Arjan's Oracle knowledge

Oracle XE change HTTP and FTP Port

2009-04-23T11:47:00.005+02:00


SQL*Plus: Release 10.2.0.1.0 - Production on Thu Apr 23 11:40:05 2009

Copyright (c) 1982, 2005, Oracle.  All rights reserved.

SQL> conn system/[PASSWORD]
Connected.
SQL> select dbms_xdb.gethttpport as "HTTP-Port"
            , dbms_xdb.getftpport as "FTP-Port" from dual;

HTTP-Port   FTP-Port
---------- ----------
     8080          0

SQL> begin
  2  dbms_xdb.sethttpport('8585');
  3  end;
  4  /

PL/SQL procedure successfully completed.

SQL> select dbms_xdb.gethttpport as "HTTP-Port"
            , dbms_xdb.getftpport as "FTP-Port" from dual;

HTTP-Port   FTP-Port
---------- ----------
     8585          0

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Install java SDK on linux

2009-04-23T10:20:00.002+02:00

Download the bin file from the java website:
http://java.sun.com/products/archive/

Install the package as root:

su - root

Change the execute rights:

chmod 700 jdk_*.bin

Execute the bin:

./jdk_*.bin

Java will be installed in /usr/java/

export JAVA_HOME=/usr/java/jdk...
export PATH=$JAVA_HOME/bin:$PATH

Now you can check if everthing is ok by:
which java
java -version

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

ORA-39165: Schema TMP was not found and ORA-31655: no data or metadata objects selected for job

2009-04-22T16:37:00.002+02:00

These errors can occur if the user exists and owns objects but when there are no records in any of the tables.

Error:


expdp system/[PASSWORD]@[ORACLE_SID] directory=[EXPORT_DIR] logfile=[LOG_FILE].log content=DATA_ONLY dumpfile=[DUMP_FILE].dmp schemas=[TMP] 

Export: Release 11.1.0.6.0 - Production on Wednesday, 22 April, 2009 16:26:37

Copyright (c) 2003, 2007, Oracle.  All rights reserved.

Connected to: Oracle Database 11g Release 11.1.0.6.0 - Production
Starting "SYSTEM"."SYS_EXPORT_SCHEMA_01":  system/********@[ORACLE_SID] directory=[EXPORT_DIR] logfile=[LOG_FILE].log content=DATA_ONLY dumpfile=[DUMP_FILE].dmp schemas=[TMP]
Estimate in progress using BLOCKS method...
Processing object type SCHEMA_EXPORT/TABLE/TABLE_DATA
Total estimation using BLOCKS method: 0 KB
ORA-39165: Schema [TMP] was not found.
ORA-31655: no data or metadata objects selected for job
Job "SYSTEM"."SYS_EXPORT_SCHEMA_01" completed with 2 error(s) at 16:26:41

Solution:
Remove the DATA_ONLY option, only the METADATA will be exported!!

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Manual installation ultrasearch in Oracle database

2009-04-20T16:00:00.005+02:00

Manual installation of database component ultrasearch in an Oracle database:


set echo on
spool ultrasearch.log
@$ORACLE_HOME/ultrasearch/admin/wk0setup.sql [ORACLE_HOME] "" SYS [PASSWORD SYS] "as sysdba" wksys SYSAUX TEMP "" "FALSE" DATABASE "" [ORACLE_HOME]/jdbc/lib/classes12.zip [ORACLE_HOME]/jlib/orai18n.jar [ORACLE_HOME]/jdk/bin/java /appl/oracle/db_10.2.0.4.0/ctx/bin/ctxhx [DB_HOSTNAME]:[DB_PORT]:[DB_SID] [DB_HOSTNAME]:[DB_PORT]:[DB_SID] [ORACLE_HOME]
spool off
exit

Check if the option is installed:


select comp_name, version, status from dba_registry
where COMP_ID='WK';

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Register database by listener

2009-04-20T15:36:00.002+02:00

When you want to register an database to an listener you can do this like this:


sqlplus / as sysdba
alter system register

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Redhat Linux IP configuration eth0

2009-04-16T16:48:00.003+02:00

Find the file ifcfg-eth0 normally in the directory /etc/sysconfig/network-scripts/

If an static ip address is used it should look something like:


DEVICE=eth0
BOOTPROTO=none
ONBOOT=yes
NETWORK=10.0.1.0
NETMASK=255.255.255.0
IPADDR=10.0.1.27
USERCTL=no

When DHCP is used it should look like:


DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes

After the ifcfg-eth0 file is changed the network must be restarted this can be done with the following command:

service network restart

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Share host folders on Virtual Linux machine

2009-04-16T15:54:00.004+02:00

In VMWare Workstation select the properties of the Virtual Machine and click on options. You can see an Shared Folders property. Enable this option and choose a folder on your host which you want to share.

VMWare tools need to be installed for this feature.

Now restart your virtual machine.

When the virtual machine is started you can access the shared folder in the directory /mnt/hgfs/[NAME OF THE SHARE]

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Split vmware files (vmdk) files in smaller chunks

2009-04-16T09:21:00.005+02:00

There is an application availible that makes it possible to split up files VMware vmdk files in smaller parts (this is part of vmware workstation vmware-diskmanager.exe). There is also een gui build for this: the application can be found on:

http://vmxbuilder.com/vmware-diskmanager-gui

If you want to change the name of the master vmdk file than you also need to change the vmx file. (Do not forget to copy the vmx file to the directory where the split up files are placed).

Change the entry:
scsi0:0.fileName = "NEW NAME.vmdk"

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Install VMWare tools on a linux VM

2009-04-16T09:13:00.003+02:00

First you select the option VM > Install VMWare Tools... in VMWare workstation. Than an virtual CD is mounted in your Virtual linux machine (/media/VMware_Tools). If this does not happen you should mount the cdrom manually: mount /media/cdrom. This can give an failure but this is error can be ignored.

execute the rpm file:


rpm -ivh VMwareTools-*.rpm

After the rpm is installed the configure perl script can be executed:


cd /usr/bin/
./vmware-config-tools.pl

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Install Oracle XE on Linux and configure database XE

2009-04-14T20:52:00.003+02:00

Download the rpm from the Oracle Website:
http://www.oracle.com/technology/software/products/database/xe/htdocs/102xelinsoft.html

Execute the RPM


rpm -ihv oracle-xe-univ-10.2.0.1-1.0.i386.rpm

Configure the database


su - root
cd /etc/init.d
./oracle-xe configure

Refer:
http://www.oracle.com/technology/software/products/database/xe/files/install.102/b25144/toc.htm

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Documentation, Netpoint/Oblix/CoreId/Oracle Access Manager

2009-04-10T09:47:00.008+02:00

Documentation Library Oracle Access Manager:
http://download-uk.oracle.com/docs/cd/B28196_01/index.htm

Oracle® Application Server Best Practices Guide
http://download-uk.oracle.com/docs/cd/B28196_01/core.1014/b31762/accessmgr.htm

Oracle® Access Manager Access Administration Guide
http://download-uk.oracle.com/docs/cd/B28196_01/idmanage.1014/b25990/v2config.htm#BHADBAGE

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

Integration BPEL / OID 10.1.4 Migration of LDIF data failed. Not all the entries are successfully

2009-04-09T15:28:00.020+02:00

In the document: http://download-uk.oracle.com/docs/cd/B31017_01/integrate.1013/b28982/service_config.htm#BABIBGFF is mentioned how the integration between BPEL and OID can be configured. But when this is done with OID version 10.1.4 some problems occur:

Migration of LDIF data failed. Not all the entries are successfully.
If the script configure_oid.sh is executed like this:

(Pay attention on a production system choose the option seedRequiredUsers instead of SeedAllUsers, otherwise all test users are in the OID)


cd $ORACLE_HOME/bpel/system/services/install/ant-tasks
./configure_oid.sh orcladmin <PASSWORD> 389 false us seedRequiredUsers oc4jadmin <PASSWORD> oc4j_soa
Buildfile: oid-config.xml

config-oid:
     [echo] Configuring OID...
    [mkdir] Created dir: $ORACLE_HOME/ldap/install
     [java] Install Configuration
     [java] Install Type: ConfigureOID
     [java] Oracle Home: $ORACLE_HOME
     [java] JDK Home: $ORACLE_HOME/jdk
     [java] Proxy Required: false
     [java] Database Vendor: oracle
     [java] OID Host: ${oid.host}
     [java] OID Port: 389
     [java] OID Realm: us
     [java] OID Seed: seedRequiredUsers
     [java] Admin User: orcladmin

     [java] ***************************************************************
     [java] Trying to obtain OID specific details from configuration files.
     [java] Warning: You would encounter problems if you have not associated your instance with an OID.
     [java] ***************************************************************
     [java] OID Host is: ldap.test.nl
     [java] OID Port is: 389
     [java] Seeding users/roles in OID realm : us...
     [java] Buildfile: bpminstall.xml

     [java] seed-oid:

     [java] init:

     [java] seed-oid:
     [java] Seeding system users/roles into OID ...
     [java] Migration of LDIF data failed. Not all the entries are successfully migrated
     [java] Seeding demo users/roles into OID ...
     [java] Migration of LDIF data failed. Not all the entries are successfully migrated

     [java] BUILD SUCCESSFUL
     [java] Total time: 5 seconds
     [java] Exit: 0
     [java] Configuring BPEL identity service configuration file ...
     [java] Adding jaas-mode attribute to hw_services orion-application.xml
     [java] Adding jaas-mode attribute to orabpel orion-application.xml

bpel-grant-privileges:
     [echo] Granting Server privileges to BPMSystemAdmin role...
     [echo] Granting Domain privileges to BPMDefaultDomainAdmin role...

all:

BUILD SUCCESSFUL
Total time: 11 seconds
Done

After some investigation I noticed that the ldif script that is inserted in the OID is in the directory: $ORACLE_HOME/bpel/system/services/config/ldap.

Then I tried to insert the users with the ldapadd commando an error occured:


ldapadd -h ldap.test.nl -p 389 -D cn=orcladmin -w <PASSWORD> -f system-oid_xxx.ldif
adding new entry cn=bpeladmin,cn=users, dc=us,dc=test,dc=nl
ldap_add: Constraint violation
ldap_add: additional info: Password Policy Error :9004: GSL_PWDNUMERIC_EXCP :Your Password must contain at least 1 numeric characters.

The conclusion is that there is een password policy in the OID, when this policy is changed the ldapadd works like a charm.

Change the policy in the OID:
start oidadmin > login with orcladmin > Password Policy Management > cn=pwdPolicies, cn=Common, cn=Product, cn=OracleContext > Password Policy for Realm dc=us,dc=test,dc=nl > tab Password Syntax

Change Number of Numeric Characters: 0

or you can change all passwords in the *.ldif file. But then the ant script is not working only because the ldif file is generated during the ant script.

The ldapadd command is working after the change in de oid and also when the passwords are changed:


ldapadd -h ldap.test.nl -p 389 -D cn=orcladmin -w <PASSWORD> -f system-oid_xxxx.ldif
adding new entry cn=bpeladmin,cn=users, dc=us,dc=test,dc=nl
adding new entry cn=default,cn=users, dc=us,dc=test,dc=nl
adding new entry cn=guest,cn=users, dc=us,dc=test,dc=nl
modifying entry cn=BPMSystemAdmin,cn=Groups, dc=us,dc=test,dc=nl
modifying entry cn=BPMDefaultDomainAdmin,cn=Groups, dc=us,dc=test,dc=nl
modifying entry cn=BPMWorkflowAdmin,cn=Groups, dc=us,dc=test,dc=nl
modifying entry cn=BPMWorkflowReassign,cn=Groups, dc=us,dc=test,dc=nl
modifying entry cn=BPMWorkflowSuspend,cn=Groups, dc=us,dc=test,dc=nl
modifying entry cn=BPMWorkflowViewHistory,cn=Groups, dc=us,dc=test,dc=nl
modifying entry cn=rule-administrators,cn=Groups, dc=us,dc=test,dc=nl
modifying entry cn=BPMAnalyst,cn=Groups, dc=us,dc=test,dc=nl
modifying entry cn=BPMPublic,cn=Groups, dc=us,dc=test,dc=nl

Now also the configure_oid.sh works like it supposed to. But when you use this script you must change all passwords because default the passwords are CHANGE_ME. The passwords are defined in the file: $ORACLE_HOME/bpel/system/services/config/ldap/system-oid.sbs.

You can verifiy everything is working fine by invoking the BPEL identity service:
http://<hostname>:<port>/integration/services/IdentityService/identity?operation=lookupUser

If the execution of this request results in this error:


Identity Service cannot find user. Error occurs while getting user "[USER]" in realm "jazn.com" Verify that user "[USER]" exits in realm "jazn.com". Contact oracle support if error is not fixable.

Adjust the file $ORACLE_HOME/j2ee/oc4j_soa/config/jazn.xml.


Line : provider="XML" location="./system-jazn-data.xml" default-realm="jazn.com"

Line :


provider="LDAP" location="ldap://test.nl:389" default-realm="us"

Change the $ORACLE_HOME/j2ee/oc4j_soa/config/jazn.xml the same as $ORACLE_HOME/j2ee/home/config/jazn.xml

There is another problem in the integration of BPEL and OID.
Hint : LOGON TO THE BPEL ADMIN CONSOLE FAILS - INSUFFICIENT PRIVILEGES / NO DOMAIN

There are two OC4J homes in the environment ($ORACLE_HOME/j2ee/home and $ORACLE_HOME/j2ee/oc4j_soa).
OC4J instance is associated with OID through EM.

This modifies the $ORACLE_HOME/j2ee/home/config/jazn.xml. However, it does not modify the $ORACLE_HOME/j2ee/oc4j_soa/config/jazn.xml file correctly.

$ORACLE_HOME/j2ee/oc4j_soa/config/jazn.xml


Line : provider="XML" location="./system-jazn-data.xml" default-realm="jazn.com"

Line :


provider="LDAP" location="ldap://test.nl:389" default-realm="us"

Change the $ORACLE_HOME/j2ee/oc4j_soa/config/jazn.xml the same as $ORACLE_HOME/j2ee/home/config/jazn.xml

Refers:
http://download-uk.oracle.com/docs/cd/B31017_01/integrate.1013/b28982/service_config.htm#BABIBGFF

Oracle HTTP Server on port under 1024 on Linux

2009-04-09T12:29:00.005+02:00

Execute the following commands as the root user


cd $ORACLE_HOME/Apache/Apache/bin/

chown root .apachectl
chmod 6750 .apachectl

Pay attention to the dots in front of the apachectl!!!!!!!!!!!!!!!!!

"Address already in use: make_sock: could not bind to address 127.0.0.1 port 7200", Netpoint/Oblix/CoreId/Oracle Access Manager

2009-04-07T20:01:00.005+02:00

When in the error log of the HTTP_Server ($ORACLE_HOME/Apache/Apache/logs/error_log.xxxxx) this error occures:


[Thu Mar 12 16:16:18 2009] [crit] (98)Address already in use: make_sock: could not bind to address 127.0.0.1 port 7200

Some processes of the HTTP_Server are still running and need to be killed.

"* glibc detected * realloc(): invalid size: 0x081a61f8 ***", Netpoint/Oblix/CoreId/Oracle Access Manager

2009-04-07T19:54:00.005+02:00

After the installation of the Access Server component of Oracle Access Manager the HTTP_Server needs to be restarted.

It is possible that the following error occures:


[Mon Feb 16 14:42:44 2009] [warn] pid file $ORACLE_HOME/Apache/Apache/logs/httpd.pid overwritten -- Unclean shutdown of previous Apache run?
*** glibc detected *** realloc(): invalid size: 0x081a61f8 ***

This can be solved by changing the httpd.conf file:
exclude two modules:


#LoadModule perl_module libexec/libperl.so
#LoadModule php4_module libexec/libphp4.so

Invalid Credentials Error OAM After Applying 10.1.4.3 Patchset to OID

2009-04-07T19:44:00.003+02:00

After applying patchset 10.1.4.3 to the OID, Login to Oracle Access Manager (OAM) access server/identity server/ policy manager fails with invalid credentials.

Applying OID 10.1.4.3 patchset modifies the OID attribute orclinmemfiltprocess. The new value is not correct and causes the described problem.

Execute the following query in the OID

For OID 10.1.4.3


$ORACLE_HOME/bin/ldapmodify –h <OID_HOST> -p <OID_PORT> –D cn=orcladmin –w <PASSWORD> -v <EOF 
dn: cn=dsaconfig,cn=configsets,cn=oracle internet directory 
changetype: modify 
replace: orclinmemfiltprocess 
orclinmemfiltprocess:(|(!(obuseraccountcontrol=*))(obuseraccountcontrol=activated)) 
orclinmemfiltprocess:(|(obuseraccountcontrol=activated)(!(obuseraccountcontrol=*))) 
orclinmemfiltprocess:(obapp=groupservcenter)(!(obdynamicparticipantsset=*)) 
orclinmemfiltprocess:(objectclass=oblixworkflowinstance) 
orclinmemfiltprocess:(objectclass=inetorgperson) 
orclinmemfiltprocess:(objectclass=oblixorgperson) 
orclinmemfiltprocess:(objectclass=oblixworkflowstepinstance) 
EOF

Refers: metalink note: 558040.1

Migration has failed. Please try to manually run the migration program by invoking

2009-04-07T19:33:00.004+02:00

Error during text based Installation of the Dutch Language Pack for Identity server on RedHat Linux

./Oracle_Access_Manager10_1_4_0_1_NL_linux_LP_Identity_System

Migrating language...


Migration has failed. Please try to manually run the migration program by
invoking
$ORACLE_ACCESS_MANAGER/identity/oblix/tools/migration_tools/start_obmigratenp
-c LP -f ERROR: could not read property fromMigrationVersion for bean
dsInfoInputbecause the following error occurred:
java.lang.NullPointerExceptionERROR: could not read property
fromFirstMinorVersion for bean dsInfoInputbecause the following error occurred:
java.lang.NullPointerException -t 1014 -s "ERROR: could not read property
destination for bean backupOblixDirBeanbecause the following error occurred:
java.lang.NullPointerException" -d "/appl/oracle/ident_10.1.4/identity" -i
"$ORACLE_ACCESS_MANAGER/identity".

Made an SR by Oracle Support and the solution to this problem is starting the installation with the -gui option.

Form-Based Authentication Single Sign On for Oracle SOA suite 10.1.3.x ESB console, Netpoint/Oblix/CoreId/Oracle Access Manager

2009-04-06T20:11:00.005+02:00

1. Configure ESB console with OAM

see my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application)

All the files that need to be changed are located in $ORACLE_HOME/j2ee/oc4j_soa/*

1.1 system-jazn-config.xml
Change the system-jazn-config.xml see Chapter 3.5 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application

The application name should be: esb

1.2 orion-application.xml
Change the orion-application.xml files in both directories: (applications and application-deployments) see Chapter 3.3 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application.

Replace this code:


<jazn provider="XML" location="../../config/system-jazn-data.xml" default-realm="jazn.com" jaas-mode="doAsPrivileged" />

By this code:


<jazn provider="XML" default-realm="jazn.com" jaas-mode="doAsPrivileged">
   <jazn-web-app auth-method="COREIDSSO"/>
</jazn>

1.3 web.xml
Change the web.xml see Chapter 3.1 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application.

Location:
/appl/oracle/soa_10.1.3/j2ee/oc4j_soa/applications/esb-dt/esb_console/WEB-INF

In the web.xml the following code must be replaced:


    <login-config>
                <auth-method>FORM</auth-method>
                <form-login-config>
                        <form-login-page>/login.jsp</form-login-page>
                        <form-error-page>/login_error.jsp</form-error-page>
                </form-login-config>
  </login-config>

Replace by:


    <login-config>
        <realm-name>ascontrol</realm-name>
    </login-config>

1.4 opmn.xml
Change the opmn.xml see Chapter 2.1 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application.

1.5 Policy Domain
Configure a policy domain for /em see Chapter 3.4 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application.

The only difference is that /esb needs to be protected instead of: /callerInfo/callerInfoB

Form-Based Authentication Single Sign On for Oracle SOA suite 10.1.3.x asconsole, Netpoint/Oblix/CoreId/Oracle Access Manager

2009-04-06T10:24:00.023+02:00

I will explain how SSO / OAM / Oracle SOA suite 10.1.3 asconsole can be configured.

1. Configure asconsole with OAM /em
First I will configure the asconsole, this is very easy. Before you can start configuring you need to create the user and groups in the OID this can be achieved with a trick.

1.1 Add User and Groups in the OID
Log in on the asconsole of the SOA suite with the oc4jadmin user:

http://hostname:port/em
Click on the home container > tab Administration > Identity Management

Fill in the OID settings of your OID, then automaticly the users and groups are added to the OID.

After this it is easy (see my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application)

All the files that need to be changed are located in the directory: $ORACLE_HOME/j2ee/home/*

1.2 system-jazn-config.xml
Change the system-jazn-config.xml see Chapter 3.5 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application

The application name should be: asconsole

1.3 orion-application.xml
Change the orion-application.xml files in both directories: (applications and application-deployments) see Chapter 3.3 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application.

Replace this code:


    <!-- %BEGINGOVERNSSO%

    <jazn provider="XML">
        <jazn-web-app auth-method="CUSTOM_AUTH"/>
    </jazn>

    %ENDGOVERNSSO% -->

By the following code:


<jazn provider="XML" default-realm="jazn.com" jaas-mode="doAsPrivileged">
   <jazn-web-app auth-method="COREIDSSO"/>
</jazn>

1.3 web.xml
Change the web.xml see Chapter 3.1 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application.

In the web.xml the following code must be replaced:


  <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>ascontrol</realm-name>
    <form-login-config>
      <form-login-page>/console/logon</form-login-page>
      <form-error-page>/logon_failed.html</form-error-page>
    </form-login-config>
  </login-config>

Replace by:


    <login-config>
        <realm-name>ascontrol</realm-name>
        <auth-method>BASIC</auth-method>
    </login-config>

1.4 opmn.xml
Change the opmn.xml see Chapter 2.1 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application.

1.5 Policy Domain
Configure a policy domain for /em see Chapter 3.4 of my post CoreId/Oracle Access Manager Form-Based Authentication for J2EE application.

The only difference is that /em needs to be protected instead of: /callerInfo/callerInfoB

Invoking ESB Service From BPEL Fails With Error "exception on JaxRpc invoke: HTTP transport error: javax.xml.soap.SOAPException"

2009-04-03T15:15:00.002+02:00

When the ESB service is called in an BPEL process and the next error occurs (Oracle ESB 10.1.3.x):

Invoking ESB Service From BPEL Fails With Error "exception on JaxRpc invoke: HTTP transport error: javax.xml.soap.SOAPException"

Metalink note: 427452.1

There are two options to resolve this issue:

Option 1: Configure the virtualhost and port number for a particular ESB system where services got registered.

1. Click the ESB system then configure Virtual host and Port number,
Set Virtual host to ESB Runtime Server's hostname
Set Port to ESB Runtime Server's http listening port
2. Apply the change

Option 2: Use ESB bindings to invoke ESB services.
1. Login to ESB console, and click the Routing Service which BPEL is attempting to invoke.
2. Go to "Definition" tab, and uncheck "Can be invoked from an external service"
3. Click apply.
4. Go to BPEL Console and clear the WSDL Cache.
5. Restart SOA suite

RedHat linux monitor network traffic from and to an host

2009-03-27T15:50:00.005+01:00

Interessed in what is sent over the network to an host from an progam use tcpdump:


/usr/sbin/tcpdump src host IP_ADDRESS_HOST or dst host IP_ADDRESS_HOST

IP_ADDRESS_HOST is the address of the host to which the requests are sent.

Form-Based Authentication for J2EE application, Netpoint/Oblix/CoreId/Oracle Access Manager

2009-03-25T14:04:00.099+01:00

This blog describes the steps which are needed to configure OAM/CoreId 10.1.4.2 with a sample J2EE application with Form-Based Authentication on Oracle Application Server 10.1.3 (Oracle HTTP Server 1.x)

Download the sample application callerInfo from the Oracle Website http://www.oracle.com/technology/sample_code/tech/java/codesnippet/security/jaznldap/JAZNLDAP.zip.

Install Oracle Access Manager components.

Install an Oracle Application Server for example 10.1.3.1 (Oracle HTTP Server 1.x/Apache 1.3.x)

Install WebGate 10.1.4.2 BP03 (THIS IS VERY IMPORTANT, there are some important bug fixes in BP03 WebGate see metalink note: 736372.1 for version / patchsets)

Install AccessGate 10.1.4.2 BP06 (THIS IS VERY IMPORTANT, there are some important bug fixes in BP06 AccessGate see metalink note: 736372.1 for version / patchsets)

Create an OC4J container and deploy the callerInfo.ear file.

Create users en groups in the OID:
http://www.oracle.com/technology/sample_code/tech/java/codesnippet/security/jaznldap/UsingDAS.html

1. Configure Oracle Access Manager
1. Configure Oracle Access Manager Form-Based Authentication
2. Configure Oracle Access Manager Basic Authentication
3. Configure the Resource Type
4. Protect the Action URL

1.1 Configure Oracle Access Manager Form-Based Authentication
For Single Sign-On functionality, a form-based authentication scheme must protect the resources.

1.1.1 Create a Login Form
The login form can be a very simple HTML page with an FORM in the page
- The action of the form can be an bogus link (in this example /oam/access/test.html) but this must be the same as in the authentication scheme which is created later on.
- The userid and password can be chosen freely but these will also be used in the authentication sheme.

login1.html


<HTML>
<HEAD>
</HEAD>
<body>
<center>
<h1>User Login</h1>
<br>
<br>
<form name="myForm" action="/oam/access/test.html" method="post">
Username: <input type="text" name="userid" width="20"><br />
Password: <input type="password" name="password" width="20"><br />
<input type="submit" value="OK">
</form>
</body>
<html>

This login1.html file can be placed in $ORACLE_HOME/Apache/Apache/htdocs/public.

1.1.2 Define Form-Based Authentication in Policy Manager

Go to the Access Manager GUI: http://hostname:port/access/oblix and click the Access System Console link, login with the administrator account.

Access System Console > Access System Configuration > Authentication Management

Click button Add to create an Form Based Authentication.

Fill in the entries like this:
(pay attention:

Name: COREidSSOform (choose freely)
Description: COREid SSO Form Based (choose freely)
Level: 1
Challenge Method: Form
Challenge Parameter: form: /public/login1.html (see the location in step 1.1.1)
creds: userid password (use the same variable names as in the login1.html in step 1.1.1)
action: /oam/access/test.html (use the same action as in the login1.html in step 1.1.1)
passthrough: No
SSL Required: No
Challenge Redirect Enabled: Yes

1.1.3 Configure the credential_mapping Plug-In for Form-Based Authentication

Now you have to configure the credential_mapping plugin_in for form-based authentication.

Click on tab plugin and click the button add.

First configure the credential_mapping (this is important, if password is the first plugin it will not work) select the plugin in the drop down box.

For Plugin Parameters:


obMappingBase="cn=users,dc=us,dc=oracle,dc=com",obMappingFilter="(&(&
(objectclass=inetorgperson)(uid=%userid%))(|(!
(obuseraccountcontrol=*)) (obuseraccountcontrol=ACTIVATED)))"


obCredentialPassword="password"

The value for obCredentialPassword must match the variable specified for password in the login1.html form and in the creds part of the Form Based Authentication.

This also corresponds to the value of the coreid.password.attribute option in the Oracle Access Manager login module configuration.

1.1.5 Create Host Identifier
Access System Configuration > Host Identifiers

Click Add

Name: Hostname
Description: (Choose freely)
Hostname variations: hostname:port
ip address:port

1.2 Configure Oracle Access Manager Basic Authentication

You must configure the Oracle Access Manager basic authentication scheme, which must not be password protected (only credential_mapping plug-in). This scheme will protect two resources
- A URL assouciated with resource type (myresourcetype). The Oracle Access Manager
login module will use this URL to communicate to the Access Server through the
Access Manager SDK.
- The Action URL in the login1.html (/oam/access/test.html) page. This is so submitted form requests can be
intercepted by WebGate in order to enforce rules for submitted credentials.

However the application itself must be protected by form-based authentication (steps 1.1.1 and 1.1.2)

1.2.1 Define Basic Authentication in Policy Manager
Go to the Access Manager GUI: http://hostname:port/access/oblix and click the Access System Console link, login with the administrator account.

Access System Console > Access System Configuration > Authentication Management

Click button Add to create Basic Authentication.

Fill in the entries like this:
(pay attention:

Name: COREidSSONoPwd (choose freely)
Description: Authentication without Password (choose freely)
Level: 1
Challenge Method: Basic
Challenge Parameter: realm:NetPoint Basic Over LDAP
SSL Required: No
Challenge Redirect
Enabled: Yes

1.2.2 Configure the credential_mapping Plug-In for Basic Authentication
Now you have to configure the credential_mapping plugin_in for form-based authentication.

Click on tab plugin and click the button add.

First configure the credential_mapping (this is important, if password is the first plugin it will not work) select the plugin in the drop down box.

For Plugin Parameters:


obMappingBase="cn=users,dc=us,dc=oracle,dc=com",obMappingFilter="(&(&
(objectclass=inetorgperson)(uid=%userid%))(|(!
(obuseraccountcontrol=*)) (obuseraccountcontrol=ACTIVATED)))"

The value for uid must match the variable specified for user name in the login1.html form and in the creds part of the Form Based Authentication.

This also corresponds to the value of the coreid.name.attribute option in the Oracle Access Manager login module configuration.

1.3 Configure the Resource Type

In Oracle Access Manager, a resource type describes the kind of resource to be protected, including its associated operations. Operations associated with a resource are tied to its type. You must configure an Oracle Access Manager resource type for your resource, and then protect your resource type, action URL, and application.

The Oracle Access Manager login module will need information for the resource type, as will be noted. OC4J uses the resource type to retrieve user information based on the Oracle Access Manager ObSSOCookie or the user name, using APIs of the Access Manager SDK.

1.3.1 Configure the Name and Operation of the Resource Type

Access System Console > Access System Configuration > Common Information Configuration > Resource Type Definitions

On the page that lists all resource types, choose to add a new resource type.

Make entries such as the following to define a new resource type:

Resource Name: myresourcetype (choose freely)
Display Name: myresourcetype (choose freely)
Resource Matching: Case Insensitive
Resource Operation: MYRESOURCEOPERATRION (choose freely)

You can choose any names for the resource type and resource operation, but you must use the same names for the coreid.resource.type and coreid.resource.operation option values in the Oracle Access Manager login module configuration.

1.3.2 Configure and Protect the URL of the Configured Resource Type

After authentication, OC4J requires access to the user's roles in order to check for authorization. To enable this, you must set up an Oracle Access Manager "return action" that allows Oracle Access Manager to return the appropriate roles to OC4J for the user after successful authentication.

To set up the return action in Oracle Access Manager, navigate as follows:

Policy Manager > Create Policy Domain

Policy Manager > My Policy Domains > myresourcetype > tab Resources

Create Resource for myresource type

Click button Add

Resource Type: myresourcetype (step 3.1)
Host Identifiers: hostname (step 1.5)
URL Prefix: /myresourceurl (choose freely)
Description: (choose freely)
Button Save

The URL prefix must start with a "/" and is the designated URL of the resource type. This must match the value of the coreid.resource.name option in the Oracle Access Manager login module configuration.

1.3.3 Configure the Return Action Attributes

After authentication, OC4J requires access to the user's roles in order to check for authorization. To enable this, you must set up an Oracle Access Manager "return action" that allows Oracle Access Manager to return the appropriate roles to OC4J for the user after successful authentication.

To set up the return action in Oracle Access Manager, navigate as follows:

Policy Manager > My Policy Domains > MyResourceType > Authorization Rules tab

Click button Add

Name: MyResourceType (choose freely)
Description (choose freely)
Enabled Yes
Allow takes precedence No

Click button Save

Under the Authorization Success tab section, add the following entries (continuing the preceding example using myresourcetype):

Return Type: myresourcetype
Return Name: myresourcetype
Return Attribute: ObMyGroups

1.4 Protect the Action URL

Create Resource for http type action url (/oam/access/test.html)

Policy Manager > My Policy Domains > myresourcetype > tab Resources

Create Resource for myresource type

Click button Add

Resource Type http
Host Identifiers hostname (step 1.5)
URL Prefix /oam/access/test.html action URL in login1.html
Description (choose freely)

IMPORTANT:
Do not forget to enable the policy:
My Policy Domains > MyResourceType > General

Click modify
Set Enable to Yes and click save.

Overview:

2. Configure OC4J with the Access Manager SDK
After that the SDK is installed the SDK needs be registered against the Access Server and the already installed WebGate. Pay attention the order of configuring is important. First the Access Server then the WebGate.

Configure SDK against Access Server:

Go to the directory
cd SDK_HOME/AccessServerSDK/oblix/tools/configureAccessGate


./configureAccessGate -i /SDK_HOME/AccessServerSDK/ -t AccessGate -w NAME_WEBGATE -m open -S -P PASSWORD -h ACCESS_SERVER_HOSTNAME -p ACCESS_SERVER_PORT -a ACCESS_SERVER_NAME

Output:


Preparing to connect to Access Server.  Please wait.
AccessGate installed Successfully.

Configure SDK against WebGate:


./configureAccessGate -i /SDK_HOME/AccessServerSDK/ -t AccessGate -w SDK_NAME -m open -S -P PASSWORD -h HOSTNAME_WEBGATE -p ACCESS_SERVER_PORT -a ACCESS_SERVER_NAME

Output:


Preparing to connect to Access Server.  Please wait.

AccessGate installed Successfully.

2.1 Configure the Access Manager SDK to Each OC4J Instance
You will need Oracle Access Manager SDK, one installation for each OC4J instance, on the same system as OC4J. The Access Manager SDK is required by OC4J at runtime to communicate with Access Server. OC4J must be given the Access Manager SDK location during startup (through the java.library.path property), so that it can initialize the SDK. Note this initialization occurs only if at least one application is using Oracle Access Manager as the security provider.

2.1.1 Copy jobaccess
Copy the Oracle Access Manager file jobaccess.jar from the Access Manager SDK to the OC4J path. You will find this file in the SDK_HOME/AccessServerSDK/oblix/lib directory. Create the directory ORACLE_HOME/j2ee/home/lib/ext (if it does not already exist) and copy the jobaccess.jar to that directory.

2.2 Configure the Access Manager SDK Library Path for Each OC4J Instance

Configuring opmn.xml for Oracle Access Manager

Where OC4J is managed by OPMN, add settings to opmn.xml for Oracle HTTP Server and OC4J, as follows, when you use Oracle Access Manager:

1. Set the LD_ASSUME_KERNEL environment variable to the value "2.4.19".
2. Set the LD_LIBRARY_PATH environment variable to point to the AccessServerSDK library path.
3. Add the AccessServerSDK library path to java.library.path as a start parameter.

Then restart the OC4J instances.

Following is an opmn.xml example for the OC4J home instance. Repeat these settings for the OC4J_SOA instance and any other OC4J instances as appropriate:


<ias-component id="OC4J">
   <process-type id="oc4j_callerinfo" module-id="OC4J" status="enabled">
      <environment>
         <variable id="LD_ASSUME_KERNEL" value="2.4.19"/>
         <variable id="LD_LIBRARY_PATH"
                value="/SDK_HOME/AccessServerSDK/oblix/lib" append="true"/>
      </environment>
      <module-data>
         <category id="start-parameters">
            <data id="java-options" value="-server ...
                  -Djava.library.path=/SDK_HOME/AccessServerSDK/oblix/lib
                  ... />
         </category>
         ...
      </module-data>
      ...
   </process-type>
   ...
</ias-component>

3. Configure the CallerInfo Application

3.1 Protect the Application URL's in web.xml
The first step in protecting your application is to protect appropriate URLs or URL prefixes through settings in the web.xml file, using standard J2EE features.

These are the same URLs that you will you protect through Oracle Access Manager.

And add the following code:


    <login-config>
        <auth-method>BASIC</auth-method>
    </login-config>

3.2 Settings for Application Deployment
In Oracle Application Server 10.1.3.x implementations, Application Server Control does not yet support Oracle Access Manager as a security provider. When you deploy your application using the Application Server Control Console, choose the file-based provider. This will be overridden through the configuration steps documented in this blog.

3.3 Configure Oracle Access Manager SSO in orion-application.xml
To use Oracle Access Manager Single Sign-On as the authentication method for Web applications, set the auth-method attribute to "COREIDSSO" in the element in the OC4J orion-application.xml files ($ORACLE_HOME/j2ee/CONTAINER_NAME/applications and in $ORACLE_HOME/j2ee/CONTAINER_NAME/application-deployments). You can do this as either a pre-deployment step (packaged in the EAR file) or a post-deployment step.


<jazn provider="XML" default-realm="jazn.com" jaas-mode="doAsPrivileged">
   <jazn-web-app auth-method="COREIDSSO"/>
</jazn>

You also need to add the mapping between de application role and the OID group:


<!-- mapping for realm "jazn.com" -->
<security-role-mapping name="sr_manager">
     <group name="managers" />
</security-role-mapping>
<security-role-mapping name="sr_developer">
    <group name="developers" />
</security-role-mapping>

3.4 Protect the Application URL's in Oracle Access Manager

Policy Manager > Create Policy Domain
Name : callerInfoB
Description: callerInfoB

Click button save

Tab Resources

Resource Type http
Host Identifiers hostname
URL Prefix /callerInfo/callerInfoB
Description caller info B (choose freely)

Click button Save

Tab Authorisation Rules > SubTab General

Name Everyone (choose freely)
Description Everyone (choose freely)
Enabled Yes
Allow takes precedence No

Click Save

Tab Authorisation Rules > SubTab Allow Access

Role Any one
Click Save

Tab Default Rules > SubTab Authentication Rule > SubSubTab General

Name: Form Login
Description: Form Login
Authentication Scheme: COREidSSOform

Tab Default Rules > SubTab Authorization Expression > SubSubTab Expression

Select Authorization Rule: Everyone
Click button Add > Click button Save

IMPORTANT:
Do not forget to enable the policy:
My Policy Domains > CallerInfoB > General

Click modify
Set Enable to Yes and click save.

3.5 Configure the Oracle Access Manager Login Module

For a Web application, the OC4J implementation to support Oracle Access Manager requires the login module CoreIDLoginModule, supplied by Oracle. The following template shows the general form of the configuration, in the system-jazn-data.xml file.

$ORACLE_HOME/j2ee/CONTAINER_NAME/config/system-jazn-data.xml


<application>
  <name>callerinfo</name>
    <login-modules>
      <login-module>
         <class>oracle.security.jazn.login.module.coreid.CoreIDLoginModule</class>
           <control-flag>required</control-flag>
             <options>
               <option>
                 <name>coreid.password.attribute</name>
                 <value>password</value>
               </option>
               <option>
                 <name>coreid.name.attribute</name>
                 <value>userid</value>
               </option>
               <option>
                 <name>addAllRoles</name>
                 <value>true</value>
               </option>
               <option>
                 <name>coreid.resource.operation</name>
                 <value>MYRESOURCEOPERATION</value>
               </option>
               <option>
                 <name>coreid.resource.type</name>
                 <value>myresourcetype</value>
               </option>
               <option>
                 <name>coreid.resource.name</name>
                 <value>/myresourceurl</value>
               </option>
               </options>
            </login-module>
        </login-modules>
    </application>

3.6 Test the application

WebGate will intercept this request and will check the authentication scheme for this URL. The configuration shown earlier in this chapter will result in the user being prompted with the login.html login form from "Create a Login Form". Then the following sequence will take place:

1. WebGate will capture the user name and password from the login form and communicate to Access Server.
2. Access Server will communicate to Oracle Internet Directory (or other LDAP repository that you use).
3. After the user is authenticated, the Oracle Access Manager SSO token will be returned to WebGate.
4. WebGate will set the ObSSOCookie and pass the cookie and other HTTP headers to mod_oc4j, which will route the request to the appropriate OC4J instance.
5. OC4J will take the cookie and validate it, or retrieve roles for the user associated with this cookie from Access Server using the Access Manager SDK configured on OC4J.

http://hostname:port/callerInfo

Application:

Click on the link for managers: callerInfoB

Login screen (login1.html):

Login as manager/password

Application shows roles:

Refers:
http://download.oracle.com/docs/cd/B31017_01/web.1013/b28957/coreid.htm#BJEBJCCF

Did this post help you in any way can you please leave a comment? This will motivate me writing more posts.

WebGate version and patches, Netpoint/Oblix/CoreId/Oracle Access Manager

2009-03-23T15:08:00.005+01:00

It is possible to retrieve the version and patches for Oracle Access Manager components:

For Access Server:
Login on the web interface:
http://hostname:portnumber/access/oblix

Click on Access System Console link, log in with an administrator user, click on the about link in the upper right corner and then on the button View System Info.

For WebGate
Look in the directory $ACCESS_INSTALL_DIR/access/oblix/config there is an file npXX_wg.txt. In this file there is an Release entry with the patch number.

Command line deployment war file on Oracle Application Server 10.1.2

2009-03-23T14:52:00.004+01:00

It is possible to deploy an war or ear file from the command line with an Oracle Application server 10.1.2.

Deploy war file:


$ORACLE_HOME/dcm/bin/dcmctl deployApplication -f filename.war -a "application name" -co oc4j_container -rc /contextroot

Deploy ear file:


$ORACLE_HOME/dcm/bin/dcmctl deployApplication -f filename.ear -a "application name" -co oc4j_container

The application will not be visible in the em console. An restart of the em console solves the problem.

emctl stop iasconsole
emctl start iasconsole

ErrorDocument not working for Oracle HTTP Server with OC4J

2009-03-20T17:04:00.006+01:00

When an application is deployed in an OC4J container sometimes ugly error messages are thrown in the browser (401 Unauthorised). Normally these messages can be formatted in $ORACLE_HOME/Apache/Apache/conf/httpd.conf with the ErrorDocument feature. But there is a bug in Oracle HTTP Server. This can be solved by adding the following line in $ORACLE_HOME/Apache/Apache/conf/mod_oc4j.conf


<IfModule mod_oc4j.c>
  Oc4jUseOHSErrors on
</IfModule>

And in httpd.conf:


ErrorDocument 401 "You are not authorised to view this page.

Metalink note: 560358.1

Arjan's Oracle knowledge

Oracle XE change HTTP and FTP Port

Install java SDK on linux

ORA-39165: Schema TMP was not found and ORA-31655: no data or metadata objects selected for job

Manual installation ultrasearch in Oracle database

Register database by listener

Redhat Linux IP configuration eth0

Share host folders on Virtual Linux machine

Split vmware files (vmdk) files in smaller chunks

Install VMWare tools on a linux VM

Install Oracle XE on Linux and configure database XE

Documentation, Netpoint/Oblix/CoreId/Oracle Access Manager

Integration BPEL / OID 10.1.4 Migration of LDIF data failed. Not all the entries are successfully

Oracle HTTP Server on port under 1024 on Linux

"Address already in use: make_sock: could not bind to address 127.0.0.1 port 7200", Netpoint/Oblix/CoreId/Oracle Access Manager

"*** glibc detected *** realloc(): invalid size: 0x081a61f8 ***", Netpoint/Oblix/CoreId/Oracle Access Manager

Invalid Credentials Error OAM After Applying 10.1.4.3 Patchset to OID

Migration has failed. Please try to manually run the migration program by invoking

Form-Based Authentication Single Sign On for Oracle SOA suite 10.1.3.x ESB console, Netpoint/Oblix/CoreId/Oracle Access Manager

Form-Based Authentication Single Sign On for Oracle SOA suite 10.1.3.x asconsole, Netpoint/Oblix/CoreId/Oracle Access Manager

Invoking ESB Service From BPEL Fails With Error "exception on JaxRpc invoke: HTTP transport error: javax.xml.soap.SOAPException"

RedHat linux monitor network traffic from and to an host

Form-Based Authentication for J2EE application, Netpoint/Oblix/CoreId/Oracle Access Manager

WebGate version and patches, Netpoint/Oblix/CoreId/Oracle Access Manager

Command line deployment war file on Oracle Application Server 10.1.2

ErrorDocument not working for Oracle HTTP Server with OC4J

"* glibc detected * realloc(): invalid size: 0x081a61f8 ***", Netpoint/Oblix/CoreId/Oracle Access Manager