Wednesday, October 17, 2012

Configure Jenkins to bind to Active Directly for Security

Jenkins can be download in this website: http://jenkins-ci.org/

What is Jenkins?

Jenkins is an award-winning application that monitors executions of repeated jobs, such as building a software project or jobs run by cron. Among those things, current Jenkins focuses on the following two jobs:
  1. Building/testing software projects continuously, just like CruiseControl or DamageControl. In a nutshell, Jenkins provides an easy-to-use so-called continuous integration system, making it easier for developers to integrate changes to the project, and making it easier for users to obtain a fresh build. The automated, continuous build increases the productivity.
  2. Monitoring executions of externally-run jobs, such as cron jobs and procmail jobs, even those that are run on a remote machine. For example, with cron, all you receive is regular e-mails that capture the output, and it is up to you to look at them diligently and notice when it broke. Jenkins keeps those outputs and makes it easy for you to notice when something is wrong.


For us, we use jenkins to do gemfire deployments in our environments. Adding security to jenkins is a simple process, the pre-requisite of course is that you have Jenkins installed, configured and jobs setup.

Click Jenkins > Manage Jenkins > Configure System 



 On the configure page, Fill in correct information on the access control > Active Directory field.



Test the Active Directory by clicking on the test. 

Under Authorization, choose Project-based Matrix Authorization Strategy






Add the group and users that you want to have permission to jenkins. 

You can then go ahead, save and test away. 



If you want granular security in some particular jobs, you can then go ahead and configure that job by following these instruction. 

First, click on the job then click Configure




 
Click on "Enable Project based security", add the users that you want access to this job and what they are able to do.



I can then tell that diana.sy is able to execute and run this job but not the other jobs that is not enabled.

Wednesday, October 3, 2012

Move OIM Resource from 10g to 11g

The process of migrating resource from Oracle Identity Manager 10g to 11g is quite tedious but simple. You got to have admin access to both server in order to do this.

1. Open browser, go to http://<OIM10g_server>:port/xlWebApp/
    Login as xelsysadm
2. Click on Deployment Manager, Export

    Note: I use IE for this and make sure you have the pop-up blocker disabled. 


Select the resource you want to export. In this example, I start with "Error Code"



Click "Select Children"


Click "Select Dependencies"


Click "Add for Export"

After the reviewing the confirmation screen, you can click export and a pop-up will show up. Type in the name of this export, then save the export to a file. 

After export is save to an xml file, go to your 11g server.

http://<OIM11g_hostname>:14000/oim

On the landing page, click "Advanced"


Under System Management, click "Import Deployment Manager File". Make sure the pop-up blocker is not enable.

On the pop-up import Deployment Manager box, click on the file that was exported. 





Click "Add File"


 Click "Import" 

It will prompt if the import is successful.










Configure Design Console on your local

The following are the prerequisites needed before you can configure Design console

1. Install Oracle Identity Manager in your Server
2. Install Oracle Identity Manager in your Local workstation
3. Install Java in your workstation 
4. Run config.sh in your local workstation.

After all the steps above are preform, create the wlfullclient.jar on the OIM Server

# cd <wls_server>/server/lib/
# java -jar /opt/app/middleware/modules/com.bea.core.jarbuilder_1.6.0.1.jar
 

 <output will look like this>
Integrating jar -->(1)/(40277)//opt/app/middleware/modules/com.bea.core.http.pubsub.mbean_1.6.0.0.jar
Integrating jar <--(1)/(40281)/(4)//opt/app/middleware/modules/com.bea.core.http.pubsub.mbean_1.6.0.0.jar
Integrating jar -->(1)/(40281)//opt/app/middleware/modules/com.bea.core.diagnostics.accessor_1.5.0.0.jar
Integrating jar <--(1)/(40377)/(96)//opt/app/middleware/modules/com.bea.core.diagnostics.accessor_1.5.0.0.jar
Created new jar file: /opt/app/middleware/wlserver_10.3/server/lib/wlfullclient.jar






Grab wlfullclient.jar from the server and drop it to your local workstation under <IDM install directory>/designconsole/ext


On you local workstation edit <IDM install directory>/designconsole/config/xlconfig.xml


    <ApplicationURL>http://OIM_host_Name:14000/xlWebApp/loginWorkflowRenderer.do</ApplicationURL>   

    <Discovery>
        <CoreServer>
            <java.naming.provider.url>t3://OIM_host_Name:14000/oim</java.naming.provider.url>
            <java.naming.factory.initial>weblogic.jndi.WLInitialContextFactory</java.naming.factory.initial>
        </CoreServer>
    </Discovery> 


Launch local workstation <IDM Install Dir>/designconsole/xlclient.cmd

Login with credential set up on the server you are pointing to.