Using Liferay SSO with Oracle Access Manager 11g

Well, I was given a challenging task – using Oracle Access Manager 11g as an SSO provider for Liferay 6.0 (the community edition…).
Now, as you might know – there is no built-in OAM support for Liferay – so I was stuck with configuring one myself. Since I didn’t even have the OAM installed – I’ll detail all the steps I did. To simplify matters – I installed OAM on Microsoft Windows Server, but the same should hold for Linux.

All Oracle downloads were downloaded from Version is

OAM Installation

  1. Install Oracle database. I didn’t install Oracle XE, but rather the Enterprise edition.
  2. Alter the Oracle database.
    1. Open sqlplus as sys and run the following commands
    2. alter system set open_cursors=1000 scope=both;
      alter system set processes=1000 scope=SPFILE;
  3. Restart Oracle DB.
  4. Run RCU (V33643-01), and check the Identity Managent checkbox. Proceed with the installation.
  5. Install WebLogic Server (wls1036_generic)
  6. Install SOA Suite (ofm_soa_generic_11. and ofm_soa_generic_11.
  7. Install IdM (V33644-01_1of2 and V33644-01_2of2)
  8. From your ORACLE_HOME/IDM_HOME/common/bin run the config.cmd file.
  9. Install all the required components (especially all the Oracle Access Manager relevant components).
  11. Run the following WLST scripts (thank you Warren
  12. $MW_HOME/oracle_common/common/bin/wlst.cmd $ORACLE_HOME/common/tools/ -d $IAM_DOMAIN_LOCATION -m create     -c IAM -p $ORA_PASS
    $MW_HOME/oracle_common/common/bin/wlst.cmd $ORACLE_HOME/common/tools/ -d $IAM_DOMAIN_LOCATION -m validate
  13. Where
    1. $MW_HOME is where you put the Middleware home (e.g. ~/Oracle/Middleware)
    2. is the Oracle IAM home (e.g. ~/Oracle/Middleware/Oracle_IAM1)
    3. LOCATION is the domain home (e.g. ~/Oracle/Middleware/user_projects/domains/OAMDomain)
    4. $ORA_PASS is the password needed to talk to the database
  14. Now you can safely run the admin server. Connect to it using IP_ADDR:7001/em, and start the OAM managed server too.

Apache installation/configuration

On a separate machine (I used RedHat Linux 5.5):

  1. Install Apache2.2
  2. Configure WebGate (I used ZIP file
  3. Configure Apache to act as a proxy for your Liferay server by using ProxyPass and ProxyPassReverse. For instance:
  4. ProxyRequests Off
    ProxyPass /web http://LIFERAY_SERVER:8080/web
    ProxyPassReverse /web http://LIFERAY_SERVER:8080/web
  5. Configure WebGate in the Apache. On my machine the configuration looked like this:
  6. LoadModule obWebgateModule "/usr/local/webgate/product/access/oblix/apps/webgate/bin/"
    LoadFile "/usr/local/webgate/"
    LoadFile "/usr/local/webgate/"
            WebGateInstalldir "/usr/local/webgate/product/access"
            WebGateMode PEER
            #webgateload obWebgateModule "/usr/local/webgate/product/access/oblix/apps/webgate/bin/"
            SetHandler obwebgateerr
            SetHandler obwebgateerr
            AuthType Oblix
            require valid-user

OAM Configuration

  1. Open the Access Manager console, and click on the “New OAM10g WebGate”
  2. Fill in the details, exactly as you did during the WebGate installation.
  3. Go to “Application Domains”, and select the newly created Application Policy
  4. Change any required value, and select “Authorization Policies”
  5. Select the “Protected Resource Policy”
  6. Select “Responses”
  7. Add a new response – HTTP Header with the name of LIFERAY_SCREEN_NAME and value of uid

Liferay Configuration

  1. Edit the file and add the following line:

Restart Apache, and browse to it. You should get the OAM login page, and after login – you should see you have automatically logged-in into Liferay…

13 thoughts on “Using Liferay SSO with Oracle Access Manager 11g

  1. Hi

    It was a nice article. We are also planning to provide SSO to LifeRay Portal 6.0.x version. I was wondering you specified here about using 10g WebGate. May I know why? Does 11g WebGate does not work with LifeRay Portal?


  2. I want to integrate liferay with Oracle Access Manager on cloud .could you share integration document for linux environment.


      1. Hi liran,

        I was talking about Liferay integration with OAM.You have done same as mentioned in post .if you have any document for that integration please share.


  3. Does this apply to liferay 7.0? I does not seem to be working for me. After login via OAM, i get redirected to the liferay port 8080 page


      1. How about liferay 6.2? I’m using Oracle HTTP Server as a proxy for Liferay. The redirect is working: when I’m accessing the oracle ohs url I’m redirected to the sso page. However, after I enter the credential I’m redirected to the liferay homepage, and must enter liferay credential.
        Can you please help me on this ? What am I missing ? Or what do I need to configure extra ?


      2. Sorry – Liferay 6.2 changed allot in their SSO architecture – and I’m not working with this version…


      3. I already changed the liferary version to 6.1 GA1, but still need to login again with liferay credential. Is the header name must be LIFERAY_SCREEN_NAME ?


  4. I have OAM and Liferay installed in separate weblogic server.

    I have OAM setup is ready with me and also set authorization header but some how not able to get authorize in Liferay somehow.
    Do you see possible issue here ?


    1. Friends,

      I am actually able to perform SSO with Liferay by following the same steps given above. It works like a charm :). Only problem you might face during logout and session handling because Liferay and OAM running individual sessions and we need to handle logout separately here to kill both the sessions.
      I will post details stuff over very soon


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s