Oracle Security and Identity Management






			SSL enabling the SSO Server In this section we will be configuring three files and reregistering all SSO applications that will be PKI protected. The three files we will be configuring are "sso_apache.conf", "orion-web.xml" and "policy.properties". The result of this exercise will be that the SSO server, the DAS server and the OCA Server will be SSL protected. Configuring the sso_apache.conf file Configuring the orion-web.xml file Configuring the policy.properties file Registering your SSO Applications with mod_osso Configuring the sso_apache.conf file In this file configuration we will add two directives. The first one will setup the URL's for your Java links. The second directive will allow the single sign-on server to receive client certificate parameters. There are two ways to modify this file. EM AS Control and Manual Edit. EM Application Server Control edit of the "sso_apache.conf" file (Recomended method) Editing the configuration files with the EM Application Server Control gives you the ability to easily revert back to old configurations should you change your mind. More importantly, you will not have to manually run the dcmctl command to update the Distributed Configuration Management (DCM) every time you make a change to a configuration file. In a browser, navigate to the EM Application Server Control URL. Example: http://aspen.us.oracle.com:1810 Click on the "HTTP_Server" link in the "System Components" section. On the page that follows click on the "Administration" link at the top of the page. On the page that follows click on the "Advanced Server Properties" link. In the list of files that follows click on the "sso_apache.conf" link. Add the directive for the URL's of your Java links to the end of this file. Example: <IfDefine SSL> <location "/sso/auth"> SSLRequireSSL </location> <location "/sso/ChangePwdServlet"> SSLRequireSSL </location> </IfDefine> Add the second directive that will allow the single sign-on server to receive client certificate parameters to the end of the same file. Example: <IfModule mod_ossl.c> Oc4jExtractSSL on <location "/sso"> SSLOptions +ExportCertData +StdEnvVars </location> </IfModule> After you finish editing this file, click the "Apply" button to commit your edits. You will be prompted to restart the HTTP Server. Make sure you select "Yes" to restart the HTTP Server. Manual edit of the "sso_apache.conf" file (Not Recomended) If you decide to manually edit this file without the EM Application Server Control you will have to manually update the Distributed Configuration Management (DCM) at the end of this procedure in order to make the changes permanent. Change directory to $ORACLE_HOME/sso/conf Make a backup copy of the sso_apache.conf file Open the file "sso_apache.conf" in a text editor. Add the directive for the URL's of your Java links to the end of this file. Example: <IfDefine SSL> <location "/sso/auth"> SSLRequireSSL </location> <location "/sso/ChangePwdServlet"> SSLRequireSSL </location> </IfDefine> Add the second directive that will allow the single sign-on server to receive client certificate parameters to the end of the same file. <IfModule mod_ossl.c> Oc4jExtractSSL on <location "/sso"> SSLOptions +ExportCertData +StdEnvVars </location> </IfModule> Save the changes to this file and exit the editor. Run the following commands to update the Distributed Configuration Management (DCM): dcmctl updateconfig -co OC4J_SECURITY dcmctl updateconfig -ct ohs Restart OC4J_SECURITY and the HTTP server. opmnctl restartproc process-type=OC4J_SECURITY opmnctl restartproc process-type=HTTP_Server Watch a viewlet to see how its done. Configuring the orion-web.xml file This file can only be edited manually. Change directory to $ORACLE_HOME/j2ee/OC4J_SECURITY/application-deployments/sso/web Make a backup copy of the orion-web.xml file. Open the file orion-web.xml in a text editor. Open a new line above the closing tag "</orion-web-app>" and enter the following line there: <jazn-web-app runas-mode="true" /> Example: Save the changes made to the file and exit the editor. Configuring the policy.properties file Change directory to $ORACLE_HOME/sso/conf Make a copy of the policy.properties file. Open the file policy.properties in a text editor. Change the "DefaultAuthLevel" value from MediumSecurity to MediumHighSecurity Example: DefaultAuthLevel = MediumHighSecurity In the same file also change the Authentication plugin From: MediumSecurity_AuthPlugin = oracle.security.sso.server.auth.SSOServerAuth To: MediumHighSecurity_AuthPlugin = oracle.security.sso.server.auth.SSOX509CertAuth Example: Save the changes to the file and exit the editor. Registering your SSO Applications with mod_osso Now we need to register your SSO applications with the SSO server. In the following example we will register the SSO server itself (which will also take care of the DAS web application) as well as the OCA application. From the command prompt enter the following command. Make sure to substitute your own hostname, domain, and port information in this command. # $ORACLE_HOME/jdk/bin/java -jar $ORACLE_HOME/sso/lib/ossoreg.jar -oracle_home_path $ORACLE_HOME -site_name SSO -config_mod_osso TRUE -mod_osso_url https://hostname.domain.com:4443 -u root Example: Now register the OCA application with the following command: # $ORACLE_HOME/jdk/bin/Java -jar $ORACLE_HOME/sso/lib/ossoreg.jar -oracle_home_path $ORACLE_HOME -site_name OCA -config_mod_osso TRUE -mod_osso_url https://hostname.domain.com:4400 -u root -virtualhost -config_file $ORACLE_HOME/Apache/Apache/conf/osso/oca/osso.conf Some Operating Systems have a limitation to the length of characters in a command at the command prompt which may hinder you from properly running this command. If this is a problem for you, create a new file and enter this command into the file and make the file executable and run it. Example: Now we need to update the Distributed Configuration Management (DCM). Failure to do so may cause problems with authenticating to your Virtual Host applications such as OCA. Example: dcmctl updateconfig -v -d Now we need to restart the infrastructure. In a browser, navigate to the EM Application Server Control URL. Example: http://aspen.us.oracle.com:1810 Click the "Restart" all button. Finally, start the Oracle Certificate Authority. Example: # ocactl start Watch a viewlet to see how its done.