OracleAS 10g: Enterprise Identity Management

Transcription

1 OracleAS 10g: Enterprise Identity Management Student Guide Volume 1 D17035GC10 Edition 1.0 April 2004 D39327

2 Author Shaibal Kumar Saha Technical Contributors and Reviewers Henry Abrecht Tridip Bhattacharya Lee C. Cooper Greg Gagnon Rajender Gupta Allan L. Haensgen John Heimann Alexander Hunold Sudha P. Iyer Kari Jyrälä Ashish Kolli Jeff Levinger Richard Louis Strohm Michael Mesaros Paul D. Needham Shankar Raman Kevin Reardon David Saslav Daniel Shih Jerry Smith Richard Smith Uppili Srinivasan Olaf Stullich Jay Tomlinson Copyright 2004, Oracle. All rights reserved. This documentation contains proprietary information of Oracle Corporation. It is provided under a license agreement containing restrictions on use and disclosure and is also protected by copyright law. Reverse engineering of the software is prohibited. If this documentation is delivered to a U.S. Government Agency of the Department of Defense, then it is delivered with Restricted Rights and the following legend is applicable: Restricted Rights Legend Use, duplication or disclosure by the Government is subject to restrictions for commercial computer software and shall be deemed to be Restricted Rights software under Federal law, as set forth in subparagraph (c)(1)(ii) of DFARS , Rights in Technical Data and Computer Software (October 1988). This material or any portion of it may not be copied in any form or by any means without the express prior written permission of Oracle Corporation. Any other copying is a violation of copyright law and may result in civil and/or criminal penalties. If this documentation is delivered to a U.S. Government Agency not within the Department of Defense, then it is delivered with Restricted Rights, as defined in FAR , Rights in Data-General, including Alternate III (June 1987). The information in this document is subject to change without notice. If you find any problems in the documentation, please report them in writing to Education Products, Oracle Corporation, 500 Oracle Parkway, Redwood Shores, CA Oracle Corporation does not warrant that this document is error-free. Oracle and all references to Oracle Products are trademarks or registered trademarks of Oracle Corporation. All other products or company names are used for identification purposes only, and may be trademarks of their respective owners. Publisher Joseph Fernandez

3 Contents Preface I Course Introduction Course Objectives I-2 Day 1 I-4 Day 2 I-5 Day 3 I-6 Day 4 I-7 Day 5 I-8 Summary I-9 1 Introduction to Identity Management Objectives 1-2 Identity Management: Overview 1-3 Benefits of Identity Management 1-4 Identity Management System: Components 1-5 Oracle Identity Management Infrastructure 1-6 Oracle Identity Management: Objectives 1-7 Oracle Identity Management: Terminology 1-9 Oracle Identity Management 1-11 Integrating Application Security with Identity Management 1-12 Identity and Application Provisioning Life Cycle 1-14 Oracle Internet Directory: Overview 1-16 Components of Oracle Internet Directory 1-17 OracleAS Single Sign-On Server: Overview 1-19 Oracle Directory Integration and Provisioning Platform 1-20 OracleAS Certificate Authority: Overview 1-21 OracleAS Certificate Authority: Key Features 1-22 Administrative Delegation 1-24 Delegated Administration Services: Overview 1-25 Summary Security in an Enterprise and Web Environment Objectives 2-2 Enterprise Computing Environment 2-3 Components of Network Security 2-4 General Authentication Flow 2-6 Security Objectives of Oracle Application Server 10g 2-7 Providing Basic Security Services 2-8 Standards and Deployment Flexibility 2-10 Reducing Application Development and Deployment Costs 2-11 iii

4 Providing Security in Depth 2-13 Oracle Application Server: Security Architecture 2-14 User Management in the Internet Environment 2-16 Securing the Web Infrastructure 2-18 Enterprise Security Team 2-19 Summary Installing OracleAS Infrastructure Objectives 3-2 Services and Components of OracleAS Infrastructure 3-3 Installation of OracleAS Infrastructure: Overview 3-5 Minimum Requirements for OracleAS Infrastructure 3-6 Setting Up the Environment 3-8 OracleAS Infrastructure: Installation Steps 3-10 Starting the Installation 3-12 Oracle Universal Installer 3-13 First Installation of Oracle Product 3-14 Specify File Locations Window 3-15 Select a Product to Install 3-16 Select Installation Type 3-17 Preview of Infrastructure Installation 3-19 Select Configuration Options 3-20 Specify Identity Management Realm 3-21 OracleAS Certificate Authority 3-22 Database Identification 3-23 Passwords and Database File Location 3-24 Database Character Set 3-25 Specify Instance Details 3-26 Summary of Installation 3-27 End of Installation Window 3-28 Postinstallation Tasks 3-29 Accessing the OracleAS Instance 3-30 Application Server Control 3-31 Verifying OID Server 3-32 Accessing the SSO Server 3-33 Starting and Stopping OracleAS Infrastructure 3-34 Summary Planning Oracle Identity Management Deployment Objectives 4-2 Identity Management Deployment Planning Process: Overview 4-3 iv

5 Performing Requirement Analysis 4-4 High-Level Requirement Analysis 4-5 Translating Requirements into a Logical Deployment Plan 4-12 Standard Enterprise Model 4-13 Model Serving Internal and External Users 4-14 Using One Identity Management Infrastructure 4-15 Using Two Identity Management Infrastructures Security Isolation 4-16 Administrative Autonomy for Departmental Applications Model 4-18 Central Single Sign-On and Departmental Autonomy for Applications 4-19 Model Integrating OIM with Windows Environment 4-20 Integrating with Enterprise Provisioning 4-21 Application Service Provider Deployment 4-22 Detailed Deployment Planning 4-23 Planning Physical Network Topologies 4-24 Oracle Identity Management Infrastructure Default Deployment 4-25 OIM Infrastructure Deployment Using Multiple Middle-Tier Services 4-26 Replicated Oracle Identity Management 4-27 Application Deployments in Replicated Directory Environments 4-29 Deploying a Directory-Enabled Application: Guidelines 4-30 OracleAS Certificate Authority Recommended Deployment 4-32 Summary a Managing Oracle Internet Directory Objectives 5a-2 What Is a Directory? 5a-3 Lightweight Directory Access Protocol 5a-5 LDAP Components 5a-7 Oracle Internet Directory 5a-9 Security Benefits of OID 5a-10 OID Architecture: Overview 5a-11 OID Server Instance Architecture 5a-12 OID Node Architecture Components 5a-13 OPMNCTL Command 5a-15 Typical Startup Sequence 5a-16 Typical Shutdown Sequence 5a-17 OID Server Processes 5a-18 Starting the OID Monitor Process 5a-19 Starting Oracle Internet Directory Server Instance 5a-21 OID Log Files 5a-23 Stopping the OID Server Instance 5a-24 v

6 Stopping the OID Monitor Process 5a-25 Summary 5a-26 5b Managing Oracle Internet Directory Data Objectives 5b-2 Overview of Oracle Directory Manager 5b-3 Connecting to the OID Server 5b-4 ODM Connect Dialog Box 5b-5 Using ODM 5b-7 ODM Navigation Pane 5b-8 Disconnecting from the OID Server 5b-9 Using LDIF File 5b-10 OID Command-Line Tools 5b-12 Using Bulk Tools 5b-13 Using bulkload Command 5b-14 Using ldifwrite Command 5b-16 Using bulkmodify Command 5b-18 Using bulkdelete Command 5b-20 Using LDAP Command-Line Tools 5b-21 Using ldapadd Command 5b-22 Using ldapaddmt Command 5b-24 Using ldapbind Command 5b-25 Using ldapcompare Command 5b-26 Using ldapdelete Command 5b-28 Using ldapmoddn Command 5b-29 Using ldapmodify Command 5b-30 Using ldapmodifymt Command 5b-33 Using ldapsearch Command 5b-34 Summary 5b-36 6 Creating and Managing Oracle Identity Management DIT Objectives 6-2 OID Directory Information Tree: Overview 6-3 Sample DIT Structure 6-4 Planning DIT 6-5 Policies for Organizing Users 6-7 Policies for Organizing Groups 6-9 Delegation in Oracle Application Server 6-11 Privileges for Administering Oracle Technology Stack 6-13 User Administration 6-14 Group Administration 6-15 vi

7 Administration of Users and Groups in Oracle Application Server 6-16 Create User Group 6-17 Edit User Group 6-18 Delete User Group 6-20 User Privilege Assignment 6-21 Group Creation Group 6-22 Edit Groups Group 6-23 Delete Groups Group 6-25 Group Privilege Assignment 6-26 Delegation Privileges for Deployment of Oracle Components 6-27 Oracle Application Server Administrator 6-28 User Management Application Administrator 6-29 Trusted Application Administrator 6-30 Delegation of Privileges for Component Runtime 6-31 Oracle Components: Security Privileges 6-32 Summary Configuring Oracle Identity Management Realm Objectives 7-2 Oracle Identity Management Realm: Overview 7-3 Identity Management Policies 7-4 Deploying Identity Management Realms 7-5 Single Identity Management Realm 7-6 Multiple Identity Management Realms 7-7 Identity Management Realm in Hosted Environment 7-8 Identity Management Realm Objects 7-9 Planning the Identity Management Realm 7-10 Default Schema, DIT, and Identity Management Realm 7-12 Default Identity Management Realm 7-14 Identity Management Realm Specific Oracle Context 7-16 Identity Management Realm Specific Oracle Context s Common Entries 7-17 Customizing an Existing Identity Management Realm 7-19 Default Directory Users 7-21 OracleAS Bootstrap Model 7-22 OID Protection Domains 7-23 Directory Roles 7-24 Summary Managing Credentials Objectives 8-2 Storage of User Credentials 8-3 vii

8 Password Policies 8-4 Location of Password Policy Entries 8-6 Verification of User Password 8-7 Managing Password Policies Using Oracle Directory Manager 8-8 Modifying Password Policies by Using ODM 8-10 Managing Password Policies by Using Command-Line Tools 8-11 Managing Password Policies Using OID Self-Service Console 8-12 Modifying the OID Administrator Password 8-13 Modifying the IM Administrator Password 8-14 Password Storage for Authenticating to OID 8-16 Password Verifiers 8-18 Location of Password Verifiers 8-20 Attributes Storing Password Verifiers 8-21 Password Verifier Authentication Model 8-23 How Password Verification Works 8-24 Managing Password Verifier Profiles 8-25 Changing ODS Schema Password 8-27 Summary Administering the OracleAS Single Sign-On Server Objectives 9-2 OracleAS Single Sign-On: Overview 9-3 Single Sign-On Components 9-4 Authentication Flow for OracleAS Single Sign-On 9-6 Starting and Stopping OracleAS Single Sign-On Components 9-8 OracleAS Single Sign-On Administrator s Role 9-10 OracleAS Single Sign-On Administration Pages 9-12 Configuring the OracleAS Single Sign-On Server 9-13 Retrieving ORASSO Schema Password 9-14 Enabling Global User Inactivity Timeout 9-15 Partner Application: Overview 9-17 Registering mod_osso 9-18 Administering External Applications 9-20 Adding an External Application 9-21 Accessing External Application and Storing Its Credentials 9-23 Updating OID Access Information 9-24 Refreshing OID Cache 9-25 Multilevel Authentication: Overview 9-26 Components of a Multilevel System 9-28 Windows Native Authentication 9-31 viii

9 Monitoring OracleAS Single Sign-On Server 9-32 Summary Managing Oracle Delegated Administration Service Objectives 10-2 Delegated Administration Service 10-3 OID Self-Service Console: Overview 10-5 Benefits of DAS and OID Self-Service Console 10-6 How DAS Works 10-7 DAS Proxy User 10-9 DAS Configuration and Log Files Starting and Stopping DAS Verifying Whether DAS Is Running Enabling Oracle DAS Debug Mode Viewing Configuration Settings for an Identity Management Realm Configuring the Default Identity Management Realm Specific Context Configuring User Entries Managing Users, Groups, and Subscribers Using DAS Searching for User and Group Entries Using DAS Maintaining User Entries Using DAS Changing Passwords Changing Another User s Password Resetting SSO Password Creating Group Entries by Using DAS Modifying and Deleting Group Entries Using DAS Assigning Privileges to Users and Groups Using DAS Managing Services Managing Accounts Creating Identity Management Realms Summary Managing SSL Certificates in Oracle Identity Management Infrastructure Objectives 11-2 Public Key Infrastructure 11-3 What Is SSL? 11-5 Encryption Mechanism 11-6 Data Integrity: Message Digest 11-7 Authentication: Digital Signatures 11-8 Authentication: Digital Certificates 11-9 How SSL Works ix

10 Certificate Authority Traditional Certificate Provisioning Oracle PKI Management Tools OracleAS Certificate Authority OracleAS Certificate Authority: Key Features OCA Single Sign-On Authentication OracleAS Certificate Provisioning OCA Architecture OCA Functional Structure OCA Configuration Elements Starting and Stopping OCA Accessing the OCA Home Page Details Required to Obtain a Certificate Requesting the Web Administrator Certificate OCA Administration Home Page Summary Requesting User Certificates from OCA Server Objectives 12-2 User Certificates: Overview 12-3 Requesting a User Certificate 12-4 Requesting a User Certificate Using SSO Authentication 12-5 Requesting a User Certificate Using SSL Authentication 12-7 Requesting a Certificate Using Manual Authentication 12-9 Configuring Browser to Trust OCA Managing User Certificates Requesting a Server Certificate Requesting a Subordinate CA Certificate Importing and Downloading a CRL Summary Managing Certificates and Configuring OCA Objectives 13-2 Managing Certificates as an Administrator 13-3 Approving and Rejecting Certificate Request 13-4 Searching for a Certificate Request or an Issued Certificate 13-6 Using Advanced Search 13-8 Revoking a Certificate 13-9 Renewing a Certificate Updating the Certificate Revocation List Revoking an OCA Web Administrator Certificate x

11 OracleAS Single Sign-On and OCA Configuring OCA Server Enabling OCA Server Notifications System Configuring Mail Notifications Configuring Alerts Scheduling OCA Jobs Enabling General OCA Server Tasks Viewing OCA Logs Practice Statement Summary Managing OracleAS Certificate Authority Policies Objectives 14-2 OCA Policy Rules: Overview 14-3 How Policies Are Evaluated 14-4 OCA Default Policies 14-5 OCA Policy Predicates 14-6 OCA Certificate Policy: RSAKeyConstraints 14-7 OCA Certificate Policy: ValidityRule 14-8 OCA Certificate Policy: UniqueCertificateConstraint 14-9 OCA Certificate Policy: RevocationConstraints OCA Certificate Policy: RenewalRequestConstraints Predicate Attributes Actions on Predicates Actions on Policies Adding Custom Policies Summary Securing Certificates by Using Oracle Wallet Objectives 15-2 What Is Oracle Wallet Manager? 15-3 Oracle Wallet Manager: Functions 15-4 Managing Wallets 15-5 Creating a New Wallet 15-6 Saving a Wallet 15-7 Deleting a Wallet 15-8 Changing the Wallet Password 15-9 Using the Auto Login Feature Exporting a Wallet Uploading Wallets Downloading Wallets xi

12 Managing User Certificates Adding a Certificate Request Exporting a User Certificate Request Importing the User Certificate to the Wallet Exporting a User Certificate Managing Trusted Certificates Importing a Trusted Certificate Exporting a Trusted Certificate Enable Oracle HTTP Server to Use SSL Configuring Oracle HTTP Server for SSL Certificates Summary Integrating Oracle Identity Management Infrastructure with Other Directories and Applications Objectives 16-2 Oracle Directory Integration and Provisioning Platform: Overview 16-3 Why Is Oracle Directory Integration and Provisioning Platform Needed? 16-4 Structure of Oracle DIP 16-5 Provisioning: Overview 16-6 Synchronization: Overview 16-8 Provisioning Versus Synchronization Oracle Directory Integration and Provisioning Server Directory Integration Toolkit Administration and Monitoring Tools Oracle Directory Integration and Provisioning Platform Deployment Scenario Overall Deployment User Creation and Provisioning Modification of User Attributes Deletion of Users Oracle Directory Integration and Provisioning Server Register the Oracle Directory Integration and Provisioning Server Oracle Directory Integration and Provisioning Server and Configuration Set Entries Sequence of Oracle Directory Integration and Provisioning Server Events Starting the Oracle Directory Integration and Provisioning Server Stopping the Oracle Directory Integration and Provisioning Server Restarting the Oracle Directory Integration and Provisioning server Setting the Debug Level Finding the Log Files Viewing Oracle Directory Integration and Provisioning server Information Summary xii

13 17 Synchronizing Oracle Identity Management with Other Directories Objectives 17-2 Directory Synchronization Service 17-3 Connectors 17-4 Directory Synchronization Profiles 17-6 Synchronization Agent 17-8 Synchronization Process: Overview 17-9 Directory Synchronization Profile Registering Connectors to Oracle Directory Integration and Provisioning Platform Mapping Rules and Formats Mapping Rule Format Creating a New Mapping File Guidelines for Adding Mapping Rules Mapping Types Location and File Names Registering Profiles by Using ODM Deregistering a Profile Using ODM Registering Profile by Using Command-Line Tools Deregistering Profile by Using Command-Line Tool Using Directory Integration and Provisioning Assistant Creating, Modifying, and Deleting directory Synchronization Profile Other DIP Assistant Command Options Troubleshooting Oracle Directory Integration and Provisioning Platform Summary Configuring Oracle Identity Management Provisioning Integration Service Objectives 18-2 Provisioning Integration Service 18-3 Provisioning Procedure 18-4 Provisioning Information 18-6 Provisioning Integration Service and OID 18-7 Applications and Provisioning Integration Service 18-8 Application and Provisioning Integration Service 18-9 Applications and Provisioning Integration Service Deploying Oracle Directory Provisioning Integration Service Provisioning Subscription Tool Security and Provisioning Profiles Provisioning Profiles and Access Entities xiii

14 Security-Sensitive Provisioning Profile Attributes Monitoring Provisioning Integration Profile Troubleshooting the Provisioning Integration Service Summary Oracle Internet Directory Replication Concepts Objectives 19-2 OID Replication 19-3 Directory Replication Group and Replication Agreement 19-4 Types of Replicas 19-5 Types of Replication 19-6 Partial Replication 19-7 Types of Directory Replication Groups 19-8 Data Transfer Between Nodes in a DRG 19-9 Single-Master DRG Multimaster DRG Fan-out DRG Multimaster and Fan-out DRG Enhancing Replication Methods Included and Excluded Naming Contexts Replication Agreement Replication Configuration Objects in OID Replication Architecture Multimaster Supplier Replication Process Multimaster Consumer Replication Process OID Replication Server Conflict Resolution Automated Resolution of Conflicts Replication Processes Adding a New Entry to a Consumer Deleting an Entry Modifying an Entry Modifying a Relative Distinguished Name Modifying a Distinguished Name Fan-out Replication Process Partial Replication Filtering Rules Summary Setting Oracle Internet Directory Replication Objectives 20-2 Master and Remote Definition Site 20-3 xiv

15 Installing and Configuring the Replication Server 20-4 Installing OID on MDS and RMS 20-5 Setting Up OID Replication for DRG 20-7 Loading Data into OID Starting OID and Replication Server Test Directory Replication Adding a Replication Node Deleting Replication Node Changing Replication Administrator Password Resolving Conflicts Manually Human Intervention Queue Manipulation Tool OID Reconciliation Tool Rules for Configuring LDAP Replication Adding a Partial Replication Node Removing a Partial Replica Node Viewing and Modifying Replica Naming Context Objects Changing the Replication DN Password Managing OID Replication Modifying Configuration Parameters Viewing and Modifying Replica Node Viewing and Modifying Replication Agreement Summary Appendix A - Practices Appendix B - Solutions Appendix C - Integrating Oracle Identity Management with Windows Active Directory Service Objectives C-2 OID and Microsoft Windows OS C-3 Managing Password Verifiers in OID C-5 MS Windows ADS as Central Enterprise Directory C-6 OID as Central Enterprise Directory C-7 Configuration Information for ADS Connector C-8 MS ADS Synchronization Mapping Rules C-10 MS ADS Synchronization Access Control C-12 Planning Integration with ADS C-13 Configuring ADS and OID Import and Export Synchronization C-14 Summary C-15 xv

16 Appendix D - Enterprise User Management and Oracle Identity Management Objectives D-2 User Management: Challenges D-3 Enterprise User Security: Overview D-4 Enterprise Users Versus Database Users D-6 Enterprise User Schemas D-8 Enterprise User: Authentication Mechanism D-10 Enterprise User Security: Directory Entries D-12 Enterprise Users and Roles Directory Entries D-13 Enterprise Domains and Database Server Directory Entries D-15 Using Shared Schemas for Enterprise User Security D-17 Shared Schema Configuration for Enterprise Users D-18 Enterprise User Security Configuration: Overview D-19 Enterprise User Security Administration Tools D-21 Summary D-22 xvi