2 Configuring Access Administrators and Server Settings

2.2.1 Configuring Master Access Administrators

Only Master Administrators can create Master Access Administrators. A Master Access Administrator can perform any function in the Access System except for creating other Master Access Administrators, and can delegate administrative functions.

To add a Master Access Administrator

1. From the Access System Console, select System Configuration, then click the Administrators link in the left navigation pane.

   The Configure Administrators page lists current Master Access Administrators.

2. Click the Master Access Administrators link.

   The Modify Master Access Administrators page appears.

3. Click Select User.

   A page appears that contains search fields.

4. Use the search fields to select the people that you want.

   The search fields consist of attributes that you want to search, search criteria such as "contains," and search strings or partial strings. Select the number of search results that you want to view at a time and click Go.

5. Click Done to return to the Modify Master Access Administrators page.

   The names of any new people you chose using the Selector are displayed in the Modify Master Access Administrators page.

6. Use the checkboxes to deselect any names that you need to remove from your list.

7. Review your selections to ensure that your list is complete.

8. Click Save to save the changes (or Cancel to exit without changing).

2.2.2 Configuring Delegated Access Administrators

When the responsibility for managing the Access System falls on a few people, you may want these people to appoint others to share the work. People currently responsible for resources generally know best to whom to delegate responsibility. The ability to delegate Access System administration to other people enables you to scale administration of your resources, empowering those closest to the resources and most knowledgeable about them to manage them.

A Master Access Administrator can create a group of users and assign administrative rights to the group. The Master Access Administrator can assign the same administrative rights to multiple groups. For example, Group1 and Group2 can both be assigned the right to manage Access Servers.

The following functions can be delegated:

• Add, modify, delete AccessGate configurations.

• Add, modify, delete Access Server configurations.

• Add, modify, delete Access Server clusters.

• Add, modify, delete authentication schemes.

• Add, modify, delete authorization schemes.

• Add, modify, delete host identifiers.

• Add, modify, delete resource type definitions.

• Modify the revoked user list.

  To manage the revoked user list, a delegated administrator must have access to the searchbase containing the entry for the user and must have appropriate attribute read permissions.

You can add a user to multiple groups. For example, if you create one group of Delegated Administrators to manage authentication schemes and authorization schemes, and another group to manage Access Servers and Access Server clusters, the same user can belong to both groups.

When an administrator performs certain tasks, Oracle Access Manager creates an informational log. See the Oracle Access Manager Identity and Common Administration Guide for details.

Policy domain administration can also be delegated. See "Delegating Policy Domain Administration" on page 4-46 for details.

2.2.3 Creating a Group of Delegated Access Administrators

The following procedure illustrates how to add Delegated Administrators to the Access System.

To create a group of Delegated Access Administrators

1. From the Access System Console, click System Configuration, then click the Administrators link in the left navigation pane.

   The Configure Administrators page appears.

2. Under the title Groups of Delegated Administrators, click the Add button.

   The Create a New Group of Delegated Administrators page appears. You can complete all information requested or create an empty group with no administrative rights or members.

3. Provide the information requested.

4. For example:

   Name: A name for this group

   Description: Optional description

   Administrative Rights: Select the rights you want to give to this group

5. Click the Select User button, beside the Members label, to display the Selector.

6. Use the Selector to add people to this group, then click Done when you are finished to return to the Create a new group of Delegated Administrators page.

7. Click Save to complete the process.

2.2.4 Modifying a Group of Delegated Administrators

The following procedure illustrates how to alter a group of Delegated Administrators in the Access System.

To modify a group of delegated administrators

1. From the Access System Console, click the System Configuration tab, then click the Administrators link in the left navigation pane.

2. Click the link for the group to modify.

   The Modify Group of Delegated Administrators page appears.

3. Click Modify.

   The page changes to show editable fields for group name, description, and so on.

4. Make your changes and click Save.

2.3.1 Viewing Server Settings

You use the Access System Console to view server settings for items such as email addresses, directory servers, and the SSO logout URL.

To view server settings

1. Launch the Access System Console.

2. Click System Configuration, then select Server settings.

   The View Server Settings page appears.

2.3.2 Customizing Email Addresses

You use the Customize Email function to specify email addresses for user feedback.

The end user accesses email addresses by clicking the About link at the top of the page, then clicking Submit Admin Feedback or Submit Oracle Feedback.

To customize email

1. In the Access System Console, click System Configuration, then select Server settings.

   The View Server Settings page appears.

2. Click Customize Email to display this page.

   
   

3. Type email addresses in the following fields:

   Address	Description
   Email address for Bug Reports	This address must be changed to be sent to a person or alias in your organization. This person or department can either solve the problem or contact Oracle for help.
   Email address for User Feedback	When a user submits an Oracle Feedback form, the data is sent to the address specified. The default is feedback@Oracle.com.
   Webmaster's Email address	When a user submits an Admin Feedback form, the data is sent to the address specified. The default is webmaster@company.com.

   
   

4. Click Save to save your changes (or Cancel to exit without saving).

5. Restart your Web server.

2.3.3 Configuring a Single Sign-On Logout URL

Single sign-on (SSO) is the ability to access multiple resources with a single login. The Access System performs single sign-on for users by setting an ObSSOCookie for each user or application that accesses a resource protected by the Access System. The ObSSOCookie enables users to access other resources protected by the Access System that have the same or a lower authentication level. See Chapter 7, "Configuring Single Sign-On" for details.

You can configure a single sign-on logout URL and an associated logout page to remove the ObSSOCookie. This forces the user to re-authenticate the next time he or she accesses a resource protected with the Access System.

Oracle provides a logout.html page that is presented to users upon logout and that runs the function that removes session cookies. This form is located in:

PolicyManager_install_dir/access/oblix/lang/en-us/logout.html

For information on configuring this logout page or creating a custom one, see "Configuring Logout". This section only discusses the logout URL.

If you have multiple languages installed, you can configure the Oracle Access Manager single sign-on logout URL to point to a logout.html file in the language of the user's browser. To configure the logout URL, you provide the %lang% parameter in the single sign-on logout URL. Access Manager replaces %lang% with the browser's language at run time.

To configure the SSO Logout URL

1. In the Access System Console, click System Configuration.

2. Click Server Settings in the left navigation pane.

3. Click the Configure SSO Logout URL link.

   The following page appears.

   
   

4. Choose the option you want:

   • If you use a third-party program for logging users out, select No SSO Logout URL

   • If you want to have the Identity System and Access System automatically call this page when the user clicks Logout, select URL.

   Note:

   You must manually create a link to this logout.html page from other resources that are protected by the Access System. Create the link on the pages that you want to contain the logout feature.

5. Click Save.

6. Flush the Access Server cache after changing the SSO Logout value.

   See "Automatic Access System Cache Flush" for more information.

7. Flush the Identity Server cache after changing the SSO Logout value.

   For more information about managing Identity Server caches, see the Oracle Access Manager Identity and Common Administration Guide and the Oracle Access Manager Deployment Guide.

2.3.4 Configuring the Directory Server

You use the Directory Server Configuration page to modify various directory server settings using the Access System Console. This is similar to modifying Directory Server details using the Identity System Console, as discussed in the Oracle Access Manager Identity and Common Administration Guide. Directory server details available in the Access System Console include those for configuration data and policy data.

To configure the directory server

1. From the Access System Console, click System Configuration, then click Server settings.

   The View Server Settings page appears.

2. Click the Directory Server link.

   The Directory Server Configuration page appears. Notice that the page is divided into two areas: one for configuration data and one for policy data. The configuration base and policy base on this page cannot be changed.

   
   

   The configuration base identifies the location of all Oracle Access Manager-specific information. You cannot change this information. The Policy Base identifies the location in the DIT under which all Access System policy data is stored, which you cannot change.

   Note:

   If you change the information in any field marked with an asterisk (*), you must repeat product setup as described in the Oracle Access Manager Identity and Common Administration Guide.

3. Specify configuration information for configuration data, as shown in the following table.

   Field	Description
   Machine(*)	Name or IP address of the computer where the directory server managing the user data, configuration data, or policy data is installed
   Port Number(*)	Port number of the directory server managing the user data, configuration data, or policy data is listening
   Root DN(*)	Root DN of the directory server
   Root Password	Root password of the directory server
   Directory Server SecurityMode(*)	Security mode the directory server uses to protect its communications

   
   

4. Specify configuration information for Policy data, as shown in the previous table.

5. Click Save to save your changes (or Cancel to exit without saving).