Oracle HTTP Server Controller

This controller provisions and maintains Oracle HTTP Server. The controller supports the following HTTP server configurations:

  1. Oracle HTTP Server - Collocated. This requires the domain to have a database.

  2. Oracle HTTP Server - Restricted JRF. This does not requires a database.

Oracle HTTP Server supported versions: 1. 12.2.1.4 2. 12.2.1.3

The controller does not supports Standalone HTTP Server.

The documentation assumes that the user has prior knowledge of working with MintPress SDK and/or MintPress Runtime.

How to Use the Controller

The controller can be used in two ways, (a) Using the MintPress Controllers Directly (b) Using MintPress Runtime JSON Format.

Using this controller directly

A fully documented script to create a single node HTTP domain in a collocated domain is here. A fully documented script to create a single node HTTP domain in a restricted domain is here.

Using MintPress Runtime JSON Format

Sample single node JSON format that are supported via MintPress Runtime are located here.

Using Oracle HTTP Server

  1. Oracle HTTP Server 12.2.1.4 - Collocated

  2. Oracle HTTP Server 12.2.1.4 - Restricted

These samples can also be found under docs.limepoint.com/mintpress/reference/runtime-json-templates

FAQ

Q. Important properties for Oracle HTTP Server

A. The following table lists all the properties applicable for Oracle HTTP Server. The column SystemComponent/installation/template signifies where the property should be mentioned viz installationList, templateList or SystemComponent

Property Default Value Description template/installation/systemcomponent
AdminHost 127.0.0.1 The hostname where the admin interface of HTTP server will run SystemComponent
AdminPort 7770 The port number of the admin interface of the HTTP server SystemComponent
ListenAddressm 127.0.0.1 The hostname of server this HTTP instance should run on. SystemComponent
ListenPort 7777 The port number of the HTTP server of the HTTP server SystemComponent
SSLListenPort 7887 The SSL port number of the HTTP server of the HTTP server SystemComponent
ListenPortSsl self.SSLListenPort The SSL port number of the HTTP server of the HTTP server SystemComponent
ServerName “http://#selfself.ListenAddress:#selfself.ListenPort” The servername to be set for HTTP server SystemComponent

Oracle HTTP Server Properties Reference

Oracle HTTP Server Template

Refer OracleHTTPServerInstallation for all installation properties. Refer OracleHTTPServerTemplate for all template properties. Refer OracleHTTPServerSystemComponent for all system component properties.

Refer the LimePoint Controller Reference for details on all properties supported.

WebGate Registration

MintPress::OracleHTTPServer::SystemComponent supports registering an Oracle WebGate agent with an external OAM (Oracle Access Manager) server directly. No separate gem is required.

The feature targets OHS 14c (14.1.2+). The underlying tools used are: - deployWebGateInstance.sh — deploys the WebGate binary into the OHS instance directory - EditHttpConf — patches httpd.conf to load the WebGate module - oamreg.sh inband — registers the agent with OAM via RREG

Methods

Method Description
‘setup_webgate` Runs ‘deploy_webgate` then `register_webgate`
‘deploy_webgate` Deploys WebGate binary + patches ‘httpd.conf`. Idempotent — skips if already deployed
‘register_webgate` Registers the agent with OAM via RREG. Safe to re-run
‘remove_webgate` Removes the ‘webgate.conf` include line from `httpd.conf`. When `remove_webgate_configs` is `true` (default), also deletes the `webgate/` folder from the instance directory

WebGate Properties Reference

Property Default Description
‘oam_admin_url` — OAM Administration Server URL (e.g. ‘oam.example.com:7001`)
‘oam_admin_user` — OAM admin username
‘oam_admin_password` — OAM admin password (‘Mint::Secret` or plain String)
‘oam_server` — A ‘LASRpcUtils::Transport` connected to the OAM server. When set, `oamreg.sh` runs directly on the OAM server — `oam_rreg_home` is not required
‘oam_fmw_home` — FMW home on the OAM server. Required when ‘oam_server` is specified. RREG binary is at `oam_fmw_home/oam/server/rreg/bin/oamreg.sh`
‘oam_java_home` — ‘JAVA_HOME` on the OAM server. Set this when the OAM server’s default Java is not suitable for ‘oamreg.sh` (e.g. needs Java 8 rather than Java 21)
‘force_webgate_registration` ‘false` When ‘true`, removes any existing agent output at `oam_fmw_home/oam/server/rreg/output/agent_name` on the OAM server and re-runs registration. When `false`, existing output is reused and registration is skipped
‘remove_webgate_configs` ‘true` When ‘true`, `remove_webgate` also deletes the `instance_home/webgate/` folder after removing the `httpd.conf` include. Set to `false` to keep registration artifacts on disk
‘webgate_action` ‘nil` Controls WebGate lifecycle when used via ERB templates: ‘register` runs `setup_webgate`, `deregister` runs `remove_webgate`. Not typically set when calling the SDK directly
‘oam_rreg_home` — Path to the RREG artifact on the OHS host (directory or ‘.tar.gz`). Not needed when `oam_server` is specified
‘webgate_agent_name` component ‘name` Agent name to register with OAM
‘webgate_host_identifier` component ‘name` Host identifier for the agent
‘webgate_mode` ‘open` Security mode: ‘open`, `simple`, or `cert`
‘webgate_auto_create_policy` ‘true` Auto-create authentication and authorisation policies during registration
‘webgate_protected_resources_list` ‘/…/*,/` Comma-separated list of protected URIs
‘webgate_public_resources_list` ‘“”` Comma-separated list of public URIs
‘webgate_excluded_resources_list` ‘“”` Comma-separated list of excluded URIs
‘webgate_logout_redirect_url` — URL to redirect to after logout
‘webgate_password` — WebGate agent password (‘Mint::Secret` or plain String)
‘webgate_cert_password` — Certificate password — required when ‘webgate_mode` is `cert`
‘webgate_request_file` — Path to a pre-built RREG request XML file. When set, skips auto-generation of ‘rreg.xml`
‘import_uri_file` — Path to a file containing URIs to import during registration
‘webgate_tmp_dir` ‘/tmp/rreg` Temporary working directory on the OHS host for RREG operations (used when ‘oam_rreg_home` path)
‘cleanup_temp_files` ‘true` Remove the temporary RREG working directory after registration (OHS-host path only)

Examples

The examples below assume a domain, machine, and OHS installation object have already been created. See ohs_create_collocated.rb for a full setup reference.

1. Minimal — open mode, all defaults

The simplest registration. webgate_agent_name defaults to the component name (ohs1), protected resources default to /.../*,/.

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                 'ohs1',
  domain:               domain,
  machine:              machine,
  oam_admin_url:        'http://oam.example.com:7001',
  oam_admin_user:       'weblogic',
  oam_admin_password:   'welcome1',
  oam_rreg_home:        '/oracle/stage/RREG.tar.gz'
)

ohs.create
ohs.setup_webgate   # deploy + register in one call

2. Open mode with explicit agent name, resources, and logout URL

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                              'ohs1',
  domain:                            domain,
  machine:                           machine,
  oam_admin_url:                     'http://oam.example.com:7001',
  oam_admin_user:                    'weblogic',
  oam_admin_password:                'welcome1',
  oam_rreg_home:                     '/oracle/stage/RREG.tar.gz',
  webgate_agent_name:                'myapp-webgate-agent',
  webgate_host_identifier:           'myapp-host',
  webgate_protected_resources_list:  '/myapp/.../*,/',
  webgate_public_resources_list:     '/myapp/public/...',
  webgate_excluded_resources_list:   '/myapp/health,/myapp/status',
  webgate_logout_redirect_url:       'http://oam.example.com:7001/oam/server/logout',
  webgate_auto_create_policy:        true
)

ohs.create
ohs.setup_webgate

3. Open mode with agent password

Some OAM configurations require the WebGate agent to be created with a specific password.

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                'ohs1',
  domain:              domain,
  machine:             machine,
  oam_admin_url:       'http://oam.example.com:7001',
  oam_admin_user:      'weblogic',
  oam_admin_password:  'welcome1',
  oam_rreg_home:       '/oracle/stage/RREG.tar.gz',
  webgate_agent_name:  'myapp-webgate-agent',
  webgate_password:    'AgentP@ssw0rd'
)

ohs.create
ohs.setup_webgate

4. Cert mode

webgate_cert_password is required when webgate_mode is cert.

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                  'ohs1',
  domain:                domain,
  machine:               machine,
  oam_admin_url:         'http://oam.example.com:7001',
  oam_admin_user:        'weblogic',
  oam_admin_password:    'welcome1',
  oam_rreg_home:         '/oracle/stage/RREG.tar.gz',
  webgate_mode:          'cert',
  webgate_agent_name:    'myapp-webgate-agent',
  webgate_password:      'AgentP@ssw0rd',
  webgate_cert_password: 'CertP@ssw0rd'
)

ohs.create
ohs.setup_webgate

5. Using a pre-existing RREG directory instead of a tar.gz

If the RREG tool has already been extracted on the target host, point oam_rreg_home at the directory directly.

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:               'ohs1',
  domain:             domain,
  machine:            machine,
  oam_admin_url:      'http://oam.example.com:7001',
  oam_admin_user:     'weblogic',
  oam_admin_password: 'welcome1',
  oam_rreg_home:      '/oracle/stage/rreg'   # extracted directory, not an archive
)

ohs.create
ohs.setup_webgate

6. Using a pre-built RREG request file

When webgate_request_file is set, the auto-generated rreg.xml is bypassed and the provided file is passed directly to oamreg.sh. Useful when the registration XML is managed externally or contains advanced options.

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                  'ohs1',
  domain:                domain,
  machine:               machine,
  oam_admin_url:         'http://oam.example.com:7001',
  oam_admin_user:        'weblogic',
  oam_admin_password:    'welcome1',
  oam_rreg_home:         '/oracle/stage/RREG.tar.gz',
  webgate_request_file:  '/oracle/stage/myapp_rreg_request.xml'
)

ohs.create
ohs.setup_webgate

7. Importing URIs from a file

When import_uri_file is set, the RREG tool is prompted to import URIs from the specified file rather than using the inline resource lists.

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                'ohs1',
  domain:              domain,
  machine:             machine,
  oam_admin_url:       'http://oam.example.com:7001',
  oam_admin_user:      'weblogic',
  oam_admin_password:  'welcome1',
  oam_rreg_home:       '/oracle/stage/RREG.tar.gz',
  import_uri_file:     '/oracle/stage/uris.txt'
)

ohs.create
ohs.setup_webgate

8. Specifying Java home on the OAM server

Use oam_java_home when oam_server is set and the OAM server’s default Java is not suitable for oamreg.sh (for example, the server has Java 21 in PATH but oamreg.sh requires Java 8).

oam_transport = LASRpcUtils::Transport.new('oam.example.com', 'ssh', {
  user:            'oracle',
  keys:            ['~/.ssh/id_rsa'],
  port:            22
})

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:               'ohs1',
  domain:             domain,
  machine:            machine,
  oam_admin_url:      'http://oam.example.com:7001',
  oam_admin_user:     'weblogic',
  oam_admin_password: 'welcome1',
  oam_server:         oam_transport,
  oam_fmw_home:       '/oracle/app/fmw',
  oam_java_home:      '/oracle/app/java/jdk1.8.0_391'
)

ohs.create
ohs.setup_webgate

9. Deploy and register as separate steps

deploy_webgate and register_webgate can be called independently. Both are safe to re-run — deploy_webgate skips if already deployed, and register_webgate overwrites any previous registration artifacts.

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:               'ohs1',
  domain:             domain,
  machine:            machine,
  oam_admin_url:      'http://oam.example.com:7001',
  oam_admin_user:     'weblogic',
  oam_admin_password: 'welcome1',
  oam_rreg_home:      '/oracle/stage/RREG.tar.gz'
)

ohs.create

# Deploy WebGate binary and patch httpd.conf
ohs.deploy_webgate

# ... perform other steps in between if needed ...

# Register with OAM separately
ohs.register_webgate

10. Multiple OHS components on the same domain, each with their own agent

Each SystemComponent registers as a separate named agent. WebGate properties are per-instance.

ohs_opts = {
  domain:             domain,
  machine:            machine,
  oam_admin_url:      'http://oam.example.com:7001',
  oam_admin_user:     'weblogic',
  oam_admin_password: 'welcome1',
  oam_rreg_home:      '/oracle/stage/RREG.tar.gz'
}

ohs1 = MintPress::OracleHTTPServer::SystemComponent.new(ohs_opts.merge(
  name:                              'ohs1',
  ListenPort:                        7777,
  webgate_agent_name:                'myapp-ohs1-agent',
  webgate_protected_resources_list:  '/app1/.../*,/'
))

ohs2 = MintPress::OracleHTTPServer::SystemComponent.new(ohs_opts.merge(
  name:                              'ohs2',
  ListenPort:                        7778,
  webgate_agent_name:                'myapp-ohs2-agent',
  webgate_protected_resources_list:  '/app2/.../*,/'
))

domain.system_components['ohs1'] = ohs1
domain.system_components['ohs2'] = ohs2

[ohs1, ohs2].each do |ohs|
  ohs.create
  ohs.setup_webgate
end

11. Keep temporary files for debugging

Set cleanup_temp_files: false to retain the RREG working directory after registration — useful for inspecting the generated rreg.xml or oamreg.sh output.

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                'ohs1',
  domain:              domain,
  machine:             machine,
  oam_admin_url:       'http://oam.example.com:7001',
  oam_admin_user:      'weblogic',
  oam_admin_password:  'welcome1',
  oam_rreg_home:       '/oracle/stage/RREG.tar.gz',
  webgate_tmp_dir:     '/home/oracle/rreg_debug',
  cleanup_temp_files:  false
)

ohs.create
ohs.setup_webgate
# Temporary files remain at /home/oracle/rreg_debug for inspection

12. Remove WebGate

remove_webgate removes the include "…/webgate/config/webgate.conf" line from httpd.conf. By default (remove_webgate_configs: true) it also deletes the webgate/ folder from the instance directory. Set remove_webgate_configs: false to keep the registration artifacts on disk so WebGate can be re-enabled by calling deploy_webgate again. Restart OHS after removal for the change to take effect.

# Full removal — remove httpd.conf include AND delete webgate/ folder (default)
ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:    'ohs1',
  domain:  domain,
  machine: machine
)

ohs.remove_webgate
ohs.stop
ohs.start

# Soft disable — remove httpd.conf include only, keep registration artifacts
ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                   'ohs1',
  domain:                 domain,
  machine:                machine,
  remove_webgate_configs: false
)

ohs.remove_webgate
ohs.stop
ohs.start

Auto-fetching RREG from the OAM Server

Instead of pre-staging the RREG tool on the OHS host, you can point directly at the OAM server. The controller will:

  1. Check whether {oam_fmw_home}/oam/server/rreg/output/{agent_name} already exists on the OAM server

  2. If it exists and force_webgate_registration is false (default): skip registration and go straight to step 3

  3. If it exists and force_webgate_registration is true: remove the existing output and re-register

  4. Run {oam_fmw_home}/oam/server/rreg/bin/oamreg.sh inband on the OAM server with OAM_REG_HOME={oam_fmw_home}/oam/server/rreg. Output is always written to {oam_fmw_home}/oam/server/rreg/output/{agent_name}/

  5. Clear the OHS instance’s webgate/config/ directory and copy the output artifacts (ObAccessClient.xml, cwallet.sso, etc.) from the OAM server directly into it

oam_rreg_home is not required when oam_server is used.

13. Fetch RREG automatically from OAM server — open mode

oam_transport = LASRpcUtils::Transport.new('oam.example.com', 'ssh', {
  user:  'oracle',
  keys:  ['~/.ssh/id_rsa'],
  port:  22
})

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:               'ohs1',
  domain:             domain,
  machine:            machine,
  oam_admin_url:      'http://oam.example.com:7001',
  oam_admin_user:     'weblogic',
  oam_admin_password: 'welcome1',
  oam_server:         oam_transport,
  oam_fmw_home:       '/oracle/app/fmw'
)

ohs.create
ohs.setup_webgate

14. Fetch RREG from OAM server — cert mode

oam_transport = LASRpcUtils::Transport.new('oam.example.com', 'ssh', {
  user:  'oracle',
  keys:  ['~/.ssh/id_rsa'],
  port:  22
})

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                  'ohs1',
  domain:                domain,
  machine:               machine,
  oam_admin_url:         'http://oam.example.com:7001',
  oam_admin_user:        'weblogic',
  oam_admin_password:    'welcome1',
  oam_server:            oam_transport,
  oam_fmw_home:          '/oracle/app/fmw',
  webgate_mode:          'cert',
  webgate_agent_name:    'myapp-webgate-agent',
  webgate_password:      'AgentP@ssw0rd',
  webgate_cert_password: 'CertP@ssw0rd'
)

ohs.create
ohs.setup_webgate

15. Force re-registration when output already exists on the OAM server

By default, if {oam_fmw_home}/oam/server/rreg/output/{agent_name} already exists the controller skips oamreg.sh and copies the existing artifacts. Set force_webgate_registration: true to tear down the existing output and re-register.

oam_transport = LASRpcUtils::Transport.new('oam.example.com', 'ssh', {
  user:  'oracle',
  keys:  ['~/.ssh/id_rsa'],
  port:  22
})

ohs = MintPress::OracleHTTPServer::SystemComponent.new(
  name:                        'ohs1',
  domain:                      domain,
  machine:                     machine,
  oam_admin_url:               'http://oam.example.com:7001',
  oam_admin_user:              'weblogic',
  oam_admin_password:          'welcome1',
  oam_server:                  oam_transport,
  oam_fmw_home:                '/oracle/app/fmw',
  force_webgate_registration:  true
)

ohs.create
ohs.setup_webgate

16. Multiple OHS components fetching RREG from the same OAM server

The oam_server transport can be shared across components. Each component registers as its own named agent.

oam_transport = LASRpcUtils::Transport.new('oam.example.com', 'ssh', {
  user:  'oracle',
  keys:  ['~/.ssh/id_rsa'],
  port:  22
})

shared_oam_opts = {
  oam_admin_url:      'http://oam.example.com:7001',
  oam_admin_user:     'weblogic',
  oam_admin_password: 'welcome1',
  oam_server:         oam_transport,
  oam_fmw_home:       '/oracle/app/fmw',
  domain:             domain,
  machine:            machine
}

ohs1 = MintPress::OracleHTTPServer::SystemComponent.new(shared_oam_opts.merge(
  name:               'ohs1',
  webgate_agent_name: 'app1-webgate-agent'
))

ohs2 = MintPress::OracleHTTPServer::SystemComponent.new(shared_oam_opts.merge(
  name:               'ohs2',
  webgate_agent_name: 'app2-webgate-agent'
))

[ohs1, ohs2].each { |ohs| ohs.create; ohs.setup_webgate }