Requirement:
The requirement is to allow users to choose at login time from 2 different attributes from LDAP (e.g. uid and email address).
Oracle solution:
Ref: How to allow multiple login attributes in OAM/OAAM integration using a custom TAP module (Doc ID 2190079.1)
For login user enters username and password on the OAAM page used when integrated with OAM (oaam_server/oamLoginPage.jsp).
Doing so, however, will imply that OAAM will have to keep two security profiles corresponding to each login attribute. When user is authenticated using a different attribute for the first time he will be seen as a new user (OAAM will create a new user record with login_id set to the new attribute value in the VCRYPT_USERS database table) so the registration process will take place again.
This will affect as well any pattern, behavior data which OAAM registers for that user (which will actually be seen by OAAM as 2 users now) so it's not recommended in case one wants to have highly accurate login and pattern data for each user.
Custom solution:
Since there is a limitation when OAAM is part of solution as mentioned in Oracle solution. Below custom solution will prevent creating duplicate OAAM security profiles for same user who login with either username or email address and no custom TAP modules need to be created in OAM.
By customizing OAAM login flow using OAAM extensions it can be achieved.
High level steps below.
The requirement is to allow users to choose at login time from 2 different attributes from LDAP (e.g. uid and email address).
Oracle solution:
Ref: How to allow multiple login attributes in OAM/OAAM integration using a custom TAP module (Doc ID 2190079.1)
For login user enters username and password on the OAAM page used when integrated with OAM (oaam_server/oamLoginPage.jsp).
Doing so, however, will imply that OAAM will have to keep two security profiles corresponding to each login attribute. When user is authenticated using a different attribute for the first time he will be seen as a new user (OAAM will create a new user record with login_id set to the new attribute value in the VCRYPT_USERS database table) so the registration process will take place again.
This will affect as well any pattern, behavior data which OAAM registers for that user (which will actually be seen by OAAM as 2 users now) so it's not recommended in case one wants to have highly accurate login and pattern data for each user.
Custom solution:
Since there is a limitation when OAAM is part of solution as mentioned in Oracle solution. Below custom solution will prevent creating duplicate OAAM security profiles for same user who login with either username or email address and no custom TAP modules need to be created in OAM.
By customizing OAAM login flow using OAAM extensions it can be achieved.
High level steps below.
- Copy struts config file action mapping for /login.do from oaam_server.ear to OAAM extensions WAR file struts XML file.
- Change the "/login.do" action mapping "success" redirect to custom action(Example: /validateUser.do)
- Write an action class extending struts action with below logic.
- Get user entered email address/username entered in OAAM login page screen from OAAM session.
- Write custom logic(JNDI code) to get user login attribute(uid) from user store in custom action class
- Update UIOSessionData instance with user login attribute(uid) retrieved from user store
- Recreate VcryptAuthUser with login username(uid attribute retrieved from user store) if user has already OAAM security profile already created.
- Send action forward to "/loginJump.do" to continue login process with username(uid attribute) even though user entered email address.
- Build custom action class into a custom jar file and deploy in OAAM extensions war under /WEB-INF/lib folder
Thanks
Siva Pokuri.
