Under the Hood 11g Identity Management
2 likes805 views
The document outlines the features and architecture of Oracle 11g identity management, including components like identity manager, access manager, and directory services. It discusses the importance of identity management for compliance, security, and cost management, along with various technical processes such as LDAP search mechanisms and server chaining. Additionally, it provides implementation guidelines, replication strategies, and configuration steps for the Oracle identity management system.
Under the Hood 11g Identity Management
- 1. 11g Identity Management Peter McLarty Pacific DBMS Pty Ltd 17 th August 2010 The most comprehensive Oracle applications & technology content under one roof
- 3. Introduction What are we here for?
- 6. Single Sign On (Single Point of truth)
- 7. Lots of products Identity Manager
- 12. Why do we need it? Compliance
- 13. Security
- 15. How is it useful Access Controls
- 17. Audit Support
- 18. Controls Roles
- 19. Fine grain access controls
- 20. Tracking of events – logon - logoff
- 21. Oracle Directory Services Oracle Virtual Directory
- 24. Oracle Internet Directory & Oracle Directory Server
- 25. What's OID? LDAP Service
- 27. Data Store used by other Identity Services
- 29. OIDMON
- 30. ODS
- 31. ODRS
- 32. LDAP Server Instance Server Processes
- 34. Tuning Required
- 35. Default Ports 3060 Non SSL
- 36. 3131 SSL
- 37. Metadata Uses a cache which is built at startup
- 38. Directory schema - what is stored
- 39. Control of who access what – ACP
- 40. Root DSE - Stores information about the server itself
- 41. Metadata Privilege Groups - Used for Access Control Policies
- 42. Contains entries for hosted businesses,password verification,password policy and others
- 43. DIT What is a DIT? Can I have more DIT's?
- 44. Search Process 1 Client connects SSL or non SSL with LDAP protocol
- 45. Type of user can be known or anonymous
- 46. Filters can be put in place to limit search
- 47. User authenticated, bind made, ACL checked
- 48. Search Process 2 LDAP search request is converted to OCI language to interrogate the database
- 49. Database retrieves data; passes it back via OCI to the LDAP server
- 50. Query result sent back to the database
- 51. Server Chaining What is it? Why do we want to use it?
- 52. Server Chaining 2 Server chaining supports the following operations: Bind
- 53. Compare
- 54. Modify
- 55. Search
- 56. Creating a Server Chaining Entry Command Line or Directory Services Manager - Create LDIF file
- 57. dn: cn=AD,cn=users,dc=pacificdbms,dc=com,dc=au cn: AD objectclass: orclcontainer objectclass: top
- 58. Connection to Sun IPlanet cn=oidsciplanet,cn=OID Server Chaining,cn=subconfigsubentry orclOIDSCExtHost: sunone.example.com orclOIDSCExtPort: 10389 orclOIDSCExtDN: cn=directory manager orclOIDSCExtPassword: ********
- 59. Connection to Sun IPlanet orclOIDSCExtUserContainer: ou=people,dc=example,dc=com orclOIDSCExtGroupContainer: ou=groups,dc=example,dc=com orclOIDSCTargetUserContainer: cn=iPlanet,cn=users,dc=oracle,dc=com orclOIDSCTargetGroupContainer: cn=iPlanet,cn=groups,dc=oracle,dc=com
- 60. Connection to Sun IPlanet orclOIDSCExtSearchEnabled: 1 orclOIDSCExtModifyEnabled: 1 orclOIDSCExtAuthEnabled: 1 orclOIDSCSSLEnabled: 1 orclOIDSCExtSSLPort: 10636 orclOIDSCWalletLocation: /ipwallet/ewallet.p12 orclOIDSCWalletPassword: ********
- 61. Debugging Server Chaining Create an LDIF
- 62. filedn: cn=oidscad,cn=oid server chaining,cn=subconfigsubentry changetype: modify replace: orcloidscDebugEnabled orcloidscDebugEnabled: 1Execute
- 63. $ORACLE_HOME/bin/ldapmodify -h host -p port -D cn=orcladmin -q -f file
- 64. Designing your implementation Do Not use clustered hosts - too many issues
- 65. If you have the skills use Linux on VM's
- 66. Scatter installations across your environment
- 67. Use Replication
- 68. If you have load balancers use them
- 69. Installation Using default settings the server needs 6GB or greater
- 70. Can do small memory with altered Java VM settings
- 71. Need to understand 11g path conventions
- 72. Install Notes Metalink Note 858748.1 Getting Started FAQ
- 73. Configuration After installing the software configure the instance – config.sh
- 74. Save configuration before running configuration step at the end
- 75. Small memory config Metalink note 865166.1
- 76. -Xrs -XX:MaxPermSize=192m in Admin Console – Server Configuration
- 77. Replication Its Important What model? Fan Out, Multimaster, Single Master? Not guaranteed to be consistent- data different on different nodes
- 78. Single Master One master all others read only
- 79. Multimaster All Nodes can update all other nodes
- 80. Fan Out Its a hybrid
- 81. LDAP Replication Full or Partial Peer to peer, One Way, Two Way Multimaster, Single Master, Fan Out
- 82. LDAP Replication
- 83. Advanced Replication (Database) Full replication
- 84. Peer to peer
- 85. Multimaster
- 86. Single by changing all but one to read only
- 87. Uses the database to do the replication
- 88. Uses command line tools to configure this
- 89. remtool Use it for configuring the advanced replication
- 90. Modify or reset replication Bind DN password
- 91. Displaying various errors and status information for change log propagation
- 92. Convert advanced replication to LDAP replication
- 93. Setting up Replica - Command Line Copy database for new instance; not recommended
- 94. Bootstrapping is the better option
- 95. What is bootstrapping? Supplier Node and Replica Node
- 96. Use remtool to copy metadata from supplier to replica
- 97. Set up the replication with the Replication wizard
- 98. Replica Using Replication Wizard Fusion Middleware Control
- 101. Follow remaining steps – Oracle Docs
- 102. Bootstrapping issues Cannot have replica and supplier system in bootstrap mode (orclreplicastate=1) = Normal Operation
- 103. A number of problems in My Oracle Support for bootstrap
- 104. Fusion Middleware and Managing OID Cannot do if not part of a WLS domain
- 105. Fusion Middleware Control uses SSL
- 106. Port configured none or server authentication
- 107. To connect use http://host:port/odsm
- 108. Command Line Domain Home to manage the Admin Server
- 109. Instance Home to manage the OID Server
- 110. opmnctl to control the OID server
- 112. ods_process_status Oidmon polls table to check system
- 113. Can be used by other scripts to monitor OID
- 114. WLST Weblogic Scripting Tool
- 115. Jython based
- 116. Used for many things
- 117. Can script many tasks
- 118. Weblogic Server Version The following might be useful when installing new product to an existing server
- 119. cat registry.xml | grep version
- 122. Tell us what you think… http://feedback.insync10.com.au