Part 1: How to Configure SSL for Oracle 10g Application Server: Part I- Certificate Authority (OCA)

As a subset of Identity Management for Oracle 10g Application Server with Fusion Middleware, we will provide a brief two part series on how to manage SSL. In this post, we will discuss how to setup, configure and manage the Secure Socket Layer (SSL) security within Oracle 10g Application Server. The first part will be to configure the Oracle Certificate Authority (OCA) for use with certificates and the second part involves how to setup and manage wallets with the Oracle Wallet Manager for certificates with SSL and Oracle 10g Application Server. We will provide a four part series on SSL since it is an extremely complex subject within Identity Management (IdM) for Oracle Fusion Middleware.

Part 1: Concepts for SSL and Oracle Certification Authority (OCA)
Part 2: SSL Configuration with OCA and Oracle Wallet Manager (OWM)
Part 3: OHS (Oracle HTTP Server) Configuration for SSL
Part 4: Additional topics for SSL with OracleAS 10g such as EBS


Concepts for SSL and Oracle 10gAS PKI


The Oracle Public Key Infrastructure (PKI) is the big picture for managing certificates within Oracle Fusion Middleware components. PKI consists of the following items:

- Secure Sockets Layer (SSL)
- Oracle Wallet Manager (OWM), containers and wallets
- the Oracle Internet Directory (OID) and Oracle 10g Application Server Single Sign On (SSO)

We have discussed most of these components already for OID and SSO. However, before we manage to discuss the details for SSL configuration with Oracle 10gAS, we need to first understand how to configure the Oracle Certificate Authority (OCA) and Oracle Wallet Manager (OWM).

Understanding Certificates with Oracle PKI Components for 10gAS


Digital certificates are electronic documents that establish security credentials for transactions within Oracle 10gAS including Oracle 10g Portal, Reports, and Discoverer applications. Each certificate contains the username and digital signature from the issuing certificate authority (CA). We have a few different types of certificates:

- Client based certificates: also known as end-entity certificates which contain personal or user certificates
- Web server certificates contain server side digital signature for secure web communications between servers.
- root authority certificates are self signed certificates which form the base or root of a certificate authority (CA).

What is a certificate authority (CA) ? A certificate authority is a third party such as Verisign that provides the verified credentials for an organization and issues the security certificates used for all SSL connections. This CA performs the authentication of the user's certificate identity so that it is trusted within the 10g Application server environment. Oracle 10gAS provides a utility called the Oracle Certificate Authority (OCA) which administers and manages these certificates. After the certificate is available it needs a storage place for safe keeping and reference during 10gAS processing of transactions. Here is where the Oracle Wallet Manager (OWM) utility comes into play. We have two choices where to store these trusted certificates: in an LDAP directory system or a wallet manager. The Oracle Wallet Manager (OWM) allows us to store these certificates in a repository schema located in the 10gAS Infrastructure database for safe keeping. We can use the PKCS #12 (Personal Information Exchange Syntax) standard if we so wish as part of the certification process. The Oracle Wallet Manager (OWM) allows us to manage the security credentials for clients and servers.

How Does SSL Work?


The SSL process operates in the following series of steps to provide secure communication between the user's client and Oracle 10g Application Server.

1. An end user connects to the 10g Application Server and submits a request on the SSL port via HTTPS protocol.

2. The server verifies the user's identity by signing the certificate and sending it back to the client

3. The client end user will use the server public key to verify that the owner of the certificate is indeed the same user who signed it. If the certificate authority (CA) credentials are unknown, the end user client browser replies that the certificate was issued by an unknown CA.

4. The user manually verifies that the site certificate has been issued by a trusted authority ie) Verisign and generates a encypted token using the server's public key.

5. The certificate is sent back to the server and SSL performs a handshake operation based on the cipher in the public key. If the session keys match, the certificate is accepted and the end user is able to access the Oracle 10g Application server applicatons via SSL.

The Oracle Certificate Authority (OCA) verifies all details of the operations for SSL with the SSO and OID servers during this process. Now that we have provided an introduction to SSL and Oracle PKI security, lets present some hands on examples of how to configure certificates for SSL with the Oracle Certificate Authority (OCA).

Setup and Configuration for Oracle Certificate Authority (OCA)


By default, after installing the Oracle 10gAS infrastructure components for Oracle 10g Application Server, the OCA is not started. As such, we need to start and verify the processes for the OCA.

By default, the OCA configuration files live under the $ORACLE_HOME/oca/conf directory for the 10gAS infrastructure.

We need to startup the OCA by using the ocactl utility located under $ORACLE_HOME/oca/bin. Once we start the OCA processes by executing the ocactl start command, we are ready to configure the certificates for Oracle 10gAS.




To get help on using the ocactl commands, we have the following example:





The oca.xml file contains the main settings for the configuration of the OCA for Oracle 10g Application server as shown in the following example.



You can edit the file with any XML editor utility.
Since OCA relies on wallets to store the various PKI credentials and password storage area for passwords. The OCA requires the certificate authority (CA) signing wallet as well as the CA SSL wallet. The CA signing wallet is created by the Oracle 10gAS installer or can be imported from another CA to setup a custom CA structure. The new wallet along with the signed key and certificate are signed by the new CA. The SSL certificate authority wallet is created by the 10gAS installer when you install 10g Application Server components for the Infrastructure. It contains the SSL certificate and private key for the SSL server that hosts the OCA. This SSL wallet can also be imported from another certificate authority (CA) or managed by the Oracle Wallet Manager (OWM) utility.

To access the OCA interface from within Oracle 10g Application Server, we can navigate to the 10gAS home page for OCA based on https://server:/oca/admin as shown in the following example.



We can also check the details from the main 10gAS application server infrastructure page for OCA operations.



Now lets return to the main OCA interface that we discussed earlier. The first step for configuration after we have started the OCA processes with 10g Application Server is to setup the enrollment process for certificates.




The fields with asterisks are required by OCA. Here we use ocawebadmin as our user with ABC
for the organization. We also have options below to setup the certificate information.




We can set the time period for the certificate from 6months to 5 years. We also have an option to set the certificate key size to either high grade or medium grade based on our security and encryption policy standards. We finalize our setup and click the submit button which will process our new certificate details as shown below.



Now that we have our OCA certificate for administration tasks, we need to import it into our web browser! To do so, we choose the option below to install in browser.



Once we have successfully added the new certificate to our browser, we save the backup copy and return to our main OCA administration page to verify all certificates and their status. Since this was a test certificate that we used previously, OCA rejected our new certificate request. So we will need to revoke all certificates by using the ocactl revokecert command. In the next post, we will cover these tasks in more detail to complete our coverage for SSL with Oracle 10g Application Server. In a nutshell the reason why this failed was because the certificate also needs to exist in the Oracle Wallet Manager (OWM). If the certificate cannot be found by OWM, it will be rejected by the OCA. So we will need to clear out all certificate requests and recreate a new wallet and certificate for SSL to be used by the Oracle 10g Application Server. We conclude this introduction to SSL configuration with a summary display of the main OCA administration page for certificate management.

The first general pages provides us with options to manage and configure certificates and certificate requests.



When we first access the general tab, the certificate will popup to ask us if we trust it or not as confirmation.
We have many options here to configure and publish the certificate with SSL. We can enable or disable SSL and/or SSO authentication for our certificates as well as configure directory settings for the LDAP OID server. We also have a Notification tab to setup our SMTP server for emailing alerts and messages to the OCA administrator.



If we need to change policy settings for managing our certificates, we navigate to the Policy tab for the OCA Administration web console.




We can set policy rules for certificates based on requests, revocations or renewals. Under the Certificate Management tasks menu, we can also update our Certificate Revocation List (CRL).




We have menu options to enter the number of days to keep the certificate revocation list valid in days (CRL Validity)
as well as the Signature Algorithm choice between SHA1 with RSA or MD5 with RSA.




On a final note for our introduction to SSL with Oracle 10gAS, there is an option to customize the certification practice statement issued by the OCA within Oracle 10g Application Server applications. By editing the ocaadmin_cs_practicestmt.html file located under $ORACLE_HOME/j2ee/oca/applications/oca/helpsets/oca_practice_stmt, IT security administrators can have a department message issued by Corporate IT security as part of the messaging system.

We will conclude our discussion of SSL for Oracle 10gAS in our next post by explaining the setup and configuration of the Oracle Wallet Manager (OWM) with the Oracle Certificate Authority (OCA) for SSL.

Single Sign On (SSO) Server Configuration for Oracle 10gAS Application Server

This week, we continue our Fusion Middleware series with a discussion on how to configure and manage Oracle 10gAS Single Sign On (SSO) with Portal. Compared to the complex nature of OID and SSL, Single Sign On is fairly straight forward and simple to configure and administer. We will provide a summary of how SSO works within 10gAS and Portal and then some exercises to configure, administer and monitor its operations with Oracle 10gAS (10.1.2.0.2) on Linux platform.


How Does Single Sign On Work?

Single Sign On (SSO) is part of the Oracle 10gAS identity management (IdM) technology that is stored within the Oracle 10g Application Server database repository called the Infrastructure. The way it works is based on the concept of web browser cookies which are authenticated by the Oracle 10gAS server and reciprocated to partner and external applications on the end user web browser. Partner applications are internal web based applications such as Oracle 10g Portal, Forms and Reports within the Oracle 10gAS application server environment. In other words, users accessing applications within Oracle Application Server must be authenticated by the Oracle 10gAS Single Sign On Server. External applications are third party external web based applications that can be included in the 10gAS environment in terms of authentication via single sign on. Single Sign On (SSO) is based on the mod_osso module of the OHS (Oracle HTTP Server ie: Apache 1.3.x) within the Oracle 10gAS application server. Getting back to the difference between partner applications and external applications in terms of how SSO behaves is that external applications retain their usernames and passwords without delegating responsibility for authentication to the SSO server.

mod_osso and SSO


The mod_osso module is contained within the OHS (Oracle HTTP Server) and transmits simple header values to Oracle 10g Application Server applications as part of user validation and authentication procedures. These header values include the following:
-username
-userid GUID
- language information
- user DN (distinguished name) used with OID (Oracle Internet Directory)

The SSO server issues a challenge to the application and once the user and application have been authenticated, the redirect occurs back to the user browser which sets the SSO cookie in the user's browser with the authorization token. Now that we have given the summary on SSO concepts, lets examine how to setup, configure and administer a basic SSO environment with Oracle 10gAS (10.1.2.0.2) and Portal on Linux (OEL 5.3) platform.

Configure Single Sign On Server (SSO)


Single Sign On server (SSO) is composed of the OHS module mod_osso which provides a database access descriptor (DAD) that is stored as metadata configuration information in the Oracle 10gAS infrastructure database. SSO interfaces with OC4J (Oracle Container for Java) and OHS (Oracle HTTP Server or Oracle's implementation of Apache 1.3) to provide the mechanism for single user and password access to Portal and other Oracle 10g Application Server applications.

Single Sign On Concepts


Single Sign On (SSO) Server provides the mechanism for users to logon to Oracle Portal and Oracle Application Server applications by using a single username and password which is stored in the user's browser via a SSO cookie that has been authenticated against the SSO server. The components of Single Sign On (SSO) for Oracle 10gAS are the mod_osso module based in the OHS (Oracle HTTP Server) which is Oracle's version of the popular Apache 1.3 web server as well as metadata in the Oracle 10gAS infrastructure database.

How to Configure Single Sign On Server (SSO) for Oracle 10g Application Server


Our examples will user Oracle 10gAS (10.1.2.0.2) release on Linux (OEL 5.3) platform.
The following access point in Oracle 10g Application Server allows us to configure the SSO server.






In the below main screen for Oracle 10gAS we can view the main components for Single Sign On (SSO) Server:



Single Sign On Server provides many customization options for both partner and external applications. Partner applications are authenticated directly from within Oracle 10gAS while external applications have their own username and password authentication which are registered to the SSO server. Portal is a partner application for example. Now to view the status of the SSO server within the Oracle 10gAS infrastructure, we can navigate to the SSO server status:



From here we can monitor the status of SSO server operations including tracking any failed user logons authenticated against the Oracle 10gAS environment. Next, lets examine how to configure SSO Server settings for Oracle 10gAS.


This allows us to change settings for Single Sign On session duration as well as an additional session
policy setting that requires us to verify IP addresses for requests made to the SSO server.




For managing applications with Single Sign On (SSO) Server, we can access the link to Partner and External Applications as shown below.

For example, if we wish to modify configuration for exiting Portal applications, we can select the edit Partner application as follows.



Now the following options appear for Partner application configuration with SSO server.






Here we have a plethora of configuration options for our Portal based applications for Oracle 10g Application Server with SSO.
We can configure our URL settings as well as login timeframe details as well as application administrator account information. Now let's examine how to add and manage external applications with Single Sign On Server (SSO) for Oracle 10gAS.





Here we have many options for the URL and additional configuration settings for external applications with SSO.
Of particular interest to us is the login URL, username and password field name as well as the next subheading below
for Authentication Method for SSO with the external application. We have a few options here: POST, GET or BASIC AUTHENTICATION. Let's offer a brief explanation of these three methods below.

-POST allows data to be posted to the Single Sign On (SSO) server and submits login credentials within the body of the application form.

- GET presents the page request to the server and submits the login credentials in the application part of the URL

- BASIC AUTHENTICATION submits the login credentials within the application's
URL protected by HTTP basic authentication.

How to Access SSO Server from Oracle Portal


During installation for a midtier application server instance with Portal, Oracle automatically adds Portal as one of the
new partner applications for SSO. We can access SSO server from Portal as shown below.



Of note is to choose the second main section that shows Edit SSO Server Administration.

Single Sign On is simple to configure and administer. It is easier to manage and setup than the far more complex
items within Oracle Identity Manage such as OID and SSL which require far more steps. To monitor SSO server components from the operating system, we can use the OPMN (Oracle Process Monitor and Notification) facility. The command to obtain a status check for all of the Oracle 10gAS components is to run opmnctl status as shown in the following example.



Here we want to make sure that OC4J_SECURITY, OID, OC4J_Portal, and OID are in Alive status or SSO Server will not function correctly. We will provide future discussions on Oracle Fusion Middleware topics for Troubleshooting Oracle 10gAS, Webcache, Performance tuning and additional topics on Identity Management as well as coverage of the newest member of the Oracle Application Server family: Weblogic. Stay tuned!

Cheers,
Ben

Identity Management Part I: Making friends with the Oracle Internet Directory (OID) for Oracle Application Server 10gR2

Dear Readers,

Our series continues for Oracle Fusion Middleware technology with a focus on Oracle Application Server (10gAS). The following will be topics for Fusion Middleware:

Part I: Identity Management- OID and SSO
Part II: Tips and Tricks for Monitoring and Troubleshooting Oracle Application Server
Part III: Performance Tuning Oracle Application Server

As part of our new Fusion Middleware series of tips for Oracle database technology, this week will cover
how to configure the complex identity management piece (IdM) for Oracle 10gR2 Application Server (OAS)
by using the Oracle Internet Directory (OID) component of the Oracle 10g Application Server infrastructure.

What is the Oracle Application Server (OAS) ? The Oracle 10gAS is a robust technology that provides a multitude of web server
and rich content management functions for customer applications. It is the heart of many core Oracle enterprise technologies such as Oracle EBS and additional technologies that require web inter/intranet functionality.

For our case study, we will use a full blown installation of Oracle 10gR2 Application Server (10.1.2.0.2) on the Oracle Enterprise 5 Linux 32 bit platform (OEL 5.3) . Since Fusion Middleware is a suite of 200+ products, we will only cover Application Server for the time being in our Fusion Middleware series before we move onto other core topics such as BPEL and SOA (Service Oriented Architecture). What are the components of the Oracle 10g Application Server? There are two major pieces: the middle tier application server and the second technical stack is called the Infrastructure. In a standard OAS installation, one only needs to use the middle tier application server for most purposes. The infrastructure is an optional enterprise tech stack that is not always required. In essence, we have an n-tiered architecture that makes up the structure for an Oracle 10gAS environment: web tier, middle tier, and infrastructure. First, lets review the components of the middle tier for Oracle 10g Application server.

Web Tier

- Oracle HTTP Server (OHS) which is the Oracle modified version of the Apache HTTP server with a few twists unique to Oracle
- Oracle Application Server Web Cache (optional): provides enhancement in performance for caching web page content
and some software based load balancing features

Middle Tier Oracle 10g Application Server (10.1.2 OracleAS)

- OC4J server which is the Oracle Container for Java Enterprise Edition and the heart of the Oracle 10g Application Server
- Oracle Portal: rich web based content management system for portlets and web applications
- Oracle Wireless: for handheld wireless devices to access web rich database applications

Infrastructure Components of OracleAS 10gR2:

The infrastructure architecture of Oracle 10g Application Server consists of two core technical items:
Identity Management: includes Oracle Internet Directory(OID), Single Sign On (SSO)
Metadata Repository which is an Oracle 10g database which stores metadata for OAS application services such as OID and
SSL.

Oracle recommends at least a 2-3 tiered approach to optimize performance and provide for optional load balancing solution.

One key area within the Oracle Application Server that is poorly understood is Identity Management. Identity management provides many security administration functions to streamline access to Oracle web systems such as Single Sign On (SSO) authentication. Single Sign On allows a user to access multiple Oracle web applications with a single user name and password that is authenticated against the OAS and Oracle database environments. Stay tuned as we will cover SSO in future installments. For now, hang on and we will return to OID and Application Server setup. The reason why I chose to cover OID first is that now Oracle 10gAS requires a full setup with OID before installation of Discoverer for the Business Intelligence (BI) environment. What is OID? OID or Oracle Internet Directory is the Oracle LDAP implementation (Lightweight Directory Access Protocol) with Application Server. I like to think of OID is Microsoft Active Directory on steroids for Oracle. So for those of you who are new to LDAP, to break it down in simple terms. LDAP has a name structure based on an inverted tree as shown below:



Suffice it to say, a discussion of LDAP is beyond scope of our discussion for Oracle 10gAS but a good reference on LDAP is available in the Oracle Internet Directory Administrator's Guide 10g available at .

OK, lets get started with configuration for Oracle Internet Directory (OID) with Oracle 10g Application Server. One useful item to mention is the help system that comes with OAS as shown in the below figure example:



Now, lets start a new session to configure OID. Of note: OID can also be configured for non-Application Server environments. For instance, we can setup OID with Oracle 11g. The OID security is available from the Network Configuration Assistant (netca) to setup the Oracle Internet Directory with Oracle database environments. For Oracle 10gAS, the method to setup and configure OID is to use the oidadmin utility.

Back to our Oracle 10gAS environment. The oidadmin utility is located under our $ORACLE_HOME/bin directory. Make sure to correctly set your Oracle environment variables for your operating system. We start oidadmin and the welcome screen appears below.



We need to login to OID as the default administrator. Since OID uses LDAP, we need to specify the login format based on common name (CN)

cn=orcladmin
password= the password for ias_admin account that we chose during the Oracle 10gAS installation process.

Then we login. The welcome screen appears and shows our default OID environment.



Now, let's expand the tree structures to expose the various configuration details for OID with our 10gAS environment.



As you can see, multiple tasks can be performed to administer users and servers within the OID environment for Oracle 10gAS.
Suffice it to say, it would require an entire book to detail all aspects of Oracle Identity management with Oracle 10g Application Server. For now, we will provide a basic walkthrough to get the baseline configuration up and running with our new 10g Application Server. There are three divisions of OID configuration to consider:

1. Access Control Management
2. Schema Management
3. Server Management

Access Control Management

First we will consider Access Control Management with OID. Access Control management is the process of granting and restricting access to a realm of Oracle application or database servers within the Oracle Internet Directory (OID) environment for Identity Management.

Access controls can be managed and created via the OID interface for applications and users based on the OID LDAP X.509 standard using cn (common name) and LDAP syntax. For example, we have the cn=Reports details displayed for Access Control Management listed below.



Schema Management for OID and Identity Management


By default, OID stores all metadata about configuration details and users in a set of schemas within the Oracle 10g repository database which is part of the Infrastructure component of Oracle 10gAS.

Each schema item is broken down into subitems such as object id, class, and attributes based on the LDAP syntax for OID as shown below.



Now let's move on to showcase server management for OID and 10g Application Server.

Server Management for OID and Identity Management


OID provides various types of server configurations for Oracle 10gAS:

- Directory Server
- Replication Server
- Integration Server

These servers determine the specific type of security mechanism and configuration to be used with Oracle 10g Application Server. For example, to view, change and update settings for our directory server we would expand the tree structure menu item under Server management:



We also have options to modify settings for SSL (Secure Sockets Layer):



Now let's move on to configuration tasks for Oracle 10g Application Server with a basic Identity Management setup. So, we return to our Oracle 10gAS control window.



To access the settings for Identity Management, we navigate to the Infrastructure tab on our Application Server Enterprise Manager. As expected, it shows us that nothing has been configured yet. We click on the configure tab.




We enter the hostname details for our 10g Application Server, port number.



Recall that we need to specify the username in LDAP format with cn=orcladmin and the password for ias_admin that
was given during the Oracle 10gAS installation. Oracle then politely informs us that the entire tech stack for Oracle 10g Application Server will be shutdown and restarted to complete our basic Identity Management configuration. We verify all settings are correct.



Now our configuration setup should be complete for a baseline Identity Management install. Our next post will detail basic SSO configuration for Oracle 10g Application Server.

Cheers,
Ben