In this article we will demonstrate how an organization can take a role-based approach to automate provisioning and personalize a portal.
Any organization that implements a role-based platform for automated provisioning and a personalized portal must first implement an integrated identity-management platform to manage risk, protect sensitive information assets, and improve business performance. The provisioning platform pulls identities from a trusted source (often an HR system) and facilitates provisioning by automatically creating accounts on a target system.
The provisioning platform extracts user attributes, such as role and relationship data, from Oracle Role Manager through application programming interfaces (APIs).
The importance of role-based management is a relatively new component of Identity and Access Management (IAM) that is quickly gaining acceptance. Many organizations are adopting role-management technology to speed the provisioning process. An access management platform allows users of applications or IT systems to log in once and gain access to IT resources across the enterprise. To understand how these different components work together, let's review the architecture shown in Figure 2. When a new user is created in the authoritative identity source, a notification is sent to the provisioning platform. Roles, memberships, approvers, and provisioning attributes are calculated and passed back to the provisioning platform.
The provisioning platform creates, revokes, and modifies accounts on target enterprise applications.
The access management layer uses the LDAP directory to authenticate and authorize users requesting access to the portal layer.
Now that we have seen how a reference solution works, we can examine how Schneider National, a trucking company, automated employee on-boarding and personalized portal access to employees based on their roles. Schneider National, based in Green Bay, Wisconsin, is a multinational provider of transportation services and logistics solutions that recently updated its IAM solution.
In recent years, Schneider's homegrown provisioning solution proved unable to handle the growing compliance requirements and increasing complexity of the business environment. In an effort to correct the access rights, access requests were adjusted multiple times, which complicated accurate tracking of users' access rights.
Similarly, suspending access of terminated employees was a manual process that required managers to request termination. Schneider's existing solution also lacked a central authorized source for user profile attributes, and the company's target systems did not automatically sync user profile attributes. Lastly, Schneider struggled with inconsistent interfaces and applications for customers, truckers, and employees.
Schneider, with the guidance of PricewaterhouseCoopers, decided to address these deficiencies by replacing all legacy and home-grown solutions with packaged applications, part of a strategy to help reduce costs and standardize the IT infrastructure.
The company selected Oracle Identity Management Suite (Oracle Identity Manager, Oracle Role Manager, and Oracle Access Manager) and Oracle WebCenter Suite Spaces for its new infrastructure. Note: Oracle Role Manager has since been replaced with Oracle Identity Analytics 11g, which is now the strategic product for role administration and role lifecycle management. Oracle E-Business Suite Human Resources Management System (HRMS) is the authoritative source for user profiles.
The Oracle Identity Manager policy engine manages the fine-grained entitlements across managed applications, automating IT processes and enforcing security and compliance requirements such as segregation of duties. Oracle Role Manager enables business users to define user access by abstracting resources and entitlements as roles.
Oracle Internet Directory is one of the LDAP directories provisioned by Oracle Identity Manager.
Oracle Access Manager provides an identity-management and access-control system that is shared by all enterprise applications. Oracle WebCenter Suite Spaces is a ready-to-use social networking application that allows business users to quickly build individual and group work environments with a few clicks. For its consolidation platform, Schneider employed the Oracle WebLogic Server, which includes native integration for identity management components. Because the Oracle identity management components are integrated out of the box, Schneider didn't have to build its own modules and interfaces, which saved in development costs and implementation time. To understand how these pieces fit together, let's review how the technology fully automates Schneider's on-boarding process for new-hires. Schneider employs the Oracle iRecruitment application for finding, recruiting, and hiring new employees. Once the employee account is created, Oracle Identity Manager pulls user information from Oracle E-Business Suite at regular intervals to manage the user on other target systems as well as in its own repository.
Oracle E-Business Suite Employee Reconciliation Connector retrieves employee records from the Oracle E-Business Suite HR store and creates identities based on them in Oracle Identity Manager, using a process known as trusted source reconciliation.
Oracle Identity Manager also uses Oracle E-Business User Manager connector to create users on Oracle E-Business Suite and assign responsibilities based on their roles. In the event of employee termination, Oracle Identity Manager uses data from the HR system to determine the employee's last day of employment.
Schneider also configured Oracle Identity Manager to recertify all accounts from target applications on a regular interval. Oracle Role Manager acts as a supplier of role and role-grant information to Oracle Identity Manager, which in turn uses this information to provision various applications. Dynamic business roles in Oracle Role Manager automate role membership based on job codes (such as Executive Sales account in Figure 6) or other business relationships. Oracle Role Manager derives a user's access based on role membership, for example, US Employee Self Service (non-driver) in Figure 7, and automatically generates accounts on target applications, which can dramatically speed on-boarding of new employees. For personnel changes, such as promotions or reassignments, the HR system modifies the user profile to reflect the new job and, based on role definition, Oracle Role Manager instructs Oracle Identity Manager to automatically update the user's access rights and remove unneeded access privileges.
The Oracle Resource Profile within Oracle Identity Manager creates a user profile that defines the applications that each employee can access. Oracle Virtual Directory acts as a proxy between Oracle Access Manager and Oracle Internet Directory and provides real-time, virtual views of identity data from any data store, including directories, databases, and the Web.
Schneider used the Oracle WebCenter Suite Spaces module to build flexible, robust individual and group work environments. With its previous solution, the company's applications not only were dissimilar in interface, but they also required a separate Web browser session to run. Each Schneider employee has access to an individual portal based on user roles that provides access to appropriate applications and data. Based on the job responsibility assigned by HR in Oracle E-Business Suite, Oracle Role Manager assigns the proper business role to the user. Schneider adopted Oracle Internet Directory for its ability to seamlessly integrate with other Oracle products, including Oracle Access Manager, Oracle Collaborative Suite, Oracle E-Business Suite, and Oracle Enterprise Manager. The first time a user accesses Oracle WebCenter Suite Spaces without authentication, Oracle Access Manager requires the user to log in using single sign-on credentials. Schneider employee portals allow users to view and respond to e-mail and calendar events from a customized portal. For drivers, Schneider will build a portal that allows user access to individual information such as pay history, load history, and online training. The customer portals enable users to view individual data (invoices, proof-of-delivery documentation, and driver assignments, for instance) and perform tasks such as request a rate for a shipping order. The new suite of identity-management solutions enabled Schneider to achieve notable gains in efficiencies, which have had a positive impact on operating costs. The ability of Oracle Identity Manager to automatically remove terminated employees significantly improved Schneider's overall security posture, because the company no longer worries about being out of compliance due to orphaned accounts. Higher availability provided by Oracle Access Manager enables the company to run multiple instances to provide redundancy and efficiency. Finally, the implementation enables Schneider to quickly generate audit reports to determine user access rights for regulatory compliance reports. Schneider Transportation's out-of-date infrastructure couldn't keep pace with increasing demands for efficient on-boarding, identity management, certification, role management, and data sharing with business partners. The Oracle Identity Management products enable you to configure and manage the identities of users, devices, and services across diverse servers, to delegate administration of these identities, and to provide end users with self-service privileges. It is critical to configure high availability for the Oracle Identity Management products because other enterprise-level applications depend on them. This chapter discusses configuring the Identity Management products for high availability in an active-active configuration. Figure 7-1 shows the Oracle Fusion Middleware 11g Oracle Identity Management high availability architecture. An Oracle HTTP Server instance is installed on WEBHOST1, and an Oracle HTTP Server instance is installed on WEBHOST2. An Oracle Directory Services Manager instance and an Oracle Directory Integration Platform instance have been installed in the WLS_ODS1 Managed Server.
An Oracle Directory Services Manager instance and an Oracle Directory Integration Platform instance have been installed in the WLS_ODS2 Managed Server.
This Oracle Identity Federation instance and the one in the WLS_OIF1 Managed Server on IDMHOST1 are configured as the CLUSTER_OIF cluster.
On OIDHOST1, an Oracle Internet Directory instance and an Oracle Virtual Directory instance have been installed.
On OIDHOST2, an Oracle Internet Directory instance and an Oracle Virtual Directory instance have been installed.
The Oracle Internet Directory instances on OIDHOST1 and OIDHOST2 have been configured as a cluster. It is possible to configure 10g Oracle Single Sign-On and 10g Delegated Administration Services with 11g Oracle Internet Directory.
Table 7-1 summarizes the Oracle Identity Management products that you can install using the suite-level installation program for 11g.
Oracle Internet Directory is an LDAP Version 3-enabled service that enables fast retrieval and centralized management of information about dispersed users, network configuration, and other resources. Oracle Virtual Directory is an LDAP Version 3-enabled service that provides an abstracted view of one or more enterprise data sources.
Oracle Virtual Directory consolidates multiple data sources into a single directory view, enabling you to integrate LDAP-aware applications with diverse directory server data stores. The Oracle Directory Integration Platform is a J2EE application that enables you to synchronize data between various directories and Oracle Internet Directory. Oracle Identity Federation enables companies to provide services and share identities across their respective security domains, while providing protection from unauthorized access.
Oracle Directory Services Manager is a unified graphical user interface (GUI) for Oracle Virtual Directory and Oracle Internet Directory. Oracle Directory Services Manager is available from either the Oracle Enterprise Manager Fusion Middleware Control or from its own URL. This section describes the prerequisite steps that must be completed before setting up an Oracle Identity Management high availability configuration. This section provides links to instructions for installing and configuring a database repository. For 10g Release 2 (10.2), see the Oracle Database Oracle Clusterware and Oracle Real Application Clusters Installation Guide. For 10g Release 2 (10.2), see Oracle Database Oracle Clusterware and Oracle Real Application Clusters Installation Guide. When you run the installer, select the Configure Automatic Storage Management option in the Select Configuration page to create a separate Automatic Storage Management home.
Many of the Oracle Fusion Middleware components require the existence of schemas in a database prior to installation.
See the next section for information on using RCU to load the Oracle Identity Management schemas into a RAC database repository. The Repository Creation Utility (RCU) ships on its own CD as part of the Oracle Fusion Middleware 11g kit.
Before you install any of the Oracle Identity Management components described in this chapter, run RCU to create the schemas used by Oracle Identity Management and Management Services into a RAC database. If you will be installing Oracle Identity Federation, you must also run RCU to create the schemas used by Oracle Identity Federation into a RAC database. When you install an Oracle Fusion Middleware product, RCU is installed in the Oracle home directory for that product and you will then be able to run RCU from that Oracle home. For addition information about running and installing RCU, see Oracle Fusion Middleware Installation Planning Guide and Oracle Fusion Middleware Repository Creation Utility User's Guide.
This section describes how to configure the database for Oracle Fusion Middleware 11g metadata.
The value of the static PROCESSES initialization parameter must be 500 or greater for Oracle Internet Directory. The method that you use to change a parameter's value depends on whether the parameter is static or dynamic, and on whether your database uses a parameter file or a server parameter file. Oracle recommends using the Oracle Enterprise Manager Cluster Managed Services Page to create database services that client applications will use to connect to the database.
You can also use SQL*Plus to configure your RAC database to automate failover for Oracle Internet Directory using the following instructions. The EXECUTE DBMS_SERVICE command above must be entered on a single line to execute properly. For more information about the SRVCTL command, see the Oracle Real Application Clusters Administration and Deployment Guide. If you already have a service created in the database, make sure that it is enabled for high availability notifications and configured with the proper server-side Transparent Application Failover (TAF) settings.
This section describes how to validate the Transparent Application Failover (TAF) configuration settings made earlier. This section describes the network prerequisites for deploying an Oracle Identity Management high availability environment. All components in the Oracle Identity Management software stack require a hardware load balancer when deployed in a high availability configuration. The load balancer must be able to detect service and node failures (through notification or some other means) and to stop directing non-Oracle Net traffic to the failed node.
It is highly recommended that you configure the load balancer to be in fault-tolerant mode.
It is highly recommended that you configure the load balancer virtual server to return immediately to the calling client when the back-end services to which it forwards traffic are unavailable. Table 7-3 shows the virtual server names to use for the external load balancer in the Oracle Identity Management high availability environment. This section describes the virtual server names that should be set up for the high availability deployments described in this chapter. This virtual server acts as the access point for all LDAP traffic to the Oracle Internet Directory servers in the directory tier. Oracle recommends that you configure the same LDAP port for SSL connections on the virtual server and on the computers on which Oracle Internet Directory is installed. This is a requirement for most 10g Oracle Fusion Middleware products that need to use Oracle Internet Directory via the load balancer.
This virtual server acts as the access point for all LDAP traffic to the Oracle Virtual Directory servers in the directory tier. This virtual server acts as the access point for all HTTP traffic to the Oracle Identity Federation servers in the application tier. Monitor the heartbeat of the Oracle Internet Federation Server processes on OIFHOST1 and OIFHOST2.
This virtual server acts as the access point for all internal HTTP traffic that gets directed to the administration services. In addition, ensure that the virtual server names are associated with IP addresses and are part of your Domain Name System (DNS). This section provides an introduction to Oracle Internet Directory and describes how to design and deploy a high availability environment for Oracle Internet Directory. Oracle Internet Directory is an LDAP store that can be used by Oracle components such as Directory Integration Platform, Oracle Directory Services Manager, JPS, and also by non-Oracle components.
The Oracle directory replication server uses LDAP to communicate with an Oracle directory (LDAP) server instance. An Oracle Internet Directory node consists of one or more directory server instances connected to the same directory store.


Figure 7-2 shows the various directory server elements and their relationships running on a single node. The Oracle directory server instance and the Oracle directory replication server connect to OID Monitor by way of the operating system.
Also called a replication server, it tracks and sends changes to replication servers in another Oracle Internet Directory system.
For more information about Oracle Internet Directory replication, refer to Chapter 8, "Configuring Identity Management for Maximum High Availability.".
OIDMON also monitors servers and restarts them if they have stopped running for abnormal reasons. OID Monitor checks the state of the servers through mechanisms provided by the operating system.
Communicates with OID Monitor by placing message data in Oracle Internet Directory server tables.
Oracle Internet Directory, which is Oracle's LDAP store, is a C-based component that uses a database as its persistence store.
OIDMON: OIDMON is responsible for the process control of an Oracle Internet Directory instance. Replication server process: This is a process within Oracle Internet Directory that runs only when replication is configured. OPMN: The Oracle Process Manager and Notification Server (OPMN) is a daemon process that monitors Oracle Fusion Middleware components, including Oracle Internet Directory. Oracle Internet Directory process information is maintained in the ODS_PROCESS_STATUS table in the ODS database user schema.
An Oracle Internet Directory instance can be started and stopped using the Oracle Enterprise Manager Fusion Middleware Control or the command opmnctl.
Upon receiving the start command, OPMN issues an oidmon start command with appropriate arguments, as specified in the opmn.xml file. When you start OIDMON through OPMN, OPMN starts OIDMON and ensures that OIDMON is up and running. OIDMON monitors the status of the Oracle Internet Directory dispatcher process, LDAP server processes, and replication server process and makes this status available to OPMN and Oracle Enterprise Manager Fusion Middleware Control.
Once the Oracle Internet Directory process starts up, clients access Oracle Internet Directory using the LDAP or LDAPS protocol.
The Oracle Internet Directory dispatcher process sends the LDAP connections to the Oracle Internet Directory server process in a round robin fashion. Database connections from each server process are spawned at server startup time, depending on the value set for the instance configuration parameters ORCLMAXCC and ORCLPLUGINWORKERS.
Oracle Internet Directory uses an Oracle database to store configuration information as well as data. Table 7-5 shows Oracle Internet Directory processes and the log file name and location for the process.
This section provides conceptual information about using Oracle Internet Directory in a high availability two-node Cluster Configuration. Figure 7-3 shows the Oracle Internet Directory Cluster Configuration high availability architecture in an active-active configuration. Figure 7-3 shows Oracle Internet Directory in the directory tier in a Cluster Configuration high availability architecture. Transparent Application Failover (TAF) is used to connect the Oracle Internet Directory instances with the RAC database that serves as the security metadata repository.
In the Cluster Configuration, OPMN commands are used to start each Oracle Internet Directory instance. When the cluster is stopped using OPMN, Oracle Internet Directory disconnects from the database and the Oracle Internet Directory server stops. Configuration changes can be done at a cluster level to any instance in the Cluster Configuration. Oracle Internet Directory server configuration aspects such as the number of servers, database connections, sizelimit, and timelimit are part of the instance-specific server configuration entry.
On the other hand, if you chooses to have a common set of server configuration attributes for both Oracle Internet Directory instances in the cluster, then you should choose the same Oracle Internet Directory component name for both Oracle Internet Directory instances, for example, oid1 on both Oracle Internet Directory node1 and node2. Oracle Internet Directory LDAP server instances cache certain LDAP metadata artifacts such as Schema, ACLs, and Password Policy. Oracle Internet Directory also caches metadata and metadata changes trigger notification across the nodes.
This section discusses protection from different types of failure in an Oracle Internet Directory Cluster Configuration. If an Oracle Internet Directory process cannot be restarted, then the front-ending load balancing router detects failure of Oracle Internet Directory instances in the Cluster Configuration and routes LDAP traffic to surviving instances.
If an Oracle Internet Directory instance in the Cluster Configuration gets hung, the load balancing router detects this and routes requests to surviving instances. If one of the Oracle Internet Directory instances in the two-node Cluster Configuration fails (or if one of the computers hosting an instance fails), the load balancing router routes clients to the surviving Oracle Internet Directory instance.
Oracle Internet Directory server failure is usually transparent to Oracle Internet Directory clients as they continue to get routed through the load balancer. In Oracle Internet Directory active-active configurations, if you are doing ldapadd operations through the LDIF file at the time of failover, your operation would fail even if you are doing this operation through a load balancer host and port.
This section describes the protection available for Oracle Internet Directory from database failure. By default, the tnsnames.ora file configured in Oracle Internet Directory's ORACLE_INSTANCE ensures that Oracle Internet Directory's connections to the database are load balanced between the RAC database instances. Oracle Internet Directory uses database high availability event notification to detect database node failure and to fail over to a surviving node. If Transparent Application Failover (TAF) is configured, then upon a database instance failure, Oracle Internet Directory will fail over its database connections to the surviving database instance, which enables the LDAP search operations that were in progress during the failover to be continued.
If both Transparent Application Failover (TAF) and high availability event notification are configured, Transparent Application Failover (TAF) is used for failover and high availability event notifications are used only for logging the events.
Oracle Internet Directory also has a mechanism to detect stale database connections, which allows Oracle Internet Directory to reconnect to the database.
If none of the database instances are available for a prolonged period, then the Oracle Internet Directory LDAP and REPL processes will automatically be shut down. While all the database instances are down, OIDMON will continue to be up and an opmnctl status command will show that OIDLDAPD instances are down. All database failover induced activity for Oracle Internet Directory is recorded in the OIDMON log file. This section describes prerequisites for setting up the Oracle Internet Directory high availability architecture. Before setting up Oracle Internet Directory in a high availability environment, you must ensure that the time on the individual Oracle Internet Directory nodes is synchronized. Synchronize the time on all nodes using Greenwich Mean Time so that there is a discrepancy of no more than 250 seconds between them. If OID Monitor detects a time discrepancy of more than 250 seconds between the two nodes, the OID Monitor on the node that is behind stops all servers on its node. Before you can install the Oracle Internet Directory instances on OIDHOST1 and OIDHOST2, you must use the Repository Creation Utility (RCU) to create the collection of schemas used by Oracle Identity Management and Management Services.
On the Create Repository screen, select the Create operation to load component schemas into an existing database.
On the Schema Passwords screen, enter the passwords for the main and additional (auxiliary) schema users.
When Oracle Internet Directory is deployed in a high availability configuration, it is recommended to use an external load balancer to front-end the Oracle Internet Directory instances and load balance requests between the various Oracle Internet Directory instances.
Oracle Internet Directory can be deployed in a highly availability configuration either in a standalone mode or as a part of a WebLogic Server domain.
The standalone mode should be chosen for deployments where Oracle Internet Directory will be managed entirely using command line tools, and where Oracle Enterprise Manager Fusion Middleware Control and Oracle Directory Services Manager are not deemed mandatory. It is recommended that Oracle Internet Directory be set up in a clustered deployment, where the clustered Oracle Internet Directory instances access the same RAC database repository. This section describes the steps to deploy Oracle Internet Directory without a WebLogic Server domain.
Ensure that ports 389 and 636 are not in use by any service on the computer by issuing these commands for the operating system you are using. If the port is in use (if the command returns output identifying the port), you must free the port. On the Specify Inventory Directory screen, enter values for the Oracle Inventory Directory and the Operating System Group Name. This sets the required permissions for the Oracle Inventory Directory and then brings up the Welcome screen. The Oracle Inventory screen is not shown if an Oracle product was previously installed on the host. Ensure that the Oracle Home Location directory path for OIDHOST1 is the same as the Oracle Home Location path for OIDHOST2. Check the checkbox next to the I wish to receive security updates via My Oracle Support field.
On the Configure Components screen, select Oracle Internet Directory, deselect all the other components, and click Next. On the Configure Ports screen, select Specify Ports Using Configuration File and enter the filename for the staticports.ini file that you copied to the temporary directory. Any incorrect information entered in the RAC database connect string has to be corrected manually after the installation. On the Create Oracle Internet Directory screen, specify the Realm and enter the Administrator (cn=orcladmin) password and click Next.
On the Installation Summary screen, review the selections to ensure that they are correct (if they are not, click Back to modify selections on previous screens), and click Install. On the Installation Progress screen on UNIX systems, a dialog box appears that prompts you to run the oracleRoot.sh script.
On the Configuration screen, multiple configuration assistants are launched in succession; this process can be lengthy. When you perform an Oracle Internet Directory installation using Oracle Identity Management 11g installer, the default component name that the installer assigns to the Oracle Internet Directory instance is oid1. The instance-specific configuration entry for this Oracle Internet Directory instance is cn=oid1, cn=osdldapd, cn=subconfigsubentry. If you perform a second Oracle Internet Directory installation on another computer and that Oracle Internet Directory instance uses the same database as the first instance, the installer detects the previously installed Oracle Internet Directory instance on the other computer using the same Oracle database, so it gives the second Oracle Internet Directory instance a component name of oid2.
The instance-specific configuration entry for the second Oracle Internet Directory instance is cn=oid2, cn=osdldapd, cn=subconfigsubentry.
If a third Oracle Internet Directory installation is performed on another computer and that instance uses the same database as the first two instances, the installer gives the third Oracle Internet Directory instance a component name of oid3, and so on for additional instances on different hosts that use the same database. Note that the shared configuration for all Oracle Internet Directory instances is cn=dsaconfig, cn=configsets,cn=oracle internet directory.
This naming scheme helps alleviate confusion when you view your domain using Oracle Enterprise Manager by giving different component names to your Oracle Internet Directory instances. The instructions in this section can also be used to scale out Oracle Internet Directory in your 11g Oracle Identity Management high availability configuration. Ensure that the Oracle Home Location directory path for OIDHOST2 is the same as the Oracle Home Location directory path for OIDHOST1. On the Specify Schema Database screen, select Use Existing Schema and specify the following values. On the Specify OID Administrator Password screen, specify the OID Administrator password and click Next.
If you want to manage an Oracle Internet Directory component with Oracle Enterprise Manager Fusion Middleware Control, you must register the component and the Oracle Fusion Middleware instance that contains it with an Oracle WebLogic Server domain.
Before using the opmnctl registerinstance command to register an Oracle Internet Directory instance with an Oracle WebLogic Server domain, make sure that the WebLogic Server is already installed.
Slideshare uses cookies to improve functionality and performance, and to provide you with relevant advertising. But as IT enterprises grow more complex with new systems, interfaces, and applications, it becomes increasingly challenging to control and monitor who can access what IT resources.
Unauthorized users could gain access to IT resources and wreak havoc on applications and data. First is in the process of how a user is provisioned (or de-provisioned) when the user joins (or leaves) the organization. Unauthorized end users also could gain access to the company's intranet (or extranet) portal, exposing sensitive data. Application protocols such as LDAP directories lack the architectural flexibility to capture and maintain detailed information about people and complex organizational relationships. We will review how a reference architecture is built using portal, role manager, and provisioning tools.
An identity management suite also can be used to integrate information portals, providing a sophisticated solution for access management, provisioning, and role management. It is responsible for synchronizing user data between the HR system and target systems where there are changes to user data, such as new-hires, job role changes, or employee termination. The provisioning platform maintains a comprehensive, time-stamped audit trail of all user-provisioning activities. Based on 2009 field research, for instance, the Burton Group highlighted the importance of role management, stating that role-based initiatives benefit a business by improving compliance and reducing risk and expenses associated with excessive privileges. Role management organizes user-access rights based on similar responsibilities across the enterprise. This allows the organization to create a centralized and automated single sign-on (SSO) solution for managing who has access to what information across the IT infrastructure. One of the accounts provisioned is an LDAP directory that stores user identities in groups based on their roles. The 75-year-old company and its wholly owned subsidiaries employ a complex IT infrastructure that supports a range of user types, including employees, associates, customers, and vendors. The existing solution could centrally manage accounts on multiple target systems, but it required considerable IT resources to manage connectivity with the target systems. The confusion led to delays in assigning access rights to new-hires and internal transfers, which resulted in a loss of productivity. Suspended accounts were not automatically registered in the system, however, which impeded the security team's efforts to provide accurate internal audits of active accounts. Accordingly, Schneider's security team often did not know which user had access to what applications. The company's applications not only were dissimilar in interface, but also required a separate Web browser session to run. Schneider chose Oracle Identity Manager, in particular, for its off-the-shelf connectors and ability to automatically manage accounts on various target systems. Oracle Identity Analytics 11g contains a superset of the features in Oracle Role Manager 10g, but adds comprehensive support for access certification and identity audit. The human resources team was charged with accurately entering user-related information for existing employees in the HRMS. Oracle Identity Manager records data from the Oracle E-Business Suite HRMS system and sends data to Oracle Role Manager.
Oracle Internet Directory groups are created by Oracle Identity Manager based on Oracle Role Manager roles and user-role assignments. The result is a centralized and automated single sign-on solution for managing who has access to what information across the entire IT infrastructure. Schneider uses Oracle WebCenter Suite Spaces to provide a collaborative environment for its employees.
Using a self-service Web interface, a job applicant creates an account and enters personal information to apply for the position. Using Oracle E-Business Suite integration with Oracle Identity Manager, Schneider electronically enrolled 100% of its employees during the annual benefit enrollment, which saved significant costs because employees did not have to print, distribute, and process paper-based forms. On the last working day, the Oracle Identity Manager system automatically removes the user's access from all target systems. This enabled the company to detect all orphaned accounts on all target systems and override any changes made directly on the target systems.


When Oracle Role Manager is deployed with Oracle Identity Manager, the integration between components is bundled and preconfigured. Using out-of-the-box connection tools, Schneider's IT team configured Oracle Identity Manager to manage automatic provisioning on Oracle E-Business Suite, Siebel, Oracle Internet Directory, Microsoft Active Directory, Microsoft Exchange 2007, and Oracle Database. The company employed the functionality and flexibility of Oracle WebCenter Suite Spaces to create portals for its employees, and it plans to implement portals for customers and all truck drivers next year. The new employee portals require only one browser session and enable users to more quickly and efficiently complete tasks. Using this business role, Oracle Identity Manager automatically creates a user account on Oracle Internet Directory and assigns proper group membership.
Schneider uses Oracle Internet Directory as a scalable directory to store identity and meta-data information for Oracle Access Manager and Oracle WebCenter Suite Spaces.
After login, Oracle Access Manager pulls user credentials from Oracle Internet Directory and, based on the access policy, allows or rejects access to Oracle WebCenter Suite Spaces.
Schneider also is considering adding dashboards that will provide real-time information and metrics, based on the user's role or department. Using this solution, the company reduced the total time of on-boarding from several days to 24 hours. Since implementing the new system, Schneider has experienced less downtime due to system outages, which has boosted productivity. For instance, the company streamlined payroll because it can now handle checks electronically. The company implemented a scalable system based on the Oracle Identity Management Suite to standardize its technology and incorporate effective identity and access management with role-based access control.
These products also enable you to configure single sign-on across applications and to process users' credentials to ensure that only users with valid credentials can log into and access online resources.
If the Oracle Identity Management products fail, applications depending on them will also fail. A load balancing router routes requests to the Oracle HTTP Server instances on WEBHOST1 and WEBHOST2.
The RAC database has been configured in a JDBC multi data source to protect the instances from RAC node failure.
The RAC database has been configured in a JDBC multi data source to protect the instance from RAC node failure.
Transparent Application Failover (TAF) is used to connect the Oracle Internet Directory instance with the RAC database that serves as the security metadata repository. The Oracle Virtual Directory instances on OIDHOST1 and OIDHOST2 have also been configured as a cluster. Oracle Directory Integration Platform includes services and interfaces that allow you to deploy synchronization solutions with other enterprise repositories. Oracle Directory Services Manager simplifies the administration and configuration of Oracle Virtual Directory and Oracle Internet Directory by allowing you to use web-based forms and templates. Oracle Fusion Middleware provides a tool, the Repository Creation Utility (RCU), to create the component schemas in an existing database. This is a required step before you install the Oracle Identity Management components that are used in the high availability configurations described in this chapter.
These schemas are required for the high availability Oracle Identity Management configurations described in this chapter. See the Oracle Database Administrator's Guide for details on parameter files, server parameter files, and how to change parameter values. For complete instructions on creating database services, see the chapter on Workload Management in the Oracle Real Application Clusters Administration and Deployment Guide.
For each virtual server, the load balancer should allow configuration of traffic management on more than one port. If an Oracle Internet Directory process stops on OIDHOST1 or OIDHOST2, or if either host OIDHOST1 or OIDHOST2 is down, the load balancer must continue to route the LDAP traffic to the surviving computer. If an Oracle Virtual Directory process stops on OVDHOST1 or OVDHOST2, or if either host OVDHOST1 or OVDHOST2 is down, the load balancer must continue to route the LDAP traffic to the surviving computer. If an Oracle Internet Federation Server process stops on OIFHOST1 or OIFHOST2, or if either host OIFHOST1 or OIFHOST2 is down, the load balancer must continue to route traffic to the surviving computer.
The computers on which Oracle Fusion Middleware is running must be able to resolve these virtual server names. There can be more than one directory server instance on a node, listening on different ports. When you invoke process management commands, such as oidctl or opmnctl, or when you use Fusion Middleware Control to start or stop server instances, your commands are interpreted by this process. If the default instance of OIDLDAPD is stopped using the OIDCTL command, then OIDMON stops the instance.
This message data includes configuration parameters required to run each Oracle directory server instance. It is a stateless process and stores all of the data and the majority of its configuration information in the back-end database. Oracle Enterprise Manager Fusion Middleware Control uses OPMN to stop or start instances of Oracle Internet Directory. OIDMON reads the contents of the table at a specified interval and acts upon the intent conveyed by the contents of that table.
There is no impact on other running instances when an Oracle Internet Directory instance starts up. The number of server processes is controlled by the orclserverprocs attribute in the instance-specific configuration entry. The number of database connections spawned by each server equals ORCLMAXCC + ORCLPLUGINWORKERS + 2.
All the nodes in the Cluster Configuration that share the same database read the same configuration information.
In this case, the configuration entries will be cn=oid1,cn=osdldapd,cn=subconfigsubentry and cn=oid2,cn=osdldapd,cn=subconfigsubentry respectively and they need to be updated separately for each Oracle Internet Directory instance.
In this case, there will be one common configuration entry cn=oid1,cn=osdldapd,cn=subconfigsubentry. Multiple Oracle Internet Directory LDAP server processes on a given node keep their caches in sync via semantics built around a shared memory segment managed by Oracle Internet Directory on each node. External load balancers are typically configured to perform a health check of Oracle Internet Directory processes.
For example, if an Oracle Internet Directory instance establishes four database connections, two connections are made to each database instance. However, OIDMON and OPMN will continue to ping for the database instance availability and when the database becomes available, the Oracle Internet Directory processes (LDAP and REPL) are automatically restarted by OIDMON. When a database instance becomes available, OIDMON will restart all configured Oracle Internet Directory instances.
For example, assume that there are three nodes, where the first node is 150 seconds ahead of the second node, and the second node is 150 seconds ahead of the third node.
Later, if desired, the standalone Oracle Internet Directory instances can be registered with a remote Oracle WebLogic Server domain using opmnctl commands.
These are listed in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management in the Oracle Fusion Middleware documentation library for the platform and version you are using. Specifically, the correct host, port, and instance name must be provided for each RAC instance, and the service name provided must be configured for all the specified RAC instances.
Any change of properties in the entry cn=oid2, cn=osdldapd, cn=subconfigsubentry will not affect the first instance (oid1).
The ODS schema chosen is already being used by the existing Oracle Internet Directory instance. You can register an Oracle Fusion Middleware instance with a WebLogic domain during installation or Oracle instance creation, but you are not required to do so.
If the provisioning process is not automated, new-hires could spend numerous unproductive hours or days waiting to get access to key applications and resources. An LDAP directory could capture that Jean is a manager, for instance, but it cannot know details such as her business role, who she manages, or what applications she should have access to according to her business role. We will then explore how Schneider National, a multinational trucking company, successfully automated employee on-boarding and personalized its intranet portal using Oracle Identity Management Suite (Oracle Identity Manager, Oracle Role Manager, and Oracle Access Manager) and the Oracle WebCenter Suite Spaces feature.
When a user is removed from a role and no longer requires access, the provisioning platform automatically deletes the user privileges from the target system.
For instance, a company might formalize job codes or responsibilities into particular roles that carry their own specific system-access rights and security levels. Although Schneider is not a publicly traded company, internal directives require that it adhere to compliance standards, such as Sarbanes-Oxley.
Over time, the security team discovered the system was granting more access than the user required, which put the company in danger of compliance violations.
The combination of Oracle Identity Analytics and Oracle Identity Manager delivers a powerful, flexible solution for enterprise identity administration and governance. Oracle Role Manager then provides access policy membership for the user to Oracle Identity Manager.
Oracle Access Manager leverages Oracle Internet Directory to authenticate and authorize users for Oracle WebCenter Suite Spaces. When a candidate is hired, the personal data from the application is flowed into the Oracle E-Business Suite system and becomes the new-hire's personnel data. For forced terminations, Schneider has established an emergency team that can remove the user account directly from Oracle Identity Manager. Schneider also leveraged Oracle Identity Manager to manage and synchronize passwords on all target systems, and Schneider employed the self-service password-reset functionality in Oracle Identity Manager to provide self-service capability to end users. The company also configured Oracle Identity Manager to manage users on other target systems by leveraging the Oracle Identity Manager adapter factory to enable Java-based integration with other target systems. Oracle WebCenter Suite Spaces has enabled Schneider to build a portal that combines various applications into one interface with a common look and feel. This resulted in significant cost savings and efficiencies because new-hires are able to start work on day one. Similarly, 100 percent of its employees now fill out benefits enrollment online, obviating the need to mail and process paper forms.
Oracle WebCenter Suite Spaces enabled Schneider to easily create portals for employees (and soon, for all truckers and business partners) for streamlined and secure access to its system, resulting in a solution set that can easily mature and grow with the business. You will make this Administration Server active if the Administration Server on IDMHOST1 becomes unavailable. It can also be used to provide Oracle Internet Directory interoperability with third party metadirectory solutions.
For high availability environments, these schemas must be created and loaded into a Real Application Clusters (RAC) database. For example, for Oracle Internet Directory clusters, the load balancer needs to be configured with a virtual server and ports for LDAP and LDAPS traffic. Oracle Directory Services Manager and the command-line tools communicate with the Oracle directory servers over LDAP.
During startup OIDMON spawns the OIDLDAPD dispatcher process and the replication server process, if replication is configured for the instance.
If you stop or start Oracle Internet Directory components from the command line, you use opmnctl, the command-line interface to OPMN.
The interval is controlled by the value of the sleep command line argument used at OIDMON startup, and the default value is 10 seconds. The Oracle Internet Directory server processes communicate with the Oracle database server through Oracle Net Services. The load balancing router routes LDAP client requests to the two Oracle Internet Directory instances that are clustered on OIDHOST1 and OIDHOST2.
High availability event notification is used for notification when a RAC instance becomes unavailable.
The OIDMON process polls for configuration changes on each Oracle Internet Directory server and updates the database repository about configuration changes. OIDMON keeps these caches in sync across nodes by ensuring that these shared memory segments are in sync across the nodes, which is achieved using the Oracle Internet Directory database.
The Oracle Internet Directory server that gets the ldapmodify request for the metadata change notifies other Oracle Internet Directory servers about the change of metadata (including OIDMON). If the instance fails in the middle of a transaction, the transaction is not committed to the database.
If a request is received before the load balancer detects process unavailability, clients application could receive a error.
For most applications, this will not be an issue because most applications have the ability to retry the connection a fixed number of times.
The OID Monitor automatically detects the change in the system time and starts the Oracle Internet Directory servers on its node. In this case, the third node is 300 seconds behind the first node, so the OID Monitor will not start the servers on the third node until the time is synchronized. Oracle Enterprise Manager Fusion Middleware Control and Oracle Directory Services Manager can be used to manage Oracle Internet Directory instances that are configured with an Oracle WebLogic Server domain. Therefore, ensure that ports 389 and 636 are not in use by any service on OIDHOST2 by issuing these commands for the operating system you are using. Therefore, the new Oracle Internet Directory instance being configured would reuse the same schema. If an Oracle Fusion Middleware instance was not previously registered with a WebLogic domain, you can register it by using opmnctl registerinstance. On the other hand, if users are not de-provisioned accurately, they could gain unauthorized access to applications and data after they leave the company, posing a serious security risk.
This is why the business context of a user is critical when automating provisioning or building a portal. Oracle Role Manager acts as a supplier of role and role grant information to Oracle Identity Manager, which in turn uses this information to provision various applications. When user accounts are removed from Oracle Identity Manager, Oracle Identity Manager then automatically removes all target system accounts attached to the deleted user.
The new system enables Schneider to manage employees across the role lifecycle in a centralized, automated repository.
The services accessed on this virtual host include the WebLogic Administration Server Console, Oracle Enterprise Manager and Oracle Directory Services Manager.
If there are multiple instances of Oracle Internet Directory that use the same database, only one of them can be running replication. For details, refer to Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory. Multiple server processes enable Oracle Internet Directory to take advantage of multiple processor systems. OIDMON and other Oracle Internet Directory servers pull the changes from the database repository. When the failed instance comes up again, the load balancing router detects this and routes requests to all the instances. If the client application performs a retry, the load balancer should route it to a healthy Oracle Internet Directory instance and the request should be successful. Oracle Identity Manager pushes these changes to the role manager, which derives user role membership and access information based on the user profile sent from the trusted resource.
For more information, refer to Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory. In this way, any change made at a cluster member level is propagated to every Oracle Internet Directory server in the cluster. The provisioning platform and role manager should work in tandem to ensure that provisioning events are based on roles. The number of server processes spawned for an instance is controlled by the orclserverprocs attribute.



Coaches corner duncan
Leadership education store
Create master page in sharepoint 2013 designer
Organizational skills for 12 year olds


Comments to Oracle identity management certification 11g

H_A_C_L_I

25.08.2014 at 14:32:46

With this one, and if you want to recognize The Law of Attraction tactics must moderate the.

SHCWARZKOPF

25.08.2014 at 15:46:43

Magazine 15 June 2015 (Travel regulations on mentoring is noted and.