I was trying to run an ldif file that will modify certain attribute and objectclass.

I was giving the user details without quotes in ldap_modify command as shown below and it throws Insufficient access error.

[oracle@hostname bin]$ ./ldapmodify -h hostname -p 389 -D cn=orcladmin -W password -f oid_tuning.ldif
modifying entry cn=dsaconfig,cn=configsets,cn=oracle internet directory
ldap_modify: Insufficient access

When I tried with quotes as shown below, it worked like a charm!

[oracle@hostname bin]$ ./ldapmodify -h hostname -p 389 -D “cn=orcladmin” -w password -f oid_tuning.ldif
modifying entry cn=dsaconfig,cn=configsets,cn=oracle internet directory

The error looks like a user lock or access privileges issue, but the answer is quite simple. Anyhow, feel like it would be useful.

Share This

This post covers changes in Oracle Access Manager from 10g (10.1.4.X) to 11g (11.1.1.X).

Oracle Access Manager (OAM) : is Access Management Product acquired from Oblix in 2005. 

• Oblix COREid (6, 7) and OAM 10g is written in C++where as OAM 11g is J2EE application deployed on Oracle WebLogic Server (10.3.3+)
• There are two main OAM components in OAM 10g, Access System(Access Server, WebGate and Policy Manager) and Identity System (Identity Server and WebPass). In OAM 11g there is NO “Identity System Component“. Identity related functions are moved to Oracle Identity Manager(OIM) 11g. (OIM is user provisioning and reconciliation product acquired from Thor Xellerate)
• There is NO identityXML interface or Workflow in OAM 11g.
• Access Server in 10g is now called as OAM Server in 11g
• Policy Manager in 10g is now called as OAM Administration Console in 11g
• AccesssGate and WebGate in 10g are now called as OAM Agents in 11g
• Directory Profiles in 10g are now called as User-Identity Store in 11g
• In OAM 10g configurations are stored in LDAP servers where as in OAM 11g configurations are stored in xml file (under webloigic domain) - $DOMAIN_HOME/config/fmwconfig/oam-config.xml
• In OAM 10g Policies are stored in LDAP server where as in OAM 11g you have option to store them either in XML file or in Database.
• In OAM 10g Sessions used to be stateless where as in OAM 11g, user sessions are stateful and stored on Server in OAM 11g (It is possible to leverage Coherence for distributed caching of session data). For more information on Oracle Coherence (earlier Tangosol) click here
• In OAM 11g (by default) Policy Data & User session datais stored in single database (details under $DOMAIN_HOME/config/jdbc/oam-db-jdbc.xml) under one schema however it is possible to configure OAM Policy Data in to one database and user session data in another database. 
• OAM Server (Access Server in 10g) in OAM 11g is deployed on WebLogic Managed Server (oam_server1 - default port 14100)
• In OAM 11g, OAM Administration Console(Policy Manager in 10g) is deployed on WebLogic Admin Server (default port 7001)
• URL for OAM Administration Console is http://server:7001/oamconsole (default username/password created during domain creation in weblogic)
• OAM 11g User Interface (UI) is based on Application Development Framework (ADF)
• Three type of Web Agents are supported in OAM 11g -
  a) AccessGate/WebGate from 11g
  b) AccessGate/WebGate from 10g (for backward compatibility) and
  c) mod_osso for Oracle 10g Single Sign-On integration  

. 

For step by step installation of Oracle Access Manager (OAM) 11g click here

Share This

Typically, while installing the WebPass (say) , the httpd.conf of HTTP Server will be pointed out and after the webpass configurations are updated in the httpd.conf, the Http Server should be restarted.

The below error was encountered in Apache error log while restarting HTTP Server

/u01/osinfra/Apache/Apache/logs/httpd.pid overwritten — Unclean shutdown of previous Apache run?
*** glibc detected *** realloc(): invalid size: 0×0819e4a8 ***

This is because of the perl module in the Apache server.

Edit the httpd.conf and edit the below line.

LoadModule perl_module libexec/libperl.so

Attempt to start the HTTP Server is succesful.

Share This

./ssoreg.sh -oracle_home_path $ORACLE_HOME -config_mod_osso TRUE -site_name LBR_Hostname:7777 -remote_midtier config_file $ORACLE_HOME/Apache/Apache/conf/osso/worklist/osso.conf  -mod_osso_url http://LBR_Hostname:7777

Then the osso.conf file will be used in mid-tier (BPEL worklist) for performing few configurations. This will be followed by a restart of HTTP Server and OC4J processes.

We encountered the below error while restarting the HTTP Server of BPEL server.

$ORACLE_HOME/Apache/Apache/bin/apachectl start: execing httpd
Syntax error on line 7 of $ORACLE_HOME/Apache/Apache/conf/mod_osso.conf:
SSO server version v3.0 is not supported

The root cause of the issue is the infra tier version. If the Infra tier is upgraded to 10.1.4.3, then the ssoreg.sh should be run with an additional parameter -sso_partner_version v1.4 as shown below.

./ssoreg.sh -oracle_home_path $ORACLE_HOME -config_mod_osso TRUE -site_name LBR_Host:7777 -remote_midtier config_file $ORACLE_HOME/Apache/Apache/conf/osso/worklist/osso.conf  -mod_osso_url http://LBR_Host:7777
-sso_partner_version v1.4

However, this is not applicable if you are using Infra Tier version with 10.1.4.0.1.

Helpful articles:

Metalink article : 809743.1

Share This

I did not witness any issues in a development environment. However, when I replicated the same integration process in a product environment, I found the difference.

I have followed this metalink note for 753087.1 BPEL OSSO integration. During the BPEL worklist registration process, the -site_name is given as myhost.mydomain.com. This means the BPEL worklist port number is not used here and it was not mentioned whether it is the individual BPEL server hostname or the load balance router URL.

Many attempts used with registering the individual BPEL server name with OSSO were invain using ssoreg.sh.

I was skeptical from the beginning as to register whether with the LBR or individual server. Conceptually, the Load balancer is not intelligent enough to route it to OSSO server, it is the individual BPEL servers which are registered with OSSO who could do it. Well, this is my perception!

When I register with individual BPEL server, I was getting the below error when I access the BPEL worklist using the URL http://soa.domain.com:7777/integration/worklistapp/

There was no helpful errors in OC4J logs and hence found very difficult to troubleshoot.

I have gone through few configuration files of BPEL worklist server to check what URL the server is accepting/using. One of the files is Wf_client_config.xml located under $ORACLE_HOME/bpel/system/services/config.

The URL that it is pointing is the LBR and not the individual BPEL server as shown below.

<identityService>
<soapEndPoint>http://LBR.hostname:7777/integration/services/IdentityService/identity</soapEndPoint>
</identityService>

………………….
………………….

I read this metalink article 739686.1 just to get to know few more things about this integration troubleshooting. I found that -site_name is used as hostname.domain:bpel_port and this is something which is not mentioned in the basic metalink article we were following 753087.1 .

Now I got some clue to register the BPEL as LBR hostname including the bpel port.

So, I used the below script to run using ssoreg.sh.

./ssoreg.sh -oracle_home_path $ORACLE_HOME -config_mod_osso TRUE -site_name LBR.hostname:7777 -remote_midtier -config_file $ORACLE_HOME/Apache/Apache/conf/osso/worklist/osso.conf  -mod_osso_url http://LBR.hostname:7777
-sso_partner_version v1.4

When I did so, the SSO worked like a gem!

Note: The BPEL worklist port in our case is 7777, hence change it as per your application.

Share This

In my case, I got it while restarting/stopping the HTTP_Server as shown below.

[oracle@mahendra.domain.com bin]$ ./opmnctl stopall
opmnctl: stopping opmn and all managed processes…
=======================
opmn id=mahendra.domain.com:7017
2 of 3 processes stopped.

ias-instance id=oasinfra.mahendra.domain.com
++++++++++++++++++++++++++++
—————————————-
ias-component/process-type/process-set:
HTTP_Server/HTTP_Server/HTTP_Server

Error
–> Process (pid=6047)
time out while waiting for a managed process to stop
Log:
/u01/osinfra/opmn/logs/HTTP_Server~1

opmnctl: graceful stop of processes failed, trying forceful shutdown…

Even the shutdown was not successful as shown below.

[oracle@mahendra.domain.com bin]$ ./opmnctl shutdown
opmnctl: shutting down opmn and all managed processes…
Unacceptable request: OPMN is terminating
<?xml version=’1.0′ encoding=’ISO-8859-1′?>
<response>
<opmn id=”mahendra.domain.com:7017″ http-status=”406″ http-response=”OPMN is terminating”>
</opmn>
</response>

Then I checked the status of opmnctl processes as shown below.

[oracle@mahendra.domain.com bin]$ ./opmnctl status

Processes in Instance: oasinfra.mahendra.domain.com
——————-+——————–+———+———
ias-component      | process-type       |     pid | status
——————-+——————–+———+———
DSA                | DSA                |     N/A | Down
LogLoader          | logloaderd         |     N/A | Down
dcm-daemon         | dcm-daemon         |     N/A | Down
OC4J               | OC4J_SECURITY      |     N/A | Down
HTTP_Server        | HTTP_Server        |    6047 | Stop
OID                | OID                |     N/A | Down

All the processes except HTTP_Server were down and even several attempts to stop HTTP Server alone could not succeed.

So, I have checked the process id that the HTTP_Server is being assigned to as shown below.

[oracle@mahendra.domain.com bin]$ ./opmnctl status -l

Processes in Instance: oasinfra.mahendra.domain.com
——————-+——————–+———+—–
ias-component      | process-type       |     pid | status   |        uid |  memused |    uptime | ports
——————-+——————–+———+—–
DSA                | DSA                |     N/A | Down     |        N/A |      N/A |       N/A | N/A
LogLoader          | logloaderd         |     N/A | Down     |        N/A |      N/A |       N/A | N/A
dcm-daemon         | dcm-daemon         |     N/A | Down     |        N/A |      N/A |       N/A | N/A
OC4J               | OC4J_SECURITY      |     N/A | Down     |        N/A |      N/A |       N/A | N/A
HTTP_Server        | HTTP_Server        |    6047 | Stop     | 1912078433 |    12328 |  00:23:20 | N/A
OID                | OID                |     N/A | Down     |        N/A |      N/A |       N/A | N/A

So, I have searched for the process identifier as shown below and it is to be killed.

[oracle@mahendra.domain.com bin]$ ps -ef | grep  1912078433
oracle    6047     1  0 12:08 ?        00:00:00 /u01/osinfra/Apache/Apache/bin/httpd -d /u01/osinfra/Apache/Apache -U 1912078433
oracle   10820 27210  0 12:31 pts/4    00:00:00 grep 1912078433

Killing the process as shown below.

[oracle@mahendra.domain.com bin]$ kill -9 6047

Few seconds later, the opmnctl processes showed not connected as shown below.

[oracle@mahendra.domain.com bin]$ ./opmnctl status
Unable to connect to opmn.
Opmn may not be up.

Now, I have started the opmnctl processes and this time I am through.

Share This

Oracle Identity Manager (OIM) : is Identity Provisioning and Reconciliation software . To know more about provisioning and reconciliation in OIM click here

Oracle Internet Directory (OID) : is LDAP (Lightweight Directory Access Protocol) compliant Directory Server from Oracle. To know more about OID click here

Oracle Identity Manager Connectors : are used to integrate OIM with third party applications (ERP, OID, Databases)

Resources/Target System : Third Party Applications (OID, EBS/ERP, CRM, Databases) to which OIM connects for reconciliation and provisioning are called as Resources (sometime also referred by Target System)

• For OID Connector, OID version 9.x, 10.1.4.x and 11Gr1 (11.1.1.X) are supported.

There are two modes in which connector can be run (either of two) Identity Reconciliation or Account Management

a) Identity Reconciliation Mode :OID is used as trusted source and users are modified and created directly in OID and then reconciled to OIM. 
At time of reconciliation,
i) Scheduled task establishes connection to OID and sends reconciliation criteria to APIs (Application Programming Interface)
ii)The APIs extract user records that matches reconciliation criteria and pass them to scheduled task
iii) Scheduled task brings the records to Oracle Identity Manager (OIM)
iv) Each record (users) fetched form OID is then compared with existing OIM users and if user record already exists then update made to user record in OID is copied to OIM user. If no match is found then user record fetched from OID is used to create an OIM User.

b) Account Management Mode: In account management mode OID is used as target resource . When configured in Account Management mode, there are two type of operations provisioning and reconciliation carried out by connector account .

Provisioning Operation: During Provisioning operation
i)Adapters carry provisioning data submitted through process form to OID.
ii)APIs on OID accepts provisioning data from adapters.
iii)APIs carry out required operation (add, update, delete) to OID and return response from OID to adapter
iv) Adapters return response back to OIM

Reconciliation Operation : During Reconciliation Operation
i)Scheduled task establishes connection to OID and sends reconciliation criteria to APIs (Application Programming Interface)
ii)The APIs extract user records that matches reconciliation criteria and pass them to scheduled task
iii) Scheduled task brings the records to Oracle Identity Manager (OIM)
iv) Each record (users) fetched form OID is then compared with existing OIM users and if user record already exists then update made to user record in OID is copied to OIM user. If no match is found then user record fetched from OID is used to create an OIM User.

For Step by Step installation of OID-OIM connector in 11g stay tuned

Share This

I have done the integration of E-Business suite with Oracle Single Sign-on today and would like to post few integration details of the same.

In my case, I am using EBS 12.0.6 and the pre-requisites is that OID should be upgraded to 10.1.4.3. The patch 5855635 should be applied in E-Business Suite machine  if the E-Business suite is running on AIX machine.

Note: You might need to check the certification matrix the exact OID version compatible for E-Business version.

All we need is to register the OID with the E-Business instance. A script txkrun.pl needs to be run for this, which will register the E-Business application in Oracle Single Sign-On server of the OID instance and registers the OID details in E-Business Suite database.

For eg; $FND_TOP/bin/txkrun.pl -script=SetSSOReg

Note: Several other parameters can be provided in the above command based on your requirement. Investigate that in the metalink article given below.

The sample output of the above script is shown below.

Enter the host name where Oracle iAS Infrastructure database is installed ? OID_HOSTNAME
Enter the LDAP Port on Oracle Internet Directory server ? OID_PORT

Enter SSL LDAP Port on Oracle Internet Directory server ? OID_SSL_PORT
Enter the Oracle Internet Directory Administrator (orcladmin) Bind password ?
Enter the instance password that you would like to register this application instance with ?
Enter Oracle E-Business apps database user password ?

You can observe that first input to be given is the hostname where Oracle iAS Infrastructure database is installed. This means you should enter the Database hostname if OID and DB are residing on different machines which is the same in our case. In fact, we should provide the OID hostname and not DB hostname.

After OID registration is completed successfully, check the OSSO application whether the EBS is registered as partner application or not and restart the OC4J_Security service.

Create an EBS user in OID (not an admin user) as shown below,

for e.g., username=operations, password=welcome1

When you access the E-Business console, it will display OSSO login page for login details and upon submitting those details, it will show another login page which is to map the operations user in E-Business, the second login page will appear only for the first time you access the E-Business console after OID registration.

For subsequent access of E-Business console, any OID user trying to login will be mapped to operations user of E-Business application.

Helpful Articles:

Metalink Note: 376811.1

Share This

• For Part I Download Software and create Schema click here 
• For Part II Install WebLogic Server 10.3.3  click here
• For Part III Install SOA Server and Upgrade to 11.1.1.3 click here
• For Part IV Install IDAM 11.1.1.3 click he
• For Part V Create Domain for OIM, OAM, OAAM, OAPM & OIN here

To initiate OIM Server configuration execute config.sh under ORACLE_HOME/bin (To create/extend Domain run config.sh under $ORACLE_HOME/common/bin)

• Select OIM Server (OIM Design Console is design time tool used by developers and available only on Windows).

• Enter OIM/MDS schema details which We created in Part I of this series here

• Enter WebLogic Admin Server URL (Admin Server should be running at this stage). Default Port for WebLogic Admin Server URL is 7001
• T3 is Oracle’s proprietary protocol used by WebLogic to transport data between WebLogic Server and other Java Programs

• If WebLogic Admin Server is not running then start Admin Server

• Enter OIM Administrator Password (xelsysadm is OIM Administrator user)
• Enter OIM HTTP URL (Default OIM Managed Server Port number is 14000)
• You can configure standalone OHS (Oracle HTTP Server) in-front of WebLogic Server using steps mentioned here

• For time being don’t select anything here (We will enable OIM for LDAP Sync and integrate with OAM later)
• Integration of OIM with OAM provides Single Sign-On (SSO) and Access Management features provided by Oracle Access Manager(OAM)

• Restart WebLogic Admin Server (stopWebLogic.sh & startWeblogic.sh)
• Start OIM Managed Server using startManagedWebLogic.sh where oim_server1 is name of OIM Managed Server

• Access OIM Admin Server using http://servername:OIM_Port/oim (default OIM Managed Server Port is 14000)
• OIM Admin User-name is xelsysadm and password you entered during OIM configuration screen above

.

Part VII : Configure Oracle Access Manager (OAM) : #OracleIdM 11g : Step by Step Installation of OAM, OIM, OAAM, OAPM, OIN coming next !!

Share This

I have performed the OID upgrade to 10.1.4.3 today. Till then, OAM was working perfectly fine. Soon after the upgrade, I restarted OID and OAM services and it went without any errors.

When I accessed the OAM consoles either (Identity or Access), it throws an error saying Invalid Credential. The Access Server logs show the error given below.

Directory is unreachable, down, or incorrect connection parameters were specified” function^LoadDBEntrySetSorted() dn^ou=Oblix, <DN>”

I am sure that login details are not changed at all.

It seems that this is a known issue with OID 10.1.4.3 when we use it as user store for OAM, tuning is required!

Workaround: 

Need to modify certain attributes of few object classes as shown below.

$ORACLE_HOME/bin/ldapmodify –h <OID host> -p <OID port> –D cn=orcladmin –w <OID superuser password> -v <EOF
dn: cn=dsaconfig,cn=configsets,cn=oracle internet directory
changetype: modify
replace: orclinmemfiltprocess
orclinmemfiltprocess:(|(!(obuseraccountcontrol=*))(obuseraccountcontrol=activated))
orclinmemfiltprocess:(|(obuseraccountcontrol=activated)(!(obuseraccountcontrol=*)))
orclinmemfiltprocess:(obapp=groupservcenter)(!(obdynamicparticipantsset=*))
orclinmemfiltprocess:(objectclass=oblixworkflowinstance)
orclinmemfiltprocess:(objectclass=inetorgperson)
orclinmemfiltprocess:(objectclass=oblixorgperson)
orclinmemfiltprocess:(objectclass=oblixworkflowstepinstance)
EOF

You can also copy it in ldif and run the ldapmodify from OID machine. Now, I am able to access the OAM consoles fine.

Helpful Articles:

Metalink article 558040.1.

PS: The workaround was suggested by a person called Gopi Goalla, Thanks to him!!

Share This