A Configuring Single Sign-On

A.2.1.1 Configure the WebLogic Security Realm

1. Log into the WebLogic Server Console as an administrator.

2. Click Lock & Edit.

3. Click Security Realm.

4. Click AgileRealm.

5. C1ick Providers, and then click New.

6. Enter AgileSAML2IA as Name, select SAML2IdentityAsserter as Type, and then click OK.

7. On the Providers page, click New.

8. For Name, enter AgileSAMLAT. For Type, select SAMLAuthenticator. Click OK. The new Provider is displayed in the Authentication Providers table.

9. Click Reorder.

10. Order the providers as follows:

    • AgileSAML2IA

    • AgileSAMLAT

    • TrustServiceIdentityAsserter

    • AgileAuthenticator

    • DefaultAuthenticator

11. Click OK.

12. Click AgileSAMLAT.

13. For Control Flag select OPTIONAL and then click Save.

14. Click Activate Changes.

15. Restart the all WebLogic servers in the domain.

A.2.1.2 Create RDBMS Security Store

1. Locate the RCU schema connection information - the JDBC URL, JDBC driver, schema user and password (e.g in file <AgileHome>/agileDomain/config/jdbc/opss-auditview-jdbc.xml).

2. Open SQLPlus using the RCU schema information from step 1 and run the SQL script located in file <FMW_HOME>/wlserver/server/lib/rdbms_security_store_oracle.sql.

3. Log into the Weblogic console as the administrator and enable the RDBMS security store by entering the RDBMS connection information ( Home > Summary of Security Realms >myrealm--(Configuration --> RDBMS Security Store)).

   
   

   Note: Input the schema password in plain text. Do not use an encrypted password. The password will be encrypted when it is saved.

   
   

4. Click Save and Activate Changes and restart WebLogic Servers if necessary.

A.2.1.3 Register Web SSO IdP Partner

1. Log into the WebLogic Server Console as an administrator.

2. Click Lock & Edit.

3. Click Security Realm.

4. Click AgileRealm.

5. Click Providers, click AgileSAML2IA, and click the Management tab.

6. Click the New drop-down and select New Web Single Sign-On Identity Provider Partner.

7. Enter a name in the Name field (e.g. WebSSO-IdP-Partner-1) and then select the IDP XML metadata configuration file which you received from the IdP, then click Ok.

8. Click the newly created IdP (e.g. WebSSO-IdP-Partner-1)

9. Set the Enabled checkbox and input the following Redirect URIs:

   
   /Agile/PLMServlet /Agile/PCMServlet
   
   

   Note: In this configuration, the /Agile/default/login-cms.jsp URI can be used for non-SSO logins.

   
   

10. Click Save and then click Activate Changes.

A.2.1.4 Configure SAML 2.0 Federation Service

This section requires that you define a SAML signing key to be used to sign the SAML assertion in an "identity keystore" and that this key be trusted meaning that the key and/or trust chain appears in the "trust keystore".The following steps describe how one might create and configure a new keystore with a new key to be used as the SAML signing key.

Generate Keystore

1. Generate a JKS keystore and SSO signing key (below is an example keytool command)

   keytool -genkey -keypass welcome1 -keystore SpIdentity.jks -storepass welcome1 -keyalg rsa -alias sp
   

   
   

   Note: It may be necessary to convert the key to PKCS12 format.

   
   
   
   

   Note: The "keytool" command with the "-list" option can be used to review the contents of the keystore and the format of the key.

   
   
   
   

   Note: In a cluster, the keystore must be accessible to each machine running a managed server.

   
   

The following steps describe how to configure the new keystore created in the previous step as a Custom Identity Keystore with a Custom Trust Keystore. This example assumes that the Java Standard Trust Keystore is not needed to establish trust for SAML signing key or any SSL certificates.

Configure Keystores

1. Log into the WebLogic Server console as an administrator.

2. Click Lock & Edit.

   
   

   Note: in a cluster, the following steps must be performed for each managed server.

   
   

3. Click on Environment and then Servers and then click on the WebLogic server name.

4. Under the Configuration tab, click the Keystores sub tab.

5. Click the Change button and select Custom Identity and Custom Trust.

6. For Custom Identity Keystore, enter the path to the JKS file generated earlier (e.g. file SpIdentity.jks in the example keytool command above).

7. For Custom Identity Keystore Type, enter jks.

8. Enter and confirm the Custom Identity Keystore Passphrase (e.g. welcome1 in the example keytool command above).

9. Configure the Custom Trust Keystore and then click Save.

10. Under the Configuration tab, click the Federation Services sub tab and then click the SAML 2.0 General sub tab.

11. Fill the fields in the Site Info section. For Published Site URL, use the protocol/host/port used to access the application (in a cluster, this would be the URL for the load-balancer virtual server) and add the URI /saml2 (e.g. https://agileplm.mydomain.com/saml2). Note: this implies that the proxy and/or load-balancer must pass requests for the /saml2 context to the [managed] server(s).

12. In the Single Sign-On section, for Single Sign-on Signing Key Alias enter the key alias (e.g. sp in the example keytool command above). Enter and confirm the Single Sign-on Signing Key Pass Phrase (e.g. welcome1 in the example keytool command above).

13. Click Save.

14. [OPTIONAL] Click Publish Meta Data to save the SP metadata to a file (e.g. for use when registering Agile PLM as a SP with your IdP).

15. Under the Configuration tab, click the Federation Services sub tab and then click the SAML 2.0 Service Provider sub tab.

16. Set the Enabled checkbox. In the Default URL field, input the Agile PLM web client URL (https://agileplm.mydomain.com/Agile/PLMServlet).

17. Click Save and then click Activate Changes.

A.2.2.1 Register Agile PLM as SAML application in IDCS

1. Log into the Oracle Identity Cloud Service console as an administrator.

2. Expand the Navigation Drawer, click Applications, and then click Add.

3. Click SAML Application.

4. On the Details tab, enter a Name for the SAML application (e.g. Agile PLM 9.3.6 Dev).

5. On the SSO Configuration tab, provide the information as follows (in the URL examples below, replace https://myhost.mydomain.com with the protocol/host/port from the Web Server URL used to access Agile PLM):

   Table A-1

   Information	Values
   [General]
   Entity ID	https://myhost.mydomain.com/spentityid
   Assertion Consumer URL	https://myhost.mydomain.com/saml2/sp/acs/post
   NameId Format	Unspecified
   NameId Value	User Name
   Signing Certificate	<upload the signing certificate>
   [Advanced Settings]
   Signed SSO	Assertion and Response
   Include Signing Certificate in Signature	<checked>
   Signature Hashing Algorithm	SHA-256

   
   
   
   

   Note: In the table above, Entity ID is simply a globally unique identifier. By convention, a URL is typically used for Entity ID. If a URL is used, it is simply a string and does not need to be resolvable.

   
   

6. Define users and groups on the Users and Groups tabs. Make sure that the user's Login ID exists in Agile PLM. Assign the users and groups to the application.

A.2.3.1 Register Agile PLM as a Service Provider (SP) in Okta

1. Log into Okta Admin.

2. Navigate to Applications and click Add Application. Then click Create New App.

3. For Platform choose Web. For Sign on Method, select SAML 2.0. Click Create.

4. Input General Settings information.

5. For the Configure SAML step, input SAML Settings as follows (in the URL examples below, replace https://myhost.mydomain.com with the protocol/host/port from the Web Server URL used to access Agile PLM):

   Table A-2

   Information	Values
   [General]
   Single sign on URL	https://myhost.mydomain.com/saml2/sp/acs/post
   Use this for Recipient URL and Destination URL	<checked>
   Allow this app to request other SSO URLs	<unchecked>
   Audience URI aka Audience Restriction (SP Entity Id)	https://myhost.mydomain.com/spentityid
   Default RelayState	<blank>
   Name ID Format:	Unspecified
   Application username:	Okta username

   
   
   
   

   Note: In the table above, SP Entity ID is simply a globally unique identifier. By convention, a URL is typically used for Entity ID. If a URL is used, it is simply a string and does not need to be resolvable.

   
   

6. Continue to complete the creation of the application.

7. Click the Sign On tab of the newly created application. Click Identity Provider Metadata to download the IdP metadata profile file.

A.2.3.2 Create Users and Groups

To create users and groups:

1. Define users and groups. Make sure that the user's Login ID exists in Agile PLM. Assign the users and groups to the application.

A.2.5.1 [3-1] Error - SAML2Service Unavailable

When configuring the Federation Service and attempting to Publish Meta Data, you may encounter error message SAML2Service Unavailable.

The workaround is to remove the Single Sign-on Key Alias and Pass Phrase, in the SSL configuration tab of the server, input the private key alias and password in the Federation Service->SAML 2.0 General tab, and restart the server. Then re-enter the Single Sign-on Key Alias and Pass Phrase, Save and Activate Changes.

A.2.5.2 [3-2] Error - No SAML2 Service Entity ID Configured.

When configuring the Identity Provider you may encounter error message No SAML2 service identity ID configured.

The solution is to configure the SAML2 service entity ID in the Federation Service configuration.

A.2.5.3 [3-3] Cleaning the WebLogic Server Cache Causes Loss of Configuration of Web SSO IdP Partner

The workaround is to reconfigure the Web SSO IdP Partner after clearing the WebLogic Server cache.

A.2.5.4 [3-4] Error - Invalid Key Information

Error [Security:096620] Invalid key information

This error may occur if the Identity and/or Trust Keystores are not configured properly (for example, if WebLogic Server cannot establish the trust chain for the SAML signing key using the Trust Keystore).

A.3.2.1 IIS 8.5 Web Server Configuration Prerequisites

Ensure the following components have been downloaded and installed.

1. Installed, configured and tested IIS 8.5 web server with Agile PLM 9.3.6. You can refer to the Knowledge Base for details.

2. Download OAM WebGate 10g and 10gPatch 13 for IIS from the site:

   http://www.oracle.com/technetwork/middleware/ias/downloads/101401-099957.html

   1. Get oam_int_win_v12_cd1.zip from disk11 for Windows.

   2. Extract and start installation using Oracle_Access_Manager10_1_4_3_0_CR2_Win64_ISAPI_WebGate.exe

3. Now install OAM WebGate 10g on the same system where IIS 8.5 web server has been installed.

4. Download Webgate10g patch13 (p18708753_10143_MSWIN-x86-64.zip from Disk11) from OTN for Microsoft Windows and install.

5. Ensure that IIS8.5 is installed with all Role Services. If not, you can add those from Server Manger. Navigate to Web Server, right click, Add Role Services. Add all role services. You can refer to the Knowledge Base for details.

The following sections/main steps explain the configuration of the OAM 11gR2 Server with the Agile PLM 935 application:

• "OAM WebGate Registration in OAMServer (IIS 8.5)"

• "IIS 8.5 Web server Configuration with WebGate"

• "OAM Webgate Configuration for IIS 8.5 Web server"

• "Agile PLM Configuration for IIS 8.5 Web server"

• "Testing Agile PLM with OAM and IIS 8.5 Web Server"

A.3.2.2 OAM WebGate Registration in OAMServer (IIS 8.5)

To perform OAM WebGate Agent registration in OAMServer:

1. Create a WebGate entry on OAM console through UI mode Steps:

   1. Click New OAM WebGate 10g in welcome page.

   2. Enter the Name. The host identifier will populate automatically.

   3. Click Apply.

      Figure A-2 OAM WebGate Agent Registration

      
      

A.3.2.3 IIS 8.5 Web server Configuration with WebGate

The following steps must be performed after the installation of OAM10g WebGate for IIS 8.5 web server:

1. Navigate to Site-ISAP Filters tab and add Filter OracleWebGate point to webgate.dll.

2. Navigate to Site.

   1. Right-click Add Application.

   2. Give alias name as access and point physical path to Web Gate\access folder.

3. Navigate to Host Level.

   1. Click ISAPI and CGI Restrictions.

   2. Click Add.

   3. Add the path to webgate.dll and type description as OracleWebGate.

   4. Select check box Allow extension path to execute.

   5. Click OK.

4. Navigate to Web Gate/access.

   1. Right click Properties.

   2. Navigate to Security.

   3. Assign Full Control to Everyone.

5. Restart IIS.

A.3.2.4 WebLogic Proxy Configuration for IIS 8.5 Web server

To configure WebLogic proxy for IIS 8.5 web server:

1. Ensure that you have installed and configure the WebLogic proxy plug-in patch for IIS 8.5 web server.

   Download the WLS12.2.1.1 Proxy Plugin WLSPlugin12.2.1.1-IIS-Win64.zip from the location:

   http://www.oracle.com/technetwork/middleware/webtier/downloads/index.html

2. Extract the plug-in zip to location C:\myhome\weblogic-plugins-1.1.

   
   

   Note: This will be referred as the variable PLUGIN_HOME going forward.

   
   

3. Create iisproxy.ini file in %PLUGIN_HOME%\lib\ with below details:

   WebLogicHost=wls-host

   WebLogicPort=wls-port

   Debug=ALL

   WLLogFile=C:\Temp\wl-proxy.log

   WLExcludePathOrMimeType=/obrar.cgi

4. Ensure that the %PLUGIN_HOME%\lib is included in the system PATH

   (Control-Panel > System > System Properties > Environment Variables > System Properties > PATH)

5. Open IIS Manager, use 'Default Web Site' or create a 'Web Site' based on your needs.

   1. Click the site.

   2. Open 'Handler Mappings' and add a script map

   • Set the 'Extension' like '/Agile/*'

   • Set 'Executable' to %PLUGIN_HOME%\lib\iisproxy.dll

   • Give a 'Name'

   • Create the Script Map:

     In the handler mapping, Open Above Added script map.

     Click Request Restrictions, Mapping tab.

     Uncheck "Invoke handler only if the request is mapped to"

     Click OK.

     Click Yes in Edit Script Map prompt.

6. Create new directory oamsso under

   <IIS inetpub>\wwwroot\

   and copy file logout.html to oamsso folder from OAM server

   <Middleware Home>\user projects\domains\oam_domain\output\<935IIS Agent>

7. Navigate to Host Level and click on ISAPI and CGI Restrictions and click on Add, add the path to iisproxy.dll and select allow extension path to execute.

8. Open IIS Manager, use either 'Default Web Site' or create a 'Web Site'.

   1. Click on the site.

   2. Double-click on Request Filtering in right pane.

   3. Click Edit Feature Settings in Actions pane.

   4. In Edit Request Filtering Settings Dialog, change Maximum query string (Bytes) to:

      4096

   5. Click OK.

      
      

      Note: If you need to add any protect and unprotect resources to work with specific functionality, then add those resource URLs as handler mappings by following the same process above.

      
      

9. Restart IIS.

A.3.2.5 OAM Webgate Configuration for IIS 8.5 Web server

To configure OAM WebGate:

1. Add the authorization policy as below:

   1. Navigate to OAM Console > Policy Configuration > Applications domain > Agent (Name of the Agent in this case) > Authorization Policies.

   2. Open Protected Resources Policy.

   3. Navigate to Response tab.

   4. Add Response as below:

      Name= remote-user

      Type=Header

      Value=$user.attr.dn

   5. Click Apply.

2. Configure Resources for Web gate:

   1. Add these resources with webroot context (in this case Agile):

      Add resource URLs

      /Agile

      /Agile/…/*

      with Authentication and Authorization policy as Protected Resource Policy.

      Figure A-3 Add resource URLs

      
      

   2. Exclude the Resources for Gantt Chart.

      You must exclude the below static resources to work on Gantt chart with WebGate. Also use the webroot context while creating Resources to exclude.

      Navigate to OAM Console > Policy Configuration > Applications domain > Open WebGate10g Agents.

      Click Resources.

      In the Resources window, click Search.

      Add the following Resource Types by using the Create button. IN the Create New page:

      Select Type as HTTP.

      Select the Host Identifier of the Web Gate Agent.

      Type the Resource URL with webroot context.

      Select Protection level as Excluded.

      Add the resources as shown in the following figure.

      Figure A-4 Add resources for Gantt chart

      
      

A.3.2.6 Agile PLM Configuration for IIS 8.5 Web server

1. Navigate to the WebLogic console where the Agile application is installed and create AgileIdentityAsserter.

   1. In WLS Console:

      Click Lock and Edit.

      Move to Summary of Security Realms >AgileRealm >Providers.

      Click New.

      Create AgileIdentityAsserter Authentication with "AgileIdentityAssertion" Provider.

   2. Open the added AgileIdentityAsserter.

   3. Select the Active type as remote-user and Save.

   4. Click Activate Changes.

   5. Logout from the console.

2. Open agile.Properties file, and add the below settings:

   oam.header.name=remote-user

   oam.sso.logout.url=/oamsso/logout.html?end_url=/Agile/PLMServlet

   
   

   Note: Where /Agile is the web-root context for the installed application.

   
   

3. Open the Web.xml (\application.ear\application.war\WEB-INF\ web.xml) and change auth-method as below:

   <auth-method>client-cert, form</auth-method>

4. Restart the WebLogic Application Server where the Agile Application is installed.

5. Configure LDAP Server (which is used as identity store in OAM) with Agile, Migrate LDAP Users into Agile Application and Activate LDAP users.

6. Login to Agile Java Client.

   Navigate to the Location node.

   Enter the Web Server Proxy URL.

   Restart the File Manager.

A.3.2.7 Testing Agile PLM with OAM and IIS 8.5 Web Server

1. Attempt to login to Agile Proxy URL with the IIS 8.5 web server port number as configured.

   You should see the OAM Credentials page.

2. Enter the appropriate OAM (Configured LDAP Identity store user) username and password and the Agile application home page should be presented.

A.3.3.1 OHS1213 Web Server Configuration Prerequisites

Ensure the following components have been downloaded and installed.

1. Download OHS 12.1.3 from the URL below:

   http://www.oracle.com/technetwork/middleware/webtier/downloads/index-jsp-156711.html

2. Extrat the zip file and then run the .exe file.

3. Installation steps:

   1. Find the Oracle Home, which is different than the Weblogic Home.

      Choose Standalone HTTP Server (Managed independently of WebLogic server).

   2. Ensure that all the checks are passed.

   3. Click Next button next to the installation progress panel to install OHS.

4. Create an OHS instance:

   1. Cd to $OHS_HOME\oracle_common\common\bin

   2. Enter:

      config.sh

      to launch the Configuration wizard.

   3. Choose:

      Create a new domain

   4. Check:

      Oracle HTTP Server (standalone) - 12.1.3.0 [ohs]

   5. Use the default JDK version:

      Oracle HotSpot 1.7.0_51

   6. Create:

      Component ohs1

   7. Define the following parameters:

      Admin Host = OHS Server Host

      Admin Port = 9999

      Listen Port = 7777

      SSL Listen Port = 4443

   8. Enter the username and password for Node Manager. Use Oracle123!

   9. Create the instance.

5. Configure the instance:

   1. Go to the directory:

      $OHS_HOME\user_projects\domains\base_domain\config\fmwconfig\components\OHS\ohs1

   2. Edit:

      mod_wl_ohs.conf

   3. Add the information shown below:

      <IfModule weblogic_module>
           WebLogicHost <Agile-wls host>
           WebLogicPort <Agile-wls port>
           Debug ON
           WLLogFile <Temp location>/weblogic.log
        </IfModule>
        <Location /Agile>
         WLSRequest on
        </Location>
        <Location /JavaClient>
         WLSRequest on
        </Location>
        <Location /CoreService>
         WLSRequest on
        </Location>
      
      
      

6. Start Node Manager:

   1. Go to the directory:

      $OHS_HOME\user_projects\domains\base_domain\bin

   2. Run:

      startNodeManager.cmd

   3. Start OHS component by using the command:

      startComponent.cmd ohs1'

7. WebGate should be installed by default once OHS1213 is installed.

A.3.3.2 OAM 11gR2 Server Configuration Main Steps

The following sections/main steps explain the configuration of the OAM 11gR2 Server with the Agile 935 Application:

• "OAM WebGate Registration in OAMServer with OHS 12.1.3 Web Server"

• "OAM WebGate Configuration for OHS 12.1.3 Web Server"

• "Agile PLM Configuration for OHS 12.1.3"

• "Testing Agile PLM with OAM and OHS 12.1.3 Web Server"

A.3.3.3 OAM WebGate Registration in OAMServer with OHS 12.1.3 Web Server

Create WebGate11g Agent in OAM Console:

A.3.3.4 OAM WebGate Configuration for OHS 12.1.3 Web Server

A. The following steps are required to be performed post installation of WebGate 11g for OHS 12.3 Web Server on the Server where you installed your OHS and WebGate.

1. Deploy WebGate:

   • Go to the directory:

     <OHSHOME>/webgate/ohs/tools/deployWebGate

   • Run the deployWebGateInstance.sh as below:

     ./deployWebGateInstance.sh -w <OHSHOME>/user_projects/domains/base_domain/config/fmwconfig/components/OHS/ohs1 -oh <OHSHOME>

   You should see the following sample on the console:

   Copying files from WebGate Oracle Home to WebGate Instancedir

2. Add to the PATH in Environment Variables:

   export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<OHSHOME>/lib

3. Update httpd.conf with the WebGate configuration:

   1. Go to directory:

      <OHSHOME>/webgate/ohs/tools/setup/InstallTools

   2. Run the command below:

      ./EditHttpConf -w <OHSHOME>/user_projects/domains/base_domain/config/fmwconfig/components/OHS/ohs1 -oh <OHSHOME>

      You should see the following sample on the console:

      The web server configuration file was successfully updated

      /scratch/qa/OHSHOME/user_projects/domains/base_domain/config/fmwconfig/components/OHS/ohs1/httpd.conf has been backed up as /scratch/qa/OHSHOME/user_projects/domains/base_domain/config/fmwconfig/components/OHS/ohs1/httpd.conf.ORIG

4. Copy the cwallet.sso and ObClientAccess.xml file from OAM Server:

   From location <Middleware Home >\user_projects\domains\oam_domain\output\OHS11G in OAM Server

   To OHS instance Web Gate directory:<OHSHOME>/user_projects/domains/base_domain/config/fmwconfig/components/OHS/ohs1/webgate/config

B. Add the authorization policy:

1. Navigate to OAM Console > Policy Configuration > Applications domain > Agent (Name of the WebGate11g Agent in this case) > Authorization Policies.

2. Open Protected Resources Policy.

3. Navigate to Response Tab.

4. Add Response as below:

   Name= remote-user

   Type=Header

   Value=$user.attr.dn

5. Click Apply.

C. Add user defined parameters for OHS 11g WebGate Agent in OAM Console:

1. Navigate to OAM Console > System Configuration > Access Manager Settings >S SO Agents > OAM Agents > WebGate 11G Agent.

2. Add the below parameters to User Defined Parameters attribute:

   UniqueCookieNames=enabled

   filterOAMAuthnCookie=false

3. Click Apply.

D. Configure resources for WebGate::

1. Add these resources with webroot context (in this case Agile):

   Add resource URLs

   /Agile

   /Agile/…/*

   with Authentication and Authorization policy as Protected Resource Policy.

   Figure A-6 Add resources

   
   

2. Exclude the Resources for Gantt chart:

   We Need to Exclude the below static resources to work on Gantt chart with WebGate. Also use the webroot context while create Resources to exclude.

   1. Navigate to OAM Console > Policy Configuration > Applications domain > Open WebGate Agents.

   2. Click Resources.

   3. In the Resources window, click Search.

   4. Add the following Resource Types using Create Button.

      In Create New page:

      Select Type as HTTP.

      Select the Host Identifier of the Web Gate Agent.

      Type the Resource URL.

      Select Protection level, Authentication Policy.

      Add the resources as shown in the following figure:

      Figure A-7 Add resources

      
      

A.3.3.5 Agile PLM Configuration for OHS 12.1.3

1. Navigate to the WebLogic console where the Agile application is installed and create AgileIdentityAsserter.

   1. In WLS Console:

      Click Lock and Edit.

      Move to Summary of Security Realms >AgileRealm >Providers.

      Click New.

      Create AgileIdentityAsserter Authentication with "AgileIdentityAssertion" Provider.

   2. Open the added AgileIdentityAsserter.

   3. Select the Active type as remote-user and Save.

   4. Click Activate Changes.

   5. Logout from the console.

2. Open agile.Properties file, and add the below settings:

   oam.header.name=remote-user

   oam.sso.logout.url=/oamsso/logout.html?end_url=/Agile/PLMServlet

   
   

   Note: Where /Agile is the web-root context for the installed application.

   
   

3. Open the Web.xml (\application.ear\application.war\WEB-INF\ web.xml) and change auth-method as below:

   <auth-method>client-cert, form</auth-method>

4. Restart the WebLogic Application Server where the Agile Application is installed.

5. Configure LDAP Server (which is used as identity store in OAM) with Agile, Migrate LDAP Users into Agile Application and Activate LDAP users. See "Agile LDAP Configuration" to configure LDAP Server with Agile PLM.

6. Login to Agile Java Client.

   Navigate to the Location node.

   Enter the Web Server Proxy URL.

   Restart the File Manager.

A.3.3.6 Testing Agile PLM with OAM and OHS 12.1.3 Web Server

1. Attempt to login to Agile Proxy URL with the OHS1213 web server port number as configured.

   You should see the OAM Credentials page.

2. Enter the appropriate OAM (Configured LDAP Identity store user) username and password and the Agile application home page should be presented.

A.3.4.1 OAM 11gR2 Configuration Prerequisites with Apache 2.4 Web Server

Ensure the following components have been downloaded and installed.

1. Download Apache2.4 from Apache site and install/configure and test Apache2.4 with Agile 9.3.6 (Agile should be installed on WLS12.2.1.1). You can refer to the Oracle Knowledge Base for details.

2. Down load 11g R2 PS2 (11.1.2.2.0) Web Gate software V73670-01.zip for Apache 2.4.x from oracle OTN site and install it on the same system where Apache web server has been installed.

The following sections/main steps explain the configuration of the OAM 11gR2 Server with the Agile 936 Application:

• "WebGate Agent Configuration in OAM Server with Apache 2.4 Web Server"

• "OAM WebGate Configuration with Apache 2.4 Web Server"

• "Agile PLM Application Configuration with Apache 2.4 Web Server"

• "Testing Agile PLM with OAM and Apache 2.4 Web Server"

A.3.4.2 WebGate Agent Configuration in OAM Server with Apache 2.4 Web Server

You must add a WebGate Agent for the Apache Webserver in the OAM Server.

To perform OAM WebGate Agent registration in OAMServer:

1. Create a WebGate entry on OAM console through UI mode Steps:

   1. Click on New OAM WebGate 11g in welcome page.

   2. Enter the Name. The host identifier will populate automatically.

   3. Click Apply.

A.3.4.3 OAM WebGate Configuration with Apache 2.4 Web Server

OAM WebGate Configuration

You must perform the following steps post-installation of WebGate11g for Apache Web Server on the server where you installed Apache and WebGate.

1. Deploy WebGate:

   1. Go to the directory:

      WebGate_Oracle_Home/webgate/apache/tools/deployWebGate

   2. Run the deployWebGateInstance.sh as below:

      ./deployWebGateInstance.sh -w <WebGate_Instancedir> -oh <WebGate_Oracle_Home> -ws apache

      You should see the following sample on the console:

      Copying files from WebGate Oracle Home to WebGate Instancedir

   3. Add to the PATH in Environment Variables:

      export LD_LIBRARY_PATH=<WebGate_Oracle_Home>/webgate/apache/lib

   4. Go to WebGate_Oracle_Home/webgate/apache/tools/setup/InstallTools

      Run the command below:

      ./EditHttpConf -f <Apache Home>/conf/httpd.conf -w <WebGate_Instancedir> -oh <WebGate_Oracle_Home> -ws apache24

      You should see the following sample on the console:

      The web server configuration file was successfully updated.

      /scratch/Software/httpd-2.4.10/conf/httpd.conf has been backed up as /scratch/Software/httpd-2.4.10/conf/httpd.conf.ORIG

   5. Copy the cwallet.sso and ObClientAccess.xml file from OAM Server:

      From location <Middleware Home >\user_projects\domains\oam_ domain\output\OHS11G in OAM Server to WebGate_Instance_Home/webgate/config

   6. Add the authorization policy:

      Navigate to OAM Console > Policy Configuration > Applications domain > Agent (Name of the WebGate11g Agent in this case) > Authorization Policies.

      Open Protected Resources Policy.Navigate to Response Tab.Add Response as below:

      Name= remote-user

      Type=Header

      Value=$user.attr.dn

      Click Apply.

   7. Add user defined parameters for OHS11g WebGate Agent in OAM Console:

      Navigate to OAM Console > System Configuration > Access Manager Settings >S SO Agents > OAM Agents > WebGate 11G Agent.

      Add the below parameters to User Defined Parameters attribute:

      UniqueCookieNames=enabled

      filterOAMAuthnCookie=false

      Click Apply.

2. Configure Resources for WebGate:

   1. Add these resources with webroot context (in this case Agile):

      Add resource URL's ” /Agile, /Agile/…/* ” with Authentication and Authorization policy as Protected Resource Policy

      Figure A-9 Add WebGate Resources

      
      

   2. Exclude the Resources for Gantt chart:

      We need to exclude the below static resources to work on Gantt chart with WebGate. Also use the webroot context while create Resources to exclude.

      1. Navigate to OAM Console > Policy Configuration > Applications domain > Open WebGate Agents

      2. Click Resources.

      3. In the Resources window, click Search.

      4. Add the following Resource Types using Create Button. In Create New page:

         Select Type as HTTP.

         Select the Host Identifier of the WebGate Agent.

         Type the Resource URL with webroot context

         Select Protection level as Excluded

         Add the resources as below:

         Figure A-10 Add Resource Types

         
         

A.3.4.4 Agile PLM Application Configuration with Apache 2.4 Web Server

1. Navigate to the WebLogic Administration console where the Agile application is installed and create AgileIdentityAsserter.

   1. In WLS Console, click Lock and Edit.

   2. Move to Summary of Security Realms >AgileRealm >Providers.

   3. Click New and Create AgileIdentityAsserter Authentication with "AgileIdentityAssertion" Provider.

   4. Open the added AgileIdentityAsserter.

   5. Select the Active type as remote-user and then Save.

   6. Click Activate Changes and logout from the console.

2. Open agile.Properties file, add the below settings:

   oam.sso.logout.url=/oamsso/logout.html?end_url=/Agile/PLMServlet

   
   

   Note: .Where /Agile is the root context or virtual path for the Agile PLM application.

   
   

3. Open the Web.xml (\application.ear\application.war\WEB-INF\ web.xml) and change auth-method as below:

   <auth-method>client-cert, form</auth-method>

4. Restart the WebLogic Application Server where the Agile Application is installed.

5. Configure LDAP Server (which is used as identity store in OAM) with Agile.

6. Migrate LDAP Users into Agile Application and Activate LDAP users. For more information, see "Agile LDAP Configuration" to configure LDAP Server with Agile.

7. Login to Agile Java Client.

   Navigate to Location node.

   Enter Web Server Proxy URL.

   Restart the File Manager.

A.3.4.5 Testing Agile PLM with OAM and Apache 2.4 Web Server

1. Attempt to login to Agile Proxy URL with the Apache web server port number as configured.

   You should see the OAM Credentials page.

2. Enter the appropriate OAM (configured LDAP Identity store user) username and password and the Agile application home page should be presented

A.4.2.1 Configure IIS Proxy with WLS

These are the steps to configure Windows NTLM for Single sign-on with Internet Information Services (IIS) as proxy server for WLS.

A.4.2.2 Configure PLM for NTLM with WLS

A. To configure your PLM system for SSO with NTLM, perform these operations.

1. In the WLS console, go to Summary of Security Realms > AgileRealm > Providers.

2. Click New and add "AgileIdentityAsserter" as the AgileRealm Authentication Provider.

3. Open the added AgileIdentityAsserter, select the Active type as Authorization (the AGILESSO is already a default value there). Both should be selected.

4. Click Save, then click Activate the Changes, and then logout from the console.

5. Stop the Application server.

B. Edit this file:

agile_home/agileDomain/applications/application.ear/application.war/WEB-INF/web.xml.

WLS12.2.1.1 supports multiple authentication methods. Add the following elements:

<login-config>

<auth-method>client-cert, form</auth-method>

<realm-name>AgileRealm</realm-name>

<form-login-config>

<form-login-page>/default/login-cms.jsp</form-login-page>

<form-error-page>/default/loginError.jsp</form-error-page>

</form-login-config>

</login-config>

C: Perform the following setting modifications for the action "CLICK ON LOGIN UPON LOGOUT SHOULD LOGIN AUTOMATICALLY IN SSO ENABLE SYSTEM".

Edit this file:

agile_home/agileDomain/config/agile.properties

• Set the agile.sso.enabled value in agile.properties to the following:

  agile.sso.enabled= true

• Set the agile.sso.cookie.name in agile.properties to the following:

  agile.sso.cookie.name=AGILESSO

D. Restart the Agile server.

E. Ensure that NT user name and password exist in DB:

Ensure that the NT user name and password exist in the DB to which the application is connected (by migrating from Microsoft Active Directory Domain LDAP Server. Refer to "LDAP" for information about configuring the LDAP server, migrating users and activation) to which the application is connected.

F. Set Web Server Proxy URL in Agile PLM Administrator:

1. Log in to Java Client as administrator.

2. Navigate to the Location node.

3. Enter the Web Server Proxy URL.

4. Restart the File Manager.

G. Attempt to access the Proxy URL in your Windows computer:

• In IE browser, it should automatically login to Agile PL M.

• In Firefox browser, it will ask for your network credentials only for the first time access.

A.4.4.1 With Secure Proxy

With this deployment, authentication takes place on the proxy server, so it is recommended for those companies that use a proxy server.

Request flow with this deployment:

1. User launches browser to access Agile PLM (for example, http://agileplm.xyz.com/Agile/PLMServlet).

2. The NTLM-enabled IIS server challenges the browser for credentials.

3. After a successful NTLM handshake, the request reaches Agile Application Server (AAS) agent with user information.

NTLM is a connection-based authentication protocol. For each new socket connection between client and server (or proxy), it has to exchange credentials by sending and responding to HTTP requests and responses.

1. The AAS agent passes the user information to the application server security framework.

2. The user will be allowed to access Agile applications.

This authentication happens whenever the client sends an HTTP POST request; therefore, authentication can re-occur even during an established user session.

A.4.4.2 With Transparent Proxy or No Proxy

Request flow with this deployment:

1. User launches browser to access Agile (for example, http://agileplm.xyz.com/Agile/PLMServlet).

2. The Agile Application Server (AAS) agent installed on server challenges the browser for credentials.

3. After a successful NTLM handshake, the AAS agent passes the user information to the application server security framework.

4. The user will be allowed to access Agile applications.