OpenAM Interview Questions for freshers experienced :-
1. What is OpenAM?
OpenAM is an open source access management, entitlements and federation server platform, backed by ForgeRock. OpenAM originated as OpenSSO, an access management system developed by Sun Microsystems, owned by Oracle.
2. How OpenAM Helps us?
OpenAM provides a service named as access management, which involves managing the access to all resources available within the network. Once we set up OpenAM to manage access, we have a service to take control of who can access what resources, when, and under what circumstances. Yet, a resource can be just about anything accessible over the network from a web page, to an application, to a web service.
3. Can OpenAM be centrally managed?
OpenAM centralizes all access control by handling both validation and authorization. validation is confirming of an identity, for example confirming that a user has successfully logged in. Authorization is determining whether to grant access to someone who is valid.
4. How OpenAM validates?
OpenAM centralizes validation by using a variety of authentication modules. Modules connect to identity repositories that store identities and provide authentication services. The identity repositories are implemented as LDAP directories, relational databases, RADIUS, Windows authentication, one-time password services, other standards-based access management systems and much more. OpenAM lets us chain together the validation services used which lets you configure stronger authentication for more sensitive resources for example. It allows to set up modules that remember a device when the user logs in successfully.
5. How OpenAM authorizes?
OpenAM centralizes authorization by letting the user, use OpenAM to manage access policies separate from applications and resources. Instead of building access policy into web application, we can install a policy agent with the web application to request policy decisions from OpenAM. This way we can avoid issues that could arise when developers must embed policy decisions into their applications.
6. Explain the Software Requirements to implement OpenAM
The following are the software requirements to for effective installation of OpenAM,
- The Apache HTTP Server used to support the OpenAM projects that rely on web pages.
- Apache Tomcat, which provides a web container for OpenAM platform
- OpenAM is a Java web application; it needs a web container established by Apache Tomcat.
- OpenAM core server with its console
For OpenAM, the core server with OpenAM console acts as the pivotal to a web application. During the configuration, OpenAM sets up the OpenDJ directory, for the purpose of holding OpenAM’s configuration and serve as an identity store and authentication service.
>> OpenAM Apache Policy Agent, to intercept requests from users and to enforce OpenAM formulated access policy decisions. Since OpenAM is a Java Web Application, the Java Development Kit (Kit) is pre-installed.
7. How to To Configure a Policy in OpenAM
Follow these steps to create a policy that allows all authenticated users to perform an HTTP GET
- In OpenAM Console, click the Access Control tab, then in the Realms table click the link to / (Top Level Realm).
- We should click the Policies tab, click iPlanetAMWebAgentService, and then click Add New Policy.
- Allocate a new name to the policy of Authenticated users can get Apache HTTP home page, and then click Next.
- In the Specify Resources step, click *://*:*/* to move the pattern to the Create your resources section. Then, replace the asterisks so that the pattern reads: https://www.example.com:8000/*, and then click the Add icon.
- OpenAM Policy Rule and Next to proceed.
- In the Select Actions step, select the GET and POST actions, ensure their value is set to Allow, and then click Next.
- n the Define Subject Conditions step, click Subject Condition; from the type, drop-down choose Authenticated Users and then drag the grey block into the green AND logical block above.
- OpenAM Policy Subjects and Next to proceed.
- In the Define Environment Conditions and Specify Response Attributes steps, click Next.
Review your configuration. It should resemble the following:
- Review OpenAM Policy
- To make changes to the configuration, either click the relevant step or click the item to jump to the relevant step and make amendments to the configuration.
- When the configuration is completed, click Finish.
9. What are the steps followed in order to set up OpenAM to protect a web page?
- Prepare your host file.
- Deploy Apache HTTP server.
- Deploy Apache Tomcat.
- Deploy OpenAM.
- Configure a policy in OpenAM.
- Create a web policy agent profile.
- Install OpenAM web policy agent.
These steps are used in Linux system whereas for Microsoft Windows, just adapt the examples accordingly.
10. What are deployment-planning steps in OpenAM?
Following the installation step in Project Initiation
- Architectural design
- Execution of OpenAM system
- Testing with the help of Automation & continuous integration
- Providing solutions by Functional testing
- Recovery of issues by Non-Functional testing
- Supportability
11. What is the need of OpenAM client Application Programming Interfaces (APIs)?
In Federate and OpenAM environments, the OpenAM Java APIs offered through the OpenAM Java SDK let a user’s Java and Java EE applications request OpenAM for authentication and authorization. The exposure of RESTful API, which returns XML or JSON over HTTP, will allow the user to access authentication, authorization, and identity services from web applications using REST clients in the same language as that of the user’s choice.
12. What are the procedures to upgrade a legacy deployment?
- Keep your customized OpenAM server .war file organized.
- Use ‘Installing OpenAM Core Services’ to arrange a new installation of servers from the new, customized .war file, starting with the instructions.
- After installation is complete, use the ‘ssoadm do-batch’ command to apply multiple changes with a single command
- Authenticate the new service to check if the performance meets the expected level or not.
- Finally, execute the task of redirecting client application traffic to the new installation from the old deployment.
13. What are the functions of OpenAM APIs?
OpenAM provides client application programming interfaces for a number of requirements. The OpenAM Java APIs offered through OpenAM Java SDK lets your Java and Java EE applications to call for OpenAM validation, in both OpenAM and federated environments.
14. What are the functions of OpenAM SPIs?
OpenAM offers Java-based service interfaces to let you extend services for the requirements of your specific deployment. Following is are the steps to implement such plugins.
- Custom OAuth 2.0 scopes plugins define how OpenAM playing the role of authorization server handles scopes, including what token information to return regarding scopes set when authorization was granted.
- Custom authentication plugins let OpenAM validate users against a new authentication service or an authentication service specific to the deployment
- Post authentication, plugins perform additional processing at the end of the authentication process, but before the subject to validation. Post validation, plugins can store information about the authentication in the user’s profile, or call another system for audit logging purposes.
- Policy evaluation plugins implement new policy conditions, send attributes from the user profile as part of a policy response, extend the definition of the subjects to whom the policy applies, or customize how policy management is delegated.
15. How OpenAM provides functionality to IPv4 and IPv6?
OpenAM provides functionality for IPv4, IPv6, and as a hybrid of both. While the majority of the interaction is done at the backend, there are a few places where the GUI needs some inputs, while setting up policy conditions. These fields follow the same standard, which applies, to IPv4 & IPv6. IPv4 uses a 32-bit integer value, with a decimal system. IPv6 uses a hexadecimal system, and a colon separates the eight groups of hexadecimal digits.
16. How to develop Client Applications?
Client applications can access OpenAM services for authentication, authorization, and single sign-on/single log out, by the use of sessions. Client applications also are allowed, to manage authorization policies. This part of the guide covers client interaction with OpenAM over supported protocols and using OpenAM APIs.
17. What do you understand by RESTful APIs?
Representational State Transfer is an architectural style that sets certain limitations for designing and building large-scale distributed systems. As an architectural style, REST has very broad utility. The designs of both HTTP 1.1 & URIs follow RESTful principles. The World Wide Web is no doubt the largest and best-known REST applications. Many other web services also follow the REST architecture, like OAuth 2.0 and OpenID Connect 1.0. ForgeRock Common REST (CREST) applies RESTful principles to define common verbs for HTTP-based APIs that access web resources and collects resources.
18. How can we specify an explicit API REST version?
We can specify the version of REST API to use by adding an Accept-API-Version header to the request. We can configure the default behavior of OpenAM which will take when a REST call which does not specify any explicit version information.
19. What is The RADIUS Protocol?
The RADIUS protocol is a very simple protocol of four packet types:
- Access – Request packets, received from a client to a server to begin a new authentication conversation or to respond to a previous response in an existing conversation and provide the requested information.
- Access – Accept packets received from a server to a client to indicate a successful authentication.
- Access – Reject packets received from a server to a client to indicate a failed authentication.
- Access – Challenge packets received from a server to a client to solicit more information from the entity validated.
20. How to Create a Web Policy Agent Profile?
OpenAM stores information of profiles about policy agents centrally by default. You can then manage the policy agent profile through OpenAM Console. The policy agent can recover the configuration from OpenAM profile at installation time when it starts up, and OpenAM can notify the policy agent of changes to its configuration.
21. What is the user self-registration?
OpenAM provides self-registration for users as a feature in OpenAM’s REST APIs. Users can be safely signed up in OpenAM without the administrators or help desk getting involved.
22. What is the password reset function?
OpenAM help users to reset their passwords on their own. OpenAM handles both the case where a user knows their password and wants to change it and the case where the user has forgotten their password and needs to reset it, possibly after answering security questions.
23. What are the dashboard services?
Users have a number of applications assigned, especially if the organization has standardized on software as a service, for example for email, document sharing, support ticketing, customer relationship management, web conferencing, and so forth. It can be useful to present these applications on a user’s dashboard with the profile and assign applications to the user’s dashboard automatically based on the user’s profile.
24. What is Single-Sign on?
Single sign-on (SSO) is a core attribute of OpenAM. Once we have set up OpenAM, we can protect as many applications in the network domain as we want. We need to install the policy agents for the additional servers and add policies for the resources served by the applications.
25. How can user authenticate?
Users can then authenticate themselves on their own to start a session on any site in the domain, and they remain authenticated for all sites in the domain, without the need to log in again.
26. Why is Single Sign-on feature necessary?
Many organizations have more than one domain, with cookies set in one domain are not returned to servers in another domain. Many organizations get sub-domains controlled independently, leading to the need to protect against someone setting up against a rogue sub-domain to hijack session cookies. OpenAM’s cross-domain single sign-on (CDSSO) provides a safe method for your OpenAM servers in one domain to work with policy agents from other domains, defending against potential session cookie hijacking.
27. What is standard based federation?
When we need to federate identities across not just different domains but instead across different organizations with separate access management solutions, then we need interoperable federation technologies. An organization, that acts as an identity provider for other organizations providing services, allow users to use their identity from another organization to access the services. Either way, OpenAM has the capability to integrate well in federated access management scenarios.
28. What is CRUD?
OpenAM REST APIs makes CRUD (create, read, update, delete) easy to use in web applications. They also provide extended actions and query capabilities for access management functionality.
29. What is the benefit of OpenAM Java APIs?
OpenAM Java APIs provided through the OpenAM Java SDK allows Java and Java EE applications to call on OpenAM for authentication and authorization in both OpenAM and federated environments.
30. What does C SDK?
The OpenAM C SDK provides APIs for native applications with new web server policy agents. The C SDK has been designed for Linux, Solaris, and Windows platforms.
31. What do you understand by SAML 2.0 SSO & Federation?
SAML 2.0 SSO is part of the federated access management. Federation permits access management across the organizational boundaries. Federation allows organizations to share the identities and services without giving away their organizational information and the services they provide.