Enterprise Security

Wednesday, November 30, 2016

DCC Configuration in OAM 11.1.2.3

As a continuity to my earlier blog post on DCC(Detached credential collector) in OAM, I am now posting on the steps to configure the DCC in OAM 11gR2PS3 version. In this post, I configured the DCC and protected a sample HTML page with it.

Environment:

OAM 11.1.2.3BP07
OHS 11.1.1.7
OAM Webgate 11.1.2
RHEL6

Steps:

Deploy a sample html file inside OHS which will be protected using OAM
I have a file deployed inside OHS directory at below location

<OHS_CONFIG_HOME>/htdocs/dcc/dcc.html

Register a webgate in OAM which will be used as DCC webgate. In my case I have used the existing Webgate_IDM_11g as DCC webgate.
Make sure to check 'Allow Credential collector Operations' as shown below.
Click on Apply to save the changes.

Deploy newly create artifacts into OHS Webgate config folder and restart the OHS services
Newly created artifacts are available in OAM domain output folder

<OAMDomain_Home>/output/Webgate_IDM_11g/

Copy these artifacts to OHS Webgate config folder

<OHSConfig_Home>/webgate/OHS/

Restart OHS instance to load these new artifacts
Now lets create an authentication scheme for DCC
Go to Application Security -> Authentication schemes
Create a new authentication scheme with the following value

Name : DCCAuthenticationScheme
Description : DCCAuthenticationScheme
Authentication Level : 2
Challenege Method : Form
Challenge Redirect URL : https://<DCC_OHS_HOST:OHS_PORT>/
Authentication Modue : LDAP
Challenge URL : /oamsso-bin/login.pl
Context type: Leave as blank

Now lets configure this authentication policy with this newly create DCCAuthenticationScheme
Go to Application Domain that registered with newly created Webgate or application domain that is associated with DCC webgate(for ex: Testappdomain).
Navigate to Application Domains -> Testappdomain -> AuthenticationPolicies -> Create
Create a new authentication policy as follows

Name: DCCAuthenticationPolicy
Authentication scheme : DCCAuthenticationScheme

Click on Apply to save the changes.
Click on resource and create a new resource as follows.

Resource Type: HTTP
Host Identifier: IAMSuiteAgent
Resource URL : /dcc/dcc.html

Associate this new resource with this DCCAuthenticationPolicy and required authorization policy as shown below.

Now lets update the login.pl file to point it to the right perl library path
This can be found using the following command

which perl

output : /usr/bin/perl

Make a note of this path which needs to be updated in login.pl script
Edit the login.pl using VM editor
Update the location of perl in the login.pl as shown below

Now comment the following line as shown below

use URI::Escspe;

All configurations are complete with the above step. Now lets access and verify the authentication using DCC webgate
Access followingURL

http://<DCC_OHS_HOST:OHS_PORT>/dcc/dcc.html

Now you will see the Out of the box login page which is served from the /oamsso-bin/login.pl
If you observe, Now OAM redirected user to the DCC login page according the authentication scheme configured.
Enter user credentials and click on submit.

That't it guys. You are authenticated successfully through DCC mechanism and landed on home page now.

Thank you for visiting

Wednesday, November 23, 2016

What is DCC(Detached credential collector) in OAM ??

Hello friends, Recently I came across the requirement for Detached credential collector in OAM 11.1.2.3. So I started configuring it with a sample application to understand how it works. In my blog, I will also post about the configuration changes required for DCC.

Before we get started with these configurations, It is better to understand the main difference between the DCC and ECC(Embedded credential collector) which are supported by OAM. The major difference is way the credentials are submitted to OAM server for the validation.

How ECC Works:

Embedded credential collector(ECC) engine is used for capturing the user credentials submitted which is embedded/deployed inside OAM application server from an external agent like user browser etc. So ECC services runs on application layer.
In ECC mechanism, user submits the credentials on the login form which will be submitted directly to OAM Server over web i.e., user credentials are submitted to OAM Server from user browser agent to OAM server running in the middle tier/App layer through a proxy over HTTP/HTTPS. You can still secure this communication by adding SSL layer but most of the people doesn't like to expose their app layer contexts.

How DCC Works:

In DCC mechanism, user submits the credentials on the login form which is deployed in DMZ served by DCC webgate and webgate will also takes care of submitting these credentials to OAM server through OAP communication. This OAP communication is backend channel communication happens between the webgate and OAM server.

            So comparatively DCC is more secured mechanism while handling the user credential communication between User browser agent and OAM servers. DCC supports almost all the features which ECC supports except a few like Challenge methods. DCC supports only Basic/form based authentications where as ECC supports many other ways of challenge mechanisms. As long as you are using the Form based mechanism for user authentications, DCC is the more secure way to use.

             Also there are several other differences between this ECC and DCC which are very well documented here.

      After going through above link, you will have a better understanding on the way how these credential collectors work in OAM and differences between these two mechanisms.

My blog post on how to configure DCC in OAM 11.1.2.3 is here...

Thanks you for visiting.

Tuesday, October 18, 2016

Multi factor authentication with OAM alone !! [Part-2]

Now lets configure the 'AdativeAuthenticationPlugin'
Click on 'Application Security' and navigate to authentication plugins

Search for 'AdaptiveAuthenticationPlugin' and select the plugin

Update the below details as shown. These details will be same as what we have updated in the authentication module

Now click on Save to update the changes and click on 'Activation State' to make sure it is activated on the managed server.

Note: In this step, there might be issue sometimes in activating this Plugin . Reported error message would be ''Action failed due to inconsistent status of plugin in different managed servers". Refer to my other post on the fix for this issue.

Once the plugin is activated, Lets configure the authentication policy
Navigate to 'Applciation security' -> Application domain
Search for authentication policy that protected the our sample html file.
Click on Advanced Rules -> Post authentcation. Add the new rule

This is the step where we redirect the user to additional authentication by configuring the below rule which always evaluates to true.
Add the rule as shown below and click on 'Add' to apply this rule.

Click on Apply to save this updated authentication policy.

Now we have completed the configurations and lets validate the scenario.

Validation:

Lets make sure we have a user profile in OUD with mail populated with a valid email.

Now access the protected url in my case it is

http://OHShost:OHSPort/test/test.html

Authenticate with username and password which is initial authentication step.

Once initial authentication is successful, you will be redirected to OTP screen which is additional step of authentication
You can select OTP-> your email address and click on OTP. This will send an OTP code to the email address that is retrieved from UserIdentity store1

Enter the OTP received and click on Login button

That's all. You are now authenticated successfully through multi factor authentication which is One Time Pin(OTP) received through email

You can also refer to following links in case of any issues mentioned in below links.

Thank you for visiting.