OIM / OID : Referential Integrity for referenced group memberships on change username

Use Case 

Change Username (typically via OIM APIs) doesn't update group memberships. When we change username, the cn of the user changes. Since the dn comprises of cn and the dc, the referenced group memberships are orphaned.

This is because, by default, "Referential Integrity" is turned OFF in OID and OIM. 

Refer Section : C.2.2 Common Name Generation for Modify User Operation

"Because the CN changed, Oracle Identity Manager attempts a modify operation (modrdn) in the directory resulting in DN change. Because of this unintended DN change, the group membership DN becomes stale resulting in the user loosing membership in that group. This subsequently results in authorization failure. This happens when referential integrity is turned off in the LDAP server, and therefore, the referenced groups are not updated when the RDN of the user changes. Therefore, referential integrity must be turned on in the target LDAP server. Otherwise, the group memberships become stale. The referential integrity issue is also applicable to roles. Groups are also members of other groups and any RDN changes must be reflected as well."

Please see table in link for scenarios when this property is not consistent in OIM and OID.

• Turn on Referential Integrity Check in OID : 

Change orclRIEnabled to 2 within cn=dsaconfig,cn=configsets,cn=oracle internet directory [Default value is 0]
http://docs.oracle.com/cd/E15586_01/oid.1111/e10029/ref_integ.htm

• In OIM, modify System property : XL.IsReferentialIntegrityEnabled to TRUE

The above will make sure change username is seamless and doesn't cause any data corruption issues. Obviously, we need to have LDAP Sync turned on between OIM and OID to make sure that this works as expected.

Oracle API Gateway (OAG) : Concept & marriage with SOA & Mobile

Oracle API Gateway is a standards-based, policy-driven, standalone software security solution that provides first line of defense in Service-Oriented Architecture (SOA) environments.

It enables organizations to securely and rapidly adopt Cloud, Mobile and SOA Services by bridging the gaps and managing the interactions between all relevant systems.

Oracle Web Services Manager(OWSM) is generally used for application security of a particular service,most customers have any use cases around DMZ or Perimeter Security for Web Services. This product serves as a part of the enterprise security solution.

This would be typically for customers needing access to web services from the internet, similar to how we access a web application. OAG can do a  lot of validations
and route the requests only once those checks have passed. This may also be a typical use case for Mobile Applications which use REST Web Services at the backend.

I have seen a strong value in this security product for all SOA and Mobile projects.

Here’s a high-level request flow :

There are many advantages that OAG can provide :

–   Authentication, Authorization (Leverages existing LDAP like AD ; existing IDM platforms for this – RSA AM, CA Site Minder, Oracle Access Mgr)

–   XML Acceleration, Throttling, Caching, Protocol translation (REST to SOAP and vice versa), Dynamic routing, SLA enforcement

–   Identity Propagation and Credential Mapping , Filter threatening content (XML Bombs, DOS Attacks, Virus)

Oracle OEMs (or Original Equipment Manufacturing) the OAG product from AxWay – AxWay’s gateway product is rebranded for Oracle as OAG, and is almost identical.

Quick Demo : https://www.youtube.com/watch?v=MWunxvZnB1A

Oracle  Datasheet

OAM 11.1.2.2 (11gR2) - System error after submitting credentials from Custom Login Page

Scenario : Standard Custom Login Page doing form post to /oam/server/auth_cred_submit with username/pwd and 'request_id' in cookie.

Issue - Sporadic redirection to an error page with 'System Error has occurred' message with details -

[oam_server1] [TRACE] [] [oracle.oam.binding] [tid: [ACTIVE].ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: ] [ecid: 004sto37QpzDoYX5HvH7if00063I00002b,0:2] [SRC_CLASS: oracle.security.am.pbl.protocol.plugin.oam.AMFailureResponseHandler] [APP: oam_server#11.1.2.0.0] [SRC_METHOD: processResponse] [URI: /oam/server/auth_cred_submit] OAM-02073[[

oracle.security.am.common.utilities.exception.AmRuntimeException: OAM-02073
at oracle.security.am.engines.enginecontroller.AuthzEngineController.checkProtected(AuthzEngineController.java:438)
at oracle.security.am.engines.enginecontroller.AuthzEngineController.processEvent(AuthzEngineController.java:177)
at oracle.security.am.controller.MasterController.processEvent(MasterController.java:570)
at oracle.security.am.controller.MasterController.processRequest(MasterController.java:759)

Solution - 

As per Support Document Id 1578776.1-

"Verify that the custom login page is submitting the credentials to /oam/server/auth_cred_submit with the correct OAM Server Host and Port.The OAM_SERVER_HOST.DOMAIN and SSLPORT values should match those configured in the OAM Console -> System Configuration -> Access Manager Settings page for Load Balancing OAM Server Host and OAM Server Port.”

In  my case, the form post URL was pointing to https://<host>/oam/server/auth_cred_submit.

Once I had it changed to https://<host>:443/oam/server/auth_cred_submit, (adding missing port) this issue got resolved.

Please check the above support document for some other causes for this issue.

Oracle Security : Getting Started

Oracle Identity Management(IDM) is a vast collection of products with confusing terminology and it can be difficult to understand where to start. Hope the below links help.

Concepts

Oracle IDM Basics - (Keep clicking to navigate through entire topics)

A few simple Tutorials from Oracle to get started

Oracle IDM Home Page (Source to Datasheets, Whitepapers, Customer Use Cases and various Data)

Installs

Software Downloads Page

Installation Guide 

Issues/Continuous learning of tricky use cases & finer concepts

Oracle IDM A-Team Blogs (Learn tricks of the trade)

Oracle IDM Forums

OnlineAppsDBA Blogs

Oracle Security Facebook Page

Mapping of use cases with products

IDM Customer Success Stories  

Collated IDM 11gR2 Blog Dashboard

Abhishek Gupta's Blog

Oracle IDM 11gR2 : Integrating with MS Active Directory 2003

The latest versions of OIM and OAM 11gR2(11.1.2.x) donot support LDAP Sync or OIM-OAM Integration using Active Directory(AD) 2003 as per the 11gr2 certification matrix. 

We had a use case to support federation using OAM 11gR2 somehow with AD 2003 as the Identity Store. 

Option 1 : Using OVD

We noticed that the latest version of OVD was 11.1.1.7 which happens to support AD 2003 as per the 11gR1 FMW certification matrix .So potentially we could hook OAM with OVD as the Identity Store and still connect to Active Directory 2003, which is not directly supported!

Extending this theory we could provision to OVD from OIM which finally would create relevant user accounts in Active Directory 2003!!

Oracle confirmed this in SR # 3-9503114871(you may not be able to view it directly but can refer to this in another SR if need be).

Option 2 : Using OID and DIP

Standup OID(11.1.1.7 is the latest as of today) and sync existing users from AD 2003 using a DIP process.

Option 3 : Use IDM 11gR1

Least preferred since it's never a good idea to go back to a older release when the newer release has so much to offer and IDM 12c is in the pipeline.If none of the above can be made to work for whatever reasons, AD 2003 is definitely supported both with OIM and OAM 11gR1(11.1.1.x).

Database Security - Enterprise User Security (EUS)

About Enterprise User Security (EUS)

• Enterprise User Security (EUS) is a way of integrating Oracle Database with LDAP compliant directory server like Oracle Internet Directory (OID) or Microsoft AD
  so that database Users , Passwords & Roles can be centrally managed in a LDAP Directory Server.
• Belongs to Database Security category of the IdM stack.

Advantages 

• Offers low costs & centralized authentication.
• Increases security & compliance.
• No data migration needed , clients continue to use existing directories.

Architecture

• Oracle Virtual Directory (OVD) has a EUS Adapter and EUS Plugins OOTB.
• The LDAP Directory (OID or AD or Novell or Sun eDirectory) needs to be setup for EUS.
• The Oracle Database/s need to be EUS enabled using NETCA & DBCA utility.
• The Database/s can be logged into using a centralized EUS User/s later.
• Kerberos authentication can be enabled to do native authentication for SQL clients like sql plus & SQL Developer.

Useful Resources 

1. EUS DataSheet with Architecture
2. Enterprise User Security Guide
3. Integrating Enterprise Security with AD
4. Oracle Whitepaper
5. Atul Kumar’s Blog
6. How To Configure EUS with OVD 11.1.1.6 and Active Directory - AD (Doc ID 1449132.1)
7. Expected Issues - How To Avoid Extending The Active Directory Schema With extendAD For OVD-OID-AD-EUS 11g Integration? (Doc ID 1159337.1)

Oracle Identity Mgmt 11gR2 PS2 : New features & Cloud / Mobile Strategy

Source - The live webcast on this topic by Oracle. Here are the updates -

"Oracle IdM R2 PS2 Theme  - Cloud , Mobile , Simplification"

New features in 11gR2 PS2 release  -

1) Cloud Access Portal - a web based application has been added in PS2 release which will enable admins to manage SaaS based cloud applications.

• The login to each application will be using SSO , form-fill technologies & federation capabilities.UI adapts to  various form factors.
• OAM Protects the resources
• When clicked on apps , redirection to logjn page with form fill and auto login.
  
  

2)Session Management features in Oracle Privileged Account Manager (OPAM) - 

OPAM is a whole new set of functionality focused on managing administrative passwords for applications, databases and operating systems.

Session initiation , control & recording have been added in PS2

3) Oracle Mobile Security Suite (OMSS) -

This heavily leverages features and concepts from Oracle's Bitzer acquistion . This is a MAM (Mobile Application Management) solution.

• The onus is on application centric security as opposed to device centric security.
• Introduces a new concept called the Secure Mobile Workspace which containerizes all corporate applications with a single login .
• Builds on the BYOD concept where in employees can use their personal devices / phablets to access corporate apps/data.
• Fine grained policy control using Oracle Mobile Access/Admin Console with new features like geo-fencing , time-bound access to workspace etc.
• Enterprise wide Identity management solution is extended to mobile devices
• Oracle API Gateway (OAG) support for RESTful IdM services.
• DLP Support
• Core apps for Email, Calendar, Contacts, Tasks, Notes.

4) Oracle Mobile Authenticator

• Adds strong authentication features for SSO enabled apps
• Uses changing PIN every 30 seconds for registered apps
• Integration with OAM
• Available on Android and iOS

5) Improved & fully integrated OAuth 2.0 Support for authorization -client , server , 2 legged or 3 legged authorization.

6) Automated IdM Suite install

• 2 hours for single node  , 8 hours for 8 node HA cluster.
• Patching support
• Standard builds
• No additional license needed , feature is supposedly OTB using Wizards and components to be installed can be configured.

General 11gR2 IdM strategy from Oracle

To provide a unified Identity Management platform for Cloud , Enterprise and Mobile Applications.

Useful Links

https://blogs.oracle.com/OracleIDM/entry/major_themes_of_the_idm https://blogs.oracle.com/OracleIDM/entry/what_s_new_in_ps2 OMSS Webcast - http://medianetwork.oracle.com/video/player/3442504861001 Link to this webcast

P.S. Source of images Oracle Webcast , intention only to share the information.

Oracle Mobile Security Suite (OMSS)

Oracle launched OMSS on Feb 26th , 2014 and had a webcast few days back detailing its features. Here are few details - 

Overview -

Oracle Mobile Security Suite (OMSS) addresses the BYOD challenges by isolating corporate from personal data on consumers’ personal mobile devices without

needing to lockdown the entire device.

Oracle’s Mobile Security Container technology protects corporate apps and data and enables a Secure Enterprise Workspace that meets enterprise security

requirements without compromising user experience. It offers the most integrated solution with Windows® authentication and Oracle Access Manager

infrastructure for secure Single Sign-on (SSO) to corporate applications.

The entire solution includes -

1)A BYOD,employee-centric mobile security suite that separates personal apps from secure,“containerized” corporate

,“off-the-shelf” apps and data avoiding device lock-down.Containerized apps are Oracle and/or third -party enterprise

applications accessed by employees through the corporate network(intranet).

2) A consumer - centric mobile and social service that provides a software development kit (SDK) allowing corporate

developers to secure custom enterprise apps for Apple’s iOS and Google’s Android devices, bridging the gap between mobile devices,

social networks, and the enterprise’s backend identity management infrastructure.

Key Identifiers -

1)Comprehensive set of security policies providing strong authentication, encryption and DLP (Data Leak Prevention) controls .

2)Containerization (apps are containerized and only one time login into a container is needed).

2)Secure Enterprise Workspace which houses all the corporate apps.

3)Single Sign-on (SSO) with Integrated Windows Authentication (Kerberos and NTLM) and OAM authentication (Basic Auth and OAuth 2.0) 

4)AppTunnel that eliminates need for mobile VPN and protects from rogue apps.

5)Mobile Security Access Server is located in the DMZ which redirects unauthenticated requests to appropriate Oracle Mobile Security containers.

7)Mobile Security Admin Console for Locking , providing access , remote wipe of corporate container.

8)New and useful features like geo-fencing and time-fencing available in admin console.

9)Leverages the existing IDM Architecture - talks to Directory Services(OID/OUD/AD) , apps can be protected by OAM and/or OIF.

10)Container has OOTB apps like Secure Browser , Catalog , Mail Mgr etc.

11)OMSS can be deployed on Oracle Enterprise Linux or Microsoft Windows.

12)Android 4.x and above including 4.4/KitKat compatibility

13)The Oracle Mobile Security Suite components are distributed across the corporate DMZ and the enterprise intranet (or corporate network)

14)This is a mobile application management (MAM) solution which has various advantages over MDM(Mobile Device Mgmt) solutions like Airwatch

like separate container for coprporate apps , no requirement of device locking , data privacy etc.

Architecture - 

The recently rechristened Oracle MAF is tightly integrated with OMSS.

Useful Links -

OMSS Webcast	OMSS Whitepaper	OMSS Oracle Home Page	OMSS Data Sheet	Oracle Mobile & Social (packaged with OAM)	OMSS Linux Install	OMSS 3.0 new features

P.S. Source of images Oracle Webcast , intention only to share the information.