#236 Installing OSB 11.1.1.7

Installing OSB 11.1.1.7 on Win 64bit

Files required -

Step 0 - install RCU

I have already installed SOA PS6 - so I have already run rcu.
If you are doing a standalone OSB install i.e. no SOA database already installed - then
you need to run rcu against your ORCL DB.
simply unzip the rcu file and run rcu.bat



For this scenario -
I am going to install in the directory d:\work\envs\OSBPS6


Step 1 - Install WLS
java -jar wls1036_generic.jar

Specify the home directory

Then do a typical install

Point to your jdk

Step 2 - Install OEPE
Now unzip the oepe file to your home directory e.g. D:\work\envs\OSBPS6

Step 3 - Install OSB
Unzip ofm_osb_generic...

Open Disk1

Run setup.exe -jreLoc yourJDK

e.g.

Specify your home directory e.g. d:\work\envs\OSBPS6

Select Custom install

Here I select the IDE, but de-select the samples

Validate the oepe location.

Review - Oracle_OSB1 directory has been created

Step 4 - Configure OSB domain

run config.cmd

 

Notice I selected the dev edition - all on the 1 AdminServer.
I also selected WSM and EM for managing WSM.

  
Point to your local DB for the WSM schema.
Do not worry about the JMS Reporting provider

 

 Next I change the AdminServer port to 7010 - as I already have SOA Suite installed

Start the AdminServer

Step 5 - Test web console

 http://localhost:70101/sbconsole

Step 6- Test Oepe IDE

Start eclipse and then create an OSB configuration project

An OSB Configuration Project is a container for OSB projects. OSB projects can only be created inside an OSB Configuration Project. The Configuration Project is an environment where you can define various OSB and IDE environmental settings and behaviors.

Click on the Servers tab 

Right mouse click --> New --> Server

Point to your domain directory

 Add Resources

Looks good!

#235 WSM protecting composite - yet again!

Here we go, the last of 3 posts -

The exposed service is protected by the following WSM policy -

 Testing this is easy -

1. Make sure the SSL Listen Port is enabled

Test in em, don't forget to edit the endpoint URL -

Next post will call this from OSB

#234 BPEL invoking SAML protected web service

Firstly kudos to the excellent posts from Edwin Biemond - which were my starting point here -

http://biemond.blogspot.de/search/label/OWSM

also a BIG thanks to my colleague FlaviusS for the SAMLCredentialMapperProvider setup.

In this scenario, I create a web service and deploy it to WLS server running in nc_domain.

I then create a SOA composite with a BPEL process that calls this service.
The SOA composite is deployed to bpmps6_domain.

A user called wsclient has been created in the WLS ldap of both domains.
  
Now to SAML -
SAML recognises 3 Roles -
1. the principal aka the user e.g. wsclient
2. the identityProvider e.g. WLS ldap
3. the serviceProvider e.g. the web service running on nc_domain

To quote Wikipedia -

"In the use case addressed by SAML, the principal requests a service from the service provider. The service provider requests and obtains an identity assertion from the identity provider. On the basis of this assertion, the service provider can make an access control decision - in other words it can decide whether to perform some service for the connected principal. Before delivering the identity assertion to the SP, the IdP may request some information from the principal - such as a user name and password - in order to authenticate the principal. SAML specifies the assertions between the three parties: in particular, the messages that assert identity that are passed from the IdP to the SP."

So to recap, I have 2 WLS domains on my laptop -
nc_domain - simple standalone WLS (AdminServer running on port 7005) along with EM and WSM.

bpmps6_domain - SOA PS6 domain with all the bells and whistles!

Keystore setup

I set up the keystores in both domains -

bpmps6 - default-keystore.jks - key is orakey

nc - oracle-keystore.jks - key is orclkey

Now I export the public keys for each and
import the public orakey to nc oracle-keystore.jks
import the public orakey to bpmps6 default-keystore.jks

The cmds -

keytool -genkeypair -keyalg RSA -alias orclkey -keypass welcome1 -keystore oracle-keystore.jks -storepass welcome1 -validity 3600

keytool -exportcert -alias orclkey -storepass welcome1 -keystore oracle-keystore.jks -file orclServer.cer

keytool -exportcert -alias orakey -storepass welcome1 -keystore default-keystore.jks -file oraServer.der

keytool -import -alias orakey -file oraServer.der -storepass welcome1 -keystore oracle-keystore.jks

keytool -import -alias orclkey -file orclServer.cer -storepass welcome1 -keystore default-keystore.jks

keytool -list -storepass welcome1 -keystore default-keystore.jks

just in case –

keytool -delete -alias orakey -keystore default-keystore.jks

Notice I exported the orakey as a .der file - more about that later.

User creation

I create a user called wsclient (password welcome1) on both domains via the WLS console.
btw. passwords don't need to match. However welcome1 is as good a password as any!

SAML CredentialMapperProviderSetup on bpmps6 domain

The use of the key - in this case we point to the oraServer.der file, exported earlier, is specified here -

Opening this, one sees -

 When creating this entry, WLS won't accept a .cer file, hence my export to .der format.

 
Security config in em - bpmps6_domain

 sign-csf-key is set to orakey/welcome1
 enc-csf-key is set to orakey/welcome1
basic.credentials is set to wsclient/welcome1
 keystore-csf-key is set to owsm/welcome1



 Security config in em - nc_domain

 sign-csf-key is set to orclkey/welcome1
 enc-csf-key is set to orclkey/welcome1
 keystore-csf-key left to default.




Now to the app itself...

Create the web service

The ws itself is very simple -

 You see the policy used is - oracle/wss11_saml_token_with_message_protection_service_policy
Now I deploy this ws to the AdminServer running on nc_domain.

Create the SOA Project

I then create a SOA Project - and include the ws as a reference -

I configure security -

 Note: the service policy we defined earlier is
oracle/wss11_saml_token_with_message_protection_service_policy

So the complementary client policy is 
oracle/wss11_saml_token_with_message_protection_client_policy

Now I add a simple BPEL process with default input/output parameters.
The process calls the ExternCCservice passing a credit card nr and getting a response (valid/invalid)

 I then apply security to the exposed BPEL client -

I deploy the app and test -

Test

Result -

#233 Simple example of BPEL invoking WSM protected service

Very simple example -

I have created a validate creditCard web service and deployed it to WLS

As you can see, I specified oracle/wss_username_token_service_policy when creating the web service.

I get the following if I try to test the web service using the default WLS web service tester -

Great stuff, as we say in Ireland!

Step 1 - create a new user in WLS -

Mine is called wsclient, password is welcome1

Step 2 - setup the keystore 

 This creates -

Note the directory /mydomain/config/fmwconfig

Step 3 - configure keystore usage in em

I then configure the keystore - using the alias orakey setting all passwords to welcome1

 

Step 4 - create a key entry for wsclient in em

Note the name - basic.credentials

Now I create my composite

Security is configured on CCService as follows -

I specified oracle/wss_username_token_service_policy when creating the web service.
So now I specify the relevant policy for the web service client -

  Click on the pencil icon to edit -

here is our basic.credentials

Deploy and test the composite -

Result -

#232 Oracle Fusion Middleware ,11g R1 (11.1.1.7) released

Here it is on OTN