How to allow multiple login attributes in OAM/OAAM integrated environment

Requirement:

The requirement is to allow users to choose at login time from 2 different attributes from LDAP (e.g. uid and email address). 

Oracle solution:

Ref: How to allow multiple login attributes in OAM/OAAM integration using a custom TAP module (Doc ID 2190079.1)

For login user enters username and password on the OAAM page used when integrated with OAM (oaam_server/oamLoginPage.jsp).

Doing so, however, will imply that OAAM will have to keep two security profiles corresponding to each login attribute. When user is authenticated using a different attribute for the first time he will be seen as a new user (OAAM will create a new user record with login_id set to the new attribute value in the VCRYPT_USERS database table) so the registration process will take place again.

This will affect as well any pattern, behavior data which OAAM registers for that user (which will actually be seen by OAAM as 2 users now) so it's not recommended in case one wants to have highly accurate login and pattern data for each user.

Custom solution:

Since there is a limitation when OAAM is part of solution as mentioned in Oracle solution. Below custom solution will prevent creating duplicate OAAM security profiles for same user who login with either username or email address and no custom TAP modules need to be created in OAM.

By customizing OAAM login flow using OAAM extensions it can be achieved.

High level steps below.

1. Copy struts config file action mapping for /login.do from oaam_server.ear to OAAM extensions WAR file struts XML file.
2. Change the "/login.do" action mapping "success" redirect to custom action(Example: /validateUser.do)
3. Write an action class extending struts action with below logic.
1. Get user entered email address/username entered in OAAM login page screen from OAAM session.
2. Write custom logic(JNDI code) to get user login attribute(uid) from user store in custom action class
3. Update UIOSessionData instance with user login attribute(uid) retrieved from user store
4. Recreate VcryptAuthUser with login username(uid attribute retrieved from user store) if user has already OAAM security profile already created.
5. Send action forward to "/loginJump.do" to continue login process with username(uid attribute) even though user entered email address.
4. Build custom action class into a custom jar file and deploy in OAAM extensions war under /WEB-INF/lib folder

Thanks

Siva Pokuri.

Sample code of OAAM 11g API code to get user challenge questions

import com.bharosa.client.BharosaHelper;

import com.bharosa.client.BharosaSession;

import com.bharosa.client.enums.BharosaEnumAuthStatus;

import com.bharosa.client.enums.BharosaEnumChallengeResult;

import com.bharosa.vcrypt.auth.impl.VCryptAuthSOAPImpl;

import com.bharosa.vcrypt.auth.intf.VCryptAuthResult;

import com.bharosa.vcrypt.auth.intf.VCryptAuthUser;

import com.bharosa.vcrypt.auth.intf.VCryptLocalizedString;

import com.bharosa.vcrypt.auth.intf.VCryptQuestion;

import com.bharosa.vcrypt.common.util.VCryptResponse;

import com.bharosa.vcrypt.tracker.util.CookieSet;

import com.bharosa.vcryptclient.proxy.intf.BharosaProxy;

public class OAAMCQuestions {

/**

* @param args

*/

public static void main(String[] args) {

OAAMCQuestions ocqv =  new OAAMCQuestions();

ocqv.getUserChallengeQuestions();

}

public void getUserChallengeQuestions(){

String username = "spokuri";

try {

            VCryptAuthSOAPImpl auth = new VCryptAuthSOAPImpl();

            VCryptAuthUser user = new VCryptAuthUser();

            BharosaProxy proxy = BharosaProxyImpl.getInstance();

           

            String customerID = proxy.getUserByLoginId(username).getCustomerId();

           

            System.out.println("customerID " + customerID);

           

            user = proxy.getUser(customerID);

           

           

            user = proxy.getUserByLoginId(customerID);

           

            VCryptQuestion secretQuestion = proxy.moveToNextSecretQuestion(customerID);

           

            System.out.println("Secret Question " + secretQuestion);

           

            VCryptQuestion[] secretQuestion1 = proxy.getAllMappedSignOnQuestions(customerID);

           

            String q1 = secretQuestion1[0].toString();

            System.out.println("Question 1" + q1);

            String q2 = secretQuestion1[1].toString();

            System.out.println("Question 2" + q2);

            String q3 = secretQuestion1[2].toString();

            System.out.println("Question 3" + q3);

                       

           

        } catch (Exception e) {

            e.printStackTrace();

        }

       

         

    }

}

Sample OAAM 11g API code to reset security profile

Sample Code:

package com.pokuri.oaam;

import java.util.ArrayList;
import java.util.List;

import com.bharosa.vcrypt.auth.intf.*;
import com.bharosa.vcrypt.auth.util.VCryptAuthUtil;
import com.bharosa.vcrypt.common.util.VCryptResponse;
import com.bharosa.vcrypt.customercare.impl.VCryptCCImpl;
import com.bharosa.vcrypt.customercare.impl.VCryptCCSOAPImpl;
import com.bharosa.vcrypt.customercare.util.VCryptCCUtil;

import com.bharosa.vcryptclient.proxy.exception.BharosaProxyException;
import com.bharosa.vcryptclient.proxy.intf.BharosaProxy;

/**
 * @author siva pokuri
 *
 */
public class ChallengeQuestionsReset
{
public static void main(String[] args)
{
ChallengeQuestionsReset cu = new ChallengeQuestionsReset();
String response = "FAILED";
try
{
response = cu.resetUserProfile("spokuri", "Default");
System.out.println("Response " + response);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
System.out.println("RESPONSE " + response);
}
 
  public String resetUserProfile(String userName, String primaryGroupName)
{
   System.out.println("Creating user: " + userName);
            try{
 
   VCryptCCSOAPImpl vcc = new VCryptCCSOAPImpl();
   VCryptResponse vr = vcc.resetUser(userName);
 
   System.out.println("Message " +vr.getSuccess());
   System.out.println("Status code Message " +vr.getResponseCode());

return "SUCCESS";

  }
  catch (Exception e) {
// TODO: handle exception
}
return "FAILED";
}

}

-- Siva Pokuri.

TIPS: SQL query to search OAAM 11g User security questions registered in database

Query:

select question from v_user_questions where question_id in (select question_id from v_user_qa where user_id in (select user_id from vcrypt_users where login_id = 'spokuri') and answer != 'null');

-- Siva Pokuri.

TIPS: To turn off location prompt in OAAM Server login page

OAAM Location tracker screenshot:

Change below property value from "true" to "false" in OAAM Admin Console to stop that Location tracker prompt:

bharosa.uio.default.javascript.fingerprint.location.prompt.enabled=true

-- Siva Pokuri.

OAAM 11g API code to create & configure security questions for user

import java.util.ArrayList;

import java.util.List;

import com.bharosa.vcrypt.auth.intf.*;

import com.bharosa.vcrypt.auth.util.VCryptAuthUtil;

import com.bharosa.vcrypt.common.util.VCryptResponse;

import com.bharosa.vcryptclient.proxy.exception.BharosaProxyException;

import com.bharosa.vcryptclient.proxy.intf.BharosaProxy;

/**

 * @author pokuri

 *

 */

public class CreateUser {

private BharosaProxy proxy = null;

public static void main(String[] args)

{

CreateUser cu = new CreateUser();

String response = null;

try

{

response = cu.createUser("pressi", "Default");

//response = cu.checkQuestionsStatus("siva.pokuri");

} catch (Exception e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

System.out.println("RESPONSE " + response);

}

   

    public String checkQuestionsStatus(String userName)

    {

    VCryptAuthUser user = null;

    System.out.println("Checking user: " + userName);

    user = new VCryptAuthUser();

user.setLoginId(userName);

try {

System.out.println("Questions Status " + user.getRegistrationStatus());

} catch (Exception e) {

System.out.println("Exception " +e);

return "QA_STATUS_CHECK_FAILED";

}

return "CHECKED_QA_STATUS";

    }

   

public String createUser(String userName, String primaryGroupName)

{

proxy = BharosaProxySingleton.getProxyInstance();

// try to find the user record in OAAM

   VCryptAuthUser user = null;

   System.out.println("Creating user: " + userName);

   user = new VCryptAuthUser();

   

   try{

    user.setLoginId(userName.trim());

   }

   catch (Exception e) {

System.out.println("Exception " + e);

}

   user.setCustomerId(userName.trim());

   user.setCustomerGroupId(primaryGroupName.trim());

   try

   {

    user = proxy.createUser(user);

   }

catch (Exception e)

{

System.out.println("Exception " +e);

return "CREATE_USER_FAILED";

}

proxy.setUser(user);

int status = proxy.getUserStatus(userName.trim());

System.out.println("User Status  before Security Questions ---- >> " + status);

String questionId1 = "41";

String questionText1 = "Who was your childhood hero?";

String answer1 = "pilot1";

String questionId2 = "42";

String questionText2 = "What is the name of your favourite childhood teacher?";

String answer2 = "pilot2";

String questionId3 = "43";

String questionText3 = "What was your dream job as a child?";

String answer3 = "pilot";

     

VCryptQuestion question1 = new VCryptQuestion();

VCryptQuestion question2 = new VCryptQuestion();

VCryptQuestion question3 = new VCryptQuestion();

List<String> answerList = new ArrayList<String>();

List<String> answerList1 = new ArrayList<String>();

List<String> answerList2 = new ArrayList<String>();

question1.setQuestionId(new Long(questionId1.trim()));

question1.setQuestion(questionText1.trim());

answerList.add(answer1.trim());

question1.setAnswerList(answerList);

question2.setQuestionId(new Long(questionId2.trim()));

question2.setQuestion(questionText2.trim());

answerList1.add(answer2.trim());

question2.setAnswerList(answerList1);

     

question3.setQuestionId(new Long(questionId3.trim()));

question3.setQuestion(questionText3.trim());

answerList2.add(answer3.trim());

question3.setAnswerList(answerList2);

     

try

{

VCryptAuth auth = VCryptAuthUtil.getVCryptAuthInstance();

VCryptAuth auth1 = VCryptAuthUtil.getVCryptAuthInstance();

VCryptAuth auth2 = VCryptAuthUtil.getVCryptAuthInstance();

VCryptResponse vr = null;

VCryptResponse vr1 = null;

VCryptResponse vr2 = null;

vr = auth.addQuestion(userName.trim(), question1);

vr1 = auth1.addQuestion(userName.trim(), question2);

vr2 = auth2.addQuestion(userName.trim(), question3);

System.out.println("Response Code " + vr.getResponseCode());

System.out.println("Response Code " + vr1.getResponseCode());

System.out.println("Response Code " + vr2.getResponseCode());

System.out.println("Successfully Created User & configured Sequrity questions");

proxy.setUserStatus(userName.trim(), 2);

System.out.println("User "+userName+" Status -->>"+proxy.getUserStatus(userName.trim()));

}

catch (Exception e)

{

System.out.println("Create user failed!!!! " + e);

}

return "CREATE_USER_SUCCESS";

}

}

-- Siva Pokuri