identity and access management deployment using lifecycle management (lcm)
TRANSCRIPT
2
What is LCM?
Deployment Topology
LCM versus Typical Implementation
Infrastructure Changes
Challenges of LCM
Possible Customization Considerations
Next Steps
Agenda
3
Provides automated installation and configuration capabilities for Oracle Identity and Access Management
Provides automation for all aspects of:• Installing
• Configuring
• Deploying
• Integrating
• Patching
Alternative to Manual Install
Assists in following Oracle Enterprise Deployment Guide (EDG)
What is Lifecycle Management (LCM)?
4
• Old Deployment Process1. Run RCU
2. Install JDK
3. Install WebLogic
4. Install Application
5. Configure Domain
6. Post Install Tasks
7. Patch Application
• New Deployment Process1. Install IDM LCM Tools
1. Patch IDM LCM Tools
2. Create Response File
3. Deploy Response File
1. Ability to automatically
deploy latest patch to
applications
2. Automated or manual
deployment process
Traditional Install versus LCM Install
5
• Old Patching Process1. Update OPatch, if necessary
2. Download application patch
3. Patch Oracle Binaries
4. Modify patch_oim_wls.profile
5. Patch OIM Managed Servers
6. Patch design console and remote manager
7. Post configurations for WebLogic Server
8. Patch diagnostic dashboard
9. Redeploy SPML DSML Web Service
• New LCM Patching Capabilities1. Patches all nodes
2. Applies patch to both shared and
local storage
3. Stops and starts affected servers
4. Executes post-patch artifact
changes
5. Provides comprehensive state-sharing and reporting
6. Capable of upgrading to newer
Patch Set releases (e.g. PS2 to PS3)
Traditional Patching versus LCM Patching
6
Benefits
Reduces the
complexity of
installation
Provides
maximum
automation
Assists in
automated
upgrade and
patching
Can be used for
provisioning,
patching, and
upgrade
Supports
production-
ready
topologies on
multiple hosts
Provides
significant
reduction in
deployment
time
For
provisioning,
patching, and
upgrade – Pre-
and post-install
health checks
Flexible
deployment
Runtime
monitoring and
diagnosability
Automated tool for
initial deployment
Automated tool for
ongoing upgrade,
patching, and health
check
Proactive
monitoring and
management with
Enterprise Manager
Simplicity Usability Manageability Outcome
Source: http://www.oracle.com
8
• Application Binaries
– OAM
– OIM
– SOA
• Admin Server
• IAM Patch Manager
• Application Binaries (OHS)
• Managed Servers
– OAM
– OIM
– SOA
– BI
• OHS opmnctl Instance
– httpd.conf and moduleconf all
configured automatically out of box
Binaries and Application Servers Install Location
Shared Directory Local Directory
11
OIM PS3
*LCM-recommended directory structure for OIM,
highlighting shared and private directories
12
OAM PS3
*LCM-recommended directory structure for OAM,
highlighting shared and private directory structure
Out-of-the-box creates 3
managed servers:
1. OAM Managed Server
2. Oracle Policy Manager
3. Mobile Security Suite
Managed Server
14
DEV2 OIM Two-Node Topology
dev2igdadmin.ast.org
For all internal HTTP traffic directed to administration
services in Governance Domain
dev2igdinternal.ast.org
SOA Managed Servers access this virtual host to callback OIM
web services
dev2prov.ast.org
Access point for all HTTP trafficdirected to SSO services
Source: https://docs.oracle.com/cd/E40329_01/doc.1112/e48618/network_im.htm#IMEDG2156
astastast
15
DEV2 OAM Two Node Topology
dev2iadadmin.ast.org
Load Balancer end point used to access
IAMAccessDomain admin functions
dev2iadinternal.ast.org
Internal call back virtual host
dev2sso.ast.org
Access point for all HTTP traffic directed to
SSO services; Incoming traffic from clients is
SSL-enabled
dev2msas.ast.org
Central access point for securing traffic
from mobile devices to intranet resourcesSource: http://www.oracle.com
astast astast
ast
16
HA Deployment using LCM supports deployment on only two nodes• Scale-out scripts available – Manual process
May need two separate OHS Instances to front-end internal OIM and OAM applications
OHS server does not use latest version
Shared Directory System may not be an option for all enterprises
Challenges
17
Installing and Creating Oracle Internet Directory is not supported
OAM-only and OIM-only topologies cannot share same IDM_TOP• Requires two different mounts and additional storage
Cleanup and restore is supported only for single-host deployments
Scale-out and scale-up of configured environment not automated by LCM tools• Manual steps required
Automated patching does not support:• JDK Upgrade
• Patching of database and Oracle WebLogic Server• Patching of Oracle Access Manager Webgates used for Web servers
• Patching of LCM tools
Tool Limitations
18
Quicker Deployment Time
IDM Admin Service• REST API-based
• Scale-out capabilities
• Test-to-productiono Uses IDMAS to generate configuration difference between multiple
environments
o T2P gesture is achieved by applying new configuration to target environment
• Multi-data center capabilitieso Automatically synchronize changes between Master DC & Clone DC
Future 12c LCM Features
19
LCM has a learning curve
Use LCM where HA is required for only two nodes
Recommend to use only where Enterprise allows shared
directories
Use Redhat 6 or Redhat 7 as OS
Allow Load Balancers to respond to PING during installation
Some customization around timeouts may be required
Concluding Thoughts
*The views and opinions expressed herein are those of the author and do not necessarily reflect the views of Oracle or any other associates.