OIF 11g: Federation Fails With time sync issue between SP and IDP

Issue:

OIF 11g partners are running out of sync in the time.  
That let's fail the federation with the error message: "AuthnResponse failed validation due to an invalid condition related to time".

Available solutions to fix the issue.

Solution 1: Solution Make sure that all the OIF partners are timely in sync.

Solution 2: But as a complete time sync accross all OIF partners could be challenging to accomplishand and verify, then there is actually this ... :
ER 16906719 - FEDERATION FAILS WHEN IDP AND SP ARE NOT TIMLY IN SYNC - CLOCKS SKEW NEEDED

... that has been implemented, and which allows now to set a time clockdrift delta for the times on the SAML Assertion Conditions->NotBefore
The ER (Enhancement Request) bug is implemented only in 11.1.2.2.0 (11gR2 PS2).
So, the OAM/OIF Federation 11.1.2.2.0 has been enhanced to support setting outgoing clock drift adjustment, using WLST command updatePartnerProperty with "senderserverclockdrift" property.

The relevant documentation the WLST command as for this  11.1.2.2.0  release is available at : http://docs.oracle.com/cd/E40329_01/web.1112/e28155/custom_infra_security.htm#CHDEECBH

PS: Oracle Support strongly suggests and recommends the customers to move to the newer releases versions of the products as they use, and thus to benefit to the new available features as well as known bugs fixes.

Solution 3: If you cannot really move or plan to upgrade to OIF 11gR2PS2 for now, but still desperately need this ER fix, then an One-Off patch for the ER (Enhancement Request) bug 16906719  backport as on top of OIF 11gR1 11.1.1.6.0 has been completed.

The patch 16906719 is available from My Oracle Support as per patch 16906719

--> Patch 16906719: FEDERATION FAILS WHEN IDP AND SP ARE NOT TIMELY IN SYNC - CLOCKS SKEW NEEDED (Patch)

p16906719_111160_Generic.zip   59.2 KB

So, if you use the exact release of OIF 11gR1 11.1.1.6.0 version and still would like the fix of this, then please download Patch 16906719 and review the patch README file as included in the zip for patch installation.

Please test this on your testing environment, before moving it to Production environment.

As per this patch 16906719, the OIF 11gR1 11.1.1.6.0 is enhanced with the backport of this bug in order to support setting outgoing clock drift adjustment, using the below WLST command to configure OIF 11.1.1.6.0 :

- setConfigProperty("serverconfig", "senderserverclockdrift", "VALUE_IN_SECONDS", "long")
for OIF global setting, replace VALUE_IN_SECONDS by the value in seconds

- setFederationProperty("PROVIDER_ID", "senderserverclockdrift", "VALUE_IN_SECONDS", "long")
replace VALUE_IN_SECONDS by the value in seconds and PROVIDER_ID by the partner's ProviderID

Test case:
- set up Fed SSO for SAML2.0
- configure IdP using the WLST commands listed above
- at SP, go to test sp sso
- perform Fed SSO with IdP
- in the result, see the SAML assertion
- look for Conditions->NotBefore

Without fix it will be equals to IssueInstant (in Assertion)

With fix it will be equals to IssueInstant (in Assertion) minus senderserverclockdrift

PS: This patch is only applicable to OIF 11gR1 11.1.1.6.0 and you might need to double-check with possible patches conflict (as if you might have other existing OIF 11gR1 patches as running on the same environment).
4)* If you use any other OIF 11gR1 11.1.1.x (other than the OIF 11.1.1.6.0), then there is currently no other patch available on the same for OIF 11.1.1.x, and thus you would need to double check with OIF product support team on any further specific request on the same.
But still, the best option and recommended solution is to really move to newer version of OAM/OIF 11gR2PS2 11.1.2.2.0 and/or any later/newer version coming after it.

Thanks
Siva Pokuri

The HTTP Filter DLL C:\oracle\product\11.1.1\as_1\webgate\iis\lib\webgate.dll failed to load. The data is the error.

The HTTP Filter DLL C:\oracle\product\11.1.1\as_1\webgate\iis\lib\webgate.dll failed to load.  The data is the error. 

Could not load all ISAPI filters for site 'examplesite'.  Therefore site startup aborted.

ISSUE:

After installation of IIS7 webgate on Windows 2008 R2 when a protected

resource is accessed following error is displayed

ERROR:

The HTTP Filter DLL C:\oracle\product\11.1.1\as_1\webgate\iis\lib\webgate.dll

failed to load.The data is the error.Could not load all ISAPI filters for site 'examplesite'.  

Therefore site startup aborted.

CAUSE:

Missing Microsoft VC++ libraries and incorrect information in webgate.ini file

To resolve above issue:

1. Download and install Visual C++ Redistributable for Visual Studio 2012 Update 4 64bit on windows 2008 R2 machine where IIS webgate is installed.
2. Now try to access protected resource.
3. You should be successfully redirected to login page

JPS-10702: The datasource jdbc/OPSSDBDS is not found.

JPS-10702: The datasource jdbc/OPSSDBDS is not found.

Issue: Failed to initialize the applcation jdbc/OPSSDBDS due to error weblogic.application.ModuleException

Note: 1 Generally you can face following below issue when your OIM&OAM schemas passwords got expired.

Note: 2 There will be a case like when OIM&OAM schemas got expired and passwords are changed to default or custom or random passwords. When you try starting Weblogic(Adminserver)or Managed Server you will face error like ORA-01017: invalid/password; login denied.

Note: 3 In some cases you can be able to access OIM or OAM schemas using sqldeveloper or using any clients but still you can face error ORA-01017: invalid/password; login denied while starting  Weblogic(Adminserver)or Managed Server

                                       

To Resolve Issue

1.  Contact your DBA to reset schema password got expiredOnce password reset is done using sqldeveloper or using any sql client
2. Try to access all OIM&OAM realted schemas you should be able to connect successfully.
3. Login to WebLogic Server Administration console (default port 7001) http://hostname:port/console
4. Select Data Sources under JDBC in Services section you can able to see list of data sources
5. Click on particular data sources---->connection pools---> Password--->New Password--->save it
6. Click on example Data sources for which you need to change password and in testing tab you can test your data source
7. Now you should be able to start Admin and Managed servers successfully.