How to allow multiple login attributes in OAM/OAAM integrated environment

Requirement:

The requirement is to allow users to choose at login time from 2 different attributes from LDAP (e.g. uid and email address). 

Oracle solution:

Ref: How to allow multiple login attributes in OAM/OAAM integration using a custom TAP module (Doc ID 2190079.1)

For login user enters username and password on the OAAM page used when integrated with OAM (oaam_server/oamLoginPage.jsp).

Doing so, however, will imply that OAAM will have to keep two security profiles corresponding to each login attribute. When user is authenticated using a different attribute for the first time he will be seen as a new user (OAAM will create a new user record with login_id set to the new attribute value in the VCRYPT_USERS database table) so the registration process will take place again.

This will affect as well any pattern, behavior data which OAAM registers for that user (which will actually be seen by OAAM as 2 users now) so it's not recommended in case one wants to have highly accurate login and pattern data for each user.

Custom solution:

Since there is a limitation when OAAM is part of solution as mentioned in Oracle solution. Below custom solution will prevent creating duplicate OAAM security profiles for same user who login with either username or email address and no custom TAP modules need to be created in OAM.

By customizing OAAM login flow using OAAM extensions it can be achieved.

High level steps below.

1. Copy struts config file action mapping for /login.do from oaam_server.ear to OAAM extensions WAR file struts XML file.
2. Change the "/login.do" action mapping "success" redirect to custom action(Example: /validateUser.do)
3. Write an action class extending struts action with below logic.
1. Get user entered email address/username entered in OAAM login page screen from OAAM session.
2. Write custom logic(JNDI code) to get user login attribute(uid) from user store in custom action class
3. Update UIOSessionData instance with user login attribute(uid) retrieved from user store
4. Recreate VcryptAuthUser with login username(uid attribute retrieved from user store) if user has already OAAM security profile already created.
5. Send action forward to "/loginJump.do" to continue login process with username(uid attribute) even though user entered email address.
4. Build custom action class into a custom jar file and deploy in OAAM extensions war under /WEB-INF/lib folder

Thanks

Siva Pokuri.

OAAM Tips: Enable Secure and HTTPonly to all OAAM cookies

There are two properties to set OAAM cookies Secure and HTTPOnly.

1. "oaam.cookies.secure" property can be "true" or "false". By default property value always "false". If all OAAM cookies needed to be secure make this property "true".
2. "oaam.cookies.httponly" property is "true" by default.

It's always good practice to have both true as it prevents sending the cookie over the network in clear text.

Thanks

Siva Pokuri.

Sample code of OAAM 11g API code to get user challenge questions

import com.bharosa.client.BharosaHelper;

import com.bharosa.client.BharosaSession;

import com.bharosa.client.enums.BharosaEnumAuthStatus;

import com.bharosa.client.enums.BharosaEnumChallengeResult;

import com.bharosa.vcrypt.auth.impl.VCryptAuthSOAPImpl;

import com.bharosa.vcrypt.auth.intf.VCryptAuthResult;

import com.bharosa.vcrypt.auth.intf.VCryptAuthUser;

import com.bharosa.vcrypt.auth.intf.VCryptLocalizedString;

import com.bharosa.vcrypt.auth.intf.VCryptQuestion;

import com.bharosa.vcrypt.common.util.VCryptResponse;

import com.bharosa.vcrypt.tracker.util.CookieSet;

import com.bharosa.vcryptclient.proxy.intf.BharosaProxy;

public class OAAMCQuestions {

/**

* @param args

*/

public static void main(String[] args) {

OAAMCQuestions ocqv =  new OAAMCQuestions();

ocqv.getUserChallengeQuestions();

}

public void getUserChallengeQuestions(){

String username = "spokuri";

try {

            VCryptAuthSOAPImpl auth = new VCryptAuthSOAPImpl();

            VCryptAuthUser user = new VCryptAuthUser();

            BharosaProxy proxy = BharosaProxyImpl.getInstance();

           

            String customerID = proxy.getUserByLoginId(username).getCustomerId();

           

            System.out.println("customerID " + customerID);

           

            user = proxy.getUser(customerID);

           

           

            user = proxy.getUserByLoginId(customerID);

           

            VCryptQuestion secretQuestion = proxy.moveToNextSecretQuestion(customerID);

           

            System.out.println("Secret Question " + secretQuestion);

           

            VCryptQuestion[] secretQuestion1 = proxy.getAllMappedSignOnQuestions(customerID);

           

            String q1 = secretQuestion1[0].toString();

            System.out.println("Question 1" + q1);

            String q2 = secretQuestion1[1].toString();

            System.out.println("Question 2" + q2);

            String q3 = secretQuestion1[2].toString();

            System.out.println("Question 3" + q3);

                       

           

        } catch (Exception e) {

            e.printStackTrace();

        }

       

         

    }

}

OAAM 11g R2 PS3 Secondary email OTP configuration with custom challenge processor

Hello Readers,

Steps to configure secondary email as OTP:

Demo video: http://www.idmfun.com/2016/07/oaam-11g-r2-ps3-secondary-email-otp_1.html

1. Create custom challenge processor.

2. Create a class which extends "AbstractUMSOTPChallengeProcessor" as shown below.

import com.bharosa.uio.processor.challenge.AbstractUMSOTPChallengeProcessor;

import com.bharosa.uio.util.UIOSessionData;

import com.bharosa.uio.util.UIOUtil;

import java.util.ArrayList;

import java.util.List;

import oracle.ucs.messaging.ws.types.Address;

import oracle.ucs.messaging.ws.types.DeliveryType;

public class Email2ChallengeProcessor extends AbstractUMSOTPChallengeProcessor

{

   protected List<Address> getRecipients(UIOSessionData sessionData) 

   {

       String toAddress = UIOUtil.getContactInfo(sessionData, "email2");

       Address recipientAddr = getAddress(toAddress, DeliveryType.EMAIL);

       List<Address> retList = new ArrayList<Address>();

       retList.add(recipientAddr);

       return retList;

    }

}

3. Build jar file with the above java class file and place it in oracle.oaam.extensions.war lib folder.

4. Add below list of properties in oaam_custom.properties file in oracle.oaam.extensions.war

# Second Email Address Input Registration Field Properties Example

bharosa.uio.default.userinfo.inputs.enum.email2=2002

bharosa.uio.default.userinfo.inputs.enum.email2.name=Email Address 2

bharosa.uio.default.userinfo.inputs.enum.email2.description=Email Address 2

bharosa.uio.default.userinfo.inputs.enum.email2.inputname=email2

bharosa.uio.default.userinfo.inputs.enum.email2.inputtype=text

bharosa.uio.default.userinfo.inputs.enum.email2.maxlength=40

bharosa.uio.default.userinfo.inputs.enum.email2.required=true

bharosa.uio.default.userinfo.inputs.enum.email2.order=2

bharosa.uio.default.userinfo.inputs.enum.email2.enabled=true

bharosa.uio.default.userinfo.inputs.enum.email2.regex=.+@[a-zA-Z_]+?\.[a-zA-Z.]+

bharosa.uio.default.userinfo.inputs.enum.email2.errorCode=otp.invalid.email

bharosa.uio.default.userinfo.inputs.enum.email2.managerClass=com.bharosa.uio.manager.user.DefaultContactInfoManager

bharosa.uio.default.userinfo.inputs.enum.email2.verify=true

#bharosa.uio.default.userinfo.inputs.enum.email2.displaymask=.{1,2}(.*)@([a-zA-Z_]+)?\.[a-zA-Z]{2,3}

# Second Email Address Challenge OTP Field Properties Example

bharosa.uio.default.challenge.type.enum.ChallengeEmail2=2003

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.available=true

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.description=Challenge Email 2

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.displayedInfo=email2

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.enabled=true

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.htmlInputType=text

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.htmlLabel=Email Code

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.name=Email Challenge2

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.otp=true

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.otpexpirytimeMs=400000

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.processor=Email2ChallengeProcessor

bharosa.uio.default.challenge.type.enum.ChallengeEmail2.requiredInfo=email

# Rule action for ChallengeEmail2

rule.action.enum.ChallengeEmail2=1091

rule.action.enum.ChallengeEmail2.name=Challenge Email 2

rule.action.enum.ChallengeEmail2.description=Challenge the user using Email

rule.action.enum.ChallengeEmail2.otp=true

5. Redeploy oracle.oaam.extensions.war file in both oaam admin & oaam server managed servers.

6. Login to OAAM admin console

7. Navigate to Groups and click on "OAAM Challenge Choice" and click on "Actions" tab.

8. Add newly created action called "Challenge Email 2".

9. Now, login to TAP protected application by registering new user with 2 OTP email addresses.

10. Test login with user account who registered primary & secondary email address.

-- Siva Pokuri.

OAAM 11g R2 PS3 challenge choice demo video

Ref: https://docs.oracle.com/cd/E52734_01/oaam/AAMAD/otp.htm#AAMAD9657

-- Siva Pokuri.

Federation between OAM 11g R2 PS2 (as IDP) And OAAM 11g R2 PS2 (with TAPScheme) Is Failing

Error Message:

[2016-01-10T10:35:15.624-04:00] [oaam_server_server1] [WARNING] [] [oracle.oaam] [tid: [ACTIVE].ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: d755faf711bced8d:-36c6a2a8:1540baa882a:-8000-0000000000011332,0] [APP: oaam_server#11.1.2.0.0] [DSID: 0000LGyO9iN4epo5GVG7yf1N3Jbx00001_] OAM TAP Submit URL not found in TAP token, OAM may not be up to date.

This is known issue in OAM + OAAM 11g R2 PS2 base environment.

Follow the oracle support document below to download and install one off patch

Federation between OAM (as IDP) And OAAM (with TAPScheme) Is Failing (Doc ID 1928959.1)

(OR)

Update OAM & OAAM to latest build patch.

-- Siva Pokuri

Info: All about OAAM 11g database tables

Click here:  http://docs.oracle.com/cd/E23549_01/oid.1111/e10035/schema_oaam.htm

Download link: https://drive.google.com/open?id=0B6HoUzbcx4JON2x3RjJCaWJKRXM



-- Siva Pokuri.

Sample OAAM 11g API code to reset security profile

Sample Code:

package com.pokuri.oaam;

import java.util.ArrayList;
import java.util.List;

import com.bharosa.vcrypt.auth.intf.*;
import com.bharosa.vcrypt.auth.util.VCryptAuthUtil;
import com.bharosa.vcrypt.common.util.VCryptResponse;
import com.bharosa.vcrypt.customercare.impl.VCryptCCImpl;
import com.bharosa.vcrypt.customercare.impl.VCryptCCSOAPImpl;
import com.bharosa.vcrypt.customercare.util.VCryptCCUtil;

import com.bharosa.vcryptclient.proxy.exception.BharosaProxyException;
import com.bharosa.vcryptclient.proxy.intf.BharosaProxy;

/**
 * @author siva pokuri
 *
 */
public class ChallengeQuestionsReset
{
public static void main(String[] args)
{
ChallengeQuestionsReset cu = new ChallengeQuestionsReset();
String response = "FAILED";
try
{
response = cu.resetUserProfile("spokuri", "Default");
System.out.println("Response " + response);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
System.out.println("RESPONSE " + response);
}
 
  public String resetUserProfile(String userName, String primaryGroupName)
{
   System.out.println("Creating user: " + userName);
            try{
 
   VCryptCCSOAPImpl vcc = new VCryptCCSOAPImpl();
   VCryptResponse vr = vcc.resetUser(userName);
 
   System.out.println("Message " +vr.getSuccess());
   System.out.println("Status code Message " +vr.getResponseCode());

return "SUCCESS";

  }
  catch (Exception e) {
// TODO: handle exception
}
return "FAILED";
}

}

-- Siva Pokuri.

TIPS: To turn off location prompt in OAAM Server login page

OAAM Location tracker screenshot:

Change below property value from "true" to "false" in OAAM Admin Console to stop that Location tracker prompt:

bharosa.uio.default.javascript.fingerprint.location.prompt.enabled=true

-- Siva Pokuri.

OAAM 11g API code to create & configure security questions for user

import java.util.ArrayList;

import java.util.List;

import com.bharosa.vcrypt.auth.intf.*;

import com.bharosa.vcrypt.auth.util.VCryptAuthUtil;

import com.bharosa.vcrypt.common.util.VCryptResponse;

import com.bharosa.vcryptclient.proxy.exception.BharosaProxyException;

import com.bharosa.vcryptclient.proxy.intf.BharosaProxy;

/**

 * @author pokuri

 *

 */

public class CreateUser {

private BharosaProxy proxy = null;

public static void main(String[] args)

{

CreateUser cu = new CreateUser();

String response = null;

try

{

response = cu.createUser("pressi", "Default");

//response = cu.checkQuestionsStatus("siva.pokuri");

} catch (Exception e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

System.out.println("RESPONSE " + response);

}

   

    public String checkQuestionsStatus(String userName)

    {

    VCryptAuthUser user = null;

    System.out.println("Checking user: " + userName);

    user = new VCryptAuthUser();

user.setLoginId(userName);

try {

System.out.println("Questions Status " + user.getRegistrationStatus());

} catch (Exception e) {

System.out.println("Exception " +e);

return "QA_STATUS_CHECK_FAILED";

}

return "CHECKED_QA_STATUS";

    }

   

public String createUser(String userName, String primaryGroupName)

{

proxy = BharosaProxySingleton.getProxyInstance();

// try to find the user record in OAAM

   VCryptAuthUser user = null;

   System.out.println("Creating user: " + userName);

   user = new VCryptAuthUser();

   

   try{

    user.setLoginId(userName.trim());

   }

   catch (Exception e) {

System.out.println("Exception " + e);

}

   user.setCustomerId(userName.trim());

   user.setCustomerGroupId(primaryGroupName.trim());

   try

   {

    user = proxy.createUser(user);

   }

catch (Exception e)

{

System.out.println("Exception " +e);

return "CREATE_USER_FAILED";

}

proxy.setUser(user);

int status = proxy.getUserStatus(userName.trim());

System.out.println("User Status  before Security Questions ---- >> " + status);

String questionId1 = "41";

String questionText1 = "Who was your childhood hero?";

String answer1 = "pilot1";

String questionId2 = "42";

String questionText2 = "What is the name of your favourite childhood teacher?";

String answer2 = "pilot2";

String questionId3 = "43";

String questionText3 = "What was your dream job as a child?";

String answer3 = "pilot";

     

VCryptQuestion question1 = new VCryptQuestion();

VCryptQuestion question2 = new VCryptQuestion();

VCryptQuestion question3 = new VCryptQuestion();

List<String> answerList = new ArrayList<String>();

List<String> answerList1 = new ArrayList<String>();

List<String> answerList2 = new ArrayList<String>();

question1.setQuestionId(new Long(questionId1.trim()));

question1.setQuestion(questionText1.trim());

answerList.add(answer1.trim());

question1.setAnswerList(answerList);

question2.setQuestionId(new Long(questionId2.trim()));

question2.setQuestion(questionText2.trim());

answerList1.add(answer2.trim());

question2.setAnswerList(answerList1);

     

question3.setQuestionId(new Long(questionId3.trim()));

question3.setQuestion(questionText3.trim());

answerList2.add(answer3.trim());

question3.setAnswerList(answerList2);

     

try

{

VCryptAuth auth = VCryptAuthUtil.getVCryptAuthInstance();

VCryptAuth auth1 = VCryptAuthUtil.getVCryptAuthInstance();

VCryptAuth auth2 = VCryptAuthUtil.getVCryptAuthInstance();

VCryptResponse vr = null;

VCryptResponse vr1 = null;

VCryptResponse vr2 = null;

vr = auth.addQuestion(userName.trim(), question1);

vr1 = auth1.addQuestion(userName.trim(), question2);

vr2 = auth2.addQuestion(userName.trim(), question3);

System.out.println("Response Code " + vr.getResponseCode());

System.out.println("Response Code " + vr1.getResponseCode());

System.out.println("Response Code " + vr2.getResponseCode());

System.out.println("Successfully Created User & configured Sequrity questions");

proxy.setUserStatus(userName.trim(), 2);

System.out.println("User "+userName+" Status -->>"+proxy.getUserStatus(userName.trim()));

}

catch (Exception e)

{

System.out.println("Create user failed!!!! " + e);

}

return "CREATE_USER_SUCCESS";

}

}

-- Siva Pokuri