Showing posts with label Oracle Access Management. Show all posts
Showing posts with label Oracle Access Management. Show all posts

Wednesday, August 24, 2011

What's new in Oracle Access Management

Yesterday, as part of the IOUG education series, I did a webinar about layering enterprise security with Oracle Access Management components. We also spent some time explaining what's new in Oracle Access Management 11gR1 PS1 (11.1.1.5.0), released earlier this summer.

The replay will be available shortly, so check back soon.

We focused on a number of key themes for the PS1 release, including:
  • Single Platform to Secure Access to Data, Applications and WebServices
  • Centralized Session Management to deliver stronger security
  • Stronger methods of Authentication including OTP tokens, and KBA
  • Enhanced Manageability
    • Centralized Server and Agent Administration
    • Inline Diagnostics and Troubleshooting
One of the other cool things we did in this release was complementing the existing OAM services - authentication, SSO, and session management - with a new, integrated standards-based security token service.

This is a great example of how we layer functional products, like Oracle Access Manager and Oracle STS, on top of our modular, shared services architecture. We also centralized policy management and administration of the two products into a single console:






 


This integrated approach allows customer to deploy OAM and STS together, or to disable services that aren't required. For example customers that have already deployed a 3rd party authentication and SSO system and don't require OAM services can deploy Oracle STS with that 3rd party system.

In case it isn't obvious, deployment flexibility is another theme of the release.

We are pretty excited about some of the new features and will be posting on individual products in the release, including Oracle Access Manager, Oracle ESSO, and Oracle Adaptive Access Manager in upcoming blog posts.

Friday, May 13, 2011

OAM 11g Authentication as a Webservice

A bit advanced topic for those who want to dive deep into OAM..

Check out other good blogs from Eric and Chris to understand the nitty gritty of how SSO works

A common scenario for an access manager to fulfill authn/authz services is for a client to pass the necessary credentials to an agent and the agent in turn will pass the info to OAM via the http/OAP protocols. The agents used here are ofcourse the webgates and the accessgate. The webgate being specific to the webservers and the accessgate being the customized agent for the client application that may or may not have a webserver.
Now what happens if you are in a situation if the client does not have a webserver that oracle agents normally are compatible with. The client is left alone to use the accessgate that may involve lots of customization or he may just not use access manager as his solution.

What if there's a way if you could remove the clients webserver dependency on webgate/accessgate and yet provide a standard way of communicating to Oracle Access Manager.
The solution is using OAM as a webservice and yet the necessary mechanics for a successful OAM authentication still remains unchanged. In other words the agent(accessgate) is moved to the back-end probably remaining in the same box as the OAM or another box.

So what exactly drives the OAM authentication to trigger. The following diagram depicts the above scenario.

The request for a resource can be done in two ways

From a web client such as a browser




Or from a standalone client such as a java application



Note in both the above cases the client does not require any webgates/accessgate

Before I jump into the details of the above some of the soap features worth mentioning (of which some of you may be already aware of ) are
Soap
  1. Uses standard internet HTTP
  2. Uses XML to send and receive messages
  3. Platform independent
  4. Language independent
  5. A protocol for exchanging information in a decentralized and distributed environment
  6. Soap happens to be one of the key features of Microsoft's .Net Architecture especially, Web Services


Web services describes a standardized way of integrating Web-based applications using the XML, SOAP, WSDL and UDDI open standards over an Internet protocol backbone. XML is used to tag the data, SOAP is used to transfer the data, WSDL is used for describing the services available and UDDI is used for listing what services are available. Used primarily as a means for businesses to communicate with each other and with clients, Web services allow organisations to communicate data without intimate knowledge of each other's IT systems behind the firewall


Flow in a nut shell



  1. The client requests for a resource.
  2. The request is submitted to a proxy client which in turn makes a soap call to OAMAuthService which is a webservice.
  3. This service calls the OAM 10g ASDK API.
  4. The ASDK API invokes the accessgate (which is installed) to communicate to the OAM server .
  5. The OAM server performs authentication and passes an encrypted token back to the client.



Components

The components involved in the above architecture are

OAMServer: The emphasis here will be a OAM 11g server . That provides the authentication service

AccessGate: AccessGate is the building block for all webgates. Unlike webgates where it is always associated to a webserver an accessgate is used by standalone application or by a non web applications. say for eg a java program or an EJB or and C program etc. Accessgates are the only way to communicate with the OAM server

OAMAuthService: A java file that consists of the implementation APIs for the webservice. These API call the AccessGate ASDK API which communicate with the accessgate and in turn talks to the OAM server for authentication check

WebServiceClientProxy: This is a Java proxy that is used to make webservice calls on OAMAuthService All web and non web applications will instantiate this java class for OAM Auth Services

OAMAuthServlet: This is a sample servlet file that instantiates the WebServiceClientProxy and also collects the username and password and submits them to the OAM Server via the WebServiceClient Proxy


Scope
The scope is limited to sesssion token validation between similar agents. i.e the token obtained from one 10g agent can be used with another 10g agent. The 10g token cannot be used with a 11g agent. This is limited in the current release.

Sample Code
https://www.samplecode.oracle.com/tracker/tracking/linkid/prpl1004?id=S757

The sample code folder also consists of a Jdeveloper IDE project file. (Helpful for those who would like to view and deploy from an IDE)

I hope you have enjoyed this article and leave comments if any.

Follow derick_leo on Twitter




Monday, March 28, 2011

What is more important? What you buy or from whom you buy it?

I recently had a very enlightening and satisfying customer service experience.

Not too long ago, I bought a new car. I love the car - it drives great, gets great gas mileage, looks cool, and is basically everything I was looking for in a car. Unfortunately, this car was also having persistent issues with the emissions system, causing the Service Engine Soon light to come on after about 1700 miles. I dutifully took the car into the dealer to have it serviced. Then I took it in again. And again.

With each trip to the dealer, my frustration mounted. I began to conclude that I had inadvertently been sold a "lemon". I did some research into California's "Lemon Law" and as a result immediately contact the manufacturer to notify them of the issues with the car, tell them how frustrated I was, and see what they would do.

Because of other customer service experiences - satellite/dish providers and mobile/telco providers spring immediately to mind - I expected the worst. To my surprise, the customer service provided by BMW North America was superb. The customer service representatives (I talked to two during one 20 minute call) were helpful. They showed empathy for my situation. They told me they would advocate on my behalf. They offered suggestions for what to do next. They asked me what would I thought would help bring the situation to a successful conclusion and promised to work toward those outcomes.

As a result, I was immediately calmed. I asked for a root cause analysis of the problem and I agreed to another attempt to service the vehicle. In the end, I didn't get a root cause, but I did get my car back with the issue fixed, was treated exceptionally by the dealer, and am probably on my way to becoming a lifetime customer.

Every successful company cares about their customers. So what makes one vendor or manufacturer different from another?

I am very often asked by customers, partners, Oracle sales people, and others what differentiates Oracle and our Identity and Access Management products. Usually they expect that I will tell them what our products do, how they are built, and why that makes them different from other products they may be evaluating. What I typically tell people is that it isn't WHAT we are selling but HOW we stand behind it that makes all the difference. The example above perfectly illustrates the point.

Let's face it, there often isn't a lot of easily identifiable functional differentiation between products sold by big enterprise software companies. While most claim otherwise, this is also true of many of the smaller start up and niche vendors in the identity and access management market.

The same can also be said for car manufacturers like BMW, Lexus, and Mercedes Benz, which is what got me thinking about this in the first place, that it's more about from whom you buy and how they help you after you buy it than what you buy in the first place. Setting aside the price aspect for a moment, generally this kind of thing is referred to as a commodity.

So when I listen to customers talk about what is really important to them, I generally hear them focus on two things:
  1. they think of most software and the hardware it runs on as commodities, and;
  1. as a result it isn't the product functionality they are worried about, but the robustness of the solution and how easy it will be to keep it up and running in their environment.
In fact, when asked to spend $100, many will spend $70-80 out of that $100 on tools/features for existing software that facilitate diagnosing or troubleshooting issues. As it turns out, this is an indication that these customers are worried about whether - when something goes wrong - someone will be there to listen, to help them through their problems, to understand what defines a successful outcome, and be an advocate toward that outcome.

So how do vendors and customers work together to achieve a successful outcome? What do commodity vendors do to differentiate themselves from other vendors?

While working with customers, I've noticed a few things that our team does that almost always
help:
  • Be proactive. If all your interactions are based on hair-on-fire escalations you generally don't have a good basis for cooperative, constructive problem solving. Since most enterprise software support systems are by their nature reactive, proactive communication will help by establishing a raport and creating trust outside of the scope of reacting to a specific problem. Proactive communication will also allow you to anticipate key upcoming milestones so that you can prime your reactive support system to be ready before problems occur.
  • Be transparent. Tell your customer what you are doing and why you are doing it. Most support escalations occur when your customer contact doesn't know what to tell his/her boss. Picking up the phone periodically, even if just to explain that you have nothing new to report but are continuing to work on or monitor the situation, can help defuse most potentially explosive situations.
  • Show empathy. Don't make exaggerated claims or promise to deliver things you cannot deliver. The single most satisfying thing about the customer service I received from my car manufacturer was the fact that they made it clear they were on my side. They made no promises other than to be my advocate. That was enough.
  • Engage action. Get everyone on the same page about why they come to the office everyday: to ensure customer success. If everyone is on the same page about why, you can avoid disputes about what needs to happen, who needs to do it, and when it needs to get done. The most successful resolutions I've seen have been the result of strong collaborations of cross functional teams where the day job of most of those team members was not, strictly speaking, customer support.
This is a pretty basic description of what the folks at my car manufacturer did for me. Of course, there is no one-size-fits-all solution that creates undeniable differentiation around a commodity product. Nonetheless, when prospective customers ask me what sets Oracle apart, I don't spend a lot of time telling them about software features. Instead, I describe the process above, explain why that is important to us as an organization, and how that emphasis benefits customers.

Usually, that is enough.

Friday, September 10, 2010

Identity Management at Oracle Open World

Oracle Open World is fast approaching and the time to register is NOW so you don't miss out. This year the show is going to be a blast. I have heard rumors about the band that will be performing one night but you know what they say about rumors. More importantly, the IDM team have a lot of new things to talk about at this years show. First, we released 11g this summer which included exciting new approaches like Service Oriented Security, better user experience and new features for:

  • Oracle Identity Manager
  • Oracle Access Manager
  • Oracle Adaptive Access Manager
  • Oracle Identity Analytics
If you want a comprehensive list of all the sessions so you can follow along. Please visit the Focus On Identity Management document located here. Also, we have five don't miss sessions which you need to attend. Here are the dates and times. Or, you can find them on our Facebook page here.

Date & Time
Title of Presentation
Location
Mon 11am Oracle Identity Management 11g Overview Moscone South 309
Tue 2pm Simplify IDM with Directory Services –
Moscone South 309
Tues 3:30pm Oracle’s IDM Strategy (for Sun, Oracle Customers Alike)
Moscone South 310
Wed 1pm Building a Strong Foundation for Your Cloud with IDM
Moscone South 309
Wed 4:45pm Complete Identity & Access Governance with OIA 11g
Moscone South 309
Tues 5pm How Cisco Achieved Large-Scale, Highly Available Access Management Moscone South 310

The last time the Identity Management team was all together a few photo's were taken and I have included one from that fun event at Burton Catalyst. Hope you will be able to join us!


Tuesday, April 27, 2010

Iron Man 2, Identity Security and Access Management in the Cloud

If you are a security expert and you have not been to the new Oracle Iron Man 2 website you have to take a look at the cool demo site listed under "Stark Expo". The intro has a great security questionnaire on Security in the cloud in an cutting edge interface. If you read yesterday's blog, and went to the Iron-Clad Cloud: Secure Cloud Computing article in the new Security Newsletter, you were able to get an insight into way's Oracle can help secure the cloud. You will also do well on the questionnaire at "Stark Expo".

Go Check it out!

In Iron Man 2, Oracle is a proud sponsor of
Stark Expo, a world-class tradeshow that depends on a cloud computing
architecture to ensure that all systems are free from overload. And
that’s where you come in: by becoming a Master Cloud Operative, you’ll
help keep Stark Expo up and running. Complete your training, test your
troubleshooting skills, and get certified in the Oracle Pavilion.

Wednesday, July 1, 2009

New OAM 10.1.4.2 Certifications Released (June 2009)

The following new OAM 10.1.4.2 Certifications have been released:
1) Oracle HTTP Server (OHS) 10.1.3.4+ v2.0 (64-bit) WebGate for HP-UX Itanium 11.23 and 11.31
2) Lotus Domino Web Server 8.5.x (64-bit) WebGate for Windows 2003 EE SP2+ and Windows 2008 EE - x86-64 hardware
3) Sun Java Webserver 7.0.x (64-bit) WebGate for Solaris 10 (64-bit) - SPARC S2 hardware

Additional Resources:
OTN (download) location
OAM 10.1.4.x Support matrix location
OAM 10.1.4.x Package list location

Tuesday, June 24, 2008

Welcome to the Oracle Access Management Blog!

Welcome to the Oracle Access Management blog.

There is a lot going on in the world of access management and we - the product management team responsible for Oracle's Access Management Suite of products (Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Entitlements Server, and Oracle Identity Federation) - started this blog to share information and engage discussion.

This blog will focus on informational articles about our products, discussions of product functionality, and our take on industry trends and emerging technologies. We will also share best practices for deploying, integrating, and managing Oracle Access Management products. And we will generally muse on topics we think are important to access management, security, fraud detection, entitlements management, and federation.

We will also be featuring some regular topics including keeping tabs on online fraud and the impact this has on businesses across all industries in a weekly feature we call Fraud Flashes.


Stayed tuned.

-Eric