Looks like it’s time to start planning for the IDM conference season. There are some great conferences planned and I need to figure out how to start budgeting for some of these. Let me know if I have missed any conferences that should be listed.
March:
May:
June:
July:
September:
December:
So, this is not my “typical” IDM post but I wanted to save this for my own future reference.
Scenario:
Working from Mac OS X desktop and connecting to an EC2 (Redhat) instance over SSH. I am installing and configuring Symfony which requires (strongly desires) that you connect to the config.php script from localhost (127.0.0.1).
Options:
1.) Modify PHP script to comment out the localhost checks (boring)
2.) Create a SSH tunnel from Mac terminal to the web port on the EC2 instance
The first option is pretty obvious and requires basic skills. I am not sure what the ripple effects are with this so I’d prefer not to go this route.
The second option earns more “skillz” points and doesn’t require you to modify the config.php file, from Symfony. Note: Originally, I was using port 81 as the local port. I changed the local port to 1337 vs 81. Chris (see comments) made an excellent point that you don’t need to use sudo if your local port is higher than 1024.
Steps:
1. Open Terminal Window from OS X desktop
2. Type: ssh -i mykey.pem -L 1337:am.acme.com:80 am.acme.com
So what did we do here:
ssh -i mykey.pem: connect to remote server using ssh with the key that you use to connect to Amazon instance (you do use keys right??)
-L 1337:am.acme.com:80: Local port (on OS X) will be 1337 and map that port to 80 on the EC2 instance URL am.acme.com
am.acme.com: this is the remote (EC2 instance) hostname
3. The first time you connect to this server you will be asked to add this host to your known hosts file (say yes)
4. Open a web browser (from OS X) and enter “127.0.0.1:1337/Symfony/web/config.php” to connect to the Symfony config on the EC2 instance
As long as you keep the SSH connection open then you can use the tunnel. To close the tunnel, just exit from the SSH session.
I just finished configuring Oracle Access Manager (OAM) for Common Access Card (CAC) authentication integrated with Axway’s Server Validator (SV)Plugin ( I will blog about this in another post ) for certificate validation. While discussing this with another engineer on the project he mentioned that this really opened the door for tightly integrating with a lot of their existing partners. I said that while this is great I would prefer to federate with these partners and not have to deal with managing the extra infrastructure components as well has having to manage several trusted certificates provided by the partners (with intermediate certificates there were about 6 just for this partner alone … I am trying to picture how that scales for each new partner). I freely admit that I am biased towards Federation. I am totally sold-out on the benefits of having the Identity Provider (IdP) take care of credentialing and authentication and the Service Provider (SP) can focus on the applications. His point in preferring to authenticate locally with CAC (vs via Federation) was that by doing so we somehow offer a better user experience. I think you can also make the argument that a particular, potential IdP maybe not have Federation capabilities (this won’t always be the case IMO). Do you think that you can achieve the same Level of Assurance (LoA) by using Federation instead of authenticating at the SP? (SAML, OpenID or OpenID Connect)
I’d like to crowd-source this discussion and see if we can put together some good arguments for/against either side. Please RT and comment if you have thoughts/opinions on this.
I just got this from my friends at OptimalIDM and wanted to share this news.
OptimalIDM is formally announcing their Virtual Identity Server for Office 365 via a press release at 9:00 a.m. this morning.
VIS for Office 365 adds a ton of features and support to Office 365 such as:
OptimalIDM is demonstrating this at a Lunch presentation on TUESDAY at TEC.
I needed to import a group of users, into Oracle Internet Directory (OID) with attributes in a variety of backend data stores. I used Oracle Virtual Directory to virtualize the data stores into a single ldap view. I used the OVD adapter configuration to specify which attributes I wanted returned. I then exported using the export control from Apache Directory Studio. This resulted in an ldif file containing all of the records I needed with attributes. There were a few additional attributes as a result of using OVD that I now had to deal with.
I ended up with an ldif file that contained a lot of records like this:
dn: cn=Babs Jensen@ACME.GOV,ou=temp_user_load
objectclass: inetOrgPerson
objectclass: organizationalPerson
objectclass: person
objectclass: top
cn: 1234556677@ACME.GOV
cn: Babs.Jensen@ACME.gov
cn: Jensen, Babs
sn: Jensen
givenName: Babs
mail: BABS.JENSEN@ACME.GOV
vdejoindn: ou=acmeinfo_temp:cn=JENSEN\,BABS,ou=acmeinfo_temp
vdejoindn: AD_temp:CN=babs.jensen@ACME.GOV,OU=locations,OU=park,ou=ad_t
emp,dc=acme,dc=local
fascnDecoded: 1234567890987654321
guid: ABcdedghi1234567890
ssn: 12345678
…
Note: With the SED command you can make changes directly to the source file but I am creating a new target file with each change I can make so that I can always revert back if the command doesn’t work exactly the way I want it to.
I wanted to get rid of lines that don’t start with an attribute name (In my case I am free to get rid of lines that carry over into the second line … YMMV)
I also wanted to specifically wanted to get rid of all lines that start with “vdejoindn:” and there are also some vdejoindn lines that overrun onto a second line that won’t beremoved if I use sed to remove lines with the pattern matching vdejoindn:.
So, first I want to remove all lines that don’t contain a colon. This removes the overrun lines but also all blank lines.
$ sed ‘/:/!d’ input.ldif > tmp.ldif
this keeps the lines with a colon.
But now we don’t have breaks between the records
$ sed ‘s/^dn:/\n&/g’ tmp.ldif > tmp2.ldif
Ok, now I want to get rid of the lines that have “vdejoindn:”.
$ sed ‘/vdejoindn:/d’ tmp2.ldif > tmp3.ldif
Now at some point I ended up with “^M” at the end of each file … I don’t know if this is because I opened with VIM in Windows before moving to Linux … I am going to assume so but either way in this instance I want to remove these characters.
$ dos2unix tmp3.ldif > tmp4.ldif
Alright, Now, for me to import this into Oracle Internet Directory (OID) I’ll need to add the “changetype” directive. I am going to add the string “changetype: add” on a new line after each line with “ou=temp_user_load:” which is the temporary suffix I used in this export.
$ sed ‘/ou=temp_user_load/ a\changetype: add’ tmp4.ldif > tmp5.ldif
Now, should be the last step, prior to importing, is to correct the entries “DN” attribute. Essentially, we need to replace “ou=temp_user_load” with the correct suffix for where these users will be created.
$ sed ‘s/ou=temp_user_load/cn=Users,o=icam,dc=acme,dc=local/g’ tmp5.ldif > tmp6.ldif
At this point my ldif file (“tmp6.ldif”) is ready to import into my directory. You can use the ldapmodify command or since I am using OID you can use bulkload (which is recommended for large record sets).
I have an Oracle Identity 11g environment running on VirtualBox 4.0. This is a development environment that I use to test out various installations and configurations. I noticed the other day that I wasn’t able to start the Oracle Internet Directory (OID) instance.
When I checked the log file I can see that I am not able to connect to the Database. By the way, the log that is referenced doesn’t show anything of value. The log that actually contained the error is called: oidmon-0000.log
According to ora-code.com ora-28000 the error means that the user account that is connecting to the database ‘ODS’ is locked.
ORA-28000:
the account is locked Cause: The user has entered wrong password consequently for maximum number of times specified by the user’s profile parameter FAILED_LOGIN_ATTEMPTS, or the DBA has locked the account Action: Wait for PASSWORD_LOCK_TIME or contact DBA
It’s typically trivial to unlock an account from the sqlplus command line
So, we should be good now. I will try to start the process again.
But now my log shows
So, now I am getting an ORA-01017 error. Which means “Invalid username/password”. So, it seems that the Database doesn’t like the password that OID is supplying to connect to the ODS schema.
I’ll use SQL Developer to try and connect to the database with the ODS user
Interesting, SQL Developer is showing an ORA-28000 error.
Let’s try connecting using SQLPlus …
So, it seems we have a consensus (and yes, I did just include my password in the screenshot … it doesn’t matter)
Let’s see what the database has to say about this user. Make sure you reconnect to the DB as oracle.
Ok, didn’t we just unlock it? Let’s try again …
So, now what is the status?
Hey! This is good right? … the account seems to be open again.
So, let’s try to start OID again.
Ok, this is looking pretty ugly right about now…
… and the account is locked again. So, let’s see if we can figure out why this is happening.
Maybe the wallet that holds the ODS password for OID has become corrupt. We can recreate it using oidpasswd.
Note: Before you run oidpasswd it’s important to have your Oracle environment set up correctly. Here is what I am using (yours may vary):
ORACLE_SID=orcl
ORACLE_BASE=/opt/oracle
ORACLE_INSTANCE=/opt/oracle/Middleware/asisnt_1
ORACLE_HOME=/opt/oracle/Middleware/Oracle_IDM1
MW_HOME=/opt/oracle/Middleware
Now with this output … I have verified the location of the tnsnames.ora file and the information in it … so I am going to assume for the moment that the issue is with the password (at least until I prove otherwise).
Typically, changing the password will unlock the account
But here we are and the account is still locked.
… I am spending some time just fishing around on the Internet and looking around at my system
Wait a second … I wasn’t even thinking about ODSSM …
Change the ODSSM’s password and then unlock ODS.
So, both accounts should now be “OPEN”
Now restart the OIDMON process
What does the log say
Completely different error this time. At least I feel like we are making some progress …
hmmm … if the wallet can’t be read … maybe we can recreate the wallet. Let’s re-run the “create wallet” command that we tried earlier.
Hey! … it was successful this time. So, let’s try starting the OID processes
That was successful!
Now to check the status of the OPMN Processes
All of the OID related processes are now Alive. The ohs1 process is down because I turned it off earlier.
We installed Oracle Identity Federation (OIF) 11.1.1.2 a few months ago and had to move on to some other, more pressing IDM-related issues. We finally came back to the Federation tasks at the beginning of September. The first thing I did was take an inventory of where we left off and compared to what the current released version was from Oracle. I found that we were now a version behind with both Weblogic Server (WLS) and OIF. I initially put off upgrading because we were in a hurry to integrate with one of their business partners. We were able to configure the Circle of Trust with the Relying Party (RP, aka Service Provider) with just a few issues. This particular partner is using OpenSAML as their software of choice. The only issue for us is that they didn’t (or don’t) create metadata files. This is their choice because OpenSAML has a module for doing this. The metadata files is a feature in SAML 2.0 that allows for easy (…easier) integration with your Federation partners. I was able to create one manually for them by using the sp.xml file that was created when using the OpenSSO Fedlet (that’s for another post).
So, finally on to the point of this post. The only issues that we have had with OIF 11.1.1.2 is that when trying to search for local users (we are using OVD as our User Data Store … OVD front’s two different AD instances) we have some issues with the search function and not all users can authenticate. Yes, this is actually a major problem.
I noticed via http://support.oracle.com that there are a lot of patches available for 11.1.1.2. I ended up downloading the 11.1.1.3 version from OTN (here).
(Note: I talked to my contact at Oracle Support who said that 11.1.1.4 is coming very soon)
This version requires that Weblogic be at least 10.1.3. I went back to the support site and downloaded the 10.1.3 patch from there. It’s a jar file that is run and will open up as an OUI installer. I found this site which I used as a guide. It’s pretty simple and painless. Make sure that you restart WLS after upgrading and before upgrading OIF. When the OIF upgrade is complete you should restart the managed service.
After restarting OIF I noticed in Enterprise Manager (EM) that OIF is still displaying as 11.1.1.2. I am running the Upgrade Assistant (Oracle_Home/bin/ua). On the second screen you can select “Verify Instance”. This will walk you through and verify that your OIF instance is upgraded to the correct version. In my case the status is showing as “Failed”. One thing that seems odd to me is that the port shown (on the error message) is 7499. It looks like it’s trying to access the URL to the metadata file and is trying to go on 7499. (i.e., http://hostname:7499/fed/idp/metadata). I can get to the file via 7777 and not 7499. So, I’ll need to check later as to why the Upgrade Assistant is using that port.
I just tried to re-run the 11.1.1.3 patch installer. It complained that the patch had already been applied to this Oracle_Home. So, now I am perplexed. Let’s try rebooting the box and restarting the WLS and OIF services.
Interestingly, after the reboot the OIF version is still showing as 11.1.1.2 … but my OIF LDAP Authentication Engine error is no longer occurring. So, maybe it did get patched?? I am working on confirming this … maybe the version number doesn’t get updated? … that doesn’t sound right though.
Brad Tumy 