Integrating OAM 11g with Google Authentication

Nowadays most of the people have multiple internet accounts, each of them with their own credentials, so we usually struggle to remember which user and password were used for a website. Also, web administrators realised many users refuse to register in their sites because they do not want to go through the process of entering all the required data and having another credential to remember.

To avoid this problem, web applications started to de integrated with social media APIs. This way, registration process is easier and login just takes a couple of clicks, making more attractive the site to users.

In the case of Oracle WebCenter Portal, authentication is usually managed in Oracle Access Manager (OAM) and this product can be integrated with social login. In this post I am going to focus on the integration with Google authentication.

When I started this integration with my colleague Sara Manzanero, we found this post and this one explaining the process, which seemed quite straight forward. However, they were written when Google used the OpenID protocol, and now it is using the OAuth 2.0 protocol; also there were some missed steps.

1. Configuring web server

Web server needs to be configured for the roots "oic_rest" and oic_rp". The following fragment is an example for OHS:

# Social Login

<Location /oic_rest>

      SetHandler weblogic-handler

      WeblogicCluster <ip1>:<oam1_port>,<ip2>:<oam_port2>

      Satisfy any

      Allow from all

</Location>

<Location /oic_rp>

      SetHandler weblogic-handler

      WeblogicCluster <ip1>:<oam1_port>,<ip2>:<oam_port2>

      Satisfy any

      Allow from all   

</Location>

2. Enabling Mobile and Social

In order to enable social login in OAM, perform the following actions:

1. Login to OAM console.

2. Navigate to Configuration -> Available Services.

3. Enable "Identity Federation" and "Mobile and Social" services.

3. Creating user identity store

1. In OAM console, navigate to User Identity Stores.

2. Create a new IDS Repository with the connection data to the client identity store (LDAP, AD, ....).

 3. Create an IDS Profile pointing to the IDS repository created in the previous step.

4. Set the new profile as the Default  Store and save changes.

 4. Editing Mobile Services

1. Navigate to Mobile and Social > Mobile Services.

2. Edit UserProfile in Service Providers table.

3. Set the Identity Directory Service to the one created in the previous section.

5. Creating Google Project

A Google project must be created using our own account:

1. Login to Google developer console:

https://console.developers.google.com

2. Create a new project:

3. Once created, navigate to Credentials and createa new client ID. 

4. Set your website URL and for "Redirect URIs", specify this:

http://<host>:<ohs_port>/oic_rp/return

5. Eventually, the Client ID and secret will be displayed for this project:

6. Copy those  values for later use.

6. Editing Internet Identity Provider

1. Back to OAM console, navigate to Social Identity.

2. In Internet Identity Providers section, edit Google.

IMPORTANT: In order to use the Google Identity Provider with OAuth 2.0, the following patch must be applied: 

- Patch 18955121: GOOGLE OPENID INTERFACE NOT ANYMORE SUPPORTED BY GOOGLE

Or simply upgrade OAM to 11.1.2.2.4 with BP04:

- Patch 19718347: ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.2.4

After patching, providers must be updated with the WLST instruction msUpgrade().

3. Paste the Consumer key and secret from your Google project.

4. Save changes.

7. Configuring User Identity Store

1. Navigate to User Identity Store screen and edit the IDS Profile created in section 3.

2. In the Entity Attributes tab,  there is a table with the mappings of the identity store.

3.  Ensure the attributes needed are defined and properly mapped, such as cn, userPassword or mail.

4. Click on the Entities tab and edit the attribute values, they should be provided by the Identity store (LDAP, AD) administrator team.

5. Save changes.

NOTE: If the following error is prompted at saving changes, check that all the attributes have Name, Field and Description.

8. Editing Application Profile

1. Navigate to the Social Identity screen and edit the application profile is being used.

2.  Set the attribute values according to your needs. It is important to choose the UserID Attribute to the Entity Attribute that will be checked when users log in with Google (previous task). For Shared Secret, choose a password of yor choice.

3. Create the Application User Attributes needed for the login and map them to the registration names. The A-Team has a good post explaining this process.

4. In the last section of the page, select Google and define the mappings between the Identity provider (Google) and application.

5. Save changes.

9. Updating Authentication Scheme

1. Navigate to Authentication Schemes and select OICScheme.

2. Set Challenge URL to the /oic_rp/login.jsp path, including host and port. Also, include the parameter MatchLDAPAttribute to the attribute that will uniquely identify users in the identity store, this is configured in section 7.

3. Save changes.

10. Configuring Application Domain

1. Finally, navigate to Application Domains and select the one is being used (OAMApplication) or create a new one if it is a new installation. 

NOTE: The name of the application domain must match the name of the Application Profile (section 8).

2. Click on the Authentication Policies tab.

3. Click on the Protected Resource Policy and set the Authentication Scheme to OICScheme.

4. Save changes and configuration is finished.

Checking Google Login

Once all the configuration steps have be implemented, it is time to test the functionality.

1. Enter the URL to a protected resource of your application and the following screen will be displayed.

2. Click on the Google icon and you will have to login with Google (if you are not already logged in) and confirm the application can access your Google account.

3. the registry page will be loaded with some of the fields already filled in from your Google account.

NOTE: The above screen is the default one, taken from documentation, the displayed attributes do not correspond to the configuration described in this post.

4. After filling all the required information, click Register and the user should be created in the identity store.

5. The next time that I want to access the application, I would simply click the Google link in the login page and I will be logged in directly.

In a future post I will explain how to use customised WebCenter Portal pages for registy and login.

References

A Beginner’s HowTo on Social Federation with OAM Mobile & Social
Understanding Mobile and Social

Configuring Social Identity

OAM 11gR2 Integration with Google using OpenID 

OAM: Configuring Mobile & Social To Authenticate With Google

Generating a Consumer Key and Consumer Secret for Google

Oauth with Oracle Access Manager 11g R2 – Series

SR 3-10408828701 : OAM Integration with Facebook Invalid OAuth access token value

Patch 18955121: GOOGLE OPENID INTERFACE NOT ANYMORE SUPPORTED BY GOOGLE

Patch 19718347: ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.2.4