Oracle Identity and Access Management: The All-In-One Seminar Student Guide

Transcription

1 Oracle Identity and Access Management: The All-In-One Seminar Student Guide D50461GC10 Edition 1.0 June 2007 D51338

2 Author Litha Dhananjayan Technical Contributors and Reviewers Aykut Celik Sujatha Kalastriraju Gayathri Rajagopal Mohit Singh Editors Arijit Ghosh Aju Kumar Daniel Milne Amita Narayan Nita Pavitran Richard Wallis Graphic Designers Satish Bettegowda Steve Elwood Samir Mozumdar Asha Thampy Copyright 2007, Oracle. All rights reserved. Disclaimer This document contains proprietary information and is protected by copyright and other intellectual property laws. You may copy and print this document solely for your own use in an Oracle training course. The document may not be modified or altered in any way. Except where your use constitutes "fair use" under copyright law, you may not use, share, download, upload, copy, print, display, perform, reproduce, publish, license, post, transmit, or distribute this document in whole or in part without the express authorization of Oracle. The information contained in this document is subject to change without notice. If you find any problems in the document, please report them in writing to: Oracle University, 500 Oracle Parkway, Redwood Shores, California USA. This document is not warranted to be error-free. Restricted Rights Notice If this documentation is delivered to the United States Government or anyone using the documentation on behalf of the United States Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS The U.S. Government s rights to use, modify, reproduce, release, perform, display, or disclose these training materials are restricted by the terms of the applicable Oracle license agreement and/or the applicable U.S. Government contract. Trademark Notice Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. Publisher Jobi Varghese

3 Contents Oracle Identity and Access Management: Overview - Seminar Objectives O-2 Course Agenda O-5 1 Introduction to Identity Management Objectives 1-2 Identity Management: Overview 1-3 Complete Picture: Oracle Identity Management 1-4 Oracle Fusion Middleware and Identity Management 1-6 Benefits of Identity Management 1-9 Identity Management: Terminology 1-10 Functional View of Identity Management Suites 1-12 Directory Services 1-13 Identity Administration 1-14 Access Management 1-15 Provisioning 1-16 Federation 1-17 Web Services Security 1-18 Oracle Identity Management Solution 1-19 Product Functionality Matrix 1-21 Oracle Internet Directory 1-22 Oracle Virtual Directory 1-23 Oracle Access Manager 1-24 Oracle Identity Manager 1-25 Oracle Identity Federation 1-26 Oracle Enterprise Single Sign-On Suite 1-27 Oracle Web Services Manager 1-28 Summary Synchronizing and Replicating Data Using Oracle Internet Directory Objectives 2-2 Today s IT Challenges 2-4 What Is a Directory? 2-5 Directory Services Business Drivers 2-7 The LDAP Directory Standard 2-8 iii

4 Oracle Product Strategy for Directory Services 2-10 Directory Services: Features 2-11 Oracle Directory Services Product Offerings 2-12 Oracle Internet Directory 2-13 OID Architecture: Overview 2-15 OID Node Architecture Components 2-16 OID Server Instance Architecture 2-18 Oracle Internet Directory Functions: Scalability 2-19 Oracle Internet Directory Functions: High Availability 2-21 Oracle Internet Directory Functions: Information Security 2-22 Oracle Internet Directory Functions: Integrated Management Environment 2-24 Oracle Directory Integration Platform: Overview 2-25 Synchronization Service: Overview 2-27 Default Integration Profiles 2-29 Oracle Directory Integration Server: Run-Time Functionality 2-30 Connectors 2-31 Directory Synchronization Profiles 2-32 Synchronization Agent 2-33 OID Replication 2-34 Directory Replication Group and Replication Agreement 2-35 Types of Replicas 2-36 Differentiators 2-37 Conclusion 2-38 Summary Integrating LDAP Using Oracle Virtual Directory Objectives 3-2 Types of Directory Services Solutions 3-3 Obstacles for Traditional Directories 3-4 Benefits of Virtual Directories 3-5 Oracle Virtual Directory: Features 3-7 Oracle Virtual Directory: Data Federation 3-8 Oracle Virtual Directory: Translation 3-9 Oracle Virtual Directory: Directory Security 3-10 Oracle Virtual Directory: High-Availability Support 3-12 Oracle Virtual Directory: Custom-Integration APIs 3-13 Large-Scale Directory Deployment Issues 3-14 How Oracle Virtual Directory Is Used to Resolve These Issues 3-19 Using Virtual Directory: Other Advantages 3-24 OVD System Requirements 3-27 OVD Supported Software 3-28 iv

5 Oracle Virtual Directory Adapters 3-29 Conclusion 3-30 Summary Reconciling and Provisioning Data Using Oracle Identity Manager Objectives 4-2 Oracle Identity Manager 4-4 Key Features and Functionalities of Oracle Identity Manager 4-5 Oracle Identity Manager Architecture 4-7 Oracle Identity Manager Architecture: Advantages 4-8 Oracle Identity Manager Architecture: Tiers 4-9 Tier 1: Presentation Tier 4-10 Tier 2: Server Tier 4-11 Tier 3: Data and Enterprise Integration Tier 4-13 Reconciliation and Provisioning: Overview 4-15 Reconciliation: Types 4-16 Reconciliation: Events 4-18 Provisioning: Types 4-19 Trusted Source Reconciliation: Conceptual Diagram 4-21 Targeted Resource Reconciliation: Conceptual Diagram 4-22 Oracle Identity Manager Connector: Overview 4-23 Oracle Identity Manager Connector: Components 4-24 Oracle Identity Manager Users: Three Types 4-26 Oracle Identity Manager User Entities: Two Types 4-27 Deployment Recommendations 4-28 Relation Between Provisioning and Reconciliation 4-30 Case Study Case Study 1: Results 4-32 Case Study Case Study 2: Results 4-34 Summary Authenticating and Authorizing Data Using Oracle Access Manager Objectives 5-2 Oracle Access Manager: Features 5-3 Oracle Access Manager: Benefits 5-4 Oracle Access Manager 5-5 Product Differentiators 5-6 Oracle Access Management Business Drivers 5-7 Oracle Access Manager: Components 5-9 Oracle Access Manager 5-10 v

6 Oracle Access Manager Access System 5-11 Oracle Access Manager Identity System 5-13 Features of the Identity System 5-14 Identity System Applications 5-16 Identity System Applications: Example 5-18 Identity System: Components 5-19 Identity Server 5-20 WebPass 5-21 Identity System Communication Steps 5-22 Communication Between Identity Server and Directory Server 5-23 Communication Between WebPass and Identity Server 5-24 Query Builder 5-25 Oracle Access Manager Access System 5-26 Access System Architecture 5-27 Policy Manager 5-28 Access System Console 5-29 Access Server 5-30 WebGate 5-31 Access System Operation 5-32 Caching 5-33 Auditing the Access System 5-34 Auditing Events 5-35 Authentication Plug-Ins 5-36 Authorization Plug-Ins 5-37 Access Management API 5-38 Identity Event Plug-In API 5-39 IdentityXML 5-40 Presentation Services: Portal Inserts 5-41 PresentationXML 5-42 Oracle Access Management Overall Direction 5-43 Summary 5-44 Appendix A: Installation Guide vi