Integrating 11g Oracle Identity & Access Management with Oracle EBS

Pre-requisites :

• Enterprise Linux 5.8 64 bit
• Oracle Database 11.2.0.1
• RCU for OID 11.1.1.7
• OID 11.1.1.7
• RCU for OAM 11.1.2.2
• OAM 11.1.2.2
• WebTier OHS 11.1.1.7
• WebGate 11.1.2.2

1. Install 11gr2 Database (11.2.0.1)
2. Ensure that all of the processes are running for the database (into which you plan to install Oracle Internet Directory).
3. Before running RCU 11.1.1.7.0, ensure that the database initialization parameter ‘Open_Cursors’ is set to a minimum of ‘500’.
4. Run RCU 11.1.1.7.0 to create the necessary database schema: In the ‘Select Component’ page: Expand ‘Identity Management’ and select only ‘Oracle Internet Directory’ (‘Oracle Identity Federation’ is not required)
5. Install RCU 11.1.1.7

Install WebLogic Server 10.3.6 (Full Installer)
(Later, you will also install an Oracle Identity Management Oracle home inside this Oracle Middleware home).
Download Java 6 Update 35 or later
Export JAVA Home

Install and Configure the Identity Management Products and Create a WebLogic Domain and Managed Server

During the configuration, in the ‘Configure Components’ screen:

• Select Oracle Internet Directory and Oracle Directory Integration Platform (the Oracle Directory Services Manager and Fusion Middleware Control management components are automatically selected for this installation):

(i.e. UNSELECT ‘Oracle Identity Federation Components’ and UNSELECT ‘Oracle Virtual Directory’)

• Ensure that only ‘Oracle Internet Directory’ and ‘Oracle Directory Integration Platform’ are selected and click Next.

• In the ‘Installation Summary’ screen, ensure that only the following are in the list of ‘Applications Selected for Configuration’:

a. Oracle Internet Directory

b. Oracle Directory Integration Platform

c. Enterprise Manager

d. Oracle Directory Services Manager

e. Click the ‘Configure’

Enforce Attribute Uniqueness for UID in Oracle Internet Directory 11gR1
Invoke Oracle Directory Services Manager and connect to the Oracle Internet Directory server.
http://egtapp02:7001/odsm
(determine the port by examining the wls_ods1.url file at $MW_Home/user_projects/domains//servers/wls_ods1/data/nodemanager/wls_ods1.url)

Click on the ‘Advanced’ tab

Expand ‘Attribute Uniqueness’ in the left pane (bottom of the left frame)

Click on the left hand ‘Create an attribute uniqueness constraint’ icon (below the ‘Attribute Uniqueness’ heading.

The New Constraint window is displayed.

Enter the following values to ensure that the UID field is unique in Oracle Internet Directory:

Enter ‘UID_UNIQUE’ in ‘Attribute Uniqueness Constraint Name’
Ensure that ‘Enable Unique Attribute’ is Checked (i.e. Yes)
Enter ‘uid’ in ‘Unique Attribute Name’
Enter ‘ inetorgperson’ in ‘ Unique Attribute Objectclass’
Select ‘One Level’ in ‘Unique Attribute Scope’
Enter the Realm Distinguished Name (DN), e.g. ‘cn=Users,dc=us,dc=oracle,dc=com’ in ‘Unique Attribute Subtree’

Choose OK. The entry you just created appears in the list of attribute uniqueness constraint entries in the left frame.

Click on the ‘UID_UNIQUE’ name in the left frame (below ‘Attribute Uniqueness’) and the record is displayed in the main frame.

Click the ‘Apply’ button to apply this constraint

Configure Oracle Internet Directory to return operational attributes
Configure Oracle Internet Directory to return operational attributes for lookup requests. This modification adds the orclguid attribute to records returned by Oracle Internet Directory when queried by Oracle Access Manager, allowing these records to be mapped to others that are uniquely identified by orclguid. To make this modification create an ldif file as detailed below and execute this command from the Oracle Home where Oracle Internet Directory is installed:
Create an ldif file (for example ‘change_attrs.ldif’) containing the following:

vi change_attrs.ldif
dn: cn=dsaconfig, cn=configsets,cn=oracle internet directory
changetype: modify
add: orclallattrstodn
orclallattrstodn: orcladmin

Run the following to execute the command from the newly created ldif file:

$ORACLE_HOME/bin/ldapmodify -h egtapp02.ods.local -p 3060 -D cn=orcladmin -w Oracle_123 -v -f change_attrs.ldif

Install Oracle Access Manager
Configure OAM Schema using RCU 11.1.2.2

Install Oracle Access Manager 11.1.2.2

Configure OAM Domain

Configure Security Store for OAM Domain to Database
Create DB security store – Mandatory step to start Admin Server for OAM server.
Configure OAM Domain to use database as security store using –m create option like

$DOMAIN_HOME/bin/setDomainEnv.sh
cd $MW_HOME/oracle_common/common/bin
./wlst.sh /u01/weblogic/fmw/Oracle_IAM1/common/tools/configureSecurityStore.py -p /u01/weblogic/fmw/user_projects/domains/IAMDomain/ -c IAM -m create -p Oracle_123

Upgrade OPSS schema

\

Create boot.properties to start WebLogic Administration and Managed Server

mkdir -p /u01/weblogic/fmw/user_projects/domains/IAMDomain/servers/oam_server1/security

vi boot.properties
username=weblogic
password=Oracle_123

Create boot.properties for Admin Server

mkdir -p /u01/weblogic/fmw/user_projects/domains/IAMDomain/servers/AdminServer/security

vi boot.properties
username=weblogic
password=Oracle_123

Start Weblogic Admin server and managed server(oam_server1)

tail -f nohup.out

tail -f nohup.out

Configure Identity Store
Oracle E-Business Suite requires Oracle Internet Directory as the identity store. To setup Oracle Internet Directory as the identity store for Oracle E-Business Suite create a dedicated Oracle Internet Directory identity store for Oracle E-Business Suite
Logon to the OAM Console
http://egtapp02:7002/oamconsole

Create User Identity Store
In the OAM Console, under the Launch Pad, navigate to Configuration > User Identity Stores
Click the “*” (Create) icon under the ‘OAM ID Stores’
In the window that opens, enter the attributes for your new identity store, for example:

Store Name- EBSIdStore
Store Type- OID: Oracle Internet Directory
Description- Directory for Oracle E-Business Suite Application
Location- egtapp02:3060
Bind DN- cn=orcladmin
Password- Oracle_123
User Name Attribute- uid
User Search Base- cn=Users,dc=ods,dc=local
Group Search Base- cn=Groups,dc=com

Create Authentication Module
In the OAM Console, under the Launch Pad, navigate to Access Manager –> Authentication Modules
Click the “*” (Create Authentication Module) icon > Select ‘Create LDAP Authentication Module’ from the drop-down:
Enter the following information in the Create LDAP Authentication Module region, and click Apply:
Name = LDAP_EBS
User Identity Store = EBSIdStore

Create Authentication Scheme
In the OAM Console, under the Launch Pad, navigate to Access Manager >
Authentication Schemes

Click the “*” (Create Authentication Scheme) icon.

Enter the following information in the Authentication Schemes region, and click Apply:

Name = EBSAuthScheme
Description = Authentication Scheme for E-Business Suite
Authentication Level = 2
Default =
Challenge Method = FORM
Challenge Redirect URL = /oam/server/
Authentication Module = LDAP_EBS
Challenge URL = /pages/login.jsp
Context Type = default
Context Value = /

Registering Oracle E-Business Suite Release 12 with Oracle Internet Directory 11gR1
Oracle E-Business Suite is required to integrate with OID so that users can be synchronized
between FND_USER (in e-Business Suite) and users in OID. EBS-OID synchronization can be
configured in one of following four ways
a) OID to EBS: Users are synchronized from OID to E-Business Suite
b) EBS to OID: User are synchronized from E-Business Suite to OID
c) EBS to OID and OID to EBS two way: User are synchronized two way i.e. from OID to
E-Business Suite and E-Business Suite to OID
d) Bi-Directional but no creation: User are synchronized two way i.e. from OID to E-Business Suite and E-Business Suite to OID but if user is missing in one of the two systems them it will not be created.

EBS version apply following additional patches for 12.1.1 version on EBS Middle Tier

Patch 7651166 and 12408233

Register Instance

$FND_TOP/bin/txkrun.pl -script=SetSSOReg -registerinstance=yes -infradbhost=egtapp02 -ldapport=3060 -ldapportssl=3061 -ldaphost=egtapp02 -oidadminuser=cn=orcladmin -oidadminuserpass=Oracle_123 -appspass=apps

Register OID

$FND_TOP/bin/txkrun.pl -script=SetSSOReg -registeroid=yes -ldaphost=egtapp02 -ldapport=3060 -oidadminuser=cn=orcladmin -oidadminuserpass=Oracle_123 -appspass=apps -instpass=Oracle_123 -appname=VIS -svcname=VIS -provisiontype=1 -dbldapauthlevel=0

SELECT PREFERENCE_NAME, PREFERENCE_VALUE FROM APPS.FND_USER_PREFERENCES WHERE MODULE_NAME='LDAP_SYNCH';
SELECT * FROM fnd_user_preferences WHERE user_name='#INTERNAL' AND module_name='OID_CONF';

If the above script returns no rows then execute the below statement and re-check

execute fnd_oid_plug.setPlugin;

Install and Configure WebGate on the WebTierRun the WebGate 11g Installer to install WebGate 11g.

Execute deployWebgateInstance.sh and EditHttpConf to associate WebGate with the WebTier, for example

Run the WebTier 11g Installer to install and configure Oracle HTTP Server.

Install OHS WebTier 11.1.1.7

Install OAM WebGate 11.1.2.2

Deploy Webgate
Set OHS environment

cd /u01/weblogic/fmw/Oracle_OAMWebGate1/webgate/ohs/tools/deployWebGate

./deployWebGateInstance.sh -w /u01/weblogic/fmw/Oracle_WT1/instances/instance1/config/OHS/ohs1 -oh /u01/weblogic/fmw/Oracle_OAMWebGate1

Set LD_LIBRARY_PATH

Register the WebGate Agent with Oracle Access Manager

After installing the WebGate on the WebTier, you also need to register the WebGate agent.

Follow the steps below to register the WebGate agent on the machine where Oracle Access Manager is installed using the oamreg tool that is available in the <Oracle_IAM>/oam/server/rreg directory:

. oam.env

cd $MW_HOME/iam/oam/server/rreg/input/

cp OAM11GRequest_short.xml VIS.xml

Create a new file named VIS.oam.conf to serve as URIs file to the oamreg tool.

./bin/oamreg.sh inband input/VIS.xml

When prompted for the admin username and password, enter the credentials for your Oracle Access Manager Administrator, by default user “weblogic”.

You may optionally set a password for your WebGate.

When prompted “Do you want to import an URIs file?(y/n)”, enter “y”.

Enter the full path for the URIs file that you just created as <RREG_Home>/input/VIS.oam.conf.

The script will output Success INFO messages and should complete successfully with a Request summary..

Copy the generated registration artifacts to your WebTier

Verify registration using OAM Console

Logon to the OAM Console

Verify that the following artifacts are visible now in the OAM Console, under Launch Pad:.

Access Manager section > Click on SSO Agents > Under Webgates tab > Search for {Identifier for your WebGate}

Access Manager section > Click on Host Identifiers > Search for {Identifier for your WebGate}

Access Manager section > Click on Application Domains > Search for {Identifier for your WebGate}

Test WebGate

Access a public resource

Access a protected resource

http://egtapp02:7780/index.html

You should be redirected to OAM login page

http://egtapp02:14100/oam/server/obrareq.cgi?

Set Authentication Scheme

Login to OAM Console à Application Domains à VIS_agent à Authentication Policies à Protected Resource Policy

Change Authentication Scheme to EBSAuthScheme

Configure Response Headers

Oracle E-Business Suite integration with Oracle Access Manager uses two specific response headers. Configure Oracle Access Manager to set these response headers as follows.

Add Response Headers to the Authentication Policies

In the OAM Console,under the Launch Pad, navigate to Access Manager > Application Domain > VIS_agent > Authentication Policies > Protected Resource Policy.

Click the Protected Resource Policy.

In the Authentication Policy configuration window, click on the Responses tab. Use the “+” icon and add the following two rows.

Add Response Headers to the Authorization Policies

In the OAM Console,under the Launch Pad, navigate to Access Manager > Application Domain > VIS_agent > Authorization Policies > Protected Resource Policy.

Click the Protected Resource Policy.

In the Authentication Policy configuration window, click on the Responses tab. Use the “+” icon and add the following two rows.

Test Response Headers

Test that Oracle Access Manager sets the response headers as specified, for example by adding the printenv script to your protected resources and accessing the script from your browser as authenticated user. On a WebTier 11g, you will find the printenv script in your $ORACLE_INSTANCE/config/OHS/ohs1/cgi-bin directory.

You may create a symbolic link and add this resource to your protected resources. For example:

cd $ORACLE_INSTANCE/config/OHS/ohs1/htdocs ln -s ../cgi-bin cgi-bin chmod 755 cgi-bin/printenv

In the OAM Console,under the Launch Pad, navigate to Access Manager > Application Domain > Search for {Identifier for your WebGate} > Resources tab.

Click the “New Resource” button at the upper right hand side of the window.

Enter the following information in the Create Resource region, and click Apply:

Configure OAM to support long URLs

Long URLs may exceed a cookie limit on your Internet browser. Configure Oracle Access Manager to support long URLs by changing the serverRequestCacheType from COOKIE to FORM in Oracle Access Manager configuration file $DOMAIN_HOME/config/fmwconfig/oam-config.xml:

<Setting Name=”serverRequestCacheType” Type=”xsd:string”>FORM</Setting>

Restart Admin and Managed server to pickup the new changes

Create WebLogic Domain for Oracle E-Business Suite AccessGate

cd $WLHOME/common/bin ./config.sh

Download and extract Oracle E-Business Suite AccessGate

Download Oracle E-Business Suite AccessGate available from Patch 18131618 and unzip it to $MW_HOME/appsutil/accessgate/VIS. For example:

mkdir -p $MW_HOME/appsutil/accessgate/myEBS cd $MW_HOME/appsutil/accessgate/myEBS unzip [location to patch 18131618]/p18131618_R12_GENERIC.zip

Copy oacleanup.html to WebTier

Copy the samplecleanup.html from $MW_HOME/appsutil/accessgate/VIS/sample to the /public directory that you created on your WebTier and rename the file to oacleanup.html.

$ORACLE_INSTANCE/config/OHS/ohs1/htdocs/public/oacleanup.html

Access the page from your browser:

http://egtapp02:7780/public/oacleanup.html

You should be able to access this test page without authentication, because we specified this page in the URIs file during WebGate registration with Oracle Access Manager as public resource. At this point you will only see an empty page. We will use this URL when deploying E-Business Suite AccessGate in the next step.

Copy library

Copy the file $MW_HOME/appsutil/accessgate/{instance}/fndext.jar to your $DOMAIN_HOME/lib directory. For example:

cd $MW_HOME/appsutil/accessgate/myEBS cp fndext.jar /d01/Oracle/Middleware/user_projects/domains/eag_domain/lib

Restart the Oracle WebLogic Server processes. This allows the Oracle WebLogic Server to include fndext.jar on the classpath during startup.

Generate DBC file

Login to Oracle EBS Machine (VIS) and generate a dbc file using below command

java oracle.apps.fnd.security.AdminDesktop apps/<apps password> CREATE \ NODE_NAME=eaghost.example.com [IP_ADDRESS=<IP address of external application server>] DBC=$FND_SECURE/VIS.dbc

Set Up Necessary Oracle E-Business Suite Users

Set up a necessary Oracle E-Business Suite user with role UMX|APPS Schema Connect, logon locally to Oracle E-Business Suite as the user with role UMX|Apps Schema Connect.

http://<ebshost>.<domain>:<port>/OA_HTML/AppsLocalLogin.jsp

If this user has just been created, you will be prompted on logon to Oracle E-Business Suite to reset the password. Reset the password.

Verify that you can successfully logon locally with the new password as the user with role UMX|Apps Schema Connect.

Deploy Oracle E-Business Suite AccessGate using txkEBSAuth.xml

Navigate to System Administrator Responsibility aàSecurity : Usersà Define

Username- EBSADMIN
Password- Password1
Description- E-business AccessGate User

Switch to User Management Responsibilty àUsers

Search for “EBSADMIN” user and click Update

On Update User screen, click Assign Roles

On next screen , select Role from drop down and search for “APPS%SCHEMA%”

Select the “APPS SCHEMA CONNECT ROLE”

Click Save

On Next Screen, give justification for user as shown below and click Apply

After setting up the user, logon locally to Oracle E-Business Suite as the user with role UMX|Apps Schema Connect.

Deploy Oracle E-Business Suite AccessGate using txkEBSAuth.xml

Set the environment, for example:

. $MW_HOME/wlserver_10.3/server/bin/setWLSEnv.sh

Change to the directory where you installed Oracle E-Business Suite AccessGate in the previous step. For example:

cd $MW_HOME/appsutil/accessgate/VIS

Execute the txkEBSAuth.xml ant script to create your data source and deploy the Oracle E-Business Suite AccessGate Java application.

ant -f txkEBSAuth.xml \
-Dwlshosturl=egtapp02.qia.local:7041 \
-Dwlsuser=weblogic \
-Dwlspwd=Oracle_123 \
-DdataSourceName=VIS \
-DdataSourceJNDIName=jdbc/VIS \
-DasadminUser=EBSADMIN \
-DasadminPassword=Oracle_123 \
-DdbcFile=/u01/weblogic/fmw/appsutil/accessgate/VIS/VIS_EGTAPP02.ODS.LOCAL.dbc \
-DserverName=eag_server1 \
-DdeploymentName=ebsauth_VIS \
-DcontextRoot=/ebsauth_VIS \
-DfndauthWarFile=/u01/weblogic/fmw/appsutil/accessgate/VIS/fndauth.war \
-DplanPath=/u01/weblogic/fmw/appsutil/accessgate/VIS/plan/Plan.xml \
-DSSOServerRelease=11 \
-DSSOServerURL=http://egtapp02.ods.local:14100 \
-DWebgateLogoutURL=http://egtapp02.ods.local:7780/public/oacleanup.html \
-DlogConfigFile=/u01/weblogic/fmw/appsutil/accessgate/VIS/sample/logging.properties
echoOFF:
getDataSourceDetails:
[input] skipping input as property dataSourceName has already been set.
[input] skipping input as property dataSourceJNDIName has already been set.
[input] skipping input as property dbcFile has already been set.
[input] skipping input as property asadminUser has already been set.
getASADMINPasswordWindows:
getASADMINPasswordUnix:
echoON:
[input] skipping input as property asadminPassword has already been set.
echoOFF:
getTargetServerDetails:
[input] skipping input as property serverName has already been set.
getDeploymentDetails:
[input] skipping input as property deploymentName has already been set.
[input] skipping input as property contextRoot has already been set.
[input] skipping input as property fndauthWarFile has already been set.
[input] skipping input as property planPath has already been set.
[input] skipping input as property dbcFile has already been set.
[input] skipping input as property dataSourceJNDIName has already been set.
getOAMDetails:
[input] skipping input as property WebgateLogoutURL has already been set.
[input] skipping input as property SSOServerRelease has already been set.
[input] skipping input as property SSOServerURL has already been set.
getAllParameters:
checkDBCExists:
checkWarExists:
checkFndextWarExits:
checkPlanDirExists:
all:
findOS:
getServerDetails:
[input] skipping input as property wlshosturl has already been set.
[input] skipping input as property wlsuser has already been set.
getWLSAdminPasswordWindows:
getWLSAdminPasswordUnix:
echoON:
[input] skipping input as property wlspwd has already been set.
echoOFF:
getDataSourceDetails:
[input] skipping input as property dataSourceName has already been set.
[input] skipping input as property dataSourceJNDIName has already been set.
[input] skipping input as property dbcFile has already been set.
[input] skipping input as property asadminUser has already been set.
getappsDBDetails:
[echo] DBC File is /u01/weblogic/fmw/appsutil/accessgate/VIS/VIS_EGTAPP02.QIA.LOCAL.dbc
[echo] APPS_JDBC_URL is APPS_JDBC_URL=jdbc\:oracle\:thin\:@(DESCRIPTION\=(ADDRESS_LIST\=(LOAD_BALANCE\=YES)(FAILOVER\=YES)(ADDRESS\=(PROTOCOL\=tcp)(HOST\=idm.ods.local)(PORT\=1525)))(CONNECT_DATA\=(SID\=VIS)))
[echo]
[echo] Following values are retrieved from DBC File:
[echo] SID/SERVICE:VIS
[echo] APPS_JDBC_URL:jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(LOAD_BALANCE=YES)(FAILOVER=YES)(ADDRESS=(PROTOCOL=tcp)(HOST=idm.ods.local)(PORT=1525)))(CONNECT_DATA=(SID=VIS)))
getASADMINPasswordWindows:
getASADMINPasswordUnix:
echoON:
[input] skipping input as property asadminPassword has already been set.
echoOFF:
getTargetServerDetails:
[input] skipping input as property serverName has already been set.
getDataSourceParameters:
checkDBCExists:
checkFndextWarExits:
createDataSource:
[echo] ********************************************************************
[echo] STEP 1: CREATING DATA SOURCE
[echo] ********************************************************************
[wlst] Connecting to server using username:weblogic url:egtapp02.ods.local:7041
[wlst] Connecting to t3://egtapp02.ods.local:7041 with userid weblogic ...
[wlst] Successfully connected to Admin Server 'AdminServer' that belongs to domain 'eag_domain'.
[wlst]
[wlst] Warning: An insecure protocol was used to connect to the
[wlst] server. To ensure on-the-wire security, the SSL port or
[wlst] Admin port should be used instead.
[wlst]
[wlst] Check if data source VIS already exits
[wlst]
[wlst]
[wlst] Check if JNDI Name jdbc/VIS already exists
[wlst]
[wlst] Changing to Edit Mode
[wlst] Location changed to edit tree. This is a writable tree with
[wlst] DomainMBean as the root. To make changes you will need to start
[wlst] an edit session via startEdit().
[wlst]
[wlst] For more help, use help(edit)
[wlst] You already have an edit session in progress and hence WLST will
[wlst] continue with your edit session.
[wlst]
[wlst] Starting an edit session ...
[wlst] Started edit session, please be sure to save and activate your
[wlst] changes once you are done.
[wlst]
[wlst] Creating data source : VIS
[wlst]
[wlst] Setting JDBCDataSourceParams for the data source VIS
[wlst]
[wlst] Setting JNDI name for the data source VIS
[wlst]
[wlst] Setting JDBCDriverParams for the data source VIS
[wlst]
[wlst] Setting User and dbcFile properties for the data source VIS
[wlst]
[wlst] Setting JDBCConnectionPoolParams for the data source VIS
[wlst]
[wlst] Setting GlobalTransactionsProtocol for the data source VIS
[wlst]
[wlst] Setting target for the data source VIS
[wlst]
[wlst] Saving all your changes ...
[wlst] Saved all your changes successfully.
[wlst] Activating all your changes, this may take a while ...
[wlst] The edit lock associated with this edit session is released
[wlst] once the activation is completed.
[wlst] Activation completed
[wlst] Successfully created data source VIS.
[wlst] Disconnected from weblogic server: AdminServer
findOS:
getServerDetails:
[input] skipping input as property wlshosturl has already been set.
[input] skipping input as property wlsuser has already been set.
getWLSAdminPasswordWindows:
getWLSAdminPasswordUnix:
echoON:
[input] skipping input as property wlspwd has already been set.
echoOFF:
getTargetServerDetails:
[input] skipping input as property serverName has already been set.
getDeploymentDetails:
[input] skipping input as property deploymentName has already been set.
[input] skipping input as property contextRoot has already been set.
[input] skipping input as property fndauthWarFile has already been set.
[input] skipping input as property planPath has already been set.
[input] skipping input as property dbcFile has already been set.
[input] skipping input as property dataSourceJNDIName has already been set.
getOAMDetails:
[input] skipping input as property WebgateLogoutURL has already been set.
[input] skipping input as property SSOServerRelease has already been set.
[input] skipping input as property SSOServerURL has already been set.
getDeploymentParameters:
checkWarExists:
checkDBCExists:
copyDeploymentPlan:
[echo] Copying fndauth_deployment_plan.tmp to /u01/weblogic/fmw/appsutil/accessgate/VIS/plan/Plan.xml
[copy] Copying 1 file to /u01/weblogic/fmw/appsutil/accessgate/VIS/plan
checkPlanDirExists:
creatPlandirAndWeblogicXML:
[touch] Creating /u01/weblogic/fmw/appsutil/accessgate/VIS/plan/plan/WEB-INF/weblogic.xml
checkPlanExists:
getAPPServerID:
updateDeploymentPlan:
[echo] Updating Deployment Plan
deployApplication:
[echo] ********************************************************************
[echo] STEP 2: DEPLOYING APPLICATION
[echo] ********************************************************************
[wlst] Connecting to server using username:weblogic url:egtapp02.ods.local:7041
[wlst]
[wlst] Connecting to t3://egtapp02.ods.local:7041 with userid weblogic ...
[wlst] Successfully connected to Admin Server 'AdminServer' that belongs to domain 'eag_domain'.
[wlst]
[wlst] Warning: An insecure protocol was used to connect to the
[wlst] server. To ensure on-the-wire security, the SSL port or
[wlst] Admin port should be used instead.
[wlst]
[wlst]
[wlst] Check if deployment ebsauth_VIS already exists.
[wlst]
[wlst] Location changed to serverRuntime tree. This is a read-only tree with ServerRuntimeMBean as the root.
[wlst] For more help, use help(serverRuntime)
[wlst]
[wlst]
[wlst]
[wlst]
[wlst] Deploying application to eag_server1
[wlst]
[wlst] Changing to Edit Mode
[wlst] Location changed to edit tree. This is a writable tree with
[wlst] DomainMBean as the root. To make changes you will need to start
[wlst] an edit session via startEdit().
[wlst]
[wlst] For more help, use help(edit)
[wlst]
[wlst] Starting an edit session ...
[wlst] Started edit session, please be sure to save and activate your
[wlst] changes once you are done.
[wlst] Deploying application from /u01/weblogic/fmw/appsutil/accessgate/VIS/fndauth.war to targets eag_server1 (upload=false) ...
[wlst]
[wlst] You have an edit session in progress, hence WLST will not
[wlst] block for your deployment to complete.
[wlst] Started the Deployment of Application. Please refer to the returned WLSTProgress object or variable LAST to track the status.
[wlst]
[wlst] Successfully deployed fndauth.war application.
[wlst]
[wlst] Saving all your changes ...
[wlst] Saved all your changes successfully.
[wlst] Activating all your changes, this may take a while ...
[wlst] The edit lock associated with this edit session is released
[wlst] once the activation is completed.
[wlst] Activation completed
[wlst] Disconnected from weblogic server: AdminServer
[wlst] &lt;WLContext.close() was called in a different thread than the one in which it was created.&gt;
BUILD SUCCESSFUL
Total time: 31 seconds

Create application like ebsauth_VIS which is visible under deployments in WebLogic Console

Verify Oracle E-Business Suite AccessGate deployment

Logon to WebLogic Administration Console, for example:

http://egtapp02:7041/console

In the WebLogic Administration Console, navigate to EAGdomain > Environment > Servers, and verify that the Oracle E-Business Suite AccessGate managed server “eag_server1” is running on the specified port, for example port 7043.

Navigate to EAGdomain > Deployments, and verify that the Oracle E-Business Suite AccessGate application named “ebsauth_VIS” is deployed, with State: Active and Health: OK.

Navigate to Services > DataSources, and verify that the DataSource that you created during deployment, for example “ebsDSVIS” exists, and is targeted to your managed server, for example eag_server1. Click on the data source to review its settings.

In the Connection Pool tab, observe it has the correct values for Properties user and dbcFile that you specified during deployment in parameters -DasadminUser and -DdbcFile respectively.

In the Monitoring tab, observe that the data source is enabled and running.

Verify that you can access following Oracle E-Business Suite AccessGate URL from your browser, for example:

http://egtapp02:7043/ebsauth_VIS/ssologout_callback

You should see an empty page at this point.

Redirect HTTP Server to WebLogic Server for Oracle E-Business Suite AccessGate

Configure the HTTP server on which WebGate is running to act as a proxy for authentication requests for Oracle E-Business Suite resources. After a request for authentication is successfully handled by WebGate, the request will be processed by the Oracle E-Business Suite AccessGate application that is deployed on your WebLogic Server instance.

If you are using Oracle HTTP Server 11g, you will find the configuration for the mod_weblogic plugin in the mod_wl_ohs.conf file, which is included in httpd.conf by default.

Modify the file and include the configuration to redirect HTTP server requests to your WebLogic Server. For example:

<IfModule mod_weblogic.c>
 WebLogicHost egtapp02.ods.local
 WebLogicPort 7043
 </IfModule>
 <Location /ebsauth_VIS>
 SetHandler weblogic-handler
 </Location>

Restart your HTTP Server.

Verify that you can access following Oracle E-Business Suite AccessGate resource via your HTTP server and WebGate from your browser, for example:

http://egtapp02:7780/ebsauth_VIS/ssologout_callback

You should be able to access this test page without authentication, because we specified the ssologout_callback resource in the URIs file during WebGate registration with Oracle Access Manager as public resource.

Your HTTP server will now act as a proxy and your Oracle E-Business Suite AccessGate application will process the request.

You should see an empty page at this point.

Set Oracle E-Business Suite profile options

Set the following Oracle E-Business Suite profile options.

Application Authenticate Agent (APPS_AUTH_AGENT)

Applications SSO Type (APPS_SSO)

Applications Single Sign On Hint Cookie Name (APPS_SSO_HINT_COOKIE_NAME)s

Stop and restart the applications services on your Oracle E-Business Suite middle tier. Then stop and restart the Oracle WebLogic Server where Oracle E-Business Suite AccessGate is deployed.

Test Single Sign-On with Oracle E-Business Suite

You have completed integrating Oracle E-Business Suite with Oracle Access Manager 11.1.2 using Oracle E-Business Suite AccessGate.

Test single sign-on integration now.

Logon to Oracle E-Business Suite

http://idm:8004/OA_HTML/AppsLogin

You will be re-directed to your OAM single sign-on page. Login using valid OID user credentials. After successful authentication, you will be re-directed to your Oracle E-Business Suite home page.