In one of my missions, I was involved in a new Fusion Middleware 12C (12.2.1.2) installation with an ADF application and an Oracle report server instance deployments .
\nThis infrastructure is protected using an Access Manager Single Sign on Server.
\nIn Production, the complete environment is fronted by a WAF server ending the https.
\nOn the TEST The complete environment is fronted by a SSL reverse proxy ending the https.<\/p>\n
In the chosen architecture, all Single Sign On request goes directly through the reverse proxy to the OAM servers.
\nThe Application requests and the reports requests are routed through a HTTP server having the WebGate installed.<\/p>\n
Below is an extract of the SSL part of the reverse Proxy configuration: <VirtualHost *:7778> # Force caching for image files #reports.conf The OAM Server gets and sets a cookie named OAM_ID. The contents of the cookies are:<\/p>\n Authenticated User Identity (User DN) The validity of a WebGate handled user session is 30 minutes by default and then the WebGate checks the OAM cookies. We needed to changes the SSL reverse proxy configuration to send the correct information to the WebLogic Server and HTTP Server about ending SSL at reverse proxy level. # For the WebLogic Server to be informed about SSL ending at reverse proxy level The WAF needed to be configured to do the same HTTP Headers adds in the production environment.<\/p>\n After those changes, the issue was solved.<\/p>\n","protected":false},"excerpt":{"rendered":" In one of my missions, I was involved in a new Fusion Middleware 12C (12.2.1.2) installation with an ADF application and an Oracle report server instance deployments . This infrastructure is protected using an Access Manager Single Sign on Server. In Production, the complete environment is fronted by a WAF server ending the https. On […]<\/p>\n","protected":false},"author":40,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[229],"tags":[],"type_dbi":[],"class_list":["post-11652","post","type-post","status-publish","format-standard","hentry","category-database-administration-monitoring"],"acf":[],"yoast_head":"\n
\n# SSL Virtual Host
\n<VirtualHost 10.0.1.51:443>
\n ServerName https:\/\/mySite.com
\n ErrorLog logs\/ssl_errors.log
\n TransferLog logs\/ssl_access.log
\n HostNameLookups off
\n ProxyPreserveHost On
\n ProxyPassReverse \/oam http:\/\/appserver.example.com:14100\/oam
\n ProxyPass \/oam http:\/\/appserver.example.com:14100\/oam
\n ProxyPassReverse \/myCustom-sso-web http:\/\/appserver.example.com:14100\/myCustom-sso-web
\n ProxyPass \/myCustom-sso-web http:\/\/appserver.example.com:14100\/myCustom-sso-web
\n ProxyPass \/reports http:\/\/appserver.example.com:7778\/reports
\n ProxyPassReverse \/reports http:\/\/appserver.example.com:7778\/reports
\n ProxyPass \/myApplication http:\/\/appserver.example.com:7778\/myApplication
\n ProxyPassReverse \/myApplication http:\/\/appserver.example.com:7778\/myApplication
\n # SSL configuration
\n SSLEngine on
\n SSLCertificateFile \/etc\/httpd\/conf\/ssl\/myStite_com.crt
\n SSLCertificateKeyFile \/etc\/httpd\/conf\/ssl\/mySite_com.key
\n<\/VirtualHost><\/code>
\nHTTP Server Virtual hosts:
\n# Local requests
\nListen 7778
\n<VirtualHost *:7778>
\n ServerName http:\/\/appserver.example.com:7778
\n # Rewrite included for OAM logout redirection
\n RewriteRule ^\/oam\/(.*)$ http:\/\/appserver.example.com:14100\/oam\/$1
\n RewriteRule ^\/myCustom-sso-web\/(.*)$ http:\/\/appserver.example.com:14100\/myCustom-sso-sso-web\/$1
\n<\/VirtualHost><\/p>\n
\n ServerName https:\/\/mySite.com:443
\n<\/VirtualHost><\/code>
\nThe ADf application and the reports servers mapping is done using custom configuration files included in http.conf files
\n#adf.conf
\n#----------
\n<Location \/myApplication>
\n SetHandler weblogic-handler
\n WebLogicCluster appserver.example.com:9001,appserver1.example.com:9003
\n WLProxySSLPassThrough ON
\n<\/Location><\/p>\n
\n<FilesMatch \".(jpg|jpeg|png|gif|swf)$\">
\n Header unset Surrogate-Control
\n Header unset Pragma
\n Header unset Cache-Control
\n Header unset Last-Modified
\n Header unset Expires
\n Header set Cache-Control \"max-age=86400, public\"
\n Header set Surrogate-Control \"max-age=86400\"
\n<\/FilesMatch><\/p>\n
\n#-------------
\n<Location \/reports>
\n SetHandler weblogic-handler
\n WebLogicCluster appserver.example.com:9004,appserver1.example.com:9004
\n DynamicServerList OFF
\n WLProxySSLPassThrough ON
\n<\/Location><\/code>
\nAfter configuring a ADF application and the Reports Server to be protected through the WebGate, the users can connect and work without any issue during the first 30 minutes.
\nThen they loose their sessions. We thought first it was related to the session timeouts or inactivity timeout.
\nWe increased the values of those timeouts without success.
\nWe checked the logs and found out that the issue was related to the OAM and WebGate cookies.<\/p>\n
\n Each WebGate gets and sets a cookie named OAMAuthnCookie_ + the host name and port.<\/p>\n
\n Authentication Level
\n IP Address
\n SessionID (Reference to Server side session \u2013 OAM11g Only)
\n Session Validity (Start Time, Refresh Time)
\n Session InActivity Timeouts (Global Inactivity, Max Inactivity)
\n Validation Hash<\/p>\n
\nThose cookies are secured and were lost because they were not forwarded by the WAF or the reverse proxy due to ending of the https. \t<\/p>\n
\nThis has been done adding two HTTP Headers to the request before sending them to the Oracle Access Manager or Fusion Middleware HTTP Server.<\/p>\n
\nRequestHeader set WL-Proxy-SSL true
\n# For the Oracle HTTP Server to take the secure cookies in account
\nRequestHeader set X-Forwarded-Proto “https”<\/p>\n