#oim oracle | Explore Tumblr posts and blogs

oracle-fusion-financials-1 · 8 months ago

Text

What is Oracle Fusion Middleware?

Oracle Fusion Middleware (OFM) is a comprehensive suite of software solutions designed to facilitate enterprise-level software development and integration. Built on Java EE standards, it provides a set of services and tools that allow businesses to manage complex IT environments, integrate disparate systems, and streamline business processes. It bridges the gap between different enterprise applications, databases, and even cloud services, ensuring that businesses can adapt to evolving IT landscapes with minimal disruption.

Here, we’ll explore the components of Oracle Fusion Middleware, its key benefits, and why it’s a vital tool for modern businesses.

Key Components of Oracle Fusion Middleware

Oracle Fusion Middleware is composed of several layers of software and services, each addressing different aspects of business IT infrastructure. Some of the core components include:

1. Oracle WebLogic Server

The cornerstone of OFM, Oracle WebLogic Server, is an application server that provides a runtime environment for building and deploying enterprise Java EE applications. It's known for its scalability, reliability, and ability to handle mission-critical applications. WebLogic offers capabilities for developing, deploying, and managing large-scale applications in a distributed computing environment.

2. Oracle SOA Suite

Service-Oriented Architecture (SOA) is critical for integrating disparate systems across an organization. Oracle SOA Suite simplifies the process of building, deploying, and managing integrations by allowing services to communicate with each other, even if they are written in different programming languages or run on different platforms. SOA Suite includes essential tools like BPEL (Business Process Execution Language), enterprise service buses (ESBs), and adapters that connect various enterprise systems.

3. Oracle BPM Suite

Oracle Business Process Management (BPM) Suite extends the capabilities of the SOA suite to include the modeling, simulation, and execution of business processes. It enables organizations to automate and optimize their business workflows, improve agility, and enhance operational efficiency. With Oracle BPM, businesses can streamline their decision-making processes and ensure alignment with strategic goals.

4. Oracle Identity Management

Security is a top priority in today’s digital business environment. Oracle Identity Management (OIM) provides a platform to manage user identities, access privileges, and ensure compliance with regulatory requirements. It includes features for single sign-on (SSO), role-based access control (RBAC), and user provisioning, making it easier to manage security across a distributed IT environment.

5. Oracle Business Intelligence (BI)

Oracle's BI components help businesses gain insights from their data. Oracle BI Suite Enterprise Edition (OBIEE) is a platform that provides interactive dashboards, ad-hoc query capabilities, and reporting tools. It enables decision-makers to make data-driven decisions by analyzing trends, KPIs, and business performance metrics.

6. Oracle Data Integrator (ODI)

ODI simplifies the process of extracting, transforming, and loading (ETL) data between systems. It’s designed to handle large-scale data integration challenges, offering high-performance batch processing as well as real-time integration solutions. ODI ensures that data flows seamlessly between databases, enterprise applications, and cloud services, enabling organizations to maintain data consistency and integrity.

7. Oracle Content and Experience

Content management and collaboration are critical in today’s digital workplace. Oracle Content and Experience is a cloud-based solution that allows organizations to manage content, collaborate, and deliver personalized user experiences across various digital channels. It serves as a hub for sharing and managing documents, images, videos, and other content while ensuring consistency and governance.

Key Benefits of Oracle Fusion Middleware

1. Integration Across Heterogeneous Systems

One of the greatest advantages of OFM is its ability to integrate different systems, even those running on disparate technologies. Whether it’s connecting legacy systems with modern cloud-based applications or integrating on-premise databases with third-party services, OFM provides the tools necessary to create a seamless IT ecosystem.

2. Scalability and Flexibility

As enterprises grow, their IT infrastructure needs to scale accordingly. Oracle Fusion Middleware offers unparalleled scalability, allowing organizations to expand their applications, services, and data management solutions without having to re-architect the entire system. Its cloud-ready architecture also ensures flexibility, giving businesses the option to deploy their solutions on-premise, in the cloud, or in hybrid environments.

3. Enhanced Security and Compliance

With a strong focus on identity management and access control, Oracle Fusion Middleware ensures that businesses can maintain robust security measures across their IT landscape. The comprehensive security features allow for centralized control of user identities and permissions, making it easier to comply with industry regulations and internal policies.

4. Improved Business Agility

With tools like the Oracle SOA and BPM suites, OFM enables businesses to automate and streamline their operations. By simplifying business processes and eliminating manual intervention, businesses can respond to market changes more quickly and innovate faster.

5. Reduced Complexity

Oracle Fusion Middleware provides a unified platform that reduces the complexity of managing multiple systems and platforms. This results in easier maintenance, faster deployment, and reduced overhead in managing IT infrastructure.

Use Cases of Oracle Fusion Middleware

1. Application Integration

For large organizations with multiple legacy applications, integrating these systems with newer cloud-based services can be challenging. Oracle Fusion Middleware’s SOA and data integration tools allow for smooth integration, enabling different systems to communicate and share data efficiently.

2. Process Automation

Businesses in industries like manufacturing, finance, and retail rely on process automation to maintain efficiency. Oracle BPM and SOA Suites help automate manual workflows, reducing operational costs and improving time to market.

3. Data-Driven Decision Making

In today’s competitive market, businesses must leverage data to make informed decisions. Oracle BI tools enable organizations to gather insights from their vast amounts of data, giving them a competitive edge through analytics, reporting, and data visualization.

4. Hybrid Cloud Environments

Many organizations are adopting hybrid cloud strategies that combine on-premise infrastructure with cloud services. Oracle Fusion Middleware supports hybrid environments, offering the flexibility to integrate and manage applications across different cloud providers and on-premises systems.

ConclusionOracle Fusion Middleware is a powerful and comprehensive suite of tools that empowers enterprises to manage their IT infrastructure efficiently. It serves as the backbone for organizations looking to integrate, secure, and optimize their business processes. With capabilities that extend from integration and security to business intelligence and content management, OFM ensures that businesses can meet the challenges of digital transformation and stay competitive in an ever-evolving market. To Your bright future join Oracle Fusion Financials.

#careergrowth #erptraining #financecareers #erptree #oraclefusion #jobguarantee #oraclefusionfinancials #financejobs #hyderabadtraining #100jobguarantee

0 notes

marlondouglastech · 1 year ago

Text

Feeling overwhelmed with Peoplesoft ERP enhancements?We've got you covered! Our Oracle NetSuite expertise includes seamless cloud integration with key systems like OIM, making your life easier. Our team of Oracle Cloud experts can help you quickly implement the necessary customizations and tweaks, so you can stay ahead of the competition and also assist you with ongoing maintenance and support to ensure optimal performance.Partner with Tangenz, an Oracle Preferred Partner, for seamless solutions. Learn more at https://tangenz.com/

#cloud hcm #fusion analytics warehouse

0 notes

superbhideoutstarlight-blog · 8 years ago

Photo

OIM online training | Bytes online training

#oim onlinetraining #oim oracle

0 notes

digital9900 · 2 years ago

Text

If you want to gain expertise in Oracle Identity Manager and advance your career in Identity and Access Management, APTRON Solutions NOIDA is the perfect training institute for you. With their Oracle Identity Manager Training in Noida, you will gain a solid understanding of OIM and its various components, making you well-equipped to handle real-world situations. Attend their course today and take the first step towards advancing your career in Identity and Access Management.

#OracleIdentityManagerTraining #IAMTraining #APTRONSolutionsNOIDA

0 notes

identityclasses · 2 years ago

Text

Become a master in Oracle Identity Manager (OIM) Development

Our scenario-based OIM Training Program is designed to teach you real-world skills and strategies faster than any other approach. Not only will you be a big step closer to prestigious OIM Certification, you’ll also have the confidence to convince any business or organization that you have the skills they’re looking for.

#oracle #identityclasses #cybersecurity #infosec

0 notes

shadycollectorcheesecake-blog · 4 years ago

Link

0 notes

recruitersgo · 5 years ago

Photo

OIM Consultant (Oracle Identity Manager) II Woonsocket, RI https://ift.tt/2HxeyU0

0 notes

oraclefusionmhcmblog · 5 years ago

Text

Oracle Fusion HCM Blog

Client AND ROLE PROVISIONING PROCESSES:

- > Send Pending LDAP Requests: Bulk preparing of client and job provisioning demands.

Sends mass solicitations to OIM quickly to make (and furthermore suspend or re-empower) client accounts, as proper. At the point when you load individual records, the application consequently makes client account demands as a matter of course and arrangements jobs to clients as per job provisioning rules.

Before you run this procedure, survey your information change completely and affirm its exactness. In the event that you have to cleanse your information and rehash the transformation, it will take any longer on the off chance that you've made client accounts and advised clients of their sign-in subtleties. You can control parts of the provisioning procedure for the venture by setting the User and Role Provisioning choices on the Manage Enterprise Oracle Fusion HCM Online Information page. For instance, you can smother the programmed making of client accounts.

This procedure sends to the LDAP index the solicitations identified with client account provisioning just as the solicitations for including and evacuating client jobs. You normally utilize this to procedure the provisioning demands made by mass procedures just as to process future dated solicitations.

This activity ought to be booked in any event once every day to deal with any mass or future-dated client or job provisioning demands.

This activity ought to likewise be pursued stacking laborers or clients in mass utilizing Oracle Fusion HCM Online Data Loader.

- > Autoprovision Roles for All Users (Ad Hoc Rarely): Evaluates jobs enrollment for all clients, including latent.

This procedure assesses all clients in the framework against the job provisioning rules. This procedure may have overwhelming execution sway on your condition on the off chance that you run it consistently. You should run this procedure sporadically, just when job provisioning rules are included or refreshed.

Ought to be run just when job mapping rules have been included or changed, and these guidelines apply to the whole client populace.

This activity shouldn't be routinely planned as programmed job provisioning occurs as a feature of client creation.

Never expected to be utilized oftentimes on consistent schedule.

- > Send Personal Data for Multiple Users to LDAP(Ad Hoc Rarely): Reconciles individual data changes in Oracle Fusion HCM Online with LDAP catalog

This procedure synchronizes changes acted in mass on Oracle HCM Cloud individual records with the LDAP registry records. The accompanying fields are synchronized: First Name, Last Name, Email, and Manager. You ordinarily pursue this procedure stacking individual information in mass. You can likewise run this procedure to refresh the administrator chain of importance in the LDAP catalog

This activity is just required in the wake of changing individual information (name, administrator, email) by means of a mass procedure, for example, HCM Data Loader imports.

This activity ought to be planned to pursue once the mass burden is finished.

- > Retrieve Latest LDAP Changes (Very once in a while): Updates Oracle Fusion HCM Online individual records with information originating from LDAP catalog.

This activity refreshes the Oracle Cloud Applications Security tables with information originating from the LDAP registry. You should pursue this procedure once the item update is finished. For instance, after you overhaul from 18C to 19A.

Never expected to be utilized much of the time on consistent schedule.

- > Synchronize Bell Notifications (Every 2 hours): Bell Notifications to synchronize with the BPM Worklist

To move the effectively endorsed warnings from chime, there is an ESS work definition which can be planned to run intermittently. Benefit Needed to Schedule/Execute this Job Definition is : FND_MANAGE_SCHEDULED_JOB_DEFINITION_PRIV ( This benefit moves up to all the Family Admin Job Roles).

They will be set apart as Read/moved from Pending Notifications to All Notifications promptly once the client peruses them as there are no pending activities on them.

The Synchronize Bell Notifications ought to be booked for each 2 hrs. furthermore, is limited by Development to refresh 500 records one after another.

- > Calculate Seniority Dates(Adhoc): To figure the position dates for laborers dependent on the status rules arranged in the application

Parameters:

Individual Number: Enter individual number

Rank Date Code List: ORA_ESD_P,ORA_LESD_W( This qualities might be diverse dependent on the client designs - See the arrangement information table for this data) (ORA_ESD_P,ORA_LESD_W,ORA_POSITION_SD_A)

Prohibit ended Workers: Yes

Activity: Clean And Repopulat

Arrangement and Maintenance > Manage Common Lookups utilizing the Lookup

Type ORA_PER_SENIORITY_ITEMS

- > Synchronize Transaction Workflow Status(Daily once and Adhoc):

This procedure guarantees that the work process status is refreshed accurately in SOA and Oracle Fusion Applications

- > Import User and Role Application Security Data (Daily Once) : To set up and keep up the Security Console

It duplicates clients, jobs, benefits, and information security arrangements from the LDAP catalog, strategy store, and Applications Core Grants outline to Oracle Fusion HCM Online Applications Security tables. IT Security Manager : this job must to run this procedure.

- > Importing User Login History (Daily Once) :This assignment runs a procedure that imports data about client access to Oracle Fusion Applications to the Oracle Fusion Applications Security tables

This data is required by the Inactive Users Report, which provides details regarding clients who have been latent for a predefined period.

- >Optimize Person Search Keywords (Daily on occasion of low action):

Enhance Person Search Keywords Index procedure to recognize the divided lists and help improve the general inquiry execution.

The Update Person Search Keywords process first and afterward the Optimize Person Search Keywords process. We can't plan the two procedures at the same time. On the off chance that you plan them simultaneously, the subsequent procedure will trust that the primary procedure will finish before it begins.

- > Process and Reassign Inactive User Accounts(Daily Once):

Procedure that recognizes dormant client records and expels them from their groups. It likewise sends notices to individuals reassigned as the new group leads.

- > To mirror the Flex Fields in OTBI then we have to run the underneath procedure in succession:

Make Rules XML File for BI Extender Automation

Import Oracle Fusion Data Extension For Transactional Business Intelligence

#Oracle Fusion HCM Online Training #Oracle Fusion HCM Training #Oracle Fusion HCM Training in Hyderabad #Oracle Fusion HCM Training Videos

0 notes

marlondouglastech · 1 year ago

Text

Feeling overwhelmed with Peoplesoft ERP enhancements?

We've got you covered! Our Oracle NetSuite expertise includes seamless cloud integration with key systems like OIM, making your life easier. Our team of Oracle Cloud experts can help you quickly implement the necessary customizations and tweaks, so you can stay ahead of the competition and also assist you with ongoing maintenance and support to ensure optimal performance.

Partner with Tangenz, an Oracle Preferred Partner, for seamless solutions. Learn more at https://tangenz.com/

#Fusion Analytics Warehouse #cloud hcm

0 notes

ssnlinux · 8 years ago

Text

Things I’ve Learned: FreeIPA

I've been a user of FreeIPA for quite a long time, mostly in home and lab environments that didn't really have any bearing on enterprise environments. I always saw it as a sort of Active Directory (it's not) for Linux and UNIX systems and used it to test various things. One example of using it to test "things" was practicing for my RHCE in 2016 and also studying my Red Hat Security Hardening. Now I've used it since version 3.0, and it definitely has come a long way since then. I never really took a lot of the time I thought was necessary to learn specific things about it, in terms of having it work with an Active Directory and even 2FA/OTP among other things. Many years ago, there were functions such as winsync (which is now deprecated) that helped with this, while even the sssd components began to slowly integrate Active Directory support directly.

To give some backstory to the title of this post: In my current job, we are a mixed environment shop. We have a handful of Windows, Linux, and UNIX systems. Because of this, we have two separate directory servers. We have an LDAP and an Active Directory. A few years back, I respawned conversations that were shut down by previous management: We need to consolidate directory servers into at least Active Directory. Practically all of our workstations run Windows or Mac. Our usernames between both directories are different (LDAP uses underscores between first and last names, AD had first initial, last name up to 7 characters and now it's first.last). You can imagine how confusing this is and how annoying this actually is.

You can imagine the challenges this brings. In fact, here's a list of challenges this poses for the organization.

New users get confused and think they login with user.name@domain, domain\user.name, user.name on Linux/UNIX systems

Users at times do not know what username is used for what application or system (is it user_name or user.name for $x?)

Introduction of OIM (oracle identity manager) and OAM (oracle access manager), which was setup incorrectly and managed poorly by incompetent team called "information security"

Now you might wonder why does this matter to my FreeIPA topic. Simple, it causes issues for the UNIX engineering team (which I now co-lead).

Managers and above as well as new users expect all their access to be already there for all Linux/UNIX systems they need to work on

Again, new users get confused and use AD usernames to login to Linux/UNIX systems

Access is defined on their LDAP objects as "host: hostname"

SUDO is hybrid: LDAP and /etc/sudoers.d files

Identity management tools, which have been in the environment for almost 4 years, were never designed to handle the above

Management is reluctant to go to "member" groups to define access to systems (to emulate "role based" access)

This is where I stepped in and suggested that we need to use a different product, even though I initially suggested we go to AD entirely. The problem with going to AD entirely is that it takes away the UNIX team's management, and plus we would probably need to buy other products or software just to get group policies to work. This did not sit well with majority of my team and I didn't like the idea either, especially because we then begin to lose a sense of control on our own systems. This is when I suggested FreeIPA, as FreeIPA at the time (version 4.4) supported IPA-AD trusts. This meant that it gave control back to the UNIX team to our own infrastructure. Logins would be from our AD, we wouldn't need to create accounts in FreeIPA. This reduces a lot of overhead on us, leaving LDAP to start to (hopefully) die off. My team as a whole agreed to the idea so I took the project and started it up.

This is what I've learned and achieved.

The Setup

The setup was easy for me. The network team delegated me a subdomain of one of our internal domains to make my life easier. The Windows team was also extremely helpful and helped me get the AD trust up. I didn't expect it to be a pain, as my tests at home succeeded. The trust was setup, enabling compat and posix attributes (uidNumber, gidNumber, unixHomedirectory, loginShell) to try and make the migration from LDAP to IPA easier. The Windows engineer also setup my team as well as two other teams with the attributes so I had a biggger test bed.

After doing this, I also set the domain resolution order (FreeIPA 4.5) to be the AD domain first. That way, logging in with just user.name without the @domain works without much an issue. And then, clients using sssd had full_name_format set to %1$s to make it less confusing for users on their prompts. I didn't like the idea of having a prompt like [email protected]@servername - that's extremely annoying to look at. When this is set, you are able to do id for users in both AD or IPA without the domain on the name and it succeeds on RHEL 7 and higher. Setting domain resolution order back to blank or not setting it at all will require the @domain to be used for logins, including in the compat tree. There's really no other clear way around this as far as I know.

SID Numbers

The issue with trying to do a cleanish migration is that you can't change gid numbers out from under people. FreeIPA creates a range for your domain and also creates a range for AD, even if you don't use it/you're using posix attributes. When you create groups outside of IPA's defaulted range, they will not receive SID numbers. In this case, I had to create another range and then rerun the proper SID generating scripts.

I created a range with this data:

Base ID: 10

Range size: 50000

Primary RID base: 200000000

Secondary RID base: 200050000

I then did an update across the board. This took a little bit.

# cat > /root/task/80-sidgen-task-conf.uipdate <<EOF dn: cn=$TIME-$FQDN,cn=ipa-sidgen-task,cn=tasks,cn=config add:objectClass: top add:objectClass: extensibleObject add:cn:$TIME-$FQDN add:nsslapd-basedn: $SUFFIX add:delay: 0 EOF # ipa-ldap-updater /root/task/80-sidgen-task-conf.update

SUDO

SUDO for clients older than RHEL 7 was very interesting when in a IPA-AD trust.

Legacy Clients

Our environment is ridiculously mixed. We have Solaris 8, 10, 11, RHEL 5, 6, and 7. We also have Fedora workstations that my team uses because we dislike Windows, but that's a different story. We have still been trying to get rid of Solaris 8 forever now, but without any movement. We decided to not attach Solaris 8 to FreeIPA to hopefully let the systems rot.

RHEL 5

"RHEL 5???" you might be thinking. Yes. It's been out of support since March 31, 2017. This company has no concept of anything "new" or wanting to get rid of technology debt. So since we were probably going to be stuck with RHEL 5 for another year or so, I had to figure out how to get it to connect to FreeIPA - not only as a client but also be able to see Active Directory users. The first thing I learned here: Always use the ipa-advise command - Seriously. This will help you out so much.

In my case, I used nss pam ldap to help here. What this provided at the very least is the ability to get sudo to actually work 100% of the time - sudo didn't work all the time when sssd was the id provider. Here's the issue:

The domain resolution order configuration causes multiple uid attributes to appear on objects in the compat tree - this is normal.

Group membership, even in the compat tree, is defined by [email protected], rather than just user. As far as I know, there's no clear way around this. Running groups or id will not show proper membership.

sudo probably only worked here because of the id output, even though I was logging in with first.last, my id shows up as [email protected] and associated that properly with my group membership

When using sssd, while the user would appear as first.last, group membership would never be applied. Here's what I mean.

dn: uid=first.last,cn=users,cn=compat,dc=ipa,dc=example,dc=com cn: First Last objectClass: posixAccount objectClass: top gidNumber: 1006800013 gecos: First Last uidNumber: 10000 loginShell: /bin/bash homeDirectory: /home/first.last uid: [email protected] uid: first.last dn: cn=unixadm,cn=groups,cn=compat,dc=ipa,dc=example,dc=com gidNumber: 5900 objectClass: posixGroup objectClass: ipaOverrideTarget objectClass: ipaexternalgroup objectClass: top ipaAnchorUUID:: removed cn: unixadm memberUid: [email protected]

I'm sure you see the problem. This causes other issues: If you're trying to use pam_hbac, it seems to want to work using pam_sss in the stack, not pam_ldap. With pam_ldap, it doesn't even try. With pam_sss, it tries, but it ultimately fails because it doesn't seem to be properly evaluating the rules and groups - again, this goes back to what I said: group membership is not seen with sssd fully while nss pam ldap can associate it to an extent.

As of this writing, I was never able to properly figure this out. What I noticed is in sssd, the group memberships were always intermittent. In fact, it always acted weird - if I did getent group unixadm, it'd show me. As soon as I ran id against my user, I'd disappear from the group. And I found this to be very troublesome. Sometimes it worked, other times it didn't. I could never really figure out why this was happening. One thing I did try was updating SSSD to 1.9.6 from a COPR repo. That didn't help.

Long story short: get rid of your RHEL 5 systems. At least RHEL 6 worked. Sort of.

Solaris 10

Alright, so this is where it gets interesting. Getting it to work with FreeIPA was a chore, a serious chore. The worst part about all of this is the communication from the system to FreeIPA is unencrypted. Yes, you heard this right. Unencrypted. I couldn't even get it to be OK with Kerberos login to at least have a secure channel. The saving grace here is that if you have a keytab on your system and login, it should just work. The other problem I had is I needed to use pam_ldap in my pam configuration.

First thing I needed is a profile that the ldapclient could use. I also created a solaris system account. Here's an example ldif below you can add into IPA.

dn: cn=solaris_authpam,ou=profile,dc=ipa,dc=example,dc=com serviceAuthenticationMethod: pam_ldap:simple authenticationMethod: simple objectClass: top objectClass: DUAConfigProfile bindTimeLimit: 5 cn: default cn: solaris_authpam defaultSearchBase: dc=ipa,dc=example,dc=com defaultServerList: pentl01.ipa.example.com pentl02.ipa.example.com followReferrals: TRUE objectclassMap: shadow:shadowAccount=posixAccount objectclassMap: passwd:posixAccount=posixaccount objectclassMap: group:posixGroup=posixgroup profileTTL: 6000 searchTimeLimit: 15 serviceSearchDescriptor: group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com serviceSearchDescriptor: sudoers:ou=sudoers,dc=ipa,dc=example,dc=com dn: uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com objectClass: account objectClass: simpleSecurityObject objectClass: top uid: solaris userPassword: secret123

I needed to create a keytab for the host.

# ipa host-add hostname.example.com # ipa-getkeytab -s pentl01.ipa.example.com -p host/[email protected] -k /tmp/hostname.keytab

I then transferred the keytab to the system and put it at /etc/krb5/krb5.keytab. I configured /etc/krb5/krb5.conf.

[libdefaults] default_realm = IPA.EXAMPLE.COM dns_lookup_kdc = true verify_ap_req_nofail = false [realms] IPA.EXAMPLE.COM = { } DOMAIN.TLD = { } [domain_realm] ipa.example.com = IPA.EXAMPLE.COM .ipa.example.com = IPA.EXAMPLE.COM domain.tld = DOMAIN.TLD .domain.tld = DOMAIN.TLD [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log kdc_rotate = { period = 1d version = 10 } [appdefaults] kinit = { renewable = true forwardable= true }

Set the permissions of the keytab to 600, owned by root:sys. Once it was configured, I tested kinit [email protected]. If you get a message about "kt warn", it can be ignored. After this, set /etc/defaultdomain to your ipa domain (ipa.example.com). Configure /etc/ldap.conf.

base dc=ipa,dc=example,dc=com scope sub TLS_CACERTDIR /var/ldap TLS_CERT /var/ldap/cert8.db TLS_CACERT /var/ldap/ipa.pem tls_checkpeer no ssl off bind_timelimit 120 timelimit 120 uri ldap://pentl01.ipa.example.com sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com pam_lookup_policy yes

Create /var/ldap if needed and create an NSS certificate database. You should also have your CA certificate as /var/ldap/ipa.pem.

# cd /var/ldap # /usr/sfw/bin/certutil -A -n "ca-cert" -i /var/ldap/ipa.pem -a -t CT -d .

At this point, I do the ldapclient init.

# ldapclient init -a profileName=solaris_authpam \ -a domainName=ipa.example.com \ -a proxyDN="uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com" \ -a proxyPassword="secret123" \ -D uid=solaris,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com \ -w qdbKnW1et pentl01.ipa.example.com

Now configure /etc/nsswitch.conf.

passwd: files ldap [NOTFOUND=return] group: files ldap [NOTFOUND=return] sudoers: files ldap netgroup: ldap

Now configure /etc/pam.conf

# Console login auth requisite pam_authtok_get.so.1 login auth sufficient pam_krb5.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth required pam_unix_auth.so.1 use_first_pass login auth required pam_ldap.so.1 rlogin auth sufficient pam_rhosts_auth.so.1 rlogin auth requisite pam_authtok_get.so.1 rlogin auth sufficient pam_krb5.so.1 rlogin auth required pam_dhkeys.so.1 rlogin auth required pam_unix_cred.so.1 rlogin auth required pam_unix_auth.so.1 rlogin auth required pam_ldap.so.1 # Needed for krb krlogin auth required pam_unix_cred.so.1 krlogin auth sufficient pam_krb5.so.1 # Remote Shell rsh auth sufficient pam_rhosts_auth.so.1 rsh auth required pam_unix_cred.so.1 rsh auth binding pam_unix_auth.so.1 server_policy rsh auth required pam_ldap.so.1 # Needed for krb krsh auth required pam_unix_cred.so.1 krsh auth required pam_krb5.so.1 # ? ppp auth requisite pam_authtok_get.so.1 ppp auth required pam_dhkeys.so.1 ppp auth required pam_dial_auth.so.1 ppp auth binding pam_unix_auth.so.1 server_policy ppp auth required pam_ldap.so.1 # Other, used by sshd and "others" as a fallback other auth requisite pam_authtok_get.so.1 other auth sufficient pam_krb5.so.1 other auth required pam_dhkeys.so.1 other auth required pam_unix_cred.so.1 other auth binding pam_unix_auth.so.1 server_policy other auth required pam_ldap.so.1 other account requisite pam_roles.so.1 other account required pam_projects.so.1 other account binding pam_unix_account.so.1 server_policy other account required pam_ldap.so.1 other session required pam_unix_session.so.1 other password required pam_dhkeys.so.1 other password requisite pam_authtok_get.so.1 other password requisite pam_authtok_check.so.1 other password required pam_authtok_store.so.1 server_policy # passwd and cron passwd auth binding pam_passwd_auth.so.1 server_policy passwd auth required pam_ldap.so.1 cron account required pam_unix_account.so.1 # SSH Pubkey - Needed for openldap and still probably needed for ipa # without this, ssh keys stopped working. sshd-pubkey account required pam_unix_account.so.1

I installed pkgutil from OpenCSW. Seriously, this will help you out tremendously.

# /opt/csw/bin/pkgutil -y -i sudo sudo_ldap # vi /etc/opt/csw/sudo.conf Plugin sudoers_policy sudoers-ldap.so Plugin sudoers_io sudoers-ldap.so # ln -s /etc/ldap.conf /etc/opt/csw/ldap.conf

After that, I went ahead and tested id, logins, etc.

bash-3.2# id louis.abel uid=25439([email protected]) gid=1006800013(aocusers)

The current problem is that id won't show group membership, yet if you run the groups command, it will. Just because it shows the groups, doesn't mean you can really work with the files that are group owned as such. This only changes if you login via [email protected].

Solaris 11

Solaris 11 was a lot more forgiving. I was able to get SSL to work and the sudo that they provide to work also. Most of the things above can be used. I'll point out which ones you can pull from above.

Create another profile on the IPA server.

dn: cn=solaris_authssl,ou=profile,dc=ipa,dc=example,dc=com authenticationMethod: tls:simple objectClass: top objectClass: DUAConfigProfile bindTimeLimit: 5 cn: default cn: solaris_authssl defaultSearchBase: dc=ipa,dc=example,dc=com defaultServerList: pentl01.ipa.example.com pentl02.ipa.example.com followReferrals: TRUE objectclassMap: shadow:shadowAccount=posixAccount objectclassMap: passwd:posixAccount=posixaccount objectclassMap: group:posixGroup=posixgroup searchTimeLimit: 15 serviceSearchDescriptor: group:cn=groups,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: passwd:cn=users,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: netgroup:cn=ng,cn=compat,dc=ipa,dc=example,dc=com serviceSearchDescriptor: ethers:cn=computers,cn=accounts,dc=ipa,dc=example,dc=com serviceSearchDescriptor: sudoers:ou=sudoers,dc=ipa,dc=example,dc=com profileTTL: 6000

Generate your keytabs and move them to the server.

Configure the krb5.conf file as necessary.

Set /etc/defaultdomain to your IPA domain.

Place IPA cacert into /var/ldap/ipa.pem

Your /etc/ldap.conf will need to be a tad different on Solaris 11. You will need to remove the TLS_CERT line. Solaris 11 no longer uses NSS.

base dc=ipa,dc=example,dc=com scope sub TLS_CACERTDIR /var/ldap TLS_CACERT /var/ldap/ipa.pem tls_checkpeer no ssl off bind_timelimit 120 timelimit 120 uri ldap://pentl01.ipa.example.com sudoers_base ou=sudoers,dc=ipa,dc=example,dc=com pam_lookup_policy yes

To configure nsswitch, you have to run commands (thanks oracle).

/usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/default = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/sudoer = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/password = astring: "files ldap [NOTFOUND=return]"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/group = astring: "files ldap [NOTFOUND=return]"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/host = astring: "files dns"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/network = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/protocol = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/rpc = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/ether = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/netmask = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/bootparam = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/publickey = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/netgroup = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/automount = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/alias = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/printer = astring: "user files"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/service = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/project = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/auth_attr = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/prof_attr = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/tnrhtp = astring: "files ldap"' /usr/sbin/svccfg -s svc:/system/name-service/switch 'setprop config/tnrhdb = astring: "files ldap"' /usr/sbin/svcadm refresh svc:/system/name-service/switch ; /usr/sbin/svcadm restart svc:/system/name-service/switch ; /usr/sbin/svcadm restart ldap/client

Now you need to setup all of your pam files. Here are the ones I configured and it worked.

# /etc/pam.d/krlogin auth required pam_unix_cred.so.1 auth required pam_krb5.so.1 # /etc/pam.d/krsh auth required pam_unix_cred.so.1 auth required pam_krb5.so.1 # /etc/pam.d/login auth requisite pam_authtok_get.so.1 auth sufficient pam_krb5.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth required pam_dial_auth.so.1 auth required pam_unix_auth.so.1 server_policy auth required pam_ldap.so.1 # /etc/pam.d/other auth definitive pam_user_policy.so.1 auth requisite pam_authtok_get.so.1 auth sufficient pam_krb5.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth required pam_unix_auth.so.1 server_policy auth required pam_ldap.so.1 account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account required pam_unix_account.so.1 server_policy account required pam_krb5.so.1 account required pam_tsol_account.so.1 account required pam_ldap.so.1 session definitive pam_user_policy.so.1 session required pam_unix_session.so.1 password definitive pam_user_policy.so.1 password include pam_authtok_common password sufficient pam_krb5.so.1 password required pam_authtok_store.so.1 server_policy # /etc/pam.d/passwd auth binding pam_passwd_auth.so.1 server_policy auth required pam_ldap.so.1 account requisite pam_roles.so.1 account definitive pam_user_policy.so.1 account required pam_unix_account.so.1 # /etc/pam.d/ppp auth requisite pam_authtok_get.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth required pam_dial_auth.so.1 auth required pam_unix_auth.so.1 server_policy auth required pam_ldap.so.1 # /etc/pam.d/rlogin auth definitive pam_user_policy.so.1 auth sufficient pam_rhosts_auth.so.1 auth requisite pam_authtok_get.so.1 auth sufficient pam_krb5.so.1 auth required pam_dhkeys.so.1 auth required pam_unix_cred.so.1 auth required pam_unix_auth.so.1 auth required pam_ldap.so.1 # /etc/pam.d/rsh auth definitive pam_user_policy.so.1 auth sufficient pam_rhosts_auth.so.1 auth required pam_unix_cred.so.1 auth required pam_ldap.so.1 # /etc/pam.d/sshd-pubkey account required pam_unix_account.so.1

The only issue is if you are using domain resolution order, trying to login without the realm name for AD users will cause an assertion error. I asked Oracle to fix this because Solaris 10 was fine. I don't know when they'll fix it. As of this writing, they claim October 20, 2017.

The actual current problem is that id won't show group membership, yet if you run the groups command, it will. Just because it shows the groups, doesn't mean you can really work with the files that are group owned as such. This only changes if you login via [email protected] or remove the domain resolution order entirely - this would cause you to have to login with username@domain.

HBAC

For legacy clients to authenticate AD users properly, you need an HBAC rule against the IPA servers that perform the task of talking to AD. I'd recommend creating an ipaservers group (if one doesn't exist already) of all of your IPA servers, and then creating the hbac rules.

# ipa hbacsvc-add system-auth # ipa hbacrule-add system-auth-legacy # ipa hbacrule-add-host --hostgroup=ipaservers # ipa hbacrule-mod --usercat=all system-auth-legacy

For legacy clients, you need the pam_hbac module. For RHEL 5, there is a copr repo that you can pull the RPM's for. For Solaris, you are required to compile them, which isn't fun, I understand. Below I'll show you how to compile the modules and how to utilize the module.

Solaris 10 ++++++++++

You need to install OpenCSW's pkgutil. I also brought the sources of pam_hbac from github over as a git clone in a tar file.

root# pkgutil -y -i libglib2_dev gmake openssl binutils gcc4g++ glib2 ar libnet root# cd /tmp root# tar xf pam_hbac.tar root# cd /tmp/pam_hbac root# PATH=$PATH:/opt/csw/bin root# autoconf -o configure ; autoreconf -i root# ./configure AR=/opt/csw/bin/gar --with-pammoddir=/usr/lib/security --sysconfdir=/etc/ --disable-ssl root# vi Makefile.am ## Comment out the man pages #if HAVE_MANPAGES #SUBDIRS += doc #endif root# make root# make install root# /etc/pam_hbac.conf URI = ldap://pentl01.ipa.example.com BASE = dc=ipa,dc=example,dc=com BIND_DN = uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com BIND_PW = secret123 SSL_PATH = /var/ldap HOST_NAME = hostname.example.com

After this, you can place the hbac lines in your pam file. I usually put it under 'other' and 'login' as "account".

login auth requisite pam_authtok_get.so.1 login auth sufficient pam_krb5.so.1 login auth required pam_dhkeys.so.1 login auth required pam_unix_cred.so.1 login auth required pam_dial_auth.so.1 login auth required pam_unix_auth.so.1 use_first_pass login auth required pam_ldap.so.1 login account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail debug # other account requisite pam_roles.so.1 other account required pam_projects.so.1 other account binding pam_unix_account.so.1 server_policy other account required pam_ldap.so.1 other account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail debug

To answer your question, yes. I had to disable SSL. This is because IPA has a lot of ciphers turned off. Solaris 10 doesn't support much higher, and because these are dynamically compiled (not static), they pick up both SSL libraries from OpenCSW and the system. But the system is picked up first and used.

Solaris 11 ++++++++++

Compiling on Solaris 11 is easier (thankfully).

root# pkg install autoconf libtool pkg-config automake gcc asciidoc docbook (some of these won't install, that's fine) root# cd /tmp root# tar xf pam_hbac.tar root# cd /tmp/pam_hbac root# autoreconf -if root# ./configure --with-pammoddir=/usr/lib/security --mandir=/usr/share/man --sysconfdir=/etc/ root# make root# make install root# /etc/pam_hbac.conf URI = ldap://pentl01.ipa.example.com BASE = dc=ipa,dc=example,dc=com BIND_DN = uid=hbac,cn=sysaccounts,cn=etc,dc=ipa,dc=example,dc=com BIND_PW = secret123 SSL_PATH = /var/ldap HOST_NAME = hostname.example.com

Pam is a little different here. I configured login and other just like on Solaris 10.

# goes at the VERY end of the account block in /etc/pam.d/other and /etc/pam.d/login account required pam_hbac.so ignore_unknown_user ignore_authinfo_unavail debug

General +++++++

You also need to create an hbac service in IPA.

# ipa hbacsvc-add sshd-gssapi # ipa hbacsvc-add sshd-kbdint

You would need to associate those in particular to your HBAC rule sets as needed for your legacy hosts.

Summary

What I've learned overall is that trying to get legacy clients to work with FreeIPA is actually simple if you were only using IPA. It begins to get tricky when you add in AD. The other thing I've learned is that there are companies that will not let go of their dying systems and we just have to live with it. Because this is the case and I know it will not change any time soon, I had to really put a lot of (unnecessary) effort into making this all work. RHEL 6 and RHEL 7? Easy. RHEL 5, Solaris 10/11? Not so easy.

This also gave me a more of a sour taste in my mouth about the political landscape of an enterprise. It's just flat out unfortunate. But, I am glad I got this experience so I can show others what I had to deal with and hopefully others can conquer it in the same way or even better than I have.

#freeipa #linux

1 note · View note