Install and Configure OAM-OMSS Topology using IDM LCM Tool with OUD

1. Navigate to OTN - otn.oracle.com or directly go to http://www.oracle.com/technetwork/middleware/id-mgmt/downloads/index.html, click on download link under 11g R2 Release (11.1.2.x). Accept the terms and click next to the link for Oracle Identity and Access Management Repository 11.1.2.3. It should redirect you to edelivery.oracle.com. Sign In and download the software.

    

2. After downloading all the files, you should have following 12 zip files staged. Unzip the files and you will have one read me file along with two directories - installers and jdk. In our environment the software is staged under /scratch/vp/stage/software

    

3. On the terminal window set two environment variables:
   export REPOS_HOME=/scratch/vp/stage/software
   export JAVA_HOME=$REPOS_HOME/jdk

1. Install the LCM tools by running an installer, which is located in the Oracle Identity and Access Management deployment repository (REPOS_HOME). Before you begin, make sure two environment variables - REPOS_HOME and JAVA_HOME - are set on the terminal window.
   To begin installing the tools, change to $REPOS_HOME/installers/idmlcm/Disk1 directory and start the installer and click Next on the Welcome screen:
   cd $REPOS_HOME/installers/idmlcm/Disk1
   ./runInstaller -jreLoc $JAVA_HOME

    

2. Skip Software Updates and Click Next.

    

3. On Prerequisite screen, click Next.

    

4. On the Installation Location screen, specify where you want to install IDM LCM tool.

    

5. On the Installation Summary screen, click Install.

    

6. On the Installation Progress screen, click Next :

    

7. On the Installation Complete screen, Click Finish.

    

8. You can view the directory structure of IDM LCM tools directory.

    

9. Set a new environment variable on the same terminal window:
   export IDMLCM_HOME=/scratch/vp/stage/idmlcm

Before you run the deployment wizard, change the following OAM database, system parameters:

1. Verify the following kernel parameters:
   

   • shmmax = 2147483648
   • soft nproc 4096
   • hard nproc 4096

   If using RHEL6 and above change it in /etc/security/limits.d/90-nproc.conf
   else change it in /etc/security/limits.conf
   Reboot the machine.

2. Set and verify the following database parameters:

   • open_cursors 1600
   • session_cached_cursors 500
   • session_max_open_files 50
   • sga_target 536879120 (min should be 4294967296 )
   • pga_aggregate_target 104857600 (OPTIONAL)
   • sga_max_size 4294967296
   • memory_target=0 (OPTIONAL)
You can change the above database values using:
    sqlplus / as sysdba
    SELECT value FROM v$parameter WHERE name = ‘<parameter_name>'; 
For example: SELECT value FROM v$parameter WHERE name = ‘open_cursors';

If the value of the parameter is less than the values mentioned above, modify the values using:
    alter system set <parameter_name> = <value> scope=spfile
    For example:
    alter system set open_cursors = 1600 scope=spfile 

Verify the following database parameters:

• Processes = 500
• open_cursors = 1600
• session_cached_cursors = 500
• aq_tm_processes = 1
• dml_locks = 3396
• job_queue_processes = 1000
• session_max_open_files = 50
• sessions = 772
• sga_target = 536879120
• pga_aggregate_target = 104857600
• sga_max_size = 4294967296
Restart the DB.

1. Checks OS and release:  checks against certification matrix on OTN. In our case, Oracle Linux 6.5 64 bit.

2. Checks if the following ports are free - the ports mentioned in the provisioning.rsp file for example:

• 8989,
• 6703 OPMN Local port,
• 14150 OAM Policy mgr port,
• 6704 OPMN Remote port,
• 14151 OAM policy mgr SSL port,
• 7001 Admin Server port,
• 14180 OMSM port,
• 14181 OMSM SSL port,
• 5556 Node mgr port,
• 7777 OHS HTTP port,
• 14100 OAM port,
• 7779,
• 1389 OUD non-SSL port,
• 4443 OHS SSL port,
• 4444 OUD Admin listener port,
• 5575 OAM OAP port,
• 9002 OMSAS SSL port,
• 9001 OMSAS port, 
• 9999 OHS admin SSL port

3. Checks the following free disk space:

   • $SHARED_CONFIG_DIR - 3GB
   • $IDM_TOP - 20GB
   • $LCM_HOME/provisioning - 0.2 GB
   • Temp space - 500 MB
   • Swap memory - 512 MB
4. Checks for free memory: 6GB minimum but  22 GB is recommended.
5. Checks the host is reachable by pinging host

6. Checks for the supported JDK vendor and version.

7. Confirms the following OS packages are installed:
   • binutils-2.20.51.0.2-5.36.el6.x86_64
   • compat-libcap1-1.10-1.x86_64
   • gcc-4.4.7-4.el6.x86_64
   • gcc-c++-4.4.7-4.el6.x86_64
   • libaio-0.3.107-10.el6.x86_64
   • libaio-devel-0.3.107-10.el6.x86_64
   • libgcc-4.4.7-4.el6.i686
   • libstdc++-devel-4.4.7-4.el6.x86_64
   • sysstat-9.0.4-22.el6.x86_64
   • compat-libstdc++-33-3.2.3-69.el6.x86_64
   • glibc-2.12-1.132.el6.x86_64
   • libstdc++-4.4.7-4.el6.x86_64
   • libXext-1.3.1-2.el6.i686
   • libXtst-1.2.1-2.el6.i686
   • xorg-x11-utils-7.5-6.el6.x86_64
   • xorg-x11-apps-7.6-6.el6.x86_64
   • xorg-x11-xinit-1.0.9-14.el6.x86_64
   • xorg-x11-server-Xorg-1.13.0-23.el6.x86_64
   • xterm-253-1.el6.x86_64
   • openmotif-2.3.3-6.1.el6_4.i686
   • openmotif22-2.2.3-19.el6.x86_64
   • redhat-lsb-core-4.0-7.0.1.el6.x86_64
8.  Checks if the following paths have RWX permissions:
   • /scratch/vp/stage/lcmstoreloc
   • $REPOS_HOME
   • /scratch/vp/idmtop/config
9.  Run checks XClock.
   

1. Make sure Oracle Database is up and running.

2. To start the Oracle Identity and Access Management Deployment Wizard, go to $IDMLCM_HOME/provisioning/bin directory.

3. Make sure you are on the same terminal window where all the 3 previous environment variables have been set.

4. Run the following cmd:

   ./iamDeplymentWizard.sh
5. On the Welcome screen, click Next.

   
   
   

6. On Choose IAM Installation Option screen, select Create a New Identity and Access Management Deployment Response File. Click Next.

    

7. Use the Specify Security Updates screen to set up a notification preference for security-related updates and installation-related information from My Oracle Support. This information is optional. Here you can deselect I wish to receive security updates via My Oracle Support. Click Next.

    

8. On the Email Address Not Specified popup screen, click Yes.

    

9. On the Describe Response File screen, specify descriptive information to identify the response file. This information can be used to uniquely identify a response file if multiple response files are created.

   • Response File Title: The Oracle Identity and Access Management Deployment Wizard provides the default title Identity and Access Management Deployment Response File. You can change this.
   • Response File Version: The Oracle Identity and Access Management Deployment Wizard provides a default value, which you can change. You can use this to keep track of different file versions.
   • Created By: Defaults to the operating system user who invoked the Deployment Wizard. Set when the response file is initially created and cannot be modified for the current response file.
   • Created Date: Defaults to the date that the response file was initially created. Set when the response file was initially created and cannot be modified for the current response file.
   • Response File Description: Provide a description of this response file. This is an optional field.

   Click Next.

    

10. On the Select IAM Products screen, select Oracle Access Manager(OAM) Suite and Oracle Mobile Security Suite (OMSS)* Only. Click Next.

     

11. On Configure Oracle Unified Directory screen, select Configure New Directory option. Choose the Directory Types as Oracle Unified Directory. Click Next.
    

     

12. On Select Topology screen, select Single Node. In the Host Name field, specify the host where you want to deploy Identity and Access Management, as a fully-qualified host name. Click Next.

     

13. On Select Installation and Configuration Locations screen, give the location of the directories required for installation and configuration actions. Click Next.

     

14. On Directory Configure screen,enter the following values for the ports. Click Next.

    • Port = 1389
    • SSL Port = 1636

     

15. On Configure Oracle HTTP Server screen, enter the  following values for the ports.

    • HTTP Port = 7777
    • SSL Port = 4443
    • OHS Admin SSL Port = 9999
    • OPMN Local Port = 6703
    • OPMN Remote Port = 6704
    Click Next.

     

16. On Configure Oracle Access Manager screen,  enter the  following values for the ports.

    • AdminServer Port = 7001
    • OAM Port = 14100
    • Nodemanager Port = 5556

    Click Next.

     

17. On Configure Oracle Mobile Security Manager screen,  enter the  following values for the ports.

    • OMSM Port = 14180
    • OMSM SSL Port = 14181 

    Click Next.

     

18. On Configure Oracle Mobile Security Access Server screen,  enter the  following values for the ports.

    • OMSAS Port = 9001
    • OMSAS SSL Port = 9002

    Click Next.

     

19. On Configure Access Policy Manager screen,  enter the  following values for the ports.

    • OAM Policy Manager Port = 14150
    • OAM Policy Manager SSL Port = 14151

    Click Next.

     

20. On Configure Oracle Access Manager Database screen, check Create Schema Using RCU and enter the following

    • SYSDBA Username: SYS
    • SYSDBA Password: <sysdba password> For Example: Oracle123
      
    • Schema Prefix: EDGIAD
    • Service Name: <service name> For example: orcl.us.oracle.com
    • Schema Password: <Provide schema password> For Example: Oracle123
    • Host Name: <hostname>
      
    • Listen Port: 1521

    Click Next.

     

21. On Set User Names and Passwords screen, enter the common IAM password.Click Next.

     

22. The Summary screen is displayed.

     

23. On the Summary screen verify the Oracle Mobile Security Suite Configuration details.

     

24. On the Summary screen verify the Configuration details.

     

25. On the Summary screen verify the Product Installation details.

    
    
    Click Finish.

After creating the deployment response file, use it to deploy the Oracle Identity and Access Management environment. When you use the LCM tools to deploy an Oracle Identity and Access Management environment, you run the deployment in stages. At the end of each stage, you can verify that the stage has completed successfully before advancing to the next stage.

Following are the phases : Prerequisite checks, Install, Preconfigure, Configure, Configure Secondary, Postconfigure, Startup and Validate.

After you have created a response file, you can deploy the Oracle Identity and Access Management software using the deployment tool command line or the Oracle Identity and Access Management Deployment Wizard.

If you want to install and configure all the 8 steps of the IDM LCM deployment wizard for silent install and scripting, you could use the command line deployment tool. You must run the runIAMDeployment.sh script a number of times, specifying the deployment stage with the -target option. You MUST complete each command, in order, and successfully, before running the next command.

The command syntax for the deployment tool on UNIX is: runIAMDeployment.sh -responseFile RESPONSE_FILE -target STAGE

In this example, note the following:
RESPONSE_FILE is the complete path to the location of the deployment response file. You specified the file name and directory on the Summary screen when you ran the wizard to create the deployment response file.

On Unix, the default value is: IDMLCM_HOME/provisioning/bin/provisioning.rsp

Review the following example, which shows each of the commands:

• runIAMDeployment.sh -responseFile IDMLCM_HOME/provisioning/bin/provisioning.rsp -target preverify
  (Approximate time to complete this step 2 min)
• runIAMDeployment.sh -responseFile IDMLCM_HOME/provisioning/bin/provisioning.rsp -target install
  (Approximate time to complete this step 30 min)
• runIAMDeployment.sh -responseFile IDMLCM_HOME/provisioning/bin/provisioning.rsp -target preconfigure
  (Approximate time to complete this step 35 min)
• runIAMDeployment.sh -responseFile IDMLCM_HOME/provisioning/bin/provisioning.rsp -target configure
  (Approximate time to complete this step 35 min) 
• runIAMDeployment.sh -responseFile IDMLCM_HOME/provisioning/bin/provisioning.rsp -target configure-secondary
  (Approximate time to complete this step 9 min)
• runIAMDeployment.sh -responseFile IDMLCM_HOME/provisioning/bin/provisioning.rsp -target postconfigure
  (Approximate time to complete this step 13 min) 
• runIAMDeployment.sh -responseFile IDMLCM_HOME/provisioning/bin/provisioning.rsp -target startup
  (Approximate time to complete this step 20 min)
• runIAMDeployment.sh -responseFile IDMLCM_HOME/provisioning/bin/provisioning.rsp -target validate
  (Approximate time to complete this step 3 min)

1. On the Welcome screen, click Next.

    

2. On Choose IAM Installation Options screen, Select Deploy an Identity and Access Management Environment from an existing Response File. In the Response File field, specify the path name of the file you want to use, either by typing it in the field or by clicking the Browse button, navigating to the desired file, and selecting it. Click Next.

    

3. On Describe Response File screen, enter the information about the response file, that you had provided when creating the Deployment Profile. Click Next.

    

4. On Select Installation and Configuration Locations screen enter the information about the Oracle Identity and Access Management installation and configuration directories, that you had provided when creating the Deployment Profile. Click Next.

    

5. The Review Deployment Configuration screen enables you to select configurations you want to review. This is optional. Click Next.

    

6. Review the information displayed on the Summary screen to ensure that the installation details are what you intend. Click Next.

    

7. Click Next to continue.

    

8. Click Next to proceed.

    

9. Click Next. The Oracle Identity and Access Management Deployment Wizard starts the configure phase and displays the Configure screen.

    

10. Click Next to continue.

     

11. Click Next to continue.

     

12. Click Next to continue.

     

13. Click Next to continue.

     

14. Click Next to continue.

     

15. The Install Complete screen appears after deployment has completed successfully. It shows a summary of the products that have been installed.
    Click Finish.

     

The Oracle Identity and Access Environment Health Check Utility is used to check the technical aspects of your identity and access management setup and provide an overall measurement of various settings and configurations of your environment.Oracle Identity and Access Management Life Cycle Management tools  runs the health-check utility automatically as part of the pre-installation and post-configuration steps.

Further, after installing and configuring Oracle Identity and Access Management Life Cycle Management tools, the product specific plugins can be executed at any time to verify the health of the deployment.

The Oracle Identity and Access Environment Health Check Utility uses specific directories for executing plugins and for storing log files.

The healthcheck dir location is $IDMLCM_HOME/healthcheck

• bin - Contains the execution script idmhc.sh, idmhc.properties file and idmhc.bat file.
• config - Contains the xml files that must be provided as input when running the idmhc.sh command.
• lib - Contains relevant jar files

The Oracle Identity and Access Environment Health Check Utility is run, either via command-line or by the automated LCM tools, by executing the idmhc.sh command.The xml file that is passed to the idmhc.sh command contains the plugins that need to be executed. All relevant xml files reside in the $IDMLCM_HOME/healthcheck/config directory.

There are xml files for generic tests, such as PreInstallChecks_mandatory.xml, PreInstallChecks_mandatory_manual.xml, PreInstallChecks_optional.xml and PostInstallChecks.xml, and xml files that are product-specific such as PostInstallChecks_oim.xml, PostConfigChecks_oudhost.x, and PostInstallChecks_oam.xml.

Plugins are:
FreeMemoryCheck, KernelParamCheck, OSCheck, FreePortsCheck, DiskSpaceCheck, HostsCheck, DBParameterCheck, DBSchemaCheck, JDKCheck, PackageInstalledCheck, PermissionsCheck, XClockCheck, ProcessorCheck, HostsCheck. 

The Oracle Identity and Access Environment Health Check Utility uses the idmhc.properties file located in $IDMLCM_HOME/healthcheck/bin directory, to run the plugins listed in the xml files of the utility. The idmhc.properties file contains parameters that define the connectivity of IDStore, schemas for various components of the Oracle Identity and Access Management suite, WebLogic server schemas, OUD checks, and so on.

In the preverify stage, Oracle Identity and Access Management Health Check Utility (idmhc.sh) performs validation checks against your Oracle Identity and Access Management setup. The utility gathers data from your environment, and runs a set of health-check plugins in an XML file to generate a report that compares your environment configuration settings with various Oracle recommended configuration settings.

The execution script idmhc.sh that is required to run the Health Check utility can be located in the $IDMLCM_HOME/healthcheck/bin folder. The plugins in PreInstallChecks_mandatory.xmlare tested and results in errors if one of the plugins fails(/scratch/vp/stage/lcmstoreloc/provisioning/logs/<hostname>/healthchecker-preverify-error-check.log)and plugins in PreInstallChecks_optional.xml are tested and result in warnings if one of the plugins fails($LCM_HOME/provisioning/provisioning/logs/myhost.mycompany.com/healthchecker-preverify-warning-check.log)

Open the two log files:

• healthchecker-preverify-error-check.log
• healthchecker-preverify-warning-check.log

The log files of the idmhc.sh run (based on mandatory or optional plugins in the PreInstallChecks_mandatory.xml or PreInstallChecks_optional.xml files) are located in /scratch/vp/stage/lcmstoreloc/provisioning/logs/<hostname>/healthcheck-error or healthcheck-warning directories.

IDM deployment wizard automatically starts all components. if you want to do it manually, go to /scratch/vp/idmtop/config/scripts/startall.sh  (you will also find stopall.sh here).

The final directory structure looks as follows. In this picture we are highlighting only key directories.