Oracle OID (11.1.1.9) with ODIP/ODSM installation

Introduction

This blog will guide you through the installation of Oracle OID (version 11.1.1.9) with ODIP and ODSM installed. Although there are lots of howto’s on the internet and Oracle documentation, there are some tricky things when trying to install the domain in a custom location. Especially with ODIP installed. Most real-world  environments have their domains located on a separate location, outside the middleware home. This is why I wanted to share this with you.
So. Lets get started!

Software used

I have used 2 Oracle Linux 6.4 servers for the installation. 1 is running a Oracle 12c database for the schema’s that you can install with RCU (ODS). The other Linux server will be running the OID. The software used for the OID installation is from the Oracle Identity and Access Management Deployment Repository 11.1.2.3.0, which you can download from the Oracle Software Delivery Cloud This Repository contains the whole Identity and Access Management stack, including Weblogic and RCU.
We will be installing the OID as the oraoas user. The example installation will use the following settings:
The middleware home will be created in /w001/app/mwhome_idm
The ORACLE_HOME  will be created in /w001/app/mwhome_idm/Oracle_IDM1
The instance will be created in /w001/app/instances/oidinst_1 with name oid_1
The domain will be created in /w001/app/domains/idm_domain
We have a jdk home (version 1.7) installed in /w001/app/jdk

Weblogic Installation

Start the weblogic installation by running
java –jar wls_generic.jar
This jar is found in the installers/weblogic directory of the unpacked repository.
Follow the installation screens

Create the middleware home directory:

Choose Custom Install Type…

…to avoid installation of the Evaluation Database…

Select the JDK at /w001/app/jdk

Verify the installation directories

Verify the Summary

Get some coffee….

And finally deselect the Run Quickstart screen and press Done. We do not want to setup a domain at this point!

Oracle IDM Installation

We are now going to install the Oracle IDM software in the middleware home and create an ORACLE_HOME directory
Go to the installers/idm/Disk1 directory from the unpacked Repository and run runInstaller.
This will open the Inventory Directory screen. We will use /w001/app/oraInventory in this example.

Now, the Welcome Screen appears. Click Next

On the next screen, select Install Software – Do Not Configure

Select the middleware home, created in the Weblogic installation, and enter a name for the ORACLE_HOME (default Oracle_IDM1)

Accept the defaults in the rest of the installation.

Domain Creation

We are now going to create a domain with some extra options, that are now available, since we have installed the IDM software.
Run the following command to open the Domain Creation Wizard:
/w001/app/mwhome_idm/wlserver_10.3/common/bin/config.sh
Choose to create a new domain

Now, the next selection is very important! Select Oracle Enterprise Manager, Oracle Identity Management and Oracle JRF (auto-selected). Do NOT select Oracle Directory Integration Platform. We will install ODIP when we will extend the domain.

In the next screen, enter the custom location for the domain and applictions and enter the domain name.

Enter the password for the weblogic user

Select Production Mode

Choose to configure only an Administration Server

Enter the listen address and port for the Administration server

Verify the Summary screen and click Create

And Finish the domain creation

Domain Extension

Now, we will extend the domain with the OID configuration.
Start up the domain by simply running
/w001/app/domains/idm_domain/startWebLogic.sh
This will ask you to enter the weblogic user and password. Wait till the AdminServer is up and running.
With the AdminServer running, run the following command
/w001/app/mwhome_idm/Oracle_IDM1/bin/config.sh
This will show us the Oracle Identity Management Installation Welcome Screen

In the next screen, choose to extend an existing domain and enter the values for the domain created in the previous chapter.

Enter the path and name for the instance

The next screen gives us the option to configure ODIP. If we would have chosen the install ODIP during the creation of the domain, this option would not have been available!
So, now you can select to configure OID, ODIP, HTTP server and ODSM

In the next screen, select Auto Port Configuration, or select a file with custom ports.

Enter the database connection settings

Enter the realm and password for the orcladmin user

Verify the installation summary

Watch the configuration progress.

And finally click Finish to end the configuration.

Optional settings

To verify the running instance, run the following command:
/w001/app/instances/oidinst_1/bin/opmnctl status –l
This will show you the following:

To run the http server on port 80, we will have to grant root access to the .apachectl file.
As root:


As oraoas:

Change the listen port to 80

And restart the OHS

Verify OHS is running on port 80


From the Admin Console you can choose to run the Managed Server, which is hosting the DIP and ODSM application, on a different port. I have configured to run this on port 7024.
You can then configure the weblogic plugin to forward odsm to that managed server.
Edit the file mod_wl_ohs.conf
vi /w001/app/instances/oidinst_1/config/OHS/ohs1/mod_wl_ohs.conf
and add the following section:
<Location ~ "/odsm*">
SetHandler weblogic-handler
WebLogicHost oid1.cinqict.local
WebLogicPort 7024
</Location>
Again, restart the OHS server.
Now you can reach the odsm application and configure you OID through the OHS Http server, on a clean url:

The end ….

That’s all folks.

Not able to start managed servers with NodeManager after weblogic password reset

Recently we had to reset weblogic passwords on several environments. These weblogic environments are all managed by nodemanagers. We changed the weblogic passwords in the console. Logging in at the console with the new passwords went well, so we knew that the password reset was succesfull.
We then recreated the entries in the $DOMAIN_HOME/AdminServer/security/boot.properties.
Starting the AdminServer with the $DOMAIN_HOME/startWeblogic.sh script went fine, without asking for credentials. This confirmed that the boot.properties file was working with the new password.

Still, there was an error when starting the AdminServer with the nodemanager. When starting, the AdminServer logs stated that the user weblogic from the boot.properties was denied access!!! ....

The problem was that the AdminServer (as well as all other managed servers) are using a different boot.properties file, when starting with the nodemanager. This file is located in $DOMAIN_HOME/servers/AdminServer/data/nodemanager/boot.properties This file contains the old values at this moment!
When this file is present, the nodemanager will use this file to boot up the AdminServer. When it is not present, the nodemanager loads a new one.
So, just stop the AdminServer (as well as any other managed servers if present). Stop the nodemanager. Then, delete the boot.properties file from $DOMAIN_HOME/servers/AdminServer/data/nodemanager/.
Now, start the nodemanager. A new boot.properties file will be loaded into $DOMAIN_HOME/servers/AdminServer/data/nodemanager/ and the nodemanager will be able to start the AdminServer.