tag:blogger.com,1999:blog-91442253117055859732024-08-30T14:30:10.207-05:00Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.comBlogger32125tag:blogger.com,1999:blog-9144225311705585973.post-37577499062450916292023-09-03T13:23:00.010-05:002023-09-03T23:59:32.610-05:00

Keycloak is a very popular Java based open source Identity Access Management product. The recent versions (17.x onward) have gone server-less using Quarkus. When dealing with government, your SSO/ IAM system required to be FedRAMP and FIPS compliant.  Keycloak version 21.x+ is FIPS-2 certified, but additional configurations are needed to make the default Keycloak FIPS 140-2 enabled. 

Kabi Pattanayakhttp://www.blogger.com/profile/10372382266936303331noreply@blogger.com0Pleasanton, CA 94566, USA37.6436199 -121.86764649.3333860638211519 -157.0238964 65.953853736178843 -86.7113964tag:blogger.com,1999:blog-9144225311705585973.post-3071672921509390472020-09-05T20:52:00.000-05:002023-09-03T13:34:46.319-05:00

I learned my first SAML integration in 2005 using a product called SHARE-id developed by Oblix that was later part of IAM product suite of Oracle. Last 10 years there is a huge adaption of SAML protocol for a seamless integration with a centralized Authentication service providers like Azure, Ping, Forgerock, Google and so on. You can also write your own Authentication service supporting SAML.

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-19775921122864110442020-04-26T17:29:00.000-05:002020-04-26T19:22:52.030-05:00

The companies are increasingly adapting Agile methodology, Continuous Integration and Development process to make the delivery efficient.  There is also a noticeable increase of productivity among the developers.  The management expectation has gone up and this creates a quite a bit of stress  on engineers to keep the pace. Staying focused on finishing one logical task becoming

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-91708993563733236942016-04-13T23:51:00.000-05:002016-04-13T23:55:41.383-05:00

End users often misinterpret the Kerberos authentication mechanism to mean Single Sign-On (SSO) in corporate world.  Kerberos authentication provides seamless sign on to (web) applications by using the Kerberos ticket generated/ refreshed during the user’s authentication to the network (when user first login to the computer). For example, if web applications AppX and AppY are configured

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-58056337635029648292014-07-30T18:24:00.002-05:002014-07-30T18:27:52.245-05:00

I remember struggling with this one in OAM R1.  Since this feature was not available in R1, we implemented this by our own custom code.  Finally this is available in R2.  Here is the link (http://docs.oracle.com/cd/E40329_01/admin.1112/e27239/getstarted.htm#CIHBEEAI) to set this up and test in 30 minutes max. I am just posting the 1st step of exact WLST command taht I ran to

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com2tag:blogger.com,1999:blog-9144225311705585973.post-40398469830852652882014-03-10T18:28:00.000-05:002014-03-10T18:36:02.509-05:00

OAM custom authentication module requires a custom manifest.mf file to be included in your custom plugin jar file. It is is easy to include your own manifest.mf file during jar building process in eclipse. But it not that easy if you are using Netbeans .  If you do a clean build using Netbeans, you will end in having a default manifest.mf file in the jar file. Here are the steps to include

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com1tag:blogger.com,1999:blog-9144225311705585973.post-15506210581345454712014-01-15T13:24:00.000-06:002014-01-15T13:28:21.017-06:00

I have few user records with Japanese character (like 高山) in their attributes. Querying these users in OVD through ODSM displays it correctly . However, the same attributes when passed as OAM header variable through OAM-Authorization-Scheme spit out garbage like '=?UTF-8?B?6auY5bGx?=' . This happens because the Webgate will encode any non-ASCII characters in header variables according

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-13000129746992204482013-07-02T15:51:00.001-05:002013-07-02T15:52:05.526-05:00

It is a good practice to mark all OAM cookie as Secure and Http-only. This can be done in individual authentication scheme. The exact OAM-11g-R1 syntax is "ssoCookie=Secure;httponly" in Challenge-Parameters field. httponly :- By marking the cookie as httpOnly, you are ensuring that the cookie can only be used for http protocol. It is not accessible via non-HTTP methods like JavaScript ("

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-30960115361289672632013-03-21T13:22:00.000-05:002013-07-13T12:40:07.276-05:00

The Issues :-  My OIF server is integrated with OAM for authentication. I used a JSP based form login to collect credential when User makes an IntitateSSO call. I started seeing this error in OIF logs. This is very much reproducible in clustered OAM and OIF servers. FED-15132: Unknown refID Cause: User previously accessed the Oracle Identity Federation server with a

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com4tag:blogger.com,1999:blog-9144225311705585973.post-53200624804019282842013-02-07T14:15:00.001-06:002013-02-07T14:15:32.821-06:00

This issue is very familiar to all OAM experts. End User very often bookmark the OAM-form login page thinking that it is an inseparable piece of their protected application.  So, when User comes from this bookmarked login page , he ends in the OAM default blue screen as OAM does not where to redirect the user after successful authentication. DETAIL ISSUE DESCRIPTION:- To understand

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-35759070376761300312012-10-10T15:23:00.002-05:002012-10-10T15:24:27.381-05:00

It was little harder than I thought :(  My weblogic expert friend shared it. For OIF and OAM :- Assuming that you have installed OIF from Oracle_IDM2 $ export ORACLE_HOME=/opt/apps/Oracle/Middleware/Oracle_IDM2 $ export PATH=$PATH:/opt/apps/Oracle/Middleware/Oracle_IDM2/OPatch $ opatch lsinventory -detail -invPtrLoc /opt/apps/Oracle/Middleware/Oracle_IDM2/oraInst.loc For OHS  

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-22375105074653493692012-10-01T18:24:00.001-05:002012-10-04T16:21:12.152-05:00

A quick reference on WLST usage. Here is an example of setting of an OIF server parameter (userldapconnectionreadtimeout') using WLST command. $ export DOMAIN_HOME=..Directory/Oracle/Middleware/user_projects/domains/OIF_DOMAIN   $ . Directory/opt/apps/Oracle/Middleware/Oracle_IDM2/fed/scripts/setOIFEnv.sh $ java weblogic.WLST wls:/offline> setConfigProperty('datastore','

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-90170320456672347862012-09-24T00:59:00.000-05:002012-09-24T01:01:00.822-05:00

In real life OAM implementation we all use fancy login form , which is called from OAM authentication scheme. These custom login screen often use java scripts. The screen also contain at-least two input parameters 'Login-Name' and 'Password'.  So the screen is perfect play ground for XSS (Cross Site Scripting) attack. Here are few tips to make it XSS safe. For more information about XSS&nbsp

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-25431531897485389102012-05-29T13:57:00.001-05:002012-09-10T17:53:54.389-05:00

Finding OVD version :- Open file ..../Oracle/Middleware/OVD_INST_1/config/OVD/ovd1/server.os_xml . Look for section  "OVD_INST_1_OVD" . Setting OVD Log (Alternative to console) :- You can set OVD log level directly using console UI. But, you may get an error "JAVAX.EL.ELEXCEPTION: JAVA.LANG.NULLPOINTEREXCEPTION AT JAVAX.EL.BEANELRESOLVER" because of an  OVD 11.1.1.5 bug while

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-63177622410200447172012-01-11T16:31:00.001-06:002012-01-11T17:05:23.758-06:00

I wrote a Post Process Event Handler code, which provide value to a User's attribute during user creation. The event-handler code was using UserManagerment (oracle.iam.identity.usermgmt.api.UserManager) API. public class GuidGenerationPostProcEventHandler implements oracle.iam.platform.kernel.spi.PostProcessHandler {: public EventResult execute(long processId, long eventId, Orchestration

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com2tag:blogger.com,1999:blog-9144225311705585973.post-43182302725817725372012-01-09T15:56:00.000-06:002012-01-09T15:56:03.074-06:00

(1) Execute the following query against OIM schema. select XSD_VALUE from XSD where XSD_CODE='XL_BUILD_NUMBER';  (2) .../Oracle/Middleware/Oracle_IDM1/OPatch/opatch lsinventory -details

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com1tag:blogger.com,1999:blog-9144225311705585973.post-13585309069912542702012-01-06T17:13:00.000-06:002012-01-06T17:13:45.590-06:00

Here are the steps to export OIM's  User.xml from metadata using weblogic MDS utilities. $ cd /opt/Oracle/Middleware/Oracle_OIM/server/bin Aassuming you have installed OIM at /opt/Oracle/Middleware/Oracle_OIM. The default directory could be /opt/Oracle/Middleware/Oracle_IDM2 for 11.1.1.5 installation $ vi weblogic.properties.  Set the value similar to the example below

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com1tag:blogger.com,1999:blog-9144225311705585973.post-68745306614747431222011-10-25T19:55:00.000-05:002011-10-25T19:55:48.890-05:00

After installing and configuring OID-Connector, I tried to do a simple manual user provisioning to OID. As expected, the user creation in OID was rejected. Time to debug :(  So I included OID related login handler in $DOMAIN_NAME/config/fmwconfig/servers/oim_server1/logging.xml followed by restarting the oim managed server. To my surprise the logging.xml file got overwritten (to the

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-19786353763280872382011-05-14T10:14:00.000-05:002011-05-14T10:14:22.270-05:00

Here is a quick list of threats and its counter measures based on STRIDE treat model. More information at http://msdn.microsoft.com/en-us/magazine/cc163519.aspx . THREAT                          COUNTER MEASURE -------------------------------------------------------------

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-90918854738110634452010-12-23T15:20:00.000-06:002010-12-23T15:20:11.451-06:00

Problem Description :- I imported a Trusted-Reconciliation set up from one of the working environment to another environment. When I run the trusted recon on the new environment, I got the following error. ERROR,21 Dec 2010 17:33:45,658,[XELLERATE.SERVER],Class/Method: tcRCE/createUserRecord encounter some problems: {1} java.lang.NullPointerException at

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-91717118571487079482010-11-02T11:09:00.002-05:002010-11-10T12:03:19.501-06:00

Never delete the OIM users. That is the OIM recommendation. But while playing in development environment, we sometime mess up OIM with too many unwanted Users. In case you wanted to clean it up here is the little script that may help. I got this from http://forums.oracle.com/forums/thread.jspa?threadID=1997648&tstart=15 . delete from oud where oiu_key in (select oiu_key from oiu where

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-85924610370705789632010-04-12T14:37:00.004-05:002010-04-13T12:31:19.784-05:00

Does this error below looks familiar to you ? This occurs if an attribute is deleted from one of the configured object without deleting the corresponding object configuration of COREid.{Bug Report FormAn error has occurred while executing the application.Your browser doesn't support sending mail automatically!Please send E-Mail to with the following information:# Your Name# Organization# E-Mail

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-27680934202439187442010-02-17T10:41:00.006-06:002010-02-17T16:55:01.225-06:00

Here are few quick steps to deploy Sun IDM (now called Oracle_Waveset) on Weblogic app server on a Window box. Note that Sun IDM is a web application which requires any standard application server and a db repository. The installable is just a war file.A. ENVIRONMENT PREPARATION(1) download IDM 8.1 from here. Extract the downloaded file IDM_8_1_0_0.zip to a temporary directory say C:\Sun\

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-69741298370205679462009-08-03T12:24:00.009-05:002009-08-04T10:25:59.054-05:00

If you are using Sun Directory Server 5.2, here are few useful tips on Multi Master replications.(1) The typical steps of configuring multi-master (say M1 and M2 fro reference) is to define replication agreement on each of the LDAP which push changes to other. But initially both the LDAPs has to be in sync. While defining the agreement from console, it usually displays a message that "remote

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0tag:blogger.com,1999:blog-9144225311705585973.post-65127534628927632122009-07-27T11:21:00.007-05:002009-09-03T12:35:32.339-05:00

Let's say you moved one of your (or the only) LDAP server(s) to a different machine. You did all the correct changes in OAM System Console to reflect your new Ldap's host and port. But your OAM server (CoreId & Access) does not start for some reason. One of the solution could be some of your configuration xml/ lst files has not got the new host information yet.For CoreId Server :- Check all

Kabi Patthttp://www.blogger.com/profile/08932073888502264972noreply@blogger.com0