Configure an Oracle Policy Store

Installation and Upgrade Guides › Policy Server Installation Guide › Configuring CA SiteMinder® Data Stores in a Relational Database › Configure an Oracle Policy Store

Configure an Oracle Policy Store

A single Oracle database can function as a:

policy store
key store
logging database

Using a single database simplifies administrative tasks. The following sections provide instruction on how to configure a single database server to store CA SiteMinder® data.

You can configure an Oracle policy store manually or use the Policy Server installer to configure the policy store automatically.

Prerequisites for an Oracle 10g Database

After installing the Oracle 10g database, complete the following prerequisites:

Create a table space for the policy store.
Create a user with appropriate privileges to manage this table space in the database.

Create an Oracle 10g Table Space for the Policy Store

Creating a table space for the policy store is a prerequisite for an Oracle 10g database only.

Follow these steps:

In the Oracle Enterprise Manager 10g Database Control, log in as the SYSDBA user with appropriate privileges to manage the Oracle database.
On the Oracle global database’s configuration screen, select Administration, Tablespaces.
On the Tablespaces screen, click Create.
On the Create Tablespaces screen, enter a table space name, and click ADD.
Example: NETE_TB
On the Create Tablespaces: Add Datafile screen:
1. Enter a file name.
  Example: NETE_TB
2. Specify the file size.
  Example: 100 MB
3. Click Continue.
Oracle creates the table space and displays it on the Tablespaces screen.

Complete the prerequisites by creating a user to manage the table space for the policy store.

More Information:

Create an Oracle 10g User to Manage the Policy Store’s Table Space

Creating a user to manage table space for the policy store is a prerequisite for an Oracle 10g database only.

Follow these steps:

On the Oracle global database’s configuration screen, select Administration, Users.
On the Create Tablespaces screen, click Create.
On the Create User screen, enter the:
- Name for the user.
  Example: NETE
- Password for the user.
- Default Tablespace that you created.
- Temporary tablespace.
  Example: TEMP
Click Roles.
Select Modify.
On the Modify Roles screen:
1. Select CONNECT and RESOURCE as a roles for this user.
2. Click Apply.
Start sqlplus in a command window, by entering:
1. sqlplus
2. the credentials for the policy store user created on the Create User screen.
You have completed the prerequisites for an Oracle 10g database, and can now configure a CA SiteMinder® data store for the database.

Gather Database Information

Configuring a single Oracle database to function as a policy store or any other type of CA SiteMinder® data store requires specific database information.

Information prefixed with (U) indicates that the information is only required if the Policy Server is installed on a UNIX system. This information is required when configuring Oracle data source for UNIX.

Required Information

Gather the following required information before configuring a supported Oracle or Oracle RAC database as a policy store or any other type of CA SiteMinder® data store:

(U) Policy Server installation path—Identify the explicit path to where the Policy Server is installed.
Data source—Determine the name you will use to identify the Oracle data source.
Example: SM Oracle Server Wire DS.
Database administrative account—Determine the user name of an account with privileges to create, read, modify, and delete objects in the database.
Note: Ensure the administrative account does not have the DB role. Audit-based reports will not return correct results if the administrative account has the DB role.
Database administrative Password—Determine the password for the Administrative account.

Oracle Database Information

Gather the following information only if you are configuring a supported Oracle database as a policy store or any other type of CA SiteMinder® data store:

Oracle machine name—Determine the name of the machine on which the Oracle database is installed.
Oracle instance service name—Determine the service name of the database instance to which you will connect. The tnsnames.ora file specifies service names.
Oracle port number—Determine the port number on which the Oracle database is listening.

Oracle RAC Database (without SCAN) Information

Gather the following information if you are configuring a supported Oracle RAC database (without SCAN functionality configured) as a policy store or any other CA SiteMinder® data store:

Oracle RAC system service name—Determine the service name for the entire system.

Example: In the following tnsnames.ora file, SMDB is the service name for the entire system:

SMDB=
(Description =
(ADDRESS = PROTOCOL = TCP)(HOST = nete_servername1)(PORT=1521
(ADDRESS = PROTOCOL = TCP)(HOST = nete_servername2)(PORT=1521)
(ADDRESS = PROTOCOL = TCP)(HOST = nete_servername3)(PORT=1521))
(LOAD_BALANCE = yes)
(CONNECT_DATA=
(SERVER = DEDICATED)
(SERVER_NAME = SMDB))
)

Oracle RAC node service names—Determine the service names for each node in the system.
Oracle RAC node IP addresses—Determine the IP Address of each node in the Oracle RAC system.
Note: If you are using Oracle RAC 10g, determine the virtual IP address of each node in the system.
Oracle RAC node port numbers—Determine the port number for each node in the Oracle RAC system.

How to Configure the Policy Store

To configure a single Oracle database as a policy store, key store, and logging database, complete the following procedures:

Note: Be sure that you have gathered the required database information before beginning. Some of the following procedures require this information.

Be sure that the Oracle database instance that is to contain the CA SiteMinder® data is accessible from the Policy Server system. Test the communication using tnsping or sqlplus.
Create the CA SiteMinder® Schema.
Configure an Oracle data source for CA SiteMinder®:
- (Windows) Create an Oracle data source on Windows systems.
- (Windows) Create an Oracle RAC data source on Windows systems.
- (UNIX) Create an Oracle data source on UNIX.
- (UNIX) Configure the wire protocol driver.
- (UNIX) Configure the Oracle wire protocol driver.
- (UNIX) Configure the Oracle RAC wire protocol driver.
Point the Policy Server to the database.
Set the CA SiteMinder® superuser password.
Import the policy store data definitions.
Import the default policy store objects.
Restart the Policy Server.
Prepare for the Administrative UI registration.

Create the CA SiteMinder® Schema

You create the CA SiteMinder® schema so a single Oracle database can store policy, key, and audit logging information.

Follow these steps:

Log in to Oracle with sqlplus or some other Oracle utility as the user who administers the Policy Server database information.
Note: We recommend that you do not create the CA SiteMinder® schema with the SYS or SYSTEM users. If necessary, create an Oracle user, such as SMOWNER, and create the schema with that user.
Import the following script:
```
$NETE_PS_ROOT/db/sql/sm_oracle_ps.sql
```
Note: Environment variables may not function in the SQL utility of Oracle. If you experience problems importing the script using the utility, specify an explicit path.

The policy store and key store schema is added to the database.
Import the following script
```
$NETE_PS_ROOT/xps/db/Oracle.sql
```
The policy store schema is extended.
Import the following script to use the policy store as an audit logging database:
```
sm_oracle_logs.sql.
```
Note: You are not required to configure the policy store to store additional CA SiteMinder® data. You can configure individual databases to function as a separate audit log database, key store, and session store.

The database can store CA SiteMinder® data.

Configure an Oracle Data Source for CA SiteMinder®

If you are using ODBC, you need to configure a data source for the Oracle wire protocol driver.

Create an Oracle Data Source on Windows

Create an ODBC data source for an Oracle database.

Follow these steps:

Do one of the following:
- If you are using a supported 32–bit Windows operating system, click Start and select Programs, Administrative Tools, ODBC Data Sources.
- If you are using a supported 64–bit Windows operating system:
  1. Navigate to the install_home\Windows\SysWOW64.
  2. Double–click odbcad32.exe
The ODBC Data Source Administrator appears.
Click the System DSN tab, and then click Add.
The Create New Data Source dialog appears
Select CA SiteMinder® Oracle Wire Protocol, and click Finish.
The ODBC Oracle Wire Protocol Driver Setup dialog appears. The General tab is pulled to the front.
Enter a name that identifies the data source in the Data Source Name field.
Note: Record this name. You will need the data source name when pointing the Policy Server to the database.
Enter the machine name where the Oracle database is installed in the Host Name field.
Enter the port number where the Oracle database is listening on the machine in the Port Number field.
Enter the name of the Oracle instance to which you want to connect in the SID field.
Note: The service name is specified in the tnsnames.ora file. The SID is the system identifier for the database instance. The tnsnames.ora file contains service names and details that Oracle uses to identify and connect to Oracle instances.

Example: if the tnsnames.ora file contains the following entry for an Oracle instance, you enter instance1 in the SID field:
```
instance1 =
```
```
(Description=
(Address = (PROTOCOL = TCP)(Host = myhost)(Port=1521))
(Connect_DATA_ = (SID = SIDofinstance1))
)
```
Click Test Connection.
The connection settings are tested and a prompt appears specifying that the connection is successful.
Click OK.
The Oracle data source is configured for the wire protocol driver.

Create an Oracle RAC (no SCAN) Data Source on Windows

Create an ODBC data source for an Oracle RAC database that does not use the SCAN feature.

Follow these steps:

Do one of the following:
- If you are using a supported 32–bit Windows operating system, click Start and select Programs, Administrative Tools, ODBC Data Sources.
- If you are using a supported 64–bit Windows operating system:
  1. Navigate to the C:\Windows\SysWOW64.
  2. Double–click odbcad32.exe
The ODBC Data Source Administrator appears.
Click the System DSN tab, and then click Add.
The Create New Data Source dialog appears.
Select CA SiteMinder® Oracle Wire Protocol, and click Finish.
The ODBC Oracle Wire Protocol Driver Setup dialog appears. The General tab is pulled to the front.
Enter a name that identifies the data source in the Data Source Name field.
Note: Record this name. You will need the data source name when pointing the Policy Server to the database.
Enter the IP Address of the first node in the Oracle RAC system in the Host field.
Oracle RAC 10g: Enter the virtual IP Address.

Enter the service name for the entire Oracle RAC system in the Service Name field.

Example: In the following tnsnames.ora file, the SMDB value is the service name for the entire Oracle RAC system, which contains 3 nodes:

SMDB=

(Description =

(ADDRESS = (Protocol = TCP)(HOST = nete_servername1)(PORT = 1521))
(ADDRESS = (Protocol = TCP)(HOST = nete_servername2)(PORT = 1521))
(ADDRESS = (Protocol = TCP)(HOST = nete_servername3)(PORT = 1521))
(LOAD_BALANCE = yes)
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = SMDB)
)

Click the Failover tab.
Failover settings appear.
Specify the host name or virtual IP Address, port number, and service name for the remaining Oracle RAC nodes in the environment in the Alternate Servers field.
Note: The ServiceName is the service name for the entire Oracle RAC system.
Specify the AlternateServers to provide connection failover to the other Oracle nodes if the primary server is not accepting connections. The entry should have the following format:
(HostName=nete_servername2:PortNumber=1521:ServiceName=nete_servicename[,...])
Select LoadBalancing.
Click OK
The Oracle RAC data source is configured for the wire protocol driver.

Create an Oracle Data Source on UNIX Systems

You configure the names of available ODBC data sources and the attributes that are associated with these data sources in the system_odbc.ini file.

To create the system_odbc.ini file:

Navigate to policy_server_installation/db
Rename oraclewire.ini to "system_odbc.ini".

Customize the system_odbc.ini file for each site. You can also add more data sources to this file, such as defining extra ODBC user directories for CA SiteMinder®.

The first section of the system_odbc.ini file, [ODBC Data Sources], contains a list of all of the currently available data sources. The name before the “=” refers to a subsequent section of the file describing each individual data source. After the “=” is a comment field.

Note: If you modify of the first line of the data source entry ([CA SiteMinder® Data Source]), take note of the change. This value is required to configure your ODBC database as a policy store.

Each data source has a section in the system_odbc.ini file describing its attributes. The first attribute is the ODBC driver to be loaded when CA SiteMinder® uses this data source. The remaining attributes are specific to the driver.

To add an Oracle Data source:

Define a new data source name in the [ODBC Data Sources] section of the file.
Add a section that describes the data source using the same name as the data source.

To create a service name or use a different driver, edit the system_odbc.ini file. Entries for the SQL Server or Oracle drivers belong under [CA SiteMinder® Data Source].

Configure the Oracle Wire Protocol Driver

You configure the wire protocol driver to specify the settings CA SiteMinder® uses to connect to the database.

Note: This procedure only applies if the Policy Server is installed on a UNIX system. If you have not already done so, copy one of the following files and rename it system_odbc.ini. The file you rename depends on the database vendor you are configuring as a CA SiteMinder® data store.

sqlserverwire.ini
oraclewire.ini
mysqlwire.ini
postgresqlwire.ini

These files are located in siteminder_home/db

The system_odbc.ini file contains the following sections. The data source that you are configuring determine the section or sections that you edit:

[SiteMinder Data Source]: Specifies the settings CA SiteMinder® is to use to connect to the database functioning as the policy store.
[SiteMinder Logs Data Source]: Specifies the settings CA SiteMinder® is to use to connect to the database functioning as the audit log database.
[SiteMinder Keys Data Source]: Specifies the settings CA SiteMinder® is to connect to the database functioning as the key store.
[SiteMinder Session Data Source]: Specifies the settings CA SiteMinder® is to connect to the database functioning as the session store.
[SmSampleUsers Data Source]: Specifies the settings CA SiteMinder® is to connect to the database functioning as the sample user data store.

Follow these steps:

Open the system_odbc.ini file.
Depending on the data source you are configuring, edit the applicable data source sections with the following information:
```
Driver=nete_ps_root/odbc/lib/NSora27.so
Description=DataDirect 7.1 Oracle Wire Protocol
LoginID=uid
Password=pwd
HostName=nete_servername
PortNumber=1521
SID=nete_serverid
CatalogOptions=0
ProcedureResults=0
EnableDisableParam=0
EnableStaticCursorsForLongData=0
ApplicationUsingThreads=1
```
Note: When editing data source information, do not use the pound sign (#). Entering a pound sign comments the information, which truncates the value. The truncated value may cause ODBC connections to fail.
nete_ps_root

Specifies the explicit path of the Policy Server installation.

uid

Specifies the user name of the database account that has full access rights to the database.

pwd

Specifies the password for the database account that has full access rights to the database.

nete_servername

Specifies the name of the Oracle database host system.

nete_serverid
Specifies the Oracle instance service name (SID). The SID is the system identifier for the database instance.

Example: In the following sample tnsnames.ora file, the value instance1 is the SID.
```
instance1 =
```
```
(Description =
```
```
(ADDRESS = (Protocol = TCP)(Host = myhost)(Port = 1521)
```
```
(CONNECT_DATA = (SID = instance1))
```
```
)
```
Save the file.
The Oracle wire protocol driver is configured.

Configure the Oracle Wire Protocol Driver for Oracle RAC without SCAN

You configure the wire protocol driver to specify the settings CA SiteMinder® uses to connect to the database.

sqlserverwire.ini
oraclewire.ini
mysqlwire.ini
postgresqlwire.ini

These files are located in siteminder_home/db

The system_odbc.ini file contains the following sections. The data source that you are configuring determine the section or sections that you edit:

[SiteMinder Data Source]: Specifies the settings CA SiteMinder® is to use to connect to the database functioning as the policy store.
[SiteMinder Logs Data Source]: Specifies the settings CA SiteMinder® is to use to connect to the database functioning as the audit log database.
[SiteMinder Keys Data Source]: Specifies the settings CA SiteMinder® is to connect to the database functioning as the key store.
[SiteMinder Session Data Source]: Specifies the settings CA SiteMinder® is to connect to the database functioning as the session store.
[SmSampleUsers Data Source]: Specifies the settings CA SiteMinder® is to connect to the database functioning as the sample user data store.

Follow these steps:

Open the system_odbc.ini file.
Depending on the data source you are configuring, edit the applicable data source sections with the following information:
- Add ServiceName=nete_servicename
- Add AlternateServers=
- Add Loadbalancing=1
- Remove or comment SID=nete_serverid
The modified text for the data source should appear as follows:
```
Driver=nete_ps_root/odbc/lib/NSora27.so
Description=DataDirect 7.1 Oracle Wire Protocol
Logon=uid
Password=pwd
HostName=nete_servername1
PortNumber=1521
ServiceName=nete_servicename
CatalogOptions=0
ProcedureRetResults=0
EnableDescribeParam=0
EnableStaticCursorsForLongData=0
ApplicationUsingThreads=1
AlternateServers=
LoadBalancing=1
```
Note: When editing data source information, do not use the pound sign (#). Entering a pound sign comments the information, which truncates the value. The truncated value may cause ODBC connections to fail.

nete_ps_root

Specifies an explicit path to the directory where Policy Server is installed.

uid

Specifies the user name of the database account that has full access rights to the database.

pwd

Specifies the password for the database account that has full access rights to the database.

nete_servername1

Specifies the IP Address of the first Oracle RAC node.

(Oracle 10g) Specifies the virtual IP Address of the first Oracle RAC node.

nete_servicename

Specifies the Oracle RAC system service name for the entire RAC system.

AlternateServers=

If the primary server is not accepting connections, specifies the connection failover to the other Oracle nodes.

Example: (HostName=nete_servername2:PortNumber=1521:ServiceName=nete_servicename[,...])

LoadBalancing=1

Turns on client load balancing, which helps to distribute new connections to keep RAC nodes from being overwhelmed with connection requests. When enabled, the order in which primary and alternate database servers are accessed is random.
Save the file.
The Oracle wire protocol driver is configured.

Point the Policy Server to the Database

You point the Policy Server to the database so the Policy Server can access the CA SiteMinder® data in the policy store.

Follow these steps:

Open the Policy Server Management Console and click the Data tab.
Select the following value from the Storage list:
```
ODBC
```
Select the following value from the Database list:
```
Policy Store
```
Enter the name of the data source in the Data Source Information field.
- (Windows) The entry must match the name that you entered in the Data Source Name field when you created the data source.
- (UNIX) The entry must match the first line of the data source entry in the system_odbc.ini file. By default, the first line in the file is [CA SiteMinder® Data Sources]. If you modified the first entry, be sure to enter the correct value.
Enter and confirm the user name and password of the database account that has full access rights to the database instance in the respective fields.
Specify the maximum number of database connections that are allocated to CA SiteMinder®.
Note: We recommend retaining the 25 connection default for best performance.
Click Apply to save the settings.
Select the following value from the Database list:
```
Key Store
```
Select the following value from the Storage list:
```
ODBC
```
Select the following option:
```
Use the Policy Store database
```
Select the following value from the Database list:
```
Audit Logs
```
Select the following value from the Storage list:
```
ODBC
```
Select the following option:
```
Use the Policy Store database
```
Click Apply to save the settings.
(Optional) Click Test Connection to verify that the Policy Server can access the policy store.
Click OK.
The Policy Server is configured to use the database as a policy store, key store, and logging database.

Set the CA SiteMinder® Super User Password

The default CA SiteMinder® administrator account is named:

siteminder

The account has maximum permissions.

We recommend that you do not use the default superuser for day–to–day operations. Use the default superuser to:

Access the Administrative UI for the first–time.
Manage CA SiteMinder® utilities for the first–time.
Create another administrator with superuser permissions.

Follow these steps:

Copy the smreg utility to siteminder_home\bin.

siteminder_home

Specifies the Policy Server installation path.

Note: The utility is at the top level of the Policy Server installation kit.
Run the following command:
```
smreg -su password
```
password

Specifies the password for the default CA SiteMinder® administrator.

Limits:
- The password must contain at least six (6) characters and cannot exceed 24 characters.
- The password cannot include an ampersand (&) or an asterisk (*).
- If the password contains a space, enclose the passphrase with quotation marks.
Note: If you are configuring an Oracle policy store, the password is case–sensitive. The password is not case–sensitive for all other policy stores.
Delete smreg from siteminder_home\bin. Deleting smreg prevents someone from changing the password without knowing the previous one.
The password for the default CA SiteMinder® administrator account is set.

Import the Policy Store Data Definitions

Importing the policy store data definitions defines the types of objects that can be created and stored in the policy store.

Follow these steps:

Open a command window and navigate to siteminder_home\xps\dd.

siteminder_home

Specifies the Policy Server installation path.
Run the following command:
```
XPSDDInstall SmMaster.xdd
```
XPSDDInstall

Imports the required data definitions.

Import the Default Policy Store Objects

Importing the default policy store objects configures the policy store for use with the Administrative UI and the Policy Server.

Consider the following items:

Be sure that you have write access to siteminder_home\bin. The import utility requires this permission to import the policy store objects.

siteminder_home

Specifies the Policy Server installation path.
Before running a CA SiteMinder® utility or executable on Windows Server 2008, open the command-line window with administrator permissions. Open the command-line window this way, even if your account has administrator privileges. For more information, see the release notes for your CA SiteMinder® component.

Follow these steps:

Open a command window and navigate to siteminder_home\db.
Import one of the following files:
- To import smpolicy.xml, run the following command:
```
XPSImport smpolicy.xml -npass
```
- To import smpolicy–secure.xml, run the following command:
```
XPSImport smpolicy-secure.xml -npass
```
  npass
  
  Specifies that no passphrase is required. The default policy store objects do not contain encrypted data.
  
  Both files include the default policy store objects. These objects include the default security settings in the default Agent Configuration Object (ACO) templates. The smpolicy–secure file provides more restrictive security settings. For more information, see Default Policy Store Objects Consideration.
- To import Option Pack functionality, run the following command:
```
XPSImport ampolicy.xml -npass
```
- To import federation functionality, run the following command:
```
XPSImport fedpolicy-12.51.xml -npass
```
The policy store objects are imported.

Note: Importing smpolicy.xml makes available legacy federation and Web Service Variables functionality that is separately licensed from CA SiteMinder®. If you intend on using the latter functionality, contact your CA account representative for licensing information.

Restart the Policy Server

You restart the Policy Server for certain settings to take effect.

Follow these steps:

Open the Policy Server Management Console.
Click the Status tab, and click Stop in the Policy Server group box.
The Policy Server stops as indicated by the red stoplight.
Click Start.
The Policy Server starts as indicated by the green stoplight.

Note: On UNIX or Linux operating environments, you can also execute the stop-all command followed by the start-all command to restart the Policy Server. These commands provide an alternative to the Policy Server Management Console.

Prepare for the Administrative UI Registration

You use the default CA SiteMinder® super user account (siteminder) to log into the Administrative UI for the first–time. The initial login requires that you to register the Administrative UI with a Policy Server, which creates a trusted relationship between both components.

You prepare for the registration by using the XPSRegClient utility to supply the super user account name and password. The Policy Server uses these credentials to verify that the registration request is valid and that the trusted relationship can be established.

Consider the following items:

The time from which you supply the credentials to when the initial Administrative UI login occurs is limited to 24 hours. If you do not plan on installing the Administrative UI within one day, complete the following steps before installing the Administrative UI.
(UNIX) Be sure that the CA SiteMinder® environment variables are set before you use XPSRegClient. If the environment variables are not set, set them manually.

Follow these steps:

Log in to the Policy Server host system.
Run the following command:
```
XPSRegClient siteminder[:passphrase] -adminui-setup -t timeout -r retries -c comment -cp -l log_path -e error_path -vT -vI -vW -vE -vF
```
passphrase

Specifies the password for the default CA SiteMinder® super user account (siteminder).

Note: If you do not specify the passphrase, XPSRegClient prompts you to enter and confirm one.

-adminui–setup

Specifies that the Administrative UI is being registered with a Policy Server for the first–time.

-t timeout

(Optional) Specifies the allotted time from when you to install the Administrative UI to the time you log in and create a trusted relationship with a Policy Server. The Policy Server denies the registration request when the timeout value is exceeded.

Unit of measurement: minutes

Default: 240 (4 hours)

Minimum Limit: 15

Maximum Limit: 1440 (24 hours)

-r retries

(Optional) Specifies how many failed attempts are allowed when you are registering the Administrative UI. A failed attempt can result from submitting incorrect CA SiteMinder® administrator credentials when logging in to the Administrative UI for the first time.

Default: 1

Maximum Limit: 5

-c comment

(Optional) Inserts the specified comments into the registration log file for informational purposes.

Note: Surround comments with quotes.

-cp

(Optional) Specifies that registration log file can contain multiple lines of comments. The utility prompts for multiple lines of comments and inserts the specified comments into the registration log file for informational purposes.

Note: Surround comments with quotes.

-l log path

(Optional) Specifies where the registration log file must be exported.

Default: siteminder_home\log

siteminder_home

Specifies the Policy Server installation path.

-e error_path

(Optional) Sends exceptions to the specified path.

Default: stderr

-vT

(Optional) Sets the verbosity level to TRACE.

-vI

(Optional) Sets the verbosity level to INFO.

-vW

(Optional) Sets the verbosity level to WARNING.

-vE

(Optional) Sets the verbosity level to ERROR.

-vF

(Optional) Sets the verbosity level to FATAL.
Press Enter.
XPSRegClient supplies the Policy Server with the administrator credentials. The Policy Server uses these credentials to verify the registration request when you log in to the Administrative UI for the first–time.