Oracle® Fusion Middleware

Installing WebGates for Oracle Access Manager

11g Release 2 (11.1.2.2.0)

E49451-06

April 2016

Oracle Fusion Middleware Installing WebGates for Oracle Access Manager, 11g Release 2 (11.1.2.2.0)

E49451-06

Copyright © 1999, 2016,  Oracle and/or its affiliates. All rights reserved.

Primary Author: Champa Sampath

Contributing Authors: Kevin Kessler, Peter LaQuerre, Wortimla RS

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

Preface

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

1 Introduction

2 Installing and Configuring Oracle HTTP Server 11g WebGate for OAM

- 2.1 Installation Overview of OHS 11g WebGate

- 2.2 Prerequisites for Installing Oracle HTTP Server 11g WebGate

- 2.2.1 Oracle Fusion Middleware Certification

- 2.2.2 Installing JRE

- 2.2.3 Installing and Configuring Oracle HTTP Server 11g Web Server

- 2.2.4 Installing and Configuring Oracle Access Manager 11g

- 2.2.5 Prerequisites for 64-Bit Oracle HTTP Server 11g WebGates on Windows 2003 and Windows 2008 64-Bit Platforms

- 2.3 Installing Oracle HTTP Server 11g WebGate

- 2.3.1 Obtaining the Software

- 2.3.2 Starting the Oracle HTTP Server 11g WebGate Installer

- 2.3.3 Installation Flow and Procedure of Oracle HTTP Server 11g WebGate

- 2.4 Post-Installation Steps for Oracle HTTP Server 11g WebGate

- 2.5 Verifying the Installation and Configuration of Oracle HTTP Server 11g WebGate

- 2.6 Getting Started with a New Oracle HTTP Server 11g WebGate

- 2.6.1 Registering the New Oracle HTTP Server 11g WebGate

- 2.6.1.1 Setting Up the RREG Tool

- 2.6.1.2 Updating the OAM11gRequest.xml File

- 2.6.1.3 Using the In-Band Mode

- 2.6.1.4 Using the Out-Of-Band Mode

- 2.6.1.5 Files and Artifacts Generated by RREG

- 2.6.2 Copying Generated Files and Artifacts to the Oracle HTTP Server WebGate Instance Location

- 2.6.3 Restarting the Oracle HTTP Server Instance

- 2.7 Deinstalling Oracle HTTP Server 11g WebGate

- 2.7.1 Deinstallation Screens and Instructions

- 2.7.2 Manually Removing the Oracle Home Directory

- 2.8 Silent Installation for OHS 11g WebGate

3 Installing and Configuring IHS 11g WebGate for OAM

- 3.1 Installation Overview of IHS 11g WebGate

- 3.2 Prerequisites for Installing IHS 11g WebGate

- 3.2.1 Oracle Fusion Middleware Certification

- 3.2.2 Installing JRE

- 3.2.3 Installing and Configuring IHS

- 3.2.4 Installing and Configuring OAM 11g

- 3.2.5 Installing 32-bit IHS WebGate on a 64-bit Operating System

- 3.3 Installing IHS 11g WebGate

- 3.3.1 Obtaining the Software

- 3.3.2 Starting the IHS 11g WebGate Installer

- 3.3.3 Installation Flow and Procedure

- 3.4 Post-Installation Steps for IHS 11g WebGate

- 3.4.1 Deploying the IHS WebGate Instance

- 3.4.2 Setting the Environment Variables

- 3.4.3 Running the EditHttpConf Tool

- 3.5 Verifying the Installation and Configuration of IHS 11g WebGate

- 3.6 Getting Started with a New IHS 11g WebGate

- 3.6.1 Registering the New IHS 11g WebGate

- 3.6.1.1 Setting Up the RREG Tool

- 3.6.1.2 Updating the OAM11gRequest.xml File

- 3.6.1.3 Using the In-Band Mode

- 3.6.1.4 Using the Out-Of-Band Mode

- 3.6.1.5 Files and Artifacts Generated by RREG

- 3.6.2 Copying Generated Files and Artifacts to the IHS WebGate Instance Location

- 3.7 Starting the IHS Web Server and Accessing the IHS Resource

- 3.8 Deinstalling IHS 11g WebGate

- 3.8.1 Deinstallation Screens and Instructions

- 3.8.2 Manually Removing the Oracle Home Directory

- 3.9 Silent Installation for IHS 11g WebGate

4 Installing and Configuring Oracle Traffic Director 11g WebGate for OAM

- 4.1 Installation Overview of Oracle Traffic Director 11g WebGate

- 4.2 Prerequisites for Oracle Traffic Director 11g WebGate

- 4.2.1 Oracle Fusion Middleware Certification

- 4.2.2 Installing JRE

- 4.2.3 Installing and Configuring Oracle Traffic Director 11g

- 4.2.4 Installing and Configuring OAM 11g

- 4.3 Installing Oracle Traffic Director 11g WebGate

- 4.3.1 Obtaining the Software

- 4.3.2 Starting the Oracle Traffic Director 11g WebGate Installer

- 4.3.3 Installation Flow and Procedure of Oracle Traffic Director 11g WebGate

- 4.4 Post-Installation Steps for Oracle Traffic Director 11g WebGate

- 4.4.1 Deploying the Oracle Traffic Director WebGate Instance

- 4.4.2 Running the EditObjConf Tool

- 4.5 Verifying the Installation and Configuration of Oracle Traffic Director 11g WebGate

- 4.6 Getting Started with a New Oracle Traffic Director 11g WebGate

- 4.6.1 Registering the New WebGate Agent for Oracle Traffic Director 11g WebGate

- 4.6.1.1 Setting Up the RREG Tool

- 4.6.1.2 Updating the OAM11gRequest.xml File

- 4.6.1.3 Using the In-Band Mode

- 4.6.1.4 Using the Out-Of-Band Mode

- 4.6.1.5 Files and Artifacts Generated by RREG

- 4.6.2 Copying Generated Files and Artifacts to the WebGate Instance Location

- 4.6.3 Restarting the Oracle Traffic Director Instance

- 4.7 Deinstalling Oracle Traffic Director 11g WebGate

- 4.7.1 Deinstallation Screens and Instructions

- 4.7.2 Manually Removing the Oracle Home Directory

- 4.8 Silent Installation for Oracle Traffic Director 11g WebGate

5 Installing and Configuring Apache 11g WebGate for OAM

- 5.1 Installation Overview of Apache 11g WebGate

- 5.2 Prerequisites for Apache 11g WebGate

- 5.2.1 Oracle Fusion Middleware Certification

- 5.2.2 Installing JRE

- 5.2.3 Installing and Configuring Apache 2.2 and 2.4

- 5.2.4 Installing and Configuring OAM 11g

- 5.3 Installing Apache 11g WebGate

- 5.3.1 Obtaining the Software

- 5.3.2 Starting the Apache 11g WebGate Installer

- 5.3.3 Installation Flow and Procedure of Apache 11g WebGate

- 5.4 Post-Installation Steps for Apache 11g WebGate

- 5.4.1 Deploying the Apache WebGate Instance

- 5.4.2 Setting the Environment Variable

- 5.4.3 Running the EditHttpConf Tool

- 5.5 Verifying the Installation and Configuration of Apache 11g WebGate

- 5.6 Getting Started with a New Apache 11g WebGate

- 5.6.1 Registering the New WebGate Agent for Apache 11g WebGate

- 5.6.1.1 Setting Up the RREG Tool

- 5.6.1.2 Updating the OAM11gRequest.xml File

- 5.6.1.3 Using the In-Band Mode

- 5.6.1.4 Using the Out-Of-Band Mode

- 5.6.1.5 Files and Artifacts Generated by RREG

- 5.6.2 Copying Generated Files and Artifacts to the WebGate Instance Location

- 5.6.3 Restarting the Apache Instance

- 5.7 Deinstalling Apache 11g WebGate

- 5.7.1 Deinstallation Screens and Instructions

- 5.7.2 Manually Removing the Oracle Home Directory

- 5.8 Silent Installation for Apache 11g WebGate

6 Installing and Configuring Lotus Domino 11g WebGate for OAM

- 6.1 Installation Overview of Lotus Domino 11g WebGate

- 6.2 Prerequisites for Installing Lotus Domino 11g WebGate

- 6.2.1 Oracle Fusion Middleware Certification

- 6.2.2 Installing JRE

- 6.2.3 Installing and Configuring Lotus Domino 11g Web Server

- 6.2.4 Installing and Configuring Oracle Access Manager 11g

- 6.3 Installing Lotus Domino 11g WebGate

- 6.3.1 Obtaining the Software

- 6.3.2 Starting the Lotus Domino 11g WebGate Installer

- 6.3.3 Installation Flow and Procedure of Lotus Domino 11g WebGate

- 6.4 Post-Installation Steps for Lotus Domino 11g WebGate

- 6.4.1 Setting the Environment Variable

- 6.5 Verifying the Installation and Configuration of Lotus Domino 11g WebGate

- 6.6 Getting Started with a New Lotus Domino 11g WebGate

- 6.6.1 Registering the New Lotus Domino 11g WebGate

- 6.6.1.1 Setting Up the RREG Tool

- 6.6.1.2 Updating the OAM11gRequest.xml File

- 6.6.1.3 Using the In-Band Mode

- 6.6.1.4 Using the Out-Of-Band Mode

- 6.6.1.5 Files and Artifacts Generated by RREG

- 6.6.2 Copying Generated Files and Artifacts to the Oracle HTTP Server WebGate Instance Location

- 6.7 Setting the DCC Directory Mapping

- 6.8 Deinstalling Lotus Domino 11g WebGate

- 6.8.1 Deinstallation Screens and Instructions

- 6.8.2 Manually Removing the Oracle Home Directory

- 6.9 Silent Installation for Lotus Domino 11g WebGate

7 Moving a WebGate Agent From a Test to a Production Environment

- 7.1 Overview of Moving a WebGate Agent From a Test to a Production Environment

- 7.2 Prerequisites for Moving a WebGate Agent From a Test to a Production Environment

- 7.2.1 Configuring the Web Server

- 7.2.2 Copying the Oracle Access Management (OAM) Server

- 7.2.3 Verifying the Test to Production Tools

- 7.2.4 Verifying the JDK Version

- 7.3 Replicating the WebGate Binary and Configuration From Test to Production

- 7.3.1 Replicating the WebGate Binary Files

- 7.3.2 Replicating the WebGate Configuration

Preface

This Preface provides supporting information for Oracle Fusion Middleware Installing WebGates for Oracle Access Manager and includes the following topics:

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

Audience

The Oracle Fusion Middleware Installing WebGates for Oracle Access Manager guide is intended for administrators that are responsible for installing 11g WebGates for Oracle Access Manager.This document assumes you have experience installing enterprise components. Basic knowledge about Oracle Access Manager, WebGates, and Oracle Application Server is recommended.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Related Documents

For more information, see the following documents in the Oracle Identity and Access Management 11g Release 2 (11.1.2) documentation library:

- Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management

- Oracle Fusion Middleware Administrator's Guide for Oracle Access Management

- Oracle Fusion Middleware Installation Planning Guide

- Oracle Fusion Middleware Release Notes

You can also access Oracle documentation online from the Oracle Technology Network (OTN) Web site at the following URL:

http://docs.oracle.com/

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

1 Introduction

A WebGate is a web-server plug-in for Oracle Access Manager (OAM) that intercepts HTTP requests and forwards them to the Access Server for authentication and authorization.

For information about the typical workflow in an environment with a WebGate and Oracle Access Manager, see "About SSO Log In Processing with OAM Agents" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.

This document contains the following chapters:

- Installing and Configuring Oracle HTTP Server 11g WebGate for OAM

- Installing and Configuring IHS 11g WebGate for OAM

- Installing and Configuring Oracle Traffic Director 11g WebGate for OAM

- Installing and Configuring Apache 11g WebGate for OAM

- Moving a WebGate Agent From a Test to a Production Environment

2 Installing and Configuring Oracle HTTP Server 11g WebGate for OAM

This chapter describes how to install and configure Oracle HTTP Server 11g Release 2 WebGate for Oracle Access Manager. For an introduction to WebGates and an overview of installing WebGates, see Chapter 1.

This chapter contains the following sections:

- Installation Overview of OHS 11g WebGate

- Prerequisites for Installing Oracle HTTP Server 11g WebGate

- Installing Oracle HTTP Server 11g WebGate

- Post-Installation Steps for Oracle HTTP Server 11g WebGate

- Verifying the Installation and Configuration of Oracle HTTP Server 11g WebGate

- Getting Started with a New Oracle HTTP Server 11g WebGate

- Deinstalling Oracle HTTP Server 11g WebGate

- Silent Installation for OHS 11g WebGate

Note:
If you want to integrate Oracle HTTP Server 11g Release 2 WebGate for Oracle Access Manager with other Oracle Identity and Access Management components, follow the instructions in either of the guides listed below:

- Oracle Fusion Middleware Integration Guide for Oracle Identity Management Suite

- Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management

2.1 Installation Overview of OHS 11g WebGate

Installing OHS 11g WebGate for Oracle Access Manager involves the following steps:

1. Installing the OHS web server

2. Installing OHS 11g WebGate for Oracle Access Manager

3. Completing the post-installation configuration steps

4. Verifying the OHS 11g WebGate installation

5. Registering the new WebGate agent

2.2 Prerequisites for Installing Oracle HTTP Server 11g WebGate

This section contains the following topics:

- Oracle Fusion Middleware Certification

- Installing JRE

- Installing and Configuring Oracle HTTP Server 11g Web Server

- Installing and Configuring Oracle Access Manager 11g

- Prerequisites for 64-Bit Oracle HTTP Server 11g WebGates on Windows 2003 and Windows 2008 64-Bit Platforms

2.2.1 Oracle Fusion Middleware Certification

The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 11g Release 2 (11.1.2.1.0).

You can access the Oracle Fusion Middleware Supported System Configurations document by searching the Oracle Technology Network (OTN) web site:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

2.2.2 Installing JRE

You must have Java runtime environment (JRE) 1.7 or higher installed.

2.2.3 Installing and Configuring Oracle HTTP Server 11g Web Server

You can download the Installer from the Oracle Technology Network (OTN):

http://www.oracle.com/technology/software/products/middleware/htdocs/fmw_11_download.html

Alternatively, you can download the latest Oracle Fusion Middleware 11g software from the following website:

http://edelivery.oracle.com/

For information about installing and configuring Oracle HTTP Server 11g (11.1.1.7.0), see Oracle Fusion Middleware Installation Guide for Oracle Web Tier.

Note:
After you install and configure Oracle HTTP Server, a working instance of Oracle HTTP Server is configured in an Instance home.

2.2.4 Installing and Configuring Oracle Access Manager 11g

For information about installing Oracle Access Manager (OAM), see "Installing and Configuring Oracle Identity and Access Management (11.1.2.2.0)" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see "Configuring Oracle Access Manager" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

In addition, see "Securing Communication" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager for information about configuring Oracle Access Manager in Open, Simple, or Cert mode.

2.2.5 Prerequisites for 64-Bit Oracle HTTP Server 11g WebGates on Windows 2003 and Windows 2008 64-Bit Platforms

If you are using Windows 2003 or Windows 2008 64-bit operating systems, then you must install Microsoft Visual C++ 2005 libraries on the machine hosting the Oracle HTTP Server 11g WebGate for Oracle Access Manager.

These libraries are included in the Microsoft Visual C++ 2005 SP1 Redistributable Package (x64), which can be downloaded from the following website:

http://www.microsoft.com/en-in/download/details.aspx?id=18471

In addition, install the Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package MFC Security Update, which can be downloaded from the following website:

http://www.microsoft.com/en-in/download/details.aspx?id=26347

2.3 Installing Oracle HTTP Server 11g WebGate

This section discusses the following topics:

- Obtaining the Software

- Starting the Oracle HTTP Server 11g WebGate Installer

- Installation Flow and Procedure of Oracle HTTP Server 11g WebGate

2.3.1 Obtaining the Software

For information about obtaining the OHS 11.1.2.2.0 WebGate software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.

2.3.2 Starting the Oracle HTTP Server 11g WebGate Installer

The installer for Oracle HTTP Server 11g WebGate for Oracle Access Manager is included in the WebGate.zip file.

To start the installation wizard, perform the following steps:

- On UNIX

1. Extract the contents of the WebGate.zip file to a directory. By default, this directory is named WebGate.

2. Go to the Disk1 directory under the WebGate folder.

3. Run the following command:
full_path_to_the_runInstaller_directory ./runInstaller -jreLoc WebTier_Home/jdk

- On Windows

1. Extract the contents of the WebGate.zip file to a directory. By default, this directory is named WebGate.

2. Go to the Disk1 directory under the WebGate folder.

3. Run the following command:
full_path_to_the_setup.exe_directory setup.exe -jreLoc WebTier_Home\jdk

Note:
When you install Oracle HTTP Server, the jdk directory is created under the WebTier_Home directory. You must enter the absolute path of the JRE folder located in this JDK when launching the installer. For example, on Windows, if the JDK is located in D:\oracle\Oracle_WT1\jdk, then launch the installer from the command prompt as follows:
D:\setup.exe -jreLoc D:\oracle\Oracle_WT1\jdk

After the Installer starts, the Welcome screen is displayed. Proceed with the installation by referring to Section 2.3.3.

2.3.3 Installation Flow and Procedure of Oracle HTTP Server 11g WebGate

To install Oracle HTTP Server 11g WebGate for Oracle Access Manager, follow the instructions in Table 2-1.

If you need additional help with any of the installation screens, then click Help to access the online help.

Table 2-1 Installation Flow

No.

Screen

Description and Action Required

1.

Welcome Screen

Click Next to continue.

2.

Prerequisite Checks Screen

Click Next to continue.

3.

Specify Installation Location Screen

Specify the Middleware home and Oracle home locations.

Note that the Middleware home should contain an Oracle home for Oracle Web Tier. Oracle WebLogic Server is not a prerequisite for installing Oracle HTTP Server WebGate. However, Oracle HTTP Server, which is a component of Oracle Web Tier, requires the directory structure for the Middleware home.

For more information about these directories, see "Understanding Oracle Fusion Middleware Concepts and Directory Structure" in Oracle Fusion Middleware Installation Planning Guide for Oracle Identity and Access Management.

Click Next to continue.

4.

Installation Summary Screen

Verify the information on this screen.

Click Install to begin the installation.

5.

Installation Progress Screen

If you are installing on a UNIX system, then you may be asked to run the ORACLE_HOME/oracleRoot.sh script to set up the proper file and directory permissions.

Click Next to continue.

6.

Installation Complete Screen

Click Finish to dismiss the installer.

2.4 Post-Installation Steps for Oracle HTTP Server 11g WebGate

You must complete the following steps after installing Oracle HTTP Server 11g WebGate for Oracle Access Manager:

- On UNIX

1. Go to the WebGate_Home/webgate/ohs/tools/deployWebGate directory by running the following command:
cd WebGate_Home/webgate/ohs/tools/deployWebGate

2. Run the following command to copy the required bits of agent from the WebGate_Home directory to the WebGate_Instance location:
./deployWebGateInstance.sh -w WebGate_Instance_Directory -oh WebGate_Oracle_Home

In this command:

- WebGate_Oracle_Home is the directory in which you have installed Oracle HTTP Server WebGate and created it as the Oracle home for WebGate.
Example:

MW_HOME/Oracle_OAMWebGate1

- WebGate_Instance_Directory is the location of WebGate Instance home, which is same as the Instance home of Oracle HTTP Server.
Example:

MW_HOME/Oracle_WT1/instances/instance1/config/OHS/ohs1

Note:
An Instance home for Oracle HTTP Server is created after you configure Oracle HTTP Server. This configuration is performed after installing Oracle HTTP Server 11.1.1.7.0 or patching to Oracle HTTP Server 11.1.1.7.0.

3. Run the following command to ensure that the LD_LIBRARY_PATH variable contains Oracle_Home_for_Oracle_HTTP_Server/lib:
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:Oracle_Home_for_Oracle_HTTP_Server/lib

4. From your present working directory, move up one directory level:
WebGate_Home/webgate/ohs/tools/setup/InstallTools

5. On the command line, run the following command to copy the apache_WebGate.template from the WebGate_Home directory to the WebGate Instance location (re-named to WebGate.conf) and update the httpd.conf file to add one line to include the name of WebGate.conf:
./EditHttpConf -w WebGate_Instance_Directory [-oh WebGate_Oracle_Home] [-o output_file]

Note:
The -oh WebGate_Oracle_Home and -o output_file parameters are optional.

In this command:

- WebGate_Oracle_Home is the directory in which you have installed Oracle HTTP Server WebGate for Oracle Access Manager and created it as the Oracle home for WebGate.
Example:

MW_HOME/Oracle_OAMWebGate1

- WebGate_Instance_Directory is the location of the WebGate Instance home, which is also the Instance home of Oracle HTTP Server.
Example:

MW_HOME/Oracle_WT1/instances/instance1/config/OHS/ohs1

- output_file is the name of the temporary output file used by the tool.
Example:

Edithttpconf.log

- On Windows

1. Move to the following directory under your Oracle home for WebGate:
WebGate_Home\webgate\ohs\tools\deployWebGate

2. Run the following command to copy the required bits of agent from the WebGate_Home directory to the WebGate_Instance location:
deployWebGateInstance.bat -w WebGate_Instance_Directory -oh WebGate_Oracle_Home

In this command:

- WebGate_Oracle_Home is the directory where you have installed Oracle HTTP Server WebGate for Oracle Access Manager and created as the Oracle home for WebGate.
Example:

MW_HOME\Oracle_OAMWebGate1

- WebGate_Instance_Directory is the location of WebGate Instance home, which is also the Instance home of Oracle HTTP Server.
Example:

MW_HOME\Oracle_WT1\instances\instance1\config\OHS\ohs1

Note:
An Instance home for Oracle HTTP Server is created after you configure Oracle HTTP Server. This configuration is performed after installing Oracle HTTP Server 11.1.1.7.0 or patching to Oracle HTTP Server 11.1.1.7.0.

3. Run the following command to ensure that the LD_LIBRARY_PATH variable contains Oracle_Home_for_Oracle_HTTP_Server\lib:
Set the WebGate_Installation_Directory\webgate\ohs\lib location and the Oracle_Home_for_Oracle_HTTP_Server\bin location in the PATH environment variable. Add a semicolon (;) followed by this path at the end of the entry for the PATH environment variable.

4. From your present working directory, move up one directory level:
WebGate_Home\webgate\ohs\tools\EditHttpConf

5. Run the following command to copy the apache_WebGate.template from the WebGate_Home directory to the WebGate Instance location (renamed to WebGate.conf) and update the httpd.conf file to add one line to include the name of WebGate.conf:
EditHttpConf.exe -w WebGate_Instance_Directory [-oh WebGate_Oracle_Home] [-o output_file]

Note:
The -oh WebGate_Oracle_Home and -o output_file parameters are optional.

In this command:

- WebGate_Oracle_Home is the directory in which you have installed Oracle HTTP Server WebGate for Oracle Access Manager and created as the Oracle home for WebGate.
Example:

MW_HOME\Oracle_OAMWebGate1

- WebGate_Instance_Directory is the location of WebGate Instance home, which is also the Instance home of Oracle HTTP Server.
Example:

MW_HOME\Oracle_WT1\instances\instance1\config\OHS\ohs1

- output_file is the name of the temporary output file used by the tool.
Example:

Edithttpconf.log

2.5 Verifying the Installation and Configuration of Oracle HTTP Server 11g WebGate

After installing Oracle HTTP Server 11g WebGate for Oracle Access Manager and completing the post-installation steps, you can examine the installDATE-TIME_STAMP.out log file to verify the installation. The default location of the log are as follows:

- On UNIX
WebGate_Home/oraInst.loc

- On Windows
C:\Program Files\Oracle\Inventory\logs

2.6 Getting Started with a New Oracle HTTP Server 11g WebGate

Before you can use the new Oracle HTTP Server 11g WebGate agent for Oracle Access Manager, you must complete the following tasks:

1. Registering the New Oracle HTTP Server 11g WebGate

2. Copying Generated Files and Artifacts to the Oracle HTTP Server WebGate Instance Location

3. Restarting the Oracle HTTP Server Instance

2.6.1 Registering the New Oracle HTTP Server 11g WebGate

You can register the new WebGate agent with Oracle Access Manager by using the Oracle Access Manager Administration console. For more information, see "Registering an OAM Agent Using the Console" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Management.

Alternatively, you can use the RREG command-line tool to register a new WebGate agent. You can use the tool to run in two modes: In-Band and Out-Of-Band.

This section contains the following topics:

- Setting Up the RREG Tool

- Updating the OAM11gRequest.xml File

- Using the In-Band Mode

- Using the Out-Of-Band Mode

- Files and Artifacts Generated by RREG

2.6.1.1 Setting Up the RREG Tool

To set up the RREG tool, complete the following steps:

- On UNIX

1. After installing and configuring Oracle Access Manager, go to the following directory:
Oracle_IDM2/oam/server/rreg/client

2. Untar the RREG.tar.gz file.
Example:

gunzip RREG.tar.gz

tar -xvf RREG.tar

The tool for registering the agent is located at:

RREG_Home/bin/oamreg.sh

Note:
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg.

- On Windows

1. After installing and configuring Oracle Access Manager, go to the following location:
Oracle_IDM2\oam\server\rreg\client

2. Extract the contents of the RREG.tar.zip file to a destination of your choice.

The tool for registering the agent is located at:

RREG_Home\bin\oamreg.bat

Note:
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg.

Set the following environment variables in the oamreg.sh script. on UNIX, and oamreg.bat script, on Windows:

- OAM_REG_HOME
Set this variable to the absolute path to the directory in which you extracted the contents of RREG.tar/rreg.

- JDK_HOME
Set this variable to the absolute path to the directory in which Java or JDK is installed on your machine.

2.6.1.2 Updating the OAM11gRequest.xml File

You must update the agent parameters, such as agentName, in the OAM11GRequest.xml file in the RREG_Home\input directory on Windows. On UNIX, the file is in the RREG_Home/input directory.

Note:
The OAM11GRequest.xml file or the short version OAM11GRequest_short.xml is used as a template. You can copy this template file and use it.

Modify the following required parameters in the OAM11GRequest.xml file or in the OAM11GRequest_short.xml file:

- serverAddress
Specify the host and the port of the OAM Administration Server.

- agentName
Specify any custom name for the agent.

- agentBaseUrl
Specify the host and the port of the machine on which Oracle HTTP Server 11g WebGate is installed.

- preferredHost
Specify the host and the port of the machine on which Oracle HTTP Server 11g WebGate is installed.

- security
Specify the security mode, such as open, based on the WebGate installed.

- primaryServerList
Specify the host and the port of Managed Server for the Oracle Access Manager proxy, under a Server container element.

After modifying the file, save and close it.

2.6.1.3 Using the In-Band Mode

If you run the RREG tool once after updating the WebGate parameters in the OAM11GRequest.xml file, then the files and artifacts required by WebGate are generated in the following directory:

On UNIX:

RREG_Home/output/agent_name

On Windows:

RREG_Home\output\agent_name

Note:
You can run RREG either on a client machine or on the server. If you are running it on the server, then you must manually copy the artifacts back to the client.

Complete the following steps:

1. Open the OAM11GRequest.xml file, which is in RREG_Home/input/ on UNIX and RREG_Home\input on Windows. RREG_Home is the directory on which you extracted the contents of RREG.tar.gz/rreg.
Edit the XML file and specify parameters for the new Oracle HTTP Server WebGate for Oracle Access Manager.

2. Run the following command:
On UNIX:

./RREG_Home/bin/oamreg.sh inband input/OAM11GRequest.xml

On Windows:

RREG_Home\bin\oamreg.bat inband input\OAM11GRequest.xml

2.6.1.4 Using the Out-Of-Band Mode

If you are an end user with no access to the server, then you can email your updated OAM11GRequest.xml file to the system administrator, who can run RREG in the out-of-band mode. You can collect the generated AgentID_Response.xml file from the system administrator and run RREG on this file to obtain the WebGate files and artifacts you require.

After you receive the generated AgentID_Response.xml file from the administrator, you must manually copy the file to the input directory on your machine.

- On UNIX
Complete the following steps:

1. If you are an end user with no access to the server, open the OAM11GRequest.xml file, which is in RREG_Home/input/.
RREG_Home is the directory on which you extracted the contents of RREG.tar.gz/rreg. Edit this XML file and specify parameters for the new Oracle HTTP Server WebGate for Oracle Access Manager. Send the updated file to your system administrator.

2. If you are an administrator, copy the updated OAM11GRequest.xml file, which is in RREG_Home/input/ directory.
This is the file that you received from the end user. Go to your (administrator's) RREG_Home directory and run the following command:

./RREG_Home/bin/oamreg.sh outofband input/OAM11GRequest.xml

An Agent_ID_Response.xml file is generated in the output directory on the administrator's machine, in the RREG_Home/output/ directory. Send this file to the end user who sent you the updated OAM11GRequest.xml file.

3. If you are an end user, copy the generated Agent_ID_Response.xml file, which is in RREG_Home/input/.
This is the file that you received from the administrator. Go to your (client's) RREG home directory and run the following command on the command line:

./RREG_Home/bin/oamreg.sh outofband input/Agent_ID_Response.xml

Note:
If you register the WebGate agent by using the Oracle Access Manager Administration Console, as described in "Registering an OAM Agent Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager, then you must manually copy the files and artifacts generated after the registration from the server (the machine on which the Oracle Access Manager Administration Console is running) to the client machine. The files and artifacts are generated in the MW_HOME/user_projects/domains/name_of_the_WebLogic_domain_for_OAM/output/Agent_ID directory.

- On Windows
Complete the following steps:

1. If you are an end user with no access to the server, then open the OAM11GRequest.xml file, which is in RREG_Home\input\ directory.
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg. Edit this XML file, specify parameters for the new Oracle HTTP Server WebGate for Oracle Access Manager, and send the updated file to your system administrator.

2. If you are an administrator, copy the updated OAM11GRequest.xml file, which is in RREG_Home\input\. This is the file you received from the end user. Go to your (administrator's) RREG_Home directory and run the following command:
RREG_Home\bin\oamreg.bat outofband input\OAM11GRequest.xml

An Agent_ID_Response.xml file is generated on the administrator's machine in the RREG_Home\output\ directory. Send this file to the end user who sent you the updated OAM11GRequest.xml file.

3. If you are an end user, copy the generated Agent_ID_Response.xml file, which is in RREG_Home\input\. This is the file you received from the administrator. Go to your (client's) RREG home directory and run the following command:
RREG_Home\bin\oamreg.bat outofband input\Agent_ID_Response.xml

Note:
If you register the WebGate agent by using the Oracle Access Manager Administration Console, as described in "Registering an OAM Agent Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager, then you must manually copy the files and artifacts generated after the registration from the server (the machine on which the Oracle Access Manager Administration Console is running) to the client machine. The files and artifacts are generated in the MW_HOME/user_projects/domains/name_of_the_WebLogic_domain_for_OAM/output/Agent_ID directory.

2.6.1.5 Files and Artifacts Generated by RREG

Regardless of the method or mode you use to register the new WebGate agent, the following files and artifacts are generated in the RREG_Home/output/Agent_ID directory:

- cwallet.sso

- ObAccessClient.xml

- In SIMPLE mode, RREG generates:

- password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be the same as the passphrase used on the server.

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, RREG generates password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.

Note:
You can use these files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing aaa_cert.pem and aaa_chain.pem files along with password.xml and aaa_key.pem.

2.6.2 Copying Generated Files and Artifacts to the Oracle HTTP Server WebGate Instance Location

After RREG generates these files and artifacts, you must manually copy them, based on the security mode you are using, from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home directory.

Do the following according to the security mode you are using:

- In OPEN mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- In SIMPLE mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

In addition, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config/simple directory:

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

Generating a New Certificate

You can generate a new certificate as follows:

1. Go to the WebGate_Home/webgate/ohs/tools/openssl directory.

2. Create a certificate request as follows:
./openssl req -utf8 -new -nodes -config openssl_silent_ohs11g.cnf -keyout aaa_key.pem -out aaa_req.pem -rand WebGate_Home/webgate/ohs/config/random-seed

3. Self-sign the certificate as follows:
./openssl ca -config openssl_silent_ohs11g.cnf -policy policy_anything -batch -out aaa_cert.pem -infiles aaa_req.pem

4. Copy the following generated certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- cacert.pem located in the simpleCA directory

Note:
After copying the cacert.pem file, you must rename the file to aaa_chain.pem.

Migrating an Existing Certificate

If you want to migrate an existing certificate (aaa_key.pem, aaa_cert.pem, and aaa_chain.pem), ensure that you use the same passphrase that you used to encrypt aaa_key.pem. You must enter the same passphrase during the RREG registration process. If you do not use the same passphrase, then the password.xml file generated by RREG will not match the passphrase used to encrypt the key.

If you enter the same passphrase, you can copy these certificates as follows:

1. Go to the WebGate_Instance_Home/webgate/config directory.

2. Copy the following certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- aaa_chain.pem

2.6.3 Restarting the Oracle HTTP Server Instance

You can use the Oracle Process Manager and Notification Server (OPMN) command-line tool to start or stop your Oracle HTTP Server instance. If you have any instance running, run the following command on the command-line to stop all running instances:

Oracle_Home_for_Oracle_HTTP_Server/opmn/bin/opmnctl stopall

To restart the Oracle HTTP Server instance, run the following commands on the command line:

1. Oracle_Home_for_Oracle_HTTP_Server/opmn/bin/opmnctl start

2. Oracle_Home_for_Oracle_HTTP_Server/opmn/bin/opmnctl startproc ias-component=Oracle_HTTP_Server_Instance_Name

2.7 Deinstalling Oracle HTTP Server 11g WebGate

You should always use the instructions provided in this section for removing the Oracle HTTP Server 11.1.2.2.0 WebGates for Oracle Access Manager. If you try to remove the software manually, then you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this section will ensure that the software is properly removed.

To deinstall the WebGate agent, do the following:

1. Go to the MW_HOME/WebGate_Home/oui/bin directory on UNIX, and MW_HOME\WebgGate_home\oui\bin on Windows.

2. Run the following command:
On UNIX: ./runInstaller -deinstall

On Windows: setup.exe -deinstall -jreLoc JRE_LOCATION

Ensure that you specify the absolute path to your JRE_LOCATION; relative paths are not supported.

After the deinstaller starts, the Welcome screen is displayed. Proceed with the deinstallation by referring to Section 2.7.1.

2.7.1 Deinstallation Screens and Instructions

Follow the instructions in Table 2-2 to complete the deinstallation.

If you need additional help with any of the deinstallation screens, then click Help to access the online help.

Table 2-2 Deinstallation Flow

Sl. No.

Screen

Description

Action Required

1.

Welcome

Each time the deinstaller starts, the Welcome screen is displayed.

Click Next.

2.

Deinstall Oracle Home

The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall.

Verify the Oracle home you are about to deinstall.

Click Deinstall.

On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory in addition to removing the software.

Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen.

If you select No, go to Section 2.7.2 for instructions on how to manually remove your Oracle home directory.

3.

Deinstallation progress

The Deinstallation Progress screen shows the progress and status of the deinstallation.

Wait until the Deinstallation Complete screen appears.

4.

Deinstallation Complete

The Deinstallation Complete screen appears when the deinstallation is complete.

Click Finish to dismiss the screen.

2.7.2 Manually Removing the Oracle Home Directory

If you have selected No on the warning screen during deinstallation, then you must manually remove your WebGate_Home directory and any sub-directories. For example: if your Oracle WebGate home directory was /home/Oracle/Middleware/Oracle_OAMWebGate1, run the following command:

cd /home/Oracle/Middleware/

rm -rf Oracle_OAMWebGate1

On Windows, if your Oracle Common home directory was C:\Oracle\Middleware\Oracle_OAMWebGate1, then use a file manager window, go to the C:\Oracle\Middleware directory, right-click on the Oracle_OAMWebGate1 folder, and then select Delete.

2.8 Silent Installation for OHS 11g WebGate

To run the OHS 11g WebGate in silent mode, complete the following steps:

1. Set the contents of the silent.rsp file. For example:

[ENGINE]
#DO NOT CHANGE THIS.
Response File Version=1.0.0.0.0
[GENERIC]
ORACLE_HOME=/home/MW_HOME/ohs_WebGate_home
MIDDLEWARE_HOME=/home/MW_HOME
[SYSTEM]
[APPLICATIONS]
[RELATIONSHIPS]

In the preceding file, the parameters are as follows:

- ORACLE_HOME: Provide the Oracle Home location. This is the directory in which you want to install the new OHS WebGate. The location must be an immediate child folder under the specified Middleware Home location. The Oracle Home directory name can contain only alphanumeric, hyphen (-), dot (.), and underscore (_) characters, and must begin with an alphanumeric character. The total length has to be less than or equal to 128 characters. For example, home/middleware/ohs_webgate.

- MIDDLEWARE_HOME: Specify the full path to your Middleware home directory.

2. Extract the contents of the installer to a directory.

3. Run the following command:
WebGate_Installer_Directory/Disk1/runInstaller -jreLoc jre_location -invPtrLoc Absolute_Path_Of_the_oraInst.loc_file -silent -response Absolute_Path_Of_the_silent.rsp_file

In the preceding command:

- WebGate_Installer_Directory is the absolute path to the directory in which you have extracted the contents of the WebGate installer.

- jre_location is the absolute path to the JRE directory.

- Absolute_Path_Of_the_oraInst.loc_file is the absolute path to the oraInst.loc file.

- Absolute_Path_Of_the_ silent.rsp_file is the absolute path to the silent.rsp file you created.

3 Installing and Configuring IHS 11g WebGate for OAM

This chapter describes how to install and configure IBM HTTP Server (IHS) 11g Release 2 WebGate for Oracle Access Manager.

This chapter contains the following sections:

- Installation Overview of IHS 11g WebGate

- Prerequisites for Installing IHS 11g WebGate

- Installing IHS 11g WebGate

- Post-Installation Steps for IHS 11g WebGate

- Verifying the Installation and Configuration of IHS 11g WebGate

- Getting Started with a New IHS 11g WebGate

- Starting the IHS Web Server and Accessing the IHS Resource

- Deinstalling IHS 11g WebGate

- Silent Installation for IHS 11g WebGate

3.1 Installation Overview of IHS 11g WebGate

Installing IHS 11g WebGate for Oracle Access Manager involves the following steps:

1. Installing the IHS web server

2. Installing IHS 11g WebGate for Oracle Access Manager

3. Completing the post-installation configuration steps

4. Verifying the IHS 11g WebGate installation

5. Registering the new WebGate agent

3.2 Prerequisites for Installing IHS 11g WebGate

This section discusses the following topics:

- Oracle Fusion Middleware Certification

- Installing JRE

- Installing and Configuring IHS

- Installing and Configuring OAM 11g

3.2.1 Oracle Fusion Middleware Certification

The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 11g Release 2 (11.1.2.1.0).

You can access the Oracle Fusion Middleware Supported System Configurations document at:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

3.2.2 Installing JRE

You must have Java runtime environment (JRE) 1.7 or higher installed.

If you are installing on a 64-bit Linux platform, or on Oracle Enterprise Linux (OEL) 6, ensure that you have a 32-bit JRE.

If you are installing IHS on an AIX system, ensure that you have a 64-bit JRE.

3.2.3 Installing and Configuring IHS

For information about installing and configuring IHS, see the IBM HTTP Server product documentation.

3.2.4 Installing and Configuring OAM 11g

For information about installing Oracle Access Manager (OAM), see "Installing and Configuring Oracle Identity and Access Management (11.1.2.2.0)" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see "Configuring Oracle Access Manager" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

In addition, see "Securing Communication" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Management for information about configuring Oracle Access Manager in Open, Simple, or Cert mode.

3.2.5 Installing 32-bit IHS WebGate on a 64-bit Operating System

A 32-bit Linux version of IHS WebGate may be installed on most 64-bit Linux platforms, with a 32-bit JDK. To see which platforms are supported, see the Oracle Fusion Middleware System Requirements and Specifications for Oracle Fusion Middleware 11g Release 2 (11.1.2) document, available on the following page:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

For more information, see the System Requirements and Supported Platforms for Oracle Fusion Middleware 11g Release 2 (11.1.2) document, available on the following page:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-requirements-100147.html

3.3 Installing IHS 11g WebGate

This section contains the following topics:

- Obtaining the Software

- Starting the IHS 11g WebGate Installer

- Installation Flow and Procedure

3.3.1 Obtaining the Software

For information about obtaining the IHS 11g WebGate software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.

3.3.2 Starting the IHS 11g WebGate Installer

To start the installation wizard, do the following:

1. Go to the directory in which you extracted the contents of the Installer.

2. Go to the following location:
cd Disk1

3. Run the following command:

- On Linux 32-bit and AIX systems
./runInstaller

- On Linux 64-bit system
linux32 bash ./runInstaller

- On Oracle Enterprise Linux (OEL) 6 system
linux32 bash ./runInstaller -jreLoc JRE_Location

Ensure that you launch the installer from the WebGate_ihs/Disk1 directory.

4. Specify the JRE/JDK location when prompted. Ensure that you provide the complete path to a 32-bit JRE/JDK if you are installing on a 64-bit Linux platform. If you are installing on an AIX system, provide the complete path to your 64-bit JRE/JDK directory.

After the Installer starts, the Welcome screen is displayed. Proceed with the installation by referring to Section 3.3.3.

3.3.3 Installation Flow and Procedure

To install IHS 11g WebGate for Oracle Access Manager, follow the instructions in Table 3-1.

If you need additional help with any of the installation screens, then click Help to access the online help.

Table 3-1 Installation Flow of IHS WebGate

No.

Screen

Description and Action Required

1.

Welcome Screen

Click Next to continue.

2.

Prerequisite Checks Screen

Click Next to continue.

3.

Specify Installation Location Screen

Specify the Middleware home and Oracle home locations.

For more information about these directories, see "Understanding Oracle Fusion Middleware Concepts and Directory Structure" in Oracle Fusion Middleware Installation Planning Guide.

Click Next to continue.

4.

Installation Summary Screen

Verify the information on this screen.

Click Install to begin the installation.

5.

Installation Progress Screen

Click Next to continue.

6.

Installation Complete Screen

Click Finish to dismiss the Installer.

3.4 Post-Installation Steps for IHS 11g WebGate

This section includes the following topics:

- Deploying the IHS WebGate Instance

- Setting the Environment Variables

- Running the EditHttpConf Tool

3.4.1 Deploying the IHS WebGate Instance

Create an IHS WebGate instance by using the deployWebGateInstance.sh tool from the WebGate Oracle home directory. The WebGate instance directory that you are creating or have provided must be empty.

To deploy the WebGate instance, do the following:

1. Go to the WebGate_Oracle_Home/webgate/ihs/tools/deployWebGate directory by running the following command:
cd WebGate_Oracle_Home/webgate/ihs/tools/deployWebGate

2. Run the following command:
./deployWebGateInstance -w WebGate_Instancedir -oh WebGate_Oracle_Home -ws WebServer

In the preceding command:

- WebGate_Instancedir is the directory in which the new WebGate instances should be created.

- WebGate_Oracle_Home is the WebGate Oracle home directory you specified while installing IHS 11g WebGate.

- WebServer is IHS.

Example:

./deployWebGateInstance -w /home/wg_instance4ihs/ -oh /home/Oracle_OAMWebGate1/ -ws ihs

3.4.2 Setting the Environment Variables

Set the environment variable LD_LIBRARY_PATH on Linux, and LIBPATH on AIX, to WebGate_Oracle_Home/webgate/ihs/lib.

Example:

On Linux

export LD_LIBRARY_PATH=/home/Oracle_OAMWebGate1/webgate/ihs/lib

On AIX

export LIBPATH=/home/Oracle_OAMWebGate1/webgate/ihs/lib

3.4.3 Running the EditHttpConf Tool

To run the EditHttpConf tool, do the following:

1. Go to the WebGate_Oracle_Home/webgate/ihs/tools/setup/InstallTools directory, by running the following command:
cd WebGate_Oracle_Home/webgate/ihs/tools/setup/InstallTools

2. Run the following command:
./EditHttpConf -f path_to_webserver_config_file -w WebGate_Instance_Dir -oh WebGate_Oracle_Home -ws WebServer

In the preceding command:

- path_to_webserver_config_file is the full path of the IHS instance httpd.conf file.

- WebGate_Instance_Dir is the directory in which the new WebGate instance is created.

- WebGate_Oracle_Home is the full path to the WebGate Oracle home.

- WebServer is IHS.

Note:
The -oh parameter is optional and the command runs without any error, even if you do not specify it.

Example:

cd /home/OAMWebGate1/webgate/ihs/tools/setup/InstallTools/

./EditHttpConf -f /home/instanceHome1/net-test_ihs1/config/test_httpd.conf -oh /home/Oracle_OAMWebGate1/ -w /home/Oracle_OAMWebGate1/wg_instance4ihs/ -ws ihs

3.5 Verifying the Installation and Configuration of IHS 11g WebGate

After installing IHS 11g WebGate for Oracle Access Manager, you can examine the installDATE-TIME_STAMP.out log file to verify the installation. The default location of the log is in the following file:

WebGate_Home/oraInst.loc

3.6 Getting Started with a New IHS 11g WebGate

Before you can use the new IHS 11g WebGate agent for Oracle Access Manager, you must complete the following tasks:

1. Registering the New IHS 11g WebGate

2. Copying Generated Files and Artifacts to the IHS WebGate Instance Location

3.6.1 Registering the New IHS 11g WebGate

You can register the new WebGate agent with Oracle Access Manager by using the Oracle Access Manager Administration console. For more information, see "Registering an OAM Agent Using the Console" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Management.

Alternatively, you can use the RREG command-line tool to register a new WebGate agent. You can run the tool in two modes: In-Band and Out-Of-Band.

This section contains the following topics:

- Setting Up the RREG Tool

- Updating the OAM11gRequest.xml File

- Using the In-Band Mode

- Using the Out-Of-Band Mode

- Files and Artifacts Generated by RREG

3.6.1.1 Setting Up the RREG Tool

To set up the RREG tool, complete the following steps:

1. After installing and configuring Oracle Access Manager, go to the following directory:
Oracle_IDM2/oam/server/rreg/client

2. Untar the RREG.tar.gz file.
Example:

gunzip RREG.tar.gz

tar -xvf RREG.tar

The tool for registering the agent is located at:

RREG_Home/bin/oamreg.sh

Note:
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg.

Set the following environment variables in the oamreg.sh script:

- OAM_REG_HOME
Set this variable to the absolute path to the directory in which you extracted the contents of RREG.tar/rreg.

- JDK_HOME
Set this variable to the absolute path to the directory in which Java or JDK is installed on your machine.

3.6.1.2 Updating the OAM11gRequest.xml File

You must update the agent parameters, such as agentName, in the OAM11GRequest.xml file located in the RREG_Home/input directory.

Note:
The OAM11GRequest.xml file or the short version OAM11GRequest_short.xml is used as a template. You can copy this template file and use it.

Modify the following required parameters in the OAM11GRequest.xml file or in the OAM11GRequest_short.xml file:

- serverAddress
Specify the host and the port of the OAM Administration Server.

- agentName
Specify any custom name for the agent.

- agentBaseUrl
Specify the host and the port of the machine on which IHS 11g WebGate is installed.

- preferredHost
Specify the host and the port of the machine on which IHS 11g WebGate is installed.

- security
Specify the security mode, such as open, based on the WebGate installed.

- primaryServerList
Specify the host and the port of Managed Server for the Oracle Access Manager proxy, under a Server container element.

After modifying the file, save and close it.

3.6.1.3 Using the In-Band Mode

If you run the RREG tool once after updating the WebGate parameters in the OAM11GRequest.xml file, then the files and artifacts required by WebGate are generated in the following directory:

RREG_Home/output/agent_name

Note:
You can run RREG either on a client machine or on the server. If you are running it on the server, then you must manually copy the artifacts back to the client.

Complete the following steps:

1. Open the OAM11GRequest.xml file, which is in the RREG_Home/input/ directory. RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg.
Edit the XML file and enter parameters for the new IHS WebGate for Oracle Access Manager.

2. Run the following command:
./RREG_Home/bin/oamreg.sh inband input/OAM11GRequest.xml

3.6.1.4 Using the Out-Of-Band Mode

If you are an enduser with no access to the server, then you can email your updated OAM11GRequest.xml file to the system administrator, who can run RREG in the out-of-band mode. You can collect the generated AgentID_Response.xml file from the system administrator and run RREG on this file to obtain the WebGate files and artifacts you require.

After you receive the generated AgentID_Response.xml file from the administrator, you must manually copy the file to the input directory on your machine.

Complete the following steps:

1. If you are an enduser with no access to the server, open the OAM11GRequest.xml file, which is in RREG_Home/input/.
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg. Edit the XML file, specify parameters for the new IHS WebGate for Oracle Access Manager, and send the updated file to your system administrator.

2. If you are an administrator, copy the updated OAM11GRequest.xml file, which is in the RREG_Home/input/ directory.
This is the file that you received from the enduser. Go to your (administrator's) RREG_Home directory and run the following command:

./RREG_Home/bin/oamreg.sh outofband input/OAM11GRequest.xml

An Agent_ID_Response.xml file is generated in the output directory on the administrator's machine, in the RREG_Home/output/ directory. Send this file to the enduser who sent you the updated OAM11GRequest.xml file.

3. If you are an enduser, copy the generated Agent_ID_Response.xml file, which is in the RREG_Home/input/ directory.
This is the file that you received from the administrator. Go to your (client's) RREG home directory and run the following command:

./RREG_Home/bin/oamreg.sh outofband input/Agent_ID_Response.xml

Note:
If you register the new WebGate agent by using the Oracle Access Manager Administration console, as described in "Registering an OAM Agent Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Management, then you must manually copy the files and artifacts generated after the registration from the server (the machine on which the Oracle Access Manager Administration Console is running) to the client machine. The files and artifacts are generated in the MW_HOME/user_projects/domains/name_of_the_WebLogic_domain_for_OAM/output/Agent_ID directory.

3.6.1.5 Files and Artifacts Generated by RREG

Regardless of the method or mode you use to register the new WebGate agent, the following files and artifacts are generated in the RREG_Home/output/Agent_ID directory:

- cwallet.sso

- ObAccessClient.xml

- In SIMPLE mode, RREG generates:

- password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be the same as the passphrase used on the server.

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, RREG generates password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.

Note:
You can use these files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing aaa_cert.pem and aaa_chain.pem files along with password.xml and aaa_key.pem.

3.6.2 Copying Generated Files and Artifacts to the IHS WebGate Instance Location

After RREG generates these files and artifacts, you must manually copy them, based on the security mode you are using, from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home directory.

Do the following according to the security mode you are using:

- In OPEN mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- In SIMPLE mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

In addition, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config/simple directory:

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

Generating a New Certificate

You can generate a new certificate as follows:

1. Go to the WebGate_Home/webgate/ihs/tools/openssl directory.

2. Create a certificate request as follows:
./openssl req -utf8 -new -nodes -config openssl_silent_ihs11g.cnf -keyout aaa_key.pem -out aaa_req.pem -rand WebGate_Home/webgate/ihs/config/random-seed

3. Self-sign the certificate as follows:
./openssl ca -config openssl_silent_ihs11g.cnf -policy policy_anything -batch -out aaa_cert.pem -infiles aaa_req.pem

4. Copy the following generated certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- cacert.pem located in the simpleCA directory

Note:
After copying the cacert.pem file, you must rename the file to aaa_chain.pem.

Migrating an Existing Certificate

If you want to migrate an existing certificate (aaa_key.pem, aaa_cert.pem, and aaa_chain.pem), then ensure that you use the same passphrase that you used to encrypt aaa_key.pem. You must enter the same passphrase during the RREG registration process. If you do not use the same passphrase, then the password.xml file generated by RREG will not match the passphrase used to encrypt the key.

If you enter the same passphrase, then you can copy these certificates as follows:

1. Go to the WebGate_Instance_Home/webgate/config directory.

2. Copy the following certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- aaa_chain.pem

3.7 Starting the IHS Web Server and Accessing the IHS Resource

Before you start the web server, ensure that you have set the environment variable as specified in Section 3.4.2.

To start the IHS web server:

- On Linux
Run the following command:

/IBM/HTTPServer/bin/apachectl -k start

- On AIX

1. Go to the httpd.conf file at /IHS/HTTPServer/conf/httpd.conf, open it in a text editor, and add the following:
ThreadStackSize 2097152

2. Run the following command:
/IBM/HTTPServer/bin/apachectl -k start

After you start the IHS Web Server, log in to it by using the following URL:

http://machine_name.my.company.com:port

WebGate intercepts the request and redirects you to the Oracle Access Manager console. Enter the username and password, and you are redirected to the IBM HTTP Server.

3.8 Deinstalling IHS 11g WebGate

You should always use the instructions provided in this section for removing the IHS 11g WebGate. If you try to remove the software manually, thne you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this chapter will ensure that the software is properly removed.

To deinstall the IHS WebGate, do the following:

1. Go to the MW_HOME/Webgate_Home/oui/bin directory

2. Run the following command:
./runInstaller -deinstall

After the Installer starts, the Welcome screen is displayed. Proceed with the deinstallation by referring to Section 3.8.1.

3.8.1 Deinstallation Screens and Instructions

Follow the instructions in Table 3-2 to deinstall IHS 11g WebGate.

If you need additional help with any of the deinstallation screens, then click Help to access the online help.

Table 3-2 Deinstallation Flow

Sl. No.

Screen

Description

Action Required

1.

Welcome

Each time the deinstaller starts, the Welcome screen is displayed.

Click Next.

2.

Deinstall Oracle home

The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall.

Verify the Oracle home you are about to deinstall.

Click Deinstall.

On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory, in addition to removing the software.

Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen.

If you select No, go to Section 3.8.2 for instructions on how to manually remove your Oracle home directory.

3.

Deinstallation progress

The Deinstallation Progress screen shows the progress and status of the deinstallation.

Wait until the Deinstallation Complete screen appears.

4.

Deinstallation Complete

The Deinstallation Complete screen appears when the deinstallation is complete.

Click Finish to dismiss the screen.

3.8.2 Manually Removing the Oracle Home Directory

If you have selected No on the warning screen during deinstallation, then you must manually remove your WebGate_Home directory and any sub-directories. For example: if your Oracle WebGate home directory was /home/Oracle/Middleware/Oracle_OAMWebGate1, run the following command:

cd /home/Oracle/Middleware/

rm -rf Oracle_OAMWebGate1

3.9 Silent Installation for IHS 11g WebGate

To run the IHS 11g WebGate in silent mode, complete the following steps:

1. Set the contents of the silent.rsp file. For example:

[ENGINE]
#DO NOT CHANGE THIS.
Response File Version=1.0.0.0.0
[GENERIC]
ORACLE_HOME=/home/MW_HOME/ihs_WebGate_home
MIDDLEWARE_HOME=/home/MW_HOME
[SYSTEM]
[APPLICATIONS]
[RELATIONSHIPS]

In the preceding file, the parameters are as follows:

- ORACLE_HOME: Provide the Oracle home location. This is the directory in which you want to install the new IHS WebGate. The location must be an immediate child folder under the specified Middleware home location. The Oracle home directory name can contain only alphanumeric, hyphen (-), dot (.), and underscore (_) characters, and must begin with an alphanumeric character. The total length must be less than or equal to 128 characters. For example, home/middleware/ihs_webgate.

- MIDDLEWARE_HOME: Specify the full path to your Middleware home directory.

2. Extract the contents of the installer to a directory.

3. Run the following command:
WebGate_Installer_Directory/Disk1/runInstaller -jreLoc jre_location -invPtrLoc Absolute_Path_Of_the_oraInst.loc_file -silent -response Absolute_Path_Of_the_silent.rsp_file

In the preceding command:

- WebGate_Installer_Directory is the absolute path to the directory in which you have extracted the contents of the WebGate installer.

- jre_location is the absolute path to the JRE directory.

- Absolute_Path_Of_the_oraInst.loc_file is the absolute path to the oraInst.loc file.

- Absolute_Path_Of_the_ silent.rsp_file is the absolute path to the silent.rsp file you created.

4 Installing and Configuring Oracle Traffic Director 11g WebGate for OAM

This chapter describes how to install and configure Oracle Traffic Director 11g WebGate for Oracle Access Manager. For an introduction to WebGates and an overview of installing WebGates, see Chapter 1.

This chapter contains the following sections:

- Installation Overview of Oracle Traffic Director 11g WebGate

- Prerequisites for Oracle Traffic Director 11g WebGate

- Installing Oracle Traffic Director 11g WebGate

- Post-Installation Steps for Oracle Traffic Director 11g WebGate

- Verifying the Installation and Configuration of Oracle Traffic Director 11g WebGate

- Getting Started with a New Oracle Traffic Director 11g WebGate

- Deinstalling Oracle Traffic Director 11g WebGate

- Silent Installation for Oracle Traffic Director 11g WebGate

Note:
When you install OTD WebGate, the Enterprise Single Sign-On (ESSO) access proxy binaries are installed by default. So, if you want to use Enterprise Single Sign-On with OTD WebGate, then you must run all of the tasks provided in this chapter. However, in Section 4.4.2, instead of running the command provided in step two, run the following command:
./EditObjConf -f path_to_webserver_config_file -w WebGate_Instance_Dir -oh WebGate_Oracle_Home -ws WebServer -enableESSO

In this command:

- path_to_webserver_config_file is the full path of the OTD instance obj.conf file.

- WebGate_Instance_Dir is the directory in which new WebGate instances are created.

- WebGate_Oracle_Home is the full path to the WebGate Oracle home.

- WebServer is OTD.

Example:

./EditObjConf -f /home/instanceHome1/net-test_otd1/config/test_otd1-obj.conf -oh /home/Oracle_OAMWebGate1/ -w /home/Oracle_OAMWebGate1/wg_instance4otd/ -ws otd -enableESSO

For more information about Enterprise Single Sign-On, see "Introduction to Oracle Enterprise Single Sign-On Suite" in Oracle Fusion Middleware Enterprise Single Sign-On Suite Administrator's Guide.

Following is a list of the platforms supported by the OTD 11g Webgate.

4.1 Installation Overview of Oracle Traffic Director 11g WebGate

Installing Oracle Traffic Director 11g WebGate for Oracle Access Manager involves the following steps:

1. Installing the Oracle Traffic Director web server

2. Installing Oracle Traffic Director 11g WebGate for Oracle Access Manager

3. Completing the post-installation configuration steps

4. Verifying the Oracle Traffic Director 11g WebGate installation

5. Registering the new WebGate agent

4.2 Prerequisites for Oracle Traffic Director 11g WebGate

This section discusses the following topics:

- Oracle Fusion Middleware Certification

- Installing JRE

- Installing and Configuring Oracle Traffic Director 11g

- Installing and Configuring OAM 11g

4.2.1 Oracle Fusion Middleware Certification

The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 11g Release 2 (11.1.2.1.0).

You can access the Oracle Fusion Middleware Supported System Configurations document at:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

4.2.2 Installing JRE

You must have a 64-bit Java runtime environment (JRE), 1.7 or higher installed.

4.2.3 Installing and Configuring Oracle Traffic Director 11g

If you do not have Oracle Traffic Director 11.1.1.7.0 installed, then you can download the Installer from the Oracle Technology Network (OTN):

http://www.oracle.com/technology/software/products/middleware/htdocs/fmw_11_download.html

Alternatively, you can download the latest Oracle Fusion Middleware 11g software from the following website:

http://edelivery.oracle.com/

For information about installation and configuration, see Oracle Traffic Director Installation Guide.

4.2.4 Installing and Configuring OAM 11g

For information about installing Oracle Access Manager (OAM), see "Installing and Configuring Oracle Identity and Access Management (11.1.2.2.0)" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see "Configuring Oracle Access Management" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

In addition, see "Securing Communication Between OAM 11g Servers and WebGates" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager for information about configuring Oracle Access Manager in Open, Simple, or Cert mode.

4.3 Installing Oracle Traffic Director 11g WebGate

This section includes the following topics:

- Obtaining the Software

- Starting the Oracle Traffic Director 11g WebGate Installer

- Installation Flow and Procedure of Oracle Traffic Director 11g WebGate

4.3.1 Obtaining the Software

For information about obtaining the Oracle Traffic Director 11.1.2.2.0 WebGate software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.

4.3.2 Starting the Oracle Traffic Director 11g WebGate Installer

To start the installation wizard, do the following:

1. Go to the directory in which you extracted the contents of the Installer.

2. Go to the following location:
cd Disk1

3. Run the following command:
./runInstaller

4. Provide the jre location when the Oracle Universal Installer (OUI) prompts for it.

After the Installer starts, the Welcome screen appears. Continue by referring to the section Installation Flow and Procedure of Oracle Traffic Director 11g WebGate for installing Oracle Traffic Director 11g WebGate for Oracle Access Manager.

4.3.3 Installation Flow and Procedure of Oracle Traffic Director 11g WebGate

To install Oracle Traffic Director 11g WebGate for Oracle Access Manager, follow the instructions in Table 4-1.

If you need additional help with any of the installation screens, then click Help to access the online help.

Table 4-1 Installation Flow of OTD WebGate

No.

Screen

Description and Action Required

1

Welcome Screen

Click Next to continue.

2

Prerequisite Checks Screen

Click Next to continue.

3

Specify Installation Location Screen

Specify the Middleware home and Oracle home locations.

For more information about these directories, see "Understanding Oracle Fusion Middleware Concepts and Directory Structure" in Oracle Fusion Middleware Installation Planning Guide.

Oracle home in case of OTD WebGate is any valid directory, not necessarily in the Middleware home. So, if you do not provide a Middleware home or if you provide an invalid Middleware home, the Installer proceeds without any error.

Click Next to continue.

4

Installation Summary Screen

Verify the information on this screen.

Click Install to begin the installation.

5

Installation Progress Screen

Click Next to continue.

6

Installation Complete Screen

Click Finish to dismiss the Installer.

4.4 Post-Installation Steps for Oracle Traffic Director 11g WebGate

This section includes the following topics:

- Deploying the Oracle Traffic Director WebGate Instance

- Running the EditObjConf Tool

4.4.1 Deploying the Oracle Traffic Director WebGate Instance

Create an Oracle Traffic Director instance by using the deployWebGateInstance.sh tool from the Webgate Oracle home directory.

To deploy the WebGate instance, do the following:

1. Go to the WebGate_Oracle_Home/webgate/iplanet/tools/deployWebGate directory by running the following command:
cd WebGate_Oracle_Home/webgate/iplanet/tools/deployWebGate

2. Run the following command:
./deployWebGateInstance -w WebGate_Instancedir -oh WebGate_Oracle_Home -ws ohs|iplanet|otd

In this command:

- WebGate_Instancedir is the directory in which the new WebGate instances should be created.

- WebGate_Oracle_Home is the WebGate Oracle home directory you specified while installing OTD 11g WebGate.

- Web server is OTD.

Example:

./deployWebGateInstance.sh -w /home/wg_instance4otd/ -oh /home/Oracle_OAMWebGate1/ -ws otd

4.4.2 Running the EditObjConf Tool

To run the EditObjConf tool, do the following:

1. Go to the WebGate_Oracle_Home/webgate/iplanet/tools/setup/InstallTools directory by running the following command:
cd WebGate_Oracle_Home/webgate/iplanet/tools/setup/InstallTools

2. Run the following command:
./EditObjConf -f path_to_webserver_config_file -w WebGate_Instance_Dir -oh WebGate_Oracle_Home -ws WebServer

In this command:

- path_to_webserver_config_file is the full path of the OTD instance obj.conf file.

- WebGate_Instance_Dir is the directory in which new WebGate instances are created.

- WebGate_Oracle_Home is the full path to the WebGate Oracle home.

- WebServer is OTD.

Example:

cd /home/OAMWebGate1/webgate/iplanet/tools/setup/InstallTools/

./EditObjConf -f /home/instanceHome1/net-test_otd1/config/test_otd1-obj.conf -oh /home/Oracle_OAMWebGate1/ -w /home/Oracle_OAMWebGate1/wg_instance4otd/ -ws otd

4.5 Verifying the Installation and Configuration of Oracle Traffic Director 11g WebGate

After installing Oracle Traffic Director 11g WebGate for Oracle Access Manager, you can examine the installDATE-TIME_STAMP.out log file to verify the installation. The default location of the log is in the following file:

WebGate_Home/oraInst.loc

4.6 Getting Started with a New Oracle Traffic Director 11g WebGate

Before you can use the new Oracle Traffic Director 11g WebGate for Oracle Access Manager, you must complete the following tasks:

1. Registering the New WebGate Agent for Oracle Traffic Director 11g WebGate

2. Copying Generated Files and Artifacts to the WebGate Instance Location

3. Restarting the Oracle Traffic Director Instance

4.6.1 Registering the New WebGate Agent for Oracle Traffic Director 11g WebGate

You can register the new WebGate with Oracle Access Manager by using the Oracle Access Manager Administration Console. For more information, see "Registering Partners (Agents and Applications) by Using the Console" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.

Alternatively, you can use the RREG command-line tool to register a new WebGate agent. You can run the tool in two modes: In-Band and Out-Of-Band.

This section includes the following topics:

- Setting Up the RREG Tool

- Updating the OAM11gRequest.xml File

- Using the In-Band Mode

- Using the Out-Of-Band Mode

- Files and Artifacts Generated by RREG

4.6.1.1 Setting Up the RREG Tool

To set up the RREG tool, complete the following steps :

1. After installing and configuring Oracle Access Manager, go to the following directory:
Oracle_IDM2/oam/server/rreg/client

2. Untar the RREG.tar.gz file.
Example:

gunzip RREG.tar.gz

tar -xvf RREG.tar

The tool for registering the agent is located at:

RREG_Home/bin/oamreg.sh

Note:
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg.

Set the following environment variables in the oamreg.sh script:

- OAM_REG_HOME
Set this variable to the absolute path to the directory in which you extracted the contents of RREG.tar/rreg.

- JDK_HOME
Set this variable to the absolute path to the directory in which Java or JDK is installed on your machine.

4.6.1.2 Updating the OAM11gRequest.xml File

You must update the agent parameters, such as agentName, in the OAM11GRequest.xml file in the RREG_Home/input directory.

Note:
The OAM11GRequest.xml file or the short version OAM11GRequest_short.xml is used as a template. You can copy this template file and use it.

Modify the following required parameters in the OAM11GRequest.xml file or in the OAM11GRequest_short.xml file:

- serverAddress
Specify the host and the port of the OAM Administration Server.

- agentName
Specify any custom name for the agent.

- agentBaseUrl
Specify the host and the port of the machine on which Oracle Traffic Director 11g WebGate is installed.

- preferredHost
Specify the host and the port of the machine on which Oracle Traffic Director 11g WebGate is installed.

- security
Specify the security mode, such as open, based on the WebGate installed.

- primaryServerList
Specify the host and the port of Managed Server for the Oracle Access Manager proxy, under a Server container element.

After modifying the file, save and close it.

4.6.1.3 Using the In-Band Mode

If you run the RREG tool once after updating the WebGate parameters in the OAM11GRequest.xml file, then the files and artifacts required by WebGate are generated in the following directory:

RREG_Home/output/agent_name

Note:
You can run RREG either on a client machine or on the server. If you are running it on the server, then you must manually copy the artifacts back to the client.

Complete the following steps:

1. Open the OAM11GRequest.xml file, which is in the input directory at RREG_Home/input/. RREG_Home is the directory where you extracted the contents of RREG.tar.gz/rreg to. Edit the XML file and fill in parameters for the new Oracle Traffic Director WebGate for Oracle Access Manager.

2. Run the following command:
./RREG_Home/bin/oamreg.sh inband input/OAM11GRequest.xml

4.6.1.4 Using the Out-Of-Band Mode

If you are an end user with no access to the server, then you can email your updated OAM11GRequest.xml file to the system administrator, who can run RREG in the out-of-band mode. You can collect the generated AgentID_Response.xml file from the system administrator and run RREG on this file to obtain the WebGate files and artifacts you require.

After you receive the generated AgentID_Response.xml file from the administrator, you must manually copy the file to the input directory on your machine.

Complete the following steps:

1. If you are an end user with no access to the server, open the OAM11GRequest.xml file, which is in RREG_Home/input/.
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg. Edit this XML file and specify parameters for the new Oracle Traffic Director WebGate for Oracle Access Manager. Send the updated file to your system administrator.

2. If you are an administrator, copy the updated OAM11GRequest.xml file, which is in the RREG_Home/input/ directory.
This is the file that you received from the end user. Go to your (administrator's) RREG_Home directory and run the following command:

./RREG_Home/bin/oamreg.sh outofband input/OAM11GRequest.xml

An Agent_ID_Response.xml file is generated in the output directory on the administrator's machine, in the RREG_Home/output/directory. Send this file to the end user who sent you the updated OAM11GRequest.xml file.

3. If you are an end user, copy the generated Agent_ID_Response.xml file, which is in the RREG_Home/input/ directory.
This is the file that you received from the administrator. Move to your (client's) RREG home directory and run the following command:

./RREG_Home/bin/oamreg.sh outofband input/Agent_ID_Response.xml

Note:
If you register the WebGate agent by using the Oracle Access Manager Administration Console, as described in "Registering Partners (Agents and Applications) by Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager, then you must manually copy the files and artifacts generated after the registration from the server (the machine on which the Oracle Access Manager Administration Console is running) to the client machine. The files and artifacts are generated in the MW_HOME/user_projects/domains/name_of_the_WebLogic_domain_for_OAM/output/Agent_ID directory.

4.6.1.5 Files and Artifacts Generated by RREG

Regardless of the method or mode you use to register the new WebGate agent, the following files and artifacts are generated in the RREG_Home/output/Agent ID directory:

- cwallet.sso

- ObAccessClient.xml

- In SIMPLE mode, RREG generates:

- password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be the same as the passphrase used on the server.

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, RREG generates password.xml file, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.

Note:
You can use these files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing aaa_cert.pem and aaa_chain.pem files along with password.xml and aaa_key.pem.

4.6.2 Copying Generated Files and Artifacts to the WebGate Instance Location

After RREG generates these files and artifacts, you must manually copy the following files, based on the security mode you are using, from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home directory.

Do the following according to the security mode you are using:

- In OPEN mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- In SIMPLE mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

In addition, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config/simple directory:

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

After copying the files, you must either generate a new certificate or migrate an existing certificate.

Generating a New Certificate

You can generate a new certificate as follows:

1. Go to the WebGate_Home/webgate/otd/tools/openssl directory.

2. Create a certificate request as follows:
./openssl req -utf8 -new -nodes -config openssl_silent_ohs11g.cnf -keyout aaa_key.pem -out aaa_req.pem -rand WebGate_Home/webgate/otd/config/random-seed

3. Self-sign the certificate as follows:
./openssl ca -config openssl_silent_ohs11g.cnf -policy policy_anything -batch -out aaa_cert.pem -infiles aaa_req.pem

4. Copy the following generated certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- cacert.pem located in the simpleCA directory

Note:
After copying the cacert.pem file, you must rename the file to aaa_chain.pem.

Migrating an Existing Certificate

If you want to migrate an existing certificate (aaa_key.pem, aaa_cert.pem, and aaa_chain.pem), then ensure that you use the same passphrase which you used to encrypt aaa_key.pem. You must enter the same passphrase during the RREG registration process. If you do not use the same passphrase, then the password.xml file generated by RREG will not match the passphrase used to encrypt the key.

If you enter the same passphrase, then you can copy these certificates as follows:

1. Go to the WebGate_Instance_Home/webgate/config directory.

2. Copy the following certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- aaa_chain.pem

4.6.3 Restarting the Oracle Traffic Director Instance

Note:
If you have installed OTD WebGate on a Solaris or Sparc 64-bit platform, set the LD_PRELOAD_64 variable as LD_PRELOAD_64 =WebGate_Home/libclntsh.so.11.1:WebGate_Home/libnnz11.so, before running the startserv or stopserv commands.For example:
export LD_PRELOAD_64=/home/Oracle_OAMWebGate1/Lib/libclntsh.so.11.1:/home/Oracle_OAMWebGate1/lib/libnnz11.so

Use the startserv command to start or stopserv command to stop your Oracle Traffic Director instance.

To stop the server, run the following command:

/home/bin/stopserv

To start the server, run the following command:

export LD_LIBRARY_PATH=/webgate/iplanet/lib

/home/bin/startserv

To restart the Oracle Traffic Director instance, stop all running instances, and then run the start command.

4.7 Deinstalling Oracle Traffic Director 11g WebGate

You should always use the instructions provided in this section for removing the Oracle Traffic Director 11g WebGate for Oracle Access Manager. If you try to remove the software manually, you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this section will ensure that the software is properly removed.

To deinstall the WebGate agent, do the following:

1. Go to the MW_HOME/Webgate_Home/oui/bin directory on UNIX, and MW_HOME\Webgate_home\oui\bin on Windows.

2. Run the following command:
On UNIX: ./runInstaller -deinstall

On Windows: setup.exe -deinstall -jreLoc JRE_LOCATION

Ensure that you specify the absolute path to your JRE_LOCATION; relative paths are not supported.

After the deinstaller starts, the Welcome screen is displayed. Proceed with the deinstallation by referring to Section 4.7.1.

4.7.1 Deinstallation Screens and Instructions

Follow the instructions in Table 4-2 to complete the deinstallation.

If you need additional help with any of the deinstallation screens, click Help to access the online help.

Table 4-2 Deinstallation Flow

Sl. No.

Screen

Description

Action Required

1.

Welcome

Each time the deinstaller starts, the Welcome screen is displayed.

Click Next.

2.

Deinstall Oracle Home

The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall.

Verify the Oracle home you are about to deinstall.

Click Deinstall.

On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory in addition to removing the software.

Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen.

If you select No, go to Section 4.7.2 for instructions on how to manually remove your Oracle home directory.

3.

Deinstallation progress

The Deinstallation Progress screen shows the progress and status of the deinstallation.

Wait until the Deinstallation Complete screen appears.

4.

Deinstallation Complete

The Deinstallation Complete screen appears when the deinstallation is complete.

Click Finish to dismiss the screen.

4.7.2 Manually Removing the Oracle Home Directory

If you have selected No on the warning screen during deinstallation, then you must manually remove your Webgate_Home directory and any sub-directories. For example: if your Oracle WebGate home directory was /home/Oracle/Middleware/Oracle_OAMWebGate1, run the following command:

cd /home/Oracle/Middleware/

rm -rf Oracle_OAMWebGate1

On Windows, if your Oracle Common home directory was C:\Oracle\Middleware\Oracle_OAMWebGate1, then use a file manager window, go to the C:\Oracle\Middleware directory, right-click on the Oracle_OAMWebGate1 folder, and then select Delete.

4.8 Silent Installation for Oracle Traffic Director 11g WebGate

To run the Oracle Traffic Director 11g WebGate in silent mode, complete the following steps:

1. Set the contents of the silent.rsp file. For example:

[ENGINE]
#DO NOT CHANGE THIS.
Response File Version=1.0.0.0.0
[GENERIC]
ORACLE_HOME=/home/MW_HOME/ohs_WebGate_home
MIDDLEWARE_HOME=/home/MW_HOME
[SYSTEM]
[APPLICATIONS]
[RELATIONSHIPS]

In the preceding file, the parameters are as follows:

- ORACLE_HOME: Provide the Oracle home location. This is the directory in which you want to install the new Oracle Traffic Director WebGate. The location must be an immediate child folder under the specified Middleware home location. The Oracle home directory name can contain only alphanumeric, hyphen (-), dot (.), and underscore (_) characters, and must begin with an alphanumeric character. The total length has to be less than or equal to 128 characters. For example, home/middleware/ohs_webgate.

- MIDDLEWARE_HOME: Specify the full path to your Middleware home directory.

2. Extract the contents of the installer to a directory.

3. Run the following command:
WebGate_Installer_Directory/Disk1/runInstaller -jreLoc jre_location -invPtrLoc Absolute_Path_Of_the_oraInst.loc_file -silent -response Absolute_Path_Of_the_silent.rsp_file

In the preceding command:

- WebGate_Installer_Directory is the absolute path to the directory in which you have extracted the contents of the WebGate installer.

- jre_location is the absolute path to the JRE directory.

- Absolute_Path_Of_the_oraInst.loc_file is the absolute path to the oraInst.loc file.

- Absolute_Path_Of_the_ silent.rsp_file is the absolute path to the silent.rsp file you created.

5 Installing and Configuring Apache 11g WebGate for OAM

This chapter describes how to install and configure Apache 11g WebGate for Oracle Access Manager. For an introduction to WebGates and an overview of installing WebGates, see Chapter 1.

This chapter contains the following sections:

- Installation Overview of Apache 11g WebGate

- Prerequisites for Apache 11g WebGate

- Installing Apache 11g WebGate

- Post-Installation Steps for Apache 11g WebGate

- Verifying the Installation and Configuration of Apache 11g WebGate

- Getting Started with a New Apache 11g WebGate

- Deinstalling Apache 11g WebGate

- Silent Installation for Apache 11g WebGate

5.1 Installation Overview of Apache 11g WebGate

Installing Apache 11g WebGate for Oracle Access Manager includes the following steps:

1. Installing the Apache web server

2. Installing Apache 11g WebGate for Oracle Access Manager

3. Completing the post-installation configuration steps

4. Verifying the Apache11g WebGate installation

5. Registering the new WebGate agent

5.2 Prerequisites for Apache 11g WebGate

This section discusses the following topics:

- Oracle Fusion Middleware Certification

- Installing JRE

- Installing and Configuring Apache 2.2 and 2.4

- Installing and Configuring OAM 11g

5.2.1 Oracle Fusion Middleware Certification

The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 11g Release 2 (11.1.2.1.0).

You can access the Oracle Fusion Middleware Supported System Configurations document at:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

5.2.2 Installing JRE

You must have a 64-bit Java runtime environment (JRE), 1.7 or higher installed.

5.2.3 Installing and Configuring Apache 2.2 and 2.4

For information about installing and configuring Apache 2.2 and 2.4, see the Apache product documentation.

5.2.4 Installing and Configuring OAM 11g

For information about installing Oracle Access Manager (OAM), see "Installing and Configuring Oracle Identity and Access Management (11.1.2.2.0)" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see "Configuring Oracle Access Management" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

In addition, see "Securing Communication Between OAM 11g Servers and WebGates" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager for information about configuring Oracle Access Manager in Open, Simple, or Cert mode.

5.3 Installing Apache 11g WebGate

This section includes the following topics:

- Obtaining the Software

- Starting the Apache 11g WebGate Installer

- Installation Flow and Procedure of Apache 11g WebGate

5.3.1 Obtaining the Software

For information about obtaining the Apache 11.1.2.2.0 WebGate software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.

5.3.2 Starting the Apache 11g WebGate Installer

To start the installation wizard, do the following:

1. Go to the directory in which you extracted the contents of the Installer.

2. Go to the following location:
cd Disk1

3. Run the following command:
On UNIX:

./runInstaller -jreLoc <location_of_jre>

On Windows:

setup.exe -jreLoc <location_of_jre>

4. Run the following command to deploy WebGate instance:
deployWebGateInstance.bat -w c:\haripnar\MW_HOME\Oracle_WT1\instances\instance1\config\OHS\ohs1 -oh C:\haripnar\MW_HOME\Oracle_OAMWebGate1

5. On Windows, we do not set LD_LIBRARY_PATH, instead update the path variable:
set PATH=<Oracle_OAMWebGate1/webgate/apache/lib>;%PATH%

i.e., Add a semicolon (;) followed by this path at the end of the entry for the path environment variable.

After the Installer starts, the Welcome screen appears. Continue by referring to the section Installation Flow and Procedure of Apache 11g WebGate for installing Apache 11g WebGate for Oracle Access Manager.

5.3.3 Installation Flow and Procedure of Apache 11g WebGate

To install Apache 11g WebGate for Oracle Access Manager, follow the instructions in Table 5-1.

If you need additional help with any of the installation screens, click Help to access the online help.

Table 5-1 Installation Flow of Apache WebGate

No.

Screen

Description and Action Required

1

Welcome Screen

Click Next to continue.

2

Prerequisite Checks Screen

Click Next to continue.

3

Specify Installation Location Screen

Specify the Middleware home and Oracle home locations.

For more information about these directories, see "Understanding Oracle Fusion Middleware Concepts and Directory Structure" in Oracle Fusion Middleware Installation Planning Guide.

Oracle home in case of Apache WebGate is any valid directory, not necessarily in the Middleware home. So, if you do not provide a Middleware home or if you provide an invalid Middleware home, the Installer proceeds without any error.

Click Next to continue.

4

Installation Summary Screen

Verify the information on this screen.

Click Install to begin the installation.

5

Installation Progress Screen

Click Next to continue.

6

Installation Complete Screen

Click Finish to dismiss the Installer.

5.4 Post-Installation Steps for Apache 11g WebGate

This section includes the following topics:

- Deploying the Apache WebGate Instance

- Setting the Environment Variable

- Running the EditHttpConf Tool

5.4.1 Deploying the Apache WebGate Instance

Create an Apache instance by using the deployWebGateInstance.sh tool from the Webgate Oracle home directory.

To deploy the WebGate instance, do the following:

1. Go to the WebGate_Oracle_Home/webgate/apache/tools/deployWebGate directory by running the following command:
cd WebGate_Oracle_Home/webgate/apache/tools/deployWebGate

2. Run the following command:
./deployWebGateInstance -w WebGate_Instancedir -oh WebGate_Oracle_Home -ws apache

In this command:

- WebGate_Instancedir is the directory in which the new WebGate instances should be created.

- WebGate_Oracle_Home is the WebGate Oracle home directory you specified while installing Apache 11g WebGate.

- Web server is Apache.

Example:

./deployWebGateInstance.sh -w /home/wg_instance4apache/ -oh /home/Oracle_OAMWebGate1/ -ws apache

5.4.2 Setting the Environment Variable

For Apache webgate, you must set the PRELOAD flag for AIX and Solaris platforms:

- On AIX:
export LDR_PRELOAD64=libclntsh.so

- On Solaris:
export LD_PRELOAD_64=webgate_install_home/lib/libclntsh.so.11.1:webgate_install_home/lib/libnnz11.so

Set the environment variable:

- On Linux, Sparc, and Solaris:
export LD_LIBRARY_PATH=/webgate_oracle_home/Oracle_OAMWebGate1/webgate/apache/lib

- On AIX:
export LIBPATH=/webgate_oracle_home/Oracle_OAMWebGate1/webgate/apache/lib

5.4.3 Running the EditHttpConf Tool

To run the EditHttpConf tool, do the following:

1. Go to the WebGate_Oracle_Home/webgate/apache/tools/setup/InstallTools directory by running the following command:
cd WebGate_Oracle_Home/webgate/apache/tools/setup/InstallTools

2. Run the following command:
On UNIX:

./EditHttpConf -f path_to_webserver_config_file -w WebGate_Instance_Dir -oh WebGate_Oracle_Home -ws WebServer

On Windows:

EditHttpConf.exe -f path_to_webserver_config_file -w WebGate_Instance_Dir -oh WebGate_Oracle_Home -ws WebServer -o output_file

In the preceding command:

- path_to_webserver_config_file is the full path of the Apache instance obj.conf file.

- WebGate_Instance_Dir is the directory in which new WebGate instances are created.

- WebGate_Oracle_Home is the full path to the WebGate Oracle home.

- WebServer is apache or apache24, depending on your Apache version. If you are installing on Apache 2.2, use apache and if you are installing on Apache 2.4, use apache24.

Example:

On Apache 2.2:

cd /home/OAMWebGate1/webgate/apache/tools/setup/InstallTools/

./EditHttpConf -f /home/webserver-apache22/conf/httpd.conf -oh /home/Webgate_Oracle_Home/ -w /home/webgate_instance4Apache/ -ws apache

On Apache 2.4:

cd /home/OAMWebGate1/webgate/apache/tools/setup/InstallTools/

./EditHttpConf -f /home/webserver-apache24/conf/httpd.conf -oh /home/Webgate_Oracle_Home/ -w /home/webgate_instance4Apache/ -ws apache24

5.5 Verifying the Installation and Configuration of Apache 11g WebGate

After installing Apache 11g WebGate for Oracle Access Manager, you can examine the installDATE-TIME_STAMP.out log file to verify the installation. The default location of the log is in the following file:

WebGate_Home/oraInst.loc

5.6 Getting Started with a New Apache 11g WebGate

Before you can use the new Apache 11g WebGate for Oracle Access Manager, you must complete the following tasks:

1. Registering the New WebGate Agent for Apache 11g WebGate

2. Copying Generated Files and Artifacts to the WebGate Instance Location

3. Restarting the Apache Instance

5.6.1 Registering the New WebGate Agent for Apache 11g WebGate

You can register the new WebGate with Oracle Access Manager by using the Oracle Access Manager Administration Console. For more information, see "Registering Partners (Agents and Applications) by Using the Console" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.

Alternatively, you can use the RREG command-line tool to register a new WebGate agent. You can run the tool in two modes: In-Band and Out-Of-Band.

This section includes the following topics:

- Setting Up the RREG Tool

- Updating the OAM11gRequest.xml File

- Using the In-Band Mode

- Using the Out-Of-Band Mode

- Files and Artifacts Generated by RREG

5.6.1.1 Setting Up the RREG Tool

To set up the RREG tool, complete the following steps :

1. After installing and configuring Oracle Access Manager, go to the following directory:
Oracle_IDM2/oam/server/rreg/client

2. Untar the RREG.tar.gz file.
Example:

gunzip RREG.tar.gz

tar -xvf RREG.tar

The tool for registering the agent is located at:

RREG_Home/bin/oamreg.sh

Note:
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg.

Set the following environment variables in the oamreg.sh script:

- OAM_REG_HOME
Set this variable to the absolute path to the directory in which you extracted the contents of RREG.tar/rreg.

- JDK_HOME
Set this variable to the absolute path to the directory in which Java or JDK is installed on your machine.

5.6.1.2 Updating the OAM11gRequest.xml File

You must update the agent parameters, such as agentName, in the OAM11GRequest.xml file in the RREG_Home/input directory.

Note:
The OAM11GRequest.xml file or the short version OAM11GRequest_short.xml is used as a template. You can copy this template file and use it.

Modify the following required parameters in the OAM11GRequest.xml file or in the OAM11GRequest_short.xml file:

- serverAddress
Specify the host and the port of the OAM Administration Server.

- agentName
Specify any custom name for the agent.

- agentBaseUrl
Specify the host and the port of the machine on which Apache 11g WebGate is installed.

- preferredHost
Specify the host and the port of the machine on which Apache 11g WebGate is installed.

- security
Specify the security mode, such as open, based on the WebGate installed.

- primaryServerList
Specify the host and the port of Managed Server for the Oracle Access Manager proxy, under a Server container element.

After modifying the file, save and close it.

5.6.1.3 Using the In-Band Mode

If you run the RREG tool once after updating the WebGate parameters in the OAM11GRequest.xml file, the files and artifacts required by WebGate are generated in the following directory:

RREG_Home/output/agent_name

Note:
You can run RREG either on a client machine or on the server. If you are running it on the server, then you must manually copy the artifacts back to the client.

Complete the following steps:

1. Open the OAM11GRequest.xml file, which is in the input directory at RREG_Home/input/. RREG_Home is the directory where you extracted the contents of RREG.tar.gz/rreg to. Edit the XML file and fill in parameters for the new Apache WebGate for Oracle Access Manager.

2. Run the following command:
./RREG_Home/bin/oamreg.sh inband input/OAM11GRequest.xml

5.6.1.4 Using the Out-Of-Band Mode

If you are an end user with no access to the server, then you can email your updated OAM11GRequest.xml file to the system administrator, who can run RREG in the out-of-band mode. You can collect the generated AgentID_Response.xml file from the system administrator and run RREG on this file to obtain the WebGate files and artifacts you require.

After you receive the generated AgentID_Response.xml file from the administrator, you must manually copy the file to the input directory on your machine.

Complete the following steps:

1. If you are an end user with no access to the server, open the OAM11GRequest.xml file, which is in RREG_Home/input/.
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg. Edit this XML file and specify parameters for the new Apache WebGate for Oracle Access Manager. Send the updated file to your system administrator.

2. If you are an administrator, copy the updated OAM11GRequest.xml file, which is in the RREG_Home/input/ directory.
This is the file that you received from the end user. Go to your (administrator's) RREG_Home directory and run the following command:

./RREG_Home/bin/oamreg.sh outofband input/OAM11GRequest.xml

An Agent_ID_Response.xml file is generated in the output directory on the administrator's machine, in the RREG_Home/output/directory. Send this file to the end user who sent you the updated OAM11GRequest.xml file.

3. If you are an end user, copy the generated Agent_ID_Response.xml file, which is in the RREG_Home/input/ directory.
This is the file that you received from the administrator. Move to your (client's) RREG home directory and run the following command:

./RREG_Home/bin/oamreg.sh outofband input/Agent_ID_Response.xml

Note:
If you register the WebGate agent by using the Oracle Access Manager Administration Console, as described in "Registering Partners (Agents and Applications) by Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager, then you must manually copy the files and artifacts generated after the registration from the server (the machine on which the Oracle Access Manager Administration Console is running) to the client machine. The files and artifacts are generated in the MW_HOME/user_projects/domains/name_of_the_WebLogic_domain_for_OAM/output/Agent_ID directory.

5.6.1.5 Files and Artifacts Generated by RREG

Regardless of the method or mode you use to register the new WebGate agent, the following files and artifacts are generated in the RREG_Home/output/Agent ID directory:

- cwallet.sso

- ObAccessClient.xml

- In the SIMPLE mode, RREG generates:

- password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be the same as the passphrase used on the server.

- aaa_key.pem

- aaa_cert.pem

- In the CERT mode, RREG generates password.xml file, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.

Note:
You can use these files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing aaa_cert.pem and aaa_chain.pem files along with password.xml and aaa_key.pem.

5.6.2 Copying Generated Files and Artifacts to the WebGate Instance Location

After RREG generates these files and artifacts, you must manually copy the following files, based on the security mode you are using, from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home directory.

Do the following according to the security mode you are using:

- In OPEN mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- In SIMPLE mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

In addition, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config/simple directory:

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

After copying the files, you must either generate a new certificate or migrate an existing certificate.

Generating a New Certificate

You can generate a new certificate as follows:

1. Go to the WebGate_Home/webgate/apache/tools/openssl directory.

2. Create a certificate request as follows:
./openssl req -utf8 -new -nodes -config openssl_silent_apache11g.cnf -keyout aaa_key.pem -out aaa_req.pem -rand WebGate_Home/webgate/apache/config/random-seed

3. Self-sign the certificate as follows:
./openssl ca -config openssl_silent_apache11g.cnf -policy policy_anything -batch -out aaa_cert.pem -infiles aaa_req.pem

4. Copy the following generated certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- cacert.pem located in the simpleCA directory

Note:
After copying the cacert.pem file, you must rename the file to aaa_chain.pem.

Migrating an Existing Certificate

If you want to migrate an existing certificate (aaa_key.pem, aaa_cert.pem, and aaa_chain.pem), then ensure that you use the same passphrase which you used to encrypt aaa_key.pem. You must enter the same passphrase during the RREG registration process. If you do not use the same passphrase, then the password.xml file generated by RREG will not match the passphrase used to encrypt the key.

If you enter the same passphrase, then you can copy these certificates as follows:

1. Go to the WebGate_Instance_Home/webgate/config directory.

2. Copy the following certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- aaa_chain.pem

5.6.3 Restarting the Apache Instance

Use the startserv command to start or stopserv command to stop your Apache instance.

To stop the server, run the following command:

/home/bin/stopserv

To start the server, run the following command:

export LD_LIBRARY_PATH=/WebGate_Home/lib

/home/bin/startserv

To restart the Apache instance, stop all running instances, and then run the start command.

5.7 Deinstalling Apache 11g WebGate

You should always use the instructions provided in this section for removing the Apache 11g WebGate for Oracle Access Manager. If you try to remove the software manually, then you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this section will ensure that the software is properly removed.

To deinstall the WebGate agent, do the following:

1. Go to the MW_HOME/Webgate_Home/oui/bin directory on UNIX, and MW_HOME\Webgate_home\oui\bin on Windows.

2. Run the following command:
On UNIX: ./runInstaller -deinstall

On Windows: setup.exe -deinstall -jreLoc JRE_LOCATION

Ensure that you specify the absolute path to your JRE_LOCATION; relative paths are not supported.

After the deinstaller starts, the Welcome screen is displayed. Proceed with the deinstallation by referring to Section 5.7.1.

5.7.1 Deinstallation Screens and Instructions

Follow the instructions in Table 5-2 to complete the deinstallation.

If you need additional help with any of the deinstallation screens, then click Help to access the online help.

Table 5-2 Deinstallation Flow

Sl. No.

Screen

Description

Action Required

1.

Welcome

Each time the deinstaller starts, the Welcome screen is displayed.

Click Next.

2.

Deinstall Oracle Home

The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall.

Verify the Oracle home you are about to deinstall.

Click Deinstall.

On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory in addition to removing the software.

Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen.

If you select No, go to Section 5.7.2 for instructions on how to manually remove your Oracle home directory.

3.

Deinstallation progress

The Deinstallation Progress screen shows the progress and status of the deinstallation.

Wait until the Deinstallation Complete screen appears.

4.

Deinstallation Complete

The Deinstallation Complete screen appears when the deinstallation is complete.

Click Finish to dismiss the screen.

5.7.2 Manually Removing the Oracle Home Directory

If you have selected No on the warning screen during deinstallation, then you must manually remove your Webgate_Home directory and any sub-directories. For example: if your Oracle WebGate home directory was /home/Oracle/Middleware/Oracle_OAMWebGate1, run the following command:

cd /home/Oracle/Middleware/

rm -rf Oracle_OAMWebGate1

On Windows, if your Oracle Common home directory was C:\Oracle\Middleware\Oracle_OAMWebGate1, then use a file manager window, go to the C:\Oracle\Middleware directory, right-click on the Oracle_OAMWebGate1 folder, and then select Delete.

5.8 Silent Installation for Apache 11g WebGate

To run the Apache 11g WebGate in silent mode, complete the following steps:

1. Set the contents of the silent.rsp file. For example:

[ENGINE]
#DO NOT CHANGE THIS.
Response File Version=1.0.0.0.0
[GENERIC]
ORACLE_HOME=/home/MW_HOME/apache_WebGate_home
MIDDLEWARE_HOME=/home/MW_HOME
[SYSTEM]
[APPLICATIONS]
[RELATIONSHIPS]

In the preceding file, the parameters are as follows:

- ORACLE_HOME: Provide the Oracle home location. This is the directory in which you want to install the new Apache WebGate. The location must be an immediate child folder under the specified Middleware home location. The Oracle home directory name can contain only alphanumeric, hyphen (-), dot (.), and underscore (_) characters, and must begin with an alphanumeric character. The total length has to be less than or equal to 128 characters. For example, home/middleware/apache_webgate.

- MIDDLEWARE_HOME: Specify the full path to your Middleware home directory.

2. Extract the contents of the installer to a directory.

3. Run the following command:
WebGate_Installer_Directory/Disk1/runInstaller -jreLoc jre_location -invPtrLoc Absolute_Path_Of_the_oraInst.loc_file -silent -response Absolute_Path_Of_the_silent.rsp_file

In the preceding command:

- WebGate_Installer_Directory is the absolute path to the directory in which you have extracted the contents of the WebGate installer.

- jre_location is the absolute path to the JRE directory.

- Absolute_Path_Of_the_oraInst.loc_file is the absolute path to the oraInst.loc file.

- Absolute_Path_Of_the_ silent.rsp_file is the absolute path to the silent.rsp file you created.

6 Installing and Configuring Lotus Domino 11g WebGate for OAM

This chapter describes how to install and configure Lotus Domino 11g Release 2 WebGate for Oracle Access Manager.

This chapter contains the following sections:

- Installation Overview of Lotus Domino 11g WebGate

- Prerequisites for Installing Lotus Domino 11g WebGate

- Installing Lotus Domino 11g WebGate

- Post-Installation Steps for Lotus Domino 11g WebGate

- Verifying the Installation and Configuration of Lotus Domino 11g WebGate

- Getting Started with a New Lotus Domino 11g WebGate

- Setting the DCC Directory Mapping

- Deinstalling Lotus Domino 11g WebGate

- Silent Installation for Lotus Domino 11g WebGate

6.1 Installation Overview of Lotus Domino 11g WebGate

Installing Lotus Domino 11g WebGate for Oracle Access Manager involves the following steps:

1. Installing the Lotus Domino web server

2. Installing Lotus Domino 11g WebGate for Oracle Access Manager

3. Completing the post-installation configuration steps

4. Verifying the Lotus Domino 11g WebGate installation

5. Registering the new WebGate agent

6.2 Prerequisites for Installing Lotus Domino 11g WebGate

This section contains the following topics:

- Oracle Fusion Middleware Certification

- Installing JRE

- Installing and Configuring Lotus Domino 11g Web Server

- Installing and Configuring Oracle Access Manager 11g

6.2.1 Oracle Fusion Middleware Certification

The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 11g Release 2 (11.1.2.1.0).

You can access the Oracle Fusion Middleware Supported System Configurations document by searching the Oracle Technology Network (OTN) web site:

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

6.2.2 Installing JRE

You must have Java runtime environment (JRE) 1.7 or higher installed.

6.2.3 Installing and Configuring Lotus Domino 11g Web Server

You can download the Installer from the Oracle Technology Network (OTN):

http://docs.oracle.com/cd/E23104_01/download_readme.htm

Alternatively, you can download the latest Oracle Fusion Middleware 11g software from the following website:

http://edelivery.oracle.com/

For information about installing and configuring Oracle HTTP Server 11g (11.1.1.7.0), see Oracle Fusion Middleware Installation Guide for Oracle Web Tier.

6.2.4 Installing and Configuring Oracle Access Manager 11g

For information about installing Oracle Access Manager (OAM), see "Installing and Configuring Oracle Identity and Access Management (11.1.2.2.0)" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see "Configuring Oracle Access Manager" in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.

In addition, see "Securing Communication" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager for information about configuring Oracle Access Manager in Open, Simple, or Cert mode.

6.3 Installing Lotus Domino 11g WebGate

This section discusses the following topics:

- Obtaining the Software

- Starting the Lotus Domino 11g WebGate Installer

- Installation Flow and Procedure of Lotus Domino 11g WebGate

6.3.1 Obtaining the Software

For information about obtaining the Lotus Domino 11.1.2.2.0 WebGate software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.

6.3.2 Starting the Lotus Domino 11g WebGate Installer

To start the installation wizard, perform the following steps:

1. Go to the directory in which you extracted the contents of the Installer.

2. Go to the following location:
cd Disk1

3. Run the following command:
On Windows:

setup.exe -jreLoc <location_of_jre>

4. Provide the jre location when the Oracle Universal Installer (OUI) prompts for it.

After the Installer starts, the Welcome screen is displayed. Proceed with the installation by referring to Section 6.3.3.

6.3.3 Installation Flow and Procedure of Lotus Domino 11g WebGate

To install Lotus Domino 11g WebGate for Oracle Access Manager, follow the instructions in Table 6-1.

If you need additional help with any of the installation screens, then click Help to access the online help.

Table 6-1 Installation Flow

No.

Screen

Description and Action Required

1.

Welcome Screen

Click Next to continue.

2.

Prerequisite Checks Screen

Click Next to continue.

3.

Specify Installation Location Screen

Specify the Oracle home location.

For more information about these directories, see "Understanding Oracle Fusion Middleware Concepts and Directory Structure" in Oracle Fusion Middleware Installation Planning Guide for Oracle Identity and Access Management.

Click Next to continue.

4.

Installation Summary Screen

Verify the information on this screen.

Click Install to begin the installation.

5.

Installation Progress Screen

Click Next to continue.

6.

Installation Complete Screen

Click Finish to dismiss the installer.

6.4 Post-Installation Steps for Lotus Domino 11g WebGate

You must complete the following steps after installing Oracle HTTP Server 11g WebGate for Oracle Access Manager:

1. Move to the following directory under your Oracle home for WebGate:
WebGate_Home\webgate\domino85\tools\deployWebGate

2. Run the following command to copy the required bits of agent from the WebGate_Home directory to the WebGate_Instance location:
/deployWebGateInstance -w <WebGate Instancedir> -oh <WebGate Oracle Home> -ws <Web Server>

where <Web Server> value is domino in case of domino9 Server

<Web Server> value is domino85 in case of domino8.5.X Server.

Note:
Make sure that Domino Server is not running.

3. Run the configureDominoWebGate.bat tool for updating Domino Webserver configuration. This will update the Domino notes.ini file with WebGate specific configuration.
ConfigureDominoWebGate -w <WebGate Instancedir> -oh <WebGate Oracle Home> -ws <Web Server> -notes <path to notes.ini>

- WebGate_Instance_Dir is the directory in which the new WebGate instances are created.

- WebGate_Oracle_Home is the full path to the WebGate Oracle home.

- Path to notes.ini is the full path of the notes.ini configuration file of Domino8.x/9.x server.

4. Register the WebGate.dll as DSAPI filter from Domino console.

- Go to Domino Admin console and select Internet Protocols and configure the complete path to webgate.dll in DSAPI filters.

- Restart the WebServer to enforce the new changes.

6.4.1 Setting the Environment Variable

Set the environment variable LD_LIBRARY_PATH, to WebGate_Oracle_Home/lib.

Example:

export LD_LIBRARY_PATH=/home/Oracle_OAMWebGate1/lib

On Windows, we do not set LD_LIBRARY_PATH, instead update the path variable:

set PATH=<Oracle_OAMWebGate1/webgate/domino/lib>;%PATH%

i.e., Add a semicolon (;) followed by this path at the end of the entry for the path environment variable.

6.5 Verifying the Installation and Configuration of Lotus Domino 11g WebGate

After installing Lotus Domino 11g WebGate for Oracle Access Manager and completing the post-installation steps, you can examine the installDATE-TIME_STAMP.out log file to verify the installation. The default location of the log are as follows:

WebGate_Home/oraInst.loc

6.6 Getting Started with a New Lotus Domino 11g WebGate

Before you can use the new Lotus Domino 11g WebGate agent for Oracle Access Manager, you must complete the following tasks:

1. Registering the New Lotus Domino 11g WebGate

2. Copying Generated Files and Artifacts to the Oracle HTTP Server WebGate Instance Location

6.6.1 Registering the New Lotus Domino 11g WebGate

You can register the new WebGate agent with Oracle Access Manager by using the Oracle Access Manager Administration console. For more information, see "Registering an OAM Agent Using the Console" in Oracle Fusion Middleware Administrator's Guide for Oracle Access Management.

Alternatively, you can use the RREG command-line tool to register a new WebGate agent. You can use the tool to run in two modes: In-Band and Out-Of-Band.

This section contains the following topics:

- Setting Up the RREG Tool

- Updating the OAM11gRequest.xml File

- Using the In-Band Mode

- Using the Out-Of-Band Mode

- Files and Artifacts Generated by RREG

6.6.1.1 Setting Up the RREG Tool

To set up the RREG tool, complete the following steps:

1. After installing and configuring Oracle Access Manager, go to the following location:
Oracle_IDM2\oam\server\rreg\client

2. Extract the contents of the RREG.tar.zip file to a destination of your choice.

The tool for registering the agent is located at:

RREG_Home\bin\oamreg.bat

Note:
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg.

Set the following environment variables in the oamreg.bat script:

- OAM_REG_HOME
Set this variable to the absolute path to the directory in which you extracted the contents of RREG.tar/rreg.

- JDK_HOME
Set this variable to the absolute path to the directory in which Java or JDK is installed on your machine.

6.6.1.2 Updating the OAM11gRequest.xml File

You must update the agent parameters, such as agentName, in the OAM11GRequest.xml file in the RREG_Home\input directory.

Note:
The OAM11GRequest.xml file or the short version OAM11GRequest_short.xml is used as a template. You can copy this template file and use it.

Modify the following required parameters in the OAM11GRequest.xml file or in the OAM11GRequest_short.xml file:

- serverAddress
Specify the host and the port of the OAM Administration Server.

- agentName
Specify any custom name for the agent.

- agentBaseUrl
Specify the host and the port of the machine on which Lotus Domino 11g WebGate is installed.

- preferredHost
Specify the host and the port of the machine on which Lotus Domino 11g WebGate is installed.

- security
Specify the security mode, such as open, based on the WebGate installed.

- primaryServerList
Specify the host and the port of Managed Server for the Oracle Access Manager proxy, under a Server container element.

After modifying the file, save and close it.

Note:
You need to add <Webgate Oracle Home>\webgate\dominoXX\lib folder in Path variable in case of Windows Operating system.

6.6.1.3 Using the In-Band Mode

If you run the RREG tool once after updating the WebGate parameters in the OAM11GRequest.xml file, then the files and artifacts required by WebGate are generated in the following directory:

RREG_Home\output\agent_name

Note:
You can run RREG either on a client machine or on the server. If you are running it on the server, then you must manually copy the artifacts back to the client.

Complete the following steps:

1. Open the OAM11GRequest.xml file, which is in the input directory at RREG_Home\input. RREG_Home is the directory on where you extracted the contents of RREG.tar.gz/rreg.
Edit the XML file and specify parameters for the new Lotus Domino Server WebGate for Oracle Access Manager.

2. Run the following command:
RREG_Home\bin\oamreg.bat inband input\OAM11GRequest.xml

6.6.1.4 Using the Out-Of-Band Mode

If you are an end user with no access to the server, then you can email your updated OAM11GRequest.xml file to the system administrator, who can run RREG in the out-of-band mode. You can collect the generated AgentID_Response.xml file from the system administrator and run RREG on this file to obtain the WebGate files and artifacts you require.

After you receive the generated AgentID_Response.xml file from the administrator, you must manually copy the file to the input directory on your machine.

- Complete the following steps:

1. If you are an end user with no access to the server, then open the OAM11GRequest.xml file, which is in RREG_Home\input\ directory.
RREG_Home is the directory in which you extracted the contents of RREG.tar.gz/rreg. Edit this XML file, specify parameters for the new Lotus Domino WebGate for Oracle Access Manager, and send the updated file to your system administrator.

2. If you are an administrator, copy the updated OAM11GRequest.xml file, which is in RREG_Home\input\. This is the file you received from the end user. Go to your (administrator's) RREG_Home directory and run the following command:
RREG_Home\bin\oamreg.bat outofband input\OAM11GRequest.xml

An Agent_ID_Response.xml file is generated on the administrator's machine in the RREG_Home\output\ directory. Send this file to the end user who sent you the updated OAM11GRequest.xml file.

3. If you are an end user, copy the generated Agent_ID_Response.xml file, which is in RREG_Home\input\. This is the file you received from the administrator. Go to your (client's) RREG home directory and run the following command:
RREG_Home\bin\oamreg.bat outofband input\Agent_ID_Response.xml

Note:
If you register the WebGate agent by using the Oracle Access Manager Administration Console, as described in "Registering an OAM Agent Using the Console" in the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager, then you must manually copy the files and artifacts generated after the registration from the server (the machine on which the Oracle Access Manager Administration Console is running) to the client machine. The files and artifacts are generated in the MW_HOME/user_projects/domains/name_of_the_WebLogic_domain_for_OAM/output/Agent_ID directory.

6.6.1.5 Files and Artifacts Generated by RREG

Regardless of the method or mode you use to register the new WebGate agent, the following files and artifacts are generated in the RREG_Home/output/Agent_ID directory:

- cwallet.sso

- ObAccessClient.xml

- In SIMPLE mode, RREG generates:

- password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be the same as the passphrase used on the server.

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, RREG generates password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.

Note:
You can use these files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing aaa_cert.pem and aaa_chain.pem files along with password.xml and aaa_key.pem.

6.6.2 Copying Generated Files and Artifacts to the Oracle HTTP Server WebGate Instance Location

After RREG generates these files and artifacts, you must manually copy them, based on the security mode you are using, from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home directory.

Do the following according to the security mode you are using:

- In OPEN mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- In SIMPLE mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

In addition, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config/simple directory:

- aaa_key.pem

- aaa_cert.pem

- In CERT mode, copy the following files from the RREG_Home/output/Agent_ID directory to the WebGate_Instance_Home/webgate/config directory:

- ObAccessClient.xml

- cwallet.sso

- password.xml

Generating a New Certificate

From the openssl or any other tool you can generate a new certificate.

Copy the following generated certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- cacert.pem located in the simpleCA directory

Note:
After copying the cacert.pem file, you must rename the file to aaa_chain.pem.

Migrating an Existing Certificate

If you want to migrate an existing certificate (aaa_key.pem, aaa_cert.pem, and aaa_chain.pem), ensure that you use the same passphrase that you used to encrypt aaa_key.pem. You must enter the same passphrase during the RREG registration process. If you do not use the same passphrase, then the password.xml file generated by RREG will not match the passphrase used to encrypt the key.

If you enter the same passphrase, you can copy these certificates as follows:

1. Go to the WebGate_Instance_Home/webgate/config directory.

2. Copy the following certificates to the WebGate_Instance_Home/webgate/config directory:

- aaa_key.pem

- aaa_cert.pem

- aaa_chain.pem

6.7 Setting the DCC Directory Mapping

For setting up the Domino WebGate as DCC WebGate, you need to configure the path to WebGate login files in Domino Webserver.

1. Login to Domino Admin Console.

2. On the left side pane, expand Web > Web Server Configurations, open the Domino Server.

3. In the Domino Server configuration, select Create Web > URL Mapping/Redirection.

- /oamsso-bin -> <WebGateHome>\webgate\domino\oamsso-bin

- /oamsso -> <WebGateHome>\webgate\domino\oamsso

4. Permissions to be provided for each mapping from the Domino console:

- For /oamsso-bin: Execute

- For /oamsso: Read

6.8 Deinstalling Lotus Domino 11g WebGate

You should always use the instructions provided in this section for removing the Lotus Domino 11.1.2.2.0 WebGates for Oracle Access Manager. If you try to remove the software manually, then you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this section will ensure that the software is properly removed.

To deinstall the WebGate agent, do the following:

1. Go to the MW_HOME\WebgGate_home\oui\bin.

2. Run the following command:
setup.exe -deinstall -jreLoc JRE_LOCATION

Ensure that you specify the absolute path to your JRE_LOCATION; relative paths are not supported.

After the deinstaller starts, the Welcome screen is displayed. Proceed with the deinstallation by referring to Section 6.8.1.

6.8.1 Deinstallation Screens and Instructions

Follow the instructions in Table 6-2 to complete the deinstallation.

If you need additional help with any of the deinstallation screens, then click Help to access the online help.

Table 6-2 Deinstallation Flow

Sl. No.

Screen

Description

Action Required

1.

Welcome

Each time the deinstaller starts, the Welcome screen is displayed.

Click Next.

2.

Deinstall Oracle Home

The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall.

Verify the Oracle home you are about to deinstall.

Click Deinstall.

On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory in addition to removing the software.

Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen.

If you select No, go to Section 6.8.2 for instructions on how to manually remove your Oracle home directory.

3.

Deinstallation progress

The Deinstallation Progress screen shows the progress and status of the deinstallation.

Wait until the Deinstallation Complete screen appears.

4.

Deinstallation Complete

The Deinstallation Complete screen appears when the deinstallation is complete.

Click Finish to dismiss the screen.

6.8.2 Manually Removing the Oracle Home Directory

If you have selected No on the warning screen during deinstallation, then you must manually remove your WebGate_Home directory and any sub-directories. For example: if your Oracle WebGate home directory was /home/Oracle/Middleware/Oracle_OAMWebGate1, run the following command:

cd /home/Oracle/Middleware/

rm -rf Oracle_OAMWebGate1

If your Oracle Common home directory was C:\Oracle\Middleware\Oracle_OAMWebGate1, then use a file manager window, go to the C:\Oracle\Middleware directory, right-click on the Oracle_OAMWebGate1 folder, and then select Delete.

6.9 Silent Installation for Lotus Domino 11g WebGate

To run the Lotus Domino 11g WebGate in silent mode, complete the following steps:

1. Set the contents of the silent.rsp file. For example:

[ENGINE]
#DO NOT CHANGE THIS.
Response File Version=1.0.0.0.0
[GENERIC]
ORACLE_HOME=/home/MW_HOME/domino_WebGate_home
MIDDLEWARE_HOME=/home/MW_HOME
[SYSTEM]
[APPLICATIONS]
[RELATIONSHIPS]

In the preceding file, the parameters are as follows:

- ORACLE_HOME: Provide the Oracle Home location. This is the directory in which you want to install the new Lotus Domino WebGate. The location must be an immediate child folder under the specified Middleware Home location. The Oracle Home directory name can contain only alphanumeric, hyphen (-), dot (.), and underscore (_) characters, and must begin with an alphanumeric character. The total length has to be less than or equal to 128 characters. For example, home/middleware/domino_webgate.

- MIDDLEWARE_HOME: Specify the full path to your Middleware home directory.

2. Extract the contents of the installer to a directory.

3. Run the following command:
WebGate_Installer_Directory/Disk1/runInstaller -jreLoc jre_location -invPtrLoc Absolute_Path_Of_the_oraInst.loc_file -silent -response Absolute_Path_Of_the_silent.rsp_file

In the preceding command:

- WebGate_Installer_Directory is the absolute path to the directory in which you have extracted the contents of the WebGate installer.

- jre_location is the absolute path to the JRE directory.

- Absolute_Path_Of_the_oraInst.loc_file is the absolute path to the oraInst.loc file.

- Absolute_Path_Of_the_ silent.rsp_file is the absolute path to the silent.rsp file you created.

7 Moving a WebGate Agent From a Test to a Production Environment

This chapter describes how to move a provisioned 11g WebGate configuration from a test environment to a production environment for all WebGate agents, which includes Oracle HTTP Server, IHS, Oracle Traffic Director, and Apache.

This chapter includes the following sections:

- Overview of Moving a WebGate Agent From a Test to a Production Environment

- Prerequisites for Moving a WebGate Agent From a Test to a Production Environment

- Replicating the WebGate Binary and Configuration From Test to Production

7.1 Overview of Moving a WebGate Agent From a Test to a Production Environment

To copy and 11g WebGate configuration from a test environment to a production environment, you use the following movement scripts:

- copyBinary.sh

- pasteBinary.sh

- copyConfig.sh

- pasteConfig.sh

For information about the scripts, see "Movement Scripts" in Oracle Fusion Middleware Administrator's Guide.

To copy an 11g WebGate configuration from a test environment to a production environment, do the following:

1. Copy the WebGate binary:

1. Archive the WebGate binary on the test system by using the copyBinary.sh script.

2. Transfer the archive to the production system.

3. Extract the archive in the production environment by using the pasteBinary.sh script.

2. Copy the WebGate configuration information:

1. Archive the WebGate instances on the test system by using the copyConfig.sh script.

2. Transfer the archive file and move plan to the production system.

3. (Optional.) Edit the file (moveplan.xml) that contains the configuration settings used by the pasteConfig.sh script in the next step.

4. Extract the archive in the production environment using the pasteConfig.sh script.

7.2 Prerequisites for Moving a WebGate Agent From a Test to a Production Environment

Before continuing with the steps in this chapter, verify that you have completed the following requirements.

- Configuring the Web Server

- Copying the Oracle Access Management (OAM) Server

- Verifying the Test to Production Tools

- Verifying the JDK Version

7.2.1 Configuring the Web Server

You must install and configure the Web server in the production environment. The version and build numbers in the test and production environments must match.

7.2.2 Copying the Oracle Access Management (OAM) Server

You must copy the Access Manager Server configuration from the test environment to the production environment.

If you have installed Access Manager on Weblogic Server, see "Moving from a Test to a Production Environment" in Oracle Fusion Middleware Administering Oracle Fusion Middleware.

If you have installed Access Manager on IBM WebSphere, see "Moving Access Manager From a Test to Production Environment on IBM WebSphere" in Third-Party Application Server Guide.

7.2.3 Verifying the Test to Production Tools

Verify that the test to production (T2P) tools (also known as movement scripts) are available. The tools are available in the following location:

WebGate_Oracle_Home/webgate/webgate_agent/tools/WebGateT2P

The required scripts for UNIX environments are:

Ensure that you have the cloningclientwg.jar file.

- copyBinary.sh

- pasteBinary.sh

- copyConfig.sh

- pasteConfig.sh

For information about the scripts, see "Movement Scripts" in Oracle Fusion Middleware Administrator's Guide.

7.2.4 Verifying the JDK Version

Ensure that JDK 1.7 or later is installed.

Set the JAVA_HOME environment variable to the location of the JDK/JRE path. For example, export JAVA_HOME=/home/software/jdk1.7.0_34.

Note:
You can define a JAVA_HOME environment variable on your systems and use the -javaHome command option when you are running the test-to-production migration commands.

7.3 Replicating the WebGate Binary and Configuration From Test to Production

To copy the WebGate binary and WebGate configuration files, from a test environment to a production environment, do the following:

7.3.1 Replicating the WebGate Binary Files

To replicate the WebGate binary files, do the following:

1. In the test environment, create an archive of the binary by using the copybinary.sh script. The usage is as follows:
./copyBinary.sh [-javaHome Java_Home_Path ] -archiveLoc Archive_Dir -sourceOHomeLoc Source_WebGate_Oracle_Home

2. Move the archive created in step one to the production environment by using FTP.
Also, copy the WebGateT2P directory from the Test environment to the Production environment in preparation for the next step.

3. In the production environment use the pastebinary.sh script to extract the archive copied in the previous step. The usage is as follows:
./pasteBinary.sh [-javaHome Java_Home_Path ] -archiveLoc Archive_Dir -targetOHomeLoc Target_Oracle_Home_Location

7.3.2 Replicating the WebGate Configuration

To Replicate the WebGate configuration:

1. In the test environment, create an archive of the WebGate instance (the configuration) by using the copyConfig.sh script. A file named Moveplan.xml is created at the archive location.
The copyConfig script usage is as follows:

./copyConfig.sh [-javaHome Java_Home_Path ] -archiveLoc Archive_Dir -sourceInstanceHomeLoc Source_WebGate_Instance_Home

2. Move Moveplan.xml and the archive created in step one to the production environment by using FTP.

3. (Optional.) Open moveplan.xml for editing and update the following parameters. These parameter are used by the pasteConfig.sh script to configure the WebGate in the production environment.

Table 7-1 Configuration Parameters and Expected Value

Parameter Name

Expected Value

primaryOAMServerHost

Valid OAM server name

primaryOAMServerPort

Valid OAM server proxy port

WGOracleHome

WebGate Oracle home

WGInstanceDir

WebGate instance directory

WebServerConfigFile

File path to the Web server config file, for example httpd.conf or obj.conf.

4. Set the LD_LIBRARY_PATH and LIBPATH environment variables on the production system before running pasteConfig.sh.

5. In the production environment, run the pasteConfig.sh script to extract the WebGate archive that you copied in step two. The pasteConfig.sh script has two usage modes. Use the following mode if you have defined the configuration parameters in the moveplan.xml file:
./pasteConfig.sh [-javaHome Java_Home_Path ] -archiveLoc Archive_Location -movePlanLoc Path_to_the_ moveplan.xml_file

Or, to define the configuration parameters at the command line, use the following mode:

./pasteConfig.sh [-javaHome Java_Home_Path ] -archiveLoc Archive_Location -targetOHomeLoc Target_Oracle_home_location -targetInstanceHomeLoc An_empty_directory -webserverConfPath Web_server_configuration_path -oamHost OAM_server_host -oamPort OAM_server_port

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2016, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Alpha and Beta Draft Documentation Notice

If this document is in private preproduction status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.