This document outlines the design pattern for perimeter application protection in identity access management architecture, focusing on tier 1 solutions. It describes the structure and components of the architectural pattern, which addresses challenges in software engineering like performance limitations and business risk minimization. The implementation involves SSL termination at F5 virtual servers with traffic directed to Oracle OHS for secure access management.

1. Intranet User
“On-Network”
Perimeter Protected Access
Perimeter Application Protection of Identity Access Management
Architecture Design Pattern – Tier 1 Solution Building Block Version: 1.0 Author: Mike Reams Last Modified:
DMZ Network
Design Pattern
Perimeter Application
Protection of Identity
Access Management
A Design Pattern provides a scheme for refining the subsystems or components of a software system, or the relationships between them. It describes
commonly recurring structure of communicating components that solves a general design problem within a particular context . Architectural patterns are
similar to software design patterns but have a broader scope. The architectural patterns address various issues in software engineering, such as computer
hardware performance limitations, high availability and minimization of a business risk.
Perimeter Protected Access points to a single Public VIP that terminates the SSL session at the external facing F5 Virtual Server. The back-end interface of F5
from the same session directs traffic to Oracle OHS for reverse proxy which in turns proxies to the internal F5 Virtual Servers configured as Load Balancers
using the F5 LTM module. This design is ideal for split DNS to allow internal to go exclusively through the internal F5 Virtual Server while having external
traffic route through this architectural pattern. The Oracle WebGate is extended to the perimeter network on the F5 using the Access Policy Manager module.
Architecture Domain(s) Networking | Identity Management | Security | Middleware
External DNS/VIP
External Facing
Firewall
F5 Big-IP Internal
Virtual Server
Application
Internet User
“Off-Network”
Linux OHS
Reverse Proxy
Internal Network
Data Web Server
Access
Manager
Access Policy
Central Login
F5 Big-IP External Virtual
Server w/ “APM”
If login is
required
Internal DNS/VIP
Internal Facing
Firewall
Webgate
Machine Machine
General Architecture
If login is
required
Webgate
Internal Facing
Firewall