Identity and Access Management, Identity Governance

This post provides an overview of WebLogic configuration for Active Directory as Authentication provider with several key settings. It is assumed that you have already configured the security realm. The version of WebLogic is 12c and the document being followed is the Oracle Fusion Middleware Securing WebLogic server, chapter 5 - configuring Authentication Providers. The key settings in the Authentication Provider are 1) User DN: For providing the container or DN of the users who will be authenticating 2) Group DN: For providing the container or DN of the users who will be authenticating 3) Host: This setting is for providing the Active Directory domain controllers list. However, this will vary according to the current environment, whether it is a single domain or multi-domain. Above 1),2),3) are from WebLogic Security realm configuration with Authentication Provider. The below 4) is for the Application that is deployed on the WebLogic server. Once user has been authenticated,

ITSM is  (1) Best Practices (2) Non-prescriptive (3) Non-proprietary Best practices - compiled experiences and success factors from various organizations over decades In the end ITSM provides a framework that is descriptive This framework has to be adopted by an organization and accordingly adapted to the particular organization. How it is adapted is left to the organization - It is NOT a HOW TO DO. HOW TO DO is actually implementing Adopting is NOT implementing ITIL. (because ITIL is a set of best practices) Adopt is about governance required to manage IT services. Now to implement governance your require policies, and this results to an organization adapting to ITIL. ITSM is a management system. Comparison with COBIT The process focus of COBIT is modelled via a process model that subdivides IT into four domains PBRM Plan Build Run Monitor Plan and Organize Acquire and Implement Deliver and Support Monitor and Evaluate and its Governance wit

DevOps as the name suggests is composed of two words, Dev and Ops, i.e. Development and Operations. Development as in Application or Software development and Operations as in IT Operations. Traditionally these two streams have been distinct with a strict boundary between the two work streams. DevOps is a melding of these two work streams to bring in cohesion between the Development and IT Operations teams for better and transparent communication and collaboration. Even though these are two different streams (Development and IT Operations) with specific skill set, DevOps (Dev and IT Ops) brings in faster and smooth deployment cycles. Earlier or traditional Development handing off to Operations was slow and had rigid deployments. If things broke in production, the version is sent back to Development for a fix with a bug report, Development would reproduce the issue, provide a fix and send to Operations for deployment. This traditional cycle from Application Development, to testing an

Netbeans 9 installation First is it requires support of nb-javac library which according to Netbeans is highly recommended.  nb-javac is a library which is required when you are installing Netbeans 9. There are several reasons why this library is not included as part of the standard Netbeans install binaries. The foremost reason being Java/JDK is licensed separately from Netbeans. The details being that Netbeans is now under Apache licensing or rather Apache now owns Netbeans, however, Java/JDK license is owned by Oracle separately. Hence Apache could not bundle java/jdk with the Netbeans installation binaries. Users will have to separately download and install the java/jdk binaries, which can be done by downloading nb-javac library. Or the other option is to run Netbeans on JDK 9 or later, in other words your default JDK on the Operating System should be JDK 9 or later. In either case it is recommended to use the nb-javac library which has been tuned to work with Netbeans. Configu

Note: SoapUI has two versions, one is open source and second Professional version. The open source can be download here . (confirmed link 12/19/2018). SSL Handshake issue:   There is an Issue in SoapUI version 5.3.0 (and 5.2.0 version) with SSL handshake error. It was resolved by updating below in vmoptions file ( refer here ). However, the error that shows up while trying to load wsdl is "Error loading WSDL" as below The fix is to Enable TLS 1.2 protocol for SOAP/REST calls in SoapUI, by ammending the vmoptions file to add the directive for TLS as (-Dsoapui.https.protocols=TLSv1.2). Refer here . Update: Version 5.5.0 does not have this issue. If you are on 5.3.0 better upgrade to 5.5.0 which is available now (Feb 2019). I had above issue as well as another issue reaching to https endpoint. Upgrade to 5.5.0 resolved issue. Select "Check for updates" under the Help menu and you will get option for upgrade. Select upgrade current version and accept all defaul

Recently we got a OVA file for a virtual machine. The vendor instructions were to import the ova file in vmware Workstation, Player for Windows/Linux, Fusion for Mac, and VirtualBox as well.  The instructions were to take the available package and launch the VM with VMware workstation. The package contained  Module.mf, Module.ovf and Module-disk.vmdk and a Module.ova file. The .mf and .ovf file were 2 KB each whereas the vmdk was several gigs. The package also contained a Module.ova file which was several gigs as well. OVF           Open Virtualization Format MF             Manifest file VMDK       Virtual Machine Disk OVA           Open Virtualization Appliance The ovf file is a xml file that contains metadata for the ovf package The mf file contains the SHA1 hash codes of all files in the package The vmdk file is the disk image of the virtual machine,  VMware Workstation or VirtualBox. (vmdk format was originally developed by VMware and is an open format now). All of

7 Steps to configuring your Schedule Task on Microsoft Windows This post will go over the steps to schedule a task on Windows. Microsoft Windows provides a Task Scheduler which can be configured to invoke or run a process, script or a task for a specified condition. The task can be specified to run at a particular time, Weekly, Daily, Monthly, or when user logs into the computer, boot up time etc. Tasks can be repeated or delayed as required.  You can automate several tasks with the Windows Scheduler that can be run at a specified event or time. Follow each of the 7 steps below to configure your Scheduled Task. The screenshots with 7 steps are shown below are for creating a Task. The task is invoked at a particular time or when an event occurs. At the particular time or when the event occurs, the task is trigger by the Scheduler. Step 1: How to Access Task Scheduler To access the Task Scheduler, open the Control Panel, it is under Administrative Tools. Follow the path Contr

WebLogic server integration with SAML - SP initiated and IDP initiated Single sign on This post will cover the two scenarios of SSO in SAML Federation, the SP-initiated SSO flow and IdP-initiated SSO flow. Both these flows are part of the SAML Web SSO and valid for various integrations with WebLogic server, PingFederate or Okta. There are two models for Web SSO - SP-initiated and IdP-initiated. SP-initiated and IdP-initiated models The above diagram shows the two models for Web SSO flow.  Since there are two options, the first choice is to decide your use case of where the user will start the process of the Web SSO. The SP-initiated SSO flow is described first and followed by IdP-initiated SSO flow. SP-initiated SSO flow In this use case, the user is provided with a published URL which the user accesses via their browser which takes them directly to the Service Provider (SP) Application URL/resource. However since the user is not logged in at the SP, the user request is redirected to t

How to provision users in bulk into Active Directory Group with Oracle Identity Manager OIM. Oracle Identity Manager (OIM) can integrate with Active Directory as a target system for provisioning users in Active Directory. With Oracle Identity Manager as the central Identity Management system one can manage, provision, deprovision or terminate user accounts as per the policy defined in OIM. The OIM connector for Microsoft Active Directory User Management is required for this integration. With this connector in place OIM can manage the lifecyle of user accounts in Active Directory. There are situations where there is a need to provision hundreds of users. This is a typical scenario where one needs to bulk provision users into a Active Directory Group via OIM. (instead of provisioning users one by one manually which can be tedious and time consuming). This post deals with provisioning users to a Group in Active Directory (provisioning users to AD is a related but different use case

Here is a good post from a blog about Certification Revocation (original blog is here) my  last post , I examined the reasons why certificate revocation is important to enterprise security. Now I’ll walk you through the steps you need to follow to check for revoked certificates. Certificates are believed to be ‘good’ unless we’re told otherwise, so certificate authorities simply need to maintain lists of ‘bad’ certificates that have been revoked. These lists are then made available so that anyone can query the status of a certificate. For the most part, if the certificate we are checking does not appear on a list, we can assume it’s okay. How can a compromised certificate be used in an attack? Read More. Many methods exist for publishing and querying these lists but few of them are widely used. This is largely because the methods are slow, prone to failure or are just plain complicated to understand and implement. So, what are the methods and what proble

PKI Technical Standards What follows is a comprehensive set of lists of applicable PKI standards. Notes:  Standards tend to migrate from one body to another, as they mature and become ratified and adopted by steadily bigger groups. Over time this can lead to redundant standards documents. For instance, most of the RSA Laboratories' PKCS series have been adopted by the IETF now; such standards can appear more than once in the lists below. A nearly complete compendium of information security standards was produced by APEC and is available from the Federal PKI Steering Committe website:  APEC Standards Handbook . Important PKI Standards Organisations The Major PKI Related RFCs Other PKI Related RFCs Other Cryptography Related RFCs Other Security and Crypto Standards ANSI Financial Industry PKI Standards ANSI Financial Industry PKI Standards IN DEVELOPMENT ISO PKI Standards PKCS Series Smartcard Standards & Guidelines European Electronic Signature Standards PK