Middleware Technologies : Installing Oracle Identity Manager 11.1.1.5.0

This documentation serves as a guide for installation of OIM 11g

OS: Red Hat Enterprise Linux 5.5

1. Download binaries at Oracle Identity and Access Management (11.1.1.5.0) http://www.oracle.com/technetwork/middleware/id-mgmt/oid-11g-161194.html
ofm_iam_generic_11.1.1.5.0_disk1_1of1.zip

2. Create a service account or a user id which is going to be use for administration of OAM. In my case, I am using appadmin.

3. su as root and install the necessary pre-requisite for the application.

yum install <package name>

· binutils-2.17.50.0.6

· compat-libstdc++-33-3.2.3

· compat-libstdc++-33-3.2.3 (32 bit)

· elfutils-libelf-0.125

· elfutils-libelf-devel-0.125

· gcc-4.1.2

· gcc-c++-4.1.2

· glibc-2.5-24

· glibc-2.5-24 (32 bit)

· glibc-common-2.5

· glibc-devel-2.5

· glibc-devel-2.5 (32 bit)

· glibc-headers-2.5

· ksh-20060214

· libaio-0.3.106

· libaio-0.3.106 (32 bit)

· libaio-devel-0.3.106

· libaio-devel-0.3.106 (32 bit)

· libgcc-4.1.2

· libgcc-4.1.2 (32 bit)

· libstdc++-4.1.2

· libstdc++-4.1.2 (32 bit)

· libstdc++-devel 4.1.2

· make-3.81

· numactl-devel-0.9.8.x86_64

· sysstat-7.0.2

· unixODBC-2.2.11 (32-bit)

· unixODBC-devel-2.2.11 (64-bit)

· unixODBC-2.2.11 (64-bit)

Make sure the gcc-java packages are not installed. Remove any packages related to gcc java.

4. Set Kernel Parameter

Using any text editor, create or edit the /etc/sysctl.conf file, and add or edit lines similar to the following:

vi /etc/sysctl.conf

fs.aio-max-nr = 1048576

fs.file-max = 6815744

kernel.shmall = 2097152

kernel.shmmax = 536870912

kernel.shmmni = 4096

kernel.sem = 250 32000 100 128

net.ipv4.ip_local_port_range = 9000 65500

net.core.rmem_default = 262144

net.core.rmem_max = 4194304

net.core.wmem_default = 262144

net.core.wmem_max = 1048586

Enter the following command to change the current values of the kernel parameters:

# /sbin/sysctl–p

Review the output from this command to verify that the values are correct. If the values are incorrect, edit the /etc/sysctl.conf file, then enter this command again.

5. Set Resource Limits for appadmin

Update the resource limits in the /etc/security/limits.conf configuration file for the installation owner. For example, add the following lines to the/etc/security/limits.conf file:

appadmin soft nproc 2047

appadmin hard nproc 16384

appadmin soft nofile 1024

appadmin hard nofile 65536

appadmin soft stack 10240

6. Install JDK 1.6 as root

# cd /opt/app/binaries

# ./jdk-6u25-linux-x64.bin

# mv jdk1.6.0_25 /opt/

# ln -s /opt/jdk1.6.0_25/bin/java /usr/bin/java

# java –version (to confirm the install)

java version "1.6.0_25"

Java(TM) SE Runtime Environment (build 1.6.0_25-b06)

Java HotSpot(TM) 64-Bit Server VM (build 20.0-b11, mixed mode)

# Set up JAVA_HOME on “appadmin” .bash_profile

7. Install VNC -- VNC is used to display an X windows session running on another computer. Unlike a remote X connection, the xserver is running on the remote computer, not on your local workstation. Your workstation ( Linux or Windows ) is only displaying a copy of the display ( real or virtual ) that is running on the remote machine.

Follow online documentation:

http://gofedora.com/how-to-configure-vnc-server/

1. Install VNC Server on linux thru yum

# yum install vnc-server

Note: Also make sure the following packages are installed.

# yum install xsetroot

# yum install xterm

# yum install twm

2. download vnc viewer to your windows local server

3. ssh to linux box

# ps -ef |grep vnc

When the service is running properly, it should return w/
# appadmin 12191 1 1 14:50 pts/0 00:00:00 Xvnc :1 -desktop cer-lx-authu01:1 (appadmin) -httpd /usr/share/vnc/classes -auth /home/appadmin/.Xauthority -geometry 1024x768 -depth 16 -rfbwait 30000 -rfbauth /home/appadmin/.vnc/passwd -rfbport 5901 -pn
Process id reflects host name and port its running at.

4. If the process is not running, start vnc

# vncserver

Will prompt w/ password to use. Start the service w/ the service account you want to install the service from.

5. Launch viewer point it to the server:port

example: <server_host_name>:5902

8. Install Weblogic 10g. Please refer to the previous post as a guide on how to install weblogic application server. On this example, I am use /opt/app/middleware/wls_home as my weblogic root install.

9. Load Database Schema.

This is needed so the OIM will have a database schema set up. You need to have an Oracle db and user access to be able to do this step. Work with your DBA's to create the user access.

Info provided by DBA:

Userid :OAM_APP

Password: <password>

OIMU=(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = orau1)(PORT = 1521)) (ADDRESS = (PROTOCOL = TCP)(HOST = orau2)(PORT = 1521)) (LOAD_BALANCE = yes) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME = oam_app )))

Note: OAM_APP needs sysdba privileges

A. Copy rcuHome/ to your local machine c:\rcuHome

Download rcu at http://download.oracle.com/otn/nt/middleware/11g/111160/ofm_rcu_win_11.1.1.6.0_disk1_1of1.zip

B. Double click on c:\rcuHome\BIN\rcu.bat > in a windows machine.

Next > Create

Note: there seems to be a problem creating the db w/ rcu tool while all the oracle rac service is up. So have the dba stopped all the service but one.

Create a new prefix.

Choose the following:

Identity Management

Oracle Identity Manager

It will automatically select the other db that are pre-requisite.Such as SOA.

Prompt w/ password

Creating database… <INGORE ORA-01450 AND COUPLE OTHER WARNINGS>

10. Installing OIM

A. Launch the vnc viewer on your desktop. You will be prompt for password

B. Drop the binaries to “/opt/app/binaries/ofm_iam_generic_11.1.1.5.0_disk1_1of1.zip”

> unzip ofm_iam_generic_11.1.1.5.0_disk1_1of1.zip

> cd /opt/app/binaries/Disk1/

> ./runInstaller –ignoreSysPrereqs
> Provide the jdk location: /opt/app/jdk1.6.0_25. It will then pop out a installation dialog

Choose "Skip Software Updates"

Next

Choose IDM Home

Next

Finish

Installation in progress

11. Install SOA Suite, this is a pre-requisite software before configuring Oracle Identity Manager.

A. Download the lastest version of the software at
       http://www.oracle.com/technetwork/middleware/soasuite/downloads/index.html

    B. Unzip the binaries and invoke the runInstaller of the Disk1 folder.

       # Disk1 > ./runInstaller -ignoreSysPrereqs

Skip Software Updates

Next

Choose SOA Suite home directory.

Next

I am using Weblogic as my base application server so I am choosing that.

Next

Review the Installation summary and click Install

12. Configure IDAM to create Domain

# cd <oracle_home>/common/bin
# ./config.sh

Choose "Create a new Weblogic domain"

Next

Select "Oracle Identity Manager" it should automatically select "Oracle SOA Suite" and "Oracle Enterprise Manager" click Next.

Verify the domain name and locations.

Next

Specify the admin username and password. This info will be use to login to weblogic admin console.

Next

Choose "Production Mode"

Next

Select the schema's then check "Configure Selected component schemas as RAC multi data source schemas in the next panel". Only select this option if you are using Oracle RAC as your database. It is advisable to run a RAC Oracle database in your production environment.

Fill in the info -- "Service Name", "Username/password" and the host name.

Next.

Testing connections.

Select "Administration Server" and "Managed Servers, clusters, and Machines"

Click Next.

Configure the necessary information for you "AdminServer"

Next

Configure Managed Server. There is typically 2 already pre-configured. But I added additional 2 for the additional node because I want the managed server to be clustered horizontally. It is also advisable to configure them in similar port but the listen address will be different according to the hostname.

Fill in cluster names.

Toggle the arrows to drop in the soa_servers to the soa_cluster. Same procedure to oim_server.

Click on "Unix Machine" tab add the machines. Machines usually refer to a physical server, so lets say for example you have 3 physical server in a cluster, then you will add 3 unix machines and name them accordingly.

Toggle to the arrows again to drop the managed servers to their respective machines.

Review the configuration summary and then click "Create"

12. Move domain files to 2nd node. (Optional:Only for cluster setup)

Login to the first node where you did the configuration on Step #12
# cd /opt/app/middleware/oracle_common/common/bin

# ./pack.sh -domain=/opt/app/middleware/projects/domains/uatoim_domain/ -template=/home/appadmin/oim11gtemplate.jar -template_name="oam11g" -managed=true

- copy the jar file to the 2nd node.
- unpack the jar file.

Login to the 2nd node and unpack the jar file

# cd /opt/app/middleware/oracle_common/common/bin

# ./unpack.sh -domain=/opt/app/middleware/projects/domains/uatoim_domain/ -template=/home/appadmin/oim_11g_template.jar -app_dir=/opt/app/middleware/projects/domains/uatoim_domain

13. Start weblogic Admin console and Managed Servers.

# /opt/app/middleware/projects/domains/uatoim_domain
# ./startWebLogic.sh

Will prompt you with authentication, input the admin username and password you supplied during installation.

You can then end the process by pressing Ctrl + C

-- Add security boot.properties file so you will not be prompt with credential the next time.

# cd /opt/app/middleware/projects/domains/uatoam_domain/servers/AdminServer
# mkdir security
# cd security
# vi boot.properties

username=<username>
password=<password>

Note: substitute with the same credential you have entered above. This file will be encrypted by weblogic the next time it starts.

# cd /opt/app/middleware/projects/domains/uatoam_domain
# ./startWeblogic.sh &

Note: the & is an indication that the process can run in the background when it is escaped.

Also take a note that this time around you will not be prompt with a password anymore. When weblogic starts, it checks for the boot.properties file.

You cannot escape the process by pressing any key.

-- Accessing the Admin Server

Open a browser, http://<host>:7001/console

Note: port 7001 is default. Use the one that you input during the install.

http://<server_name>:7001/console

-- Note: Do not start managed server at this point. You need to configure OIM first before you can start OIM. Proceed to the next step.

14. Configure Oracle Identity Manager.

# cd /opt/app/middleware/OIM_home/bin
# ./config.sh

Welcome page.

Next

Select "OIM Server" select Next.

Fill in "Connect string to db", OIM Schema Username/password and MDS Schema username and password. This will be the schema you created via rcu tool. It would be <prefix>_oim and <prefix>_mds. Don't be confuse, the database username name is not the same as schema username.

The previous step where you start the admin console. You input the url here including the username/password.

This password is use to configure oim console. Could be the same as your admin console or can be different. For simplicity, I like them to be the same. The keystore password is use for configuring your trust keystore.