7 Enabling SSL

7.2.1 Change Single Sign-On URLs

Run the ssocfg script, taking care to enter the command on the computer where the single sign-on middle tier is located. Use the following syntax:

• UNIX:

  $ORACLE_HOME/sso/bin/ssocfg.sh protocol host ssl_port
  
  

• Windows:

  %ORACLE_HOME%\sso\bin\ssocfg.bat protocol host ssl_port
  
  

In this case, protocol is https. (To change back to HTTP, use http.) The parameter host is the host name, or server name, of the Oracle HTTP listener for the single sign-on server.

Here is an example:

ssocfg.sh https login.acme.com 4443

To determine the correct port number, examine the ssl.conf file. Port 4443 is the port number that the OracleAS installer assigns during installation.

If you run ssocfg successfully, the script returns a status 0. To confirm that you were successful, restart the OC4J_SECURITY instance:

ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY

Then try logging in to the single sign-on server at its SSL address:

https://host:ssl_port/pls/orasso/

7.2.2 Update targets.xml

After running ssocfg, update the targets.xml file on the single sign-on middle tier.

To update targets.xml:

1. Back up the file:

   cp ORACLE_HOME/sysman/emd/targets.xml ORACLE_HOME/sysman/emd/targets.xml.backup
   
   

2. Open the file and find the target type oracle_sso_server. Within this target type, locate and edit the three attributes that you passed to ssocfg:

   • HTTPMachine—the HTTP server host name

   • HTTPPort—the SSL port number of the Oracle HTTP server

   • HTTPProtocol—the server protocol

   If, for example, you run ssocfg like this:

   ORACLE_HOME/sso/bin/ssocfg.sh https sso.mydomain.com:4443
   
   

   Update the three attributes this way:

   <Property NAME="HTTPMachine" VALUE="sso.mydomain.com"/>
   <Property NAME="HTTPPort" VALUE="4443"/>
   <Property NAME="HTTPProtocol" VALUE="HTTPS"/>
   
   

3. Save and close the file.

4. Reload the OracleAS console:

   ORACLE_HOME/bin/emctl reload
   

7.2.3 Configure Oracle Enterprise Manager Security

Since you are enabling the single sign-on server for SSL, you will need to follow all the configuration instructions detailed in the chapter about Oracle Enterprise Manager security in Oracle Enterprise Manager Advanced Configuration. Specifically, pay close attention to the section titled "Configuring Beacons to Monitor Web Applications Over HTTPS." Oracle Beacons, which are part of the Application Service Level Management features of Enterprise Manager, provide application performance availability and performance monitoring. Beacons are used to monitor a URL over SSL using an HTTPS URL.

7.3.1 Protecting URLs in the Absence of a Load Balancing Router

Use these instructions when no load balancing router is deployed in front of the single sign-on server and OracleAS Portal. In ORACLE_HOME/sso/conf/sso_apache.conf, locate and uncomment the three directives that follow; then provide a value for the Allow from parameter.

Invoke the first directive if you are installing a release 9.0.2 middle tier with a release 10.1.2 single sign-on server. This directive enables the installer to access the single sign-on server over HTTP. Replace <your_domain_name> with the fully qualified host name of the middle tier on which the installer is located; then uncomment the line. If you plan to install from more than one location, enter just a domain name.

 <Location "/pls/orasso/*[Ss][Ss][Oo][Pp][Ii][Nn][Gg]">
   Order deny,allow
   Deny from all
#  Allow from <your_domain_name>
 </Location>

OracleAS Portal must use HTTP to access the URL that provides a list of external applications. The directive that follows enables such access. Replace <your_domain_name> with the fully qualified Portal host name; then uncomment the directive. If you have more than one Portal database, enter just the domain name for these databases.

#<Location "/pls/orasso/*[Aa][Pp][Pp][Ss]_[Ll][Ii][Ss][Tt]">
#  Order deny,allow
#  Deny from all
#  Allow from <your_domain_name>
#</Location>

Versions of OracleAS Portal that predate release 9.0.2 use HTTP to verify whether a user exists in the single sign-on database. This last directive enables verification. Again, replace <your_domain_name> with the fully qualified Portal host name; then uncomment the directive. If you have more than one Portal database, enter just the domain name for these databases.

#<Location "/pls/orasso/[Oo][Rr][Aa][Ss][Ss][Oo].wwsso_app_admin.validate_user*">
#  Order deny,allow
#  Deny from all
#  Allow from <your_domain_name>
#</Location>

After editing sso_apache.conf, update the repository for Distributed Cluster Management:

ORACLE_HOME/dcm/bin/dcmctl updateConfig -v -d

7.3.2 Protecting URLs in the Presence of a Load Balancing Router

In a deployment configuration where the single sign-on server and OracleAS Portal are front-ended by a load-balancing router, the rule for limiting access to hosts should be set directly with the load-balancing router. Do not attempt to add such a rule in the ORACLE_HOME/sso/conf/sso_apache.conf file to allow or deny access to a host for this configuration.

Here is an example of such a rule for BigIP:

if (client_addr != <infrastructure db IP> netmask 255.255.255.0 and 
    (http_uri starts_with 
    "/pls/orasso/orasso.wwsso_app_admin.external_apps_list" or 
    http_uri starts_with 
    "/pls/orasso/orasso.wwsso_app_admin.validate_user")) {
discard 
} 
else { 
    use pool SSO 
}