Robert Honeyman Honeyman IT Consulting.

Transcription

1 Robert Honeyman Honeyman IT Consulting

2

3 Requirement for HA with SSO Centralized access control SPOF for dependent apps SSO failure = no protected application access Critical user data stored in Identity Store directory Recommended even if all apps not HA

4 Solution Focus Oracle Access Manager (11.1.2) Oracle Internet Directory ( x) Database HA considerations (11.2) FMW integrations (Forms , ADF )

5 HA Directory Components Oracle Internet Directory (LDAP) OID RAC Database Oracle Directory Services Manager (ODSM) Hardware Load Balancer

6 HA Access Components Access Manager (SSO / Access Control) OAM RAC Database (Policy Store / Session Persistence) Web Tier (OHS + WebGate) Hardware Load Balancer

7 Firewall Zones Web Tier OHS + WebGates Application Tier OAM + ODSM Data Tier / Directory Tier OID + Databases

8 Integrated Load Balancing Oracle Access Manager (OAM) OHS > OAM Admin console (HTTP/ mod_wl_ohs) OHS > Weblogic Admin console (HTTP/ mod_wl_ohs) Web Gate > Access Server (Oracle Access Protocol) Oracle Directory Management Services (ODSM) OHS > ODSM (HTTP/ mod_wl_ohs) OHS > Weblogic Admin console (HTTP/ mod_wl_ohs) OHS > FMW Control (HTTP/ mod_wl_ohs)

9 Hardware Load Balancing Description Protocol VIP Hostname VIP port Service port OAM SSO HTTPS sso.mycompany.com OID non-ssl LDAP ldap.mycompany.com OID SSL LDAPS ldap.mycompany.com OAM Admin HTTPS oamadmin.mycompany.com IDM Admin HTTPS idmadmin.mycompany.com

10 Middleware Storage Shared (NFS etc) Middleware Homes (Redundant) Admin Server domain directory (Mirrored) Local Weblogic Managed Server directories (ODSM, OAM) Oracle Instance directories (OID, Web Tier)

11

12 OID: HA Install Requirements Weblogic/ Java only required for ODSM Separate domain if using ODSM (IDM( x) IAM ( x)) NTP installed and hosts time synchronized Select clustered option during installation OID 2 nd node shared repository warning

13 OID HA: Single Site LDAP(S) (389, 636) Load Balancer ldap.mycompany.com LDAP(S) (3060, 3161) IDM Cluster oidhost1 OID1 OID2 oidhost2 TNS (1521) Load Balancing + TAF RAC Cluster dbhost1 RAC1 RAC2 dbhost2 NFS / ASM RAC DB

14 OID: HA Features and Config OID Identity Management Cluster Database based shared state Notable settings Entry Caching must be disabled orclcacheisenabled=0 Load Balancer / Firewall timeouts orclldapconntimeout < network device timeout OPMN auto-restart RAC for database instance HA TAF for database connection resilience

15 OID Multi-Site: Data Guard Active-Passive (normally) (1Gbps+) may allow cross-site database connections 100% data consistency across active OID instances No change logging required OID host cloning (VM clones, snap mirroring, rsync)

16 OID HA: Multi-Site with Data Guard Primary Site Load Balancer Primary LDAP(S) (389, 636) ldap.mycompany.com LB Mirroring Load Balancer Standby LDAP(S) (389, 636) ldap.mycompany.com Standby Site LDAP(S) (3060, 3161) LDAP(S) (3060, 3161) IDM Cluster Primary OID1 OID2 Clone IDM Cluster Clone OID1 OID2 TNS (1521) TAF + Load Balancing TNS (1521) TAF + Load Balancing RAC Cluster Primary RAC1 RAC2 Data Guard RAC Cluster Standby RAC1 RAC2 NFS / ASM NFS / ASM RACDB RACDB

17 Directory Management HA ODSM provides LDAP Entry / ACL Management ODSM Weblogic idmcluster in IDMDomain Separate ODSM Managed Servers from Admin Server Admin Server Domain directory on shared storage Listen on virtual floating host IP

18 Directory Management HA HTTP(S) (80,443) idmadmin.mycompany.com HTTP(S) (7777,4443) webhost1 WebTier1 WebTier2 webhost2 idmhost1 mod_wl_ohs (7001,7006) idmhost2 AdminServer EM WL Console idmcluster Weblogic Cluster wls_ods1 wls_ods2 AdminServer EM WL Console

19

20 OAM HA Install Requirements Separate Domain for Access Manager IAMDomain Domain template options - OAM, OEM, OPSS, JRF NTP installed and hosts time synchronized config.sh optional configuration Administration Server Managed Servers, Clusters and Machines Deployment Services Configure OAM Security Store before first startup! Run using WLST ${ORACLE_HOME}\common\tools\configureSecurityStore.py create then verify

21 OAM Policy / Session Database Contents Access control policies (resources, authentication, authorization) OAM Session Data (persistent back up of in-memory) RAC for single-site protection Multi Data Sources / Grid Link Data Sources Data Guard for cross-site protection Site Connection Failover in JDBC connect string

22 OAM Database connection

23 Domain directories Admin Server (Shared) Master directory ${ORACLE_BASE}/admin/IAMDomain/aserver/IAMDomain Managed Server (Local) Node specific ${ORACLE_BASE}/admin/IAMDomain/mserver/IAMDomain managed=true option for pack.sh pack.sh and unpack.sh to relocate if required

24 OAM HA Features and Config OAM Access Server Cluster Runs Access service sessions, access control WebGate talks Oracle Access Protocol to OAM Proxy Coherence replicates live config and sessions across cluster OAM_REQ cookie RequestCacheType to COOKIE Admin Server Floating host virtual interface Standard Admin Console (WLS, EM) OAM Console policy configuration

25 Oracle Access Manager HA HTTP(S) (80,443) sso.mycompany.com oamadmin.mycompany.com HTTP(S) (7777,4443) webhost1 WebTier 1 WebTier 2 webhost2 HTTP(S) 7001/7002 oamhost1 HTTP(S) (14100) oamhost2 AdminServer EM OAM Console WL Console oamcluster Weblogic Cluster OAM Proxy wls_oam1 coherence OAM Proxy wls_oam2 coherence AdminServer EM OAM Console WL Console RAC OAMDB

26 Web Tier Configuration Web Tier Utilities link to existing IAMDomain Front-end SSL desirable OAM virtual host (sso.mycompany.com) Access service URLs unprotected mod_wl_ohs handler /oam context path WLCookieName OAM_JSESSIONID

27 OID as OAM Identity Store Default ID Store is Weblogic Embedded LDAP Max 10K users, not suitable for Enterprise HA Use OID for Enterprise HA deployment OAM heartbeats to check directory availability Configurable timeouts and failure check intervals Secondary ID store configuration possible

28 OAM / OID Integration idmconfigtool.sh creates Identity Store in OID preconfigidstore prepareidstore mode=wls (weblogic) prepareidstore mode=oam (oamadmin) Register Identity Store (OAM Console) cn=oamldap,dc=mydomain,dc=com (not cn=orcladmin) Change System Identity Stores (OAM Console) System Store admin accounts, groups, roles Default Store security token service / patching LDAP Authentication Module (OAM Console)

29 OAM / OID Integrated sso.mycompany.com oamadmin.mycompany.com idmadmin.mycompany.com HTTP(S) 7777 IAMDomain Web Tiers HTTP(S) 7006 HTTP(S) 7001 HTTP(S) Identity Data (Identity Store) ldap.mycompany.com IDMDomain OAM Admin OAM WLS oamcluster OID IDM LDAP Cluster ODSM WLS idmcluster Policy / Session Data (Policy Store) RAC OAMDB RAC OIDDB

30 WebGateConsiderations WebGate Farm or application specific WebGates? What Virtual Hosting is required? Is SSL required between WebGates and Access servers? Do WebGatesneed to reside in DMZ? Are legacy agents used (OSSO, WebGate 10g)?

31 OAM Configuration WebGate Agent and Policy Registration RREG (XML config file) OAM Console Host Identifiers Virtual Hosting Application Resources - URLs Authentication Schemes Identity and credential verification Authorization Policies - Protect and Unprotect resources

32 OAM: HA Web App Integration App Requests SSO requests myapp.mycompany.com sso.mycompany.com Web Tiers IAMDomain Web Tiers Identity Data (Identity Store) ldap.mycompany.com WebGate HTTP(S) (14100) IDMDomain OAP (5575) OAM WLS oamcluster OID IDM LDAP Cluster MYAPP Policy / Session Data (Policy Store) RAC OAMDB RAC OIDDB

33 OAM Multi-Site Options Active-Passive Database - Data Guard Mid-Tier - Cloning Active-Active Database Replication Mid-Tier Single OAM Cluster (low latency required) Multi-cluster - Multi-Tier Load Balancing (site-based stickiness)

34

35 Forms: OAM Compatibility Forms (OAM x or ) Native compatibility OAM WebGate compatible Forms 10.1.x, x No native OAM compatibility OAM OSSO Legacy agent compatible

36 Forms: OAM SSO OAMAuthnCookie_<hostname+port> + OAM_ID cookies Encrypted SSO ID and session information WebGate protect /forms/frmservlet?*oammode=true* Resource Access Descriptors (RADs) stored in OID Web SSO ID mapped to DB credentials LDAP entry in OID maintains mapping Defaults, pre-populated or created on first user login Enterprise User Security (optional) Centralized Identity data Reduced Administration

37 Forms: OAM SSO Web Browser OAM_ID OAMAuthnCookie WWW Requests (HTTP) Redirect Web Tier WebGate Login requests (HTTP) Forms Requests (HTTP) OAP FORMS App data requests (TNS) SSO Identities (LDAP) OAM Policy data requests (TNS) Application Datastore FORMS DB DB Resource Access Descriptors (LDAP) OID OAM DB Policy Datastore

38 Forms: OAM Integration Associate Forms with OID in FMW Control Host: ldap.mycompany.com Port: 389 Username: cn=orcladmin Override formsweb.cfg parameters ssomode webgate ssoproxyconnect yes

39 Forms: SSO Parameters ssomode instructs Forms of the type of SSO agent webgate Forms x mod_osso(true) Forms x false No SSO ssoproxyconnect use shared Proxy account Login Credentials / RAD used are for Proxy database account Web SSO ID used as Named User database account Privileges against Named User database account ssodynamicresourcecreate Allows Dynamic RAD creation

40 ADF: OAM SSO OAMAuthnCookie_<hostname+port> + OAM_ID ADF Security / OPSS OAM Authentication Provider Identity Asserter WebGate protection / authentication Authenticator ADF authentication / no WebGate

41 ADF: WebGateSSO Web Browser OAM_ID OAMAuthnCookie WWW Requests (HTTP) Redirect Web Tier WebGate Login requests (HTTP) App Requests (HTTP) OAP IdentityAsserter ADF App data requests (TNS) SSO Identities (LDAP) OAM Policy data requests (TNS) Application Datastore APP DB OID Authenticator (LDAP) OID OAM DB Policy Datastore

42 ADF: WebGateSSO Configuration Application web.xml(s) required setting <login-config> <auth-method>client-cert</auth-method> </login-config> mod_wl_ohs handler + connection filter from WebGate protected OHS to ADF Weblogic Add OAM provider to ADF domain jps-config.xml addoamssoprovider(loginuri="/${app.context}/adfauthentication", logouturi="/oamsso/logout.html", autologinuri="/obrar.cgi") Configure OAM protected policy for /${app.context}/adfauthentication Copy OAM provider war file to ADF Weblogic autodeploy directory oamauthenticationprovider.war Select Identity Assertion Mechanism - OAM_REMOTE_USER, OAM_IDENTITY_ASSERTION Weblogic Authentication Provider settings OAM Identity Asserter (REQUIRED) OID Authenticator (SUFFICIENT) Default Authenticator (SUFFICIENT)

43 Reference Documentation Identity Management Enterprise Deployment Guide Fusion Middleware High Availability Guide Oracle MAA IDM Enterprise Deployment Oracle Fusion Middleware Integration Guide for Oracle Identity Management Suite Oracle Fusion Middleware Forms Services Deployment Guide Oracle Fusion Middleware Application Security Guide Oracle Database Enterprise User Security Administrator's Guide

44

45 Oracle Unified Directory: HA Data stored locally in Berkeley DB Directory Replication only HA option Loose consistency model Replication occurs AFTER returning write result to app Assured Replication Model Safe Read Mode => replication GUARANTEED before return Trade off performance v replica integrity Recommended for Identity Management Configurations Active/Active Assured configuration (Patch ARU ) Active/Passive Non assured configuration No OPMN auto-restart failover only

46 OUD: HA Topology Load Balancer LDAP(S) (389, 636) ldap.mycompany.com LDAP(S) (1389, 1636) oudhost1 OUD1 OUD2 oudhost2 LDAP Replication BDB1 BDB2

47

48 OID: LDAP Replication Active-Active multi-master multi-site configurations Loose consistency possible data consistency issues No downtime options for patching Change logging required Replication Options Advanced Replication (Database Transport) Faster - Required for Active-Active SSO configurations LDAP Transport Too slow for Active-Active SSO configurations Various types - Single Master, Multi Master, Fan-Out

49 OID HA: Multi-Site with Replication Load Balancer Site 1 LDAP(S) (389, 636) ldap.mycompany.com LDAP(S) (3060, 3161) Multi-Master Replication Load Balancer Site 2 LDAP(S) (389, 636) ldap2.mycompany.com LDAP(S) (3060, 3161) IDM Cluster Site 1 OID1 OID2 IDM Cluster Site 2 OID1 OID2 RAC Cluster Site 1 TNS (1521) Load Balancing + TAF RAC1 NFS / ASM RAC2 RAC Cluster Site 2 TNS (1521) Load Balancing + TAF RAC1 NFS / ASM RAC2 RACDB1 RACDB2