Downloaded 84 times
Uploaded byForgeRock
Case Study: Plus Retail - Moving from the Old World to the New World
The document outlines a case study on integrating OpenAM within an Oracle environment, detailing the infrastructure, components, and processes involved in implementing single sign-on (SSO) solutions. It discusses the transition from legacy Oracle systems to modern applications, highlighting the necessity of custom plugins and configurations to facilitate SSO across various platforms. The case study emphasizes the strategies used for seamless integration of on-premises and cloud applications while ensuring robust security and user management.
More Related Content
Similar to Case Study: Plus Retail - Moving from the Old World to the New World
Case Study: Plus Retail - Moving from the Old World to the New World
- 1. 2013 Open StackIdentity Summit - France OpenAM in an Oracle Environment Case Study
- 2. BIO • Whoami • Kurt Van Meerbeeck • • • Workingwith java since 1996 (jdk1.0.x) Working with Oracle products since 1997 (Oracle 7, OAS 3, Forms 3.x) Currently work for AXI NV/BV • • • Oracle | IBM | ForgeRock partner Database & Middleware consultant [email protected] www.axi.be
- 3. History Internet Application Server9i (IAS9i) Internet Application Server 10g (IAS10g) Fusion Middleware 11g (FMW/WLS) www.axi.be
- 4. IAS Architecture • Infrastructure Tier • • OID(LDAP) • OC4J (Orion J2EE) • OCA • SSO Server • • OHS : apache 1.3, mod_oc4j, mod_plsql, mod_osso RDBMS Multiple Middle Tiers • • OC4J • Oracle Forms, Reports, Discoverer • www.axi.be OHS : apache 1.3, mod_oc4j, mod_plsql, mod_osso Oracle Portal
- 5. OSSO flow apache J2ee MID.axi.be Mod_osso http://my.company.com Apache virtualhost - Make it a SSO partner app - ossoreg.jar – mod_osso - mod_osso.conf <location /app> require valid-user AuthType basic </location> Mod_oc4j Mod_plsql apache J2ee Mod_osso Oc4j_security oca Mod_oc4j Mod_plsql OID LDAP INFRA.axi.be IASDB www.axi.be
- 6. OSSO flow apache Partner cookieavailable ? http://my.company.com J2ee MID.axi.be Mod_osso Mod_oc4j Mod_plsql infra.axi.be/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=<y> NameVirtualHost *:80 <VirtualHost *:80> ServerName my.company.com Port 80 # Include the configuration files # needed for mod_osso OssoConfigFile /OH/my_comp_osso.conf </VirtualHost> SSO cookie ? -> Generate Redirect to logon page http://infra.axi.be/sso/jsp/login.jsp $OH/sso/policy.properties www.axi.be apache J2ee Mod_osso Oc4j_security oca Mod_oc4j Mod_plsql OID LDAP INFRA.axi.be IASDB
- 7.
- 8. OSSO flow apache J2ee MID.axi.be Mod_osso http://my.company.com HTTP POST - Username Generate Partner cookie - Password Generate redirect to the original URL - Site-token (sitetoken) Check credentials in LDAP/OID Mod_oc4j Mod_plsql apache J2ee Mod_osso Oc4j_security oca Mod_oc4j If OK Mod_plsql - Generate SSO cookie (SSO_ID) - Generate redirect to http://my.company.com/osso_login_success?urlc=<sitetoken> www.axi.be OID LDAP INFRA.axi.be IASDB
- 9. Custom Plugins IPASAuthInterface apache implements SSOServerA uth Custom Plugin Mod_osso Mod_oc4j Mod_plsql http://my.company.com extends SSOX509CertA uth J2ee SSOKerbeAuth apache J2ee Mod_osso Oc4j_security oca Mod_oc4j Mod_plsql OID LDAP CustomPlugin Important for integration - Custom plugins by subclassing OSSO server www.axi.be MID.axi.be INFRA.axi.be IASDB
- 10. Oracle 11g FMW/ WLS • Problem FMW • • www.axi.be No Infrastrure tier No SSO/OID/WNA
- 11. Desupport notice • PremierSupport for Oracle Single Sign-On 10gR3 ends on December 31, 2011 • Limited Extended Support for Oracle Single Sign-On from January 2012 through December 2012 • It is strongly recommended that you use this additional time to integrate your single sign-on deployment with Oracle Access Manager www.axi.be
- 12. Oracle Access Manager Extralicenses and server [ [ Oracle Weblogic Server [ www.axi.be Oracle Access Manager Directory Services Plus
- 13.
- 14. PLUS Retail Migrating toOpenAM Customer Case www.axi.be
- 15. Requirements - integrate withlegacy IAS/OSSO - Portal 10g - Forms 10g - OC4J - OBIEE 10g - integrate with Forms 11g (FMW/WLS) - special case as Forms *needs* OID - integrate with OBIEE 11g (FMW/WLS) - integrate with J2EE apps (FMW/WLS) - integrate apps in the cloud using federated authentication www.axi.be
- 16. Overview Legacy environment LDAP sync OpenAM OpenDJ AXI OSSO-OpenAM Integration (customosso plugin) Linux Server (cluster) Tomcat J2EE Server Custom plugins SSO using SAMLv2 LDAP sync Oracle SSO Server SSO using OpenAM Policy agents Oracle 10g Infrastructure New environment SSO using Oracle SSO server J2EE Policy agent LAMP in de CLOUD • SAMLv2 • Service Provider www.axi.be Oracle 11g Weblogic • Forms 11g • J2EE • OBIEE 11g Oracle 10g Midtiers • Forms 10g • Portal 10g • J2EE • OBIEE 10g
- 17. Create an HAOpenAM Environment www.axi.be
- 18. sso.axi.be:80 http loadbalancer snsrv615:8080 Master-master replication snsrv616:8080 ldap.axi.be:389 Tcploadbalancer snsrv615:1389 www.axi.be Master-master replication snsrv616:1389
- 19. Logical Overview Active/passive cluster Syncconfig Apache2.2 RP Apache2.2 RP L7 LB HAProxy Active/passive cluster Active/active cluster Session replication OpenAM OpenAM HAProxy L4 LB Active/active cluster Multimaster replication OpenDJ www.axi.be OpenDJ
- 20. Integrate OSSO using acustom plugin www.axi.be
- 21. Legacy environment LDAP sync OpenAM OpenDJ LinuxServer (cluster) Tomcat J2EE Server AXI OSSO-OpenAM Integration (custom osso plugin) LDAP sync Oracle SSO Server public class OpenAMAuth extends SSOServerAuth Oracle 10g Infrastructure IPASAuthInterface SSO using Oracle SSO server implements SSOServer Auth Custom Plugin extends SSOX509Cert Auth SSOKerbeAuth Custom Plugin www.axi.be Oracle 10g Midtiers • Forms 10g • Portal 10g • J2EE • OBIEE 10g
- 22. Legacy environment LDAP sync OpenAM OpenDJ LinuxServer (cluster) Tomcat J2EE Server AXI OSSO-OpenAM Integration (custom osso plugin) LDAP sync Oracle SSO Server Oracle 10g Infrastructure SSO using Oracle SSO server Oracle 10g Midtiers • Forms 10g • Portal 10g • J2EE • OBIEE 10g www.axi.be
- 23.
- 24. Oracle Forms • RAD– Oracle Developer / Designer - productivity • Large install base • Many incarnations • Server-side character based (terminal) • C/S • Web based www.axi.be
- 25.
- 26. Oracle Forms Forms is*SPECIAL* - It will check the version of OID in SSO mode ! - What if you want to get rid of OID ??? Osso-user-dn Osso-subscriber-dn Extra LDAP queries [ RAD’s [ Root DSE orcldirectoryversion www.axi.be
- 27. Oracle Forms • Formsis *SPECIAL* - Forms 11g can be plugged into an OID LDAP - What if we could mimic OID using OpenDJ 1. Recreate OID LDAP schema in OpenDJ (ldapsearch) 2. Add orcldirectoryversion to OpenDJ root DSE 3. Plugin Forms11g into OpenDJ !!! www.axi.be
- 28. Oracle Forms Forms is*SPECIAL* but can make use of OpenAM/OpenDJ without OID Osso-user-dn Osso-subscriber-dn Extra LDAP queries [ RAD’s [ Root DSE orcldirectoryversion www.axi.be
- 29.
- 30. OBIEE 11g • OBIEE11g runs on top of WLS - Makes use of Oracle Platform Security Services - Switch from embedded ldap to OpenDJ (iplanetAuthenticator) - Configure http header identity asserter (Generic SSO) - Configure OpenDJ (OBIEE groups / BIAuthor, BIAdministrators, etc) - Deploy OpenAM J2EE Policy Agent - Modify OIBIEE analytics war to add J2EE filter (redeploy) - Resync identity GUID attribute with OpenDJ - Modify RPD to use LDAP in initialisation blocks www.axi.be
- 31. OBIEE 11g http headerid asserter Generic SSO OBIEE 11g / WLS 6 1 2 Apache rp/ssl 5 DefaultAuthenticator OPSS ID store Policy store Credential store OBI OpenAM J2EE policy agent (J2EE filter) IPlanetAuthenticator 3 7 OpenAM www.axi.be 4 OpenDJ OpenDJ LDAP LDAP Embedded LDAP
- 32.
- 33. OpenAM as SAMLIdP • PLUS Retail & cloud applications • MS .NET (fedlet) • LAMP (SimpleSAMLphp) • MS Azure (ADFS) • Custom SAML attribute mapper • Using JDBC <-> Oracle RDBMS www.axi.be
- 34. OpenAM as SAMLIdP At this point … Users logged on to legacy Oracle applications Policy Agents Policy Agents Policy Agents Internal app servers … SAML Identity Provider (IdP) OpenAM cluster https://idp.axi.nl can seamlessly log on to new cloud based apps using SSO !!! www.axi.be AXI SAML based SSO External app servers SAML SP SAML SP SAML SP
- 35. In conclusion • Opensolution for PLUS providing extreme flexibility • Hooks – custom SAML attribute mapper • Custom Auth modules • Bridging between • legacy and new Oracle applications • Internal and cloud based applications www.axi.be
- 36.