View
235
Download
0
Category
Preview:
DESCRIPTION
Configuring ODI External User Authentication
Citation preview
ConfiguringODIExternalUserAuthenticationNote:Instructionsandanytextthatyouneedtomodifyareenclosedin.
Thistutorialcontainsthefollowingsections:
PurposeTimetoCompleteOverviewScenarioSoftwareandHardwareRequirementsPrerequisitesUseSQLDevelopertocreateanRDBMS(11g)Schema/UserforanewODIMasterRepositoryEdittheODIStudiojpsconfig.xmlFiletoPointtoYourExternalOIDLDAPServerSwitchtheMasterRepositoryAuthenticationModeBetweenExternalandInternalAuthenticationEditanODIStandaloneAgentjpsconfig.xmlFiletoPointtoYourExternalOIDLDAPServerUnderstandExternalUserAuthenticationinaJavaEEContextSummaryResources
Purpose
ThistutorialwalksyouthroughthestepsneededtoconfigureOracleDataIntegrator(ODI)forexternaluserauthentication.
TimetoComplete
Approximately20minutes
Overview
OracleDataIntegratorstoresalluserinformationaswellasusers'privilegesinthemasterrepositorybydefault.WhenauserlogsintoODI,itlogsinagainstthemasterrepository.ThisauthenticationmethodiscalledInternalAuthentication.
OracleDataIntegratorcanoptionallyuseOraclePlatformSecurityServices(OPSS),astandardsbasedandportablesecurityframeworkforJavaapplications,toauthenticateitsusersagainstanexternalIdentityStore,whichcontainsenterpriseusersandpasswords.Suchanidentitystoreisusedattheenterpriselevelbyallapplications,inordertohavecentralizeduserandpassworddefinitionsandSingleSignOn(SSO).Insuchaconfiguration,theODImasterrepositoryonlycontainsreferencestotheseenterpriseusers.ThisauthenticationmethodiscalledExternalAuthentication.
Note:WhenusingExternalAuthentication,onlyusersandtheirpasswordsareexternalized.ODIprivilegesremainwithintherepository.Dataserversandcontextpasswordsalsoremaininthemasterrepository.Itispossibletoexternalizedataserverandcontextpasswords,usingtheODIExternalPasswordStoragefeature.
ODIcanauthenticateitsusersagainstavarietyofexternalidentitystores,suchasOracleInternetDirectory(OID)LDAPServerorWebLogicServer.ThisOBEprovidesastepbystepwalkthroughoftheprocessofconfiguringODIwithOIDLDAPServer.Thestepsforconfiguringauthenticationwithotherexternalidentitystoresareverysimilar.
Note:ThestepstoconfigureODIexternaluserauthenticationarealsooutlinedintheODI11gDeveloper'sGuide.
Inthistutorial,youlearnhowto:
UseSQLDevelopertocreateanRDBMS(11g)Schema/UserforanewODIMasterRepositoryEdittheODIStudiojpsconfig.xmlfiletopointtoyourexternalOIDLDAPServerCreateanewODIMasterRepositoryusinganauthenticateduserintheexternalOIDLDAPServerSwitchtheMasterRepositoryauthenticationmodebetweenexternalandinternalauthenticationEditanODIstandaloneagentjpsconfig.xmlfiletopointtoyourexternalOIDLDAPServerUnderstandexternaluserauthenticationinaJavaEEcontext
Scenario
YouworkasadatabaseadministratorforGlobalEnterprise.InGlobalEnterprise,youareresponsibleformanagingthesecurityoftheOracleDataIntegratordevelopmentenvironment.InsteadofrelyingupontheinternaluserauthenticationavailableinODI,youwillestablishexternaluserauthentication,takingadvantageoftheuseraccountsmanagedbyyourcompany'scentralizedOIDLDAPServer.
SoftwareandHardwareRequirements
Thefollowingisalistofsoftwarerequirements:
Thesystemshouldincludethefollowinginstalledproducts:OracleDatabase11gOracleDataIntegrator11gRelease1AnexternalauthenticationprovidersuchasLDAP,OID,orWLS
Ifnotdonebefore,starttheservicesandcomponentsforOracleDatabase11g.
Prerequisites
Beforeyoustartthetasks,makesurethatyoursystemenvironmentmeetsthefollowingrequirements:
1. YouhaveinstalledOracleDatabase11g.Ifnotdonebefore,starttheservicesandcomponentsforOracleDatabase11g.
2. YouhaveinstalledOracleDataIntegrator11gRelease1.
. YouhaveinstalledanexternalauthenticationprovidersuchasLDAP,OID,orWLS.
UseSQLDevelopertocreateanRDBMS(11g)Schema/UserforanewODIMasterRepository
1. StartSQLDeveloperbyselectingStart>Programs>[OracleDatabasehome]>ApplicationDevelopment>SQLDeveloper.WhenSQLDeveloperopens,closetheLoggingPageLogtab.
2. InSQLDeveloper,createanewconnection.
3. Namethisnewconnection:Administrator.EnterSYSTEMforUsername.Enteroracle1forPassword.ForSID,enter:ORCL.CliskTest,andthenclickConnect.Click+toexpandconnectionAdministrator.
4. YouhavetocreatetheRDBMSschema/user(Oracle11g)fortheMasterrepository.TheschemascanbecreatedbyexecutingthefollowingSQLcommands:
createuseridentifiedbydefaulttablespacetemporarytablespacegrantconnect,resourceto
Where:correspondstothenameoftheschemathatyouwanttocreatecorrespondstothepasswordthatyougavecorrespondstotheOracletablespacewherethedatawillbestoredcorrespondstothetemporarydefaulttablespace
Inthisexample,tocreatetheuservishalformasterrepository,enterthefollowingcommand.ClickExecutestatementicon.
createuservishalidentifiedbyvishaldefaulttablespaceuserstemporarytablespacetemp
Note:Inthiscommand,vishalisthevalueofthepasswordtoconnecttotheuservishal.
EdittheODIStudiojpsconfig.xmlFiletoPointtoYourExternalOIDLDAPServer
Inthisexample,wearegoingtopointtoanexternalidentitystorethatisanOIDLDAPServer.Foryourpurposes,usethefollowinginstructionstopointtoyourownidentitystore,whichmightbeanOIDorWebLogicorotherLDAPServer.
Let'stakealookatatypicalOIDLDAPServer,whichhasausernamedSUPERVISORalreadydefined.Later,thisSUPERVISORuserwillbecomeourexternallyauthenticatedODIuser.
OracleDirectoryServicesManagercanbeusedtolookatthecontentsofanOIDLDAPServer:
Below,weseetheusernamedSUPERVISOR.LaterinthisOBE,wewillseehowtodefineanewODIMasterRepositoryusingthisexternallyauthenticatedSUPERVISORuser:
1. TheconfigurationtoconnecttoandusetheidentitystoreiscontainedinanOPSSConfigurationfilecalledjpsconfig.xmlfile.Editthejpsconfig.xmlfiletopointtoyourexternalOIDLDAPServer.
Note:Thefollowingsamplesectionfromajpsconfig.xmlfilepointstoanimaginaryOIDLDAPServer.Donotattempttocopythissampleliterallyforyourenvironment.RefertotheOracleFusionMiddlewareSecurityGuideformoreinformationoneditingyourjpsconfig.xmlfile.
Thesamplesection,below,fromajpsconfig.xmlfileshowsanLDAPServersectionadded,inwhichthecredentialsfortheLDAPServerareestablished:
user.search.bases
cn=users,dc=us,dc=oracle,dc=com
group.search.bases
cn=groups,dc=us,dc=oracle,dc=com
ReferencethisserviceinstanceinthedefaultJPScontextbyitsnameidstore.oidandalsoaddtheloginmoduleconfigurationasfollows:
Aftereditingthisfiletopointtoyourexternalidentitystore,copythefileintotheODI_HOME/oracledi/client/odi/bin/directory.TheODIStudioreadstheidentitystoreconfigurationandauthenticatesagainsttheconfiguredidentitystore.
Ifyouwanttolocatethisfileinadifferentlocation,edittheODI_HOME/oracledi/client/odi/bin/odi.conffileandedittheoptionthatsetsthelocationoftheconfigurationfile.Thisoptionissetinthefollowingline:
AddVMOptionDoracle.security.jps.config=./jpsconfig.xml
Bydefault,odi.confexpectsjpsconfig.xmltoresideinthesameexecutiondirectoryasodi.conf.
2. Runthescripttosetupthecredentialsforidstore.oidorotherLDAPintheidentitystore:
Navigatetowheretherun_credtoolscriptresidesinyourenvironment,perhaps/custom/FusionLibraries/tools.Runtherun_credtool.cmdorshscript.Whenthescriptpromptsforinput,defaultsareshownin[].
Entertheinputonthelinefollowingtheprompt.Thefollowing5linesshowyouwhichdefaultstotake.Inthe5thline,usethelocationpathwhereyourjpsconfig.xmlfileresides:
[input]Alias:[JPS][input]Key:[ldap.credential][input]UserName:cn=username[input]Password:password[input]JPSConfig:[ORACLE_HOME\custom\FusionLibraries\tools/../../../config/jpsconfig.xml]
Note:TheAliasandKeyinputmustmatchthevaluesusedintheserviceInstancesecurity.principal.aliasandsecurity.principal.keyrespectively.Again,refertotheOracleFusionMiddlewareSecurityGuideformoreinformationoneditingyourjpsconfig.xmlfile.
3. RestarttheWebLogicServerdomain.
CreateanewODIMasterRepositoryReferencingaUserintheExternalOIDLDAPServer
1. InthenextfewstepsyoucreatetheODIMasterrepository.StartOracleDataIntegrator:Start>Programs>OracleODI11gHome>OracleDataIntegrator>ODIStudio
2. OpentheNewGallerybychoosingFile>New.IntheNewGallery,intheCategoriestree,selectODI.SelectfromtheItemslisttheMasterRepositoryCreationWizard.ClickOK.TheMasterRepositoryCreationWizardappears.
3. IntheMasterRepositoryCreationWizard,selectthebrowseiconoftheJDBCDriverandthenselectOracleJDBCDriver.ClickOK.EdittheJDBCURLtoread:jdbc:oracle:thin:localhost:1521:orclEntertheUserasvishalandthePasswordasvishal.ClicktheTestConnectionbuttonandverifysuccessfulconnection.ClickOK.ClickNextontheMasterRepositoryCreationWizardscreen.
4. IntheAuthenticationwindow,selectUseExternalAuthentication.(IfyouhadselectedUseODIAuthentication,youwouldhavebeenusingODI'sinternalauthentication.)
EnterSupervisorUserandSupervisorPassword,astheyexistinyourexternaldatastoreinourcase,wearespecifyingtheuser"SUPERVISOR"inourOIDLDAPServer.ClickNext.
Note:UsernamesandpasswordsarecasesensitiveinODI.
5. InthePasswordStoragewindow,selectInternalpasswordStorage,andthenclickFinish.WhentheMasterRepositoryissuccessfullycreated,youwillseetheOracleDataIntegratorInformationmessage.ClickOK.TheODIMasterrepositoryisnowcreated.
6. YouconnecttotheODIMasterrepositorybycreatinganewODIMasterLogin.OpentheNewGallerybychoosingFile>New.IntheNewGallery,intheCategoriestree,selectODI.FromtheItemslist,selectCreateaNewODIRepositoryLogin.
7. ConfigureRepositoryConnectionswiththeparametersfromthetableprovidedbelow.
IntheOracleDataIntegratorConnectionsection,entertheUserandPasswordoftheauthenticateduserinyourexternalstore.Inthisexample,wespecifySUPERVISOR/SUNOPSISfromtheOIDLDAPServer.
IntheDatabaseConnection(MasterRepository)section,entertheUserandPasswordoftheschemauseryoucreatedforthemasterrepository.Inthisexample,wespecifyvishal/vishal.
ToentertheJDBCURL,clickthebuttonnexttoJDBCURLfieldandselectjdbc:oracle:thin:@::asshowninthescreenshot,thenedittheURL.SelectMasterRepositoryOnlybutton.ClickTestbutton.VerifysuccessfulconnectionandclickOK.ClickOKtosavetheconnection.
OracleDataIntegratorConnection
Parameter Value
LoginName MasterRepository
User SUPERVISOR
Password SUNOPSIS
DatabaseConnection(MasterRepository)
Parameter Value
User vishal
Password vishal
DriverList OracleJDBCDriver
DriverName oracle.jdbc.OracleDriver
Url jdbc:oracle:thin:@localhost:1521:orcl
Note:DonotcopyandpasteintheJDBCURLfield.ThismaycauseproblemswithenteringavalidURLstring.Instead,openthedropdownmenuandselectthecorrectdriverfromthelist.TypethecorrectURLintheURLfield.
SwitchtheMasterRepositoryAuthenticationModeBetweenExternalandInternalAuthentication
1. SwitchingtheauthenticationmodeoftheOracleDataIntegratorrepositorychangesthewayusersauthenticate.ThisoperationmustbeperformedbyaSupervisoruser.
WARNING:
WhenswitchingfromanExternaltoInternalauthentication,userpasswordsarenotcopiedfromtheidentitystoretotherepository.Thepasswordsarenullified.AlltheuseraccountsaremarkedasexpiredandmustbereactivatedbyaSUPERVISORthatiscreatedduringtheswitch.
WhenswitchingfromInternaltoExternalauthentication,theusersthatexistintherepositoryandmatchauserintheidentitystoreareautomaticallymapped.Usersthatdonotmatchauserintheidentitystorearedisabled.ASupervisormustedittheuserssothattheirnamehasamatchintheidentitystore.
Thecontextpasswordsarelost.Passwordsfordataservers,jdbcpasswordoftheworkrepository,andESSrelatedpasswordsareremovedfromtheircredentialstore.
UsetheSwitchAuthenticationModewizardtochangetheuserauthenticationmode.
BeforelaunchingtheSwitchAuthenticationModewizardperformthefollowingtasks:
DisconnectOracleDataIntegratorStudiofromtherepository.
ShutdowneverycomponentusingtheOracleDataIntegratorrepository.
TousetheSwitchAuthenticationModewizard:
FromtheODImainmenu,selectSwitchAuthenticationMode.
TheSwitchAuthenticationModewizardappears.
2. SpecifytheJDBCconnectivitydetailsofyourOracleDataIntegratormasterrepositoryasdefinedwhenyouconnectedtotheMasterRepository.
ClickNext.
3. Thenextactionvaries,dependingonthecurrentAuthenticationModeinuse:
IfcurrentlyusingInternalAuthentication,youarepromptedtoswitchtoexternalauthentication.IfcurrentlyusingExternalAuthentication,youarepromptedtoswitchtointernalauthentication.YoumustprovideandconfirmapasswordfortheSUPERVISORuserthatthewizardwillautomaticallycreateintherepository.
ClickFinish.
TheAuthenticationmodeischanged.
Ifyouhaveswitchedfromexternaltointernalauthentication,youcannowreconnecttotheOracleDataIntegratorrepositoryasSUPERVISOR,withthepasswordyouhaveprovidedinthewizard.Onceconnected,youcanediteachusertoreactivateitandsetapasswordforthisuser.Ifyouhaveswitchedfrominternaltoexternalauthentication,youcannowreconnecttotheOracleDataIntegratorrepositoryasoneoftheuserswithsupervisorprivileges,andreenabletheOracleDataIntegratorusersthathavebeendisabledduringtheswitch.
4. ReactivatingUsersAfterSwitchingtoInternalAuthentication
ToreactivateaUser:
1. InSecurityNavigatorexpandtheUsersaccordion.2. Selecttheuserthatyouwanttoreactivatefromthelistofusers.3. RightclickandselectEdit.TheUsereditorappears.4. UnselectAllowExpirationDate.5. Ifyouwanttosetapasswordforthisuser,clickChangePasswordandenterthenewpasswordforthis
user.6. FromtheFilemainmenu,selectSave.7. ReEnableUsersAfterSwitchingtoExternalAuthentication.
ToreenableaUser:
1. InSecurityNavigatorexpandtheUsersaccordion.2. Selecttheuserthatyouwanttoreenablefromthelistofusers.3. RightclickandselectEdit.TheUsereditorappears.4. IntheNamefield,enterausernamethatmatchestheloginofanenterpriseuserintheidentitystore.5. ClickRetrieveGUID.Iftheusernamehasamatchintheidentitystore,thisexternaluser'sGUIDappearin
theExternalGUIDfield.6. FromtheFilemainmenu,selectSave.
EditanODIStandaloneAgentjpsconfig.xmlFiletoPointtoYourExternalOIDLDAP
Server
1. AcommontaskusingODIistosetupandinstallODIagents.AftertheODIscenariosarecreated,theycanbescheduledandorchestratedusinganODIagent,whichisalightweightJavaprocessthatorchestratestheexecutionofODIscenarios.
Forstandaloneagents,theconfigurationtoconnectandusetheexternalidentitystoreiscontainedinacopyofthesameOPSSconfigurationfilejpsconfig.xmlthatyouusedtoconfiguretheODIStudio.
However,youneedtoplacethecopyofthisfileforstandaloneagentinadifferentfolder.CopythisfiletotheODI_HOME/oracledi/agent/bin/directory.Theagentandthecommandlinescriptswillauthenticateagainsttheconfiguredidentitystore.
RefertotheOracleFusionMiddlewareSecurityGuideformoreinformation.
2. Edittheodiparams.shfile,enteringappropriatevalues,suchas:
ODI_MASTER_DRIVER=oracle.jdbc.driver.OracleDriverODI_MASTER_URL=jdbc:oracle:thin:@localhost:1521:nrdbODI_MASTER_USER=EAMASTERODI_MASTER_ENCODED_PASS=gxfpqkz074jeaCpL4XSEFzxoj8E0pODI_SECU_WORK_REP=WORKREP1ODI_SUPERVISOR=SUPERVISORODI_SUPERVISOR_ENCODED_PASS=fJya.vR5kvNcu9TtV,jVZEt
3. Toencodethepassword:/oracledi/agent/bin/encode.sh
UnderstandExternalUserAuthenticationinaJavaEEContext
1. OracleDataIntegratorcomponentsdeployedinacontainer(JavaEEAgent,OracleDataIntegratorConsole)donotrequireaspecificconfiguration.Theyusetheconfigurationoftheircontainer.
RefertotheOracleFusionMiddlewareSecurityGuideformoreinformationonOPSSconfigurationinaJavaEE
context.
InJRFenabledJ2EEcontainers(AgentinWebLogicServer[WLS]):ConfigureJavaRequiredFiles(JRF)onWLS.AssoonasyouconfigureyourJ2EEcontainer(currentlyonlyWLSissupported)withJRFenabled,OPSSwillbeconfiguredfortheapplicationdeployedinside.Bydefault,OPSSisconfiguredtousetheWLSinternalLDAPIdentityStore.YouneedtoconfigureanewAuthenticatorinsideWLSifyouwanttouseanexternal,centralOID.
UsefulresourcesIntroductiontoOraclePlatformSecurityServices:
http://download.oracle.com/docs/cd/E12839_01/core.1111/e10043/underjps.htm
OPSSConfigurationFileReference:
http://download.oracle.com/docs/cd/E12839_01/core.1111/e10043/apjpscfg.htm#BEHDBJED
SummaryInthistutorial,youhavelearnedhowto:
UseSQLDevelopertocreateanRDBMS(11g)Schema/UserforanewODIMasterRepositoryEdittheODIStudiojpsconfig.xmlfiletopointtoyourexternalOIDLDAPServerCreateanewODIMasterRepositoryusinganauthenticateduserintheexternalOIDLDAPServerSwitchtheMasterRepositoryauthenticationmodebetweenexternalandinternalauthenticationEditanODIstandaloneagentjpsconfig.xmlfiletopointtoyourexternalOIDLDAPServerUnderstandexternaluserauthenticationinaJavaEEcontext
ResourcesOracleDataIntergator11gDocumentationTolearnmoreaboutotherOracleproducts,refertoadditionalOBEsintheLearningLibrary.
AboutOracle|OracleandSun| |Careers|ContactUs|SiteMaps|LegalNotices|TermsofUse|YourPrivacyRights
Recommended