OIF 11g "Authentication request is expired" error message

Issue: 

When IDP and SP system time is not in sync you might see "Authentication request is expired" error message in OIF log messages. And you can notice "RequestDenied" status SAML message.

Error Message:

[2017-08-23T10:05:11.877-04:00] [oam_server1] [ERROR] [FED-15063] [oracle.security.fed.eventhandler.fed.profiles.utils.CheckUtils] [tid: [ACTIVE].ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 8eeddbe1def2bc04:-43c8fb68:15df144d399:-8000-000000000106474c,0] [APP: oam_server#11.1.2.0.0] Authentication request is expired.

Cause: 

When Identity Provider (OIF) and Service Provider servers system time is not in sync above error message appears.

Resolution: 

Make sure both Service Provider and Identity Provider machines system time is in sync.

Thanks
Siva Pokuri.

TIPS: Change Database Hostname After OAM security store configured

Change Database Hostname After OAM security stored configured

Issue: 

Database Hostname need to be changed after OAM security store is configured.

Changes: 

1. Login to Weblogic console and modify below connection pools 
1. Navigate to "Services > Datasources > oamDS > Connection Pool" and modify connection details
2. Navigate to "Services > Datasources > opss-DBDS > Connection Pool" and modify connection details.
3. If weblogic console is not accessible then modify two files "oam-db-jdbc.xml and opss-jdbc.xml" under <MW_HOME>/user_projects/domains/base_domain/config/jdbc.
2. Login to server and navigate to below location.
1. <MW_HOME>/user_projects/domains/base_domain/config/fmwconfig/
2. Modify jps-config-jse.xml, jps-config-migration.xml and jps-config.xml  file
3. Modify "jdbc.url" property and update with new hostname.
3. Restart Admin server and managed server.
4. Repeat step 2 in all your cluster nodes.

Expected Error if  jps-config-jse.xml, jps-config-migration.xml and jps-config.xml  files not modified.

Info: Data source is: opss-DBDS

[EL Severe]: 2017-03-14 20:39:37.575--ServerSession(1547285287)--Exception [EclipseLink-4002] (Eclipse Persistence Services - 2.3.1.v20111018-r10243): org.eclipse.persistence.exceptions.DatabaseException

Internal Exception: java.sql.SQLRecoverableException: IO Error: The Network Adapter could not establish the connection

Error Code: 17002

Mar 14, 2017 8:39:37 PM oracle.security.jps.internal.common.config.AbstractSecurityStore getSecurityStoreVersion

WARNING: Unable to get the Version from Store returning the default. Reason: java.net.ConnectException: Connection refused.

[EL Severe]: 2017-03-14 20:39:37.978--ServerSession(1619843188)--Exception [EclipseLink-4002] (Eclipse Persistence Services - 2.3.1.v20111018-r10243): org.eclipse.persistence.exceptions.DatabaseException

Internal Exception: java.sql.SQLRecoverableException: IO Error: The Network Adapter could not establish the connection

Error Code: 17002

Mar 14, 2017 8:39:37 PM oracle.security.jps.internal.credstore.ldap.LdapCredentialStore init

WARNING: Could not create credential store instance. Reason oracle.security.jps.service.policystore.PolicyStoreConnectivityException: JPS-00027: There was an internal error: java.net.ConnectException: Connection refused

JPS-01055: Could not create credential store instance. Reason oracle.security.jps.service.policystore.PolicyStoreConnectivityException: JPS-00027: There was an internal error: java.net.ConnectException: Connection refused

Error: Diagnostics data was not saved to the credential store.

Error: Validate operation has failed.

Need to do the security configuration first!

Thanks

Kiran Pokuri

Enable detailed error messages in Oracle Unified Directory 11g

Steps to enable detailed error messages in Oracle Unified Directory

1. Login to OUD Directory server installed machine

2. Navigate to OUD installed directory

In my case: /home/oracle/Oracle/Middleware_OUD/asinst_1/OUD/bin

3. Execute below command to check “return-bind-error-messages” property value

./dsconfig get-global-configuration-prop -p 4444 -h pokuri.demo.com -D "cn=Directory Manager" -j password

Note: password in the above command is a file that contains password in the same directory

Here is the sample output:

            

4. To update the “return-bind-error-messages” property value from “false” to “true” execute the below command.

./dsconfig -h pokuri.demo.com -p 4444 -D "cn=Directory Manager" -j password set-global-configuration-prop --set return-bind-error-messages:true

Note: password in the above command is a file that contains password in the same directory

Here is the sample output of the updated property:

5. Testing with sample user. After 3 unsuccessful login attempts there is a message showing “Account is locked” in the below screen.

Hope this helps !!!

Ref: http://docs.oracle.com/cd/E29407_01/reference.111200/e27801/index.html

-- Siva Pokuri.