Oracle Access Management

Ranjan.. We will be supporting OAM 10g Plugin fea...

2011-05-16T16:53:53.988-07:00

Ranjan..

We will be supporting OAM 10g Plugin feature in the upcoming releases..

I really cannot say right now it will be a OOTB feature as requirements varies from one customer to another..

Don, I believe you are referring to when the use...

2011-05-15T22:56:19.145-07:00

Don,

I believe you are referring to when the user closes the browser without clicking on logout link..

In OAM11g we have a max session timeout property and default is something like 8 sessions..You can configure this to a smaller value.

Hi Derick, So using this web service 11g feature t...

2011-05-13T12:48:31.791-07:00

Hi Derick,
So using this web service 11g feature to support my non-browser clients which can only pass base64 authorization headers to the webgate to do the authentication? These clients cannot handle the cookies and would be passing this Az header with every request.

We've done customization in 10g to support this by writing a web server plug-in but would like to leverage the out-of-the-box feature without taking this custom piece along with 11g upgrade.

Looking forward for your comments.

I found the post interesting but at the end I was ...

2011-05-13T12:43:21.237-07:00

I found the post interesting but at the end I was a bit disappointed that you are still not using a complete OAM 11g solution. The other question I have is have you taken in to consideration how you are going to provide a logout solution? Using the 11g webgate plugin with OHS as a reverse proxy was a bit of a challenge understanding how to create a logout to destroy and inactivate the user session. If you don't take that in to consideration you need to make sure that your user doesn't create too many sessions and exceed the number defined in OAM.

Suneetha, I would definitely recommend taking a l...

2011-05-10T08:03:00.423-07:00

Suneetha,

I would definitely recommend taking a look at the Fusion Middleware Security Guide, which covers topics like how SSO integrates with applications running on WLS/FMW.

You can find this guide here:
http://download.oracle.com/docs/cd/E21764_01/core.1111/e10043/toc.htm

Additionally, take a look at the OAM 11g Admin guide. There is a section on integrating ADF applications with OAM 11g SSO, which should give you a sense of the general integration pattern for JEE or .NET applications. You can find this section here:

http://download.oracle.com/docs/cd/E21764_01/doc.1111/e15478/opssadf.htm#BDCDHDEC

We didn't cover this in the post in detail, but you can think about this as two step process: 1) identifying/authenticating the user and 2) asserting the user's identity to the application.

In the first step, you will capture information about the original request so that you can redirect the user back to the originally requested resource once authentication successfully completes.

Typically step #2 is how you identify the user to the application, and this is usually done by asserting the identity in an HTTP Header.

Now if you want to have some synchronicity between OAM managed sessions and application sessions, you will need some infrastructure - such as Oracle Platform Security Services - to bridge between things managed in the application's context and things managed outside of the app context. This configuration is explained in detail in the ADF-OAM integration section of the docs I mention above.

Thanks for the feedback on the samples. We will look at including some additional samples/examples with the product to make this easier to understand.

If a simple J2EE or .Net Web Application participa...

2011-05-02T09:14:32.811-07:00

If a simple J2EE or .Net Web Application participates in a OAM11g based SSO solution (with Webgate, AuthN and AuthZ policies all set)...

1) how will this application know which user has logged in to OAM in order to be able to create its own application session so it can keep track of user's activities/data etc.

2) with every request being redirected by Webgate to OAM Server back to Webgate and then back to the application, does it have any impact on the request parameters/attributes present in the original request submitted by the user's browser. How are request/page attributes etc kept intact and made available to the application?

3) with OAM server being the session manager (handling user's session life cycle) when the user's session is destroyed in OAM Server due to reasons like idle timeout or hard-timeout how will the application know that it has to destroy the session on its end?

Is there a document explaining with examples how this integration works. It will be nice if the product comes with some samples and code to clearly demonstrate integration of OAM with web applications developed on different platforms/languages and best practices around using the different response types (Header, Cookie, Session) and when to use AuthN responses vs Authz responses.

Is 11g going to give me a functionality to create ...

2011-04-22T10:36:27.759-07:00

Is 11g going to give me a functionality to create cookies for multiple domains instead of just one as in 10g? And if yes, then will I have the flexibility to allow SSO between these cross-DC cookies. I'm not referring to federation here.

Thanks
Ranjan

Ranjan, Chris did a great job of providing a more...

2011-04-13T12:15:51.135-07:00

Ranjan,

Chris did a great job of providing a more detailed flow on the Fusion Security Blog:
http://fusionsecurity.blogspot.com/2011/04/oam-11g-single-sign-on-and-oam-11g.html

To briefly summarize, OAM 11g manages sessions through the combination of a server side session object (stored in a Coherence cache), a server side authentication token called OAM_ID, and a resource based session cookie called OAM_AuthnCookie which is set by the Webgate and is scoped to the host where that Webgate is configured. (That is, if you are using 11g Webgates. If you are using 10g Webgates then the resource session cookie is the ObSSOCookie, which is domain scoped.)

The idea is to make it more difficult to get at all the bits of data someone would need to replay another user's session and to limit the scope of damage in the event that someone does replay a resource session cookie.

As explained elsewhere (and far more eloquently that I could), the best way to protect against HTTP session hijacking is to require SSL/TLS or other mechanisms to properly encrypt/verify traffic.

Hi Eric, With 11g, there are quite many changes in...

2011-04-12T10:01:37.654-07:00

Hi Eric,
With 11g, there are quite many changes in the way cookie handling is done and the security around it. So, are we saying that tools like Firesheep would have a tough time in hijacking / re-using OAM cookie for a non-HTTPS request?

Thanks
Ranjan

Wilfred - This certification is complete. As of th...

2011-03-28T08:09:33.082-07:00

Wilfred - This certification is complete. As of the Oracle Fusion Middleware 11gR1 PS3 release, Oracle Forms is certified with OAM 11g. We also have the migration utilities and processes documented. You can choose upgrade or a coexistence model. Check out the FMW upgrade guide for IDM:
http://download.oracle.com/docs/cd/E17904_01/upgrade.1111/e10129/toc.htm

Would love to make the switch from 10.1.4 SSO to O...

2011-03-24T00:37:19.378-07:00

Would love to make the switch from 10.1.4 SSO to OAM 11, but still waiting for Oracle Forms support. Any news on an ETA?

Very informative. A nice Read !!

2011-03-23T00:13:34.266-07:00

Very informative. A nice Read !!

Eric, Great blog. One quick comment on #4 in the...

2011-03-22T10:21:29.690-07:00

Eric,

Great blog.
One quick comment on #4 in the SSO flow: Should we also mention that additional attributes can be added to the Session Cookie as well, along with the HTTP header?

-Shesh