IdM

FREEDOM!! #StopSOPA

To protest SOPA I am sharing this content (that is not my original material).

p.s.
I am also advocating for Freedom for Scotland, Voice Activated for native Scottish speakers, funny videos, and purple unicorns. <— their real … go check Wikipedia…

Recommended IDM Books #IDM #infosec

Here are the books that I refer to in my IDM work:

Oracle:

• Oracle Identity and Access Manager 11g for Administrators
• Designing an IAM Framework with Oracle Identity and Access Management Suite (Oracle Press)
• Effective Oracle Database 10g Security by Design

ForgeRock:

• OpenAM

Using sed to clean up an LDIF file for import #Oracle #Identity #UNIX

I needed to import a group of users, into Oracle Internet Directory (OID) with attributes in a variety of backend data stores. I used Oracle Virtual Directory to virtualize the data stores into a single ldap view. I used the OVD adapter configuration to specify which attributes I wanted returned. I then exported using the export control from Apache Directory Studio. This resulted in an ldif file containing all of the records I needed with attributes. There were a few additional attributes as a result of using OVD that I now had to deal with.

I ended up with an ldif file that contained a lot of records like this:

dn: cn=Babs Jensen@ACME.GOV,ou=temp_user_load
objectclass: inetOrgPerson
objectclass: organizationalPerson
objectclass: person
objectclass: top
cn: 1234556677@ACME.GOV
cn: Babs.Jensen@ACME.gov
cn: Jensen, Babs
sn: Jensen
givenName: Babs
mail: BABS.JENSEN@ACME.GOV
vdejoindn: ou=acmeinfo_temp:cn=JENSEN\,BABS,ou=acmeinfo_temp
vdejoindn: AD_temp:CN=babs.jensen@ACME.GOV,OU=locations,OU=park,ou=ad_t
emp,dc=acme,dc=local
fascnDecoded: 1234567890987654321
guid: ABcdedghi1234567890
ssn: 12345678

…

Note: With the SED command you can make changes directly to the source file but I am creating a new target file with each change I can make so that I can always revert back if the command doesn’t work exactly the way I want it to.

I wanted to get rid of lines that don’t start with an attribute name (In my case I am free to get rid of lines that carry over into the second line … YMMV)

I also wanted to specifically wanted to get rid of all lines that start with “vdejoindn:” and there are also some vdejoindn lines that overrun onto a second line that won’t beremoved if I use sed to remove lines with the pattern matching vdejoindn:.

So, first I want to remove all lines that don’t contain a colon. This removes the overrun lines but also all blank lines.

$ sed ‘/:/!d’ input.ldif > tmp.ldif

this keeps the lines with a colon.

But now we don’t have breaks between the records

$ sed ‘s/^dn:/\n&/g’ tmp.ldif > tmp2.ldif

Ok, now I want to get rid of the lines that have “vdejoindn:”.

$ sed ‘/vdejoindn:/d’ tmp2.ldif > tmp3.ldif

Now at some point I ended up with “^M” at the end of each file … I don’t know if this is because I opened with VIM in Windows before moving to Linux … I am going to assume so but either way in this instance I want to remove these characters.

$ dos2unix tmp3.ldif > tmp4.ldif

Alright, Now, for me to import this into Oracle Internet Directory (OID) I’ll need to add the “changetype” directive. I am going to add the string “changetype: add” on a new line after each line with “ou=temp_user_load:” which is the temporary suffix I used in this export.

$ sed ‘/ou=temp_user_load/ a\changetype: add’ tmp4.ldif > tmp5.ldif

Now, should be the last step, prior to importing, is to correct the entries “DN” attribute. Essentially, we need to replace “ou=temp_user_load” with the correct suffix for where these users will be created.

$ sed ‘s/ou=temp_user_load/cn=Users,o=icam,dc=acme,dc=local/g’ tmp5.ldif > tmp6.ldif

At this point my ldif file (“tmp6.ldif”) is ready to import into my directory. You can use the ldapmodify command or since I am using OID you can use bulkload (which is recommended for large record sets).

Migrating User objects (and userpassword) in OID

uh, so … what version was that again? #Oracle #Fusion #Identity #OHS

A really quick post to share something that I found this morning.  I am constantly trying to remember the exact version of OHS (Oracle HTTP Server) that is installed (Actually any Fusion Middleware component).  Sometimes I am inheriting an existing environment or validating someone else’s environment and need to baseline what is installed.

Here is how to get a list of what components are installed and their current version:

$ORACLE_HOME/OPatch/opatch lsinventory -detail

This will dump out a ton of information on the instance of OHS.

Book Review: Oracle Identity and Access Manager 11g for Administrators (Packt Publishing)

As many of you may know, Atul Kumar, has finished writing his book “Oracle Identity and Access Manager 11g for Administrators“.  I had the pleasure of being a technical reviewer for this book.  If you know Atul or his website then you know my job was pretty easy as he is well versed and experienced with Oracle Identity Management.  I was pretty excited to finally get a hard copy of this book because, to be honest with you, I was already using this book as a reference before it was finished .  I had been having some difficulty deploying an access agent within the new 11g framework and I was able to find a very detailed explanation within Atul’s book.  I am not sure that I can give a higher compliment to an author than to say, “I was using your book before it was even printed!”.

What I like best about this book is that Atul starts out in the first chapters with a very nice, detailed, explanation of Identity Management and then builds on that explanation to introduce each component of Oracle Identity and Access Manager.  Several chapters are tied together in that they build on fundamentals explained in a previous chapter but that doesn’t mean that someone couldn’t jump into a chapter and not still receive a good understanding of those specific concepts.

I have already recommended this book to several people that are new to Oracle Identity Management as well as to some folks that have several years of Oracle Identity Management experience.  I recommend this book to anyone who is working with Oracle Identity and Access Management 11g.

Change the Listen Port for Weblogic AdminServer #Oracle #IDM #Identity

I had to re-install my Oracle Identity Management environment server and I must have had a listener running that I forgot to shutdown. The default Admin Port (7001) wasn’t available, so the installer used 7002. Typically, I would have shutdown all of the services, restarted the server and then uninstall the software. This usually frees up all of the default ports and allows me to perform a clean install. I am not sure what happened … but my mistake is an opportunity to share a good lesson. Usually using 7002 for the Admin listener would not be a big deal but in this particular environment all of the ports, except those specifically requested in advance, are blocked by a firewall. So, once I had the new install finished I wasn’t able to reach the Fusion Middleware Console (e.g., http://idm.acme.com:7001/em) from my desktop browser.

I was a little nervous about changing this because sometimes the port number is referenced in a lot of different places which makes changing it a little difficult to say the least.

As it turns out changing this is pretty trivial. You need to change the port referenced in the config.xml file and then in the startup and shutdown scripts. That’s it.

Step 1. Modify the config.xml file:

Open the following file: $Middleware_home/user_projects/domains/IDMDomain/config/config.xml

In the server directive, change the value from 7002 to 7001: (Make sure you catch all instances of the port)

    AdminServer
    1000
    200000
    20
    21

      AdminServer
      true
      7001

    idm.acme.com
    7001

Ok, so save those changes and then go to Step 2.

Step 2. Modify shutdown scripts:

Change to the directory that contains the startup and shutdown scripts for Weblogic:

$ cd $MIDDLEWARE_HOME/user_projects/domains/IDMDomain/bin

You will need to edit the following files: startManagedWeblogic.sh, stopWeblogic.sh and stopManagedWeblogic.sh

Look for the ADMIN_URL variable and change the port in the value (e.g., ADMIN_URL=”t3://idm.acme.com:7001″) from 7002 to 7001.

That’s it!

Now, save the changes to those to files and then restart WebLogic Admin and any managed servers.

Federal #ICAM “Reading List” #IDM #Identity

claims-based authorizations conversation

Steve_Lockstep @paulmadsen @brad_tumy CCW as in COM Callable Wrapper? Too tech for me I just say context usually clear to RP so design claims to match 4/7/11 5:50 PM

Creating self-signed certs for a development environment. #Oracle #IDM #PKI

Implementing Identity and Access Management requires working with PKI certs to secure communication channels. For development purposes you can create your own self-signed certificates. I use OpenSSL as the RootCA (Signing Authority) and keytool as interface to the Java Key Store (JKS).

The following outlines the steps required to create a RootCA, generate a certificate request, sign the request and then import the signed certificate back into the JKS.

A few notes about my environment:

• These instructions were validated on Oracle Enterprise Linux (for most flavors of Linux these instructions will be the same)
• OpenSSL and Keytool were already installed on the server
• In my example everything was installed on the same server … your OpenSSL instance may be on a different server.
• OpenSSL and Keytool are available on my users $PATH … yours may not be.

So, let’s do this thing …

Configure a CA, using OpenSSL

1. Create a working directory:mkdir /opt/rootCA
2. Under /opt/rootCA make the following directories: private, certs, newcerts
   
3. Change the permissions of rootCA (and subdirectories):chmod -R 700 /opt/rootCA
   
4. From the /opt/rootCA directory, find (system wide) and make a local copy of the openssl.cnf (/opt/rootCA/openssl.cnf). You do not have to use the default configuration file that is installed with OpenSSL. In my case it was owned by root and I couldn’t change it anyway. So, I made a copy of it and was able to make the changes I needed. Note: I set all of the attributes to optional because I kept getting an error when I tried to sign the certificate that some of the required attributes were missing from the server certificate (maybe a bug??)
5. Create the CA certificate:openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 365 -config ./openssl.cnf

Create a keystore and private key:

keytool -genkey -alias alias -keyalg RSA -keysize 1024 -dname “server dn” -keypass keypass -keystore keystore.jks -storepass storepass

Create a certificate request (CSR) from the application server:

keytool -certreq -v -alias alias -file servername.csr -keypass keypass -storepass storepass -keystore ./keystore.jks

Sign the Certificate Requst:

1. Sign the CSRopenssl ca -config openssl.cnf -in ../Middleware/keystores/servername.csr -out newcerts/servername.pem

Import the Trusted Root CA into the servers keystore:
keytool -import -v -noprompt -trustcacerts -alias rootcacert -file rootCA.cer -keystore keystore.jks -storepass storepass

Convert the signed cert (*.cer) into DER format (keytool preference) **

openssl x509 -outform der -in certificate.pem -out certificate.der

Import the signed cert into they server’s keystore:
keytool -import -v -alias alias-file servername.der -keystore keystore.jks -keypass keypass -storepass storepass

**Note: keytool whined that the cert was not in der format so, I used openssl to convert it.

I would love to hear feedback on these instructions and any steps that would make this easier.