OAAM for beginners

Hello everyone,

Today I am going to show how to start with OAAM installation. Later this month I am going to provide you more details such as how to integrate OAAM with OIM and OAM as well.

For this part 1 I would to explain that Oracle Adaptive Access Manger  is an Oracle Access Management product from OAM Suite Plus. We have many others such as OIF OWSM and eSSO there.

Oracle Adaptive Access Manager automates reviews of access and transaction events to detect fraud and misuse resulting in saved time and money. The proven capabilities and quick return on investment Oracle Adaptive Access Manager provides makes it a must for security products at any company.

Basically, this article will cover OAAM 11g R1 (11.1.1.*) for beginners and highlight overview of OAAM installation, configuration, and accessing OAAM for the very first time.

• First of all let’s go deeply on what means OAAM from application perspective - OAAM 11g is a J2EE application deployed on Oracle WebLogic Server. That means that you must know about NodeManager, manager server and Admin Server in order to maintain OAAM.
• OAAM 11g basically includes two components

1) OAAM Online : For Real-time risk analysis

2) OAAM Offline : For offline risk analysis

• OAAM is part of IAM the Identity and Access Management software (IAM).

• OAAM’s deployed applications for OAAM 11g are those below:

a) OAAM Server: OAAM Server that is basically a run-time component that includes rules engine and end user interface flows deployed on WebLogic Managed Server. OAAM server provides Adaptive Risk Manager, Adaptive Strong Authenticator, Web Services and more.

b) OAAM Admin Console : It’s the administration console (Web Application aka OAAM Admin) that contains customer service and security analyst case management functionality.

• Component distribution from architecture view:

So, let’s go to the most exciting part of this article, finally. The high Level Installation Steps for OAAM 11g:

• Install Database for OAAM schema in your already installed DB.
• Use RCU  to load OAAM schema there.

• Install WebLogic Server, for 64 bit O.S. use steps mentioned below.

• Install Identity and Access Management Software as mentioned
• Configure OAAM by running $MW_HOME/oracle_common/common/bin/config.sh

• when prompted for schema name, provide schema details creating using RCU

• OAAM configuration in online mode will create Admin Server and two Managed Servers (one for OAAM Admin Server and second for OAAM Server)

• Start Node Manager, Admin Server, and Managed Servers (Do Not forget to set StartScriptEnabled=true in nodemanager.properties) . If need any help.

• Create User for OAAM and add user in OAAM* group (to grant OAAM Role) using WebLogic Console

• Then, here you go to Access OAAM Admin Console http://thiagoleoncio:OAAMAdmin_ManagedServer_port/oaam_admin

• Policy Tree

The Policy tree gives you a visual representation of the policy hierarchy and the relationship between different policies, user groups, and the checkpoints.

 For example: 

1. You can double-clicking an item in the Policy tree opens a dynamic tab for that item. This enables administrators to view and edit the configurations in context. 
2. You can expand the Policy tree to view the details about the user groups and policies under each checkpoint.

For example the Forgot Password policy is under the Forgot Policy Checkpoint and All Users is assigned to the policy.

• So, here you go to Access OAAM Server http://thiagoleoncio:OAAMServer_ManagedServer_port/oaam_server

Again, thank you for your time reading this article. In about 15 days I will complete another article that basically integrate this OAAM above with OIM and OAM. Enjoy it!

References:

https://docs.oracle.com/cd/E28280_01/doc.1111/e15477/riskman.htm#IMINT217

I hope it helps you and happy coding,

Thiago Leoncio.

OAM 12C - Understanding the Authorization and Authentication Endpoints - part 2

Hello IAM developers,

Let's keep talking about OAuth Services in OAM(Oracle Access Manager).

OAM-OAuth has four authentication endpoints that receive and respond to HTTPS requests on 3Legged Authorization flow: The token endpoint, the authorization endpoint,  the push endpoint, and the user consent revocation endpoint. Each endpoint is a URL that clients use to make requests.

Fig1:  Understanding OAuth 3-Legged Authorization

The authentication endpoints are:

Token Endpoint – The client application interacts with the Token Endpoint to exchange an authorization code grant for an access token. It is also used for Client Credentials grant type and resource owner credentials grant type to get an access token. The client uses a Refresh token to obtain a new access token. The URI for this endpoint always ends in a token. For example:

HTTP(s)://<host>:<port>/ms_oauth/oauth2/endpoints/<yourOauthServiceName>/token

Authorization Endpoint – The client uses the Authorization Endpoint to get authorization from the resource owner to access the demanded resources. The client application initiates the Authorization Endpoint request by sending its identifier, a requested scope defining the resource to which it wants to access, and a redirection URI to which OAuth Services will direct the web browser once access is granted or denied. This endpoint admits the HTTPS request. The URI for this endpoint always ends in authorize. For example:

HTTP(s)://<host>:<port>/ms_oauth/oauth2/endpoints/<yourOauthServiceName>/authorize

Push Endpoint – Mobile OAuth Services client apps interact with the push endpoint to obtain (depending on configuration) part of the authorization codes, and/or part of the client tokens, access tokens, and refresh tokens that are sent through either the Apple Push Notification Service (APNS) or the Google Cloud Messaging (GCM) service. It can also be used for Mobile Client Verification code, Authorization Code, and Client Tokens. For example, the endpoint for requesting data from APNS is:

HTTP(s)://<host>:<port>/ms_oauth/oauth2/endpoints/oauthservice/push

User Consent Revocation Endpoint - Resource owners (end-users), who authenticate and authorize client applications using the browser-based authorization endpoint flow, use this endpoint to revoke their consent to client applications. For example:

HTTP(s)://<host>:<port>/ms_oauth/oauth2/ui/<yourOauthServiceName>/showrevokeconsent

When configuring clients with authorization code grant in the OAuth server, you also need to provide at least one client redirect URI where the server can return authorization credentials to the client.

Client Redirect URIs – The OAuth Services server returns authorization credentials to the client using the URI specified in the request provided that it exactly matches a URI configured in the client profile.

Next article - part3 -  I am going to show step-by-step all these OAM 12c processes in action, stay tuned.

More articles related:

Part1- OAM using OAuth2 Services - Proposed architecture, related flows, and how to configure


I hope it helps and happy coding,
Thiago Leoncio.