Identity and Access Management, Identity Governance

This post goes over enforcing HSTS for websites and how to do with PingFederate.  PingFederate is a Federation server from PingIdentity tools that provides authentication and federation services. Typically PingFederate server is configured to host or provide Single Sign on for web applications where authentication is done by PingFederate. During the authentication process, the protected website redirects the web request to the PingFederate hosted URL where user request is validated by the Federation server (PingFederate in this case). However always ensure that this redirected URL hosted at PingFederate or the Federation server is https (for example https://sso.yourdomain.com ) is enabled and not the plain http for obvious reason that the http traffic data is fully visible on the network. Hence always ensure that this URL/site be always https enforced so that the site traffic data is protected by encryption. This can be enforced by making sure that the PingFederate config file ...

Configuring SSO for Mobile and Desktop Apps Using SAML and OAuth Salesforce mobile and desktop clients, including the SalesforceA mobile app for administrators, can combine OAuth and SAML protocols for service provider–initiated single sign-on (SSO). App Support for SSO To authenticate mobile and desktop clients, a Salesforce org configured as a service provider can combine the OAuth and SAML protocols. OAuth allows users to connect applications to their accounts. SAML authenticates those connections. Using OAuth and SAML, mobile and desktop clients can take advantage of SSO integration in a way similar to web applications. SSO integration is based on several core tenets. Developers are increasingly rewriting desktop and mobile applications to use OAuth to connect to user accounts. At runtime, users authenticate and authorize the app. After this initial step, a high-entropy (long, random) token is issued to the device. It is used instead of a password the next time the app...

Difference between Web Service and API Both are means of communication. The difference is that web services communicate over network (http is the most common protocol used). API can use any means of communication. API is a generic term - here is video explaining what is an API . Whereas Web Service is a particular type of API.  For example, an SOAP Web Service is a Web Service which is compliant with the W3C specification of a SOAP Web Service protocol/definition. So we can say: All Web Services are API but APIs are not Web Services. Web Services are API that uses web network for communication are web services

ldapadd, ldapmodify are command line or shell accessible ways to add or modify entries into a LDAP Directory Information Tree or DIT. Similarly ldapsearch can be used to search for existing entries in a LDAP Directory. (1) ldapadd   ldapadd can be used to add a new entry to a LDAP Directory. Here is an example of how to use the ldapadd command to add a new user via the command line. One can add a new user via the GUI or user interface for the LDAP Directory.  For this example we will add a new user, say "user3" to LDAP Directory.  See the screenshot below with the complete command and syntax.  The syntax of the command is    ldapadd -h localhost -p 3060 -D cn=orcladmin -w xxxx << EOF   (and then press Enter, to continue adding the various entries required.) Below is a complete example that should enter a new user entry into the LDAP Directory. Here cn=orcladmin is the administrator account which is being used to interact with the Oracl...

OAM integration with ADFS, where ADFS is the IDP and OAM is SP. URLs are protected by WebGate/OAM. User accesses URL of applications protected by WebGate/OAM. Following is the flow of the steps when user accesses the URL of protected Application 1. User logs in to Active Directory and gets a Kerberos ticket. 2. User launches their browser and points to Application's URL. 3. Webgate on the Application server intercepts the request and looks for a valid session cookie but the user does not have one. 4. Webgate redirects the browser to OAM for authentication. OAM determines that the web page is protected and that the authentication method is SAML. It looks for a valid SAML token but does not find one. 5. OAM redirects the browser to ADFS to get a SAML token. 6. ADFS, through Integrated Windows Authentication, validates the user authentication against Active Directory, and once successful, it creates a SAML token and redirects the browser back to OAM. 7. OAM reads the SAML to...

The Request and Direct Role assignments are two types of operations that are defined in OIM.  Here is the link to the doc . For example, if you are a user administrator, then all operations such as create user, modify user, grant account, enable user account, and so on are direct operations. Similarly, if you have been assigned the User Viewer admin role, then operations such as create user, enable user, delete user, grant role, revoke entitlements, and so on result in a request being created. See below table for various Request or Direct Operations that are allowed based on the type of Role in OIM. The Help Desk role is an interesting one, it has capabilities for both operations (Direct and Request based) - for example, Change User Password can be done by the Help Desk role via Direct operation, whereas in order to Enable a User, the Help Desk user will have to invoke a Request based operation. In other words Help Desk role/user cannot directly enable a user. However as...

Oracle EBS E-Business suite can be integrated with Oracle IAM suite to provide a complete user access management solution. However in order to use integration with Oracle Access Manager (OAM) it is mandatory to use Oracle Internet Directory (OID). ( Note: There is a newer integration of Oracle EBS with Oracle Identity Cloud Service where there is no requirement of OAM or OID. Here is the link for this new integration . )  To understand the integration of EBS with OAM/OID, see below the (a) architecture EBS+OAM+OID integration and (b) flow of authentication with EBS+OAM+OID. (Note: EBS has the capability to provide authentication and access control without OAM since EBS has its own native AccessGate which uses the header variables to create user sessions. These header variables similar to OAM_HEADER can be sent by any other external Access Management solution.) Also refer here for the concepts of how Single sign on works with OAM and Oracle Fusion Middleware. Update (July 2019) ...

This post provides an overview of WebLogic configuration for Active Directory as Authentication provider with several key settings. It is assumed that you have already configured the security realm. The version of WebLogic is 12c and the document being followed is the Oracle Fusion Middleware Securing WebLogic server, chapter 5 - configuring Authentication Providers. The key settings in the Authentication Provider are 1) User DN: For providing the container or DN of the users who will be authenticating 2) Group DN: For providing the container or DN of the users who will be authenticating 3) Host: This setting is for providing the Active Directory domain controllers list. However, this will vary according to the current environment, whether it is a single domain or multi-domain. Above 1),2),3) are from WebLogic Security realm configuration with Authentication Provider. The below 4) is for the Application that is deployed on the WebLogic server. Once user has been authenticated,...

ITSM is  (1) Best Practices (2) Non-prescriptive (3) Non-proprietary Best practices - compiled experiences and success factors from various organizations over decades In the end ITSM provides a framework that is descriptive This framework has to be adopted by an organization and accordingly adapted to the particular organization. How it is adapted is left to the organization - It is NOT a HOW TO DO. HOW TO DO is actually implementing Adopting is NOT implementing ITIL. (because ITIL is a set of best practices) Adopt is about governance required to manage IT services. Now to implement governance your require policies, and this results to an organization adapting to ITIL. ITSM is a management system. Comparison with COBIT The process focus of COBIT is modelled via a process model that subdivides IT into four domains PBRM Plan Build Run Monitor Plan and Organize Acquire and Implement Deliver and Support Monitor and Evaluate and its Governance...

DevOps as the name suggests is composed of two words, Dev and Ops, i.e. Development and Operations. Development as in Application or Software development and Operations as in IT Operations. Traditionally these two streams have been distinct with a strict boundary between the two work streams. DevOps is a melding of these two work streams to bring in cohesion between the Development and IT Operations teams for better and transparent communication and collaboration. Even though these are two different streams (Development and IT Operations) with specific skill set, DevOps (Dev and IT Ops) brings in faster and smooth deployment cycles. Earlier or traditional Development handing off to Operations was slow and had rigid deployments. If things broke in production, the version is sent back to Development for a fix with a bug report, Development would reproduce the issue, provide a fix and send to Operations for deployment. This traditional cycle from Application Development, to testing an...

Netbeans 9 installation First is it requires support of nb-javac library which according to Netbeans is highly recommended.  nb-javac is a library which is required when you are installing Netbeans 9. There are several reasons why this library is not included as part of the standard Netbeans install binaries. The foremost reason being Java/JDK is licensed separately from Netbeans. The details being that Netbeans is now under Apache licensing or rather Apache now owns Netbeans, however, Java/JDK license is owned by Oracle separately. Hence Apache could not bundle java/jdk with the Netbeans installation binaries. Users will have to separately download and install the java/jdk binaries, which can be done by downloading nb-javac library. Or the other option is to run Netbeans on JDK 9 or later, in other words your default JDK on the Operating System should be JDK 9 or later. In either case it is recommended to use the nb-javac library which has been tuned to work with Netbeans. Con...

Note: SoapUI has two versions, one is open source and second Professional version. The open source can be download here . (confirmed link 12/19/2018). SSL Handshake issue:   There is an Issue in SoapUI version 5.3.0 (and 5.2.0 version) with SSL handshake error. It was resolved by updating below in vmoptions file ( refer here ). However, the error that shows up while trying to load wsdl is "Error loading WSDL" as below The fix is to Enable TLS 1.2 protocol for SOAP/REST calls in SoapUI, by ammending the vmoptions file to add the directive for TLS as (-Dsoapui.https.protocols=TLSv1.2). Refer here . Update: Version 5.5.0 does not have this issue. If you are on 5.3.0 better upgrade to 5.5.0 which is available now (Feb 2019). I had above issue as well as another issue reaching to https endpoint. Upgrade to 5.5.0 resolved issue. Select "Check for updates" under the Help menu and you will get option for upgrade. Select upgrade current version and accept all defaul...

Recently we got a OVA file for a virtual machine. The vendor instructions were to import the ova file in vmware Workstation, Player for Windows/Linux, Fusion for Mac, and VirtualBox as well.  The instructions were to take the available package and launch the VM with VMware workstation. The package contained  Module.mf, Module.ovf and Module-disk.vmdk and a Module.ova file. The .mf and .ovf file were 2 KB each whereas the vmdk was several gigs. The package also contained a Module.ova file which was several gigs as well. OVF           Open Virtualization Format MF             Manifest file VMDK       Virtual Machine Disk OVA           Open Virtualization Appliance The ovf file is a xml file that contains metadata for the ovf package The mf file contains the SHA1 hash codes of all files in the package The vmdk file is the disk image of the virtual mac...