highly recommended that you click Auto Save each time you log in, as the time-out period in OES can be inconsistent. You now see the OES home screen. Expand the RootOrg menu, and highlight the name of the organization object (In this example we use CrtOrg). 97