So you want to setup Windows Native Authentication with your Oracle Access Manager 11g implementation. According to the documentation, it’s pretty straightforward and simple. And it is =)

The royal pain in the ass comes when something fails and you don’t know why. You’re going to receive 1 of 4 generic errors that when googled will give you all kinds of possible causes. I’m going to give you some more =)

Here’s the common error’s you may receive:

- kinit(v5): KDC has no support for encryption type while getting initial credentials
- kinit(v5): Key table entry not found while getting initial credentials
- kinit(v5): No such file or directory while getting initial credentials
- kinit(v5): Client not found in Kerberos database.

Instead of going into the rhetoric, I’m just going to bullet out the different issues I ran into and their fixes in order of the Oracle setup doc. Hopefully they’ll help someone else out down the road!

1. Your krb5.conf file can be a host of problems.

- First make sure that all the REALM parts are in CAPITAL LETTERS ALWAYS AND EVERYWHERE. Anytime you use the realm name (in the krb5 file, krpass commands, anywhere…) it must be in caps. This is not a host name. All the hostname parts that are in lowercase are actual hostnames (or suffixes) of the box your on.

- Encryption types between your nix box and the AD server can cause problems. If AD isn’t Windows 2008 R2 (yes… R2), you’re going to experience issues. Like until R2, any authentication will fail of the SPN has a “/” in it (which they all do for us here). To help with the encryption problems, put these two lines in your [libdefaults] section:

default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5

- The example in the Oracle guide is painful to understand if you have no clue what your doing. Also the default port for Kerberos authentication is 88. I just put it there explicitly because I rock like that. Here’s mine:

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = CORP.DOMAIN.COM
ticket_lifetime = 600
dns_lookup_realm = true
dns_lookup_kdc = true
default_tkt_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5
default_tgs_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5

[realms]
CORP.DOMAIN.COM = {
kdc = addc1.corp.domain.com:88
admin_server = addc1.corp.domain.com:88
default_domain = CORP.DOMAIN.COM
}

[domain_realm]
.corp.domain.com = CORP.DOMAIN.COM
corp.domain.com = CORP.DOMAIN.COM

2. Creating the Service Principal Name

- A simple one line command right? HA! N00Bs beware =). When you run this command on the AD server, the password you provide will SET the password for that account to whatever you put. So don’t guess if you’re modifying an existing service account!

- If your password has some crazy characters or spaces in it, you’ll need to wrap it in quotes

- If you receive the error “DsCrackNames returned 0×2 in the name entry for [username]. ktpass:failed getting target domain for specified user.” This just means you need to add the domain to the username like “DOMAIN\username”

- Here’s the command I run that works. notice the “HTTP/oamserver.corp.domain.com@CORP.DOMAIN.COM”. Yes. That’s how it should be, and yes the REALM needs to be in CAPITALS:

C:\>ktpass -princ HTTP/oamserver.corp.domain.com@CORP.DOMAIN.COM -pass “c0mpl3x P455w0rd!” -mapuser DOMAIN\username -out c:\temp\keytab.service

- Now that you have your keytab.service file you should be able to get the Kerberos ticket from the AD server with the kinit command. Here’s an example that flows with the rest of the config I’ve given so far:

kinit -V HTTP/oamserver.corp.domain.com@CORP.DOMAIN.COM -k -t keytab.service

- The REALM must be in CAPS here too

Here’s where you’re going to get the majority of your errors too. I’ll try to help here.

kinit(v5): KDC has no support for encryption type while getting initial credentials

- run “klist -ke keytab.service” to see what level of encryption is setup for your file
- verify that it’s one in the list in your krb5.conf file
- Make sure your AD administrator didn’t check “Use Kerberos DES encryption types for this account”. This will cause it to fail.
- If all else fails, regenerate your keytab.service file with the “-crypto All” flag at the end to get all encryption keys

kinit(v5): Key table entry not found while getting initial credentials

- Make sure your AD administrator didn’t check “Use Kerberos DES encryption types for this account”. This will cause it to fail.
- Verify that the HTTP/host@REALM is the same in the keytab.service file matches the FQND of the OAM server and the REALM is in caps and matches what’s in your krb5.conf file

kinit(v5): No such file or directory while getting initial credentials

- The path to your keytab.service file is wrong

kinit(v5): Client not found in Kerberos database.

- Make sure that there is only 1 account in AD that has the SPN of your HTTP/host@REALM. If there is more than one account set to the SPN authentication will fail. You can issue these two commands to verify:

c:\setspn -Q HTTP/oamserver.corp.domain.com
ldifde -f c:\upn_out.txt -d “DC=domain,DC=com” -l * -r “(userprincipalname=HTTP/oamserver.corp.domain.com@CORP.DOMAIN.COM)” -p subtree -s addc1.corp.domain.com
(if you don’t have the ldifde.exe file, google: ldifde.exe “index of”

- You can also verify things with:

kinit [username]

You’ll be prompted for the password. If it’s correct you’ll be dropped to the prompt. If wrong, you’ll receive an error. If that works, then try:

kinit HTTP/host@REALM

You’ll again be prompted for the password for the account it’s attached to. If successfull you’ll be dropped to the prompt. If wrong, you’ll receive an error.

If that works, and kinit with the keytab file fails it’s something in the keytab file or a setting on the AD server.

Lastly, let’s say you don’t like the auto-failover to Basic authentication when WNA fails. Well… there’s no way to change it. Sorry. As per Oracle support, “it’s supposed to work that way”. The actual auth scheme is packaged together when sent to the user. So when WNA fails to get the SPNEGO token, it doesn’t go back to the WebGate or OAM server for a secondary authN scheme or use the Login Failed Redirect URL. It just immediately prompts the user with the popup box.

That’s all I got, but I haven’t found these answers for OAM-WNA integration specifically in one place, so hopefully this’ll save some people some time =)

Cheers!

.: Adam

After much Face<-->Keyboard and an Oracle Support ticket, it’s official! In Oracle Access Manager 11g (11.1.1.5), The Authentication Failure URL Redirect doesn’t work.

Awesome.

You’re not doing anything wrong. You’re not crazy. That box above your Authentication policy that says “Failure URL” is just there to tease you of funcationality that used to work before someone borked it.

Cheers!

.: Adam

Playing around with OAM 11g, I ran into a pain-point (slight downs moment on my end) where I couldn’t get the default identity store to work for any of my webgates, no matter what I tried. Here is an overview of my example:

I setup an Identity Store called ID1 and it points to an Active Directory
I setup a second ID store called ID2 and it points to OID.

Initially, OAM works fine as ID1 is set as the default and test user from AD is able to login.

When I enter the OAM admin console and change the user identity default store to ID2, none of the users in OID are able to login, but users from AD are still authentication successfully.

The little green flag is on the OID identity store, but out authentication policy it’s not acutally using it.

After a couple masterful head > keyboard moves, it finally hit me “Default” store. Meaning there’s got to be a we to select one in particular if needed. Is it in the Oracle Access Manager 11g documentation? Maybe, but I couldn’t find it.

Next step, look into every option of every piece of OAM.

Result… I found it =)

- Click on the System Configuration tab
- Expand Authentication Modules
- Double-click the module being used by your Authentication Scheme
- Select the Identity Store of your liking in the drop-down and click Apply

And now the webgate will authenticate from the newly selected Identity Store instead of the default one!

.: Adam

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 10 – Starting Oracle Database and Directories

This video tutorial will walk you though differnt ways to startup and stop various database and directory services.

FIN

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 9 – WebLogic Server and Domain Start-up Options

This video tutorial will walk you though ways to startup and stop the WebLogic Server and WebLogic domains.

Next >> Part 10 – Starting Oracle Database and Directories

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 8 – Configuration of Oracle Identity Manager 11g

This video tutorial will walk you though the configuration of Oracle Identity and Access Manager 11g. These tools include:

• Oracle Access Manager 11g
• Oracle Adaptive Access Manager 11g
• Oracle Identity Navigator 11g
• Oracle Identity Manager 11g
• Platform Security Services
• Authorization Policy Manager

Next >> Part 9 – WebLogic Server and Domain Start-up Options

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 7 – Installing Oracle Identity and Access Manager 11g

This video tutorial will walk you though the installation of Oracle Identity and Access Manager 11g. These tools include:

• Oracle Access Manager 11g
• Oracle Adaptive Access Manager 11g
• Oracle Identity Navigator 11g
• Oracle Identity Manager 11g
• Platform Security Services
• Authorization Policy Manager

You will need to download the 1.7GB Oracle Identity and Access Management (11.1.1.3.0) Generic Installer (ofm_iam_generic_11.1.1.3.0_disk1_1of1.zip).

Download Oracle Identity and Access Management

Next >> Part 8 – Configuration of Oracle Identity Manager 11g

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 6 – Installing and Patching the SOA Suite 11g

This video tutorial will walk you though the installation and patching Oracle’s SOA Suite 11g.

You will need to download two files, the 1.7GB SOA Suite (11.1.1.2) Generic Installer (ofm_soa_generic_11.1.1.2.0_disk1_1of1.zip), and the 1.9GB SOA Suite (11.1.1.3) Generic Installer with Business Process Management (11.1.1.3.0) for the patchset.

Download Oracle SOA Suite 11g and Patchset Here

Next >> Part 7 – Installing Oracle Identity and Access Manager 11g

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 5 – Installing, Patching, and Configuring Oracle Identity Management 11g

This video tutorial will walk you though the installation and configuration of Identity Management 11g. This includes:

• Oracle Internet Directory 11g
• Oracle Virtual Directory 11g
• Oracle HTTP Server
• Directory Integration Platform
• Directory Services Manager
• Identity Federation 11g
• Security Developer Tools
• Enterprise Manager Fusion Middleware Control

You will need to download the 962MB Identity Management (11.1.1.3.3) x86 Installer for Linux (ofm_idm_linux_11.1.1.3.0_32_disk1_1of1.zip)

Download Oracle Identity Management (11.1.1.3.0) Here

Next >> Part 6 – Installing and Patching the SOA Suite 11g

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 4 – Executing and Configuring the Repository Creation Utility 11g

This video tutorial will walk you though the execution of the Repository Creation Utility and show you which schemas need to be installed and how to do it.

You will need to download the 394MB Repository Creation Utility (11.1.1.3.3) x86 Installer for Linux (ofm_rcu_linux_11.1.1.3.3_disk1_1of1.zip)

You’ll see it at the bottom of the page, under “Required Additional Software (11.1.1.1 – 11.1.1.3)

Download Oracle Repository Creation Utility 11g (11.1.1.3) Here

Next >> Part 5 – Installing, Patching, and Configuring Oracle Identity Management 11g

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam