Identity and Access Management, Identity Governance

Difference between Web Service and API Both are means of communication. The difference is that web services communicate over network (http is the most common protocol used). API can use any means of communication. API is a generic term - here is video explaining what is an API . Whereas Web Service is a particular type of API.  For example, an SOAP Web Service is a Web Service which is compliant with the W3C specification of a SOAP Web Service protocol/definition. So we can say: All Web Services are API but APIs are not Web Services. Web Services are API that uses web network for communication are web services

ldapadd, ldapmodify are command line or shell accessible ways to add or modify entries into a LDAP Directory Information Tree or DIT. Similarly ldapsearch can be used to search for existing entries in a LDAP Directory. (1) ldapadd   ldapadd can be used to add a new entry to a LDAP Directory. Here is an example of how to use the ldapadd command to add a new user via the command line. One can add a new user via the GUI or user interface for the LDAP Directory.  For this example we will add a new user, say "user3" to LDAP Directory.  See the screenshot below with the complete command and syntax.  The syntax of the command is    ldapadd -h localhost -p 3060 -D cn=orcladmin -w xxxx << EOF   (and then press Enter, to continue adding the various entries required.) Below is a complete example that should enter a new user entry into the LDAP Directory. Here cn=orcladmin is the administrator account which is being used to interact with the Oracle Internet Directory (OID) wi

OAM integration with ADFS, where ADFS is the IDP and OAM is SP. URLs are protected by WebGate/OAM. User accesses URL of applications protected by WebGate/OAM. Following is the flow of the steps when user accesses the URL of protected Application 1. User logs in to Active Directory and gets a Kerberos ticket. 2. User launches their browser and points to Application's URL. 3. Webgate on the Application server intercepts the request and looks for a valid session cookie but the user does not have one. 4. Webgate redirects the browser to OAM for authentication. OAM determines that the web page is protected and that the authentication method is SAML. It looks for a valid SAML token but does not find one. 5. OAM redirects the browser to ADFS to get a SAML token. 6. ADFS, through Integrated Windows Authentication, validates the user authentication against Active Directory, and once successful, it creates a SAML token and redirects the browser back to OAM. 7. OAM reads the SAML to

The Request and Direct Role assignments are two types of operations that are defined in OIM.  Here is the link to the doc . For example, if you are a user administrator, then all operations such as create user, modify user, grant account, enable user account, and so on are direct operations. Similarly, if you have been assigned the User Viewer admin role, then operations such as create user, enable user, delete user, grant role, revoke entitlements, and so on result in a request being created. See below table for various Request or Direct Operations that are allowed based on the type of Role in OIM. The Help Desk role is an interesting one, it has capabilities for both operations (Direct and Request based) - for example, Change User Password can be done by the Help Desk role via Direct operation, whereas in order to Enable a User, the Help Desk user will have to invoke a Request based operation. In other words Help Desk role/user cannot directly enable a user. However as you

Oracle EBS E-Business suite can be integrated with Oracle IAM suite to provide a complete user access management solution. However in order to use integration with Oracle Access Manager (OAM) it is mandatory to use Oracle Internet Directory (OID). ( Note: There is a newer integration of Oracle EBS with Oracle Identity Cloud Service where there is no requirement of OAM or OID. Here is the link for this new integration . )  To understand the integration of EBS with OAM/OID, see below the (a) architecture EBS+OAM+OID integration and (b) flow of authentication with EBS+OAM+OID. (Note: EBS has the capability to provide authentication and access control without OAM since EBS has its own native AccessGate which uses the header variables to create user sessions. These header variables similar to OAM_HEADER can be sent by any other external Access Management solution.) Also refer here for the concepts of how Single sign on works with OAM and Oracle Fusion Middleware. Update (July 2019) : N

This post provides an overview of WebLogic configuration for Active Directory as Authentication provider with several key settings. It is assumed that you have already configured the security realm. The version of WebLogic is 12c and the document being followed is the Oracle Fusion Middleware Securing WebLogic server, chapter 5 - configuring Authentication Providers. The key settings in the Authentication Provider are 1) User DN: For providing the container or DN of the users who will be authenticating 2) Group DN: For providing the container or DN of the users who will be authenticating 3) Host: This setting is for providing the Active Directory domain controllers list. However, this will vary according to the current environment, whether it is a single domain or multi-domain. Above 1),2),3) are from WebLogic Security realm configuration with Authentication Provider. The below 4) is for the Application that is deployed on the WebLogic server. Once user has been authenticated,

ITSM is  (1) Best Practices (2) Non-prescriptive (3) Non-proprietary Best practices - compiled experiences and success factors from various organizations over decades In the end ITSM provides a framework that is descriptive This framework has to be adopted by an organization and accordingly adapted to the particular organization. How it is adapted is left to the organization - It is NOT a HOW TO DO. HOW TO DO is actually implementing Adopting is NOT implementing ITIL. (because ITIL is a set of best practices) Adopt is about governance required to manage IT services. Now to implement governance your require policies, and this results to an organization adapting to ITIL. ITSM is a management system. Comparison with COBIT The process focus of COBIT is modelled via a process model that subdivides IT into four domains PBRM Plan Build Run Monitor Plan and Organize Acquire and Implement Deliver and Support Monitor and Evaluate and its Governance wit

DevOps as the name suggests is composed of two words, Dev and Ops, i.e. Development and Operations. Development as in Application or Software development and Operations as in IT Operations. Traditionally these two streams have been distinct with a strict boundary between the two work streams. DevOps is a melding of these two work streams to bring in cohesion between the Development and IT Operations teams for better and transparent communication and collaboration. Even though these are two different streams (Development and IT Operations) with specific skill set, DevOps (Dev and IT Ops) brings in faster and smooth deployment cycles. Earlier or traditional Development handing off to Operations was slow and had rigid deployments. If things broke in production, the version is sent back to Development for a fix with a bug report, Development would reproduce the issue, provide a fix and send to Operations for deployment. This traditional cycle from Application Development, to testing an

Netbeans 9 installation First is it requires support of nb-javac library which according to Netbeans is highly recommended.  nb-javac is a library which is required when you are installing Netbeans 9. There are several reasons why this library is not included as part of the standard Netbeans install binaries. The foremost reason being Java/JDK is licensed separately from Netbeans. The details being that Netbeans is now under Apache licensing or rather Apache now owns Netbeans, however, Java/JDK license is owned by Oracle separately. Hence Apache could not bundle java/jdk with the Netbeans installation binaries. Users will have to separately download and install the java/jdk binaries, which can be done by downloading nb-javac library. Or the other option is to run Netbeans on JDK 9 or later, in other words your default JDK on the Operating System should be JDK 9 or later. In either case it is recommended to use the nb-javac library which has been tuned to work with Netbeans. Configu

Note: SoapUI has two versions, one is open source and second Professional version. The open source can be download here . (confirmed link 12/19/2018). SSL Handshake issue:   There is an Issue in SoapUI version 5.3.0 (and 5.2.0 version) with SSL handshake error. It was resolved by updating below in vmoptions file ( refer here ). However, the error that shows up while trying to load wsdl is "Error loading WSDL" as below The fix is to Enable TLS 1.2 protocol for SOAP/REST calls in SoapUI, by ammending the vmoptions file to add the directive for TLS as (-Dsoapui.https.protocols=TLSv1.2). Refer here . Update: Version 5.5.0 does not have this issue. If you are on 5.3.0 better upgrade to 5.5.0 which is available now (Feb 2019). I had above issue as well as another issue reaching to https endpoint. Upgrade to 5.5.0 resolved issue. Select "Check for updates" under the Help menu and you will get option for upgrade. Select upgrade current version and accept all defaul

Recently we got a OVA file for a virtual machine. The vendor instructions were to import the ova file in vmware Workstation, Player for Windows/Linux, Fusion for Mac, and VirtualBox as well.  The instructions were to take the available package and launch the VM with VMware workstation. The package contained  Module.mf, Module.ovf and Module-disk.vmdk and a Module.ova file. The .mf and .ovf file were 2 KB each whereas the vmdk was several gigs. The package also contained a Module.ova file which was several gigs as well. OVF           Open Virtualization Format MF             Manifest file VMDK       Virtual Machine Disk OVA           Open Virtualization Appliance The ovf file is a xml file that contains metadata for the ovf package The mf file contains the SHA1 hash codes of all files in the package The vmdk file is the disk image of the virtual machine,  VMware Workstation or VirtualBox. (vmdk format was originally developed by VMware and is an open format now). All of

7 Steps to configuring your Schedule Task on Microsoft Windows This post will go over the steps to schedule a task on Windows. Microsoft Windows provides a Task Scheduler which can be configured to invoke or run a process, script or a task for a specified condition. The task can be specified to run at a particular time, Weekly, Daily, Monthly, or when user logs into the computer, boot up time etc. Tasks can be repeated or delayed as required.  You can automate several tasks with the Windows Scheduler that can be run at a specified event or time. Follow each of the 7 steps below to configure your Scheduled Task. The screenshots with 7 steps are shown below are for creating a Task. The task is invoked at a particular time or when an event occurs. At the particular time or when the event occurs, the task is trigger by the Scheduler. Step 1: How to Access Task Scheduler To access the Task Scheduler, open the Control Panel, it is under Administrative Tools. Follow the path Contr

WebLogic server integration with SAML - SP initiated and IDP initiated Single sign on This post will cover the two scenarios of SSO in SAML Federation, the SP-initiated SSO flow and IdP-initiated SSO flow. Both these flows are part of the SAML Web SSO and valid for various integrations with WebLogic server, PingFederate or Okta. There are two models for Web SSO - SP-initiated and IdP-initiated. SP-initiated and IdP-initiated models The above diagram shows the two models for Web SSO flow.  Since there are two options, the first choice is to decide your use case of where the user will start the process of the Web SSO. The SP-initiated SSO flow is described first and followed by IdP-initiated SSO flow. SP-initiated SSO flow In this use case, the user is provided with a published URL which the user accesses via their browser which takes them directly to the Service Provider (SP) Application URL/resource. However since the user is not logged in at the SP, the user request is redirected to t