Configuring Security store for Oracle IAM environment - IDM domain

By -
Preparing for configuration of secure store 
export IAM_HOME=/u01/app/Middleware/Oracle_IDM1
Lets see the help for configuresecuritystore.py 
oracle_common/common/bin/wlst.sh IDM_HOME/common/tools/configuresecuritystore.py
-h  --help                       Prints usage message.
-d  --domaindir                  The directory of domain.
-s  --datasource                 The data source of security store configured in domain. It is optional, default value is "opss-DBDS".
-f  --farmname                   The security store farm name. It is optional, default value is the domain name.
-t  --servertype                 The policy store type, using "DB_ORACLE", "DB_DERBY", or "OID". It is optional, default value is "DB_ORACLE".
-j  --jpsroot                    The distinguished name of jpsroot. It is optional, default value is "cn=jpsroot".
-m                               Option to control domain configuration and data migration. It is optional, default value is create.
    create        - security store is populated with data and domain is configured to use newly populated policy store. This is the default.
    join          - domain is configured to uptake an existing security store, and security data is migrated to the security store. meanwhile, the encryption key for credential store will be imported as well.
    validate      - validate whether diagnostics data saved in the credential store successfully.
    validate_fix  - fix diagnostics data if it is not saved in the credential store.
    fixjse        - update JSE policy store password credential.
    --create_diagnostic_data         Create diagnostic data when upgrading OES 11g PS1 to OES 11g R2, only available when "-m join" has been set.
-c  --config                     The configuration mode of domain, using "IAM" to configure IAM mode. It is optional, default value is None.
-a  --admin                      The admin user name of OID.
-l  --ldapurl                    The url of OID.
-p  --passcode                   Policy store schema password. If not specified user will be prompted for password.
-k  --keyfilepath                The directory containing the security store data encrpytion key file ewallet.p12. If "-m join" is specified, the option is mandatory.
-w  --keyfilepassword            The password used when the encrpytion key was generated. If "-m join" is specified, the option is mandatory.
-u  --username                   The user name of JSE password credential. If "-m fixjse" is specified, this option is mandatory.
Lets create the security store 
$ wlst $IAM_HOME/common/tools/configureSecurityStore.py \
-d /u01/app/mytest/user_projects/domains/idm_domain \
-c IAM  -m create

CLASSPATH=/u01/app/oracle/Middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/u01/app/oracle/Middleware/patch_ocp371/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/u01/app/mytest/jdk1.8.0_65/lib/tools.jar:/u01/app/oracle/Middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/u01/app/oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar:/u01/app/oracle/Middleware/modules/features/weblogic.server.modules_10.3.6.0.jar:/u01/app/oracle/Middleware/wlserver_10.3/server/lib/webservices.jar:/u01/app/oracle/Middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/u01/app/oracle/Middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar::/u01/app/oracle/Middleware/oracle_common/modules/oracle.jrf_11.1.1/jrf-wlstman.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/lib/adfscripting.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/lib/adf-share-mbeans-wlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/lib/mdswlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/auditwlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/igfwlsthelp.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/jps-wlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/jps-wls-trustprovider.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/jrf-wlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/oamap_help.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/oamAuthnProvider.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/ossoiap_help.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/ossoiap.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/ovdwlsthelp.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/sslconfigwlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/wsm-wlst.jar:/u01/app/oracle/Middleware/utils/config/10.3/config-launch.jar::/u01/app/oracle/Middleware/wlserver_10.3/common/derby/lib/derbynet.jar:/u01/app/oracle/Middleware/wlserver_10.3/common/derby/lib/derbyclient.jar:/u01/app/oracle/Middleware/wlserver_10.3/common/derby/lib/derbytools.jar::
Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=128m; support was removed in 8.0

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

Info: Data source is: opss-DBDS
Please input data source password:
Info: DB JDBC driver: oracle.jdbc.OracleDriver
Info: DB JDBC URL: jdbc:oracle:thin:@mydb.vybhava.com:1521/ORCL12C
Connected:oracle.jdbc.driver.T4CConnection@70163ce4
Disconnect:oracle.jdbc.driver.T4CConnection@70163ce4
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator]  checkServiceSetup - done
May 03, 2016 11:17:21 PM oracle.security.jps.internal.config.ldap.LdapCredStoreServiceConfigurator schemaCompatibleHandler
INFO: Credential store schema upgrade not required. Store Schema version 11.1.1.7.0 is compatible to the seed schema version 11.1.1.4.0
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator]  checkServiceSchema - Store schema has been seeded completely
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator]  updateServiceConfiguration - done
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator]  seedSchemaAndCreateDIT - done
May 03, 2016 11:17:23 PM oracle.security.jps.internal.tools.utility.JpsUtilMigrationCredImpl migrateCredentialData
INFO: Migration of Credential Store data in progress.....
May 03, 2016 11:17:23 PM oracle.security.jps.internal.tools.utility.JpsUtilMigrationCredImpl migrateCredentialData
INFO: Migration of Credential Store data completed, Time taken for migration is 00:00:00
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator]  migrateData - done
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator]  testJpsService - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator]  checkServiceSetup - done
May 03, 2016 11:17:23 PM oracle.security.jps.internal.config.ldap.LdapKeyStoreServiceConfigurator schemaCompatibleHandler
INFO: Keystore schema upgrade not required. Store Schema version 11.1.1.7.0 is compatible to the seed schema version 11.1.1.4.0
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator]  checkServiceSchema - Store schema has been seeded completely
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator]  updateServiceConfiguration - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator]  seedSchemaAndCreateDIT - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator]  migrateData - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator]  testJpsService - done
May 03, 2016 11:17:24 PM oracle.security.jps.internal.policystore.ldap.LdapPolicyStore initial
INFO: Your Policy store schema is not upgraded to the latest version!
Please run the PSA (Patch Set Assistant) to upgrade the current schema version 11.1.1.7.0 to the latest version 11.1.1.7.2.
Or, you could continue to run in the backward-compatibility mode.
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator]  checkServiceSetup - done
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator]  checkServiceSchema - Store schema has been seeded completely
May 03, 2016 11:17:24 PM oracle.security.jps.internal.config.ldap.LdapPolicyStoreServiceConfigurator schemaCompatibleHandler
INFO: Policy schema upgrade not required. Store Schema version 11.1.1.7.0 is compatible to the seed schema version 11.1.1.4.0
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator]  updateServiceConfiguration - done
May 03, 2016 11:17:24 PM oracle.security.jps.internal.policystore.ldap.LdapPolicyStore initial
INFO: Your Policy store schema is not upgraded to the latest version!
Please run the PSA (Patch Set Assistant) to upgrade the current schema version 11.1.1.7.0 to the latest version 11.1.1.7.2.
Or, you could continue to run in the backward-compatibility mode.
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator]  seedSchemaAndCreateDIT - done
WLS ManagedService is not up running. Fall back to use system properties for configuration.
May 03, 2016 11:17:33 PM oracle.security.jps.internal.tools.utility.destination.apibased.JpsDstPolicy migrateData
INFO: Migration of Admin Role Members started
May 03, 2016 11:17:33 PM oracle.security.jps.internal.tools.utility.destination.apibased.JpsDstPolicy migrateData
INFO: Migration of Admin Role Members completed in 00:00:00
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator]  migrateData - done
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator]  testJpsService - done
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator]  checkServiceSetup - done
May 03, 2016 11:17:33 PM oracle.security.jps.internal.config.ldap.LdapAuditServiceConfigurator schemaCompatibleHandler
INFO: Audit store schema upgrade not required. Store Schema version 11.1.1.7.0 is compatible to the seed schema version 11.1.1.4.0
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator]  checkServiceSchema - Store schema has been seeded completely
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator]  updateServiceConfiguration - done
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator]  seedSchemaAndCreateDIT - done
May 03, 2016 11:17:33 PM oracle.security.jps.internal.audit.AuditServiceImpl registerInternal
WARNING: Cannot register to audit service for component "JPS".
May 03, 2016 11:17:33 PM oracle.security.jps.internal.tools.utility.JpsUtilMigrationAuditStoreImpl migrateAuditStoreData
INFO: Migration of Audit Store data in progress.....
May 03, 2016 11:18:17 PM oracle.security.jps.internal.tools.utility.JpsUtilMigrationAuditStoreImpl migrateAuditStoreData
INFO: Migration of Audit Store data completed, Time taken for migration is 00:00:43
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator]  migrateData - done
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator]  testJpsService - done
persist to output: /u01/app/mytest/user_projects/domains/idm_domain/config/fmwconfig - done
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator]  checkServiceSetup - done
[oracle.security.jps.internal.config.db.DbCredStoreServiceConfigurator]  updateServiceConfiguration - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator]  checkServiceSetup - done
[oracle.security.jps.internal.config.db.DbKeyStoreServiceConfigurator]  updateServiceConfiguration - done
May 03, 2016 11:18:22 PM oracle.security.jps.internal.policystore.ldap.LdapPolicyStore initial
INFO: Your Policy store schema is not upgraded to the latest version!
Please run the PSA (Patch Set Assistant) to upgrade the current schema version 11.1.1.7.0 to the latest version 11.1.1.7.2.
Or, you could continue to run in the backward-compatibility mode.
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator]  checkServiceSetup - done
[oracle.security.jps.internal.config.db.DbPolicyStoreServiceConfigurator]  updateServiceConfiguration - done
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator]  checkServiceSetup - done
[oracle.security.jps.internal.config.db.DbAuditStoreServiceConfigurator]  updateServiceConfiguration - done
persist to output: /u01/app/mytest/user_projects/domains/idm_domain/config/fmwconfig - done
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
May 03, 2016 11:18:27 PM oracle.security.jps.internal.policystore.ldap.LdapPolicyStore initial
INFO: Your Policy store schema is not upgraded to the latest version!
Please run the PSA (Patch Set Assistant) to upgrade the current schema version 11.1.1.7.0 to the latest version 11.1.1.7.2.
Or, you could continue to run in the backward-compatibility mode.
May 03, 2016 11:18:35 PM oracle.security.jps.internal.policystore.ldap.LdapPolicyStore initial
INFO: Your Policy store schema is not upgraded to the latest version!
Please run the PSA (Patch Set Assistant) to upgrade the current schema version 11.1.1.7.0 to the latest version 11.1.1.7.2.
Or, you could continue to run in the backward-compatibility mode.
Using default context in /u01/app/mytest/user_projects/domains/idm_domain/config/fmwconfig/jps-config-migration.xml file for credential store.
Credential store location : jdbc:oracle:thin:@mydb.vybhava.com:1521/ORCL12C
Credential with map Oracle-IAM-Security-Store-Diagnostics key Test-Cred stored successfully!


        Credential for map Oracle-IAM-Security-Store-Diagnostics and key Test-Cred is:
                GenericCredential
Info: diagnostic credential created in the credential store.
Info:  Create operation has completed successfully.
Then verify the store configuration as follows:

$ wlst $IAM_HOME/common/tools/configureSecurityStore.py -d /u01/app/mytest/user_projects/domains/idm_domain -c IAM -p weblogic123 -m validate

CLASSPATH=/u01/app/oracle/Middleware/patch_wls1036/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/u01/app/oracle/Middleware/patch_ocp371/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/u01/app/mytest/jdk1.8.0_65/lib/tools.jar:/u01/app/oracle/Middleware/wlserver_10.3/server/lib/weblogic_sp.jar:/u01/app/oracle/Middleware/wlserver_10.3/server/lib/weblogic.jar:/u01/app/oracle/Middleware/modules/features/weblogic.server.modules_10.3.6.0.jar:/u01/app/oracle/Middleware/wlserver_10.3/server/lib/webservices.jar:/u01/app/oracle/Middleware/modules/org.apache.ant_1.7.1/lib/ant-all.jar:/u01/app/oracle/Middleware/modules/net.sf.antcontrib_1.1.0.0_1-0b2/lib/ant-contrib.jar::/u01/app/oracle/Middleware/oracle_common/modules/oracle.jrf_11.1.1/jrf-wlstman.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/lib/adfscripting.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/lib/adf-share-mbeans-wlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/lib/mdswlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/auditwlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/igfwlsthelp.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/jps-wlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/jps-wls-trustprovider.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/jrf-wlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/oamap_help.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/oamAuthnProvider.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/ossoiap_help.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/ossoiap.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/ovdwlsthelp.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/sslconfigwlst.jar:/u01/app/oracle/Middleware/oracle_common/common/wlst/resources/wsm-wlst.jar:/u01/app/oracle/Middleware/utils/config/10.3/config-launch.jar::/u01/app/oracle/Middleware/wlserver_10.3/common/derby/lib/derbynet.jar:/u01/app/oracle/Middleware/wlserver_10.3/common/derby/lib/derbyclient.jar:/u01/app/oracle/Middleware/wlserver_10.3/common/derby/lib/derbytools.jar::
Java HotSpot(TM) 64-Bit Server VM warning: ignoring option MaxPermSize=128m; support was removed in 8.0

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

Info: Data source is: opss-DBDS
INFO: Found persistence provider "org.eclipse.persistence.jpa.PersistenceProvider". OpenJPA will not be used.
May 03, 2016 11:23:58 PM oracle.security.jps.internal.policystore.ldap.LdapPolicyStore initial
INFO: Your Policy store schema is not upgraded to the latest version!
Please run the PSA (Patch Set Assistant) to upgrade the current schema version 11.1.1.7.0 to the latest version 11.1.1.7.2.
Or, you could continue to run in the backward-compatibility mode.
WLS ManagedService is not up running. Fall back to use system properties for configuration.
Info: Diagnostics data was saved to the credential store.
Info: Validate operation has completed successfully.

Comments

Post a Comment

Popular posts from this blog

Uninstalling ORDS from Database

By -
Hello Guys!! Oracle REST Data Service (ords) is used as alternative to Oracle HTTP server (OHS) proxy web server that uses mod_plsql. In this post I would like ot share my experience on how to uninstall the ORDS from the Database. Before uninstalling you should aware of the following: Where is the ords.war exists JDK installed path (JAVA_HOME From which Database it need to uninstall Syntax: Navigate to the ORDS extracted directory which was previously used: java -jar ords.war uninstall ORDS Uninstallation Issue The challenge we faced during the ORDS uninstall $JAVA_HOME/bin/java -jar ords.war uninstall Enter the name of the database server [localhost]: Enter the database listen port [1521]: Enter the database service name [ORCL]: Please login with SYSDBA privileges to verify Oracle REST Data Services schema. Installation may be required. Enter the username with SYSDBA privileges to verify the installation [SYS]: Enter the database password for SYS: Confirm password: Jun 15...
Read more

Oracle Database 12c Client installation in Silent Mode

By -
Image
Namaste!! Welcome to 'My   OFMW   Experiments' blog! In this post, I would like to share my experiment that worked out for cooked recipes for those who are looking for silent mode installation of Oracle Client . where the applications need to use the connectivity to the Database and to execute SQL commands.   How to Download the Oracle Database 12c client? Most of the Oracle Utilities projects using the Oracle Client. Where Oracle database uses 12c then in the application software stack uses same version of Oracle Client. Choosing the right platform specific downloads is important. Which are available on OTN and also on e-delivery. Here I've worked on Oracle 12.1.0.2 database and client then again on Oracle 12.2.0.1 database and client combinations. Using VNC viewer we can install the software media but if you don't have that service available that alternative is silent mode installation. Make sure your OS have the unzip command for uncompressed. Now, unzip the do...
Read more

Create OHS Domain (Standalone) using WLST

By -
Image
Hello, Oracle Fusion product fans!! In this series of Oracle Fusion technical learning, I would like to share the latest experiment on OHS domain creation using WLST. It's a situation where I've installed OHS Standalone on a Vagrant based CentOS VirtualBox and need to run the OHS instance. I've searched on Google and also in Oracle but there is no such simple code or step that will work without X11 forwarding. Got a thought, There could be similar requirements may be there in a docker container as well. Searched in Github about OHS image creation code there I've learnt how does this WLST help us to create the OHS domain and creates ohs1 component instance within it. Create OHS Domain standalone mode using WLST script The magical WLST script looks like this... #!/usr/bin/python # Create OHS Domain standalone mode with 'ohs1' as system Component # Created date : 12-02-2020 import os, sys def read_ohsdomain_template(): """ Select a...
Read more