forgerock OPENAM passing attribute to SP bug

When SP need  additional attribute and you add these attribute to SP metadata in OpenAM console. all the existing attribute values got overwritten. So to fix this you have add all the attribute that SP required to SP metadata configuration by following below steps

go to SP metadata and select "Assertion Processing" and add required attributes to "Attribute Mapper"

like

mail=mail
uid=uid

SAML response Difference between IDP and SP initiated SSO

Difference between 2 request is in BOLD letter

DIP Initiated SSO
An IdP Initiated SSO flow is a Federation SSO operation that was started from the IdP Security Domain, by the IdP Federation server creating a Federation SSO Response and redirecting the user to the SP with the response message and an optional operational state:

The Federation SSO Response varies depending on the protocol used:
SAML 2.0: SAMLResponse with Assertion
SAML 1.1: Response with Assertion
WS-Fed: Response with Assertion
OpenID 2.0: OpenID 2.0 Response
The optional operation state in this flow will convey the URL where the user should be redirected after the Federation SSO is complete at the SP. If missing, the SP will need to determine where the user should be redirected. This information is conveyed differently depending on the protocol:
SAML 2.0: RelayState parameter
SAML 1.1: TARGET parameter
WS-Fed: wctx parameter
OpenID 2.0: this protocol does not support IdP Initiated SSO flow.


SP Initiated SSO
An SP Initiated SSO flow is a Federation SSO operation that was started from the SP Security Domain, by the SP Federation server creating a Federation Authentication Request and redirecting the user to the IdP with the message and some short string representing the operation state:

The Federation Authentication Request varies depending on the protocol used:
SAML 2.0: AuthnRequest
SAML 1.1: a URL with a parameter representing the SP
WS-Fed: a URL with a wtrealm parameter representing the SP and other optional parameters
OpenID 2.0: OpenID 2.0 Request
The operation state (what the user was doing before the Federation SSO operation started) is conveyed in the message sent to the IdP with the user, not as the whole state, but instead as a pointer to the state in the SP Server's runtime storage. This information is conveyed differently depending on the protocol:
SAML 2.0: RelayState parameter
SAML 1.1: TARGET parameter
WS-Fed: wctx parameter
OpenID 2.0: openid.return_to parameter which is an SP URL where the user will be redirected after authentication at the IdP, which is generated at runtime by the SP, and as such can contain a query parameter referencing an operational state

OpenDJ: Two Products in One(HTTP/HTTPS REST-based)

OpenDJ is both a full-fledged LDAP / LDAPS server, AND an HTTP / HTTPS REST-based server. This is an important distinction, because each can be run separately, or in tandem.


 IAM Stack can runs both LDAP and HTTP/REST on the same server. It is possible to set up REST Gateways and other more custom configurations to further separate the two.


Here's where it gets interesting:

REST is not enabled by default
REST uses its own logger and connection handler
REST uses its own separate configuration file
REST presents only a "window" of OpenDJ schema data

The last point is important. The REST interface represents potential attribute data. In other words, it CAN respond to data queries for all data available in the directory. By default, it does not. Nor, is it aware of custom schema extensions by default.


When setting up OpenDJ, first get all DJ / LDAP components working correctly, then add HTTP support later. 

why Setting the Time Service (NTP Client) is important and its alternate

In IAM stack Time synchronization is a key component of a smooth IAM service. Not configuring it can cause replication issues. To synchronize the IAM Stack, we can use the subnet router, which can be configured as an NTP server.

to retrive public SSL certificate openssl command

To retrieve public SSL certificate you can use a command similar to:

echo | openssl s_client -connect orasystemsusa.com:636 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'

manual log rotation process

OS level command to rotate logfiles.

Please find below the logrotate file for the web policy agents in PROD environment:

/var/log/httpd/*log {

    missingok

    notifempty

    sharedscripts

    delaycompress

    postrotate

        /bin/systemctl reload httpd.service > /dev/null 2>/dev/null || true

    endscript

}

OVD heap size increase oracle

Controlling the Maximum Heap Size Allocated to the Oracle Virtual Directory Server

The -Xmx parameter in the opmn.xml file controls the maximum heap size allocated to the Oracle Virtual Directory server. The default value is -Xmx256m. Edit this parameter as needed to increase or decrease the maximum heap size allocated to the Oracle Virtual Directory server. The opmn.xml file is located in the ORACLE_INSTANCE/config/OPMN/opmn/ directory.
The following example shows the -Xmx parameter set to -Xmx2048m, which allocates 2 GB of heap size to the Oracle Virtual Directory Server:

<ias-component id="OVD_COMPONENT_NAME">
            <process-type id="OVD" module-id="OVD">
               <module-data>
                  <category id="start-options">
                     <data id="java-options" value="-server -Xms512m -Xmx2048m                               
-Doracle.security.jps.config=$ORACLE_INSTANCE/config/JPS/jps-config-jse.xml 
-Dvde.soTimeoutBackend=120"/>
                     <data id="java-classpath" value="$ORACLE_
HOME/ovd/jlib/vde.jar$:$ORACLE_HOME/jdbc/lib/ojdbc6.jar"/>
                  </category>
               </module-data>
               <stop timeout="120"/>
            </process-type>
         </ias-component>