One with Apex Application

Final stage of long history is there. I love Oracle APEX, it's my first choice for POC applications, SOA composite facades or for old-fashioned application simulation.  Of course there is a lot of options for applet deployments, from J2EE servers to palin HTML pages on web serer.

1. Create new application and add blank page. So our new secured application will have 2 pages.
   
   
   
2. Open new page for edit and add new HTML Text region. 
3. Open click on new region for change parameters.
   
   
   
4. Put text below into Region Source field
   
   
   <applet codebase="https://apps.vb.mmikhail.com:445/" archive="simpleapplet.jar" code="com.mmikhail.oldsystems.SimpleApplet"  height="200" width="500" align="middle">This browser does not support Applets.</applet>
5. Save changes and run page. Enter your application credentials on login page
   
   
   
6. As soon as you click "Login" button you will see warning message
   
   
   

   ---

   This warning is about OCSP responder information:
   
   security: Obtain certificate collection in SSL Root CA certificate store
   security: Failing over to CRLs: Certificate does not specify OCSP responder
   security: Revocation Status Unknown
   You may never see it if your certificates contain OCSP responder info. However you have another option: Switch certificate and TLS check to CRL only in Java Advanced Configuration.
   

   ---

   
   
7. Next message is informational and let you know about Application. Publisher and allowed locations from our manifest header.
   
   

   
   
   

Click run and you will see apple code on Apex 10g page.

No more poodles! Part II

On previous post I've left you right after Apache HTTP 2.4 installation. We have few steps to complete.

Configure Apache 2.4 

Apache 2.4 has different set of packages and it’s not compatible with some old modules (i.e. mod_perl). Even if we will not use old system configuration it's a good time to make system backup (or take system snapshot).  As minimum make copy of /etc/httpd directory

#tar zcvf etc-httpd.tgz /etc/httpd
#tar zcvf etc-initd.tgz /etc/init.d

Now we should point system to new Apache HTTP server inaries.

Open for edit file /etc/init.d/httpd. Point httpd and apachectl variables to the new binaries as below

apachectl=/usr/local/apache2/bin/apachectl
httpd=/usr/local/apache2/bin/httpd

Save changes.  Now change configuration files to enable necessary modules.

In the file /usr/local/apache2/conf/httpd.conf:

Uncomment 

Line         Text

85  LoadModule cache_module modules/mod_cache.so
88  LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
114 LoadModule proxy_module modules/mod_proxy.so
117 LoadModule proxy_http_module modules/mod_proxy_http.so
128 LoadModule ssl_module modules/mod_ssl.so
147 LoadModule rewrite_module modules/mod_rewrite.so
480 Include conf/extra/httpd-ssl.conf

Modify logs path

265 ErrorLog "/var/log/httpd/error_log"
294 CustomLog "/var/log/httpd/access_log" common

Append to the end (there is should be your configuration file)

480 Include conf/apex/apex.conf

For SSL configuration I prefer to keep all global parameters in standard file and separate virtual host definitions.
In sake of document size I have removed all standard comments from default httpd-ssl.conf and kept essentials.

File  /usr/local/apache2/conf/extra/http-ssl.conf:

<IfModule ssl_module> 
   Listen 443 
   SSLCipherSuite HIGH:MEDIUM 
   SSLProtocol All -SSLv2 -SSLv3 
   SSLPassPhraseDialog  builtin 

   SSLSessionCache        "shmcb:/usr/local/apache2/logs/ssl_scache(512000)" 
   SSLSessionCacheTimeout  300 

   SSLCertificateFile "/etc/httpd/conf/server-cert.pem" 
   SSLCertificateKeyFile "/etc/httpd/conf/server-key.pem" 

   <FilesMatch "\.(cgi|shtml|phtml|php)$">SSLOptions +StdEnvVars</FilesMatch> 
   <Directory "/usr/local/apache2/cgi-bin">SSLOptions +StdEnvVars</Directory> 

   BrowserMatch "MSIE [2-5]" \
                 nokeepalive ssl-unclean-shutdown \
                 downgrade-1.0 force-response-1.0 
    CustomLog "/usr/local/apache2/logs/ssl_request_log" \ 
</IfModule>

Configure reverse proxy for Oracle Apex.

We are on the final stage and ready to seal our system with high-end SSL protection. Let’s create a
separate configuration file for our apex application:

#mkdir /usr/local/apache2/conf/apex
#vi /usr/local/apache2/conf/apex/apex.conf

Now create new content for configuration as below:

<VirtualHost *:80>
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
  Redirect permanent / https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

<IfModule ssl_module>
 <VirtualHost *:443>
   SSLEngine on 
   DocumentRoot "/usr/local/apache2/htdocs" 
   ServerName <yor.server.name.com> 
   ServerAdmin <yormail@server.name.com> 
   ErrorLog /var/log/httpd/apex-error_log 
   CustomLog /var/log/httpd/apex-access_log common 
   
   RewriteEngine On 
   RewriteRule ^/$ /apex/f?p=4500:1000 [R=301]
   ProxyRequests On 
   <Proxy *> 
     Order allow,deny 
     Allow from all

   </Proxy>

   ProxyPass / http://localhost:8080/
   ProxyPassReverse / http://localhost:8080/
  </VirtualHost>
</IfModule>


Save the results and try to start httpd server.

# service httpd start
Starting httpd:                                            [  OK  ]

Let’s check system status:

# /usr/local/apache2/bin/apachectl status

               Apache Server Status for localhost (via 127.0.0.1)
   Server Version: Apache/2.4.10 (Unix) OpenSSL/1.0.1k
   Server MPM: event
   Server Built: Jan 18 2015 19:49:52
   ---------------------------------------------------------------------------
   Current Time: Tuesday, 20-Jan-2015 10:00:28 EST
   Restart Time: Tuesday, 20-Jan-2015 09:07:43 EST
   Parent Server Config. Generation: 1
   Parent Server MPM Generation: 0
   Server uptime: 52 minutes 44 seconds
   Server load: 0.00 0.00 0.00
   Total accesses: 0 - Total Traffic: 0 kB
   CPU Usage: u0 s0 cu0 cs0
   0 requests/sec - 0 B/second -
   1 requests currently being processed, 74 idle workers
   +---------------------------------------------------------------------------+
   |       |    Connections    |   Threads   |        Async connections        |
   |  PID  |-------------------+-------------+---------------------------------|
   |       | total | accepting | busy | idle | writing | keep-alive | closing ||
   |-------+-------+-----------+------+------+---------+------------+---------||
   |15639  |0      |yes        |0     |25    |0        |0           |0        ||
   |-------+-------+-----------+------+------+---------+------------+---------||
   |15641  |0      |yes        |0     |25    |0        |0           |0        ||
   |-------+-------+-----------+------+------+---------+------------+---------||
   |15643  |0      |yes        |1     |24    |0        |0           |0        ||
   |-------+-------+-----------+------+------+---------+------------+---------||
   |Sum    |0      |           |1     |74    |0        |0           |0        ||
   +---------------------------------------------------------------------------+
 __________________________________________________W_____________
 ___________.....................................................
 ................................................................
 ................................................................
 ................................................................
 ................................................................
 ................

   Scoreboard Key:
   "_" Waiting for Connection, "S" Starting up, "R" Reading Request,
   "W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup,
   "C" Closing connection, "L" Logging, "G" Gracefully finishing,
   "I" Idle cleanup of worker, "." Open slot with no current process
Now we have Apache HTTP Server 2.4 up and running. Let’s check application access through SSL.

Now we have Apache HTTP Server 2.4 up and running. Let’s check application access through SSL.

Restrict access to applications.

To disable or limit access with plain protocols we need to protect ports on system level with iptables
firewall. For the first of all let’s check if firewall enabled on your system. You can do it form X session  with command:

# system-sconfig-securitylevel

Or check service iptables status:

# service iptables status

If firewall is disabled on your system I would recommend enable it from security level configuration utility and the modify /etc/sysconfig/iptables file.

It will give you something similar to rules set below:

# Generated by iptables-save v1.2.11 on Tue Jan 20 10:56:55 2015
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -s localhost  --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -s <YOR-IP-ADDRESS>  --dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW  --dport 8080 -j REJECT
-A RH-Firewall-1-INPUT -i eth0 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Jan 20 10:56:55 2015

You may put additional permissions and restrictions, just remember that rule precedence is extremely important.

Restart iptables service with command:

# service iptables restart
Flushing firewall rules:                                   [  OK  ]
Setting chains to policy ACCEPT: filter                    [  OK  ]
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules:                          [  OK  ]
# 

Check if our new rules are in place

# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  127.0.0.1            0.0.0.0/0           tcp dpt:8080
ACCEPT     tcp  --  <your-ip>            0.0.0.0/0           tcp dpt:8080
REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:8080 reject-with icmp-port-unreachable
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Results

Open in Chrome browser (it has the most strict policies and provides more information about SSL connection) you server URL with /apex path in it. You should get Oracle XE login page as below:

If we check protocol and cipher status you will see TLS 1.2 and strong ciphers from OpenSSL 1.0
As result we have:

• Application HTTP port is not available outside of the box.
• Server accepts HTTP requests and converts it to HTTPS
• Application available on HTTPS port 
• Only TLS protocols are available 
• Only strong cipher suites are available.

Case solved, have fun.

No more poodles!

I love dogs, I really do. However I'm going to say it again - no more poodles! stop this heartbleading beast who bites our good old systems. This post isn't about Oracle, but it close enough to be here.

Lets's discuss a quite inexpensive way to enforce the latest greatest  security protocols and standards for old systems.

I’m going to show you how to increase security of your system. To achieve our goals you should complete the follow:

•  Prepare system for installation
•  Install and configure 3rd party applications 
•  Install and configure OpenSSL 1.0
•  Install and configure Apache 2.4

Start point. 

To reproduce old system I’m going to use VirtualBox with trial RedHat  AS 4.8 and Oracle XE to simulate business application on it. Operating system architecture is 32 bit and there are no upgrades updates or patches.

Business application resides on the system and should be exposed to the external user with maximum protection available. Normally it uses Oracle HTTP Server 10g and uses Oracle Wallet to accept HTTPS requests. 

To simplify this document I’m going to omit all certificate configuration details and will use my own CA and prepared certificates.  There are plenty number posts around openssl and certificate requests.

Apache server from RedHat 4.8 has version 2.0б that you have SSLv2, SSLv 3 and TLSv1.0 protocols only. Frankly speaking it may be enough for your tasks and you may skip everything down to reverse proxy  configuration. However TLSv1.0 is almost the same as SSL v3.0 and may be compromised as well. 

I consider no compromises and chase perfection:  no weak chippers, no heartbleeds and no poodles!

Prepare operating system

As soon as we are going to install software from sources we need to install development packages, 

libraries and compilers. Mount file system with your RedHat installation or in my case – insert DVD 

image into virtual DVD device.

Important notice: All commands execute as root user or through sudo rights 

Install packages as below (assume that resource mounted as /media/cdrom):

# rpm -Uvh /media/cdrom/RedHat/RPMS/kernel-devel-2.6.9-67.EL.i686.rpm

# rpm -Uvh /media/cdrom/RedHat/RPMS/gcc-3.4.6-9.i386.rpm \ 

/media/cdrom/RedHat/RPMS/glibc-devel-2.3.4-2.39.i386.rpm \ 

/media/cdrom/RedHat/RPMS/glibc-kernheaders-2.4-9.1.100.EL.i386.rpm \ 

/media/cdrom/RedHat/RPMS/glibc-headers-2.3.4-2.39.i386.rpm

# rpm -Uvh /media/cdrom/RedHat/RPMS/gcc-c++-3.4.6-9.i386.rpm \

/media/cdrom/RedHat/RPMS/libstdc++-devel-3.4.6-9.i386.rpm

Open SSL 

As part of overall security increase you need to upgrade existing OpenSSL installation. 

# wget http://www.openssl.org/source/openssl-1.0.1k.tar.gz

--18:13:35--  http://www.openssl.org/source/openssl-1.0.1k.tar.gz

           => `openssl-1.0.1k.tar.gz'

Resolving www.openssl.org... 185.9.166.106

Connecting to www.openssl.org|185.9.166.106|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 4,434,910 (4.2M) [application/x-gzip]

100%[================================================,434,910    704.70K/s    

ETA 00:00

18:13:44 (508.59 KB/s) - `openssl-1.0.1k.tar.gz' saved [4434910/4434910]

Check MD5 sum of download. Correct value is d4f002bd22a56881340105028842ae1f

# md5sum openssl-1.0.1k.tar.gz

d4f002bd22a56881340105028842ae1f  openssl-1.0.1k.tar.gz

Unpack archive and go to OpenSSL sources

# tar zxf openssl-1.0.1k.tar.gz

# cd openssl-1.0.1k

Configure installation with default directories:

# ./config --prefix=/usr/local --openssldir=/usr/local/openssl

………………………………………

[1]: Entering directory `/root/openssl-1.0.1k/apps'

make[1]: Nothing to be done for `generate'.

make[1]: Leaving directory `/root/openssl-1.0.1k/test'

Configured for linux-elf.

#

There is should be no error messages yet. Compile libraries (check for errors ):

# make

……………………………

make[2]: Leaving directory `/root/openssl-1.0.1k/test'

make[1]: Leaving directory `/root/openssl-1.0.1k/test'

making all in tools...

make[1]: Entering directory `/root/openssl-1.0.1k/tools'

make[1]: Nothing to be done for `all'.

make[1]: Leaving directory `/root/openssl-1.0.1k/tools'

#

If binaries were compiled with no errors install them:

# make install

.......................................

make[1]: Entering directory `/root/openssl-1.0.1k/test'

make[1]: Nothing to be done for `install'.

make[1]: Leaving directory `/root/openssl-1.0.1k/test'

making install in tools...

make[1]: Entering directory `/root/openssl-1.0.1k/tools'

make[1]: Leaving directory `/root/openssl-1.0.1k/tools'

installing libcrypto.a

installing libssl.a

cp libcrypto.pc /usr/local/lib/pkgconfig

chmod 644 /usr/local/lib/pkgconfig/libcrypto.pc

cp libssl.pc /usr/local/lib/pkgconfig

chmod 644 /usr/local/lib/pkgconfig/libssl.pc

cp openssl.pc /usr/local/lib/pkgconfig

chmod 644 /usr/local/lib/pkgconfig/openssl.pc

#cd ~/

Validate installation 

# openssl version

OpenSSL 1.0.1k 8 Jan 2015

Install PCRE libraries

Apache HTTP server requires Perl Compatible Regular Expressions.

Get binaries

# wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.36.tar.gz
--19:35:56--  ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-8.36.tar.gz
           => `pcre-8.36.tar.gz'
Resolving ftp.csx.cam.ac.uk... 131.111.8.115
Connecting to ftp.csx.cam.ac.uk|131.111.8.115|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done.    ==> PWD ... done.
==> TYPE I ... done.  ==> CWD /pub/software/programming/pcre ... done.
==> PASV ... done.    ==> RETR pcre-8.36.tar.gz ... done.
Length: 2,009,464 (1.9M) (unauthoritative)
100%[=======================================>] 2,009,464    482.35K/s    ETA 00:00
19:36:03 (418.19 KB/s) - `pcre-8.36.tar.gz' saved [2009464]

Extract archive

# tar zxf pcre-8.36.tar.gz
# cd pcre-8.36

Configure and install libraries

#./configure
……………………………
pcre-8.36 configuration summary:
    Install prefix .................. : /usr/local
    C preprocessor .................. : gcc -E
    C compiler ...................... : gcc
    Use JIT in pcregrep ............. : no
    Buffer size for pcregrep ........ : 20480
    Link pcregrep with libz ......... : no
    Link pcregrep with libbz2 ....... : no
    Link pcretest with libedit ...... : no
    Link pcretest with libreadline .. : no
    Valgrind support ................ : no
    Code coverage ................... : no

# make
……………………
  CXX      pcre_scanner_unittest-pcre_scanner_unittest.o
  CXXLD    pcre_scanner_unittest
  CXX      pcre_stringpiece_unittest-pcre_stringpiece_unittest.o
  CXXLD    pcre_stringpiece_unittest
make[1]: Leaving directory `/root/pcre-8.36'

# make install
…………………….
CCLD     pcregrep
  CXX      pcrecpp_unittest-pcrecpp_unittest.o
  CXXLD    pcrecpp_unittest
  CXX      pcre_scanner_unittest-pcre_scanner_unittest.o
  CXXLD    pcre_scanner_unittest
  CXX      pcre_stringpiece_unittest-pcre_stringpiece_unittest.o
  CXXLD    pcre_stringpiece_unittest
make[1]: Leaving directory `/root/pcre-8.36'

#cd ~/

Install Apache HTTP server binaries

Download latest stable version (at this time It’s 2.4.10 so adjust document accordingly with your current version).

# wget http://apache.mirrors.tds.net//httpd/httpd-2.4.10.tar.gz
--19:15:51--  http://apache.mirrors.tds.net//httpd/httpd-2.4.10.tar.gz
           => `httpd-2.4.10.tar.gz'
Resolving apache.mirrors.tds.net... 216.165.129.134
Connecting to apache.mirrors.tds.net|216.165.129.134|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6,820,719 (6.5M) [application/x-gzip]
100%[========================================>] 6,820,719      1.73M/s    ETA 00:00
19:15:56 (1.41 MB/s) - `httpd-2.4.10.tar.gz' saved [6820719/6820719]
#

Check MD5 value. Correct one is 9b5f9342f73a6b1ad4e8c4b0f3f5a159

# md5sum httpd-2.4.10.tar.gz

9b5f9342f73a6b1ad4e8c4b0f3f5a159  httpd-2.4.10.tar.gz

Download latest APR and APR-Util sources

- APR MD5 is d3538d67e6455f48cc935d8f0a50a1c3

# wget http://mirror.metrocast.net/apache//apr/apr-1.5.1.tar.gz
--19:24:08--  http://mirror.metrocast.net/apache//apr/apr-1.5.1.tar.gz
           => `apr-1.5.1.tar.gz'
Resolving mirror.metrocast.net... 65.175.128.102, 2606:f400:400:0:65:175:128:102
Connecting to mirror.metrocast.net|65.175.128.102|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1,020,833 (997K) [application/x-gzip]
100%[===============================================>] 1,020,833    806.48K/s
19:24:10 (804.12 KB/s) - `apr-1.5.1.tar.gz' saved [1020833/1020833]

# md5sum apr-1.5.1.tar.gz
d3538d67e6455f48cc935d8f0a50a1c3  apr-1.5.1.tar.gz

APR-Util MD5 is  866825c04da827c6e5f53daff5569f42

# wget http://mirror.metrocast.net/apache//apr/apr-1.5.1.tar.gz
--19:24:08--  http://mirror.metrocast.net/apache//apr/apr-1.5.1.tar.gz
           => `apr-1.5.1.tar.gz'
Resolving mirror.metrocast.net... 65.175.128.102, 2606:f400:400:0:65:175:128:102
Connecting to mirror.metrocast.net|65.175.128.102|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1,020,833 (997K) [application/x-gzip]
100%[=====================================================>] 1,020,833    806.48K/s

19:24:10 (804.12 KB/s) - `apr-1.5.1.tar.gz' saved [1020833/1020833]
[root@rhas48 ~]# md5sum apr-1.5.1.tar.gz
d3538d67e6455f48cc935d8f0a50a1c3  apr-1.5.1.tar.gz

Extract and prepare sources

# tar zxf httpd-2.4.10.tar.gz
# tar zxf apr-1.5.1.tar.gz
# tar zxf apr-util-1.5.4.tar.gz
# mv apr-1.5.1 httpd-2.4.10/srclib/apr
# mv apr-util-1.5.4 httpd-2.4.10/srclib/apr-util
# cd httpd-2.4.10

Configure installation

#./configure –prefix=/usr/local/apache2 –enable-ssl
………………………
config.status: creating support/log_server_status
config.status: creating support/logresolve.pl
config.status: creating support/phf_abuse_log.cgi
config.status: creating support/split-logfile
config.status: creating build/rules.mk
config.status: creating build/pkg/pkginfo
config.status: creating build/config_vars.sh
config.status: creating include/ap_config_auto.h
config.status: executing default commands
#

Make binaries

# make
……………………………………………
/root/httpd-2.4.10/srclib/apr/libtool --silent --mode=link gcc -std=gnu99  -g -O2 -pthread -o mod_rewrite.la -rpath /usr/local/apache2/modules -module -avoid-version  mod_rewrite.lo
make[4]: Leaving directory `/root/httpd-2.4.10/modules/mappers'
make[3]: Leaving directory `/root/httpd-2.4.10/modules/mappers'
make[2]: Leaving directory `/root/httpd-2.4.10/modules'
make[2]: Entering directory `/root/httpd-2.4.10/support'
make[2]: Leaving directory `/root/httpd-2.4.10/support'
make[1]: Leaving directory `/root/httpd-2.4.10'
#

Install new server binaries

#make install
…………………………
mkdir /usr/local/apache2/conf
mkdir /usr/local/apache2/conf/extra
mkdir /usr/local/apache2/conf/original
mkdir /usr/local/apache2/conf/original/extra
Installing HTML documents
mkdir /usr/local/apache2/htdocs
Installing error documents
mkdir /usr/local/apache2/error
Installing icons
mkdir /usr/local/apache2/icons
mkdir /usr/local/apache2/logs
Installing CGIs
mkdir /usr/local/apache2/cgi-bin
Installing header files
Installing build system files
Installing man pages and online manual
mkdir /usr/local/apache2/man
mkdir /usr/local/apache2/man/man1
mkdir /usr/local/apache2/man/man8
mkdir /usr/local/apache2/manual
make[1]: Leaving directory `/root/httpd-2.4.10'
#

All binaries are in place and we are ready to complete system configuration.

Here is System and Apache configuration.

OAM 11.1.2.2.0 Custom Login Form

Good afternoon to everyone,

Today I share fresh finding and hope it'd help you t save time and keep your mind (I've almost lost mine). 

It costs me couple days of hard harvesting and log analysis, I had  to create a simple application to check session status. 

After successful Oracle OAM and Tivoli Access Manager (TAM) integration (I'm going to post it sometimes) developement team faced next challenge. Due security reasons we have no access to TAM server so federation works only for external clients.  To provide access for both teams I used new OAM 11.1.2.2.0 feature - Advanced Authentication Policy Rules.  We decided to separate authentication schemes by browser type.  So if user's accessing protected resource with Google Chrome browser OAM uses local form-based authentication scheme otherwise request will be redirected to federation plug (TAM SSO). 

Screenshot below shows advanced rule edit form. 

Simple but effective way to build two factor or more sophisticated resource protection schemes. Detailed description and samples could be found in OAM documentation here.
So far so good,identity federation works, advanced rules works like a charm, custom forms appears and works as expected but result is very well known to everyone who deals with OAM/Webgates.

After log analyze and brainstorming I realized authentication doesn't match with authentication request. It means there is something wrong with login application. It's somewhat confused because the very same application works with OAM 11gR1. 

I'd skip logs mining, documentation sift and JSP analyze descriptions so   there is a gem:
For previous OAM versions  was quite enough to send request id with username and password. OAM 11.1.2.2.0 requires authentication token. Unfortunately our login page send request_id only and code below show how it has to be (additional lines in red).

 <!-- skipped JSP & HTML header -->  
 <%  
 String reqId = null;  
 String reqToken = null;  
 if( reqId == null && request.getAttribute( GenericConstants.REQUEST_ID ) != null )  
      {  
           reqId = ( String )request.getAttribute( GenericConstants.REQUEST_ID );  
      }  
      reqId = CSSUtil.escapeHtmlFull( reqId );  
     reqToken = request.getParameter(GenericConstants.AM_REQUEST_TOKEN_IDENTIFIER);  
 %>  
 <form id="loginData" action="/oam/server/auth_cred_submit" method="post" name="loginData" >  
 <!-- Skipped form declaration and decoration -->  
   <input name="<%=GenericConstants.REQUEST_ID%>" value="<%=reqId%>" type="hidden"/>  
   <input type="hidden" name="<%=GenericConstants.AM_REQUEST_TOKEN_IDENTIFIER%>" value="<%=reqToken%>" type="hidden"/>  
 </form>  
 <!-- skipped JSP & HTML footers -->  

Now it works  and if your have login form with token already you will never face this issue.
If not read my post and save time for upcoming l-o-o-o-ong beautiful weekend.

Enjoy and take care.