Roll back/Revert a published Sandbox in OIM 11GR2

Reverting a Published Sandbox in OIM 11g R2

So many times, you would like to roll back the changes made by a published sandbox. Once published, there is no option available in OIM admin or identity interface to roll back the published sandbox. However, starting 11GR2, you could roll back the published sandbox through Enterprises Manager interface.

1. Login to Enterprise Manager(EM Console).

2> Enter into MDS schema by clicking “Identity and Access” à OIM à oim(11.1.2…..)

3> Start MBean Browser

4> Goto oracle.mds.lcm à Server: oim_server1 à Application: oracle.iam.console.identity.self-service.ear à MDSAppRuntime à MDSAppRuntime

5> On the right side, click the “listMetadataLabels”. There are 2 of them, choose the one that does not require parameter.

6> For each sandbox there will be 3 entrees, creation_<sandbox>…., pre_<sandbox>…., and post_<sandbox>…. . To go back to the oim status before the sandbox was created ( roll back the sandbox), copy the name of the SB starting with creation…..example Creation_OIM_testbox_10:30:00 . Copy the name

7> Click on “Return” to go to previous page (Operations).

Find the operation “promoteMetadataLabel”. There are 2 of them, use the one that takes one parameter only.

8> Paste the sandbax name you copied (Creation_OIM_testbox_10:30:00).

9> Click “Invoke.

10> Restart the OIM

Have fun....

Offloading webgate SSL to a load balancer

A very common configuration for webservers is to proxy it behind a load balancer. More often than not, the ssl terminates at load balancer. This means that from load balancer to web server, traffic is in OPEN TEXT mode. This allows organization to be able use IDS/IPS to monitor the internal traffic.

 

The webgate is installed on web server, when webgate receives the traffic, it sees it in OPEN TEXT mode. So, it sends back the respond to forward to the next url in OPEN mode (http://<hostname>:<port>/obrar.cgi). Since load balancer is listening for https only, this url never reaches anywhere.

There are 2 possible ways to resolve it:

1>      Create a forwarder on load balance that will forward all the http traffic to https on the same load balancer. This solution is not preferred by many organization as they do not want any unsecure port on the internet facing load balancer.

2>    Set the header variable IS_SSL to the value “ssl” on the load balancer. Webgate looks for this attribute to find out if original traffic was in secured mode. If value is set to “ssl”, the resond will include “HTTPS” instead of “HTTP”.

Have fun….

Setting up OAM WebGate behind a Load Balancer that does context based routing

Setting up a OAM webgate behind a load balancer could pose routing issue. For example, if there is a load balancer doing a context based routing as below:

http://<hostname>:<port>/protect mapped to the backend web server http://<webserver>:<port>/protect

The problem starts when traffic is intercepted by webgate, OAM authentication is successful and OAM tries to set the cookie information to web server using the url that looks like:

http://<hostname>:<port>/obrar.cgi......

This url will not make to the backend web server because there is no context to route this traffic. The traffic dies at the load balancer and an error message is displayed in the browser.

To resolve, create a new context on the load balancer that will send the return traffic from OAM server to web server.

http://<hostname>:<port>/obrar.cgi  map to http://<webserver>:<port>/obrar.cgi

Access the webserver now, after authentication, it will take to the resource successfully.

Have fun…

Set the OID log level

Product: Oracle Internet Directory 11g

Starting 11g release OID has moved the orcldebugflag from 'root-DSE' to instance level. That means, now it is possible to set the log level at the instance level instead of system wide.

This blog describes how to set the log level using, either Enterprise Manager or using ldapmodify.

Method 1: Using Enterprise Manager Console

1> Open the Enterprises manager
2> On the left frame à click "Identity and Access"  à oid1
3> On the right side drop down, select, Oracle Internet Directory à Administration  à Server Properties

4> Click the logging page.

All the logging options will be displayed.

5> Select the desired level, click "Apply"

Method 2: Using command line

Set the logging parameter, "ORCLDEBUGFLAG" to the desired level.

1> Create a ldif file that sets the two attributes

    ORCLDEBUGOP: for setting up the operation to be recorded. It is a cumulative number based on the table below.

Debug Operation Number	Operation to be recorded
1	ldapbind
2	ldapunbind
4	ldapadd
8	ldapdelete
16	ldapmodify
32	ldapmodrdn
64	ldapcompare
128	ldapsearch
256	ldapabandon
511	All LDAP operations

If bind, add, delete and modify is to be recorded, set the orcldebugop to 1 + 4 + 8 + 16 = 29

    ORCLDEBUGFLAG: for setting up log level. Use the following table to select the appropriate value.

256:          Connection management, related to network activities
512:          Search filter processing
1024:         Entry parsing
2048:         Configuration file processing
8192:         Access control list processing
491520:      Log of communication with the back end - that is with the database
524288:      Schema related operations
4194304:     Replication specific operations
8388608:     Log of entries, operations and results for each connection
16777216:    Trace function call arguments
67108864:    Number and identity of clients connected to this server
117440511:   All possible operations/data
134217728:   All Java plug-in debug messages and internal server messages related to the Java plug-in framework.
268435456:   All messages passed by a Java plug-in using the ServerLog object.
402653184:   Both of the above

I highlighted the value 491520 because it is specially useful value if you want to check the actual SQL generated by LDAP operations.

2> Example ldif file.

dn: cn=oid1,cn=osdldapd,cn=subconfigsubentry
changetype:modify
replace:orcldebugflag
orcldebugflag: 491520
-
changetype:modify
replace:orcldebugop
orcldebugop: 21

Above ldif file will set the log to record bin, add and modify and, it will record the actual SQL sent to database.

Run the ldapmodify command to set the values, check the logs.

Turn Off the Logging,

To turn off the logging, set both values to 0.

- Have fun.

Install OHS Certificate

To secure the http communication between web browsers and OHS web server, you will need to install the certificate from a trusted authority on OHS server.
By default OHS store the keys in the keystore located at
$INSTANCE/config/OHS/ohs5/keystores/default

By default OHS uses the keystore cwallet.sso defined at the above location. It is a good idea to leave the default keystore alone and create your own keystore at a different location.

Follow the steps below to setup the certificate:

1> Start the Oracle Wallet Manager(owm)

owm is an Oracle provided utility that you could use to manage the keystore and certificates. You could find it at $OHS_HOME/bin .

Example:
cd /app/oracle/product/fmw/webServer/bin
./owm

This will start the OWM interface.

2> Create a new Oracle Wallet

Click on Wallet --> New to create a new wallet. You will be asked to enter password for the wallet.

When clicked on OK, a new wallet will be created for you. 

3> Create a Certificate Signing Request (CSR)

Clicking "Yes" on the confirmation window will create a new CSR window. Alternatively, you could choose Operations --> "Add Certificate Request" to create a CSR.

Supply the information for your CSR

4> Get the certificate

Right click on the CSR --> Export it. Send it to the Certificate authority. CA will send back a trusted certificate and a user certificate.

Save the above wallet, once you receive the 2 certificate, open the wallet again and import the certificates.


5> Import the certs

Import the Trusted cert first. 

sftp the certificate received from CA to the server, then use OWM to import the cert.

A message will be displayed at the bottom that certificate is imported successfully. 
Follow the same procedure to import the user certificate.

The certificate will be shown as ready after the user certificate is imported.

Save the wallet. There will be 2 files created at the save location.

cwallet.sso
ewallet.p12

6> Modify the config files

You could create a new keystore parallel to the default location

Default keystore: $INSTANCE/config/OHS/ohs5/keystores/default
Custom keystore: $INSTANCE/config/OHS/ohs5/keystores/custom

Copy the newly create wallet file to the custom location. The location of keystore is in the configuration files and it is loaded at the startup of the server. Modify the config files to change the location.

Stop the wen server.
Go to the config location, $INSTANCE/config/OHS/oha1
grep for the file containing SSLWallet, usually it is in the file ssl.conf

 #Path to the wallet
   SSLWallet "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/keystores/default"


   <FilesMatch "\.(cgi|shtml|phtml|php)$">

Modify the SSLWallet setting to point to the directory where the new keystore is located.

Restart the web server.

Test by going to the https:// url

--have fun