TIPS: Change Database Hostname After OAM security store configured

Change Database Hostname After OAM security stored configured

Issue: 

Database Hostname need to be changed after OAM security store is configured.

Changes: 

1. Login to Weblogic console and modify below connection pools 
1. Navigate to "Services > Datasources > oamDS > Connection Pool" and modify connection details
2. Navigate to "Services > Datasources > opss-DBDS > Connection Pool" and modify connection details.
3. If weblogic console is not accessible then modify two files "oam-db-jdbc.xml and opss-jdbc.xml" under <MW_HOME>/user_projects/domains/base_domain/config/jdbc.
2. Login to server and navigate to below location.
1. <MW_HOME>/user_projects/domains/base_domain/config/fmwconfig/
2. Modify jps-config-jse.xml, jps-config-migration.xml and jps-config.xml  file
3. Modify "jdbc.url" property and update with new hostname.
3. Restart Admin server and managed server.
4. Repeat step 2 in all your cluster nodes.

Expected Error if  jps-config-jse.xml, jps-config-migration.xml and jps-config.xml  files not modified.

Info: Data source is: opss-DBDS

[EL Severe]: 2017-03-14 20:39:37.575--ServerSession(1547285287)--Exception [EclipseLink-4002] (Eclipse Persistence Services - 2.3.1.v20111018-r10243): org.eclipse.persistence.exceptions.DatabaseException

Internal Exception: java.sql.SQLRecoverableException: IO Error: The Network Adapter could not establish the connection

Error Code: 17002

Mar 14, 2017 8:39:37 PM oracle.security.jps.internal.common.config.AbstractSecurityStore getSecurityStoreVersion

WARNING: Unable to get the Version from Store returning the default. Reason: java.net.ConnectException: Connection refused.

[EL Severe]: 2017-03-14 20:39:37.978--ServerSession(1619843188)--Exception [EclipseLink-4002] (Eclipse Persistence Services - 2.3.1.v20111018-r10243): org.eclipse.persistence.exceptions.DatabaseException

Internal Exception: java.sql.SQLRecoverableException: IO Error: The Network Adapter could not establish the connection

Error Code: 17002

Mar 14, 2017 8:39:37 PM oracle.security.jps.internal.credstore.ldap.LdapCredentialStore init

WARNING: Could not create credential store instance. Reason oracle.security.jps.service.policystore.PolicyStoreConnectivityException: JPS-00027: There was an internal error: java.net.ConnectException: Connection refused

JPS-01055: Could not create credential store instance. Reason oracle.security.jps.service.policystore.PolicyStoreConnectivityException: JPS-00027: There was an internal error: java.net.ConnectException: Connection refused

Error: Diagnostics data was not saved to the credential store.

Error: Validate operation has failed.

Need to do the security configuration first!

Thanks

Kiran Pokuri

Update: Oracle IDM Suite BP 11.1.2.3.170117 (Patch 25038775) with OAM login page bookmark fix

Oracle released a new build patch yesterday for Oracle IDM 11g R2 PS3 release.

It looks like Oracle Access Manager introduced feature with "Ability to access login form from favourites(Bookmarks)".

I just noticed and thought to share it. I will have to give it a try. If you are already running on PS3 give it a try and share the experience.

Hope it helps some one out there.

-- Siva Pokuri.

Highlights of OAM PS3 Integration with EBS 12.2 for Single Sign-On

Hello Readers

Here are some highlights of EBS 12.2 SSO integration with OAM 11gR2 PS3.

1. Oracle Guide for this integration is 1576425.1. 
2. EBS 12.2 is pre-packaged with Oracle WebLogic Server 10.3.6 and WebTier 11g. WebTier 11g is 11.1.1.9. 
3. In EBS 12.2 OAM SSO integration, the need of separate WebLogic server for Access Gate and separate OHS for webgate setup has been eliminated.
4. OAM PS3 OHS webgate needs OHS to be atleast 11.1.1.9. In case if WebTier in EBS environment is less than that version, upgrade it to 11.1.1.9 for SSO to work.
5. OAM PS3 has be patched atleast BP03.
6. EBS comes with 3 automation scripts for configuring required artifacts for this SSO integration.
• This script installs webgate. 
txkrun.pl -script=SetOAMReg -installWebgate=yes -webgatestagedir=/u90/webgate
• This script deploys AccessGate
perl $AD_TOP/patch/115/bin/adProvisionEBS.pl -ebscreate=oaea_resources -contextfile=$CONTEXT_FILE  -deployApps=accessgate -SSOServerURL=<<OAM_Managed_Server_URL>> -managedsrvname=oaea_server1  -managedsrvport=6803 -logfile=/tmp/deployeag.log
• This script registers EBS with OAM and will also modify webgate for EBS logout URLs automatically
txkrun.pl -script=SetOAMReg -registeroam=yes

         7. Verify the WebGate is working first by testing http://<<ohs_host:port>>/index.html
         8.  Ensure that respective OAM Authorization policy is returning orclguid in responses. You can also test                  this by protecting cgi script in OHS directory.

Fix: OAM 11g Custom Authentication Plugin Activation Failed With Felix Bundle Exception

Error:

[2016-05-31T11:19:17.173-04:00] [oam_server1] [WARNING] [] [oracle.oam.extensibility.lifecycle] [tid: OAM Map Notification:MessageListenerWrapper] [userId: <anonymous>] [ecid: 0000LK7NL4x4epo5GVl3if1NJQ^h000004,1:24194] [APP: oam_server#11.1.2.0.0] Activation failed due to felix bundle exception while installing and starting the bundle.null[[

java.lang.reflect.InvocationTargetException

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

        at java.lang.reflect.Method.invoke(Method.java:606)

        at oracle.security.am.plugin.internal.OSGIPluginService.installAndStartBundle(OSGIPluginService.java:177)

        at oracle.security.am.extensibility.lifecycle.messaging.NodeMessageListener.installAndStartBundle(NodeMessageListener.java:66)

        at oracle.security.am.extensibility.lifecycle.messaging.NodeMessageListener.receiveMessage(NodeMessageListener.java:112)

        at oracle.security.am.extensibility.lifecycle.messaging.NodeMessageListener.receiveMessageList(NodeMessageListener.java:49)

        at oracle.security.am.extensibility.lifecycle.messaging.MessageListenerWrapper.objectCreated(MessageListenerWrapper.java:30)

        at oracle.security.am.foundation.mapimpl.coherence.events.MapListenerWrapper.notifyListener(MapListenerWrapper.java:174)

        at oracle.security.am.foundation.mapimpl.coherence.events.EventDispatcher.dispatch(EventDispatcher.java:132)

        at oracle.security.am.foundation.mapimpl.coherence.events.EventDispatcher.run(EventDispatcher.java:114)

Solution:

1. Deleted the entire "/tmp" folder in the Domain Home for BOTH OAM WLS Manage Server and Admin Servers
2. Restart the OAM Server.
3. Redeploy, distribute and activate plugins again.

-- Siva Pokuri.

OAM 11g R2 PS3 Twitter Social Auth video

-- Siva Pokuri.

OAM 11g R2 PS3 Yahoo Social Authentication demo video

-- Siva Pokuri.

Oracle Access Manager(OAM) 11g R2 PS3 Facebook Social Authentication demo video

-- Siva Pokuri.

Oracle Access Manager(OAM) 11g R2 PS3 Google OAuth Social Authentication demo video

Hi All,

I have got chance to do a quick POC on OAM social authentication with Google. Below is the demo video for the same. I will try to post brief steps soon. 

Reference Oracle support doc: How to Protect a Resource With the Google Social Identity Provider (Doc ID 2106718.1)

-- Siva Pokuri.

WATCH: Oracle Access Manager(OAM) 11g R2 PS3 Impersonation Demo

Oracle Access Manager 11g R2 PS3 Impersonation Demo

Pre-requisites:

1. OAM 11g R2 PS3 environment is up and running with OUD as user store & protected sample resource called “spokuri.html” with LDAPSchema
2. Enabled Impersonation in OAM & Extend OAM LDAP schema into OUD directory server
3. Created user “kpokuri”(Impersonatee) with “orclIDXPerson” object class in OUD
4. Created user “spokuri”(Impersonator) in OUD
5. Added an attribute “orclImpersonationGrantee” to “kpokuri” and value as “8c69d7465afc406a947669204ad88ecf|20100324163000Z|20180524172000Z”

Description: orclImpersonationGrantee attribute value has 3 parameters separated by pipe “|”.

1.     Impersonator orclguid. In this case, it’s “spokuri” user orclguid.

2.     Impersonation start date

3.     Impersonation end date

Demo Video: 

Test Case:

1. Access OAM LDAP Schema protected resource http://pokuri.demo.com:7777/spokuri.html
2. Enter impersonator credentials spokuri/<<password>>
3. Open a new tab and access http://pokuri.demo.com:14100/oam/server/impersonate/start?userid=kpokuri&success_url=http://pokuri.demo.com:7777/kpokuri.html&failure_url=http://pokuri.demo.com:7777/error.html
4. When prompted enter impersonator password again
5. Up on successful impersonation to user “kpokuri” new session will be created in OAM for user “kpokuri”.
6. Check the “kpokuri” user session in OAM admin console “session management” and notice that impersonation field will be “true”.

Hope this helps some one out there!!

-- Siva Pokuri.

How to upgrade OAM 11G R2 PS2 to PS3

Oracle Access Manager 11GR2PS2 Upgrade to PS3

1. Start the executable and follow the steps below for binary installation.  

2. Navigate to <MW_HOME>/oracle_common/bin/ and execute ./psa.

3. Upgrade the Patch set as the below screen shots.

4. Navigate to <MW_HOME>/oracle_common/common/bin/

5. Execute ./wlst.sh  and follow the screen shots below.

6. Restart both OAM managed server and WLS Admin server.

7. Access the OAM admin console "http://<wls_host>:<wls_port>/oamconsole" 

I hope this is helpful.

Thanks !!!

Kiran Pokuri