Starting OID 11g with Upstart

If you read my post on Upstart a while ago you know that I'm a fan of Upstart.

But I hadn't sat down to redo my old (and crummy) OID/OVD start scripts to use Upstart until this week partly because "if it ain't broke don't fix it" but partly because who the heck has time?!

This week I needed to create a new environment to put together a demo of the Mobile side of OAM Mobile and Social and thought I'd take a few minutes to fix that. It didn't take all that long.

Here's my /etc/init/oid.conf

start on runlevel [345]

# This is good for debugging purposes but it's a bad idea to leave
# this on long term.
#console output

# this starts OPMN, OID and OVD
pre-start script
    /bin/su - oracle -c "/home/oracle/middleware/asinst_1/bin/opmnctl startall"
end script

# and this stops them
post-stop script
    /bin/su - oracle -c "/home/oracle/middleware/asinst_1/bin/opmnctl stopall"
end script

# note that I'm only starting the AdminServer here
exec /bin/su - oracle -- /home/oracle/middleware/user_projects/domains/IDMDomain/bin/startWebLogic.sh

Note: Because this is a little test environment and I want to keep the memory down and don't need DIP or a bunch of other stuff I simply moved ODSM from wls_ods1 to the Admin Server. That lets me run OID and ODSM without needing to start the wls_ods1 managed server.

Protecting Intranet and Extranet Applications with a Single OAM 11g Deployment

I frequently get asked how to setup a single OAM deployment to protect both intranet and extranet apps. Today I’d like to explore the issues and solutions around such a setup.

This post is part of a larger series on Oracle Access Manager 11g called Oracle Access Manager Academy. An index to the entire series with links to each of the separate posts is available.

X509 Fallback to Form

OAM 11G does not provide an out of box solution for falling back to FORM authentication if X509 Certificate is not available or if the certificate is not accepted by the user. I have seen this requirement coming from customers and found a solution after brainstorming with my colleagues (special thanks to Chris Johnson and Brian Eidelman). The solution is not very difficult, though it needs some additional configurations and coding.

It should be noted that this solution is not for the use case where the user's authentication is rejected due to an invalid certificate by OAM and then the user needs to fallback to a FORM for another authentication attempt.

Converting SSL certificate generated by a 3rd party to an Oracle Wallet

     

     Recently a customer asked me how to import his private key and certificate into an Oracle HTTP Server Wallet.

The customer generated a CSR outside the OHS Wallet Manager, using Open SSL, and sent it to a CA to get his certificates issued by them.

Unfortunately, the Wallet Manager only allows you to import certificates which were created for a CSR generated by the Wallet itself.

Despite this minor limitation, there is a workaround to get your private key, certificate and CA trusted certificates chain into Oracle Wallet.

This post explains the simple steps to achieve this, with a little help from Open SSL.

OAM/OVD JVM Tuning

Over the past few weeks I've been involved in several performance tuning exercises involving OAM and OVD.  I thought it would be helpful if I created a post sharing the process I use to analyse and improve performance in OVD and OAM.