OIM 11g LDAPSync Deployment Guidelines

OIM 11g can be configured to maintain its user and role population synchronized with an LDAP directory using the LDAPSync feature.  This functionality is based on asynchronous processing through orchestration events from OIM to LDAP and on scheduled tasks for synchronization from LDAP to OIM.  This approach could mean that at some point in time, some of the entries on both repositories may be out-of-sync.  Specially when executing long running Trusted Reconciliation scheduled jobs.  The entry differences can be caused by processing errors or time lapse between user creation in OIM and user creation in LDAP.  This post details some guidelines to minimize and troubleshoot possible errors for OIM LdapSync.

Consider upgrading to OIM 11.1.1.5.2 (OIM 11g Bundle Patch 02).  BP02 provides a number of fixes that improve stability specially during bulk processing (large trusted reconciliations).

Tuning and Tips

Tune the environment to allow for better ldapsync performance when executing large trusted reconciliation jobs in the order of +30K.  These are some tuning tips, some of them straight from the documentation, others from existing deployments.

OIM Tuning

1. JVM:  PORT_MEM_ARGS="-Xms768m -Xmx2048m" in setSOADomainEnv.sh

2. MDBs: In WLS Admin Console -> Environment->Worker Managers->MaxThreadsConstraints-1  set count to 100

3. Disable reloading of Adapters:  Using weblogicExportMetadata.sh and weblogicImportMetadata.sh edit the MDS file /db/oim-config.xml.  

   Replace:

     <ADPClassLoaderConfig adapterReloadingEnabled="true" loadingStyle="ParentFirst" reloadInterval="15"     reloadingEnabled="true">

   With:

    <ADPClassLoaderConfig adapterReloadingEnabled="false" loadingStyle="ParentFirst" reloadInterval="15" reloadingEnabled="false">

   And

    <storeConfig reloadingEnabled="true" reloadingInterval="20"/>

   With:

   <storeConfig reloadingEnabled="false" reloadingInterval="20"/>

4. Database:  Monitor Perfomance with AWR reports and collect complete schema statistics using:

                  DBMS_STATS.GATHER_SCHEMA_STATS(OWNNAME=> schema_owner,

                                                                                              ESTIMATE_PERCENT=>DBMS_STATS.AUTO_SAMPLE_SIZE,

                                                                                              DEGREE=>8,

                                                                                              OPTIONS=>'GATHER AUTO',

                                                                                              NO_INVALIDATE=>FALSE);

OID Tuning

1. Consider deploying multiple OID instances for Failover and Load Balancing. Front end the instances with an LB
2. Number of OID LDAP Server Processes = #cpus. EM -> Administration -> Server Properties -> Performance ( for each oid instance)
3. Number of DB Connections per Server Process = 10 (orclmaxcc). EM -> Administration ->server properties (for each oid instance)
4. Check Skip Referral for Search. EM -> Administration -> Shared Properties (Only if not using referrals in OID).

OVD Tuning (assuming no libOVD is used)

1. Consider deploying multiple OVD instances for Failover and Load Balancing. Front end the instances with an LB and use the OID LB virtual host as the LDAP server host.
2. The parameter Operations Timeout for the Adapters to 30000 if needed (using ODSM)
3. Consider increasing maxpoolsize  for the Adapters to 30-40 if needed (using ODSM)

LDAPSync Monitoring

During the time when the LdapSync Orchestration is running check the following tables and columns in the OIM Schema to verify processing:

Obtain the latest reconciliation job key (RJ_KEY) with the query:

        select max(RJ_KEY) from recon_events;

Table RECON_BATCHES:  using RJ_KEY and RB_NOTE verify that the orchestration events are being created.  The Column RB_NOTE shows the orchestration Process ID and the operation.  It could also show errors that occur.

Table ORCH_PROCESS:  Holds the generated orch processes.  ID being the Orchestration Process ID.  If Status shows Compensated it means that an event failed.  The detail can be seen in the table ORCH_EVENTS.

Table ORCH_EVENTS:  Linked to the orchestration process with the column PROCESSID.  The RESULT column has the error details in case of failure.

The Out-of-the-Box reconciliation job " Retry Failed Orchestrations " can be used to retry compensated orchestration processes.   Specify a date range ("ddMMyyyy") for multiple ones or "Orchestration ID" for single ones.  OIM BP02 also includes fixes for this task.

Note:  In the case when reconciling new users that come as disabled, an existing bug may create the orchestration disable event before the orchestration create event.  So, these disable events would fail in LDAP since the user doesn't exist yet.  As a workaround, these events can be retried with the above Recon Job (specify OPERATION=DISABLE and a date range) after all users are created in LDAP.

Peripheral Responsibilities Required for Large IDM Build Outs (Including Fusion Apps)

Complexity and delay can occur during deployments of Oracle Identity and Access Management products (including the IDM build out for Fusion Apps) due to the fact that certain tasks required for the build out can sometimes only be performed by individuals that are not a part of the core team doing the deployment.

In many organizations IT responsibilities are very siloed. Some tasks during an IAM deployment may require assistance from individuals that operate in silos that are different from the team doing the deployment itself.

It is important to identify these tasks up front. When possible it is a good idea to make as many of these tasks as possible pre-requisites to the actual onsite installation/deployment. When that is not possible, then it is important to line up the assistance that will be required from role players who are outside of the core install/deployment project team to perform tasks that require their help.

The following are examples of such tasks:

Network

1. Provisioning of virtual hosts and VIPs.

2. Configuration of load balancers.

DB

1. Provisioning of DB including install, configuration, and creation of instances.

2. Running the RCU.

3. DB backups

Machine and Storage Provisioning

Provisioning shared storage and machines required for install. Provisioning of machines themselves including the installation and patching of OS. You’d think this would go without saying, but I’ve seen enough projects get delayed due to a lack of machines and storage that I feel I have to mention it.

Root Access

Root access is required during the creation of oraInventory and at several points during the web tier, OID, and OVD install. It is also required to do environment (file system) backups if backup is done as dictated by the EDG. One possible alternative is to do the backup as the install user and then separately backup the few files that are owned by root which do not change from the early stages of the install.

Certificates – PKI Administration

People often forget about the creation of certificates needed for SSL connections and web services security until they are actually needed. The trouble is that in many organizations, the team of people that create certificates for the organization is often small and the process by which certificates are requested and granted can take time. I recommend that when possible certificates be requested and created in advance.

When the request must come from a software component that is being installed as part of the deployment, it is still a good idea to talk to your PKI administrators in advance to make sure that the procedure for issuing the request is clear and to give them a heads up that you’d like the certificate issued as quickly as possible.

ADF Security and OPSS Policies – Sample Application

In the January / February issue of Oracle magazine, Frank Nimphius wrote a good article on ADF security and OPSS policies.  The article includes a good sample application that utilizes ADF and OPSS security, along with a pretty thorough explanation of how the sample application works and was created.  You can find the article which includes a link to the sample application download here.

OAM 11g Single Sign-On and OAM 10g Cookies

This post is part of a larger series on Oracle Access Manager 11g called Oracle Access Manager Academy. An index to the entire series with links to each of the separate posts is available.

In an earlier post I talked about how cookies work when you're using OAM 11g server with OAM 11g WebGates. But the OAM 11g server also works with OAM 10g WebGates and there are reasons you'd deploy 10g WebGates today. But OAM 11g and 10g have fundamentally different behavior when it comes to the cookies.

So how do cookies work when you're using 10g WebGates with the 11g server?

Planning an IDM Build Out for Fusion Apps Part 2 – Pre Build Out Checklist

In my last post I listed all of the architectural decisions that you’ll want to work through before diving into an IDM build out for Fusion Apps.

In this post, I’d like to take things one step further and put forth a checklist of tasks that you’ll want to accomplish before beginning the actual (onsite) build out.

Failure to complete these items before the build out will turn what is already a fairly long and intensive process into a longer and frustrating process. You want to make sure going into the actual build out that you have all the necessary hardware, software, and skill pre-requisites to ensure success.

The IDM build out for Fusion Apps and the Fusion Apps install in general is really a project where advance planning with pay off in spades.

So with that being said, I give you my list: