Common OIM errors during development

Some common errors and fixes for OIM Development I would like to share today

=========

ERROR:---

=========

getOIMConnection() : Start

Exception in thread "main" java.lang.NoClassDefFoundError: oracle/jrf/PortabilityLayerException

at TestConnection.getOIMConnection(TestConnection.java:52)

at TestConnection.main(TestConnection.java:67)

Caused by: java.lang.ClassNotFoundException: oracle.jrf.PortabilityLayerException

at java.net.URLClassLoader.findClass(URLClassLoader.java:382)

at java.lang.ClassLoader.loadClass(ClassLoader.java:418)

at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:355)

at java.lang.ClassLoader.loadClass(ClassLoader.java:351)

... 2 more

  FIX:

  ADD TO THE PROJECT LIBRARY:

  scp oracle@thiagoserver.com:/u00/ora/middleware/oracle_common/modules/oracle.jrf_11.1.1/jrf-api.jar .

=========

ERROR:---

=========

  Exception in thread "main" java.lang.NoClassDefFoundError: org/springframework/jndi/JndiTemplate

  at oracle.iam.platform.OIMClient.<init>(OIMClient.java:104)

  at TestConnection.getOIMConnection(TestConnection.java:52)

  at TestConnection.main(TestConnection.java:67)

  Caused by: java.lang.ClassNotFoundException: org.springframework.jndi.JndiTemplate

  at java.net.URLClassLoader.findClass(URLClassLoader.java:382)

  at java.lang.ClassLoader.loadClass(ClassLoader.java:418)

  at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:355)

  at java.lang.ClassLoader.loadClass(ClassLoader.java:351)

  ... 3 more

FIX: ADD TO THE PROJECT LIBRARY :

spring.jar

=========

ERROR:---

=========

Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/commons/logging/LogFactory

at org.springframework.jndi.JndiTemplate.<init>(JndiTemplate.java:44)

at oracle.iam.platform.OIMClient.<init>(OIMClient.java:104)

at TestConnection.getOIMConnection(TestConnection.java:52)

at TestConnection.main(TestConnection.java:67)

Caused by: java.lang.ClassNotFoundException: org.apache.commons.logging.LogFactory

at java.net.URLClassLoader.findClass(URLClassLoader.java:382)

at java.lang.ClassLoader.loadClass(ClassLoader.java:418)

at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:355)

at java.lang.ClassLoader.loadClass(ClassLoader.java:351)

... 4 more

FIX: ADD TO THE PROJECT LIBRARY :

commons-logging.jar from design console ext folder.

/u01/app/oracle/middleware/Oracle_OIM1/designconsole/ext/commons-logging.jar

I hope these fixes help everybody and happy coding!

Thiago Leoncio.

OAAM for beginners

Hello everyone,

Today I am going to show how to start with OAAM installation. Later this month I am going to provide you more details such as how to integrate OAAM with OIM and OAM as well.

For this part 1 I would to explain that Oracle Adaptive Access Manger  is an Oracle Access Management product from OAM Suite Plus. We have many others such as OIF OWSM and eSSO there.

Oracle Adaptive Access Manager automates reviews of access and transaction events to detect fraud and misuse resulting in saved time and money. The proven capabilities and quick return on investment Oracle Adaptive Access Manager provides makes it a must for security products at any company.

Basically, this article will cover OAAM 11g R1 (11.1.1.*) for beginners and highlight overview of OAAM installation, configuration, and accessing OAAM for the very first time.

• First of all let’s go deeply on what means OAAM from application perspective - OAAM 11g is a J2EE application deployed on Oracle WebLogic Server. That means that you must know about NodeManager, manager server and Admin Server in order to maintain OAAM.
• OAAM 11g basically includes two components

1) OAAM Online : For Real-time risk analysis

2) OAAM Offline : For offline risk analysis

• OAAM is part of IAM the Identity and Access Management software (IAM).

• OAAM’s deployed applications for OAAM 11g are those below:

a) OAAM Server: OAAM Server that is basically a run-time component that includes rules engine and end user interface flows deployed on WebLogic Managed Server. OAAM server provides Adaptive Risk Manager, Adaptive Strong Authenticator, Web Services and more.

b) OAAM Admin Console : It’s the administration console (Web Application aka OAAM Admin) that contains customer service and security analyst case management functionality.

• Component distribution from architecture view:

So, let’s go to the most exciting part of this article, finally. The high Level Installation Steps for OAAM 11g:

• Install Database for OAAM schema in your already installed DB.
• Use RCU  to load OAAM schema there.

• Install WebLogic Server, for 64 bit O.S. use steps mentioned below.

• Install Identity and Access Management Software as mentioned
• Configure OAAM by running $MW_HOME/oracle_common/common/bin/config.sh

• when prompted for schema name, provide schema details creating using RCU

• OAAM configuration in online mode will create Admin Server and two Managed Servers (one for OAAM Admin Server and second for OAAM Server)

• Start Node Manager, Admin Server, and Managed Servers (Do Not forget to set StartScriptEnabled=true in nodemanager.properties) . If need any help.

• Create User for OAAM and add user in OAAM* group (to grant OAAM Role) using WebLogic Console

• Then, here you go to Access OAAM Admin Console http://thiagoleoncio:OAAMAdmin_ManagedServer_port/oaam_admin

• Policy Tree

The Policy tree gives you a visual representation of the policy hierarchy and the relationship between different policies, user groups, and the checkpoints.

 For example: 

1. You can double-clicking an item in the Policy tree opens a dynamic tab for that item. This enables administrators to view and edit the configurations in context. 
2. You can expand the Policy tree to view the details about the user groups and policies under each checkpoint.

For example the Forgot Password policy is under the Forgot Policy Checkpoint and All Users is assigned to the policy.

• So, here you go to Access OAAM Server http://thiagoleoncio:OAAMServer_ManagedServer_port/oaam_server

Again, thank you for your time reading this article. In about 15 days I will complete another article that basically integrate this OAAM above with OIM and OAM. Enjoy it!

References:

https://docs.oracle.com/cd/E28280_01/doc.1111/e15477/riskman.htm#IMINT217

I hope it helps you and happy coding,

Thiago Leoncio.

OAuth using Google Cloud Platform

What is OAuth?

OAuth is a standard for access delegation. If you are trying to grant app/client access to information on other places(websites) without providing passwords, that's basically the purpose of OAuth. This feature is used by several companies and permits users to share information about their accounts with third-party applications or websites.

OAuth essentially allows access tokens to be issued to third-party clients by an authorization server, with the approval of the resource owner. The third party then uses the access token to access the protected resources hosted by the resource server.


Auth0 helps you to:

• Add authentication with multiple authentication sources, either social like Google, Facebook, Microsoft Account, LinkedIn, GitHub, Twitter, Box, Salesforce, among others, or enterprise identity systems like Windows Azure AD, Google Apps, Active Directory, ADFS or any SAML Identity Provider.
• Add authentication through the more traditional username/password databases.
• Add support for linking different user accounts with the same user.
• Support for generating signed JSON Web Tokens to call your APIs and flow the user identity securely.
• Analytics of how, when, and where users are logging in.
• Pull data from other sources and add it to the user profile, through JavaScript rules.

What you should add to your OAuth code:

CLIENT_ID, CLIENT_SECRET, AUTZ_URL and IDCS_URL:

Your code for parsingJWT and manipulating the JSON content provided by the OAuth mechanism should be similar to this:

In the case of Google, you should register the service account, the product name(equals project name), and the redirect_URI.

Web application configuration on GCP.

Service account and keys needed to Auth0 on Google.

Running your OAuth/Google app:

Getting the Authorization, Token and SessionID.

What's the difference between SSO/federation and this OAuth process?

A1- Federation uses SAML(Security Assertion Markup Language) to achieve SSO, Federation, and Identity Management.
OAuth(Open Authorization) is a standard for authorization of resources. It does not deal with authentication


A2-Token X Message Format
SAML deals with XML as the data constructor token format.

OAuth tokens can be binary, JSON, or SAML as explained in OAuth Bearer Tokens.

A3-Transport
SAML has Bindings that use HTTP such as HTTP POST Binding, HTTP REDIRECT Binding, etc.

But there is no restriction on the transport format. You can use SOAP or JMS or any transport you want to use to send SAML tokens or messages.

OAuth uses HTTP exclusively.


Happy coding.


I hope it helps,
Thiago Leoncio

PCI DSS Toolkit

Since 2012, Open Scoping Framework Group is providing a free PCI DSS Scoping toolkit.

Successful PCI DSS compliance depends upon the correct identification of the scope of the assessment. An overly narrow scope can jeopardize cardholder data, while an overly broad scope can add unnecessary cost and effort to the PCI compliance program. Subjective interpretation of the PCI DSS guidance results in a wide variance in practice among both QSAs and Participating Organizations.

When scoping errors occur, organizations will not focus on what matters most – that becomes a flaw - An overly narrow scope of assessment could potentially jeopardize cardholder data, while an overly broad scope potentially adds unnecessary cost and effort to achieving PCI compliance.

If you are a QSA, ISA or someone responsible for PCI compliance somehow you must follow these:

OSFG-Open Scoping Framework Group was originally created by Gene Kim whose name should be familiar to almost everyone - founder of Tripwire.  He got together his DevOps group to tackle the issues faced by all of us trying to scope the cardholder data environment (CDE) and the result was the toolkit.

Here are the activities that occur in CDE:

§ Processing – when cardholder data is actively being used by a system component (e.g., entered, edited, manipulated, printed, viewed) Open PCI DSS Scoping Toolkit (August 2012).

§ Storing – when cardholder data is inactive or at rest (e.g., located on electronic media, system component memory, paper).

§ Transmitting – when cardholder data is being transferred from one location to another (e.g., data in motion).

The toolkit defines three categories of systems.

Category 1 – System components that process, store or transmit cardholder data or are not isolated or restricted through controlled access from other Category 1 system components.

Category 2 – System components that have controlled access to a Category 1 system component.

Category 3 – System components that are isolated from all Category 1 system components.

People always get the reason why Category 1 devices are in scope because they are contained in the CDE.  While one would think that Category 3 components would be also just as easy to categorize as Category 1, but that is not necessarily the case.  The key is that Category 3 systems cannot have any access to Category 1 components.  Although attempt to ping Category 1 components from the Category 3 component could be used, a better test is to use Nmap or similar port scanner from a sample of Category 3 components to scan the CDE IP address range to determine if any ports are open.

While Category 3 components can be troublesome, it is the Category 2 devices that usually give everyone a problem including, at times, yours truly.  The reason is the connectivity issue as it can be very unclear at times whether or not a device actually has connectivity to the CDE.

To assist in identifying connected systems, the toolkit breaks Category 2 systems into four sub-categories.

Category 2a – System components which, through controlled access, provide security services (e.g., authentication) to a Category 1 device.

Category 2b – System components which, through controlled access, can initiate an inbound connection to a Category 1 device.

Category 2c – System components which, through controlled access, can only receive a connection from a Category 1 device (i.e., cannot initiate a connection).

Category 2x – System components which, through indirect and controlled access, have the ability to administer Category 1 devices. Note: Category 2x devices have no direct access to/from Category 1 devices.

The final pieces of the Open PCI DSS Scoping Toolkit I really like are the decision tree and the scenarios provided.  If these do not help explain how to scope your PCI assessment have, nothing will.

Although addressing the people and processes around cardholder data is a necessary part of any PCI compliance program, the Toolkit focuses almost entirely on categorizing the system components that comprise an organization’s computing environment. In addition, the Toolkit does not define what PCI DSS controls are required for each Toolkit category. Because every organization is different, it is up to each organization and its assessor to determine the nature, extent and effectiveness of each control to adequately mitigate the risks to cardholder data.

Again, if you do not yet have a copy of the Open PCI DSS Scoping Toolkit, hopefully this post will entice you to get a copy.

Thiago Leoncio.

IDM & Security SME.

Reference: Open PCI DSS Scoping Toolkit

Cybersecurity threats everybody needs to know about on these cloudy days

Should we start conversations around forging ahead amid the varying minefield of company’s data threats?

Source: PROTENUS BREACH BAROMETER REPORT

Wrong/Poor cybersecurity practices

In many organizations there remains an inadequate culture of security, with companies failing to follow best practices, either due to lack of knowledge or an attitude that the effort and/or cost to comply is too burdensome.

For healthcare system with several aspects of cybersecurity remaining unregulated, levels of interest and investment vary widely within the industry. From the IT corner, one basic issue remains a lack of data encryption; among marketing & sales departments, a common issue remains poor password selection and protection, with some people outright working around them by sharing passwords among groups or posting them on monitors.


Insider threats


According to a report by Protenus, nearly half (43%) of the healthcare data breaches in 2016 were a result of insider threats, both unintentional and malicious.

Data protection also needs to consider malicious insider intent, which underscores the need for as-needed data access and protected,individual log-ins – particularly amid quick staff turnover, visiting consultants and the possibility of outsiders being able to walk in and access insider systems.
 Recent incidents illustrate that surprises do come from within, as when staff engage in billing fraud or improperly view records for celebrity patients or user, or when outsiders pose as company staff.


Ransomware

Cases of ransomware and also some non-ransomware cases where hackers acquired databases and subsequently tried to extort covered entities. When extortion failed, they put user content up for sale on the dark web. There were so many user records put up for sale in 2016 that the price per record dropped significantly as the market became flooded.

These hacks have taken the healthcare industry by storm with their terrifying hijacking of hospital systems that demand a payment demand to return system control. Healthcare entities are viewed as ideal targets because it is so critical to them to avoid data or service interruption.

Source: Protenus and other IDM sources.


Thiago Leoncio.

How to change cn=orcladmin PW for OVD without EM

Here they are the steps that you must take, if your EM is not working to change OVD super user password:

1-You must set ORACLE_HOME before running this script.

2-Locate ovdcred.pl in $ORACLE_HOME/ovd/bin/directory.

3-Run the ovdcred.pl script using the following syntax:

ovdcred.pl -componentName  ovd-component-name -instancePath ovd-instance-path  -option username/password option

For example:

ovdcred.pl –componentName ovd1 –instancePath /scratch/aime1/asinst_1 –option Password

ovdcred.pl –componentName ovd1 –instancePath /scratch/aime1/asinst_1 –option Username

When you run a help or anything wrong you can see these:

perl ovdcred.pl –componentName ovd1 –instancePath /u01/app/idm/config/instances/oid1/OVD –option Password

 -componentName VAL : OVD Component Name

 -instancePath VAL  : OVD Instance Path

 -option VAL        : Password/Username

 -userType VAL      : ROOT/EMADMIN. Defaults to ROOT when this option is not spe

                      cified

If you type it properly then you will see the result:

perl /u01/app/idm/products/dir/oid/ovd/bin/ovdcred.pl  –componentName ovd1 –instancePath /u01/app/idm/config/instances/oid1/config/OVD/ovd1 –option Password

Enter password:

Confirm password:




Check this article also:

OVD11G: How to change cn=orcladmin password only for OVD

I hope it helps you,

Thiago Leoncio.

IDM-FA Mass Reset steps- Using OIM APIs

I would like to share the code and article that I wrote this month for Oracle A-team site.

Link: http://www.ateam-oracle.com/mass-reset-password-part2-using-oim-apis/

This is very helpful code for people that are looking for do Mass Reset Password after P2T  or any kind of change that affects critical data from production.

I hope it helps,
Thiago Leoncio.

OID 11G: How to collect all password policies from all your tree levels using only one command.

Hello everyone,

I would like to share today how to get all pwd policies into oid using simple command. Even if they are into different tree levels you can get those by this process below:

[leoncio@ThiagoLeoncioserver~]$ ldapsearch -p 6501 -q -D "cn=orcladmin" -b " " -s sub "(objectclass=pwdpolicy)"

Please enter bind password:

cn=default,cn=pwdPolicies,cn=Common,cn=Products,cn=OracleContext,dc=thiagoleoncio,dc                                                                                                             =com

displayname=Password Policy for Realm dc=thiagoleoncio,dc=com

orclpwdminalphachars=0

pwdfailurecountinterval=0

orclpwdmaxrptchars=0

pwdlockoutduration=86400

objectclass=top

objectclass=pwdpolicy

pwdmaxfailure=10

orclpwdminuppercase=0

orclpwdencryptionenable=0

pwdminlength=6

orclpwdalphanumeric=1

cn=default

pwdlockout=0

pwdchecksyntax=1

orclpwdpolicyenable=1

pwdgraceloginlimit=6

pwdexpirewarning=604800

pwdmaxage=10368000

orclpwdminspecialchars=0

orclpwdminlowercase=0

cn=PolicyUserPolicy,cn=pwdPolicies,cn=Common,cn=Products,cn=OracleContext, dc=thiagoleoncio,dc=com

orclpwdminalphachars=0

pwdfailurecountinterval=0

orclpwdmaxrptchars=0

pwdlockoutduration=4600

objectclass=top

objectclass=pwdpolicy

pwdmaxfailure=4

orclpwdminuppercase=0

pwdminlength=6

orclpwdencryptionenable=0

orclpwdalphanumeric=1

cn=PolicyUserPolicy

pwdlockout=1

pwdchecksyntax=1

orclpwdpolicyenable=1

pwdgraceloginlimit=6

pwdexpirewarning=0

pwdmaxage=0

orclpwdminspecialchars=0

orclpwdminlowercase=0

cn=IDMPolicy,cn=pwdPolicies,cn=Common,cn=Products,cn=OracleContext

orclpwdminalphachars=0

pwdfailurecountinterval=0

orclpwdmaxrptchars=0

pwdlockoutduration=4600

objectclass=top

objectclass=pwdpolicy

pwdmaxfailure=4

orclpwdminuppercase=0

orclpwdencryptionenable=0

pwdminlength=8

orclpwdalphanumeric=1

cn=SystemIDPolicy

pwdlockout=1

pwdchecksyntax=1

orclpwdpolicyenable=1

pwdgraceloginlimit=6

pwdexpirewarning=0

pwdmaxage=0

orclpwdminspecialchars=0

orclpwdminlowercase=0

I hope it helps you and save your day, avoiding any struggling tries from your end. See you again next month.

Thiago Leoncio.

OAM 11G Troubleshooting session: "AMInitServlet" failed to preload on startup in Web application: "oam". java.lang.ExceptionInInitializerError

Hello everyone,

   today I was installing my OAM environment and I had a very interesting issue that I would like to share into my troubleshooting article.

After finish my domains creation and Start AdminServer and OAM managed Server I received this issue below:

<BEA-000628> <Created "1" resources for pool "oamDS", out of which "1" are available and "0" are unavailable.>

####<Jul 05, 2014 2:35:56 PM EDT> <Error> <HTTP> <oam1.domdaman.intra> <WLS_OAM1> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <0000KSmQ^QF9DgYjLpuHOA1Jkmq2000002> <1405300164014> <BEA-101216> <Servlet: "AMInitServlet" failed to preload on startup in Web application: "oam".

java.lang.ExceptionInInitializerError

  at oracle.security.am.engines.sso.adapter.AbstractSessionAdapterImpl.checkAndInit(AbstractSessionAdapterImpl.java:92)

  at oracle.security.am.engines.sso.adapter.AbstractSessionAdapterImpl.<init>(AbstractSessionAdapterImpl.java:75)

  at oracle.security.am.engines.sso.adapter.MultipleUserSessionAdapterImpl.<init>(MultipleUserSessionAdapterImpl.java:56)

  at oracle.security.am.engines.sso.adapter.MultipleUserSessionAdapterImpl.<clinit>(MultipleUserSessionAdapterImpl.java:45)

  at oracle.security.am.engines.sso.adapter.SessionManagementAdapterFactory.getAdapter(SessionManagementAdapterFactory.java:46)

  at oracle.security.am.engines.enginecontroller.SSOEngineController.processEvent(SSOEngineController.java:497)

  at oracle.security.am.controller.MasterController.processEvent(MasterController.java:568)

  at oracle.security.am.controller.MasterController.processRequest(MasterController.java:757)

  at oracle.security.am.controller.MasterController.process(MasterController.java:680)

  at oracle.security.am.pbl.transport.http.AMInitServlet.initializeAmServer(AMInitServlet.java:137)

  at oracle.security.am.pbl.transport.http.AMInitServlet.init(AMInitServlet.java:79)

  at weblogic.servlet.internal.StubSecurityHelper$ServletInitAction.run(StubSecurityHelper.java:283)

  at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)

  at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)

  at weblogic.servlet.internal.StubSecurityHelper.createServlet(StubSecurityHelper.java:64)

It took a lot of time to realize that my server was not starting properly because of a related multicast issue that is described into this WLS document:

http://docs.oracle.com/cd/E11035_01/wls100/cluster/multicast_configuration.html

So, what is the fix?

You have 2 possibilities to fix this:

1)-Djava.net.preferIPV4stack=true as WLS document describe below:

http://docs.oracle.com/middleware/1213/wls/WLSRN/issues.htm

http://docs.oracle.com/cd/E11035_01/wls100/cluster/multicast_configuration.html

2)Or force to not be IPV6 with -Djava.net.preferIPV6=false option

http://docs.oracle.com/javase/6/docs/technotes/guides/net/properties.html

Once your wls server recognize that you are using the proper IPV(Internet Protocol Version). This will make the OAM deployment to go thru and your managed server you start successfully.

I hope this helps you and don't make you loose time as I did,

Thiago Leoncio.