4 Enterprise Manager Security

4.1.1 Oracle Enterprise Manager Security Model

The goals of Oracle Enterprise Manager security are:

• To be sure that only users with the proper privileges have access to critical monitoring and administrative data.

  This goal is met by requiring username and password credentials before users can access the Enterprise Manager consoles. This includes access to the Oracle Enterprise Manager 10g Grid Control Console, the Oracle Enterprise Manager 10g Database Control Console, and the Oracle Enterprise Manager 10g Application Server Control Console.

• To be sure that all data transferred between Enterprise Manager components is transferred in a secure manner and that all data gathered by each Oracle Management Agent can be transferred only to the Oracle Management Service for which the Management Agent is configured.

  This goal is met by enabling Enterprise Manager Framework Security. Enterprise Manager Framework Security automates the process of securing the Enterprise Manager components installed and configured on your network.

  
  

  See Also: "About Enterprise Manager Framework Security"

  
  

4.1.2 Classes of Users and Their Privileges

Oracle Enterprise Manager supports different classes of Oracle users, depending upon the environment you are managing and the context in which you are using Oracle Enterprise Manager 10g. For example:

• The Grid Control Console provides support for creating and managing Enterprise Manager administrator accounts.

  The Enterprise Manager administrators you create and manage in the Grid Control Console are granted privileges and roles to log in to the Grid Control Console and to manage specific target types and to perform specific management tasks.

  The default super administrator for the Grid Control Console is the SYSMAN user, which is a database user associated with the Oracle Management Repository. You define the password for the SYSMAN account during the Enterprise Manager installation procedure.

• Oracle Application Server administrators use the Oracle Application Server administrator account (ias_admin) to log in to the Application Server Control Console.

• You use the ias_admin account to manage the components of a specific Oracle Application Server instance. You define the password for the ias_admin account during the Oracle Application Server installation procedure.

4.1.3 Resources Protected

By restricting access to privileged users and providing tools to secure communications between Oracle Enterprise Manager 10g components, Enterprise Manager protects critical information in the Oracle Management Repository.

The Management Repository contains management data that Enterprise Manager uses to help you monitor the performance and availability of your entire enterprise. This data provides you with information about the types of hardware and software you have deployed, as well as the historical performance and specific characteristics of the applications, databases, applications servers, and other targets that you manage.

The Management Repository also contains information about the Enterprise Manager administrators who have the privileges to access the management data.

4.1.4 Authorization and Access Enforcement

Authorization and access enforcement for Enterprise Manager is controlled as follows:

• When you use the Grid Control Console, you create and manage Enterprise Manager administrator accounts. The SYSMAN super administrator can assign specific privileges and roles to each of the additional administrators. These privileges and roles control the targets an administrator can manage and the specific types of tasks the administrator can perform.

  
  

  See Also: "About Administrators and Roles" in the Enterprise Manager online help

  
  

• When you use the Application Server Control Console, access to the Console is restricted to administrators who use the ias_admin administrator's account. The ias_admin account is set up automatically and you assign a password for the account during the Oracle Application Server installation procedure.

  
  

  See Also: Oracle Application Server Administrator's Guide for more information about the ias_admin account

  
  

4.1.5 Leveraging Oracle Application Server Security Services

As a Web-based application, Enterprise Manager relies on industry-standard technologies to provide secure access to the Oracle Enterprise Manager 10g Grid Control Console, Database Control, and Application Server Control Console.

When you configure security for the Oracle Enterprise Manager 10g Grid Control Console, Enterprise Manager Framework Security provides secure communications between the components of your Enterprise Manager installation. However, you should also use the security services of your Oracle HTTP Server to be sure access to the Grid Control Console is secure.

Enterprise Manager deploys the Application Server Control Console and Database Control within a single, standalone Oracle Application Server Containers for J2EE (OC4J) instance. As a result, when you configure security for the Application Server Control Console, or for the Database Control, Enterprise Manager uses the standard security services of OC4J to protect your management data.

4.1.6 Leveraging Oracle Identity Management Infrastructure

Oracle Enterprise Manager 10g takes advantage of Oracle Identity Management in two ways:

• First, you can configure the Grid Control Console so it uses Oracle Application Server Single Sign-On. Administrators can then use their Single Sign-On credentials to log in to the Grid Control Console.

  
  

  See Also: Oracle Application Server Single Sign-On Administrator's Guide for general information about Oracle Application Server Single Sign-On "Configuring Enterprise Manager for Use with Oracle Application Server Single Sign-On"

  
  

• Second, you can take advantage of the Enterprise User Security features of the Oracle database. Enterprise User Security provides single sign-on (SSO) or single password authentication for your database users.

  
  

  See Also: "Managing Enterprise User Security" in the Oracle Advanced Security Administrator's Guide "Configuring Enterprise Manager for Use with Enterprise User Security"

  
  
  
  

  Note: You can configure Enterprise Manager to either use Oracle Application Server Single Sign-On or the Enterprise User Security features. You cannot use both options at the same time.

  
  

4.2.1 About Enterprise Manager Framework Security

Enterprise Manager Framework Security provides safe and secure communication channels between the components of Enterprise Manager. For example, Framework Security provides secure connections between your Oracle Management Service and its Management Agents.

Enterprise Manager Framework Security works in concert with—but does not replace—the security features you should enable for your Oracle HTTP Server. Oracle HTTP Server is part of the Oracle Application Server instance that is used to deploy the Management Service J2EE Web application.

Figure 4-1 shows how Enterprise Manager Framework Security provides security for the connections between the Enterprise Manager components. However, the secure HTTPS connection between your browser and the Grid Control Console should be configured like any other Web application by using the security features of your Oracle HTTP Server.

Figure 4-1 Enterprise Manager Framework Security

Description of "Figure 4-1 Enterprise Manager Framework Security"

Enterprise Manager Framework Security implements the following types of secure connections between the Enterprise Manager components:

• HTTPS and Public Key Infrastructure (PKI) components, including signed digital certificates, for communications between the Management Service and the Management Agents.

  
  

  See Also: Oracle Security Overview for an overview of Public Key Infrastructure features, such as digital certificates and public keys

  
  

• Oracle Advanced Security for communications between the Management Service and the Management Repository.

  
  

  See Also: Oracle Database Advanced Security Administrator's Guide

  
  

4.2.2 Overview of the Steps Required to Enable Enterprise Manager Framework Security

To enable Enterprise Manager Framework Security, you must configure each of the Enterprise Manager components in a specific order. The following list outlines the process for securing the Management Service and the Management Agents that upload data to the Management Service:

1. Use the opmnctl stopall command to stop the Management Service, the Oracle HTTP Server, and the other components of the Oracle Application Server that are used to deploy the Management Service.

2. Use emctl secure oms to enable security for the Management Service.

3. Restart the Management Service, the Oracle HTTP Server, OracleAS Web Cache, and the other application server components using the opmnctl startall command.

4. For each Management Agent, stop the Management Agent, use the emctl secure agent command to enable security for the Management Agent, and restart the Management Agent.

5. After security is enabled for all the Management Agents, use the emctl secure lock command to restrict HTTP Access to the Management Service. This will ensure that all data gathered from the Management Agents is uploaded over a secure HTTPS connection.

The following sections describe how to perform each of these steps in more detail.

4.2.3 Enabling Security for the Oracle Management Service

To enable Enterprise Manager Framework Security for the Management Service, you use the emctl secure oms utility, which is located in the following subdirectory of the Management Service home directory:

$ORACLE_HOME/bin

The emctl secure oms utility performs the following actions:

• Generates a Root Key within your Management Repository. The Root Key is used during distribution of Oracle Wallets containing unique digital certificates for your Management Agents.

• Modifies your Oracle HTTP Server to enable an HTTPS channel between your Management Service and Management Agents, independent from any existing HTTPS configuration that may be present in your Oracle HTTP Server.

• Enables your Management Service to accept requests from Management Agents using Enterprise Manager Framework Security.

To run the emctl secure oms utility you must first choose an Agent Registration Password. The Agent Registration password is used to validate that future installation sessions of Oracle Management Agents and Oracle Management Services are authorized to load their data into this Enterprise Manager installation.

To enable Enterprise Manager Framework Security for the Oracle Management Service:

1. Change directory to the following directory in the Management Service home:

   ORACLE_HOME/opmn/bin
   
   

2. Stop the Management Service, the Oracle HTTP Server, and the other application server components using the following command:

   $PROMPT> ./opmnctl stopall
   
   

3. Change directory to the following directory in the Management Service home:

   ORACLE_HOME/bin
   
   

4. Enter the following command:

   $PROMPT> ./emctl secure oms
   
   

   Enterprise Manager prompts you for the Enterprise Manager Root Password.

5. Enter the password for the SYSMAN administrator account used for the Management Repository.

   Enterprise Manager prompts you to specify an Agent Registration Password, which is a new password that will be required for any Management Agents that attempt to connect to the Management Service.

6. Specify an Agent Registration Password for the Management Service.

   Enterprise Manager prompts you to confirm the host name of the Management Service.

7. When the operation is complete, restart the Management Service, the Oracle HTTP Server, and OracleAS Web Cache:

   $PROMPT> cd $ORACLE_HOME/opmn/bin
   $PROMPT> ./opmnctl startall
   
   

8. After the Management Service restarts, test the secure connection to the Management Service by browsing to the following secure URL using the HTTPS protocol:

   https://hostname.domain:4888/
   
   

   For example:

   https://mgmthost1.acme.com:4888/
   
   

   If the Management Service security has been enabled, your browser displays the Oracle Application Server Welcome page.

$PROMPT> ./emctl secure omsOracle Enterprise Manager 10g Release 10.2.0.0.0 Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.Enter Enterprise Manager Root Password :Enter Agent Registration password :OPMN processes already stopped...   Done.Securing central oms...   Started.Checking Repository...   Done.Checking Em Key...   Done.Checking Repository for an existing Enterprise Manager Root Key...   Done.Fetching Root Certificate from the Repository...   Done.Generating Registration Password Verifier in the Repository...   Done.Generating Oracle Wallet Password for Enterprise Manager OMS...   Done.Generating Oracle Wallet for Enterprise Manager OMS...   Done.Generating Oracle Wallet for iAS HTTP Server...   Done.Updating HTTPS port in emoms.properties file...   Done.Generating HTTPS Virtual Host for Enterprise Manager OMS...   Done.Securing central oms...   Ended. 
 

Alternatively, you can enter the emctl secure oms command all on one line, but if you enter the command on one line, the passwords you enter will be displayed on the screen as you type the command.

$PROMPT> emctl secure oms -sysman_pwd <sysman password> -reg_pwd <registration password>[-host <hostname>][-reset][-secure_port <secure_port>][-root_dc <root_dc>][-root_country <root_country>][-root_state <root_state>][-root_loc <root_loc>][-root_org <root_org>][-root_unit <root_unit>][-root_email <root_email>]

$prompt> emctl secure status oms
Oracle Enterprise Manager 10g Release 10.2.0.0.0 Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.
Checking the security status of the OMS at location set in /ade/rpinnama_emcore_main3/oracle/sysman/config/emoms.properties...  Done.
OMS is secure on HTTPS Port 4888 

4.2.4 Enabling Security for the Oracle Management Agent

When you install the Management Agent on a host, you must identify the Management Service that will be used by the Management Agent. If the Management Service you specify has been configured to take advantage of Enterprise Manager Framework Security, you will be prompted for the Agent Registration Password and Enterprise Manager Framework Security will be enabled for the Management Agent during the installation.

Otherwise, if the Management Service has not been configured for Enterprise Manager Framework Security, then security will not be enabled for the Management Agent. In those cases, you can later enable Enterprise Manager Framework Security for the Management Agent.

To enable Enterprise Manager Framework Security for the Management Agent, use the emctl secure agent utility, which is located in the following directory of the Management Agent home directory:

AGENT_HOME/bin (UNIX)
AGENT_HOME\bin (Windows)

The emctl secure agent utility performs the following actions:

• Obtains an Oracle Wallet from the Management Service that contains a unique digital certificate for the Management Agent. This certificate is required in order for the Management Agent to conduct SSL communication with the secure Management Service.

• Obtains an Agent Key for the Management Agent that is registered with the Management Service.

• Configures the Management Agent so it is available on your network over HTTPS and so it uses the Management Service HTTPS upload URL for all its communication with the Management Service.

To enable Enterprise Manager Framework Security for the Management Agent:

1. Ensure that your Management Service and the Management Repository are up and running.

2. Change directory to the following directory:

   AGENT_HOME/bin (UNIX)
   AGENT_HOME\bin (Windows)
   
   

3. Stop the Management Agent:

   $PROMPT> ./emctl stop agent
   
   

4. Enter the following command:

   $PROMPT> ./emctl secure agent (UNIX)
   $PROMPT> emctl secure agent (Windows)
   
   

   The emctl secure agent utility prompts you for the Agent Registration Password, authenticates the password against the Management Service, and reconfigures the Management Agent to use Enterprise Manager Framework Security.

   
   

   Note: Alternatively, you can enter the command all on one line, but if you enter the command on one line, the password you enter will be displayed on the screen as you type: $PROMPT> ./emctl secure agent agent_registration_pwd (UNIX) $PROMPT> emctl secure agent agent_registration_pwd (Windows)

   
   

   shows sample output of the emctl secure agent utility.

5. Restart the Management Agent:

   $PROMPT> ./emctl start agent
   
   

6. Confirm that the Management Agent is secure by checking the Management Agent home page.

   In the General section of the Management Agent home page (Figure 4-2), the Secure Upload field indicates whether or not Enterprise Manager Framework Security has been enabled for the Management Agent.

   
   

   See Also: "Checking the Status of an Oracle Management Agent" in the Enterprise Manager online Help

   
   

$PROMPT> ./emctl secure agentOracle Enterprise Manager 10g Release 10.2.0.0.0. Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.Enter Agent Registration password :Agent is already stopped...   Done.Securing agent...   Started.Requesting an HTTPS Upload URL from the OMS...   Done.Requesting an Oracle Wallet and Agent Key from the OMS...   Done.Check if HTTPS Upload URL is accessible from the agent...   Done.Configuring Agent for HTTPS in CENTRAL_AGENT mode...   Done.EMD_URL set in /private/oracle/agent/sysman/config/emd.propertiesSecuring agent...   Successful.

[oracle@stang14 bin]$ ./emctl secure status agent
Oracle Enterprise Manager 10g Release 10.2.0.0.0. 
Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.
Checking the security status of the Agent at location set in 
/private/home/oracle/product/102/em/agent10g/sysman/config/emd.properties...  
Done.
Agent is secure at HTTPS Port 3872.
Checking the security status of the OMS at 
http://gridcontrol.oraclecorp.com:4889/em/upload/...  Done.
OMS is secure on HTTPS Port 4888

Figure 4-2 Secure Upload Field on the Management Agent Home Page

Description of "Figure 4-2 Secure Upload Field on the Management Agent Home Page "

4.2.5 Enabling Security with Multiple Management Service Installations

If you already have a secure Management Service running and you install an additional Management Service that uses the same Management Repository, you will need to enable Enterprise Manager Framework Security for the new Management Service. This task is executed using the same procedure that you used to secure the first Management Service, by running the emctl secure oms utility.

Because you have already established at least one Agent Registration Password and a Root Key in your Management Repository, they must be used for your new Management Service. Your secure Management Agents can then operate against either Management Service. For more information on multiple Management Service installations, refer to Using Multiple Management Service Installations.

All the registration passwords assigned to the current Management Repository are listed on the Registration Passwords page in the Oracle Enterprise Manager 10g Grid Control Console.

If you install a new Management Service that uses a new Management Repository, the new Management Service is considered to be a distinct enterprise. There is no way for the new Management Service to partake in the same security trust relationship as another Management Service that uses a different Management Repository. Secure Management Agents of one Management Service will not be able to operate against the other Management Service.

4.2.6 Restricting HTTP Access to the Management Service

By default, when you enable Enterprise Manager Framework Security on your Oracle Management Service there are no default restrictions on HTTP access. Any Oracle Management Agent can access the Grid Control Console and Management Service using HTTP or HTTPS connections.

However, it is important that only secure Management Agent installations that use the Management Service HTTPS channel are able to upload data to your Management Repository.

To restrict access so Management Agents can upload data to the Management Service only over HTTPS:

1. Stop the Management Service, the Oracle HTTP Server, and the other application server components:

   $PROMPT> cd $ORACLE_HOME/opmn/bin
   $PROMPT> ./opmnctl stopall
   
   

2. Change directory to the following location in the Management Service home:

   $ORACLE_HOME/bin
   
   

3. Enter the following command to prevent Management Agents from uploading data to the Management Service over HTTP:

   $PROMPT> emctl secure lock
   
   

4. Restart the Management Service, the Oracle HTTP Server, and the other application server components:

   $PROMPT> cd $ORACLE_HOME/opmn/bin
   $PROMPT> ./opmnctl startall
   
   

5. Verify that you cannot access the Management Agent upload URL using the HTTP protocol:

   For example, navigate to the following URL:

   http://hostname.domain:4889/em/upload
   
   

   You should receive an error message similar to the following:

   ForbiddenYou don't have permission to access /em/upload on this server
   
   

6. Verify that you can access the Management Agent using the HTTPS protocol:

   For example, navigate to the following URL:

   https://hostname.domain:4888/em/upload
   
   

   You should receive the following message, which confirms the secure upload port is available to secure Management Agents:

   Http XML File receiverHttp Recceiver Servlet active!
   
   

To remove the restriction for HTTPS uploads from the Management Agents, repeat the preceding procedure, but replace the emctl secure lock command with the following command:

$PROMPT> emctl secure unlock

http://hostname.domain:4889/em/upload

$prompt> emctl secure lockOracle Enterprise Manager 10g Release 10.2.0.0.0 Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.Checking the security status of the OMS...   Done.Updating HTTPS Virtual Host for Enterprise Manager OMS...   Done.OMS Locked. Agents must be Secure and upload over HTTPS Port 4888.

$prompt> emctl secure unlock
Oracle Enterprise Manager 10g Release 10.2.0.0.0 Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.
Checking the security status of the OMS...   Done.
Updating HTTPS Virtual Host for Enterprise Manager OMS...   Done.
OMS Unlocked. Non Secure Agents may upload using HTTP.

To restrict HTTP access to the Oracle Enterprise Manager 10g Grid Control Console, configure your Oracle HTTP Server and OracleAS Web Cache as described in the Oracle Application Server documentation.

4.2.7 Managing Agent Registration Passwords

Enterprise Manager uses the Agent Registration password to validate that installations of Oracle Management Agents are authorized to load their data into the proper Oracle Management Service.

You create the registration password when you use emctl secure oms to configure security for the Oracle Management Service installation.

4.2.7.1 Using the Grid Control Console to Manage Agent Registration Passwords

After you enable security for your Enterprise Manager components, you can use the Grid Control Console to manage your existing registration passwords or create additional registration passwords:

1. Click Setup at the top of any Grid Control Console page.

2. Click Registration Passwords.

   Enterprise Manager displays the Registration Passwords page (Figure 4-3). After you enable security for the Management Service, the registration password you created when you ran the emctl secure oms command appears in the Registration Passwords table.

3. Use the Registration Passwords page to change your registration password, create additional registration passwords, or remove registration passwords associated with the current Management Repository.

Figure 4-3 Managing Registration Passwords in the Grid Control Console

Description of "Figure 4-3 Managing Registration Passwords in the Grid Control Console"

When you create or edit an Agent Registration Password on the Registration Passwords page, you can determine whether the password is persistent and available for multiple Management Agents or to be used only once or for a predefined period of time.

For example, if an administrator requests to install a Management Agent on a particular host, you can create a one-time-only password that the administrator can use to install and configure one Management Agent.

On the other hand, you can create a persistent password that an administrator can use for the next two weeks before it expires and the administrator must ask for a new password.

$PROMPT> emctl secure setpwd sysman_password new_Install_Password

4.2.8 Enabling Security with a Server Load Balancer

When you deploy a Management Service that is available behind a Server Load Balancer (SLB), special attention must be given to the DNS host name over which the Management Service will be available. Although the Management Service may run on a particular local host, for example myhost.mycompany.com, your Management Agents will access the Management Service using the host name that has been assigned to the Server Load Balancer. For example, oracleoms.mycompany.com.

As a result, when you enable Enterprise Manager Framework Security for the Management Service, it is important to ensure that the Server Load Balancer host name is embedded into the Certificate that the Management Service uses for SSL communications. This may be done by using emctl secure oms and specifying the host name in the with an extra -host parameter as follows:

$PROMPT> emctl secure oms -host

Enterprise Manager prompts you for the Agent Registration Password and then for the preferred host name (). Enter the host name for the Server Load Balancer.

$PROMPT> emctl secure oms agent_reg_pwd  -hostname mgmt_host

4.2.9 Enabling Security for the Management Repository Database

This section describes how to enable Security for the Oracle Management Repository. This section includes the following topics:

• About Oracle Advanced Security and the sqlnet.ora Configuration File

• Configuring the Management Service to Connect to a Secure Management Repository Database

• Enabling Oracle Advanced Security for the Management Repository

• Enabling Security for a Management Agent Monitoring a Secure Management Repository or Database

ORACLE_HOME/network/admin

ORA-12645: Parameter does not exist

4.3.1 Configuring Enterprise Manager to Use the Single Sign-On Logon Page

To configure the Grid Control Console for use with Oracle Application Server Single Sign-On:

1. Set the ORACLE_HOME environment variables to the Management Service home directory.

   For example:

   $PROMPT> setenv ORACLE_HOME /dev01/oracle/em10g_GridControl
   
   

2. Change directory to the bin directory of the Management Service Oracle home:

   $PROMPT> cd $ORACLE_HOME/opmn/bin
   
   

3. Stop the Management Service, the Oracle HTTP Server, and the other components of the application server:

   $PROMPT> ./opmnctl stopall
   
   

4. Change directory to the bin directory of the Management Service Oracle home:

   $PROMPT> cd $ORACLE_HOME/bin
   
   

5. Enter the following command at the operating system prompt:

   $PROMPT> ./emctl config oms sso -host ssoHost -port ssoPort -sid ssoSid  -pass ssoPassword -das http://ssohost:port/
   
   

   For example:

   $PROMPT> ./emctl config oms sso -host sshost1.acme.com -port 1521 -sid asdb -pass Ch22x5xt -das http://ssohost1.acme.com:7777
   
   

   Table 4-2 describes the arguments on the emctl config oms sso command line.

   shows the typical output generated by the emctl config oms sso command.

6. Restart the Management Service, Oracle HTTP Server, and the other application server components:

   $PROMPT> cd $ORACLE_HOME/opmn/bin
   $PROMPT> ./opmnctl startall
   
   

7. Go the Grid Control Console URL.

   For example:

   http://mgmthost1.acme.com:7777/em
   
   

   The browser is redirected to the standard Single Sign-On Logon page.

smptest@stamt03 bin]$ ./emctl config oms sso -host 
isunraj29.us.oracle.com -port 1521 -sid orcl -pass W5RB9YD3 -das 
http://isunraj29.us.oracle.com:7777 -u oracle
 
Oracle Enterprise Manager 10g Release 10.2.0.0.0  Copyright (c) 1996, 
2005 Oracle Corporation.  All rights reserved.
/scratch/smptest/mm9/oms10g/Apache/Apache/conf/httpd.conf has been modified.
/scratch/smptest/mm9/oms10g/sysman/config/emoms.properties has been 
modified.
Registering to SSO server, please wait...
Parameters passed to SSO registration tool :
param0:-oracle_home_path param1:/scratch/smptest/mm9/oms10g param2:-host 
param3:
isunraj29.us.oracle.com param4:-port param5:1521 param6:-sid param7:orcl 
param8:
-schema param9:orasso param10:-pass param11:**** param12:-site_name 
param13:stam
t03.us.oracle.com:4889 param14:-success_url 
param15:http://stamt03.us.oracle.com
:4889/osso_login_success param16:-logout_url 
param17:http://stamt03.us.oracle.co
m:4889/osso_logout_success param18:-cancel_url 
param19:http://stamt03.us.oracle.
com:4889/ param20:-home_url param21:http://stamt03.us.oracle.com:4889/ 
param22:-
config_mod_osso param23:TRUE param24:-u param25:oracle 
param26:-sso_server_versi
on param27:v1.2  -DinstallType=
-DoldOracleHome=
-DoldOHSUser=root
Check /scratch/smptest/mm9/oms10g/sso/log/ssoreg.log for details of this registration
SSO registration tool finished successfully.
Done!

4.3.2 Registering Single Sign-On Users as Enterprise Manager Administrators

After you have configured Enterprise Manager to use the Single Sign-On logon page, you can register any Single Sign-On user as an Enterprise Manager administrator:

1. Go the Grid Control Console URL.

   For example:

   http://mgmthost1.acme.com:7777/em
   
   

   The browser is redirected to the standard Single Sign-On Logon page.

2. Enter the credentials for a valid Single Sign-On user.

   If the Single Sign-On user is not an Enterprise Manager administrator, the browser is redirected to a modified version of the Enterprise Manager logon page (Figure 4-4).

3. Log in to Enterprise Manager as a Super Administrator.

4. Click Setup and then click Administrators to display the Administrators page.

   
   

   See Also: "Creating, Editing, and Viewing Administrators" in the Enterprise Manager online help

   
   

   Because Enterprise Manager has been configured to use Single Sign-On, the first page in the Create Administrator wizard now offers you the option of creating an administrator based on a registered Oracle Internet Directory user (Figure 4-5).

5. Select Oracle Internet Directory and advance to the next page in the wizard.

6. Enter the name and e-mail address of the Oracle Internet Directory user, or click the flashlight icon to search for a user name in the Oracle Internet Directory.

7. Use the rest of the wizard pages to define the roles, system privileges, and other characteristics of the Enterprise Manager administrator and then click Finish.

   Enterprise Manager displays a summary page that lists the characteristics of the administrator account.

8. Click Finish to create the new Enterprise Manager administrator.

   The OID user is now included in the list of Enterprise Manager administrators. You can now verify the account by logging out of the Grid Control Console and logging back in using the OID user credentials on the Single Sign-On logon page.

Figure 4-4 Modified Enterprise Manager Logon Page When Configuring SSO

Description of "Figure 4-4 Modified Enterprise Manager Logon Page When Configuring SSO"

Figure 4-5 Create Administrator Page When SSO Support Is Enabled

Description of "Figure 4-5 Create Administrator Page When SSO Support Is Enabled"

4.3.3 Grid Control as a Single Sign-On Partner Application

The emctl config oms sso command adds the Oracle Enterprise Manager 10g Grid Control Console as an Oracle Application Server Single Sign-On partner application. Partner applications are those applications that have delegated authentication to the Oracle Application Server Single Sign-On Server.

To see the list of partner applications, navigate to the following URL:

http://hostname:port/pls/orasso/orasso.home

For example:

http://ssohost1.acme.com:7777/pls/orasso/orasso.home

4.3.4 Bypassing the Single Sign-On Logon Page

After you configure Enterprise Manager to use the Single Sign-On logon page, you can bypass the Single Sign-On page at any time and go directly to the Enterprise Manager logon page by entering the following URL:

http://hostname.domain:port/em/console/logon/logon

For example:

http://mgmthost1.acme.com:7777/em/console/logon/logon

4.5.1 Audit Data

The following data is audited for all Enterprise Manager operations:

4.5.2 Operation Codes

Apart from the common audit data, data specific to each operation is also audited. The following table lists the names of operation and their corresponding codes, and additional payloads audited for each operation.

4.5.3 Audit APIs

The following APIs allow the administrator (SYSMAN user) to set up the audit function for one or more operations:

• mgmt_audit_admin.set_audit() - This API sets the AUDIT_LEVL and AUDIT_MODE parameters. The AUDIT_LEVEL parameter can be set to 0, 1 or 2 depending on your requirement.

  • 0 - All operations in Enterprise Manager will be audited.

  • 1 - Only selected operations will be audited. If you select this level, you must turn on the audit function for the operations that are to be audited.

  • 2 - None of the operations will be audited.

  This API also sets the AUDIT_MODE parameter to 0 to store the audited data in the Management Repository.

• mgmt_audit_admin.set_audit_on() - This API turns on the audit function for specific operation.

• mgmt_audit_admin.set_audit_off() - This API turns off the audit function for a specific operation.

4.5.4 Configuring the Enterprise Manager Audit System

To set up the audit system in Enterprise Manager:

1. Make sure that the Oracle Management Service is up and running.

2. The audit function is turned off by default. Log in to the Enterprise Manager Management Repository as the sysman user. To turn on the audit function, enter the following commands:

   SQL> exec mgmt_audit_admin.set_audit(AUDIT_MODE, null, AUDIT_LEVEL);
   set AUDIT_MODE = 0
   set AUDIT_LEVEL = (0-all, 1-selected, 2-none)
   
   

3. If the AUDIT_LEVEL is set to 1, the audit function needs to be turned on / off for the specific operations that need to be audited by using the following commands:

   SQL> exec mgmt_audit_admin.set_audit_on(op_code); (Turns on the audit function for the specified operation code.)

   SQL> commit;

   SQL> exec mgmt_audit_admin.set_audit_off (op_code); (Turns off the audit function for the specified operation code. )

   SQL> commit;

   For a list of operation codes, refer to Operation Codes.

4. After setting the AUDIT_LEVEL, you must restart the Oracle Management Service to ensure that this change has taken effect.

5. You can then login to Enterprise Manager and create a job or perform other user operations.

4.6.1 Generating the emkey

The emkey is a random number that is generated during the installation of the Oracle Management Repository and is stored in a table. When the Oracle Management Service is installed, the emkey is copied from the Management Repository to the emkey.ora file and stored in the ORACLE_HOME/sysman/config/ directory of each Oracle Management Service.

4.6.2 emctl Commands

The emctl commands related to emkey are given below:

• emctl status key

• emctl config emkey -repos

• emctl config emkey -emkeyfile

• emctl config emkey -emkey

• emctl config emkey -remove_from_repos

• emctl config emkey -copy_to_repos

The usage of these commands is given below:

$prompt> emctl status emkey [-sysman_pwd <sysman password>]
$prompt> emctl config emkey -repos [-emkeyfile <emkey.ora path>] [-force] [-sysman_pwd <sysman password>]

$prompt> emctl config emkey -emkeyfile <emkey.ora path> [-force] [-sysman_pwd <sysman password>]
$prompt> emctl config emkey -emkey [-emkeyfile <emkey.ora path>] [-force] [-sysman_pwd <sysman password>]
$prompt> emctl config emkey -remove_from_repos [-sysman_pwd <sysman password>]
$prompt> emctl config emkey -copy_to_repos [-sysman_pwd <sysman password>]

$ emctl config emkey -repos -emkeyfile /tmp/emkey.ora.0 -forceOracle Enterprise Manager 10g Release 10.2.0.0.0  Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.Please enter repository password: The Em Key has been configured successfully.

$ emctl config emkey -emkeyfile /tmp/emkey.ora.1 -forceOracle Enterprise Manager 10g Release 10.2.0.0.0  Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.Please enter repository password: The Em Key has been configured successfully.

$ emctl config emkey -emkey -emkeyfile /tmp/emkey.ora.2 -forceOracle Enterprise Manager 10g Release 10.2.0.0.0  Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.Please enter repository password: Please enter the em key: The Em Key has been configured successfully.

$ emctl config emkey -remove_from_reposOracle Enterprise Manager 10g Release 10.2.0.0.0  Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.Please enter repository password: The Em Key has been removed from the Management Repository.Make a backup copy of OH/sysman/config/emkey.ora file and store it on another machine.WARNING: Encrypted data in Enterprise Manager will become unusable if the emkey.ora file is lost or corrupted.

$ emctl config emkey -copy_to_reposOracle Enterprise Manager 10g Release 10.2.0.0.0  Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.Please enter repository password: The Em Key has been copied to the Management Repository. This operation will cause the Em Key to become unsecure.

4.6.3 Install and Upgrade Scenarios

This section explains the install and upgrade scenarios for emkey.

4.7.1 Responding to Browser-Specific Security Certificate Alerts

This section describes how to respond to browser-specific security alert dialog boxes when you are using Enterprise Manager in a secure environment.

The security alert dialog boxes described in this section should appear only if you have enabled Enterprise Manager Framework Security, but you have not completed the more extensive procedures to secure your Oracle HTTP Server properly.

This section contains the following topics:

• Responding to the Internet Explorer Security Alert Dialog Box

• Responding to the Netscape Navigator New Site Certificate Dialog Box

• Preventing the Display of the Internet Explorer Security Information Dialog Box

4.7.1.1 Responding to the Internet Explorer Security Alert Dialog Box

If you enable security for the Management Service, but do not enable the more extensive security features of your Oracle HTTP Server, you will likely receive a Security Alert dialog box similar to the one shown in Figure 4-6 when you first attempt to display the Grid Control Console using the HTTPS URL in Internet Explorer.

Note: The instructions in this section apply to Internet Explorer 5.5. The instructions may vary for other supported browsers.

Figure 4-6 Internet Explorer Security Alert Dialog Box

Description of "Figure 4-6 Internet Explorer Security Alert Dialog Box"

When Internet Explorer displays the Security Alert dialog box, use the following instructions to install the certificate and avoid viewing this dialog box again in future Enterprise Manager sessions:

1. In the Security Alert dialog box, click View Certificate.

   Internet Explorer displays the Certificate dialog box.

2. Click the Certificate Path tab and select the first entry in the list of certificates as shown in Figure 4-7.

3. Click View Certificate to display a second Certificate dialog box.

4. Click Install Certificate to display the Certificate Import wizard.

5. Accept the default settings in the wizard, click Finish when you are done, and then click Yes in the Root Certificate Store dialog box.

   Internet Explorer displays a message box indicating that the Certificate was imported successfully.

6. Click OK to close each of the security dialog boxes and click Yes on the Security Alert dialog box to continue with your browser session.

   You should no longer receive the Security Alert dialog box in any future connections to Enterprise Manager when you use this browser.

Figure 4-7 Certificate Path Tab on the Internet Explorer Certificate Dialog Box

Description of "Figure 4-7 Certificate Path Tab on the Internet Explorer Certificate Dialog Box"

4.7.1.2 Responding to the Netscape Navigator New Site Certificate Dialog Box

If you enable security for the Management Service, but you do not enable the more extensive security features of your Oracle HTTP Server, you will likely receive a New Site Certificate dialog box similar to the one shown in Figure 4-8 when you first attempt to display the Grid Control Console using the HTTPS URL in Netscape Navigator.

Note: The instructions in this section apply to Netscape Navigator 4.79. The instructions may vary for other supported browsers.

When Netscape Navigator displays the New Site Certificate dialog box, use the following instructions to install the certificate and avoid viewing this dialog box again in future Enterprise Manager sessions:

1. Review the instructions and information on each wizard page; click Next until you are prompted to accept the certificate.

2. Select Accept this certificate forever (until it expires) from the list of options.

3. On the last screen of the wizard, click Finish to close the wizard and continue with your browser session.

   You should no longer receive the New Site Certificate dialog box when using the current browser.

Figure 4-8 Netscape Navigator New Site Certificate Dialog Box

Description of "Figure 4-8 Netscape Navigator New Site Certificate Dialog Box"

4.7.1.3 Preventing the Display of the Internet Explorer Security Information Dialog Box

After you enable Security for the Management Service, you may receive a dialog box similar to the one shown in Figure 4-9 whenever you access certain Enterprise Manager pages.

Note: The instructions in this section apply to Internet Explorer 6.0. The instructions may vary for other supported browsers.

Figure 4-9 Internet Explorer Security Information Dialog Box

Description of "Figure 4-9 Internet Explorer Security Information Dialog Box"

To stop this dialog box from displaying:

1. Select Internet Options from the Internet Explorer Tools menu.

2. Click the Security tab.

3. Select Internet and then click Custom Level.

   Internet Explorer displays the Security Settings dialog box.

4. Scroll down to Miscellaneous settings and enable the Display Mixed Content option.

4.7.2 Configuring Beacons to Monitor Web Applications Over HTTPS

Oracle Beacons provide application performance availability and performance monitoring. They are part of the Application Performance Management features of Enterprise Manager.

When a Beacon is used to monitor a URL over Secure Sockets Layer (SSL) using an HTTPS URL, the Beacon must be configured to recognize the Certificate Authority that has been used by the Web site where that URL resides.

The Beacon software is preconfigured to recognize most commercial Certificate Authorities that are likely to be used by a secure Internet Web Site. However, you may encounter Web Sites that, although available over HTTPS, do not have a Certificate that has been signed by a commercial Certificate Authority recognized by the Beacon. The following are out-of-box certificates recognized by Beacons:

• Class 1 Public Primary Certification Authority by VeriSign, Inc.

• Class 2 Public Primary Certification Authority by VeriSign, Inc.

• Class 3 Public Primary Certification Authority by VeriSign, Inc.

• Secure Server Certification Authority by RSA Data Security, Inc.

• GTE CyberTrust Root by GTE Corporation

• GTE CyberTrust Global Root by GTE CyberTrust Solutions, Inc.

• Entrust.net Secure Server Certification Authority by Entrust.net ((c) 1999

• Entrust.net Limited, www.entrust.net/CPS incorp. by ref. (limits liab.))

• Entrust.net Certification Authority (2048) by Entrust.net ((c) 1999

• Entrust.net Limited, www.entrust.net/CPS_2048 incorp. by ref. (limits liab.))

• Entrust.net Secure Server Certification Authority by Entrust.net ((c) 2000

• Entrust.net Limited, www.entrust.net/SSL_CPS incorp. by ref. (limits liab.))

In those cases, for example, if you attempt to use the Test section of the Beacon Performance page to test the HTTP Response of the secure URL, the following error appears in the Status Description column of the Response Metrics table on the URL Test Page:

javax.net.ssl.SSLException: SSL handshake failed: X509CertChainIncompleteErr--https://mgmtsys.acme.com/OracleMyPage.Home

To correct this problem, you must allow the Beacon to recognize the Certificate Authority that was used by the Web Site to support HTTPS. You must add the Certificate of that Certificate Authority to the list of Certificate Authorities recognized by Beacon.

To configure the Beacon to recognize the Certificate Authority:

1. Obtain the Certificate of the Web Site's Certificate Authority, as follows:

   1. In Microsoft Internet Explorer, connect to the HTTPS URL of the Web Site you are attempting to monitor.

   2. Double-click the lock icon at the bottom of the browser screen, which indicates that you have connected to a secure Web site.

      The browser displays the Certificate dialog box, which describes the Certificate used for this Web site. Other browsers offer a similar mechanism to view the Certificate detail of a Web Site.

   3. Click the Certificate Path tab and select the first entry in the list of certificates as shown in Figure 4-7.

   4. Click View Certificate to display a second Certificate dialog box.

   5. Click the Details tab on the Certificate window.

   6. Click Copy to File to display the Certificate Manager Export wizard.

   7. In the Certificate Manager Export wizard, select Base64 encoded X.509 (.CER) as the format you want to export and save the certificate to a text file with an easily-identifiable name, such as beacon_certificate.cer.

   8. Open the certificate file using a text editor.

      The content of the certificate file will look similar to the content shown in .

2. Update the list of Beacon Certificate Authorities as follows:

   1. Locate the b64InternetCertificate.txt file in the following directory of Agent Home of the Beacon host:

      agent_home/sysman/config/
      
      

      This file contains a list of Base64 Certificates.

   2. Edit the b64InternetCertificate.txt file and add the contents of the Certificate file you just exported to the end of the file, taking care to include all the Base64 text of the Certificate including the BEGIN and END lines.

3. Restart the Management Agent.

   After you restart the Management Agent, the Beacon detects your addition to the list of Certificate Authorities recognized by Beacon and you can successfully monitor the availability and performance of the secure Web site URL.

-----BEGIN CERTIFICATE----- 
MIIDBzCCAnCgAwIBAgIQTs4NcImNY3JAs5edi/5RkTANBgkqhkiG9w0BAQQFADCB
... base64 certificate content...
-----END CERTIFICATE-----

4.8.1 Using ORACLE _HOME Credentials

Oracle Enterprise Manager 10g Release 2 introduces the concept of ORACLE_HOME credentials to designate the owner of the ORACLE_HOME with special credentials for the ORACLE_HOME. The operating system user who installs the software will also need to perform the patching. In Oracle Enterprise Manager 10g Release 2, one can explicitly set the ORACLE_HOME credential and store it in the Management Repository. While patching, the user can use existing operating system credentials or override it under special circumstances. The user can specify ORACLE_HOME credentials and in the same interface choose to store it in the Management Repository for future use.

The Enterprise Manager Command line interface (EM CLI) also provides a facility to set ORACLE_HOME credentials. This is useful in cases where the Super Administrator sets the credentials and the user who initiates the patching job is unaware of the actual credentials. For auditing in security-hardened data centers, the owner of the software is usually different from the user who initiates the patching job. The patching application internally switches the user context to the owner of the software and patches the software. To emulate such a case, the patch administrator will set the ORACLE_HOME credentials to the owner of the ORACLE_HOME. The Grid Control user who executes the patching job will be unaware of the credentials. The patching job will internally execute as the owner of the ORACLE_HOME. Grid Control will audit the patching job and capture the name of the Grid Control user who initiated the job. For example, if the owner of the ORACLE_HOME is "X", the patch super administrator in Grid Control is "Y" and the target administrator in Grid Control is "Y". "Y" will set the ORACLE_HOME credential to "X" with the password, using EMCLI. "Z" will submit the patching job using the already stored preferred credentials. Grid Control will audit the job as submitted by "Z".

The following is an example for setting the Oracle Home credentials using command line:

./emcli set_credential -target_type=host -target_name=val1 -credential_set=OHCreds -column="OHUsername:val2;OHPassword:val3"
-oracle_homes="val4"

where:

val1 = Hostname

val2 = Oracle Home user name

val3 = Oracle Home password

val4 = Oracle Home location

You can also set credentials for multiple Oracle Homes on the same host using the following command:

./emcli set_credential -target_type=host -target_name=val1 -credential_set=OHCreds -column="OHUsername:val2;OHPassword:val3" 
-oracle_homes="val4;val5

where

val1 = Hostname

val2 = Oracle Home user name

val3 = Oracle Home password

val4 = Oracle Home location 1

val5 = Oracle Home location 2

The emcli set_credential command sets preferred credentials for given users. Table 4-5 describes the input values to the emcli set_credential command.

4.8.2 Patching Oracle Homes When the User is Locked

To patch an Oracle Home used by a user "Oracle" and the user is locked:

1. Edit the default patching script and prepend sudo or sudo -u or pbrun -u to the default patching step. You need to set a policy (by editing the sudoers file) to allow the user submitting the job (who must be a valid operating system user) to be able to run sudo or pbrun without being prompted for password.

4.8.3 Cloning Oracle Homes

The cloning application is wizard-driven. The source of the Oracle Home being cloned may be either an installed Oracle Home or a Software Library. Following are the steps in the cloning process:

1. If the source is an installed Oracle Home, then, after selecting the Oracle Home, a user will need to specify the Oracle Home credentials. These credentials once specified for an Oracle Home are stored in the repository. The next time a user clones the same Oracle Home, these credentials are automatically populated. Other parameters queried from the user at this point is a temporary location (on the source computer) and the list of files to be excluded from the Oracle Home. If the cloning source is a Software Library, the source Oracle Home credentials will not be queried for.

2. The user needs to specify the target location and provide the required credentials for each target location. These credentials will be the Oracle Home credentials for each of these target locations. Subsequently, if a user selects any of these cloned Oracle Homes as a source, the Oracle Home credentials are automatically populated.

3. Depending on the product being cloned, the user can view the Enterprise Manager page where query parameters required for the particular product being cloned are displayed.

4. The user can, then, view the execution of user-supplied pre-cloning and post-cloning scripts and the root.sh script. The root.sh script will always be run with sudo privileges, but the user has the option to decide if the pre-cloning and post-cloning scripts run with sudo privileges.Finally, the user can schedule the cloning job at a convenient time.

For more information about cloning, refer to the Enterprise Manager Online Help.

4.8.4 Using the sudo Command

sudo allows a permitted user to execute a command as the superuser or another user, as specified in the sudoers file. You need to set a policy (by editing the sudoers file) to allow the user submitting the job (who must be a valid operating system user) to be able to use sudo. For more information, see the manual page on sudo (man sudo) on Unix. Enterprise Manager authenticates the user using sudo, and executes the script as sudo.

For example, if the command to be executed is foo -arg1 -arg2, it will be executed as sudo -S foo -arg1 -arg2.