LDAP/Enterprise User Security certification matrix

Hi,

LDAP/Enterprise User Security certification matrix:

SSO setup master note ID's

Master Note For Enterprise User Security (Doc ID 1376365.1)

SSO setup for Oracle database users with OID.

Description for SSO setup for Oracle database users :

Answer-2: Please ensure below are followed from OID perspective. 1. First OID/DIP must be installed with all certified version of JDK, WLS, Oracle DB for OID etc 1.1.Oracle® Fusion Middleware Download, Installation, and Configuration ReadMe 11g Release 1 (11.1.1.9.0) https://docs.oracle.com/cd/E23104_01/download_readme_ps7/download_readme_ps7.htm 1.2 Oracle Fusion Middleware Supported System Configurations Oracle Fusion Middleware 11g Release 1 Certifications https://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html 1.3 Installation ( Link : https://docs.oracle.com/middleware/11119/core/INOIM/toc.htm ) Fusion Middleware Installation Guide for Oracle Identity Management Refer : Part II Installing and Configuring Oracle Identity Management (11.1.1.9.0) 4 Installing and Configuring Oracle Identity Management (11.1.1.9.0) 5 Configuring Oracle Internet Directory 7 Configuring Oracle Directory Integration Platform 8 Configuring Oracle Directory Services Manager 2. Then once OID is up and running, using the DIP component synchronization from AD to OID can be setup using below article as a reference. 2.1 Ensure certified AD is used with OID/DIP per above certification matrix link. 2.2 Then using below article setup AD-OID synchronization. Active Directory OID 11g/12c Synchronization Quick Start Guide ( Doc ID 1263918.1 ) 3. Then external Authentication plugins must be set in OID for AD synchronized users. How to Configure or Setup Java External Authentication Plugins in OID 11g ( Doc ID 1270329.1 ) 4. Once the above is done and synchronization is working fine, then create a new SR to Oracle DB EUS team to setup sqlplus login for DB users via OID/LDAP.'

SSO on EBS R12.1.3 Post clone Steps

EBS R12.1.3 Post clone SSO setup..

Description ::

Login to application Server :

1. Remove all references to Prod SSO using txkrun.pl script.

Ex: $FND_TOP/bin/txkrun.pl \ -script=SetSSOReg \ -removereferances=yes \ -appspass=*** \

2. set the user_guid to null in FND_USER table.

Ex: sql> update fnd_user set user_guid=null;

sql> commit;

3. Register the External Node and Generate the Desktop DBC File:

cd $FND_SECURE,  Verify the .dbc file exists or not.

cd $JAVA_TOP

run the below command :
--------------------------

java oracle.apps.fnd.security.AdminDesktop apps/$Apps_pass \  CREATE \ NODE_NAME=**** \ DBC=$FND_SECURE/***.dbc

note: copy the generated dbc file from $JAVA_TOP to $FND_SECURE


4. Register OID with EBS :

for this process we need to register instance first then register the OID with EBS..

a) Register Instance :

$FND_TOP/bin/txkrun.pl \ -script=SetSSOReg \ -registerinstance=yes \ -infradbhost=***** \ -ldapport=*** \ -ldapportssl=***1 \ -ladphost=**** \ -oidadminuser=cn=orcladmin \ -oidadminuserpas=***  \ -appspass=*** \

b) Register OID :

$FND_TOP/bin/txkrun.pl \ -script=SetSSOReg \ -registeroid=yes \ ldapport=*** \  -ladphost=**** \ -oidadminuser=cn=orcladmin \ -oidadminuserpas=***  \ -appspass=*** \ -instpass=**** \ -provisiontype=2\


5. Profile options update ...

Application authenticate agent   :  hostname ( default null )

Application SSO Type :  SSWA w/SSO    ( Default SSWA )

Application SSO Login Type : both ( default local )

Link Application user with OID user with the same user : Enable ( Default Null)

Application SSO auto link user : enable ( default null)

Application SSO LDAP Synchronization : Enabled ( default Enabled ).

Application single sign on Hint Cookie Name : blank  ( default ORASSO_AUTG_HIT)..



post these steps  check the users and groups status and do the network level checks.


Thanks
Srini

SSO Metalink referance notes ..

NOTE:289666.1 - REP-52251: Cannot Get Output Of Job Id
NOTE:370778.1 - Reports Failing to Run for a New User Entered into SSO
NOTE:298174.1 - Troubleshooting Problems with Report Server and SSO / Portal Integration
NOTE:316223.1 - How to Disable Single Sign-On in Reports
NOTE:329602.1 - REP-56017: Security violation: not a job owner when SSO user has '@' sign
NOTE:338451.1 - REP-56071 Showjobs and Reports Queue Manager are Asking for Userid/Pswd to Display Jobs Info
NOTE:339466.1 - SSO User With @, Showmyjobs No Jobs Displayed or REP-56017 using Getjobid
NOTE:1160747.1 - SSO and OID Reassociation, Enabled After Install Time, Are Not Working in 11g
NOTE:1287972.1 - Reports 11g De-associating OID shows [LDAP: error code 49 - Invalid Credentials]
NOTE:263664.1 - What is the Difference Between SSO and Reports Server Authentication
NOTE:271435.1 - Oracle SSO Failure Calling Reports From SSO Enabled Forms via RUN_REPORT_OBJECT
NOTE:279683.1 - How to Secure a Non-SSO Reports Server with DIAGNOSTIC=NO
NOTE:402934.1 - HTTP 500 Internal Server Error If Reports SSO Is Enabled And Portal Is Not Installed
NOTE:404359.1 - Rep-56071: Security Check Failed With Error Message: Error Code30009
NOTE:851029.1 - REP-503 for Certain SSO Users While Running Reports
NOTE:852352.1 - SSO 10g Integration with Portal, Forms, Reports, Discoverer 11g Release 1
NOTE:423384.1 - Is it Possible to Configure/Use SSO Realms for Reports 10.1.2.x ?
NOTE:437246.1 - Which Possibilities are Available to Prevent Users from Accessing Showjobs Page and Getjobid in URL
NOTE:550440.1 - Reports Fail To Run With Rep-56071 After Replacing Kerberos With Default Single Sign On
NOTE:605337.1 - Reports Queue Manager cannot connect to Reports Server. Userid/password fails
NOTE:736785.1 - Troubleshooting: How To Register a Forms & Reports Services Standalone Installation with an Existing Infrastructure - Switch Forms to SSO
NOTE:745454.1 - Error Rep-50171 While Running Report with SSO at Portal or Servlet

NOTE:418256.1 - How Forms Interacts with SSO and OID During Login
NOTE:796352.1 - REP-50201, REP-56071 And LDAP Error Code 48 "Insufficient access to do Proxy Switch"

NOTE:1085834.1 - How to Configure a Reports Server *without* SSO Authentication even when other Reports Servers *do* use SSO Authentication
NOTE:1094495.1 - Is It Possible to Disable Dynamic Resource Creation when SSOCONN is Used in Reports?
NOTE:203617.1 - "Service specific error 50125" or REP-50125 while Starting the Reports Server
NOTE:216847.1 - REP-56071: Security check failed with error message
NOTE:218911.1 - How to Retrieve the SSO Username in Reports
NOTE:246200.1 - How to Authenticate Report Servlet URLs when SSO is Disabled
NOTE:251033.1 - Reports Unable to Use Newly Created Default Resource as SSOCONN
NOTE:252339.1 - Fonts Change in Printed Output when SSO Turned On or Off and Report Server Restarted
NOTE:253222.1 - Unable to Start Reports Server from EM Website
NOTE:253724.1 - SSO Enabled reports request hangs after putting correct username/pwd in SSO login screen
NOTE:257855.1 - How to Disable SSO for a Registered Report in Portal to Allow Public Access

Thanks 

Srini