Difference Between DCC and ECC in OAM

DCC : Detached Credential Collector (AKA Authenticating Webgate), new feature introduced in  11gR2

ECC  : Embedded Credential Collector, default 11g behavior

In OAM 10g user credentials are submitted to Webgate and than Webgate communicate to OAM server with mitigate the changes. when OAM 11G version was introduced, it had different flow. user credentials are submitted to Webgate and Webgate displays OAM server login page(for credential collection). so, you have to expose OAM server for credentials submissions that is not a good practice for companies who don't want to have  OAM exposed, it is security volatility for them. so Oracle provided DCC feature in OAM 11gR2.
Now, when you are configuring 11gR2 Webgate you have a check box "Allow Credentials Collector Operators". if you click this check box users credentials will be submitted to Webgate(middle tier) and Webgate will submit user credentials to OAM server.
DCC is the way to go now a days, now companies have option to separate Webgate in web tire from OAM server.
Access Manager supports the embedded credential collector (ECC) by default and also enables you to configure the latest Webgate to use as a detached credential collector (DCC, also known as an Authenticating Webgate).

For more detailed information, please refer the below URL :
http://www.ateam-oracle.com/part-2-custom-login-and-logout-with-detached-credential-collector-dcc/

WebGate plug-in is unable to contact any Access Server

One of the most common error in OAM is "WebGate plug-in is unable to contact any Access Server".

First of all, there are many reasons for this error to happen. Most of the time it is environment specific and hence, there is no straight forward/standard solution to this error.

However, the issue must be resolved if following points are verified to be working

1. As the error clearly states that webgate is not able to connect Access Server. There could be a connection problem between webgate & Access Server. check if firewall is terminating the connection between webgate & Access Server.

2. Check if the Access Server is up & running by issuing netstat command and look for the Access Server ip and port number.

3. Check if other webgates connected to Access Server is able to connect. If other webgates are connecting then it rule out the problem with Access Server.

4. Restart Access Server and Webserver. If restarting resolves the issue it means that while restarting Access Server terminates the old connections and new connection is being established.

5. Make sure all the components involved in OAM architecture is working fine for ex: directory server, load balancer, firewalls, database etc.

6. If it is a new installation, then verify the clock settings of Access Server host and webgate host. Access Server clock must be running ahead of webgate.

7. Verify the webgate diagnostic page. http(s)://hostname:port/access/oblix/apps/ webgate/bin/webgate.cgi?progid=1. If the page is not opening then webgate is not installed correctly.

8. If the Access Server and Webgate are configured in CERT mode then check if certificate is Valid.

9. Change the log level to TRACE and diagnose the oblog.log file for Access Server and Webgate.

Main difference between Application Server and Web Server

1. Application Server supports distributed transaction and EJB. While Web Server only supports Servlets and JSP.

2. Application Server can contain web server in them. most of App server e.g. JBoss or WAS has Servlet and JSP container.

3. Though its not limited to Application Server but they used to provide services like Connection pooling, Transaction management, messaging, clustering, load balancing and persistence. Now Apache tomcat also provides connection pooling.

4. In terms of logical difference between web server and application server. web server is supposed to provide http protocol level service while application server provides support to web service and expose business level service e.g. EJB.

5. Application server are more heavy than web server in terms of resource utilization.

OAM 11g Webgate Flow

OAM 11g Webgate flow:

   1. An OAM 11g Webgate intercepts the incoming request for a resource, determines whether the resource is protected.

          a.  If it is Unprotected : User will able to see the requested application page without authentication and  authorization.
       
        b.  If it is Protected – the OAM 11g server constructs and returns a response back to the Webgate. That response contains the authentication scheme required to authenticate the user.
  
   2. Next the Webgate sets a cookie (OAM_REQ) to keep track of the target/requested URL and then redirects to the OAM 11g server, which routes the request to the credential collector.
   
   3. The detached credential collector (DCC) serves up the login page, which captures credentials and posts the credentials to the OAM server.
  
   4. The credentials are validated against the ID store configured for this particular authentication scheme.

   5. Once the credentials are validated, the OAM server creates an authentication token, the session in Coherence, and creates a server side session cookie called the OAM_ID cookie, which has details about the user, the time the session was created, the idle timeout, and session identifier to the coherence session.
   
   6. Then the OAM server constructs a response which is encrypted with the Webgate's key and redirects to the Webgate.
  
   7. The Webgate decrypts the response, extracts the authentication token and the session identifier, and uses that information to set OAMAuthnCookie, which is set as a host cookie: OAMAuthnCookie_. (In this step if you are using an OAM 10g webgate, the response from the server will contain the information required to set ObSSOCookie, if you are using mod_osso, the response will contain the information required to set the OHS host cookie.)
   
    8.When subsequent requests are made from that Webgate, the authentication token is passed by the Webgate to the OAM server, which validates the authentication token, checks the validity of the OAM_ID cookie and session timeout, and does the appropriate authorization checks.

    9.As the result of authorization checks, additional attributes may be added to HTTP Headers and passed to downstream applications. This is especially useful when asserting user identity and group or role information to downstream applications such as those running on Oracle Weblogic Server.

Differences between OAM 10g Webgates and OAM 11g Webgates

OAM 10g Webgates:

1.   C-based agents that are to be deployed on Web servers
2.   Domain-based cookie
3.   ObSSOCookie (one for all 10g Webgates)
4.   One Web server configuration supported per Webgate. Need to have multiple WebGates for multiple instances
5.   There is no detached credential collector (DCC)
6.   OAM 10g provides a proprietary multiple network domain SSO capability that predates Oracle Identity Federation. Complex configuration is required.

OAM 11g Webgates:

1.  Java-based agents that are to be deployed on Web Servers (Specific to OHS Server)
2.   Host-based cookie.
3.   Individual Webgate OAMAuthnCookie_ making it more secure
4.   Has separate install and configuration option.  Hence, single install and multiple instance configuration is supported. 
5.  Capability to act as a detached credential collector (DCC)
6.  OAM 11g supports cross-network-domain SSO out of the box.Oracle recommends you use Oracle Identity Federation for this situation.
   

How to convert .cer file into cert8.db?

Problem:

How to convert .cer file certificate into cert8.db certificate?

Solution:

1. If you have already exported .cer file, it will not directly convert .cer to cert8.db format.
2. So instead of directly converting, simply convert that .cer into .pk12 and then, use certutil command to import .pk12 to cert8.db extension

For more information regarding converting .pk7 to .cer extension, please read the below url;

http://maniidm.blogspot.in/2014/09/how-do-i-convert-pkcs-7-certificate.html

How do I convert a PKCS 7 certificate file to x.509 certificate file?

Problem:

Certificate file in email is PKCS 7 format and server certificate installation instructions requires x.509 format.

Resolution:

To convert the PKCS 7 formatted cert.cer file to x.509 format perform the following steps.

1. Copy the PKCS 7 certificate file to a Windows desktop
2. Rename the file and give it a .p7b extension
3. Open the .p7b file
4. Click the plus ( + ) symbol
5. Click the Certificates directory
   Note: If an EV certificate is being converted your should see three files. The End Entity certificate and the two EV intermediate CA's.
6. Right click on your certificate file
7. Select All Tasks > Export
8. Click Next
9. Select Base-64 encoded X.509 (.cer) > Click Next
10. Browse to a location to store the file
11. Enter a File name. For example MyCert. The .cer extension is added automatically.
12. Click Save
13. Click Next
14. Click Save

How to Re-configure Webgate

Go to C:\>cd Webgate_Install_Directory\NetPoint\Webgate\access\oblix\tools\configureWebGate

C:\Webgate_Install_Diretory\NetPoint\Webgate\access\oblix\tools\configureWebGate>configureWebGate.exe -t WebGate -i C:\Webgate_Install_Directory\NetPoint\Webgate\access

 Please enter the Mode in which you want the Web Gate to run : 1(Open) 2(Simple)  3(Cert) :Enter which mode you want to configure

 Please enter the Web Gate ID : Provide Web Gate ID which is configured in the Application Domains of OAM Administration Console

 Please enter the Password for this Web Gate :Provide the password

 Please enter the Access Server ID : OAM_SERVER1

 Please enter the Access Server Host Machine Name : Provide OAM server host-name

 Please enter the Access Server Port : 5575

 Preparing to connect to Access Server.  Please wait.

 Web Gate installed Successfully.

 Press enter key to continue ...

The above steps completes the Webgate re-configuration part on Web-server machine where web Gate is installed.

Restart IIS server.

Enable/Disable WebGate plug-in on Apache

1. Take a backup of httpd.conf from Apache installation directory

2. Edit the file. Add the following sections in end of the file to ENABLE it and Save.

3. Edit the file. Remove the following sections in end of the file to DISABLE WebGate plug-in and Save.

#*** BEGIN WebGate Specific ****

<IfModule mod_ssl.c>
LoadModule obWebgateModule "E:\ApacheWebGate\NetPoint\WebComponent\access\oblix\apps\webgate\bin\webgatessl.dll"
WebGateInstalldir "E:\ApacheWebGate\NetPoint\WebComponent\access"
WebGateMode PEER
</IfModule>

<IfModule !mod_ssl.c>
LoadModule obWebgateModule "E:\ApacheWebGate\NetPoint\WebComponent\access\oblix\apps\webgate\bin\webgate.dll"
WebGateInstalldir "E:\ApacheWebGate\NetPoint\WebComponent\access"
WebGateMode PEER
</IfModule>

<Location /access/oblix/apps/webgate/bin/webgate.cgi>
SetHandler obwebgateerr
</Location>

<Location "/oberr.cgi">
SetHandler obwebgateerr
</Location>

<LocationMatch "/*">
AuthType Oblix
require valid-user
</LocationMatch>

#*** END WebGate Specific ****

Enable or Disable WebGate Plug-In on IIS 7.5

1.    Go To Internet Service Manager.
2.    Expand the local computer by clicking +, in the left panel.
3.    Click to expand the required Web Sites tab.
4.    Right-click Web Sites in the Internet Information Services tab, click Properties, and perform the following steps:
a.    From the Internet Information Services tab, click the Edit button.
b.    Locate the ISAPI filter tab to confirm (or add) the filter DLLs, as follows:

Filter: If you updated the IIS Web server configuration file, webgate.dll should be properly located. –

Disable : Stop IIS, remove the existing WebGate entry and Start the IIS for changes to take effect

Enable : Stop and Add the WebGate entry as follows and Restart the IIS for changes to take effect

No Filter: Add the webgate.dll filter from Webgate_install_dir\oblix\access\apps\webgate\bin\webgate.dll

E.g: OracleWebGate - Webgate_install_dir\oblix\access\apps\webgate\bin\webgate.dll
c.    Save and apply any changes.

WebGate Installation

WebGate Installation

Installation:

Pre-requisites to a webGate installation

• The application or web hosting teams must ensure the following before attempting a  webgate installation.
•   Please configure the webgate prior to webgate installation.
•   Ensure the OAM 11g Administration Console is up & running
•   Ensure the IIS Web server is installed and ISAPI Role or extension has been added
•   Ensure that your IIS Web server is not in lockdown mode
•   Ensure whoever performs installation will have administrator rights and write permissions to the folder
•   Take the back up of C:\Windows\System32\inetsrv\config\apphostconfig
•   Take the back up of C:\Windows\System32\msvcirt.dll
•   Verify Time Sync Server configuration
• Verify connectivity over TCP Port 5575
• Verify administrative access for installation
•  Verify presence of a webserver on the target host

SetUp Webgate on IIS:

The following steps outline the installation process for an IIS 6.x and 7.x web server on Windows.

 Run the setup program for IIS: The respective binary provided by the <IAM> team for your web server version and type.

Oracle_Access_Manager10_1_4_3_0_CR2_Win64_ISAPI_WebGate.exe

Click on the “Run” button if the security warning box is presented

Welcome screen

Click Next and continue 

Click Next and continue

Select IIS and Click Next and continue

Make note of the installation path for the respective OS that it is being installed. The application path may be required for multiple configuration changes at some point in the future.

Below screenshot shows default installation location. If required change as per your system.

Provide Installation location or select default value.

Click Next and continue.

Click Next and continue

Select the mode as per your requirement during installation.

Then click Next and continue

Click Next and Continue

Notice that the entire options screen is not visible by default. You need to scroll down and change the default port value. Do NOT click on Next to continue.

Keep the values sent to you from the <IAM> team handy for this screen and input them as applicable. Apart from these provide value for "Password Phrase". You can provide any value.

Select "Yes" and Click Next and Continue

Click Next and Continue

Click Next and Continue

Click Next and Continue

Click Finish.

This completes the Webgate installation on the web server.

Configuring WebGate instance

Configure the OAM 10g webgate instance in OAM Administrator console.

 Log in to the OAM Console and review the new registration:

   From the OAM 11g Console System Configuration tab, navigation tree,expand the following nodes:

§  Agents

§  OAM Agents

§  10g Agents

  Double-click the agent’s name to display the registration page and review the details.

  If you will install a fresh WebGate for this registration, you must enter the following details during the installation.

For example:

Agent Name—Enter this as the WebGate ID during WebGate installation.

Access Client Password—Enter this as the WebGate password during WebGate installation. If no password was entered, you will leave the field blank.

  Access Server Host Name—Enter the DNS host name for the primary OAM 11g Server with which this WebGate is registered.

  OAM Proxy Port—From the OAM Console, System Configuration tab,navigation tree, double click Server Instances and locate the port on which the OAM Proxy is running.

WebGate ID -     

Password for webgate-

Pass Phrase - <Provide same value which was entered during installation> 

Access Server ID -   

Access Server Port – 

Access Server Host –