Oracle® Fusion Middleware

Administrator's Guide for Oracle Identity Navigator

11g Release 1 (11.1.1)

E15481-01

July 2010

Oracle Fusion Middleware Administrator's Guide for Oracle Identity Navigator 11g Release 1 (11.1.1)

E15481-01

Copyright © 2010, Oracle and/or its affiliates. All rights reserved.

Primary Author:  Ellen Desmond

Contributors:  Margaret Chou, Quan Dinh, Fannie Ho, Sandy Lii, Daniel Shih

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.

Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Contents

List of Figures

Preface

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

1 Introduction to Oracle Identity Navigator

- 1.1 Relationships with Other components

- 1.2 Single Sign-on Integration

- 1.3 Reports

- 1.3.1 Oracle Business Intelligence Publisher

- 1.3.2 My Reports

- 1.4 News

2 Managing Oracle Identity Navigator

- 2.1 Logging In as Administrator

- 2.2 Performing Initial Configuration

- 2.3 Configuring Single Sign-On

- 2.4 Configuring web.xml

- 2.5 Configuring Oracle Business Intelligence Publisher

- 2.5.1 Before You Create a Connection to BI Publisher

- 2.5.1.1 Installing BI Publisher

- 2.5.1.2 Configuring BI Publisher Report Templates

- 2.5.1.3 Configuring BI Publisher for SSL (Optional)

- 2.5.2 Creating a Connection to BI Publisher

- 2.6 Configuring Role-Based Access

- 2.6.1 Configuring Users and Groups in the Default Authenticator

- 2.6.1.1 Enabling Predefined Component Administrator Groups

- 2.6.1.2 Adding a User to a Predefined Administrative Group in the Default Authenticator

- 2.6.1.3 Configuring an Existing Group to be a Component Administrator Group

- 2.6.2 Configuring Users and Groups for the OID Authentication Provider

- 2.6.2.1 Configuring the OID Authenticator

- 2.6.2.2 Enabling Predefined Component Administrator Groups in the OID Authenticator

- 2.6.2.3 Adding a User to a Predefined Administrative Group in the OID Authenticator

- 2.6.2.4 Configure Users and Groups in Oracle Internet Directory

- 2.7 Managing the Product Launcher

- 2.7.1 Adding a Component Link to the Product Launcher by Using Product Discovery

- 2.7.2 Adding a Link to the Product Launcher Without Product Discovery

- 2.7.3 Editing a Link

- 2.7.4 Removing a Link

- 2.7.5 Adding a Category

- 2.7.6 Editing a Category

- 2.7.7 Removing a Product Category

- 2.8 Configuring a Proxy to Access News Feeds

- 2.9 Migrating Oracle Identity Navigator from Test to Production

- 2.10 Troubleshooting

- 2.10.1 Cannot Access Oracle Identity Navigator in Browser

- 2.10.2 Report Problems

3 Using the Oracle Identity Navigator Dashboard

- 3.1 Launching Oracle Identity Navigator

- 3.2 Logging In to Oracle Identity Navigator

- 3.3 Launching a Component Administrative Console

- 3.4 Managing Your Reports

- 3.4.1 Adding a New Report

- 3.4.2 Editing a Report

- 3.4.3 Adding a Report Like an Existing Report

- 3.4.4 Removing a Report

- 3.4.5 Running a Report

- 3.5 Reading News and Announcements

- 3.6 Personalizing Oracle Identity Navigator

- 3.6.1 Rearranging the Page Layout

Index

List of Figures

- 1-1 Relationships Between Oracle Identity Navigator and Other Components

Preface

Oracle Identity Navigator is an administrative portal designed to act as a launch pad for Oracle Identity Management products. This book describes how to configure and use Oracle Identity Navigator.

Audience

This document is intended for Oracle Identity Navigator administrators and Oracle Identity Management component administrators.

Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible to all users, including users that are disabled. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at http://www.oracle.com/accessibility/.

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

Access to Oracle Support

Oracle customers have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/support/contact.html or visit http://www.oracle.com/accessibility/support.html if you are hearing impaired.

Related Documents

For more information, see the following documents in the Oracle Fusion Middleware 11g documentation set.

- Oracle Fusion Middleware Installation Guide for Oracle Business Intelligence Enterprise Edition

- Oracle Fusion Middleware Security Guide for Oracle Business Intelligence Enterprise Edition

- Oracle Fusion Middleware Authorization Policy Manager Administrator's Guide

- Oracle Access Manager Integration Guide

- Oracle Fusion Middleware Suite Integration Overview

- Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory

- Oracle Fusion Middleware Administrator's Guide for Oracle Virtual Directory

- Oracle Fusion Middleware Administrator's Guide for Oracle Adaptive Access Manager

- Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager

- Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

1 Introduction to Oracle Identity Navigator

Oracle Identity Navigator is an administrative portal designed to act as a launch pad for Oracle Identity Management components. It does not replace the individual component consoles. Rather, it allows you to access the Oracle Identity Management consoles from one site.

This chapter contains the following sections:

- Relationships with Other components

- Single Sign-on Integration

- Reports

- News

1.1 Relationships with Other components

Oracle Identity Navigator is a web-based application that you access through a browser. It is installed with other Oracle Identity Management components, and enables you access other components by product discovery.

You can use Oracle Identity Navigator to access consoles for Oracle Access Manager, Oracle Adaptive Access Manager, Oracle Identity Manager, Directory Services (ODSM), and other Oracle Identity Management services. You configure Oracle Identity Navigator to connect to these consoles either by specifying the URLs directly, or by employing the product discovery feature.

Like Oracle Enterprise Manager Fusion Middleware Control, Oracle Identity Navigator is a J2EE application deployed on a Oracle WebLogic Administration Server. It uses Oracle Metadata Service.

The Oracle Identity Navigator report feature relies on Oracle Business Intelligence Publisher and requires configuration to communicate with an Oracle Business Intelligence Publisher server.

You can access RSS feeds from oracle.com. You might need to configure a proxy to connect through your company's firewall.

Figure 1-1 shows these relationships:

Figure 1-1 Relationships Between Oracle Identity Navigator and Other Components

1.2 Single Sign-on Integration

Oracle Identity Navigator is integrated with 11g Oracle Platform Security Services for single sign-on support. Some of the component consoles that you can access with Oracle Identity Navigator are single sign-on enabled and can be configured to authenticate against the same authentication service in the Oracle Identity Navigator operation environment. Single sign-on enabled consoles include Oracle Access Manager, Oracle Identity Manager, Oracle Adaptive Access Manager, and Authorization Policy Manager. Double sign-on occurs for other components, such as Oracle Directory Services Manager and Oracle Enterprise Manager Fusion Middleware Control. See "Configuring Single Sign-On" for more information.

1.3 Reports

Oracle Identity Navigator supports a set of reports by default. The reports provide meaningful information for auditors to examine the security practice of the component in the deployment environment, as well as enabling system administrators to check the component health status.

1.3.1 Oracle Business Intelligence Publisher

All reports are generated using Oracle Business Intelligence Publisher. Oracle BI Publisher 10.1.3.4.1 must be installed separately. See "Configuring Oracle Business Intelligence Publisher" for more information on installing and configuring Oracle BI Publisher.

1.3.2 My Reports

My Reports is a portlet you use to view your favorite Oracle Identity Management Oracle Business Intelligence Publisher reports in the Navigator content. In addition, the My Reports portlet allows you to save the query to run a report and run the report again. As an administrative user, you have your own My Reports portlet on the Dashboard page of Oracle Identity Navigator. You can add report categories to My Reports and save different reports under different categories.

This portlet enables you to perform the following tasks:

- Show a list of Oracle Identity Management BI Publisher Reports in a portlet configuration page.

- Select a report and add it to the My Reports list from a portlet configuration page.

- View and run any report that the you have access to.

Reports are categorized by the component they belong to.

1.4 News

Oracle Identity Navigator supports the following three Oracle RSS feeds:

- OTN Discussion Forums for Identity Management

- Oracle New Downloads

- Oracle Security Alerts.

The RSS feeds can not be changed.

2 Managing Oracle Identity Navigator

This chapter describes the tasks performed by an enterprise administrator.

It contains the following topics:

- Logging In as Administrator

- Performing Initial Configuration

- Configuring Single Sign-On

- Configuring web.xml

- Configuring Oracle Business Intelligence Publisher

- Configuring Role-Based Access

- Managing the Product Launcher

- Configuring a Proxy to Access News Feeds

- Migrating Oracle Identity Navigator from Test to Production

- Troubleshooting

2.1 Logging In as Administrator

Log in as follows:

1. Start the WebLogic Administration Server.

2. Enter the following URL in a browser:

http://host:port/oinav

where port is the Administration Server port.

3. Supply the Administrator Username and Password. The Administrator account must exist in the identity store and have the Oracle Identity Navigator Administrator role.

4. Click Log In.

2.2 Performing Initial Configuration

As the Enterprise Administrator, perform the following tasks.

1. Configure component categories. See "Managing the Product Launcher". Then add components manually or by using discovery. See "Adding a Component Link to the Product Launcher by Using Product Discovery".

2. Configure BI Publisher. See "Configuring Oracle Business Intelligence Publisher".

3. If your RSS feed is outside a firewall, configure a proxy. See "Configuring a Proxy to Access News Feeds".

2.3 Configuring Single Sign-On

By default, the Oracle Access Manager agent provides single sign-on functionality for Oracle Identity Navigator and the following Identity Management consoles:

- Oracle Identity Manager

- Oracle Access Manager

- Oracle Adaptive Access Manager

- Oracle Authorization Policy Manager

The Oracle Access Manager agent can only protect consoles in a single domain. If your environment spans multiple domains, you can use Oracle Access Manager 11g WebGate for Oracle HTTP Server 11g. To configure Oracle Identity Navigator for WebGate-based single sign-on, see the chapter "Integrating with Oracle Identity Navigator" in Oracle Access Manager Integration Guide.

2.4 Configuring web.xml

The web.xml file provides configuration and deployment information for a Web application, such as Oracle Identity Navigator. The Oracle Identity Navigator web.xml is in oinav.ear. The optional <user-data-constraint> element in web.xml can be used to specify a transport guarantee that prevents content from being transmitted insecurely. Within the <user-data-constraint> tag, the <transport-guarantee> tag defines how communication should be handled. There are three possible values for that tag:

- NONE–the application does not require any transport guarantees.

- INTEGRAL–the application requires that data sent between the client and server be sent in such a way that it cannot be changed in transit.

- CONFIDENTIAL–the application requires that data be transmitted in a fashion that prevents other entities from observing the contents of the transmission.

Because Oracle Identity Navigator supports both SSL and non-SSL connections to component consoles, the web.xml attribute <user-data-constraint> is set to a default value of NONE. That is, Oracle Identity Navigator does not, by default, support a constraint for a transport guarantee. If you want such a guarantee, you can change the <transport-guarantee> tag within the <user-data-constraint> tag to either INTEGRAL or CONFIDENTIAL.

2.5 Configuring Oracle Business Intelligence Publisher

Oracle Identity Navigator has been integrated with Oracle BI Publisher. The interface supports stronger customization than BI Publisher alone. Using the Oracle Identity Navigator interface, each administrator can customize his or her Dashboard as needed. The report tree is less deep than with BI Publisher alone, so you can access reports with fewer clicks.

Note:
Only one Oracle Business Intelligence Publisher instance can be connected to an Oracle Identity Navigator instance.

2.5.1 Before You Create a Connection to BI Publisher

Before you attempt to create a connection between Oracle Identity Navigator and an instance of BI Publisher, you must install BI Publisher and configure report templates. Optionally, you can configure BI Publisher for SSL.

2.5.1.1 Installing BI Publisher

You must install the following components:

- BI Publisher 10.1.3.4.1

- Automated Release Update 12355706 (March 2010) or later

See Also:
Oracle Business Intelligence Publisher Installation Guide in the Oracle Business Intelligence Publisher Enterprise Version 10.1.3.4 Documentation Library for more information about installing Oracle BI Publisher.

2.5.1.2 Configuring BI Publisher Report Templates

Oracle Identity Management BI Publisher report templates are installed as zip files under Oracle home directories. For 11gR1 components, all the templates are in a single zip file. These are all Audit report templates.

For 11gR1+ components, the template zip files are in specific directories under the component Oracle homes. For example:

Component

Directory Under Oracle Home

Oracle Adaptive Access Manager

oaam/reports

Oracle Access Manager

oam/server/reports

Oracle Identity Manager

server/reports

Copy and unzip audit report zip files to the audit report folder under the BI Publisher report root folder. Copy and unzip other report zip files to the BI Publisher report root folder. Use the BI Publisher web interface to configure data sources with report databases.

See Also:

- Oracle Business Intelligence Publisher Administrator's and Developer's Guide in the Oracle Business Intelligence Publisher Enterprise Version 10.1.3.4 Documentation Library for more information about installing Oracle BI Publisher.

- The chapter "Using Audit Analysis and Reporting" in Oracle Fusion Middleware Security Guide.

2.5.1.3 Configuring BI Publisher for SSL (Optional)

If you plan to use an SSL connection between Oracle Identity Navigator and BI Publisher, you must configure BI Publisher for SSL, as described in "Configuring BI Publisher for Secure Socket Layer (SSL) Communication" in Oracle Business Intelligence Publisher Administrator's and Developer's Guide in the Oracle Business Intelligence Publisher Enterprise Version 10.1.3.4 Documentation Library.

In addition to configuring BI Publisher for SSL, you must provision a CA certificate to Oracle Identity Navigator so it can connect to BI Publisher through SSL. Proceed as follows:

1. Import the BI Publisher CA certificate into the Oracle WebLogic Server trust store, using the keytool command.

keytool -keystore trust_store -export -alias alias -file certificate_file

For example:

keytool -keystore truststore.jks -export -alias cacert -file cacert.cer

If you get a hostname verification error when you issue the keystore command, disable hostname verification by adding this flag to EXTRA_JAVA_PROPERTIES in the file setDomainEnv.sh:

-Dweblogic.security.SSL.ignoreHostnameVerification=true

Then issue the keystore command again.

2. Restart the Weblogic server.

See Also:
Oracle Fusion Middleware Securing Oracle WebLogic Server for additional information about configuring SSL on the Oracle WebLogic Server.

2.5.2 Creating a Connection to BI Publisher

To create a connection, proceed as follows:

1. Click the Administration tab.

2. Expand BI Publisher.

3. In the right pane, enter values for Host, Port, User, and Password.

4. If you have configured Oracle Identity Navigator and BI Publisher to use an SSL connection, select SSL.

5. Under Specify BI Publisher report components, click Create.

6. Select a component and supply a name and path.
To limit the connection entry to a subset of the reports available for the component, click the Finder icon and navigate to the desired path. You can have more than one path for a component. Using paths in this manner can reduce the amount of text associated with a report name on the Dashboard.

Repeat for other for other components you want to add.

7. Click Test to verify the connection information you have supplied. A dialog will verify that the connection has succeeded or tell you why it failed.

8. If the test succeeds, click Apply to finish the configuration. If the test fails, consult the appropriate administrator at your site.

9. To delete a component, select it and click Delete, then click Apply.

After BI Publisher has been configured, the My Reports section of the Dashboard page will contain the link Click here to create reports.

Note:
If you change the name or path of a component, the new name or path will apply to new reports. The reports that are already saved are not modified.

2.6 Configuring Role-Based Access

Oracle Identity Navigator supports two types of administrative role: the Oracle Identity Navigator administrator and the component administrators. Actions that an authenticated user can perform are based on the roles assigned.

- Oracle Identity Navigator Administrator–Configures Oracle Identity Navigator to make Oracle Identity Management component consoles accessible through Navigator, sets up news links, assign roles to administrative users, and performs other Navigator administration tasks. The Oracle Identity Navigator administrator can also perform all the tasks that the component administrators can perform.

- Component Administrator– Manages a specific Identity Management component. Each component administrator can customize his or her own Dashboard page. Component administrators cannot access the Administration page of Oracle Identity Navigator.There are predefined administration roles for individual Oracle Identity Management components. A user that has administration role for the Oracle Identity Manager component, for example, might not be able to access the Administration console for Oracle Access Manager.

Only the Oracle Identity Navigator administrator can see the Administration page. In some companies certain tasks might span the two roles.

By default, Oracle Identity Navigator maps the Oracle WebLogic Server Administrators group to its application administrator role, NavAdmin. You can create a different administration group name in the Oracle WebLogic Server console and map that group to the Oracle Identity Navigator administrator role using APM.

The roles are implemented as groups that you configure using the WebLogic Server Administration Console, under Security Realms, Users and Groups. You must enable the groups that define the component administrator roles. Then you can add users and other groups to the predefined groups.

If Single Sign-on has been configured, when you access a console from the Product Launcher while logged in as an administrator for that component, or as Oracle Identity Navigator administrator, you are automatically authenticated.

2.6.1 Configuring Users and Groups in the Default Authenticator

This section describes how to configure users and groups that Oracle WebLogic Server stores in its default authenticator.

2.6.1.1 Enabling Predefined Component Administrator Groups

To enable predefined component administrator groups:

1. Enter the Oracle WebLogic Server Administration console URL in a browser.

http://hostname:port_number/console

The port number is the number of the Administration Server. By default, the port number is 7001.

The Login Page is displayed.

2. Log in using the user name and password supplied during installation or another administrative user that you created.
Oracle WebLogic Server Administration Console is displayed:

3. Under Domain Structure, click Security Realms.

4. Select the appropriate realm

5. Click Users and Groups.

6. Click Group.

7. Click New.

8. Provide the predefined name, a description, and a password. Confirm the password.
The predefined group names are:

- OAAMadmin

- OAMadmin

- OIMadmin

- DSAdmin

9. Leave the Provider set to DefaultAuthenticator.

10. Click Save.
The new group appears on the Users and Groups Page.

2.6.1.2 Adding a User to a Predefined Administrative Group in the Default Authenticator

Next, add an administrative user to the group. If you need to create the user, proceed as follows:

1. From the Users and Groups Page, click User.

2. Click New.

3. Provide a name, description, password. Confirm the password.

4. Click Save.

Assign the user to a group or groups as follows:

1. From the User page, click the user's name.

2. Use the arrows to assign the desired group or groups to the user.

3. Click Save.

You can add an existing group to an administrative group. The procedure is the same, except that you click the group's name instead of a user's name.

2.6.1.3 Configuring an Existing Group to be a Component Administrator Group

If you already have a group defined, you can configure it to be a component administrator group in either of two ways.

- Add the group to a predefined component administrator group. This is the preferred method.

- Change the name of the predefined group using Authorization Policy Manager.

If you want to use names other than the predefined names for the groups that define component administrator roles, you can change the names by using the Authorization Policy Manager. See Oracle Fusion Middleware Authorization Policy Manager Administrator's Guide for more information.

2.6.2 Configuring Users and Groups for the OID Authentication Provider

If you are configure Oracle Internet Directory as authentication provider in addition to the Oracle WebLogic Server default provider, to provision users and groups, you must configure the OID authenticator in Oracle Weblogic Server, and then manager users and groups in Oracle Internet Directory.

2.6.2.1 Configuring the OID Authenticator

To enable the OID Authenticator:

1. Enter the Oracle WebLogic Server Administration console URL in a browser.

http://hostname:port_number/console

The port number is the number of the Administration Server. By default, the port number is 7001.

The Login Page is displayed.

2. Log in using the user name and password supplied during installation or another administrative user that you created.
Oracle WebLogic Server Administration Console is displayed:

3. Under Domain Structure, click Security Realms.

4. Select the appropriate realm

5. Click Providers.

6. Click OIDAuthenticator.

7. Click Provider Specific.

8. On the Provider Specific page, specify the configuration information for your Oracle Internet Directory instance. The meaning of each term is provided on the Provider Specific page.

9. Click Save.

2.6.2.2 Enabling Predefined Component Administrator Groups in the OID Authenticator

To enable predefined component administrator groups:

1. Enter the Oracle WebLogic Server Administration console URL in a browser.

http://hostname:port_number/console

The port number is the number of the Administration Server. By default, the port number is 7001.

The Login Page is displayed.

2. Log in using the user name and password supplied during installation or another administrative user that you created.
Oracle WebLogic Server Administration Console is displayed:

3. Under Domain Structure, click Security Realms.

4. Select the appropriate realm

5. Click Users and Groups.

6. Click Group.

7. Click New.

8. Provide the predefined name, a description, and a password. Confirm the password.
The predefined group names are:

- OAAMadmin

- OAMadmin

- OIMadmin

- DSAdmin

9. Select OIDAuthenticator in the Provider list.

10. Click Save.
The new group appears on the Users and Groups Page.

2.6.2.3 Adding a User to a Predefined Administrative Group in the OID Authenticator

Next, add an administrative user to the group. If you need to create the user, proceed as follows:

1. From the Users and Groups Page, click User.

2. Click New.

3. Provide a name, description, password. Confirm the password.

4. Select DefaultAuthenticator in the Provider list.

5. Click Save.

Assign the user to a group or groups as follows:

1. From the User page, click the user's name.

2. Use the arrows to assign the desired group or groups to the user.

3. Click Save.

You can add an existing group to an administrative group. The procedure is the same, except that you click the group's name instead of a user's name.

2.6.2.4 Configure Users and Groups in Oracle Internet Directory

Use Oracle Directory Services Manager to create the groups, then create users and add them as members of the groups. In addition to the component administrator groups, you must add the Administrators group for Oracle Identity Navigator administrators.

You must add the following groups under the group base DN:

- Administrators

- OAAMAdmin

- OAMAdmin

- OIMAdmin

- DSAdmin

Users or groups that are members of those Oracle Internet Directory groups then have appropriate access privileges to Oracle Identity Navigator.

Add users under the user base DN and add groups under the group base DN specified in the OID authenticator configuration.

For more information, see the chapters "Managing Directory Entries" and "Managing Dynamic and Static Groups" in Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.

2.7 Managing the Product Launcher

As Administrator, you can modify the list of categories and components that appear on the Product Launcher.

You can add components within a category using either of two methods

- Specify component console information.

- Specify host information and use product discovery to determine which component consoles are available.

2.7.1 Adding a Component Link to the Product Launcher by Using Product Discovery

From the Administration tab, you can use product discovery to discover all active J2EE components in the domain, including the Oracle WebLogic Server console and Oracle Enterprise Manager Fusion Middleware Control.

1. Click the Administration tab.

2. Under Product Registration, select Discover Product(s). The Domain Selection page of the product discovery wizard appears in the right pane.

3. Specify the Host, Port, User, and Password for the server from which you want to discover components. If you are using the SSL port, select SSL.
Click Next.

4. On the Available Products page, select the component consoles you want to add to Oracle Identity Navigator. For each console you select, specify a Display Name. If a category has not been selected automatically, select a category from the Category list.
Click Next.

5. On the Product Removed page, you can optionally select previously discovered components to remove.
Click Next.

6. Review the status of the links on the Confirmation page. If necessary, click Back and correct any errors. When the Confirmation page is correct, click Finish.

2.7.2 Adding a Link to the Product Launcher Without Product Discovery

Add a link as follows:

1. Click the Administration tab.

2. Under Product Registration, click the Create Product Link icon or select Create Product Link from the Actions list.

3. In the New Product Registration dialog, select the type of component you want to add.

4. Provide values for Category, Display Name, Type, Version, Host, Port, and URL.

5. Click OK to add the link or Cancel to abandon adding the link.

2.7.3 Editing a Link

Edit a link as follows:

1. Click the Administration tab.

2. Under Product Registration, click the product you want to edit.

3. On the Product Registration screen, make desired changes

4. Click Apply to apply the changes or Revert to remove the changes you have made.

2.7.4 Removing a Link

1. Click the Administration tab.

2. Under Product Registration, highlight the item you want to remove.

3. Click the Delete Product Link icon or select Delete Product Link from the Actions list.

4. In the Confirmation dialog, click OK to proceed or click Cancel to cancel the deletion.

You can also use the product discovery interface to delete several links at once.

2.7.5 Adding a Category

Add a component category as follows:

1. Click the Administration tab.

2. Under Product Registration, select Create Category from the Actions list.

3. In the right pane, enter the component category name.

4. Click Save.

5. Verify that the new category has been added to the left pane.

2.7.6 Editing a Category

Edit a category as follows:

1. Click the Administration tab.

2. Under Product Registration, select a product category. The product category information appears tin the right pane.

3. Make the desired changes.

4. Click Apply.

2.7.7 Removing a Product Category

Remove a category as follows:

1. Click the Administration tab.

2. Under Product Registration, select a product category. The product category information appears tin the right pane.

3. Select Delete Category from the Actions list.

4. Click OK in the confirmation dialog.

2.8 Configuring a Proxy to Access News Feeds

You might need to specify a proxy so that Oracle Identity Navigator can access Oracle news feeds from inside your firewall. You do this by adding lines to the setDomainEnv script, which is in the bin directory of your WebLogic domain. For example:

user_projects/domains/base_domain/bin/setDomainEnv.sh

The file name is setDomainEnv.sh on Linux and UNIX systems and setDomainEnv.cmd on Windows systems. The script sets the domain-wide environment variables for starting and running a WebLogic Server instance. It is invoked by the startWebLogic and stopWebLogic commands.

Minimally, you must add the following lines to EXTRA_JAVA_PROPERTIES in the setDomainEnv file.

-Dhttp.proxyHost=proxy_server_host
-Dhttp.proxyPort=proxy_server_port
-Dhttp.nonProxyHosts=non_proxy_hosts

In the following example:

- Oracle Identity Management components, including Oracle Identity Navigator are deployed in the Oracle WebLogic Server domain mycompany.com. The domain also contains the machines stajz18.mycompany.com and adc2170219.mycompany.com.

- A firewall exists between the domain in mycompany.com and the Oracle news feed server. You must route news feed requests from Oracle Identity Navigator through the proxy server to the Oracle news feed site outside the firewall.

- HTTP requests sent to servers stajz18.mycompany.com and adc2170219.mycompany.com need not be routed to the proxy server.

You would add the following lines to the setDomainEnv.sh file on the WebLogic Administration Server.

EXTRA_JAVA_PROPERTIES="-Dhttp.proxyHost=www-proxy.mycompany.com -Dhttp.proxyPort=80 -Dhttp.nonProxyHosts=stajz18.mycompany.com|adc2170219.mycompany.com ${EXTRA_JAVA_PROPERTIES}"
export EXTRA_JAVA_PROPERTIES

For completeness, you can also add the following additional lines:

-DftpProxyHost=ftp_host
-DftpProxyPort=FTP_proxy_server_port
-DsocksProxyHost=SOCKS_proxy_server_host
-DsocksProxyPort=SOCKS_proxy_server_port

You must restart WebLogic Administration Server for the changes to take effect.

2.9 Migrating Oracle Identity Navigator from Test to Production

This section describes how to migrate Oracle Identity Navigator from one domain to another.

1. Install and Configure Oracle Identity Navigator in a domain, such as dom1.

2. Run wlst.sh:

ORACLE_COMMON_HOME/common/bin/wlst.sh

3. Connect to the administration server in dom1 using wlst:

connect('weblogic','password','t3://admin_server_host:<admin_server_port')

For example:

connect('weblogic','password','t3://stads75:7001')

4. Export Oracle Identity Navigator metadata from the domain to an export directory:

exportMetadata(application='oinav',server='AdminServer',toLocation='export_directory')

where export_directory is the location you want to export the metadata to.

5. Install and configure Oracle Identity Navigator in a domain, such as dom2.

6. Run wlst.sh and connect to the administration server in dom2, using the same commands you used for dom1.

7. To migrate Oracle Identity Navigator metadata from dom1 to dom2, use the following import command:

importMetadata(application='oinav', server='AdminServer', fromLocation='export_directory')

8. Restart dom2.

Note:
This procedure does not migrate the Oracle BI Publisher user password or the SSL certificate information. These need to be configured again for the new instance.

See Also:
The chapter "Moving from a Test to a Production Environment" in Oracle Fusion Middleware Administrator's Guide for complete information about migrating Oracle Fusion Middleware components.

2.10 Troubleshooting

This section describes some problems that you could encounter while configuring or using Oracle Identity Navigator.

2.10.1 Cannot Access Oracle Identity Navigator in Browser

Problem

You enter the URL for Oracle Identity Navigator into a browser and attempt to access it. You receive an error message.

Solution

In a dual-stack, IPv4 and IPv6 environment, some URLs might be inaccessible from your browser. Consult your network administrator for more information.

2.10.2 Report Problems

Problem

You cannot create a connection to BI Publisher.

Solution

Make sure the Oracle WebLogic Server and BI Publisher server are running.

Problem

You cannot create or run a report

Solution

Remember that different login accounts might have different roles. If you log in as a user who does not have the Oracle Access Manager administrator role, for example, you will not be able to create Oracle Access Manager reports.

Make sure the Oracle WebLogic Server, BI Publisher server, and Oracle Database are running.

You can access BI Publisher reports from BI Publisher itself. Doing so can help you determine whether a configuration problem is due to Oracle Identity Navigator or BI Publisher.

Consult Oracle WebLogic Server logs.

Problem

You cannot view PDF reports with Adobe Reader in a browser.

Solution

Either upgrade to a newer version of Reader or configure Reader to run directly, not as an embedded function within the browser. See your Adobe Reader documentation for more information.

Problem

You cannot view a report in MHTML format.

Solution

Open the report in HTML format.

3 Using the Oracle Identity Navigator Dashboard

This chapter describes how to access and use Oracle Identity Navigator as a component administrator. For information about managing Oracle Identity Navigator as an Oracle Identity Navigator administrator, see Chapter 2, "Managing Oracle Identity Navigator."

It contains the following topics:

- Launching Oracle Identity Navigator

- Logging In to Oracle Identity Navigator

- Launching a Component Administrative Console

- Managing Your Reports

- Reading News and Announcements

- Personalizing Oracle Identity Navigator

3.1 Launching Oracle Identity Navigator

Oracle Identity Navigator is installed as part of the 11gR1Plus installation.To launch Oracle Identity Navigator, first start the WebLogic Administration Server, then enter the following URL in a browser:

http://host:port/oinav

where port is the Administration Server port.

Note:
In a dual-stack, IPv4 and IPv6 environment, some URLs might be inaccessible from your browser. Consult your network administrator for more information.

3.2 Logging In to Oracle Identity Navigator

Remember that different login accounts might have different roles. If you log in as a user who does not have the Oracle Access Manager administrator role, for example, you will not be able to create Oracle Access Manager reports, and you won't have single sign-on access to the Oracle Access Manager console.

To log in:

1. Supply the Username and Password for the administrator account you want to log in to.

2. Click Log In.

3.3 Launching a Component Administrative Console

1. Click the Dashboard tab

2. Under Identity Management Product Launcher, click the entry.

If a product has been integrated with single sign-on, and you are logged in as an administrator with the appropriate role, you can access its console without logging in again.

3.4 Managing Your Reports

Adding a report to the My Reports portlet enables you to designate a filter, view, and name for a report. Running the report results in real time retrieval of data.

3.4.1 Adding a New Report

1. Click the Dashboard tab.

2. If necessary, expand My Reports.

3. Under My Reports, click the Create icon.

4. In the Create Report dialog, select the desired report type in the left panel.

5. Expand the items in the tree to locate the desired report type.

6. Click the report type.

7. In the Report Details dialog, supply the required information in the fields.

Note:
In the Report Details dialog, Report Details, Report Name, Template, and Format are translated as specified by your browser locale setting. Other report details are localized based on the BI Publisher user interface language preference.

8. Click Create Report to create the report.

9. When you are finished adding reports, click Close.

10. The report icon for each report you have created is now available under My Reports.

3.4.2 Editing a Report

1. Click the Dashboard tab.

2. Under My Reports, highlight the report you want to edit.

3. Click the Edit icon.

4. In the Edit dialog, make desired changes.

5. Click Save to save the changes or Cancel to cancel the changes.

6. The report icon is now available under My Reports.

3.4.3 Adding a Report Like an Existing Report

1. Click the Dashboard tab.

2. Under My Reports, highlight the report you want to clone.

3. Click the Create Like icon.

4. In the Clone Report dialog, make the desired changes to the report name, template and output format.

5. Click Save to save the new report or Cancel to abandon adding the report.

6. The report icon is now available under My Reports.

3.4.4 Removing a Report

1. Click the Dashboard tab.

2. Under My Reports, highlight the report you want to delete.

3. Click the Remove icon.

4. In the Confirmation dialog, click OK to continue with the removal or Cancel to abandon the removal.

3.4.5 Running a Report

1. Click the Dashboard tab.

2. Under My Reports, navigate to the desired report

3. Click the icon for the report you want to generate.

4. The report runs, then appears in a separate browser tab or window.

Note:
If you encounter problems viewing PDF reports with Adobe/Acrobat Reader in a browser, either upgrade to a newer version of Reader or configure Reader to run directly, not as an embedded function within the browser. See your Adobe Reader documentation for more information.

3.5 Reading News and Announcements

1. Go to the News and Announcements portal on the Dashboard.

2. Click the desired topic, Oracle Security Alerts, Oracle New Downloads, or Identity Management Discussion Forum.

3.6 Personalizing Oracle Identity Navigator

Oracle Identity Navigator uses Oracle Composer to enable runtime customization of the Dashboard page. Changes are stored in Metadata Services and are available only to the user who made them.

You can personalize the Dashboard in either View or Edit mode.

View mode is the normal state when you are running Oracle Identity Navigator in a browser. In View mode, you can rearrange page components by dragging and dropping them or by using the Actions menus. You can change the page layout by clicking the Change Layout icon and selecting a layout option.

You enter Edit mode by clicking Customize in the global navigation links. In Edit mode, you can add page resources by clicking Add Content and selecting which resource to add. You can remove content from a page section by clicking the Remove icon. You can edit a page section by clicking the Edit icon. A Component Properties Dialog with multiple tabs enables you to customize the page section.

For more information about using Oracle Composer to customize pages, see the "Enabling Runtime Editing of Pages Using Oracle Composer" chapter in Oracle Fusion Middleware Developer's Guide for Oracle WebCenter.

Note:
In the Component Properties dialog, the display name and values of attributes shown on the Display Options tab are in English, even if your Locale is set to a non-English value.

3.6.1 Rearranging the Page Layout

You can change the layout of the Dashboard.

1. Click the Customize icon on the upper right.

2. To add content to a column, click Add Content at the top of the column.

3. Select the type of portal you want to add and click Add.

4. To change the layout, click Change Layout.

5. Select the layout you want. Click the triangle in the upper right to change the layout.

6. When you have finished customizing the page, click Close on the upper right.

7. To move a portal to a different position on the page, click the View Actions Menu icon next to the portal.

Index
A  B  C  D  I  L  M  N  O  P  R  S  T  W

A

administrator

logging in as, 2.1

B

BI Publisher

configuring, 2.5

connecting to, 2.5.2

unable to connect, 2.10.2

BI Publisher version required, 2.5.1.1

C

changing domains, 2.9

customizing the dashboard, 3.6

D

default authenticator, 2.6.1

I

initial configuration, 2.2

IPv6 environment, 2.10.1

L

launching, 3.1

launching a component administrative console, 3.3

logging in, 3.2

as administrator, 2.1

M

management

changing domains, 2.9

configuring BI Publisher, 2.5

connecting to BI Publisher, 2.5.2

initial configuration, 2.2

list of categories and products in product launcher, 2.7

migrating from test to production, 2.9

product discovery of consoles, 2.7.1

proxy configuration, 2.8

reports, 3.4

role-based access, 2.6

N

news and announcements

reading, 3.5

news feeds

configuring a proxy, 2.8

O

OID authenticator, 2.6.2

other products

relationships with, 1.1

P

page layout of dashboard

customizing, 3.6.1

personalizing the dashboard, 3.6 product discovery of consoles, 2.7.1 product launcher

list of product categories and products, 2.7

proxy

configuring to access news feeds, 2.8

R

relationships with other products, 1.1

reports

managing, 3.4

role-based access

configuring, 2.6

S

secure transport guarantee, 2.4

setDomainEnv file

configuring a proxy for news feeds, 2.8

single sign-on

configuring, 2.3

T

test to production

migrating, 2.9

troubleshooting, 2.10

W

WebGate-based single sign-on, 2.3

web.xml, 2.4

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2014, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.