IDM OIM Blog

fedora generating /run/initramfs/rdsosreport.txt

2020-09-22T13:15:00.000-07:00

My fedora virtual machine not able to boot and showing as a generating /run/initramfs/rdsosreport.txt error and going to emergency mode

Solution:

run systemctl and enter

it will show you the error in the screen as:

failed failed /dev/mapper/fedora-root

run fsck /dev/mapper/fedora-root and enter y all the prompts

It will fix your booting issues.

Type exit and it will boot the system.

Best of luck.

How to Delegate Admin User Privileges OIM 11g R1

2017-01-23T15:50:00.001-08:00

I would like to delegate the user administration privileges various departments. I need to setup the following configuration to delegate the user privileges for various departments. In my example department name is celorg. They are

1. Create the Admin User

It is a two step process:

1.1 Login to the oim using the admin user xelsysadm and Admin User Password.
1.2 Create user id cel_admin and last name is College of Extended Learning, and Password using the create user interface.

2. Create the Role

It is a three step process to create a role:

2.1 Login to the oim using the admin user xelsysadm and Admin User Password.
2.2 Create role name is cel_admin create role user interface.
2.3 Assign the role to the user using the role member user interface.

3. Create the Organization

It is a three step process to create a Organization:
3.1 Login to the oim using the admin user xelsysadm and Admin User Password.
3.2 Create a Organization Name is celorg and Type is Department using Create Organization user interface.
3.3 Click Administrative Roles ==> Assign ==> Select Role (cel_admin) and Assign Check Box and Click Assign button and It will assign the role.

4. Create Authorization Policy

4.1 Login to the oim using the admin user xelsysadm and Admin User Password.
4.2 Click Authorization Policy and perform the following tasks to create the authorization policy:

4.2.1 Create Authorization Policy

Policy Name: College Of Extended Learning Admin Policy
Entity Name: User Management
Click Next Button

4.2.2 Select Permissions

Create User
Change Password
Modify User Profile
Search User
View User Details
Change User Password
Modify User Status
Click Next Button

4.2.3 Select Data Constraint

Add User Organization celorg
Select Hierarchy Aware Check Box
Click Next Button

4.2.4 Select Policy Assignment

Add User role is cel_admin
Click Next Button and Finish Button and It will create the authorization policy.

5. Testing

Login to the oim using the admin user cel_admin and Admin User Password.
Create the user using create user Link and Enter Last Name, Select Organization from the
Lookup celorg, User Id , User Type is Temp and Password. Click Save Button and It will
Create the user in celorg organization department.

"{"error":"invalid_grant","error_description":"Please check the 'exp' claim."}"

2016-11-17T16:49:00.000-08:00

Hi,

I am getting the following error while sending the JWT Token request to https://api.box.com/oauth2/token

Error:

"{"error":"invalid_grant","error_description":"Please check the 'exp' claim."}"

Solution:

long DEVIDE=1000L;
long currentTime=System.currentTimeMillis();
long seconds=(currentTime/DEVIDE);
seconds=seconds+60L;

Map<String, Object> claims= new HashMap<String,Object>();
claims.put("iss", CLIENT_ID);
claims.put("sub", SUBJECT_ID);
claims.put("box_sub_type", "user");
claims.put("aud", "https://api.box.com/oauth2/token");
claims.put("jti", UUID.randomUUID());
long currentTime=System.currentTimeMillis();
long seconds=(currentTime/DEVIDE);
seconds=seconds+60l;
claims.put("exp",seconds);

After modifying the code issue will be resolved.

Sending Tomcat Logs to Syslog Servers in Redhat 7

2016-09-14T13:15:00.002-07:00

I want to send the tomcat logs to syslogs servers in redhat 7 as follows:

1. Configuring the tomcat.conf file

I want to send the tomcat catalina.log to syslog server using the local1 facility. Go to the /etc/rsyslog.d/ and create a file called tomcat.conf and add the following content to the file.

# File 1
input(type="imfile"
File="/var/log/tomcat/catalina.log"
Tag="catalina"
StateFile="/var/spool/catalina"
Severity="info"
Facility="local1")

local1.* @<syslogServer>:514

Replace syslogServer with your actual syslog name or ip address server.

In the above configuration

File is the tomcat log file absolue path. In my case tomcat log file path is /var/log/tomcat/catalina.log.

Tag is the identification for the tomcat log file into the syslog server. In my case catalina is the tag to filter the content from the syslog server.

type is the module is being used to parse the log files. This module needs to be configured in the /etc/rsyslog.conf file. Please look section 2.2 for configuration.

StateFile is the tomcat log file parse status.

Severity is the logging severity into the syslog server

Faciltiy is the logging under facilitiy. In my case facility is local1 and this faility is being used to

filter the log file content and send to the different location.

2. Configuring the rsyslog.conf

2.1 Load the imfile module

The imfile module is required to parse the catalina.log file and send to the syslog server.

Edit the rsyslog.conf file and add the following content under MODULE section.

module(load="imfile" PollingInterval="10")

2.2 Configure the messages

This confuguration is required for not logging the calatling.log messages into the /var/log/messages.

Edit the /etc/rsyslog.conf file and append the local1.none content before /var/log/messages.

*.info;mail.none;authpriv.none;cron.none;local1.none /var/log/messages

2.3 Restart the rsyslog daemon.

systemctl restart rsyslog

Enabling Windows Authentication WCF Web Service in IIS

2016-01-29T14:04:00.002-08:00

I want to enable the windows authentication for my existing WCF web service as follows:

Pre-Requisite:

The WCF Service application already deployed in the IIS.

1. Wcf Service Application

1.1 web.config

The following changes needs to be done to enable the windows authentication for wcf service application:

Configure Basic Http Binding:

Go to the web.config file under <configuration><system.serviceModel> section add your basic http binding.

<bindings>

<basicHttpBinding>

<binding name="BasicHttpEndpointBinding">

<security mode="TransportCredentialOnly">

<transport clientCredentialType="Windows" />

</security>

</binding>

</basicHttpBinding>

</bindings>

This binding name needs to be included in the Service Endpoint binding configuration.

Configure Service Endpoint

Go to the web.config file under <configuration><system.serviceModel><service> section add your endpoint configuration.

<endpoint address="" binding="basicHttpBinding" contract="Service.AppService" bindingNamespace="http://example.edu/Service/" bindingConfiguration="BasicHttpEndpointBinding" >

I have highlighted the font in red color to modify the binding configuration.

2. IIS Configuration

2.1 Application Pool

This configuration is required because to delegate the authenticated kerberos token to target application:

Open the IIS Manager Console --> Host Name --> Application Pools --> Select WCF Deployed Application Pool --> Right Click --> Advanced Settings --> Process Model --> Identity --> Select Custom Account --> Click Set Button.

Enter Your Service Account User Name, Password, and Confirm Password.

After Configuring the Application Pool Identity, you should restart the Application Pool

2.2 WCF Service Application

This configuration is required because to enable the windows authentication for wcf service application.

Configuring the Windows Authentication:

Open the IIS Manager Console --> Host Name --> Web Site --> WCF Service Application --> Click Authentication --> Right Click Windows Authentication --> Select Enable

It will enable the windows authentication.

Configure the Use Pool Identity

Open the IIS Manager Console --> Host Name --> Web Site --> WCF Service Application --> Click Configuration Editor --> system.webServer/security/authentication/windowsAuthentication > UseAppPoolCredential value false to true.

2.3 Configuring the SPN

Open the command prompt as a windows administrator and configure the spn for host name as follows:

setspn -S "HTTP/Hostname" <Application Pool Identity>

setspn -S "HTTP/host fqdn" <Application Pool Identity>

The <Application Pool Identity> configured at the step 2.1

3. Restart IIS

Open the IIS Manager Console --> Host Name --> Right Click --> Stop

It will stop the IIS server

Open the IIS Manager Console --> Host Name --> Right Click --> Start

It will start the IIS server

4. Active Directory Configuration

This configuration is required to delegate the kerberos token to the application.
Open the Active Directory Users and Computer --> Search the Application Pool Identity (2.1 Configured Application Pool Identity or IIS Service Account) and Click Delegation --> Select "Trust this user for delegation to Any Service Kerberos Only.

5. Test the application

5.1 Create the krb.conf file

Create the krb.conf file and add the following content inside the file.

[libdefaults]

default_realm = EXAMPLE.EDU

[realms]

EXAMPLE.EDU = {

kdc = dcs01example.edu

}

Replace default_realm and kdc values with your ad domain realm and ad kdc.

5.2 Create the JAAS login.conf file

Create the login.conf file and add the following content inside the file.

com.sun.security.jgss.krb5.initiate {

com.sun.security.auth.module.Krb5LoginModule required

doNotPrompt=false useTicketCache=true;

};

5.3 Execute the Java Code

Execute the following code to test the Windows Authentication.

import java.net.Authenticator;

import java.net.PasswordAuthentication;

import java.net.URL;

import edu.example.Service;

import edu.example.Service_Service;

public class ClientService {

private static String USER_NAME="<Replace Your User Name>";

private static String USER_PWD="<Replace Your User Password>";

public ClientService() throws Exception {

}

public static void main(String args[]) throws Exception

{

System.setProperty("java.security.krb5.conf","c:/ClientService/src/krb.conf");

System.setProperty("java.security.auth.login.config","C:/ClientService/src/login.conf");

System.setProperty("javax.security.auth.useSubjectCredsOnly","false");

System.setProperty("com.sun.xml.ws.transport.http.client.HttpTransportPipe.dump", "true");

System.setProperty("com.sun.xml.internal.ws.transport.http.client.HttpTransportPipe.dump", "true");

System.setProperty("com.sun.xml.ws.transport.http.HttpAdapter.dump", "true");

Authenticator myAuth = new Authenticator()

{

@Override

protected PasswordAuthentication getPasswordAuthentication()

{

System.err.println("Feeding username and password for "

+ getRequestingScheme());

return new PasswordAuthentication(USER_NAME, USER_PWD.toCharArray());

}

};

Authenticator.setDefault(myAuth);

Service_Service service= new Service_Service();

Service binding=service.getBasicHttpBindingService();

String result= binding.verify("");

System.out.println(result);

}

WARNING: The access control entry defines the ObjectType 'GUID' that can't be resolved.

2015-10-22T10:06:00.000-07:00

I am getting the warning message after upgrading the exchange 2010 to exchange 2013 as follows:

WARNING: The access control entry defines the ObjectType 'GUID' that can't be resolved.

Solution:

1. Finding the Corrupted ObjectType in the Exchange 2013.

Get-AdPermission "dc=example,dc=edu"

After executing the Above command it will display the ACL entries for that object and also it will display the corrupted objectType. The sample output is given below:

example.edu Everyone True False
example.edu Everyone False False
example.edu NT AUTHORITY\ENTE... False False
example.edu NT AUTHORITY\Auth... False False
example.edu NT AUTHORITY\SYSTEM False False
example.edu BUILTIN\Administr... False False
example.edu S-1-5-32-554 False False
example.edu S-1-5-32-554 False False

WARNING: The object example.edu has been corrupted, and it's in an inconsistent state. The following validation happened:
WARNING: The access control entry defines the ObjectType 'acd46e6d7-8d45-4516-a4b3-61c0e509b5be' that can't be resolved..

2. Finding the Corrupted ACL Entry

Get-ACl "AD:\Dc=example,dc=edu" | Select Access -ExpandProperty Access | Where-Object {$_.ObjectType -eq "'acd46e6d7-8d45-4516-a4b3-61c0e509b5be"} | Export-csv "acl.csv"

"ActiveDirectoryRights","InheritanceType","ObjectType","InheritedObjectType","ObjectFlags","AccessControlType","IdentityReference","IsInherited","InheritanceFlags","PropagationFlags"

"ExtendedRight","All","acd46e6d7-8d45-4516-a4b3-61c0e509b5be","00000000-0000-0000-0000-000000000000","ObjectAceTypePresent","Allow","example\testGroup","False","ContainerInherit","None"

3. Finding the Corresponding Corrupted Permissions

Get-ADPermission "dc=example,dc=edu" | Where-Object {$_.User -like "*testGroup"} ft identity,user,extendedrights,accessrights

Identity User ExtendedRights AccessRights
-------- ---- -------------- ------------
example.edu example\testGroup {Change Password} {ExtendedRight}
example.edu example\testGroup {ExtendedRight}

I have highlighted the corrupted ACL entry in the example.edu container.

4. Removing the Corrupted ACL entry in ADUC User Interface.

Login as as a domain admin and remove the acl entry as follows:

Right Click on example.ed domain --> Properties --> Security --> Advanced --> Select the Corrupted ACL Entry --> Remove

The issue will be resolved after removing the corrupted acl entry.

BDB1538 Program version 5.3 doesn't match environment version 4.7

2015-08-19T13:57:00.000-07:00

Hi,

I am getting the following exception in open ldap after upgrading the red hat 6 to 7:

BDB1538 Program version 5.3 doesn't match environment version 4.7

Cause:

Berkeley Data Base upgraded from 4.7 to 5.3 while upgrading the redhat 6 to 7.

Solution:

Go to the /var/lib/ldap directory and upgrade the database file version from 4.7 to 5.3 as follows:

Currently I have the following files in the /var/lib/ldap directory

cn.bdb
dn2id.bdb
id2entry.bdb
objectClass.bdb
ou.bdb

Execute the following command to upgrade the database files as follows:

db_upgrade cn.bdb
db_upgrade dn2id.bdbdb_upgrade id2entry.bdb
db_upgrade objectClass.bdb
db_upgrade ou.bdb

After execute the above commands, you need to change the ownership for the files as foolows:

chown ldap:ldap * -R

After executing the above command, it will change the ownership of the files.

Restart the service systemctl restart slapd. The ldap service restart successfully and the issue will be resolved.

Segmentation fault error 4 in liblftp-network.so

2015-07-14T15:00:00.002-07:00

Hi,

I am getting the following errors in message log while mirroring the red-hat 7 latest packages using the mrepo and lftp 4.0.9. They are

Error:

lftp[26710]: segfault at 0 ip (null) sp 00007fffcd10e5e8 error 14 in lftp[400000+b000]
lftp[26769]: segfault at 18 ip 00007fdb03ff4808 sp 00007fff2270cda0 error 4 in liblftp-network.so[7fdb03fe2000+20000]

Cause:

Bug in lftp 4.0.9 package.

Solution:

To resolve the segmentation fault error, you need to install the latest lftp packages from the yum repo or download the source code to build and install lftp in the local system as follows:

Updating the lftp from repo

yum update lftp

Download the lftp

Download the lftp source code following url:

http://lftp.yar.ru/ftp/lftp-4.6.3a.tar.gz

Build the lftp:

Install the lftp from the source code as follows:

1. Pre-Requisite

Install the following packages to install the lftp package:

yum install readline-devel gnutils-devel

2. Build Source Code

After installing the pre-requisite packages, please follow the procedure to build the lftp packages from the source code as follows:

./configure --prefix=/apps/lftp/ --with-gnutls=yes --with-openssl=yes

make

make install

It will install the lftp package in /apps/lftp directory.

Configuring lftp command

1. Edit the /etc/mrepo.conf and add replace the lftpcmd value with /apps/lftp/bin/lftp

2. Edit the /apps/lftp/etc/lftp.conf and add the following lines to download the redhat 7 packages from the cdn.redhat.com

set ssl:ca-file "/root/certs/redhat-uep.pem"

set ssl:key-file "/root/certs/cert-key.pem"

set ssl:cert-file "/root/certs/cert.pem"

set net:timeout 86400

3. Execute the following command to mirroring the redhat 7 packages:

mrepo -guvvv redhat-7Server

It will mirror the red-hat packages from the cdn.redhat.com

Please refer my existing blog how to setup mrepo redhat 7

After installing the lftp latest 4.6.3a version, the segmentation issues are resolved.

How to setup mrepo Redhat 7

2015-07-11T21:38:00.000-07:00

The mrepo is a repository building tool for the synchronizing the remote repository to local yum or apt repositories. The following configuration needs to be performed to configure mrepo local repositories in the redhat linux 7. They

1. Pre-requisite

Install the Red hat 7 Enterprise Edition.

2. Registering the System

Run the following command to register the system in red hat network.

subscription-manager register --username <Red Hat User Name> --password <Red Hat User Password> --auto-attach

After executing the above command, it will generate the client-key, client-cert and redhat-ca cert as follows:

Client Key : /etc/pki/entitlement/<Numeric Number>-key.pem
Client Cert:/etc/pki/entitlement/<Numberic Number>.pem
Redhat CA Cert: /etc/rhsm/ca/redhat-uep.pem

It will also generate the /etc/yum.repos.d/redhat.repo file.

3. Installing the Packages

Run the yum update command to update the latest packages from the redhat network.

The following packages are required to configure the mrepo. They are

3.1 lftp

lftp is a ftp tool to get the repositories from the remote system. It supports ftp, sftp, http, and https protocols.

3.2 httpd

The httpd is a apache web server and it is being used to update the red hat systems in your network using yum repo.

3.3 mrepo

The mrepo is repository building tool and it being used to synchronize the remote system to local system repository using various protocols such as ftp,sftp, reposync, reposyncs, http and https.

3.4 Installing lftp and httpd

Run the yum install lftp httpd command and it will install the lftp and httpd component in the linx system.

3.5 Installing the mrepo

By default mrepo package is not available in the redhat network and it is available in the repofroge repository.

Execute the following command download the mrepo:

wget http://pkgs.repoforge.org/mrepo/mrepo-0.8.8-0.pre1.el6.rft.noarch.rpm

After Downloading the mrepo rpm and execute the following command to install the mrepo.

yum install mrepo-0.8.8-0.pre1.el6.rft.noarch.rpm

4. Creating the Red Hat mrepo conf

Red Hat repository file needs to be created in the /etc/mrepo.conf.d/ directory and file name is redhat-7-x86_64.conf. This configuration is required because it will synchronize the remote repository to your local repository. Add the following content to the redhat-7-x86_64.conf file.

[redhat-7]
name = Red Hat Enterprise Linux Server $release ($arch)
release = 7
arch = x86_64
metadata = yum repomd

fastrack = https://cdn.redhat.com/rhel-x86_64-server-fastrack-7
os = https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/Packages
extras = https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/extras/os/Packages
rhn-tools = https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rhn-tools/os/Packages
oracle-java = https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/oracle-java/os/Packages
rh-common = https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/rh-common/os/Packages
supplementary = https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/supplementary/os/Packages
optional = https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/optional/os/Packages

5. Configuring the lftp.conf

The lftp.conf file needs to be configured because to store the lftp ssl parameter permanently in the global config. This configuration is required for to establish the connectivity from your local repository to remote repository.

5.1 SSL Configuration

set ssl:ca-file "/etc/rhsm/ca/redhat-uep.pem"
set ssl:key-file "/etc/pki/entitlement/<Numeric Number>-key.pem"
set ssl:cert-file "/etc/pki/entitlement/<Numeric Number>.pem"

5.2 Network Time Out

set net:timeout 86400

5.3 Testing the LFTP Connectivity

After configuring the step 5.1 and 5.2, you can verify the connectivity from local repository to remote repository as follows:

lftp https://cdn.redhat.com/rhel-x86_64-server-fastrack-7

The above command will open the remote connectivity and you can navigate the files using lftp commands. For example, I want to list the data from the remote repository using ls command as follows:

ls -ltr

The above command will retrieve the data from the cdn.redhat.com network.

6. Configuring the Apache httpd conf

The mrepo.conf file needs to be modified in /etc/httpd/conf.d to display the repository info into the local repository web site. Edit the mrepo.conf file and search the Red Hat Enterprise Server5 string into the file and add next line to the Red Hat Enterprise Server 5.

AddDecription "Red Hat Enterprise Server 7 for x86_64" redhat-7-x86_64

The redhat-7-x86_64 content is configured in the mrepo config file. The redhat-7 is the section name and x86_64 is architecture. Both will be appended and created as directory /var/mrepo/redhat-7-x86_64 after synchronizing the repo using the mrepo command.

7. Synchronizing the Repository

Execute the following command to synchronize the red hat 7 repository to your local repository:

mrepo -guvv <Repo Name>

For example my repo section name is redhat-7. The command look like this.

mrepo -guvv redhat-7

The above command will synchronize the remote repository to local repository.

8. Scheduling the Cron Job for Mrepo

After synchronizing the remote repository to local repository, we need to synchronize the latest updates from remote repository to local repository using the Linux Daily Cron Job. For example my cron job will run every day at 2.30 AM and pull the changes from the redhat network.

We need to create mrepo file in /etc/cron.d/ and add the following content to configure the cron job.

30 2 * * * root /usr/bin/mrepo -q –ug

9. Enabling the Http Service

We need to enable the httpd service to restart automatically after rebooting the server. Execute the following command to enable the httpd service:

systemctl enable httpd

It will enable the service and also it create the symlinks for the httpd service as follows:

ln -s '/usr/lib/systemd/system/httpd.service' '/etc/systemd/system/multi-user.target.wants/httpd.service'

10. Configuring the Se-Linux Context

This step is mandatory only if your enable the se-linux. Configuring the selinux context for httpd mrepo as follows:

semanage fcontext -a -t httpd_sys_content_t "/var/mrepo(/.*)?"

After executing the above command and it will configure the selinux context for mrepo and also it will persist the configuration details into the /etc/selinux/targeted/contexts/files/file_contexts.local file.

restorecon -R /var/mrepo

After executing the above command and it will read the configuration from the /etc/selinux/targeted/contexts/files/file_contexts.local file and enable the selinux context for the directory /var/mrepo

Kernal Panic - Not syncing : VFS: unable to mount root fs on unknown-block (0,0)

2015-06-29T10:44:00.000-07:00

Hi,

I am getting the following error after updating the Linux System using yum update and rebooting the Linux Kernel Cent OS 7.

Kernal Panic - Not syncing : VFS: unable to mount root fs on unknown-block (0,0)

Solution:

1. Reboot the Linux Cent OS Virtual Machine.

2. Select the Existing Kernel from the Down Arrow.

3. Open the Terminal Window and Login as a root.

4. Remove the current kernel because the kernel got corrupted and execute the following command to remove the current kernel:

yum remove kernel

5. Remove the yum cache because it will refer the older repositories from the cache. Execute the following command to clear the yum cache from the system:

yum clean all

7. Update the Linux System because it will get the latest kernel from the yum repository. Execute the following command and it will update the kernel:

yum update

8. Reboot the Virtual Machine and issue will be resolved.

How to setup a Cron Schedule job in Linux

2015-06-18T11:22:00.000-07:00

I would like to setup Cron Schedule job to execute every minute in Red hat Linux. The following tasks needs to be performed to setup the Cron Schedule Job.

1. Create or Edit the Cron Tab File

Execute the following command to edit the cron tab file..

crontab -e

After executing the above command it will edit crontab file.

2. Schedule the Cron Job.

2.1 Cron Tab Format

The following format is being used to setup the cron job in Linux.

2.1.1 Minute (0-59)
2.1.2 Hour (0-23)
2.1.3 Day Of Month (1-31)
2.1.4 Month (1-12)
2.1.5 Day of Week (0-6)
2.1.6 Command

In my example I am going to setup the cron schedule job to run every minute and append the display output to a file as follows:

* * * * * /home/testuser/display.sh >>display.out

in the above example, I have used * * * * * because My Job needs to be run every minute.

The display.sh content is given below:

echo "Diaplying Message"

3. Listing the Cron Tab

After setting the cron job, you can list the all available jobs in your user space as follows:

crontab -l

After executing the above command it will display the following output:

* * * * * /home/testuser/display.sh >>display.out

4. Cron Job Store Location

After creating the Cron Schedule Job, Job details are stored in the following location with username as a file and this file owned by root:root.

/var/spool/cron/testuser

Login as a root and edit the /var/spool/cron/testuser file and verify the cron job content. In my example step 2 content and step 4 content are identical.

4. Logging

The cron schedule job running info will be displayed in the following log file:

/var/log/cron

5. Error Messages

If your cron job throwing any error or cron job is not running due to fatal errors or command not found. The error messages are displayed in the following location.

/var/spool/mail/testuser

The sample error message is given below:

From root@test.ad.example.edu Thu Jun 18 09:01:02 2015
Return-Path: <root@test.ad.example.edu>
X-Original-To: testuser
Delivered-To: testuser@test.ad.example.edu
Received: by test.ad.example.edu (Postfix, from userid 501)
id 385CE20357; Thu, 18 Jun 2015 09:01:02 -0700 (PDT)
From: root@test.ad.example.edu (Cron Daemon)
To: testuser@test.ad.example.edu
Subject: Cron <testuser@sssdlab-test> testuser /home/testuser/display.sh >>display.out
Content-Type: text/plain; charset=UTF-8
Auto-Submitted: auto-generated
X-Cron-Env: <LANG=en_US.UTF-8>
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/home/testuser>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=testuser>
X-Cron-Env: <USER=testuser>
Message-Id: <20150618160102.385CE20357@test.ad.example.edu>
Date: Thu, 18 Jun 2015 09:01:02 -0700 (PDT)

/bin/sh: testuser: command not found

I have setup the cron job to throw the error in the following format:

* * * * * testuser /home/testuser/display.sh >>display.out

In the above format command is testuser, for that reason, cron job throwing error message is "/bin/sh: testuser: command not found"

The expected result is it will create a display.out file and the content is not appended to a file.

SSSD Linux System Integrate With Active Directory

2015-06-04T16:59:00.001-07:00

I would like to integrate Linux System Authentication against the centralized Active Directory using System Security Service Daemon (SSSD). SSSD supports two kinds mechanisms to integrate Linux System Authentication against AD for authentication. They are:

1. ID Mapping using ObjectSID in AD
2. Posix Attribute Mapping using posixAccount and posixGroup Object classes.

To implement the above mechanisms you need to configure the SSSD in the Linux System as a root user as follows:

1. Installing Packages

yum install sssd sssd-client krb5-workstation samba openldap-clients oddjob-mkhomedir sssd-libwbclient sssd-libwbclient-devel

2. Configuring the DNS Resolver

Edit the /etc/resolv.conf and verify the DNS Server entries are point to the naming servers and also search domain. For example sample resolve.conf file is given below:

domain ad.example.edu

search ad.example.edu

nameserver ns1.example.edu

nameserver ns2.example.edu

Based on the above configuration it will obtain the ip address of the linux machine host from the domain naming service (DNS).

3. Configuring the Kerberos

This configuration is required for Active Directory Authentication using Kerberos protocol.

Edit the /etc/krb5.conf file and configure the Active Directory logging, libdefaults, realms, and domain realm sections as follows:

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

default_realm = AD.EXAMPLE.EDU

dns_lookup_realm = true

dns_lookup_kdc = true

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = true

rdns = false

[realms]

AD.EXAMPLE.EDU = {

kdc = dcs01.ad.example.edu

admin_server = dcs01.ad.example.edu

default_domain = ad.example.edu

}

[domain_realm]

.ad.example.edu =AD.EXAMPLE.EDU

ad.example.edu = AD.EXAMPLE.EDU

The realms and domain_realm section is required only if the domain discover service not available.

In the libdefaults section change the default_realm parameter according your environment.

In the realms section change AD.EXAMPLE.EDU realms with your actual realm, The realm parameters kdc, admin_server, and default_domain values needs to be changed according to your environment.

In domain_realm section change realm names according to your environment.

4. Configuring the Samba

Configure the Samba Server to connect the Active Directory server. Edit the /etc/samba/smb.conf and add the following content under [global] section.

[global]

workgroup = EXAMPLE

client signing = yes

client use spnego = yes

kerberos method = secrets and keytab

log file = /var/log/samba/%m.log

password server = dcs01.ad.example.edu

realm = AD.EXAMPLE.EDU

security = ads

In the global section you need to modify the workgroup, password server, and realm according to your environment. The workgroup details are available for the ad object in the Active Directory User and Computer Console as follows:

Right Click your Suffix (ad.example.edu) --> Find --> Enter Name (Search User Name) --> Search Result --> Click Search Result --> Click Account --> User Logon Name (pre-Windows 2000).

The User Logon Name (pre-Windows 2000) value is your workgroup value.

The password server value is your ad domain controller.

The realm is your ad realm.

5. Joining the Linux Machine with Domain Controller

After configuring the Steps 3 and 4, you need to perform the following tasks to join the Linux Machine with AD Domain Controller:

5.1 Obtain Kerberos Credentials:

The following command being used to obtain the kerberos credentials from the AD domain controller:

kinit administrator

After executing the above command and it will append the default realm with administrator account. For example user name will be administrator@AD.EXAMPLE>EDU. It will also ask the administrator password to authenticate user against AD domain controller. After successful authentication, kerberos key tab file will be generated in the /etc/krb5.keytab.

If you found any issue while obtaining the Kerberos credentials from the AD domain controllers, you can execute the following command to trace the kerberos authentication errors in the console.

KRB5_TRACE=/dev/stdout kinit administrator

5.2 Joining Linux Machine to Domain Controller:

After executing the step 5.1 successfully, you can execute the following command to join the Linux Computer to the AD Domain controller.

net ads join -k

After executing the above command successfully, the Linux machine will be added into the AD Domain controller. You can find the Linux machine name in the DomainJoinStaging orgainizational unit under ad.example.edu. The sample computer path is CN=testlinuxmachine,OU=DomainJoinStaging,DC=ad,DC=example,DC=edu

The CN is your Linux Machine Name. In my example my machine name is testlinuxmachine.ad.example.edu

You can verify computer name according your environment.

6. Configuring the SSSD authentication

Execute the following command to enable the SSSD authentication against the Active Directory:

authconfig --update --enablesssd --enablesssdauth –-enablemkhomedir

It will enable the sssd authentication and the changes will be written into the /etc/pam.d/ directory and also it will generate the nsswitch.conf file in the /etc/ directory.

7. Implementing the SSSD Mechanisms

After executing the step 6 it will enable the sssd authentication for the Linux Machine against with AD domain controller. But it will not create the /etc/sssd/sssd.conf file. You need to create the sssd.conf file under /etc/sssd/ directory and add the following content in the sssd.conf file.

[sssd]

domains = ad.example.edu

services = nss, pam

config_file_version = 2

[domain/ad.example.edu]

id_provider = ad

auth_provider = ad

access_provider = ad

chpass_provider = ad

ad_domain = ad.example.edu

ad_server = dcs01.ad.example.edu

ad_hostname = dcs01.ad.example.edu

ldap_schema = ad

cache_credentials = true

debug_level = 1

ldap_idmap_default_domain_sid = <Domain SID>

krb5_auth_timeout = 30

krb5_realm = ad.example.edu

In the sssd section you need to modify domains, and services according to your environment. In my example domains value is ad.exampel.edu and services values are nss, pam, and pac.

The naming service switch (nss) being used to retrieve the Active Directory Identity Objects. For example id and groups.

The Pluggable Authentication Module (PAM) is being used to authenticate the user against the active directory.

You can configure the additional services as per your requirement. For example sudo service is being used to grant the Admin Sudo Access for certain users in the Linux System.

The [domain/ad.example.edu] section you need to modify provider name parameters for authentication, authorization, and changing passwords. In my example I have selected my provider name is ad because I am going to integrate Linux System with Active Directory. This provider is a generic provider for ldap. The example providers given below

id_provider = ad

auth_provider = ad

access_provider = ad

chpass_provider = ad

You need to modify the ad domain controller parameter as follows:

ad_domain = ad.example.edu

ad_server = dcs01.ad.example.edu

ad_hostname = dcs01.ad.example.edu

ldap_idmap_default_domain_sid = <Domain SID>
krb5_realm = ad.example.edu

You need to modify the cache credential parameter because user needs to login off line.

7.1 ID Mapping Using ObjectSID in AD

This configuration copied under [domain/ad.example.edu] section and it is required because it will create the user home directory and also it will generate the uid and guid based on the active directory objectSid parameter.

ldap_idmap_range_min = 1824600000

ldap_idmap_range_size = 2000000
ldap_id_mapping = true
fallback_homedir = /home/%u

In the above configuration ldap_idmap_range_min and ldap_idmap_range_size parameters are optional. If you getting any ObjectSid to UID or GID conversion error, you need to include ldap idmap range parameters, otherwise it not required.

You can specify the default home directory parameter fallback_homedir value to create the home directory after user login successfully to the Linux System.

The ldap_id_mapping parameter value is true by default.

7.2 Posix Attribute Mapping using posixAccount and posixGroup Object classes

The following parameters needs to be modified when implementing the Posix Attribute mechanism.

ldap_id_mapping = false

ldap_user_home_directory = unixHomeDirectory

7.2.1 Active Directory User Configuration

The following modification needs to be done to implement with Posix Attribute Mechanism for the Active Directory User.

a) You need to include the PosixAccount Object class in the User Object

b) You need to add the following attributes in the user object after including the PosixAccount Object class. They are

uidNumber: The uidNumber is mapped to the unix system user uid

gidNumber: The gidNumber is mapped to the unix system group gid. This is a primary group id for the unix system and it is a single valued attribute. This value should map with active directory group gidNumber

unixHomeDirectory : The unixHomeDirectory mapped to the unix System User Home Directory

loginShell: The loginshell mapped to default shell for the linux system user.

The user modification ldif script is given below using posixAccount object class for the existing user:

ldapmodify -x -D <Admin DN> -W -h <Ldap Host> -p 389

dn: CN=12345678,OU=people,DC=ad,DC=example,DC=edu

changetype: modify

add: objectClass

objectClass: posixAccount

replace: gidNumber

gidNumber: 50001

replace: uidNumber

uidNumber: 12345678

replace: unixHomeDirectory

unixHomeDirectory: /home/12345678

add: loginShell

loginShell: /bin/bash

7.2.2 Active Directory Group Configuration

The following modification needs to be done to implement with Posix Attribute Mechanism for the Active Directory Group.

a) You need to include the PosixGroup Object class in the Group Object

b) You need to add the following attributes in the group object after including the PosixGroup Object class. They are

gidNumber: The gidNumber is mapped to the unix system group gid

member : The member field will mapped to the Linux User Groups.

The group modification ldif script is given below using posixGroup object class for the existing group:

dn: CN=developer,OU=Groups,DC=ad,DC=example,DC=edu

changetype: modify

replace: ObjectClass

ObjectClass: top

ObjectClass: Group

ObjectClass: posixGroup

replace: gidNumber

gidNumber: 50001

add: member

Member: CN=12345678,OU=people,DC=ad,DC=example,DC=edu

Note: The user object gidNumber must match with group object gidNumber. This values should be same while mapping the user to group to create the Linux System User.

8. Changing the Ownership

Execute the following command to change the Owner ship and also permission to read the sssd.conf file as a root user in the /etc/sssd directory.

chown root:root sssd.conf

chmod 600 sssd.conf

9. Restart the SSSD Service

Execute the following command to restart the sssd service.

service sssd restart

10. Testing the SSSD Authentication

Use any ssh client or putty. I am showing the example using the ssh in the command line to test the sssd authentication against active directory.

ssh -l testuser@ad.example.edu sssdlab.ad.example.edu

After entering the above command it will ask the user password and enter the user password and it will login to the Linux System and automatically create the home directory and default shell as you supplied in the sssd.conf file or from the ad if your using the posix attribute mechanism.

11. SSSD Log Location

If you found any error while authenticating the user against active directory. The following configuration needs to be done to logging the data as a debug mode.

a) Edit the /etc/sssd/sssd.conf file
b) Add the debug_level=9 parameter value under [domain/ad.example.edu] section
c) The following log files will be created in the /var/log/sssd directory:

krb5_child.log
ldap_child.log
sssd_ad.example.edu.log
sssd.log
sssd_nss.log
sssd_pam.log

If you found any error while starting the sssd service, check sssd.log file.
If you found any authentication errors and getting the data from the AD, you can check sssd_ad.example.edu.log for authentication and extracting the data from AD.
If you can verify request and response details from AD in the ldap_child.log
If you can verify Kerberos request and response details from AD in the krb5_child.log
You can check nss service error in sssd_nss.log and pam service errors in sssd_pam.log

12. Clearing SSSD Cache from memory.

If you found any errors with related to ID Mapping after switching the ID Mapping to PosixAttribute Mapping vice versa. You need to clean the sssd data base and also sssd mem cache.

a) stop the sssd service as follows:

service sssd stop

b) remove the database as follows:

rm /var/lib/sssd/db/*

c) remove the mem cache as follows:

rm /var/lib/sssd/mc/*

d) Start the SSSD service as follows:

service sssd start

13. Common Errors

13.1 pam_access(sshd:account): access denied for user `user1@example.edu' from `machine.example.edu'

Cause:

The Linux System Enforce with Access Control Policies in the access.conf file.

Solution:

Add the User or Group info into the /etc/security/access.conf file and the issue will be resolved. The access.conf sample configuration is given below:

+ : (user1) : ALL

13.2 pam_sss(sshd:chauthtok): User info message: Password change failed. Server message: Old password not accepted

The above error thrown while changing the password first logon in the SSSD Linux machine and also creating the home directory first time.

Cause:

The Client Linux SSSD machine establish the connectivity from Work Station to Kerberos Authentication Server taking more than kerberos auth timeout value when changing the password on first logon.

Solution:

Edit the /etc/sssd/sssd/conf file and increase the krb5_auth_timeout value. The default value is 6 seconds. You need to increase the timeout value according to your environment. For example krb5_auth_timeout value is 60 seconds.

How to Export Active Directory Permissions

2015-05-19T10:55:00.000-07:00

I want to export the Active Directory permissions using Get-ADPermission Command let as follows:

$orgunit = "Ou=Groups,dc=example,dc=edu"
$filename="Groups-Permissions.csv"

Get-AdObject -Filter 'Name -like "*"' -SearchBase $orgunit -SearchScope "Subtree" -Properties CanonicalName | Select @{Name="Identity";Expression={($_.CanonicalName)}} | Get-ADPermission | Select @{ Name='AccessRights';Expression={[string]::join(",", ($_.AccessRights))}},@{ Name='ExtendedRights';Expression={[string]::join(",", ($_.ExtendedRights))}},@{ Name='ChildObjectTypes';Expression={[string]::join(",", ($_.ChildObjectTypes))}},InheritedObjectType,@{ Name='Properties';Expression={[string]::join(",", ($_.Properties))}},Deny,InheritanceType,User,Identity,IsInherited,IsValid | Export-csv $filename

In the above command let I have used the following command lets to extract the ad permissions from ou=groups container:

1. Get-ADObject
2. Select
3. Get-ADPermission
4. Select
5. Export-CSV

1. Get-ADObject

Above command lets being used to retrieve all the objects under the ou=groups container.

Get-AdObject -Filter 'Name -like "*"' -SearchBase $orgunit -SearchScope "Subtree" -Properties CanonicalName

I have selected the property called CanonicalName, It contains the Identity of the AD Object. For example:

DistinguishedName: ou=Groups,dc=example,dc=edu
CanonicalName : example.edu/Groups

2. Select

Select @{Name="Identity";Expression={($_.CanonicalName)}}

Mapping the CanonicalName to Identity attribute because Get-AdPermission command lets expecting the Identity value to retrieve the AD Permissions from the object.

3. Get-ADPermission

Retrieving all the permission in the container based on the Identity attribute from the step 2.

Get-ADPermission

4. Select

It is being used to select the attributes from the Get-ADPermission command let object.

Select @{ Name='AccessRights';Expression={[string]::join(",", ($_.AccessRights))}},@{ Name='ExtendedRights';Expression={[string]::join(",", ($_.ExtendedRights))}},@{ Name='ChildObjectTypes';Expression={[string]::join(",", ($_.ChildObjectTypes))}},InheritedObjectType,@{ Name='Properties';Expression={[string]::join(",", ($_.Properties))}},Deny,InheritanceType,User,Identity,IsInherited,IsValid

5. Export-CSV

Exporting the selected attributes to a csv file:

Export-csv $filename

How to develop SAML-ECP Custom Client

2015-02-27T13:46:00.000-08:00

Pre-Requisite:

1. Installed and Configured Shibboleth IDP 3.0
2. Installed and Configured Shibboleth native SP 2.5.3 with ECP Enabled

Environment:

1. JDK 1.7
2. Eclipse
3. Gradle 1.5
4. Open SAML2.6.4
5. Apache Http Client 4.4
6. SL4J 1.7.10

Developing SAMl-ECP client

The following tasks needs to be performed to build the ECP clients:

1. Sending Request from ECP to SP

2. Sending Request from ECP to IDP

3. Sending Request from ECP to SP

1. Sending Request from ECP to SP

Accessing the Secure URL through Enhanced Client Proxy(ECP) using the Get Request. In get request you need to add two header fields in the request:

1. Accept: application/vnd.paos+xml
2. PAOS: ver='url:liberty:paos:2003-08';'urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp'

Please refer example code : EcpRequestInterceptor for adding the header variable in the request.

1.1 Send the Get Request Secure URL from ECP to SP with PAOS Header

   The PAOS header variables are added in the EcpRequestInterceptor class.

     public Envelope accessProtectedPage()
   {
       Envelope envelope=null;
       HttpGet request= new HttpGet(ecp.getProtectedUrl());
       try
       {
           CloseableHttpResponse httpResponse = client.execute(request);
           if(httpResponse != null)
           {
               if(httpResponse.getStatusLine().getStatusCode()==200)
               {
                   HttpEntity entity = httpResponse.getEntity();
                   envelope=convertRequestToSoap(entity);
                   if (!envelope.getBody().getUnknownXMLObjects().isEmpty())
                   {
                       if(envelope.getBody().getUnknownXMLObjects(AuthnRequest.DEFAULT_ELEMENT_NAME) != null)
                       {
                           logger.info("Auethentication Access"+convertSoapToString(envelope));
                       }
                       else
                       {
                           throw new RuntimeException("Invalid ECP Response");
                       }
                   }
                   else
                   {
                       throw new RuntimeException("Invalid ECP Response");
                   }
                   EntityUtils.consume(entity);
               }
               else
               {
                   throw new RuntimeException(httpResponse.getStatusLine().getStatusCode()+" - " +httpResponse.getStatusLine().getReasonPhrase());
               }
           }
       } catch (ClientProtocolException e) {
           // TODO Auto-generated catch block
           e.printStackTrace();
       } catch (IOException e) {
           // TODO Auto-generated catch block
           e.printStackTrace();
       }
       return envelope;
   }

1.2 SP will send the SOAP Response to ECP with PAOS Request in SOAP Headers and Authentication Request Statement in Soap Body.

The Ecp response from the SP is shown below.

<?xml version="1.0" encoding="UTF-8"?>
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
    <S:Header>
        <paos:Request xmlns:paos="urn:liberty:paos:2003-08" S:actor="http://schemas.xmlsoap.org/soap/actor/next" S:mustUnderstand="1"
        responseConsumerURL="https://shib-sp.example.edu/Shibboleth.sso/SAML2/ECP" service="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"/>
        <ecp:Request xmlns:ecp="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp" IsPassive="0" S:actor="http://schemas.xmlsoap.org/soap/actor/next" S:mustUnderstand="1">
        <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://shib-sp.example.edu/shibboleth</saml:Issuer>
            <samlp:IDPList xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
                <samlp:IDPEntry ProviderID="https://shib-idp.example.edu/idp/shibboleth"/>
            </samlp:IDPList>
        </ecp:Request>
        <ecp:RelayState xmlns:ecp="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp" S:actor="http://schemas.xmlsoap.org/soap/actor/next"
         S:mustUnderstand="1">ss:mem:ec7e3978ddd1958ca9efb27be7c9445017daf9068b62c647cc398a4dfc73573c</ecp:RelayState>
    </S:Header>
    <S:Body>
        <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
            AssertionConsumerServiceURL="https://shib-sp.example.edu/Shibboleth.sso/SAML2/ECP"
            ID="_c06ac9aa1e8e172b920bd32435547b05"
            IssueInstant="2015-02-27T00:04:38Z"
            ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
            Version="2.0">
                <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://shib-sp.example.edu/shibboleth</saml:Issuer>
                <samlp:NameIDPolicy AllowCreate="1"/>
                <samlp:Scoping>
                    <samlp:IDPList>
                        <samlp:IDPEntry ProviderID="https://shib-idp.example.edu/idp/shibboleth"/>
                    </samlp:IDPList>
                </samlp:Scoping>
        </samlp:AuthnRequest>
    </S:Body>
</S:Envelope>

2. Sending the Authentication Request from ECP to IDP with PAOS and Authorization Headers

2.1 Detach the SP Soap Body and Create a new Soap Envelop and set the detached soap body to new envelop

You need to remove the SOAP headers from the SP Initial Secure URL response or You can copy the authentication request from the SP Initial Secure URL response and build a new Soap Envelope. I have detached (copy) from the initial soap response and building the new soap request and sample code is given below:

public Envelope buildIdpAuthRequest(Envelope envelope)
    {

        Envelope newAuthRequest = new EnvelopeBuilder().buildObject();

        Body authBody= envelope.getBody();
        authBody.detach();
        newAuthRequest.setBody(authBody);

        return newAuthRequest;

    }

Sample Soap XML :

<?xml version="1.0" encoding="UTF-8"?>
<soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/">
    <S:Body xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
        <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
            AssertionConsumerServiceURL="https://shib-sp.example.edu/Shibboleth.sso/SAML2/ECP"
            ID="_b2c92bc8216ff317a5c42d797a7cd8ca" IssueInstant="2015-02-27T18:49:37Z"
            ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
            Version="2.0">
            <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://shib-sp.example.edu/shibboleth</saml:Issuer>
            <samlp:NameIDPolicy AllowCreate="1"/>
                <samlp:Scoping>
                    <samlp:IDPList><samlp:IDPEntry ProviderID="https://shib-idp.example.edu/idp/shibboleth"/></samlp:IDPList>
                </samlp:Scoping>
        </samlp:AuthnRequest>
    </S:Body>
</soap11:Envelope>

2.2 Send the Authentication Request to IDP with PAOS and Authorization Headers

You need to add the following header variables into the post request because these variables are required for IDP ECP profile:

1. Accept: application/vnd.paos+xml
2. PAOS: ver='url:liberty:paos:2003-08';'urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp'
3. Authorization: Basic + User Name and password encode with base 64.

The sample code is given below:

    public Envelope sendAuthenticationToIdp(String authRequestXml)
    {
        logger.info("Authentication Request from ECP to IDP :" + authRequestXml);
        Envelope envelope=null;
        HttpPost request= new HttpPost(ecp.getIdpUrl());
        request.addHeader(HttpHeaders.AUTHORIZATION, "Basic "+ Base64.encodeBytes((ecp.getUserName()+":"+ecp.getPassword()).getBytes()));
        try
        {
            request.setEntity(new StringEntity(authRequestXml));
        } catch (UnsupportedEncodingException e1) {
            // TODO Auto-generated catch block
            e1.printStackTrace();
        }
        try
        {
            CloseableHttpResponse httpResponse = client.execute(request);
            if(httpResponse != null)
            {
                if(httpResponse.getStatusLine().getStatusCode()==200)
                {
                    HttpEntity entity = httpResponse.getEntity();
                    envelope=convertRequestToSoap(entity);
                    if (!envelope.getBody().getUnknownXMLObjects().isEmpty())
                    {
                        if(envelope.getBody().getUnknownXMLObjects(Response.DEFAULT_ELEMENT_NAME) != null)
                        {
                            logger.info("Auethentication Access"+convertSoapToString(envelope));
                            org.opensaml.saml2.core.Response samlResp=(org.opensaml.saml2.core.Response)envelope.getBody().getUnknownXMLObjects(org.opensaml.saml2.core.Response.DEFAULT_ELEMENT_NAME).get(0);
                            if(samlResp.getStatus().getStatusCode().getValue().equals(StatusCode.SUCCESS_URI))
                            {
                                System.out.println("Status :"+samlResp.getStatus().getStatusCode().getValue());
                            }
                            else
                            {

                                StatusDetail detail= (StatusDetail)samlResp.getStatus().getStatusDetail().getUnknownXMLObjects(StatusDetail.DEFAULT_ELEMENT_NAME).get(0);
                                throw new RuntimeException("SAML Authentication Failed "+samlResp.getStatus().getStatusCode().getValue() + " - ");
                            }

                        }
                        else
                        {
                            throw new RuntimeException("Invalid IDP ECP Response");
                        }
                    }
                    else
                    {
                        throw new RuntimeException("Invalid ECP Response");
                    }
                    EntityUtils.consume(entity);
                }
                else
                {
                    // it will throw 403 error due to invalid password or invalid user name or authentication failed
                    throw new RuntimeException(httpResponse.getStatusLine().getStatusCode()+" - " +httpResponse.getStatusLine().getReasonPhrase());
                }
            }
        } catch (ClientProtocolException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return envelope;

    }

2.3 IDP will send the SOAP response to ECP with SAML Response in soap body and ECP response in SOAP Headers.

The sample Authentication Successful response from IDP as follows:

<?xml version="1.0" encoding="UTF-8"?>
<soap11:Envelope xmlns:soap11="http://schemas.xmlsoap.org/soap/envelope/">
    <soap11:Header>
        <ecp:Response xmlns:ecp="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"
            AssertionConsumerServiceURL="https://shib-sp.example.edu/Shibboleth.sso/SAML2/ECP"
            soap11:actor="http://schemas.xmlsoap.org/soap/actor/next" soap11:mustUnderstand="1"/>
        <samlec:GeneratedKey xmlns:samlec="urn:ietf:params:xml:ns:samlec"
            soap11:actor="http://schemas.xmlsoap.org/soap/actor/next">Saml keys</samlec:GeneratedKey>
    </soap11:Header>
    <soap11:Body>
        <saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
            Destination="https://shib-sp.example.edu/Shibboleth.sso/SAML2/ECP"
            ID="_c860f132c4115581218971d92a52f500"
            InResponseTo="_b2c92bc8216ff317a5c42d797a7cd8ca"
            IssueInstant="2015-02-27T18:49:37.867Z" Version="2.0">
                <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://shib-idp.example.edu/idp/shibboleth</saml2:Issuer>
                <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                    <ds:SignedInfo>
                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
                        <ds:Reference URI="#_c860f132c4115581218971d92a52f500">
                            <ds:Transforms>
                                <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                                <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                            </ds:Transforms>
                            <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
                            <ds:DigestValue>Digest Base 64 encoded value </ds:DigestValue>
                        </ds:Reference>
                    </ds:SignedInfo>
                    <ds:SignatureValue>Signature Value Base 64 encoded</ds:SignatureValue>
                    <ds:KeyInfo>
                        <ds:X509Data>
                            <ds:X509Certificate>Certificate</ds:X509Certificate>
                        </ds:X509Data>
                    </ds:KeyInfo>
                </ds:Signature>
                <saml2p:Status>
                    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
                </saml2p:Status>
                <saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
                    <xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
                        Id="_37f9853b6561b3722b3691392ace994b"
                        Type="http://www.w3.org/2001/04/xmlenc#Element">
                            <xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
                            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                                <xenc:EncryptedKey Id="_7dc4db379206ea3e491f5e6e15bbf6fb"
                                    Recipient="https://shib-sp.example.edu/shibboleth">
                                        <xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep">
                                            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                                            <xenc11:MGF xmlns:xenc11="http://www.w3.org/2009/xmlenc11#"
                                                Algorithm="http://www.w3.org/2009/xmlenc11#mgf1sha1"/>
                                        </xenc:EncryptionMethod>
                                        <ds:KeyInfo>
                                            <ds:X509Data>
                                                <ds:X509Certificate>Certificate</ds:X509Certificate>
                                            </ds:X509Data>
                                        </ds:KeyInfo>
                                        <xenc:CipherData>
                                            <xenc:CipherValue>Cipher Value</xenc:CipherValue>
                                        </xenc:CipherData>
                                </xenc:EncryptedKey>
                            </ds:KeyInfo>
                            <xenc:CipherData>
                                <xenc:CipherValue>Certificate</xenc:CipherValue>
                            </xenc:CipherData>
                    </xenc:EncryptedData>
                </saml2:EncryptedAssertion>
        </saml2p:Response>
    </soap11:Body>
</soap11:Envelope>

3. Sending the IDP Authentication Response from ECP to SP to access the Secure URL Access.

3.1 Add Initial Secure URL Access Relay State in IDP Soap Response Headers

The RelayState information is extracted from the initial Sp Secure Access Response from the SP Soap Envelop. This information is required in the soap header because, the SP going to accept the idp authentication SAML response and also make a decision to allow or denied requested secure page.

            RelayState relayState= (RelayState)secureResourceResponse.getHeader().getUnknownXMLObjects(RelayState.DEFAULT_ELEMENT_NAME).get(0);
            relayState.detach();

            Header header = new HeaderBuilder().buildObject();
            header.getUnknownXMLObjects().clear();
            header.getUnknownXMLObjects().add(relayState);
            idpAuthResponse.setHeader(header);

3.2 Extract the AssertionConsumerService URL from the IDP Soap Response

This assertionConsumerUrl parameter extracted from the Soap Header from the IDP Authentication soap response. This assertionConsumerUrl is being used to post the IDP Authentication response with Relay State header from ECP to Service provider post request.

String assertionConsumerUrl=((Response)idpAuthResponse.getHeader().getUnknownXMLObjects(Response.DEFAULT_ELEMENT_NAME).get(0)).getAssertionConsumerServiceURL();

3.3 Send IDP Authentication response to Service Provider with PAOS and Conetent-Type headers.

Sample Code:

    public Envelope sendAuthResponseToSp(String authResponseXml,String consumeServiceUrl)
    {
        Envelope envelope=null;
        HttpPost request= new HttpPost(consumeServiceUrl);
        request.addHeader(HttpHeaders.CONTENT_TYPE, EcpFlowConstants.PAOS_CONTENT_TYPE);

        try
        {
            request.setEntity(new StringEntity(authResponseXml));
        } catch (UnsupportedEncodingException e1) {
            // TODO Auto-generated catch block
            e1.printStackTrace();
        }
        try
        {
            CloseableHttpResponse httpResponse = client.execute(request);
            if(httpResponse != null)
            {
                if(httpResponse.getStatusLine().getStatusCode()==200)
                {
                    HttpEntity entity = httpResponse.getEntity();
                    entity.writeTo(System.out);
                    logger.info("Cookies   "+store.getCookies());
                    EntityUtils.consume(entity);


                }
                else
                {
                    throw new RuntimeException(httpResponse.getStatusLine().getStatusCode()+" - " +httpResponse.getStatusLine().getReasonPhrase());
                }
            }
        } catch (ClientProtocolException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return envelope;

    }

Example Code:

I have classified the example code 4 classes. They are

1. ECP Object

   This object is being used to capture the ECP Endpoint IDP Url, Protected Resource from the SP, User and Password to authenticate the IDP Server

2. EcpRequestInterceptor

    This object is being used to add the ECP headers in each request.

3. EcpClientFlow

This object being used to send the GET, POST request to IDP and SP using apache HttpClient.

4. EcpClient

This object is being used to Initialize the SAML Boot strap, and Interacting with EcpClientFlow object invoking the various request such as Accessing the Protected Page, Authenticating User from the IDP, and Finally Send the Authenticated IDP Response to Service Provider.

The Sample Code is given below:

package edu.example.ecp.client;

public class Ecp
{
    private String idpUrl;
    private String protectedUrl;
    private String userName;
    private String password;
    public String getIdpUrl() {
        return idpUrl;
    }
    public void setIdpUrl(String idpUrl) {
        this.idpUrl = idpUrl;
    }
    public String getProtectedUrl() {
        return protectedUrl;
    }
    public void setProtectedUrl(String protectedUrl) {
        this.protectedUrl = protectedUrl;
    }
    public String getUserName() {
        return userName;
    }
    public void setUserName(String userName) {
        this.userName = userName;
    }
    public String getPassword() {
        return password;
    }
    public void setPassword(String password) {
        this.password = password;
    }


}

package edu.example.ecp.client;

import java.io.IOException;
import java.io.StringWriter;
import java.io.UnsupportedEncodingException;
import java.net.ProxySelector;

import javax.xml.transform.Source;
import javax.xml.transform.Transformer;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.transform.TransformerException;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.TransformerFactoryConfigurationError;
import javax.xml.transform.dom.DOMSource;
import javax.xml.transform.stream.StreamResult;

import org.apache.http.HttpEntity;
import org.apache.http.HttpHeaders;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.CookieStore;
import org.apache.http.client.config.CookieSpecs;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.client.BasicCookieStore;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.impl.client.LaxRedirectStrategy;
import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
import org.apache.http.impl.conn.SystemDefaultRoutePlanner;
import org.apache.http.util.EntityUtils;
import org.opensaml.common.SAMLObject;
import org.opensaml.common.xml.SAMLConstants;
import org.opensaml.saml1.core.AuthenticationStatement;
import org.opensaml.saml2.core.Assertion;
import org.opensaml.saml2.core.AuthnRequest;
import org.opensaml.saml2.core.Status;
import org.opensaml.saml2.core.StatusCode;
import org.opensaml.saml2.core.StatusDetail;
import org.opensaml.saml2.ecp.Response;
import org.opensaml.ws.soap.soap11.Body;
import org.opensaml.ws.soap.soap11.Envelope;
import org.opensaml.ws.soap.soap11.impl.EnvelopeBuilder;
import org.opensaml.xml.Configuration;
import org.opensaml.xml.io.Marshaller;
import org.opensaml.xml.io.MarshallingException;
import org.opensaml.xml.io.Unmarshaller;
import org.opensaml.xml.io.UnmarshallingException;
import org.opensaml.xml.parse.BasicParserPool;
import org.opensaml.xml.parse.ParserPool;
import org.opensaml.xml.parse.XMLParserException;
import org.opensaml.xml.util.Base64;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.w3c.dom.Document;
import org.w3c.dom.Element;

package edu.example.ecp.client;

public class EcpClientFlow
{
    private Ecp ecp;
    private BasicParserPool pool;
    private CloseableHttpClient client;
    private CookieStore store;
    private Logger logger= LoggerFactory.getLogger(EcpClientFlow.class);

    public EcpClientFlow(Ecp ecp)
    {
        this.ecp=ecp;

        //Creating the Parse Object

        pool= new BasicParserPool();
        pool.setNamespaceAware(true);

        //Creating the Pooled Http Connection Manager
        PoolingHttpClientConnectionManager manager= new PoolingHttpClientConnectionManager();
        manager.setMaxTotal(20);
        manager.setDefaultMaxPerRoute(10);

        //Creating the Cookie Store store the Cookies
        store= new BasicCookieStore();
        //Creating the Browser Compatible Request Cookie Object
        RequestConfig config= RequestConfig.custom().setCookieSpec(CookieSpecs.DEFAULT).build();

        // Building the Client Builder

        HttpClientBuilder clientBuildert= HttpClients.custom().setConnectionManager(manager)
                .setDefaultCookieStore(store)
                // Add the ECP Header every request
                .addInterceptorFirst(new EcpRequestInterceptor())
                // Redirecting the Request
                .setRedirectStrategy(new LaxRedirectStrategy())
                .setDefaultRequestConfig(config);
        client=clientBuildert.setRoutePlanner(new SystemDefaultRoutePlanner(ProxySelector.getDefault())).build();
    }

    public Envelope accessProtectedPage()
    {
        Envelope envelope=null;
        HttpGet request= new HttpGet(ecp.getProtectedUrl());
        try
        {
            CloseableHttpResponse httpResponse = client.execute(request);
            if(httpResponse != null)
            {
                if(httpResponse.getStatusLine().getStatusCode()==200)
                {
                    HttpEntity entity = httpResponse.getEntity();
                    envelope=convertRequestToSoap(entity);
                    if (!envelope.getBody().getUnknownXMLObjects().isEmpty())
                    {
                        if(envelope.getBody().getUnknownXMLObjects(AuthnRequest.DEFAULT_ELEMENT_NAME) != null)
                        {
                            logger.info("Auethentication Access"+convertSoapToString(envelope));
                        }
                        else
                        {
                            throw new RuntimeException("Invalid ECP Response");
                        }
                    }
                    else
                    {
                        throw new RuntimeException("Invalid ECP Response");
                    }
                    EntityUtils.consume(entity);
                }
                else
                {
                    throw new RuntimeException(httpResponse.getStatusLine().getStatusCode()+" - " +httpResponse.getStatusLine().getReasonPhrase());
                }
            }
        } catch (ClientProtocolException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return envelope;
    }

    public Envelope sendAuthenticationToIdp(String authRequestXml)
    {
        logger.info("Authentication Request from ECP to IDP :" + authRequestXml);
        Envelope envelope=null;
        HttpPost request= new HttpPost(ecp.getIdpUrl());
        request.addHeader(HttpHeaders.AUTHORIZATION, "Basic "+ Base64.encodeBytes((ecp.getUserName()+":"+ecp.getPassword()).getBytes()));
        try
        {
            request.setEntity(new StringEntity(authRequestXml));
        } catch (UnsupportedEncodingException e1) {
            // TODO Auto-generated catch block
            e1.printStackTrace();
        }
        try
        {
            CloseableHttpResponse httpResponse = client.execute(request);
            if(httpResponse != null)
            {
                if(httpResponse.getStatusLine().getStatusCode()==200)
                {
                    HttpEntity entity = httpResponse.getEntity();
                    envelope=convertRequestToSoap(entity);
                    if (!envelope.getBody().getUnknownXMLObjects().isEmpty())
                    {
                        if(envelope.getBody().getUnknownXMLObjects(Response.DEFAULT_ELEMENT_NAME) != null)
                        {
                            logger.info("Auethentication Access"+convertSoapToString(envelope));
                            org.opensaml.saml2.core.Response samlResp=(org.opensaml.saml2.core.Response)envelope.getBody().getUnknownXMLObjects(org.opensaml.saml2.core.Response.DEFAULT_ELEMENT_NAME).get(0);
                            if(samlResp.getStatus().getStatusCode().getValue().equals(StatusCode.SUCCESS_URI))
                            {
                                System.out.println("Status :"+samlResp.getStatus().getStatusCode().getValue());
                            }
                            else
                            {

                                StatusDetail detail= (StatusDetail)samlResp.getStatus().getStatusDetail().getUnknownXMLObjects(StatusDetail.DEFAULT_ELEMENT_NAME).get(0);
                                throw new RuntimeException("SAML Authentication Failed "+samlResp.getStatus().getStatusCode().getValue() + " - ");
                            }

                        }
                        else
                        {
                            throw new RuntimeException("Invalid IDP ECP Response");
                        }
                    }
                    else
                    {
                        throw new RuntimeException("Invalid ECP Response");
                    }
                    EntityUtils.consume(entity);
                }
                else
                {
                    // it will throw 403 error due to invalid password or invalid user name or authentication failed
                    throw new RuntimeException(httpResponse.getStatusLine().getStatusCode()+" - " +httpResponse.getStatusLine().getReasonPhrase());
                }
            }
        } catch (ClientProtocolException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return envelope;

    }


    public Envelope sendAuthResponseToSp(String authResponseXml,String consumeServiceUrl)
    {
        Envelope envelope=null;
        HttpPost request= new HttpPost(consumeServiceUrl);
        request.addHeader(HttpHeaders.CONTENT_TYPE, EcpFlowConstants.PAOS_CONTENT_TYPE);

        try
        {
            request.setEntity(new StringEntity(authResponseXml));
        } catch (UnsupportedEncodingException e1) {
            // TODO Auto-generated catch block
            e1.printStackTrace();
        }
        try
        {
            CloseableHttpResponse httpResponse = client.execute(request);
            if(httpResponse != null)
            {
                if(httpResponse.getStatusLine().getStatusCode()==200)
                {
                    HttpEntity entity = httpResponse.getEntity();
                    entity.writeTo(System.out);
                    logger.info("Cookies   "+store.getCookies());
                    EntityUtils.consume(entity);


                }
                else
                {
                    // it will throw 403 error due to invalid password or invalid user name or authentication failed
                    throw new RuntimeException(httpResponse.getStatusLine().getStatusCode()+" - " +httpResponse.getStatusLine().getReasonPhrase());
                }
            }
        } catch (ClientProtocolException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return envelope;

    }


    public Envelope buildIdpAuthRequest(Envelope envelope)
    {

        Envelope newAuthRequest = new EnvelopeBuilder().buildObject();

        Body authBody= envelope.getBody();
        authBody.detach();
        newAuthRequest.setBody(authBody);

        return newAuthRequest;

    }

    public Envelope convertRequestToSoap(HttpEntity entity)
    {
        Envelope envlope=null;
        Document soapDoc;
        try
        {
            soapDoc = pool.parse(entity.getContent());
            Unmarshaller unmarshall = Configuration.getUnmarshallerFactory().getUnmarshaller(soapDoc.getDocumentElement());
            envlope=(Envelope)unmarshall.unmarshall(soapDoc.getDocumentElement());
        } catch (IllegalStateException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (XMLParserException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (UnmarshallingException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return envlope;
    }


    public String convertSoapToString(Envelope envelope)
    {
        String result=null;
        try
        {
            Marshaller marshaller= Configuration.getMarshallerFactory().getMarshaller(envelope);
            Element element= marshaller.marshall(envelope);
            Transformer transformer;
            transformer = TransformerFactory.newInstance().newTransformer();
            Source source = new DOMSource(element);
            StringWriter writer= new StringWriter();
            StreamResult output = new StreamResult(writer);
            transformer.transform(source, output);
            result=writer.getBuffer().toString();
        } catch (IllegalStateException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (MarshallingException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (TransformerConfigurationException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (TransformerFactoryConfigurationError e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (TransformerException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        return result;
    }

}

package edu.example.ecp.client;

import org.opensaml.common.xml.SAMLConstants;

public interface EcpFlowConstants
{
    public String PAOS_CONTENT_TYPE="application/vnd.paos+xml";
    public String PAOS_HEADER=SAMLConstants.PAOS_PREFIX.toUpperCase();
}



package edu.example.ecp.client;


import org.opensaml.DefaultBootstrap;
import org.opensaml.saml2.ecp.RelayState;
import org.opensaml.saml2.ecp.Response;
import org.opensaml.ws.soap.soap11.Envelope;
import org.opensaml.ws.soap.soap11.Header;
import org.opensaml.ws.soap.soap11.impl.HeaderBuilder;
import org.opensaml.xml.ConfigurationException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class EcpClient {

    private static Logger logger= LoggerFactory.getLogger(EcpClient.class);

    private static String SECURE_URL="https://shib-sp.example.edu/sample/";
    private static String IDP_URL="https://shib-idp.example.edu/idp/profile/SAML2/SOAP/ECP";
    private static String USER_NAME="<User Name>";
    private static String PASSWORD="<Password>";

    public static void main(String[] args)
    {
        /*
        System.setProperty("org.apache.commons.logging.Log","org.apache.commons.logging.impl.SimpleLog");
        System.setProperty("org.apache.commons.logging.simplelog.showdatetime","true");
        System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.http","DEBUG");
        System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.http.wire","DEBUG");
        System.setProperty("org.apache.commons.logging.de.tudarmstadt.ukp.shibhttpclient","DEBUG");
        */
        Ecp ecp= new Ecp();
        ecp.setProtectedUrl(SECURE_URL);
        ecp.setIdpUrl(IDP_URL);
        ecp.setUserName(USER_NAME);
        ecp.setPassword(PASSWORD);

        try
        {
            DefaultBootstrap.bootstrap();

            EcpClientFlow clientFlow= new EcpClientFlow(ecp);
            Envelope secureResourceResponse = clientFlow.accessProtectedPage();
            Envelope authRequest= clientFlow.buildIdpAuthRequest(secureResourceResponse);
            Envelope idpAuthResponse = clientFlow.sendAuthenticationToIdp(clientFlow.convertSoapToString(authRequest));
            String assertionConsumerUrl=((Response)idpAuthResponse.getHeader().getUnknownXMLObjects(Response.DEFAULT_ELEMENT_NAME).get(0)).getAssertionConsumerServiceURL();

            RelayState relayState= (RelayState)secureResourceResponse.getHeader().getUnknownXMLObjects(RelayState.DEFAULT_ELEMENT_NAME).get(0);
            relayState.detach();

            Header header = new HeaderBuilder().buildObject();
            header.getUnknownXMLObjects().clear();
            header.getUnknownXMLObjects().add(relayState);
            idpAuthResponse.setHeader(header);

            clientFlow.sendAuthResponseToSp(clientFlow.convertSoapToString(idpAuthResponse), assertionConsumerUrl);

        } catch (ConfigurationException e)
        {
            logger.error("Ecp Client Error", e);
        }


    }

}

package edu.example.ecp.client;

import java.io.IOException;

import org.apache.http.HttpException;
import org.apache.http.HttpHeaders;
import org.apache.http.HttpRequest;
import org.apache.http.HttpRequestInterceptor;
import org.apache.http.protocol.HttpContext;
import org.opensaml.common.xml.SAMLConstants;

public class EcpRequestInterceptor implements HttpRequestInterceptor,EcpFlowConstants {

    @Override
    public void process(HttpRequest request, HttpContext context)
            throws HttpException, IOException
    {
        request.addHeader(HttpHeaders.ACCEPT, PAOS_CONTENT_TYPE);
        request.addHeader(PAOS_HEADER,"ver="+SAMLConstants.PAOS_NS+";"+SAMLConstants.SAML20ECP_NS);
    }
}

Testing the Code:

Create the Source and Resource Directories

mkdir ecp-client/src/main/java -p
mkdir ecp-client/src/main/resources -p

Copy the Java Source files into ecp-client/src/main/java directory.

Creating Build File

Create a build.gradle File and add the following content in the File and also copy the file to ecp-client directory:

apply plugin: 'java'
apply plugin: 'eclipse'
apply plugin: 'application'

repositories{
    mavenCentral()
}
dependencies{
    compile 'org.opensaml:opensaml:2.6.4','org.apache.httpcomponents:httpclient:4.4',
        'org.slf4j:log4j-over-slf4j:1.7.10','org.slf4j:slf4j-simple:1.7.10',
        'org.slf4j:slf4j-api:1.7.10'
}
mainClassName='edu.example.ecp.client.EcpClient'

Setting JAVA_HOME, GRADLE_HOME and PATH:

export JAVA_HOME=JavaHOME
export GRADLE_HOME=gradle_home
export PATH=$GRADLE_HOME/bin:$PATH

Setting the Classpath

Run the following command to creating the eclipse project and also setting the classpath

gradle cleanEclipse eclipse

Running the Code

execute the gradle run and it will execute the ecp client code and display the output in the command line.

Common Errors:

Problem 1. Service Provider not sending the SOAP response with ECP Header while accessing the secure access page using the http client.

   Cause: The following headers are not available in the request:


1. Accept: application/vnd.paos+xml
2. PAOS: ver='url:liberty:paos:2003-08';'urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp'

Solution: Add the above headers in the request and SP will send the SOAP request with ECP Request Headers and also Authentication Request in the Soap Body.

Problem 2. The Identity Provider throwing 500 error while sending the authentication request from ECP to IDP

   Cause: The following headers are not available in the request:


1. Accept: application/vnd.paos+xml
2. PAOS: ver='url:liberty:paos:2003-08';'urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp'

Solution: Add the above headers in the request and DP will authenticate the user and send the SAML response in the soap body and also ecp response headers.

Problem 3. The Service Provider throwing 500 error while sending the authentication response from ECP to SP

   Cause: The following headers are not available in the request:


1. Accept: application/vnd.paos+xml
2. PAOS: ver='url:liberty:paos:2003-08';'urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp'
3. Content-Type: application/vnd.paos+xml

Solution: Add the above headers in the request and SP will accept the SAML response from the IDP issued assertion and It will redirect to requested target page.

Reference:

SAML 2.0 Profiles

How to configure Shibboleth 3.0 ECP

2015-02-20T16:09:00.000-08:00

The Shibboleth 3.0 Enhanced Client Proxy (ECP) to establish the Single-Sign on between Identity Provider (IDP) to Service Provider (SP) non supported browser applications such as Desk Top and Java Client Application.

Installed Software:

1. JDK 1.8
2. Shibboleth IDP 3.0
3. Shibboleth Native Service Provider 2.5.3
4. Tomcat 8
5. Apache Http Server 2.2
6. Red Hat 6

Pre-Requisite:

1. Installed and Configured the Shibboleth Identity Provider 3.0
2. Installed and Configured the Linux Native Service Provider 2.5.3

The following components are involved to configure the shibboleth ECP between IDP to SP:

1. Identity Provider

1.1 Defining ECP End Point

Go to the ID_HOME/metadata directory and add the following content in idp.metadata.xml file after <SingleSignOnService closing tag to enable the IDP ECP endpoint:

<SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://shib-idp-sandbox.ops.sfsu.edu/idp/profile/SAML2/SOAP/ECP"/>

1.2 Protect the ECP Endpoint Container Authentication

   Enable the Basic Authentication at the Web Server level as follows:

   1.2.1 Go to the /etc/httpd/conf.d directory and create a file idp.conf
   1.2.2 Add the following content in the idp.conf file.

<Location /idp/profile/SAML2/SOAP/ECP>
                AuthType Basic
                AuthName "Demo Organization- ECP profile"
                AuthzLDAPAuthoritative Off
                AuthBasicProvider ldap
                AuthLDAPURL ldap://<LdapHostName>/<Ldap Ou>?<Authentication Parameter>
                AuthLDAPBindDN "<Ldap Admin Bind Dn>"
                AuthLDAPBindPassword "<Ldap Bind Password>"
                Require valid-user
                SSLRequireSSL
</Location>

Replace LdapHostName with your Host Name, Ldap Admin Bind Dn with your admin dn, Ldap Bind Password with you password, Authentication Parameter with your own parameter. My parameter is CN. After replacing the configuration looks as follows:

<Location /idp/profile/SAML2/SOAP/ECP>
                AuthType Basic
                AuthName "Demo - ECP profile"
                AuthzLDAPAuthoritative Off
                AuthBasicProvider ldap
                AuthLDAPURL ldap://dcs01.example.edu/ou=people,dc=example,dc=edu?cn
                AuthLDAPBindDN "CN=shibadmin,OU=Users,DC=example,dc=edu"
                AuthLDAPBindPassword "password"
                Require valid-user
                SSLRequireSSL
</Location>

1.3 Restarting the Tomcat Server

Go to the tomcat_home/bin directory and execute the following commands to stop and start the tomcat server.

./shutdown.sh
./startup.sh

1.4 Restart the Apache Web Server

2. Service Provider

2.1 Enabling the ECP

I have installed the shibboleth sp in /apps/shibboleth-sp directory. Go to the Shibboleth-sp/etc/shibboleth directory and edit the shibboleth2.xml file and add the ECP="true" parameter under <SSO section.

<SSO entityID="<IDp Entity>" ECP="true"
discoveryProtocol="SAMLDS" discoveryURL="https://shib-idp.example.ed/DS/WAYF">
SAML2 SAML1
</SSO>

2.2 Protecting the Resource

After installing the shibboleth service provide and apache22.config file generated in the /apps/shibboleth-sp/etc/shibboleth directory. I have renamed apache22.config file to shib.conf and copy to /etc/httpd/conf.d directory. By default /secure application is protected in the shib.conf file. I am using the default configuration as it is and configuration is given below:

<Location /secure>
AuthType shibboleth
ShibCompatWith24 On
ShibRequestSetting requireSession 1
require shib-session
</Location>

2.3 Restart the Apache Web Server

/etc/init.d/httpd restart

Testing the ECP through Java

1. Download the ECP Client Libraries

Sample Code

The following sample code needs to be executed to test the ecp configuration and also modify the idPUrl to your actual Url, spUrl to your actual Sp Url, User Name with your user name and password with your password:

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;

import org.apache.http.HttpResponse;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpGet;
import org.opensaml.DefaultBootstrap;
import org.opensaml.xml.ConfigurationException;

import de.tudarmstadt.ukp.shibhttpclient.ShibHttpClient;

public class ShibEcpTestClient {

    private static String idpBaseUrl="https://shib-idp.example.edu";
    private static String spUrl="https://shib-sp.example.edu";

    private static String userName="<User Name>";
    private static String password="<Password>";

    public static void main(String[] args) {
        // TODO Auto-generated method stub


        System.setProperty("org.apache.commons.logging.Log","org.apache.commons.logging.impl.SimpleLog");
        System.setProperty("org.apache.commons.logging.simplelog.showdatetime","true");
        System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.http","DEBUG");
        System.setProperty("org.apache.commons.logging.simplelog.log.org.apache.http.wire","DEBUG");


        try {
            DefaultBootstrap.bootstrap();
        } catch (ConfigurationException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }





        HttpClient client= new ShibHttpClient(idpBaseUrl+"/idp/profile/SAML2/SOAP/ECP", userName, password);
        HttpGet req = new HttpGet(spUrl+"/secure");
        try
        {
            HttpResponse res = client.execute(req);
            InputStream ins= res.getEntity().getContent();


            BufferedReader br= new BufferedReader(new InputStreamReader(ins));
            String readLine=null;
            while((readLine=br.readLine()) != null)
            {
                System.out.println("Read Line Data :"+readLine);
            }




        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }

    }


}

Office 365 Integrating with Shibboleth 3.0

2015-02-13T16:10:00.000-08:00

Enabling the Browser based Single Sign-On or Service Provider (SP) initiated Single Sign-On between Office 365 to Shibboleth Identity Provider (IDP 3.0) as follows:

Pre-Requisite:

1. Installed and Configured the IDP Server 3.0
2. Office 365 Domain Should be created and verified.

Shibboleth IDP 3.0 Configuration:

1. Setting the Trust IDP to SP

1.1 Import the Office 365 metadata

    Go to the ID_HOME/metadata directory and execute the following command to download the office 365 metadata:

   wget https://nexus.microsoftonline-p.com/federationmetadata/saml20/federationmetadata.xml

1.2 Register the metadata with IDP

Go to the ID_HOME/conf directory and add the following content in metadata-providers.xml file:

<MetadataProvider id="microsoftonline" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/federationmetadata.xml"/>

2. Setting up the Encryption optional for SP's

Go to the IDP_HOME/conf directory and modify the idp.properties file.

2.3 Modifying the idp.properties

This configuration is required to setup optional encryption parameter for SP's metadata encryption keys. If the metadata contains encryption keys and it will apply while encrypting the data else it is optional.

idp.encryption.optional = true

3. Releasing the Attributes from IDP to SP

   As per the Microsoft the following attributes are required for office 365 SSO:

   1. ImmutableID
   2. UserId

Go to the IDP_HOME/conf directory and modify the attribute-resolver.xml and attribute-filter.xml file to release the attributes from IDP to SP.

3.1 Defining Attributes in attribute-resolver.xml File

   The following content needs to be added in the attribute-resolver.xml file:

    ImmutableID Attribute Definition

The immutableID is unqiue and shouldn't change any time. In my case common name (cn) is unique.

    <resolver:AttributeDefinition id="ImmutableID" xsi:type="ad:Simple" sourceAttributeID="cn">
            <resolver:Dependency ref="myLDAP" />
            <resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
   </resolver:AttributeDefinition>

   The SAML2StringNameID is deprecated in shibboleth 3.0. If you want to compatible with Shibboleth IDP 3.0, you need to follow the step 5 to generate the Name ID Policy and also modify the attribute definition configuration as follows:

    <resolver:AttributeDefinition id="ImmutableID" xsi:type="ad:Simple" sourceAttributeID="cn">
               <resolver:Dependency ref="myLDAP" />
               <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:mace:dir:attribute-def:ImmutableID" friendlyName="ImmutableID" encodeType="false" />
   </resolver:AttributeDefinition>


UserId Attribute Definition

<resolver:AttributeDefinition id="UserId" xsi:type="ad:Simple" sourceAttributeID="mail">
            <resolver:Dependency ref="myLDAP" />
            <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="IDPEmail" friendlyName="UserId" />
   </resolver:AttributeDefinition>

3.2 Releasing Attributes from IDP to SP in attribute-filter.xml File:

The following content needs to be added in the attribute-filter.xml file:

   <afp:AttributeFilterPolicy id="PolicyForWindowsAzureAD">
        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="urn:federation:MicrosoftOnline" />

       

       <afp:AttributeRule attributeID="UserId">
                <afp:PermitValueRule xsi:type="basic:ANY" />
       </afp:AttributeRule>

       

       <afp:AttributeRule attributeID="ImmutableID" >
            <afp:PermitValueRule xsi:type="basic:ANY" />
       </afp:AttributeRule>

       

       <afp:AttributeRule attributeID="transientId">
            <afp:DenyValueRule xsi:type="basic:ANY"/>
       </afp:AttributeRule>

   </afp:AttributeFilterPolicy>

4. Generating the Name ID Configuration

Go to the IDP_HOME/conf directory and modify the saml-nameid.properties and saml-nameid.xml file to generate the Persistence Name Id and this Id going to release to Service Providers as Name ID Policy and This Id going to be used to retrieve the attributes using AttributeService.

4.1 Configuring the SAML Name ID

The Name ID generation needs to be configured to release persistent ID as follows:

Persistent ID Generator configuration in saml-nameid.properties

The following properties needs to uncommented to configure the Persistence Name Id Generator:

      idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator
      idp.persistentId.sourceAttribute = cn
      idp.persistentId.salt = changethistosomethingrandom

    In the above configuration I have chosen cn is my source attribute. If you want to modify the source attribute according to your environment. IDP going to release the name id policy as a cn persistence attribute.

Persistent ID Generator configuration in saml-nameid.xml

The following content needs to be added in the saml-nameid.xml file and also you need to modify the attribute source ids. In my case my persistence source id is ImmutableID.

<ref bean="shibboleth.SAML2PersistentGenerator" />
<bean parent="shibboleth.SAML2AttributeSourcedGenerator"
p:format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
p:attributeSourceIds="#{ {'ImmutableID'} }" />

5. Generating Name ID Consumption Configuration

Go to the IDP_HOME/conf/c14n directory and modify the attribute-sourced-subject-c14n-config.xml and subject-c14n.xml to compatible with Attribute Encoders as per Shibboleth 3.0 Specification.

5.1 Configuring the Name ID Attribute in attribute-sourced-subject-c14n-config.xml

This configuration is required to add the name identifier in the attribute-sourced-subject-c14n-config.xml because IDP going to release NameIDPolicy in the SAML Assertion. I am using the common name (cn) as the subject name identifier and I have configured the cn as follows:

    <util:list id="shibboleth.c14n.attribute.AttributesToResolve">
        <value>cn</value>
    </util:list>

    <util:list id="shibboleth.c14n.attribute.AttributeSourceIds">
        <value>cn</value>
    </util:list>

If you want to add more than one field as a subject name identifier as follows:

    <util:list id="shibboleth.c14n.attribute.AttributesToResolve">
        <value>cn</value>
        <value>mail</value>
    </util:list>

    <util:list id="shibboleth.c14n.attribute.AttributeSourceIds">
        <value>cn</value>
        <value>mail</value>
    </util:list>

Note: These attributes are configured in the attribute-resolver.xml file.

5.2 Configuring the subject-c14n.xml File

Configuring the SAML2 Persistence Name ID

Un-Comment the following lines to configure the SAML Name Id:

<bean id="c14n/attribute" parent="shibboleth.PostLoginSubjectCanonicalizationFlow" />
<ref bean="c14n/SAML2Persistent" />

Configuring the SAML2 Name ID Format

Add the <value>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</value> in the <util:list id="shibboleth.NameTransformFormats"> bean.

6. Restart the Tomcat Web Server

Office 365 Configuration:

1. Setting the Trust From SP to IDP

   Open the Windows Azure Active Directory Power Shell Window.
   Execute the following command to authenticate the user and also establish the connectivity from client machine to windows azure AD Server.

     Connect-MsolService

     After executing the above command, you need to provide the user name and password to authenticate the user against the windows azure ad.

Configuring the SSO

The following scripts needs to be executed to configure the Single Sign-On. I have used the idp-signing.crt certificate in the script because this certificate is self signed and this certificate is available in the IDP_HOME/credentials directory.

$dom = "<Replace Your Federated Domain>"
$idpHost="<Replace Your IDP Host>"

$fedBrandName="IDMGT Shibboleth"

$url = "$idpHost/idp/profile/SAML2/POST/SSO"
$ecpUrl = "$idpHost/idp/profile/SAML2/SOAP/ECP"
$uri = "$idpHost/idp/shibboleth"
$logoutUrl = "$idpHost/profile/SAML2/POST/SLO"

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("idp-signing.crt")

$certData = [system.convert]::tobase64string($cert.rawdata)

Set-MsolDomainAuthentication –DomainName $dom –federationBrandName $FedBrandName -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $certData -IssuerUri $uri -ActiveLogOnUri $ecpUrl -LogOffUri $logoutUrl -PreferredAuthenticationProtocol SAMLP

Get-MsolDomainFederationSettings -DomainName $dom

Testing the SSO Will Come soon

Installing Shibboleth Native Service Provider

2015-02-09T12:18:00.000-08:00

Installing the Shibboleth Native Service Provider 2.5.3 in Red Hat 6.6.0.2.el6.x86_64

Pre-Requisite Software:

Install the following software using the yum repository to build the native shibboleth sp:

yum install gcc gcc-c++ openssl-devel boost-devel libcurl-devel httpd-devel unixODBC

Software Required:

The following software needs to be installed in the sequence order to build the Native Shibboleth Service Provider. You can install shibboleth default location /opt/shiiboleth-sp installation or you can choose custom path. I have chosen my path is /apps/shibboleth-sp

1. log4shib:

1.1 Download:

http://shibboleth.net/downloads/log4shib/latest/log4shib-1.0.8.tar.gz

1.2 Extract:

tar xzvf log4shib-1.0.8.tar.gz

cd log4shib-1.0.8

1.3 Configure , Build, and Install

./configure --disable-static --disable-doxygen --prefix=/apps/shibboleth-sp

make

make install

2. xerces-c 3.1.1:

2.1 Download:

wget http://www.gtlib.gatech.edu/pub/apache//xerces/c/3/sources/xerces-c-3.1.1.tar.gz

2.2 Extract:

tar xzvf xerces-c-3.1.1.tar.gz

cd xerces-c-3.1.1

2.3 Configure , Build, and Install

./configure --prefix=/apps/shibboleth-sp --disable-netaccessor-libcurl

make

make install

3. xml-security-c-1.7.2:

3.1 Download:

http://mirrors.ibiblio.org/apache/santuario/c-library/xml-security-c-1.7.2.tar.gz

3.2 Extract:

tar xzvf xml-security-c-1.7.2.tar.gz

cd xml-security-c-1.7.2

After extracting the xml-security-c-1.7.2.tar.gz file and set CPPFLAGS and LDFLAGS to configure and build the xml-security-c

3.3 Configure , Build, and Install

export CPPFLAGS='-I/apps/shibboleth-sp/include'
export LDFLAGS='-L/apps/shibboleth-sp/lib'

./configure --without-xalan --disable-static --prefix=/apps/shibboleth-sp

make

make install

4. XML Tooling:

4.1 Download:

wget http://shibboleth.net/downloads/c++-opensaml/latest/xmltooling-1.5.3.tar.gz

4.2 Extract:

tar xzvf xmltooling-1.5.3.tar.gz

cd xmltooling-1.5.3

4.3 Configure , Build, and Install

./configure --with-log4shib=/apps/shibboleth-sp --prefix=/apps/shibboleth-sp -C

make

make install

5. Open SAML:

5.1 Download:

wget http://shibboleth.net/downloads/c++-opensaml/latest/opensaml-2.5.3.tar.gz

5.2 Extract:

tar xzvf opensaml-2.5.3.tar.gz

cd opensaml-2.5.3

5.3 Configure , Build, and Install

./configure --with-log4shib=/apps/shibboleth-sp --prefix=/apps/shibboleth-sp -C

make

make install

6. httpd mod_ssl

Install the apache 2.2 http server and mod ssl for configuring the Shibboleth SP as follows:

yum install httpd mod_ssl

7. Shibboleth-Sp:

7.1 Download:

http://shibboleth.net/downloads/service-provider/latest/shibboleth-sp-2.5.3.tar.gz

7.2 Extract:

tar xzvf shibboleth-sp-2.5.3.tar.gz

cd shibboleth-sp-2.5.3

7.3 Configure , Build, and Install

Before building the shibboleth enable the apache version option. In my build i have installed the apache web server 2.2. In your case if you want to enable the different apache version you can enable acording to version. The apache options are enable-apache-22 and apx file option is with-apxs22

./configure --with-log4shib=/apps/shibboleth-sp --enable-apache-22 --with-apxs22=/usr/sbin/apxs --prefix=/apps/shibboleth-sp

make

make install

Configuring the Http Server

We need to configure the http server with shibboleth sp. For that reason copy the /apps/shibboleth-sp/etc/shibboleth/apache22.config to /etc/httpd/conf.d/apache22.conf. By default apache 2.2 load the conf automatically based on the .conf extension.

I have used the default SSL configuration certs to enable the ssl.

Restart the Apache Httpd Server:

/etc/init.d/httpd restart

After restarting the http server and it will load the shibboleth2. conf file.

Starting the Shibboleth SP

Go to /apps/shiiboleth-sp/sbin and execute the following command and it will start the shibboleth sp:

./shibd

Stopping the Shibboleth SP

ps -ef | grep shibd

kill -9 <shibd process id>

rm -f /apps/shibboleth-sp/var/run/shibboleth/shibd.sock

Shibboleth Start and Stop Start up Script:

After starting and stopping the shibboleth sp successfully, we need to build the init script as follows:

Go to the /etc/init.d/ and create the shibd file and add the following content:

ATH=/sbin:/bin:/usr/sbin:/usr/bin
DESC="Shibboleth 2 daemon"
NAME=shibd
SHIB_HOME=/apps/shibboleth-sp
SHIBSP_CONFIG=$SHIB_HOME/etc/shibboleth/shibboleth2.xml
LD_LIBRARY_PATH=$SHIB_HOME/lib
DAEMON=$SHIB_HOME/sbin/$NAME
SCRIPTNAME=/etc/init.d/$NAME
PIDFILE=$SHIB_HOME/var/run/$NAME.pid
LOCKFILE=$SHIB_HOME/var/run/shibboleth/shibd.sock
DAEMON_OPTS=""
RETVAL=0

# Force removal of socket
DAEMON_OPTS="$DAEMON_OPTS -f"

# Use defined configuration file
DAEMON_OPTS="$DAEMON_OPTS -c $SHIBSP_CONFIG"

# Specify pid file to use
DAEMON_OPTS="$DAEMON_OPTS -p $PIDFILE"

# Specify wait time to use
DAEMON_OPTS="$DAEMON_OPTS -w 30"

# Source Functions
. /etc/rc.d/init.d/functions

if [ -f /etc/sysconfig/shibd ]; then
        . /etc/sysconfig/shibd
fi

# Exit if the package is not installed.
[ -x "$DAEMON" ] || exit 0

case "$1" in
start)
    # Don't start shibd if NO_START is set.
    if [ "$NO_START" = 1 ] ; then
        echo "Not starting $DESC (see /etc/default/$NAME)"
        exit 0
    fi
    echo "Starting $DESC: "
    echo "$NAME."
    daemon --pidfile=${PIDFILE} $DAEMON $DAEMON_OPTS
    ;;

stop)
    echo "Stopping $DESC: "
    echo "PID File $PIDFILE"
        killproc -p ${PIDFILE} -t 30
        RETVAL=$?
        echo
        [ $RETVAL = 0 ] && rm -f ${PIDFILE} ${LOCKFILE}

    echo "$NAME."
    ;;

restart|force-reload)

        echo "Stopping $DESC: "
        killproc -p ${PIDFILE} -t 30
        RETVAL=$?
        echo
        [ $RETVAL = 0 ] && rm -f ${PIDFILE} ${LOCKFILE}

        sleep 1

        echo "Starting $DESC: "

        daemon --pidfile=${PIDFILE} $DAEMON $DAEMON_OPTS
        echo "$NAME."
        ;;
*)

        echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
        exit 1
        ;;
esac

exit 0

In the above script modify the SHIB_HOME according to your environment.

References:

1. https://dev.e-taxonomy.eu/trac/wiki/ShibbolethSP2InstallDebianLenny

2. https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxSourceBuild

Installing Shibboleth IDP 3.0 Linux Envronment

2015-02-04T10:58:00.001-08:00

Installing Shibboleth IDP 3.0 Linux Envronment

The following software required to install the shibboleth IDP 3.0 in RedHat Linux:

1. Sun Java 1.8
2. Apache Tomcat 8
3. Apache Http Server 2.2
4. Shibboleth IDP 3.0

I am going to install the Apache Http Server as a root user and others all install in non-root user.

1. Sun Java 1.8

   Down load the Java Files and Extract the Java. I have extracted the java in /apps/jdk1.8.0_31 directory. After extracting the set the JAVA_HOME environment variable and JAVA PATH in the bash or command line.

export JAVA_HOME=/apps/jdk1.8.0_31
export PATH=$JAVA_HOME/bin;$PATH

2. Apache Tomcat 8

Down load the Apache Tomcat 8 and Extract the Tomcat. I have extracted the tomcat in /apps/apache-tomcat-8.0.18 directory.

2.1 Create the Self Signed certificate to Enable the SSL

   Go to the /apps/apache-tomcat-8.0.18/conf directory and execute the following command to create the self signed certificate to enable the SSL. The self Signed Certificate is not recommended for production.

   keytool -genkey -keystore tomcat.jks -alias tomcat -keyalg RSA

   You need to provide the following details while executing the above command.

1. Key Store Password
2. First and Last Name. First and Last Name is Host Name.

2.2 Configuring the server.xml to enable the SSL

Add the following connector configuration below Service section

   <Connector
    protocol="org.apache.coyote.http11.Http11NioProtocol"
    port="8443" maxThreads="200" scheme="https" secure="true"
    SSLEnabled="true"
    keystoreFile="/apps/apache-tomcat-8.0.18/conf/tomcat.jks"
    keystorePass="<Replace With Your Keystore Password>" clientAuth="false"
    sslProtocol="TLS"/>

2.3 Start the Tomcat

   Go to the /apps/apache-tomcat-8.0.18/bin directory and run the ./startup.sh
   After executing the above command it will start the tomcat server.

3. Apache Http Server

   3.1 Installing the Apache Tomcat Server

   Login as a root and install the apache http server and mod_ssl

   yum install httpd mod_ssl

It will install the httpd and mod_ssl. I am using the default ssl configuration and certs provided by default installation. If you want to modify the SSL configuration to import the cert and you need to modify the /etc/httpd/conf.d/ssl.conf file and replace the following properties to with certs generated.

SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

   3.2 Starting the Http Server

    Execute the /etc/inid.d/httpd restart and It will restart the server.

    3.3 Configuring the proxy_ajp.conf file

Create the proxy_ajp.conf file and add the following content to invoke the apache tomcat web applications using ajp protocol. My tomcat is running under same machine.

ProxyPass /idp/ ajp://localhost:8009/idp/ connectiontimeout=30 timeout=60

I have used connectiontimeout and timeout parameter because some times tomcat server delay the response and http server will throw 404 error.

I have used /idp because idp application will reside in the tomcat server. I am going to deploy the idp application in tomcat server after installing the IDP Server.

3.4 Re-starting the Http Server

   Follow the step 3.2 to restart the tomcat server.

4. Shibboleth IDP 3.0

   Extract the shibboleth file and I have extracted the /apps/soft/shibboleth-identity-provider-3.0.0 directory. Go to the /apps/soft/shibboleth-identity-provider-3.0.0/bin directory and execute the ./install.sh file and It will install the shibboleth 3.o as follows:

Executing the Installable File

./install.sh

Source (Distribution) Directory: [/apps/soft/shibboleth-identity-provider-3.0.0]

Choosing the Installation Directory

Enter and It will show the following option:

Installation Directory: [/opt/shibboleth-idp]

I have chosen different path because I am going to install shibboleth idp as a non-root user. My Shibboleth idp location is

/apps/shibboleth-idp

Choosing Host Name :

Hostname: [shib-idp-sandbox.example.edu]

I have selected the default host name and press enter button and it will display the following screen.

SAML EntityID: [https://shib-idp-sandbox.example.edu/idp/shibboleth]

Choosing Attribute Scope :

Attribute Scope: [example.edu]
I have selected the default attribute scope and press enter button and it will display the following screen:

Entering the TLS and Cookie Encryption Key Password:

TLS Private Key Password:
Re-enter password:
Cookie Encryption Key Password:
Re-enter password:

Warning: /apps/shibboleth-idp/bin does not exist.
Warning: /apps/shibboleth-idp/dist does not exist.
Warning: /apps/shibboleth-idp/doc does not exist.
Warning: /apps/shibboleth-idp/system does not exist.
Warning: /apps/shibboleth-idp/webapp does not exist.
Generating Signing Key, CN = shib-idp-sandbox.example.edu URI = https://shib-idp-sandbox.example.edu/idp/shibboleth ...
...done
Creating Encryption Key, CN = shib-idp-sandbox.example.edu URI = https://shib-idp-sandbox.example.edu/idp/shibboleth ...
...done
Creating TLS keystore, CN = shib-idp-sandbox.example.edu URI = https://shib-idp-sandbox.example.edu/idp/shibboleth ...
...done
Creating cookie encryption key files...
...done
Rebuilding /apps/shibboleth-idp/war/idp.war ...
...done

Shibboleth was installed successfully.

Post Shibboleth Installation:

4.1 Setting the idp.home system variable in tomcat

Edit the /apps/apache-tomcat-8.0.18/bin/catalina.sh file and add the idp.home java system property. This property is required for loading the configuration files in the tomcat server.

JAVA_OPTS="$JAVA_OPTS -Didp.home=/apps/shibboleth-idp"

4.2 Adding the jstl-1.2.jar in the tomcat lib directory

Download the jstl-1.2.jar file and add the /apps/apache-tomcat-8.0.18/lib directory. This jar file is required for execute the velocity templates.

4.3 Deploy the idp.war file in tomcat

   Create the idp.xml file in /apps/apache-tomcat-8.0.18/conf/Catalina/localhost/ directory and add the following content to deploy the idp.war file in tomcat

<Context docBase="/apps/shibboleth-idp/war/idp.war"
    privileged="true"
    antiResourceLocking="false"
    antiJARLocking="false"
    unpackWAR="true"
    swallowOutput="true" />

4.4 Restart the tomcat

Go to the /apps/apache-tomcat-8.0.18/bin directory and execute the following commands to restart the tomcat server:

./shutdown.sh - it will stop the tomcat server
./startup.sh - it will start the tomcat server

4.5 Testing the Shibboleth Installation:

Access the shibboleth status page (https://localhost/idp/status ) and it will display the following content in the browser:

### Operating Environment Information
operating_system: Linux
operating_system_version: 2.6.32-504.8.1.el6.x86_64
operating_system_architecture: amd64
jdk_version: 1.8.0_31
available_cores: 4
used_memory: 714 MB
maximum_memory: 1751 MB

### Identity Provider Information
idp_version: 3.0.0
start_time: 2015-02-03T15:11:50-08:00
current_time: 2015-02-04T10:55:25-08:00
uptime: 71015020 ms

service: shibboleth.LoggingService
last successful reload attempt: 2015-02-03T23:11:06Z

service: shibboleth.ReloadableAccessControlService
last successful reload attempt: 2015-02-03T23:11:09Z

service: shibboleth.MetadataResolverService
last successful reload attempt: 2015-02-03T23:11:08Z

 metadata source: ShibbolethMetadata

service: shibboleth.RelyingPartyResolverService
last successful reload attempt: 2015-02-03T23:11:09Z

service: shibboleth.NameIdentifierGenerationService
last successful reload attempt: 2015-02-03T23:11:07Z

service: shibboleth.AttributeResolverService
last successful reload attempt: 2015-02-03T23:11:07Z

service: shibboleth.AttributeFilterService
last successful reload attempt: 2015-02-03T23:11:07Z

How to Develop and Deploy WCF REST Servvice Web Deployment Manager / Jenkins

2014-12-09T16:40:00.000-08:00

The following steps needs to be followed to deploy the WCF REST service in IIS using the Web Deployment Manager and Jenkin. They are

1. Download and Install Web Platform Installer

2. Open the Microsoft Web Platform Installer and Install the following components to execute the MSBuild targets and also deploy the web application in IIS through Web Deployment Manager.

2.1 Microsoft.Net Framework 4.5

This component is required for to install the SharpDevelop IDE and also Run time environment for the IIS.

2.2 Web Deployment Manager

This component is required for to deploy the REST FULL Web Services through Remote

2.3 Visual Studio 2010 Shell (Isolated)

This component is required for to deploy the REST FULL Web Services using MSBuild targets. For example /p:DeployOnBuild=True

3. Install the IIS

This step is only required if your not installed IIS in Windows 7. I have highlighted the required component in bold font. Open the Control Panel --> Programs and Features --> Turn Windows Feature On or Off --> Select Internet Information Services and Click OK Button. It will install the IIS.

3.1 Enabling the AST..Net Handler

This component is required to enable the ASP.net Mapping Handler components in IIS. This component was not installed after installing the IIS. Open the Control Panel --> Programs and Features --> Turn Windows Feature On or Off --> Select Internet Information Services --> Select World Wide Web Services --> Select ASP.NET check box and Click OK Button. It will install the ASP.NET feature.

3.2 Enabling the WCF Handler

This component is required to enable the WCF Mapping Handler components in IIS. This component was not installed after installing the IIS. Open the Control Panel --> Programs and Features --> Turn Windows Feature On or Off --> Select Microsoft .NET Framework 3.5.1 --> Select Windows Communication Foundation HTTP Activation and Windows Communication Foundation Non-HTTP Activation and Click OK Button. It will install the WCF feature.

4. Download and install the Sharpdevelop IDE

5. Create the REST Service Project Using the Sharpdevelop IDE

Open the SharpDeveop IDE --> File --> Solution --> C# --> WCF --> Select WCF REST Service and Enter Name is RestDemoService and Click Create Button and It will create the WCF REST Service Project. My Sample Code is given below. I am deploying the default generated code rest full wcf servce using web deployment manager and jenkin job.

using System;
using System.ServiceModel;
using System.ServiceModel.Web;

namespace RestDemoService
{
    [ServiceContract]
    public interface IService
    {
       [OperationContract]
       [WebGet(UriTemplate = "operation/{name}")]
       string MyOperation(string name);
    }

    public class Service : IService
    {
       public string MyOperation(string name)
       {
          // implement the operation
          return string.Format("Operation name: {0}", name);
       }
    }
}

6. Include the Visual Studio MSBuild Targets

By default sharpdevlop ide was included the visual studio web application msbbuild targets. These msbuild targets are required to package the rest full wcf service as a zip file and also publish the zip files into the IIS Web Site.

Open the RestDemoService.csproj file and import the Microsoft.WebApplication.targets file.

My windows 7 operating system is 32 bit machine and I have installed the Visual Studio 2010 Shell 32 bit version. If your installed 64 bit version choose the path MSBuildExtensionsPath64. The sample 64 bit version as follows:

Include the .svc and .config file in the Package

By default .svc and .config files are not included in the package. We need to modify the .csproj file

Original Version:

Modified Version:

7. Check in the Code into your repository.

My sample repository is svn.

8. Download the Jenkins and Install

9. Configuring the MSBuild .Net Plugin

Open the Jenkin Console and Click Manage Jenkins --> Manage Plugins --> Available --> Select MsBuild Plugin -->Click Install Without Restart Button. It will install the MSBuild .Net Plugin

10. Configuring the MSBuild Compiler

Open the Jenkin Console and Click Manage Jenkins --> Configure System --> Add MSBuild -->Enter the following details.

MSBuild Name: MsBuild - 4.0

Path to MSBuild: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

In my example i am using the .net framework 4.0 and I have entered the msbuild .net 4.0 as shown above.

Click Save and It will save the MSBuild Configuration.

11. Creating the Jenkin Job

Open the Jenkin Console --> Click New Item and Enter the following details to create the Jenkin Job:

1. Enter Item Name: Rest Demo Service

2. Select Freestyle project.

Click OK Button and It will create the Jenkin Job.

12. Configuring the Source Control

Open the Jenkin Console --> Click Jenknin job Rest Demo Service -> Configure --> Select Subversion in the Source Code Management and Enter the Repository URL. After entering the URL and It will ask the Credentials. Please click the Credentials and it will authenticate the user against the SVN Authentication repository. Leave the rest of the options as it is and Click Save Button and It will configure the subversion.

13. Triggering the Build

Open the Jenkin Console --> Click Jenknin job Rest Demo Service -> Select Poll SCM and Enter the Schedule Time. My Sample build needs to be run every 11 Hours once. I have configured as follows:

H 11 * * *

14. Configuring the Build

Open the Jenkin Console --> Click Jenknin job Rest Demo Service -> Enter the following details:

1. MSBuild Version:

This msbuild version is already configured in the configure system. Please select the MSBuild Version in the Combo box. In My case MSBuild Version is MSBuild - 4.0

2. MSBuild Build File:

Enter the Solution File or Project File. In my example Solution File Name is RestDemoService.sln

3. Command Line Arguments:

/t:clean /t:rebuild /p:Configuration=Debug /p:DeployOnBuild=True /p:DeployTarget=MsDeployPublish /p:MSDeployPublishMethod=RemoteAgent /p:CreatePackageOnPublish=True /p:DeployIisAppPath="Default Web Site/RestDemoService" /p:MsDeployServiceUrl=<Remote Agent Host Name> /p:username="Administrator User Name" /p:password=<Admin Password>

I am deploying the application in Default Web Site/RestDemoService. You can replace with your Web Site/Application Name.

Deploying the Application Remote Server

MSDeployPublishMethod = RemoteAgent

MsDeployServiceUrl = Remote Host Name

Deploying the Application Local Machine

MSDeployPublishMethod = InProc

username=Administrator User Name

password=Administrator Password

The above command will clean the build, compile the build and package as a zip file and publish to the IIS using the Deployment Manager using msbuild.

15. Running the Jenkin Job

Open the Jenkin Console --> Click Jenknin job Rest Demo Service -> Click Build Now. It will build the web application and deploy web application into the IIS.

16. Testing the WCF REST Service

Open the Browser and Access the following URL to test the WCF Web Service:

http://localhost/RestDemoService/Service.svc/operation/add

Response:

<string xmlns="http://schemas.microsoft.com/2003/10/Serialization/">Operation name: add</string>

javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.

2014-11-20T13:25:00.000-08:00

Error:

javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.

        at com.sun.xml.ws.wsdl.parser.RuntimeWSDLParser.tryWithMex(RuntimeWSDLParser.java:182)
        at com.sun.xml.ws.wsdl.parser.RuntimeWSDLParser.parse(RuntimeWSDLParser.java:153)
        at com.sun.xml.ws.client.WSServiceDelegate.parseWSDL(WSServiceDelegate.java:284)
        at com.sun.xml.ws.client.WSServiceDelegate.<init>(WSServiceDelegate.java:246)
        at com.sun.xml.ws.client.WSServiceDelegate.<init>(WSServiceDelegate.java:197)
        at com.sun.xml.ws.client.WSServiceDelegate.<init>(WSServiceDelegate.java:187)
        at weblogic.wsee.jaxws.spi.WLSServiceDelegate.<init>(WLSServiceDelegate.java:84)
        at weblogic.wsee.jaxws.spi.WLSProvider$ServiceDelegate.<init>(WLSProvider.java:598)
        at weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:120)
        at weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:112)
        at weblogic.wsee.jaxws.spi.WLSProvider.createServiceDelegate(WLSProvider.java:83)
        at javax.xml.ws.Service.<init>(Service.java:56)
        at edu.sfsu.excs.ExchangeConnectorService.<init>(ExchangeConnectorService.java:42)
        at edu.sfsu.exchange.connector.util.ExchangeConnectorUtil.getExchangeConnectorServiceSoap(Unknown Source)
        at edu.sfsu.exchange.connector.adapter.ExchangeConnectorWrapper.buildEXCSConfig(Unknown Source)
        at edu.sfsu.exchange.connector.adapter.ExchangeConnectorProcessTask.createUser(Unknown Source)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at com.thortech.xl.adapterGlue.ScheduleItemEvents.adpEXCS_CREATEUSER.CREATEUSER(adpEXCS_CREATEUSER.java:110)
        at com.thortech.xl.adapterGlue.ScheduleItemEvents.adpEXCS_CREATEUSER.implementation(adpEXCS_CREATEUSER.java:54)
        at com.thortech.xl.client.events.tcBaseEvent.run(tcBaseEvent.java:196)
        at com.thortech.xl.dataobj.tcDataObj.runEvent(tcDataObj.java:2492)
        at com.thortech.xl.dataobj.tcScheduleItem.runMilestoneEvent(tcScheduleItem.java:2919)
        at com.thortech.xl.dataobj.tcScheduleItem.eventPostUpdate(tcScheduleItem.java:742)
        at com.thortech.xl.dataobj.tcDataObj.update(tcDataObj.java:664)
        at com.thortech.xl.dataobj.tcDataObj.save(tcDataObj.java:508)
        at com.thortech.xl.dataobj.tcScheduleItem.checkChildrenIfCompleted(tcScheduleItem.java:1808)
        at com.thortech.xl.dataobj.tcScheduleItem.checkChildren(tcScheduleItem.java:1852)
        at com.thortech.xl.dataobj.tcScheduleItem.eventPostUpdate(tcScheduleItem.java:723)
        at com.thortech.xl.dataobj.tcDataObj.update(tcDataObj.java:664)
        at com.thortech.xl.dataobj.tcDataObj.save(tcDataObj.java:508)
        at com.thortech.xl.dataobj.tcORC.completeSystemValidationMilestone(tcORC.java:1190)
        at com.thortech.xl.dataobj.tcOrderItemInfo.completeCarrierBaseMilestone(tcOrderItemInfo.java:735)
        at com.thortech.xl.dataobj.tcOrderItemInfo.eventPostInsert(tcOrderItemInfo.java:172)
        at com.thortech.xl.dataobj.tcUDProcess.eventPostInsert(tcUDProcess.java:237)
        at com.thortech.xl.dataobj.tcDataObj.insert(tcDataObj.java:604)
        at com.thortech.xl.dataobj.tcDataObj.save(tcDataObj.java:474)
        at com.thortech.xl.dataobj.tcTableDataObj.save(tcTableDataObj.java:2906)
        at com.thortech.xl.dataobj.tcORC.autoDOBSave(tcORC.java:3002)
        at com.thortech.xl.dataobj.util.tcOrderPackages.createOrder(tcOrderPackages.java:526)
        at com.thortech.xl.dataobj.util.tcOrderPackages.orderPackageForUser(tcOrderPackages.java:177)
        at com.thortech.xl.dataobj.tcOIU.provision(tcOIU.java:527)
        at com.thortech.xl.dataobj.tcOIU.eventPostInsert(tcOIU.java:306)
        at com.thortech.xl.dataobj.tcDataObj.insert(tcDataObj.java:604)
        at com.thortech.xl.dataobj.tcDataObj.save(tcDataObj.java:474)
        at com.thortech.xl.dataobj.tcTableDataObj.save(tcTableDataObj.java:2906)

Cause:

Renew the SSL Certificates are imported into the Web Logic Trusted Key Store.

Solution:

To resolve the above error, We need to enable ssl JSSE implementation in web logic server as follows:

1. Modify the startNodeManager.sh file
Add the JAVA_OPTIONS="${JAVA_OPTIONS} -Dweblogic.ssl.JSSEEnabled=true"
2. Modify the setDomainEnv.sh File
Add the JAVA_OPTIONS="${JAVA_OPTIONS} -Dweblogic.ssl.JSSEEnabled=true"

After adding modifying the startNodeManager.sh and setDomainEnv.sh file and restart the Node Manager and Web Logic Managed Server and also Admin Server. The issue will be resolved.

Client Side:

If the issue is getting the client side, add the following property into a java system variable and the issue will be resolved.

-Dweblogic.security.SSL.enableJSSE=true

Configuring Openldap TLS/SSL

2014-09-15T10:56:00.000-07:00

Configuring Openldap TLS/SSL

Environment: Cent OS 6.5 64 Bit

1. Configuring the TLS open Ldap

The following steps needs to be performed to enable the TLS in openldap:

1.1 Login as a root or sudo user with root previliges

1.2 Create the ssl Directory

Create the ssl directory to store the new Certificate Authority, Server Certicate, and Server Key.

mkdir ssl
cd ssl

1.3 Create the new Certificate Authority

Execute the following command to create the new ca

       /etc/pki/tls/misc/CA -newca

      The following input parameters needed after executing the newca command and I have highlighted the steps in bold font.


       a) Enter Command to create the New CA Private Key
       b) Enter the PEM Pass Phrase
       c) Enter the CA Certificate details and the Common Name is mandatory field.


CA certificate filename (or enter to create)

     stored in the /etc/pki/CA/private/ as a cakey.pem.

Making CA certificate ...
Generating a 2048 bit RSA private key
................................+++
..................+++
writing new private key to '/etc/pki/CA/private/./cakey.pem'

Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:CA
Locality Name (eg, city) [Default City]:San Francisco
Organization Name (eg, company) [Default Company Ltd]:Example.EDU
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:Example.EDU
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:Using configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/./cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 9263543358417925999 (0x808eb79aa7edf76f)
        Validity
            Not Before: Sep 15 16:35:54 2014 GMT
            Not After : Sep 14 16:35:54 2017 GMT
        Subject:
            countryName               = US
            stateOrProvinceName       = CA
            organizationName          = Example.EDU
            commonName                = Example.EDU
        X509v3 extensions:

            X509v3 Subject Key Identifier:
                10:45:D2:A1:9F:2D:3C:69:8D:86:AD:48:CD:97:3C:97:13:B2:A1:AA
            X509v3 Authority Key Identifier:
                keyid:10:45:D2:A1:9F:2D:3C:69:8D:86:AD:48:CD:97:3C:97:13:B2:A1:AA

            X509v3 Basic Constraints:
                CA:TRUE
Certificate is to be certified until Sep 14 16:35:54 2017 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated

1.4 Copy the CA certificate from /etc/pki/CA/newcerts/ to ssl

The ca certificate stored in the /etc/pki/CA/newcerts/ as a random generated string with pem extension. In my example ca certificate name is 808EB79AA7EDF76F.pem.

cp /etc/pki/CA/newcerts/808EB79AA7EDF76F.pem exampleca.pem

You can replace example.pem to your own name.

1.5 Creating the Cert Reqest

The following command is being used to create the cert request and it requires the common name parameter as a mandatory parameter and that parameter should be host name of the openldap server. In my example host name is localhost.localdomain.

openssl req -new -nodes -keyout newreq.pem -out newreq.pem

The -nodes argument above prevents encryption of the private key. OpenLDAP only works with unencrypted private keys

Generating a 2048 bit RSA private key
...............................................................................................................................................+++
.+++
writing new private key to 'newreq.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:CA
Locality Name (eg, city) [Default City]:San Francisco
Organization Name (eg, company) [Default Company Ltd]:Example
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:localhost.localdomain
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

After executing the above command it will create the newreq.pem file in the ssl directory.

1.6 Signing the Certificate

Execute the following command to sign the certificate and it will stored in the ssl directory as newcert.pem.

/etc/pki/tls/misc/CA -sign

sing configuration from /etc/pki/tls/openssl.cnf
Enter pass phrase for /etc/pki/CA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 9263543358417926000 (0x808eb79aa7edf770)
        Validity
            Not Before: Sep 15 16:43:45 2014 GMT
            Not After : Sep 15 16:43:45 2015 GMT
        Subject:
            countryName               = US
            stateOrProvinceName       = CA
            localityName              = San Francisco
            organizationName          = Example
            commonName                = localhost.localdomain
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                83:46:4D:C7:B6:3A:3F:62:3B:87:D5:C4:75:10:18:07:FC:45:5D:9A
            X509v3 Authority Key Identifier:
                keyid:10:45:D2:A1:9F:2D:3C:69:8D:86:AD:48:CD:97:3C:97:13:B2:A1:AA

Certificate is to be certified until Sep 15 16:43:45 2015 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 9263543358417926000 (0x808eb79aa7edf770)
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=CA, O=Example.com, CN=Example.EDU
        Validity
            Not Before: Sep 15 16:43:45 2014 GMT
            Not After : Sep 15 16:43:45 2015 GMT
        Subject: C=US, ST=CA, L=San Francisco, O=Example, CN=localhost.localdomain
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c2:20:e8:2b:c3:5c:0d:90:cc:ad:81:3c:34:08:
                    fc:36:d0:ca:6a:0c:06:8c:46:4f:c3:4f:1f:ef:b7:
                    b1:50:42:a7:43:5d:88:73:2f:d2:3e:0a:4e:fe:50:
                    ae:0f:65:26:17:a4:24:cc:4f:1f:5b:72:81:61:fc:
                    ec:32:8e:0f:e5:c3:8e:89:da:87:a7:25:b1:b2:e1:
                    29:db:7e:17:c1:a0:d1:df:80:f1:54:94:2d:30:ef:
                    ab:9f:61:ac:70:24:29:41:7e:a1:31:9f:d4:41:4e:
                    db:23:2e:75:49:b4:c5:e5:92:b2:5f:d9:4b:bd:e3:
                    13:0f:e7:4b:56:a0:bf:70:9b:61:e7:e1:cc:2e:ea:
                    e6:a2:cc:68:ad:83:02:ef:ce:40:31:3f:6a:c4:a0:
                    01:d1:b2:e8:08:a8:a2:93:5f:35:76:56:80:47:3a:
                    4e:65:b3:86:3d:7c:b6:a0:50:66:ca:52:15:7f:f0:
                    4b:41:8e:4d:77:b0:45:ca:f7:ed:ae:c9:a8:26:4e:
                    3d:76:7a:70:f3:ca:ab:2f:89:4c:e3:bb:22:be:24:
                    93:c5:4f:19:c4:a5:3d:99:14:2b:8b:9d:97:57:51:
                    24:c5:d8:88:75:98:fb:d7:35:f7:2c:ab:41:a6:88:
                    40:14:46:c1:2b:88:f7:0c:68:85:97:a8:ad:bb:56:
                    4d:91
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                83:46:4D:C7:B6:3A:3F:62:3B:87:D5:C4:75:10:18:07:FC:45:5D:9A
            X509v3 Authority Key Identifier:
                keyid:10:45:D2:A1:9F:2D:3C:69:8D:86:AD:48:CD:97:3C:97:13:B2:A1:AA

    Signature Algorithm: sha1WithRSAEncryption
         aa:03:f3:dc:bc:20:88:ba:bc:3d:16:06:17:c5:25:a7:87:c8:
         18:96:a8:e0:33:9e:21:3f:ce:a0:54:c8:fd:13:c3:9c:3a:c7:
         1d:d7:0d:b3:8d:a9:64:9f:bf:32:50:59:26:2a:2d:9c:a6:fa:
         f7:67:87:ec:1e:f3:ac:0e:9f:b5:48:47:56:af:93:a5:b7:86:
         bf:9c:63:f7:ab:25:73:d1:8e:55:79:2a:7a:23:16:21:77:28:
         93:ad:a8:64:eb:bc:07:e7:a0:eb:14:69:61:b5:52:a9:2a:47:
         ef:84:9d:c6:5b:1d:c8:bd:8b:b4:61:64:14:88:91:45:68:4f:
         17:61:b1:33:f7:9c:3d:91:a9:31:33:54:ed:9b:7b:13:35:22:
         36:1b:52:23:fe:20:f4:3b:33:74:6f:71:fb:e5:ed:76:28:92:
         00:69:d6:12:03:44:a6:c8:02:ed:72:c1:7e:57:57:0c:58:a2:
         95:a3:db:1c:57:89:b6:92:64:64:4e:f2:2d:d2:8f:95:35:91:
         1b:4c:cd:89:87:44:01:68:2c:91:c9:af:79:69:0b:b1:a2:75:
         a3:15:2f:35:02:a3:26:08:5d:01:6f:6b:8e:d0:f3:36:f7:4f:
         c2:26:d2:a0:7f:ce:cc:36:b1:5a:2a:fb:fb:26:f6:93:c9:87:
         1b:59:fe:c4
-----BEGIN CERTIFICATE-----
MIIDqDCCApCgAwIBAgIJAICOt5qn7fdwMA0GCSqGSIb3DQEBBQUAMEYxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJDQTEUMBIGA1UECgwLRXhhbXBsZS5jb20xFDASBgNV
BAMMC0V4YW1wbGUuRURVMB4XDTE0MDkxNTE2NDM0NVoXDTE1MDkxNTE2NDM0NVow
ZDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMRYwFAYDVQQHDA1TYW4gRnJhbmNp
c2NvMRAwDgYDVQQKDAdFeGFtcGxlMR4wHAYDVQQDDBVsb2NhbGhvc3QubG9jYWxk
b21haW4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCIOgrw1wNkMyt
gTw0CPw20MpqDAaMRk/DTx/vt7FQQqdDXYhzL9I+Ck7+UK4PZSYXpCTMTx9bcoFh
/Owyjg/lw46J2oenJbGy4SnbfhfBoNHfgPFUlC0w76ufYaxwJClBfqExn9RBTtsj
LnVJtMXlkrJf2Uu94xMP50tWoL9wm2Hn4cwu6uaizGitgwLvzkAxP2rEoAHRsugI
qKKTXzV2VoBHOk5ls4Y9fLagUGbKUhV/8EtBjk13sEXK9+2uyagmTj12enDzyqsv
iUzjuyK+JJPFTxnEpT2ZFCuLnZdXUSTF2Ih1mPvXNfcsq0GmiEAURsEriPcMaIWX
qK27Vk2RAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5T
U0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBSDRk3Htjo/YjuH1cR1
EBgH/EVdmjAfBgNVHSMEGDAWgBQQRdKhny08aY2GrUjNlzyXE7KhqjANBgkqhkiG
9w0BAQUFAAOCAQEAqgPz3LwgiLq8PRYGF8Ulp4fIGJao4DOeIT/OoFTI/RPDnDrH
HdcNs42pZJ+/MlBZJiotnKb692eH7B7zrA6ftUhHVq+TpbeGv5xj96slc9GOVXkq
eiMWIXcok62oZOu8B+eg6xRpYbVSqSpH74SdxlsdyL2LtGFkFIiRRWhPF2GxM/ec
PZGpMTNU7Zt7EzUiNhtSI/4g9DszdG9x++XtdiiSAGnWEgNEpsgC7XLBfldXDFii
laPbHFeJtpJkZE7yLdKPlTWRG0zNiYdEAWgskcmveWkLsaJ1oxUvNQKjJghdAW9r
jtDzNvdPwibSoH/OzDaxWir7+yb2k8mHG1n+xA==
-----END CERTIFICATE-----
Signed certificate is in newcert.pem

1.7 Renaming the Certicates

    This step is optional. For naming convention we are renaming the certs.

     mv newcert.pem servercert.pem
     mv newreq.pem serverkey.pem

1.8 Copy the Certifcates from ssl to /etc/openldap/certs/

cp exampleca.pem /etc/openldap/certs/
cp server* /etc/openldap/certs/

1.9 Change the OwnerChip from root to ldap

chown ldap:ldap /etc/openldap/certs/exampleca.pem
chown ldap:ldap /etc/openldap/certs/server*

1.10 Include the Server Certificate and Server Key in the cn=Config Object

ldapmodify -D cn=config -H ldap://localhost.localdomain -W
Enter Password:

dn: cn=config
changetype: modify
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/servercert.pem

dn: cn=config
changetype: modify
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/serverkey.pem

1.11 Modifying the ldap.conf file in the /etc/openldap/

Add the following parameters into the ldap.conf file to enable the TLS.

   SSL ON
   TLS_CACERTDIR   /etc/openldap/certs
   TLS_REQCERT Allow

1.12 Restart the OpenLdap Server

/etc/init.d/slapd stop
/etc/init.d/slapd start

1.3 Testing the TLS

ldapsearch -H ldap://localhost.localdomain -D cn=Manager,dc=example,dc=edu -b dc=example,dc=edu -s base -W -ZZ

Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=edu> with scope baseObject
# filter: (objectclass=*)
# requesting: ALL
#

# example.edu
dn: dc=example,dc=edu
objectClass: dcObject
objectClass: organization
o: Example
dc: example

# search result
search: 3
result: 0 Success

# numResponses: 2
# numEntries: 1

In the above command i have used -ZZ parameter because to start the TLS Session and also it mandatory to start the TLS Session.

2. Configuring the SSL open Ldap

2.1 Modify the /etc/sysconfig/ldap file

Modify the following parameters in the /etc/sysconfig/ldap file to enable the ssl

SLAPD_LDAPS=yes

2.2 Restart the OpenLdap Server

Restart the Open Ldap Server and Take effect the changes.

/etc/init.d/slapd stop
/etc/init.d/slapd start

2.3 Testing the SSL Configuration

ldapsearch -H ldaps://localhost.localdomain -D cn=Manager,dc=example,dc=edu -b dc=example,dc=edu -s base -W

Enter LDAP Password:

# extended LDIF
#
# LDAPv3
# base <dc=example,dc=edu> with scope baseObject
# filter: (objectclass=*)
# requesting: ALL
#

# example.edu
dn: dc=example,dc=edu
objectClass: dcObject
objectClass: organization
o: Example
dc: example

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

3. References

http://www.openldap.org/faq/data/cache/185.html

ldap_add: Other (e.g., implementation specific) error (80) additional info: olcRefintAttribute : attribute type undefined

2014-09-09T15:16:00.000-07:00

Hi

Error:

I got the following error while adding the config object to the openldap.

ldapadd -D cn=Config -H ldap://localhost -W

dn: olcOverlay=refint,olcDatabase={2}bdb,cn=config
changetype: add
objectClass: olcConfig
objectClass: olcRefIntConfig
objectClass: olcOverlayConfig
objectClass: top
olcRefIntAttribute: memberof member manager owner seeAlos
olcOverlay: refint

ldap_add: Other (e.g., implementation specific) error (80)
additional info: olcRefintAttribute <seeAlos>: attribute type undefined

Cause:

seeAlos attribute not available in the schema and also syntax error.

Solution:

I have modified the attribute name from seeAlos to seeAlso and issue is resolved.

OIM Account Restore User Status From Deleted to Active

2014-07-29T10:46:00.001-07:00

Restoring the Deleted Account in OIM

When you delete the user from the Oracle Identity Manager System, the user will not been removed physically from the system and also it changes the status from Active to Deleted. It also revoke the resources from the target system for the deleted user.

I need to reactivate the deleted user from the Oracle Identity Manager as follows:

1. Login to the OIM data base user into the data base and update the user status from Deleted to Active.

2. Execute the following sql to update the user status

UPDATE USR SET USR_STATUS = 'Active' WHERE usr_login='login id'

replace login id with your login id.

3. Login to the OIM Admin Console and verify the user status is changed from Deleted to Active.

4. Re-Provision the users.

Building the OIM metadata for data base Incremental reconciliation icf connector

2014-07-24T11:01:00.000-07:00

Pre-Requisite

Build the OIM Metadata for Reconciliation

Incremental Target Reconciliation can be build in OIM using the SearchReconTask and also SyncReconTask. To build the incremental reconciliation, the following components needs to be modified and Developed:

Incremental Reconciliation for Database ICF SearchReconTask

1. Lookup.dbicf.Configuration

Add the Recon Date Format as a lookup code and decode should be valid java date format. For example

Recon Date Format

- yyyy/MM/dd HH:mm:ss

2. DataBaseIdentityFilter Class

Override the createGreaterThanExpression and createAndExpression methods to implement the Incremental Reconciliation.

@Override

protected String createGreaterThanExpression(

GreaterThanFilter filter, boolean not) {

String operation="createGreaterThanOrEqualExpression - ";

logger.ok(operation + " Started");

String query= null;

if(not)

{

return query;

}

Attribute attr= filter.getAttribute();

if(attr==null || attr.getValue()==null || (attr.getValue()!=null && attr.getValue().isEmpty()))

{

return query;

}

String name=filter.getName();

Object val=attr.getValue().get(0);

if(DataBaseIdentityUtil.isEmpty(val))

{

throw new ConnectorException("The filter value can not be empty");

}

String strValue=DataBaseIdentityUtil.getString(val);

if(name.equalsIgnoreCase("updateDate"))

{

query="T."+name + " > FUNC('TO_DATE','"+DataBaseIdentityUtil.convertDateToString(new Date(new Long(strValue).longValue()))+"','"+DataBaseIdentityConstants.DB_DATE_FORMAT+"')";

}

else

{

query="T."+name + " > '"+strValue+"'";

}

logger.ok(operation + " Final Filter "+query);

logger.ok(operation + " Ended ");

return query;

}

@Override

protected String createAndExpression(String leftExpression,

String rightExpression) {

return leftExpression + " AND "+ rightExpression;

}

3. Schedule Task Reconciliation Metadata

Add the Scheduled Task Name parameter name in the Schedule Task Reconciliation Metadata file. After Adding the parameter to the file as follows:

<?xml version = '1.0' encoding = 'UTF-8'?>

<xl-ddm-data version="2.0.1.0" user="XELSYSADM" database="jdbc:oracle:thin:@localhost:5524/estView.regress.rdbms.dev.us.oracle.com" exported-date="1307546406635" description="FF">

<task>

<name>DataBaseICFConnectorReconciliation</name>

<class>oracle.iam.connectors.icfcommon.recon.SearchReconTask</class>

<description>DataBaseICFConnectorReconciliation</description>

<string-param required="false" encrypted="false" helpText="Filter">Filter</string-param>

<string-param required="false" encrypted="false" helpText="Incremental Recon Date Attribute">Incremental Recon Date Attribute</string-param>

<string-param required="false" encrypted="false" helpText="IT Resource Name">IT Resource Name</string-param>

<string-param required="false" encrypted="false" helpText="Object Type">Object Type</string-param>

<string-param required="false" encrypted="false" helpText="Latest Token">Latest Token</string-param>

<string-param required="false" encrypted="false" helpText="Resource Object Name">Resource Object Name</string-param>

<string-param required="false" encrypted="false" helpText="Scheduled Task Name">Scheduled Task Name</string-param>

</parameters>

</task>

</scheduledTasks>

</completeXml>

</scheduledTask>

</xl-ddm-data>

The newly added parameter is highlighted as a bold font.

4. Import Schedule Task Reconciliation Metadata

Re-import the Schedule Task Reconciliation Metadata into the oim repository as follows:

Login to the OIM Console --> Advance --> Import Deployment Manager File --> Select the Scheduler Task File --> Add File --> Import. It will import the XMl File into the OIM Repository.

5. DataBaseIdentityConnector Class

Include the Incremental Recon Date Attribute parameter as a Long value in the ConnectorObject attributes in the executeQuery method. The sample code is given below.

public void executeQuery(ObjectClass objectClass, String filter,

ResultsHandler handler, OperationOptions operations) {

logger.ok("executeQuery Started");

logger.ok("executeQuery filter "+filter);

List<String> returnAttrs= new ArrayList<String>();

if(operations != null)

{

for (String attr: operations.getAttributesToGet())

{

logger.ok("executeQuery Attributes "+attr);

returnAttrs.add(attr);

}

List<UserProfile> profiles=userProfileDao.findByUsersCriteria(filter);

logger.ok("executeQuery Result "+profiles);

if(profiles != null && !profiles.isEmpty())

{

for (UserProfile userProfile : profiles)

{

ConnectorObject conobj=DataBaseIdentityUtil.convertMapToConnectorObject(userProfile);

if(returnAttrs.contains(DataBaseIdentityConstants.LAST_UPDATE))

{

conobj=DataBaseIdentityUtil.convertMapToConnectorObject(userProfile,DataBaseIdentityConstants.LAST_UPDATE);

}

else if(returnAttrs.contains(DataBaseIdentityConstants.CREATE_DATE))

{

conobj=DataBaseIdentityUtil.convertMapToConnectorObject(userProfile,DataBaseIdentityConstants.CREATE_DATE);

}

else

{

conobj=DataBaseIdentityUtil.convertMapToConnectorObject(userProfile);

}

logger.ok("executeQuery Attributes Objects "+conobj.getAttributes());

handler.handle(conobj);

logger.ok("executeQuery Attributes Objects After "+conobj.getAttributes());

}

logger.ok("executeQuery Ended");

}

DataBaseIdentityUtil class

public static ConnectorObject convertMapToConnectorObject(UserProfile userProfile,String updateFieldName)

{

ConnectorObjectBuilder userObjBuilder = new ConnectorObjectBuilder();

String status=userProfile.getStatus();

if(!isEmpty(status) && status.equalsIgnoreCase(DataBaseIdentityConstants.STATUS_ENABLED))

{

userObjBuilder.addAttribute(DataBaseIdentityConstants.STATUS,DataBaseIdentityConstants.STATUS_ENABLED);

}

else

{

userObjBuilder.addAttribute(DataBaseIdentityConstants.STATUS,DataBaseIdentityConstants.STATUS_DISABLED );

}

userObjBuilder.addAttribute(DataBaseIdentityConstants.FIRST_NAME,userProfile.getFirstName());

userObjBuilder.addAttribute(DataBaseIdentityConstants.LAST_NAME,userProfile.getLastName());

userObjBuilder.addAttribute(DataBaseIdentityConstants.MIDDLE_NAME,userProfile.getMiddleName());

userObjBuilder.addAttribute(DataBaseIdentityConstants.USER_LOGIN,userProfile.getUserLogin());

userObjBuilder.setUid(Long.toString(userProfile.getId()));

userObjBuilder.setName(Long.toString(userProfile.getId()));

if(updateFieldName != null)

{

if(updateFieldName.equalsIgnoreCase("updateDate"))

{

if(userProfile.getUpdateDate() != null)

{

userObjBuilder.addAttribute(updateFieldName,userProfile.getUpdateDate().getTime());

}

if (updateFieldName.equalsIgnoreCase("createDate"))

{

if(userProfile.getCreateDate() != null)

{

userObjBuilder.addAttribute(updateFieldName,userProfile.getCreateDate().getTime());

}

logger.ok("Final Object Data "+userObjBuilder.toString());

ConnectorObject conobj=userObjBuilder.build();

logger.ok("Final Object Data "+conobj.getAttributes());

return conobj;

}

6. Re-Deploy the ICF Jar

Build the Jar File

Execute the following command to build and generate the dbconnector-demo-1.0.jar.

gradle build

Deploy the Jar File

1. Login to the OIM Server.

2. Go to the DOMAIN_HOME/bin directory and execute source ./setDomainEnv.sh file. After executing the file , it will set the classpath.

3. Go to the OIM_HOME/server/bin directory an execute the

UploadJars.sh [-username <username>] [-password <password>] [-serverURL <t3://oimhostname:oimportno>] [-ctxFactory <weblogic.jndi.WLInitialContextFactory>] [- [-ICFBundle <Location of the ICF Bundle Jar>]

It will deploy the ICFBundle into the OIM repository.

7. Restart the OIM Server

./stopManagedWebLogic.sh oim_server1 t3://weblogicadminhost:port

./startManagedWebLogic.sh oim_server1 t3://weblogicadminhost:port

8. Re-Create the Schedule Task

Delete Schedule Task Name

Login to the OIM Admin Console --> Advanced --> System Management --> Search Schedule Jobs --> Enter Schedule task job name. After Searching the job name, Select the Job Name in the list and Click X Icon . It will delete the Schedule Task Name

Create the Schedule Task Name

Login to the OIM Admin Console --> Advanced --> System Management --> Actions --> Create --> Select Task Name from the Task List, Enter Schedule Job Name, Select No Predefined Schedule for testing, later we can configure periodic, Enter Incremental Recon Date Attribute, IT Resource Name, Object Type, Latest Token, Resource Object Name, and Scheduled Task Name. The Job Name and Scheduled Task Name should be same because it will update the Latest Token value based on the Scheduled Task Name value. The example configuration is given below.

If you specify the Filter and Incremental Recon Date Attribute in the configuration, It will search the user based on the filter and also incremental Recon Date Attribute. It will invoke the createGreathanExpression, createEqualExpression, and also createAndExpression.

Incremental SyncRecon Task

Incremental Reconciliation for Database ICF SynReconTask

2014-07-24T10:58:00.001-07:00

Incremental Reconciliation for Database ICF SynReconTask

1. Creating the Scheduler Task Metadata

<?xml version = '1.0' encoding = 'UTF-8'?>

<xl-ddm-data version="2.0.1.0" user="XELSYSADM" database="jdbc:oracle:thin:@localhost:5524/estView.regress.rdbms.dev.us.oracle.com" exported-date="1307546406635" description="FF">

<task>

<name>DataBaseICFConnectorSyncReconciliation</name>

<class>oracle.iam.connectors.icfcommon.recon.SyncReconTask</class>

<description>DataBaseICFConnectorSyncReconciliation</description>

<string-param required="false" encrypted="false" helpText="IT Resource Name">IT Resource Name</string-param>

<string-param required="false" encrypted="false" helpText="Object Type">Object Type</string-param>

<string-param required="false" encrypted="false" helpText="Sync Token">Sync Token</string-param>

<string-param required="false" encrypted="false" helpText="Resource Object Name">Resource Object Name</string-param>

<string-param required="false" encrypted="false" helpText="Scheduled Task Name">Scheduled Task Name</string-param>

</parameters>

</task>

</scheduledTasks>

</completeXml>

</scheduledTask>

</xl-ddm-data>

2. Import Schedule Task Reconciliation Metadata

Import the Schedule Task Reconciliation Metadata into the oim repository as follows:

Login to the OIM Console --> Advance --> Import Deployment Manager File --> Select the Scheduler Task File --> Add File --> Import. It will import the XMl File into the OIM Repository.

3. Restart the OIM Server

./stopManagedWebLogic.sh oim_server1 t3://weblogicadminhost:port

./startManagedWebLogic.sh oim_server1 t3://weblogicadminhost:port

4. Create the Schedule Task

Create the Schedule Task Name

Login to the OIM Admin Console --> Advanced --> System Management --> Actions --> Create --> Select Task Name from the Task List, Enter Schedule Job Name, Select No Predefined Schedule for testing, later we can configure periodic, Enter IT Resource Name, Object Type, Resource Object Name, and Scheduled Task Name. The Job Name and Scheduled Task Name should be same because it will update the Sync Token value based on the Scheduled Task Name value. The example configuration is given below.

The Sync Token value updated after running the Schedule Task.