|
Oracle® Application Server Installation Guide
10g Release 2 (10.1.2) for Microsoft Windows B14094-03 |
|
 Previous |
 Next |
|
Oracle® Application Server Installation Guide
10g Release 2 (10.1.2) for Microsoft Windows B14094-03 |
|
|
Previous |
Next |
When you install certain middle-tier or infrastructure components, the installer prompts you for a username to log in to Oracle Internet Directory. For the installation to complete successfully, this user must belong to certain groups in Oracle Internet Directory. The groups that are required depend on what you are installing.
By putting users into groups, you allow other users to perform installations. Users do not have to log in as the cn=orcladmin superuser to perform the installations.
Contents:
Section 8.3, "Groups Required to Configure or Deinstall Components"
Section 8.5, "Groups Required to Install Additional Metadata Repositories"
Section 8.7, "How to Create Users in Oracle Internet Directory"
Section 8.8, "How to Add Users to Groups in Oracle Internet Directory"
When you install Oracle Internet Directory, it has two users: cn=orcladmin and orcladmin:
cn=orcladmin is the Oracle Internet Directory superuser. This user has all the privileges to perform all tasks in Oracle Internet Directory.
The initial password for cn=orcladmin is the same as the password for the ias_admin user for the Oracle Application Server instance. You specified this password during installation.
cn=orcladmin is the owner of the objects created in the same installation session. For example, if you installed Oracle Internet Directory, OracleAS Metadata Repository, and Oracle Delegated Administration Services, the cn=orcladmin user is created and becomes a member of the Repository Owners group and the DAS Component Owners group. cn=orcladmin also becomes a member of the iAS Admins group.
Note that you cannot log in to Oracle Internet Directory as the superuser (cn=orcladmin) using Oracle Delegated Administration Services. To log in as cn=orcladmin, you must use the Oracle Directory Manager.
The orcladmin user is also created when you install Oracle Internet Directory. The DN for this user is: cn=orcladmin,cn=users,<default realm DN>.
The initial password for orcladmin is the same as the password for the ias_admin user for the Oracle Application Server instance. You specified this password during installation.
You can log in to Oracle Internet Directory as orcladmin using Oracle Delegated Administration Services to manage other Oracle Internet Directory users. You can do this because orcladmin is a valid OracleAS Single Sign-On user.
For more information on the cn=orcladmin and orcladmin users, see the Oracle Internet Directory Administrator's Guide.
Groups in Oracle Internet Directory can be classified into these categories:
Table 8-1 describes the groups that affect all Oracle Application Server instances and components registered with Oracle Internet Directory.
Table 8-1 "Global" Groups
| Group | Description |
|---|---|
|
DN: cn=IASAdmins, cn=groups, cn=OracleContext |
IAS Admins have the following privileges:
|
|
DN: cn=Trusted Application Admins, cn=groups, cn=OracleContext |
To install Oracle Identity Management, OracleAS Portal, or OracleAS Wireless components, you must belong to several groups, one of which is the Trusted Application Admins group. Table 8-4 lists the required groups for each component. |
|
IAS & User Management Application Admins DN: cn=IAS & User Mgmt Application Admins, cn=groups, cn=OracleContext |
To install OracleAS Portal or OracleAS Wireless, you must belong to several groups, one of which is the IAS & User Management Application Admins group. Table 8-4 lists the required groups for each component. |
Each metadata repository registered with Oracle Internet Directory has its own groups, as described in Table 8-2. This enables you to assign different owners and users for each repository.
Table 8-2 Groups Associated with Each Metadata Repository Registered with Oracle Internet Directory
| Group | Description |
|---|---|
|
DN: cn=Repository Owners, orclReferenceName=dbName, cn=IAS Infrastructure Databases, cn=IAS, cn=Products, cn=OracleContext |
The user who installs the metadata repository becomes a member of this group. Repository Owners have the following privileges:
|
|
DN: cn=Repository Mid-tiers, orclReferenceName=dbName, cn=IAS Infrastructure Databases, cn=IAS, cn=Products, cn=OracleContext |
Mid-Tier Administrators have the following privileges:
|
|
DN: cn=Associated Mid-tiers, orclReferenceName=dbName, cn=IAS Infrastructure Databases, cn=IAS, cn=Products, cn=OracleContext |
Members of this group are middle-tier instances associated with this metadata repository. The middle-tier instances are added to this group during installation. You do not have to add the instances manually to this group. Members of this group have the following privilege:
|
Oracle Application Server components also have groups in Oracle Internet Directory. Each component has a Component Owners group and an Associated Middle Tiers group, as described in Table 8-3.
Table 8-3 Groups Associated with Each Component
| Group | Description |
|---|---|
|
DN: cn=Component Owners, orclApplicationCommonName=componentCommonName, cn=componentName, cn=Products, cn=OracleContext |
Component Owners have the following privileges:
|
|
DN: cn=Associated Mid-tiers, orclApplicationCommonName=componentCommonName, cn=componentName, cn=Products, cn=OracleContext |
Members of this group are middle-tier instances. |
Figure 8-6 shows these groups for the Oracle Delegated Administration Services component.
Table 8-4 shows the groups that a user needs to belong to in order to configure or deinstall Oracle Application Server components.
The user who installs and configures the components becomes the owner of the components.
Table 8-4 Oracle Internet Directory Groups Required to Configure Components
| To Configure This Component | User Must Be a Member of ALL Listed Groups: |
|---|---|
|
Infrastructure Components |
|
|
OracleAS Metadata Repository |
To register OracleAS Metadata Repository against Oracle Internet Directory, you must log in to Oracle Internet Directory as a user who belongs to the iAS Admins group. |
|
In OracleAS Cluster (Identity Management) environments, to install subsequent Oracle Internet Directory instances after the first one, you must be the Oracle Internet Directory superuser ( |
|
|
|
|
You must install OracleAS Single Sign-On as the superuser ( |
|
|
|
|
OCA, configured against an existing OracleAS Metadata Repository |
|
|
OCA, configured against a new OracleAS Metadata Repository (that is, you are installing and configuring OCA and OracleAS Metadata Repository in the same installation session) |
|
|
J2EE and Web Cache Middle-tier Features |
|
|
|
|
Oracle Identity Management Access and Farm Repository (Database-Based or File-Based) |
|
|
Portal and Wireless, and Business Intelligence and Forms Middle-tier Components |
|
|
|
|
|
|
To Determine the Metadata Repository Used by OracleAS Single Sign-On
Run the following command (all on one line):
C:\> ldapsearch -h oidhostname -p oidport -D cn=orcladmin -w password -b "orclapplicationcommonname=orasso_ssoserver,cn=sso,cn=products, cn=oraclecontext" -s base "objectclass=*" seealso
Values you need to provide:
oidhostname - name of the computer running Oracle Internet Directory. Example: dbmachine.mydomain.com.
oidport - port number on which Oracle Internet Directory is listening. Example: 389.
password - password for the cn=orcladmin user.
If the command in the preceding step does not return the name of the metadata repository, then run the following commands:
Run this command first to get the "orclreplicaid" value, which you need for the next command.
C:\> ldapsearch -h oidhostname -p oidport -D cn=orcladmin -w password -b "" -s base "objectclass=*" orclreplicaid
Then run this command.
C:\> ldapsearch -h oidhostname -p oidport -D cn=orcladmin -w password -b "orclreplicaid=value_from_previous_command,cn=replication configuration" -s base "objectclass=*" seealso
This returns a "seealso" value in the format: cn=Metadata repository DB Name,cn=oraclecontext.
When you install middle tiers, the installer prompts you to log in to Oracle Internet Directory. Log in as a user who is a member of these groups:
Section 8.4.1, "Groups Required to Install Against the Desired Metadata Repository"
Section 8.4.2, "Groups Required to Install Middle-tier Components"
To install middle tiers against a metadata repository, the user must belong to these groups:
IAS Admins group
Mid-Tier Admins group for the metadata repository to be used with the middle tier. When the installer prompts for the OracleAS Metadata Repository to use with this middle tier, the installer displays only the metadata repositories for which the user is a mid-tier admin. For example, in Figure 8-2, userA can see only the repository for orcl.oracle.com, and userB can see only the repository for orcl1.oracle.com.
To install middle-tier components, such as OracleAS Portal and OracleAS Wireless, the user must belong to additional groups. See Table 8-4 for a list of components and required groups.
Figure 8-1 shows an Oracle Internet Directory with one metadata repository and one middle-tier instance. userA can install middle tiers against the orcl metadata repository because userA belongs to the Mid-Tier Admins and the IAS Admins groups. userA can also install middle-tier components because userA belongs to the Trusted Application Admins group, the IAS & User Management Application Admins group, and the Component Owners group for Wireless.
Figure 8-1 Contents of Oracle Internet Directory with One Infrastructure and One Middle Tier
To install additional metadata repositories, a user must be a member of the IAS Admins group. After installation, the user then becomes a member of the Repository Owners group for that metadata repository.
Figure 8-2 shows an Oracle Internet Directory with two metadata repositories and two middle tiers installed by different users.
Figure 8-2 Oracle Internet Directory with Two Metadata Repositories and Two Middle Tiers
The numbers in the figure correspond to these steps:
1. Install OracleAS Infrastructure (including Oracle Internet Directory and OracleAS Metadata Repository)
This first installation creates an Oracle Internet Directory and a metadata repository.
The installer registers the metadata repository with Oracle Internet Directory by creating the "orcl.oracle.com" entry.
The orcladmin user becomes a member of the Repository Owners group and the Mid-Tier Admins group for this repository.
2. Install J2EE and Web Cache Middle Tier
userA was added to the following groups:
Mid-Tier Admins group of "orcl.oracle.com"
This enables userA to use the "orcl.oracle.com" repository for this middle tier. Note that this group is required only if you install the J2EE and Web Cache middle tier with the OracleAS Database-Based Cluster option. If you install the middle tier without this option, userA does not need to belong to this Mid-Tier Admins group.
iAS Admins group
The installer registers this middle tier with Oracle Internet Directory by creating the "J2EE" entry. (The "J2EE" is the name of the middle-tier instance, specified by userA.)
The middle tier becomes a member of the Associated Mid-Tiers group for "orcl.oracle.com".
3. Install OracleAS Infrastructure (OracleAS Metadata Repository only)
userB was added to the iAS Admins group so that userB can perform this installation. See Section 8.5, "Groups Required to Install Additional Metadata Repositories".
The installer registers this new repository with Oracle Internet Directory by creating the "orcl1.oracle.com" entry.
userB becomes a member of the Repository Owners group and the Mid-Tier Admins group for the new repository.
4. Install Portal and Wireless Middle Tier
userB was added to these groups:
Mid-Tier Admins group of "orcl1.oracle.com", so that userB can use the repository for this middle tier
Trusted Application Admins, required for installing OracleAS Portal
IAS & User Management Application Admins, required for installing OracleAS Portal and OracleAS Wireless
iAS Admins, required for installing OracleAS Portal and OracleAS Wireless
The installer registers this middle tier with Oracle Internet Directory by creating the "PW1" entry.
The middle tier becomes a member of the Associated Mid-Tiers group for "orcl1.oracle.com".
You can create users in Oracle Internet Directory using the Self-Service Console, which is part of the Oracle Delegated Administration Services. See the Oracle Internet Directory Administrator's Guide for details.
|
Note: You cannot connect to Oracle Internet Directory as thecn=orcladmin superuser using the Oracle Delegated Administration Services consoles. To connect to Oracle Internet Directory as the superuser, use Oracle Directory Manager.
|
To add users to groups in Oracle Internet Directory, you can use these tools:
Oracle Directory Manager is a Java-based tool for managing Oracle Internet Directory.
Oracle Delegated Administration Services is a Web-based tool intended for end-users to perform tasks such as changing their passwords and editing their personal information. If users have the proper privileges, they can also use this tool to create groups and users.
|
Note: You cannot log in to Oracle Internet Directory as thecn=orcladmin superuser using Oracle Delegated Administration Services. In cases where you have to log in as the superuser to add users to groups (or to perform other Oracle Internet Directory-related tasks), you have to use Oracle Directory Manager.
|
When you have to log in as the cn=orcladmin superuser to add users to groups, you have to use Oracle Directory Manager, instead of Oracle Delegated Administration Services.
To add users using Oracle Directory Manager:
Start up Oracle Directory Manager. ORACLE_HOME refers to the home directory where Oracle Internet Directory is installed.
Select Start > Programs > Oracle - OracleHomeName > Integrated Management Tools > Oracle Directory Manager.
In the Oracle Directory Manager Connect screen, enter the connect information for Oracle Internet Directory:
User: Enter cn=orcladmin.
Password: Enter the password for cn=orcladmin.
Server and Port: Click the icon at the right of the field to enter the name of the computer running Oracle Internet Directory and the port number on which Oracle Internet Directory is listening.
Click Login.
On the left side, navigate to the group to which you want to add users. Select the group on the left side to display its attributes on the right side.
To navigate to "global" groups, see Section 8.8.1.1, "Navigating to "Global" Groups".
To navigate to metadata repository groups, see Section 8.8.1.2, "Navigating to Metadata Repository Groups".
To navigate to component groups, see Section 8.8.1.3, "Navigating to Component Groups".
Add new users to the group by adding the DNs of the users to the uniquemember attribute.
The "global" groups are listed in Table 8-1.
The general navigation path is as follows. See Figure 8-3 for a screenshot.
Expand the top-level entry, "Oracle Internet Directory Servers".
Expand the specific Oracle Internet Directory.
Expand the following entries: Entry Management > cn=OracleContext > cn=Groups.
Click the group to which you want to add users. Figure 8-3 shows Oracle Directory Manager with the iASAdmins group selected.
Figure 8-3 Using Oracle Directory Manager to Add Users to "Global" Groups
The metadata repository groups are listed in Table 8-2.
The general navigation path is as follows. See Figure 8-4 for a screenshot.
Expand the top-level entry, "Oracle Internet Directory Servers".
Expand the specific Oracle Internet Directory.
Expand the following entries: Entry Management > cn=OracleContext > cn=Products > cn=IAS > cn=IAS Infrastructure Databases > orclReferenceName=dbName, where dbName is the name of the OracleAS Metadata Repository database.
Click the group to which you want to add users. Figure 8-4 shows Oracle Directory Manager with the Repository Owners group for the orcl.us.oracle.com database selected.
Figure 8-4 Using Oracle Directory Manager to Add Users to Metadata Repository Groups
The component groups are listed in Table 8-3.
The general navigation path is as follows. See Figure 8-5 for a screenshot.
Expand the top-level entry, "Oracle Internet Directory Servers".
Expand the specific Oracle Internet Directory.
Expand the following entries: Entry Management > cn=OracleContext > cn=Products.
Expand the particular component (for example, cn=DAS) whose groups you want to add users to.
Expand orclApplicationCommonName=appName, where appName is specific to the component and application server instance. If you have installed multiple instances of a component, you would see multiple instances of this entry.
Click the group to which you want to add users. Figure 8-5 shows Oracle Directory Manager with the Component Owners group for Oracle Delegated Administration Services selected.
Figure 8-5 Using Oracle Directory Manager to Add Users to the Component Users Group for the Oracle Delegated Administration Services Component
Using the Deployment Delegation Console, which is installed as part of Oracle Delegated Administration Services, you can add users to or remove users from the following groups:
Repository Owners
Mid-Tier Administrators
Component Owners
|
Note: You can add users to these groups only if these groups have existing members other than thecn=orcladmin superuser. If the only member of these groups is the superuser, then you have to use Oracle Directory Manager to add users to these groups. See Section 8.8.1, "Using Oracle Directory Manager to Add Users to Groups".
|
To add users to these groups:
Ensure that the Oracle Delegated Administration Services and Oracle Internet Directory are running.
Display the Deployment Delegation Console page. The URL is:
http://hostname:port/oiddas/ui/oidinstallhome
hostname specifies the name of the computer where you installed Oracle Delegated Administration Services.
port specifies the port on which Oracle HTTP Server is listening.
Click Login.
Enter a username and password to log in to Oracle Internet Directory, and click Login. The login user must have sufficient privileges to allow you to add users to the desired group:
| To add users to this group: | Log in as a user who belongs to: |
|---|---|
| Repository Owners | the same Repository Owners group. |
| Mid-Tier Administrators | the Repository Owners group for the same repository. |
| Component Owners | the same Component Owners group. |
Perform the steps to add the user to the desired group:
| To add the user to the Repository Owners group | To add the user to the Mid-Tier Administrators group | To add the user to the Component Owners group |
|---|---|---|
|
|
|
When you install OracleAS Infrastructure with Oracle Internet Directory, OracleAS Metadata Repository, and Oracle Delegated Administration Services, the Oracle Internet Directory contains the following objects (Figure 8-6):
"Global" groups as listed in Table 8-1
The cn=orcladmin superuser
The orcladmin user belonging to the default realm
An entry for the metadata repository registered with the Oracle Internet Directory. This metadata repository is associated with the groups listed in Table 8-2. The cn=orcladmin superuser is a member of the Repository Owners group.
An application entity entry for the Oracle Delegated Administration Services component. This component is associated with the groups listed in Table 8-3. The cn=orcladmin superuser is a member of the Component Owners group.
To enable other users to install additional instances of Oracle Delegated Administration Services, log in as cn=orcladmin in Oracle Directory Manager and add the users to the Component Owners group. See Section 8.8.1, "Using Oracle Directory Manager to Add Users to Groups".
Figure 8-6 Contents of a New Oracle Internet Directory
The installer displays the Specify Login for Oracle Internet Directory screen:
when you are installing OracleAS Infrastructure and you are using an existing Oracle Internet Directory
when you are installing a middle tier that requires an infrastructure.
This screen prompts you to enter a username and password to log in to Oracle Internet Directory.
Username
In the Username field, enter either the simple username or the user's DN.
Simple username example: jdoe
DN example: cn=orcladmin
The user must belong to specific groups for installing and configuring certain components. See Table 8-4 for details.
If you want to specify the superuser, enter cn=orcladmin, not just orcladmin.
Realm
The Realm field appears only if your Oracle Internet Directory contains more than one realm. The username that you enter is authenticated against the specified realm. If you are unsure what the realm name is, contact your Oracle Internet Directory administrator.
Example 1: in a hosted deployment, the realm name could be similar to the name of the hosted company: XYZCorp.
Example 2: within an enterprise, you could have separate realms for internal users and external users. The realm name for the external users could be externalUsers.
