In this video, I'll demonstrate Adding Identity Provider Self-Signed Certificates to Oracle
Private Cloud Appliance.
This video is part of a series of videos on Federating with Identity Providers.
Other videos in this series include, Federating with an Identity Provider, which you should
view first, and a video titled Adding Oracle Private Cloud Appliance as a Trusted Relying
Party.
Please view this video as necessary when setting up a trust for your environment.
The Oracle Private Cloud Appliance Certificate Authority, or CA, is a self-signed OpenSSL
generated root and intermediate x.509 certificate.
This CA certificate is used to issue x.509 server/client certificates, enabling you to
add outside CA trust information to the Oracle Private Cloud Appliance rack.
If you use a self-signed certificate for Active Directory Federation Service, or ADFS, you
will need to add outside CA trust information from ADFS to the management nodes on the rack.
You can skip this step if your ADFS certificate is signed by a known certificate authority.
ADFS certificates that are signed by a known certificate authority should already exist
in the Oracle Private Cloud Appliance certificate bundle.
However, in my demonstration environment, both the Identity Provider's "signing certificate"
and the "certificate chain" of the web server that hosts Identity Provider's metadata needs
to be added to the CA outside bundle on all Oracle Private Cloud Appliance management
nodes.
To demonstrate this, I first need to download SAML metadata document.
The default location of the SAML metadata document for your ADFS is shown.
I'll enter the URL in a browser to download this FederationMetadata.xml file and I'll
save it to my Downloads folder on my Windows laptop.
You'll also need this file when you create the identity provider in Oracle Private Cloud
Appliance, but I will demonstrate that in another video.
I'm going to open this XML file with Notepad on my Windows laptop.
I'll locate the signing certificate within the XML file by searching for "signing".
Now I'm going to highlight and copy the certificate which is located between
beginning and ending tags.
I'm now showing that I'm logged on to management node 1 in the Oracle Private Cloud Appliance.
On management node 1, I'm going to make the directory /etc/pca3.0/vault/customer_ca and
cd into this directory.
Next I'm going to use vi to create a file named idp_cert.pem, although you can name
this file anything you want as long as you have a .pem extension.
I'm going to paste the signing certificate that I copied from the XML file.
I need to insert a line above the certificate and enter the BEGIN CERTIFICATE notation.
I'll also add a comment at the beginning of the file although this is not necessary.
And finally I need to insert a line below the certificate and enter the END CERTIFICATE
notation and save the file.
Now that I've saved the "signing certificate" into a file, I need to get the Identity Provider
web server's "certificate chain" and save it to a file.
I'll return to the FederationMetadata.xml file that I had opened using Notepad.
I can find the Single Sign On base URL within the XML file by searching for the Location
attribute.
I'll copy the URL and paste into a browser.
It appears as if an error occurred but I can click on the lock icon, then click Connection
secure.
Next I'll click More information and with the Security tab selected, I can click View
Certificate.
I'll scroll down and under Miscellaneous, I have to option to download the PEM chain.
I'll click the link and save the file and call it chain.pem
I'll open the file and select all and copy.
Returning to my Oracle Private Cloud Appliance management node terminal, I ensure that I'm
in the /etc/pca3.0/vault/customer_ca directory.
I'll use vi to create a file named idp_web_cert.pem, although you can name this file anything you
want as long as you have a pem extension.
I'll paste the certificate chain.
I'll add a comment at the beginning of the file although this is not necessary and I'll
save the file.
Now on management node 1, run the command shown, to have the certificates added to the
outside bundle.
Finally, one optional test that you can do is to check the "/etc/pca3.0/vault/certs/ca_outside_bundle.crt"
file on each management node and confirm that the signing certificate and the certificate
chain have been properly appended to that file.
I'll view the file on management node 1 and I can see that my comments are included which
ensures my files were properly appended.
This concludes this demonstration.
Thank you for watching.
Please check our additional information on Oracle Private Cloud Appliance in the Oracle
Private Cloud Appliance Documentation or in the Oracle Private Cloud Appliance Learning
Library.