Tuesday, March 16, 2010

OAM/OIM Integration Steps: Configuring OAM Policy To Protect OIM

This document is intended to provide clear instructions on how to configure Oracle Access Manager policy for Oracle Identity Manager

The basic steps for performing an OAM/OIM integration are documented in the Oracle Identity Manager Best Practices Guide, Chapter 8.

However, there are some additional notes that are important when configuring this integration.


The following procedure describes how to configure single sign-on for Oracle Access Manager.
On the welcome page of the Access System, click Policy Manager, and then click Create Policy Domain.

Create a policy domain and policies to restrict access to the Oracle Identity Manager URLs.
In the Access System console,

define host identifiers for Oracle Identity Manager.
Click Policy Manager,

and then click the link for the Oracle Identity Manager policy domain.
Click the Resources tab and define resources for Oracle Access Manager to protect.
Click the Authorization Rules tab and define an authorization rule to determine

authenticated users who can access the Oracle Identity Manager URLs.

Click the Default Rules tab. The Authentication Rule subtab is selected.

Define an authentication rule, for example, Basic Over LDAP.
Click the Authorization Expression subtab under the Default Rules tab

Click the Add button

Configure the authorization expression, using the rule(s) defined in step 6 to determine what users will be authorized to access the Oracle Identity Manager URLs. Click the 'Save' button at the bottom of the page when done.

Click the Actions subtab under the Authorization Expression subtab, and define an authorization action that sets a custom HTTP header variable on successful authorization.

The header variable should contain a value that maps to the Oracle Identity Manager user ID.

It is important to use a valid header variable name as determined by the type of Web server being used for the integration. Specifically, as noted in
Chapter 5 of the OAM Access Administration Guide, different Web servers handle header variables differently. Refer to your Web server's documentation for information on how header variables are processed. For example: Netscape/iPlanet Web servers precede Access System variables with the string, HTTP:
If you define a variable called HTTP_CN, Netscape/iPlanet produces a variable called HTTP_HTTP_CN.
When you write an application that must read a header variable, the application must look for a variable called HTTP_HTTP_CN and not HTTP_CN.
Microsoft IIS expects header variables to be defined with a dash, not an underscore. You would enter HTTP–CN, not HTTP_CN.
The receiving application must read the variable as if it had an underscore. It looks for HTTP_CN, not HTTP–CN.

Click the Policies tab.

Click Add and define an access policy in the Oracle Identity Manager policy domain, and add the Oracle Identity Manager URL resources to this policy.

Youn can see more in below link Provided by Oracle - OBE Example

Installing Oracle Access Manager: Identity Server and WebPass

Installing Oracle Access Manager: Policy Manager, Access Server, and WebGate

http://www.oracle.com/technology/obe/fusion_middleware/im1014/ovd-oam/oam-ovd/install_oam2/install_oam2.htm


Posted by at