Multi factor authentication with OAM alone !! [Part-1]

                  In this post, We are going to look the Adaptive authentication service that was introduced in the latest version of OAM Patch Set-3. Earlier to OAM 11gR2 PS3 version, multi factor authentication/step-up authentication for an application can be configured with the help of Oracle Adaptive Access manager which is separate component from Oracle Access Management suite or by going through approach of customizing the authentication flow. But you no longer need to install OAAM or go through customization effort to achieve the requirement of multi factor authentication. In OAM PS3, Adaptive authentication service provides this second factor authentication possibilities in various ways as mentioned below.

• One Time Pin(OTP) through Email/SMS/Mobile authenticator
• Access request notification from mobile authenticator 

However you will have to make use of Oracle adaptive access manager(OAAM) for various other features like Risk analysis, Fraud prevention, KBA and many others. In today's post, we are going to cover the implementation steps for enabling OTP through email.   

           

Environment:

• OAM 11.1.2.3 BP07
• RHEL6/OL6
• OUD 11.1.2.3
• OHS 11.1.1.7 with OAM Webgate 11.1.2
• SOA 11.1.1.9

Assumptions:

• OAM 11.1.2.3 installed and configured
• Sample html page deployed on OHS is protected by OAM through OOB LDAPScheme
• OUD is configured as authentication store for OAM
• SOA User Messaging Server(UMS) configured with email provider

Steps:  

• Login to OAM console and navigate to Configuration
• Click on Available services
• Click on Enable and make sure Adaptive Authentication Service is enabled

 

• Go to Application security and navigate to Authentication modules  
• Search for the 'AdaptiveAuthenticationModule' as shown

•  Click on 'AdaptiveAuthenticationModule' and go to steps. Select the 'SecondFactorOTP' stepname

• Make sure you update the following fields with relevant value
• EmailMsgSubject : This would be subject of OTP email that user receives
• EmailField: LDAP attribute name from which email value is retrieved('mail' in case OUD)
• Email_Enabled: Set to true for enabling OTP through email communication
• UmsClientUrl: URL of SOA UMS service which sends email to the user
• UmsAvailable: Set to true
• IdentityStoreRef: Name of UserIdentityStore configured in OAM as authentication repository. 

  

•  Click on Save to update the configuration and then click on Apply

  

To be continued in Part-2...

OIF: Relay State parameter in Federation

            In  this post, we are going to cover the configuration of 'Relay State' parameter for SP partners. Again before we go into the configuration, Let us understand the purpose of 'Relay state'  parameter. Essentially we use this parameter to automate the redirection of a user to a specific target page URL as soon as authentication against IDP is completed successfully and SAML assertion is posted to SP. This way you can avoid adding 'returnurl' paramter to your SSO URL while redirecting to Service provider application.

          In our example, we are using trying this on Salesforce application by redirecting to some contentdoor specific url. We have configured Salesforce as Service Provider and OAM11.1.2.3 as IDP. You can refer to my earlier posts given below for more information on SSO configurations.

• IDP Initiated SSO to Salesforce
• SP Initiated SSO to Salesforce

Environment:

• OAM 11.1.2.3 BP07
• RHEL6
• Salesforce

Steps:

• Assuming you already have configured Federated SSO to a service provider application (For ex: Salesforce) by having OAM as IDP and Salesforce as SP.
• Now Login to OAM server
• Change directory to <Oracle_IDM1_Home>/common/bin
• Execute the follownig commands
• ./wlst.sh
• connect('weblogic', 'password123', 't3://localhost:7001')
• domainRuntime() 
• updatePartnerProperty(partnerName="salesforce",partnerType="SP",propName="providerrelaystate",propValue="https://mydomain.lightning.force.com/one/one.app#/sObject/ContentDocument/home",type="string") 

• On successful execution, You will receive the message as shown above.

 Validation:

• You can login by login to salesforce using IDP Initiated or SP URLl After the authentication, you will be automatically redirected to the URL that is configured as 'Relay State' URL as shown below.

 

You can also refer to various other properties that you can set through WLST command line. These are very well documented in Oracle docs. Please refer here.  

Thank you for visiting.

oracle.security.idaas.rest.provider.cruds.ResourceNameNotFoundException: Failed to get an user from principal for UID

Receiving "oracle.security.idaas.rest.provider.cruds.ResourceNameNotFoundException"  in OAM logs during the user search operations with IDS Profile services and hence unable to find the user profile from the identity store.

Environment:

• OAM 11.1.2.3BP07
• OUD 11.1.2.3
• RHEL6/OEL6 

Error:

<Aug 29, 2016 10:03:59 PM EDT> <Warning> <oracle.idaas.oauth.resourceserver> <BEA-000000> <Resource is not found :: Resource Name "/ms_oauth/resources/userprofile/me/testuser1" >
<Aug 29, 2016 10:03:59 PM EDT> <Error> <oracle.security.idaas.rest.provider.cruds.ids.IDSUtil> <BEA-000000> <Failed to get an user from principal for UID : testuser1
oracle.security.idaas.rest.provider.cruds.ResourceNameNotFoundException: Failed to get an user from principal for UID : testuser1
    at oracle.security.idaas.rest.provider.cruds.ids.IDSUtil.getUserFromUID(IDSUtil.java:748)
    at oracle.security.idaas.rest.provider.cruds.ids.IDSUtil.getAuthPrincipal(IDSUtil.java:234)
    at oracle.security.idaas.rest.provider.cruds.ids.IDSPersonService.readPerson(IDSPersonService.java:282)
    at oracle.security.idaas.oauth.resourceserver.jaxrs.userprofile.UserProviderFacade.getUser(UserProviderFacade.java:115)
    at oracle.security.idaas.oauth.resourceserver.jaxrs.userprofile.Me.getMyProfile(Me.java:133)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
................
    at weblogic.work.ExecuteThread.execute(ExecuteThread.java:263)
    at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Caused By: oracle.igf.ids.EntityNotFoundException: Entity not found for the search filter (&(objectclass=top)(CN=testuser1)).
    at oracle.igf.ids.arisid.ArisIdServiceManager.findEntity(ArisIdServiceManager.java:1709)
    at oracle.igf.ids.UserManager.searchUser(UserManager.java:169)
    at oracle.security.idaas.rest.provider.cruds.ids.IDSUtil.getUserFromUID(IDSUtil.java:744)
    at oracle.security.idaas.rest.provider.cruds.ids.IDSUtil.getAuthPrincipal(IDSUtil.java:234)
    at oracle.security.idaas.rest.provider.cruds.ids.IDSPersonService.readPerson(IDSPersonService.java:282)
    at oracle.security.idaas.oauth.resourceserver.jaxrs.userprofile.UserProviderFacade.getUser(UserProviderFacade.java:115)
    at oracle.security.idaas.oauth.resourceserver.jaxrs.userprofile.Me.getMyProfile(Me.java:133)
........................................
    at weblogic.work.ExecuteThread.execute(ExecuteThread.java:263)
    at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Caused By: oracle.igf.ids.arisid.ArisIdNoSuchSubjectException: Entity not found for the search filter (&(objectclass=top)(CN=testuser1)).
    at com.oracle.ovd.arisid.OvdIdsStackProvider.doFind(OvdIdsStackProvider.java:1287)
    at com.oracle.ovd.arisid.ArisIdStackProvider.doFind(ArisIdStackProvider.java:175)
    at org.openliberty.arisid.Interaction.doFind(Interaction.java:1022)
    at oracle.igf.ids.arisid.ArisIdServiceManager.findEntity(ArisIdServiceManager.java:1616)
    at oracle.igf.ids.UserManager.searchUser(UserManager.java:169)
    at oracle.security.idaas.rest.provider.cruds.ids.IDSUtil.getUserFromUID(IDSUtil.java:744) 


Cause: 

This might be due to the incorrect search filter configuration in IDS profile that is enabled in OAuth Service provider configuration. It is configured to CN as RDN attribute in my scanrio. Make sure the steps mentioned in the solution and correct the configuration.

Solution:




Make sure the following two services in OAuth default domain are pointed to correct IDS profile(In my case, it is OUDIDSProfile) where your user data is stored.

• OAuthDomain -> Resources Servers -> UserProfileServices -> Identity Store name -> OUDIDSProfile

 

• OAuthDomain -> Service Profiles -> User Store -> OUDIDSProfile

  
Also verify the Attribute configurations in IDS Profile settings are configured properly reflecting the correct ldap attributes.

• Navigate to Configuration -> UserIdentityStores -> IDS Profiles -> OUDIDSProfile -> Entities. Correct your RDN/login attribute settings as shown below.

After making required corrections according to your LDAPStore IDSProfile settings, It should be able to search the user now from your directory store.

Thank you for visiting.