OPSS Unable to start WL Server XML20108 Fatal Error JPS02592 Failed To Push Ldap Config Data To LibOvd

Issue:

 Jun 21, 2016 7:03:16 PM oracle.security.jps.internal.igf.ovd.OvdIGFServiceProvider pushLdapNamesTolibOvd SEVERE: JPS-02592
<Jun 21, 2016 7:03:16 PM SGT> <Error> <Security> <BEA-090892> <The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.>
<Jun 21, 2016 7:03:16 PM SGT> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: weblogic.security.SecurityInitializationException: The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
weblogic.security.SecurityInitializationException: The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.loadOPSSPolicy(CommonSecurityServiceManagerDelegateImpl.java:1402)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1022)
        at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:873)
        at weblogic.security.SecurityService.start(SecurityService.java:141)
        at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
        Truncated. see log file for complete stacktrace
Caused By: oracle.security.jps.JpsRuntimeException: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:172)
        at oracle.security.jps.internal.policystore.JavaPolicyProvider.<init>(JavaPolicyProvider.java:375)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        Truncated. See log file for complete stacktrace

Resolution:

1.       Please verify whether your file system having disk space issues ($df -h in case of Linux). One of the causes of XML files corruption is seen when there is a filesystem full condition.

2.       If it is not relates to file system space issues, then it might be because of corrupted adapters.os_xml

3.       As additional symptom $DOMAIN_HOME/config/fmwconfig/ovd/default/server.os_xml was detected as zero (0) bytes.

Corruption of the adapters.os_xml or server.os_xml under this LibOVD location file may lead to Weblogic server startup failure.

Please navigate to the fmwconfig folder and check the adapters.os_xml or server.os_xml file or both
$DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml

There are chances the any of those xml file could be corrupted due to which the Weblogic server fails to start.

4.       In case the file is corrupted, please perform the following steps:

a.       Take a backup of $DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml  or  server.os_xml

b.      Delete corrupted adapters.os_xml or server.os_xml files under
 $DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml

c.       Copy adapters.os_xml or server.os_xml from
         $MW_HOME/oracle_common/modules/oracle.ovd_11.1.1/templates/ to
         $DOMAIN_HOME/config/fmwconfig/ovd/default/. Or restore files from backup.

5.        Restart the server. It should works!!

 Hope this post helps you to resolve this issue.

UseFul LDAP queries

Creating users in OID with LDIF scripts:
command: ldapadd -c -h servername -p 389 -D cn=orcladmin -w myPassword -f createUsers.ldif
script:
cn=jdoe,cn=Users,dc=myDivision,dc=myCompany
cn=jdoe
sn=jdoe
objectclass=top
objectclass=person
objectclass=organizationalPerson
objectclass=inetorgPerson
objectclass=orclUserV2
description=John Doe
userpassword=welcome2011
mail=john.doe@mycompany.com

Creating groups in OID with LDIF scripts:
command: ldapadd -c -h servername -p 389 -D cn=orcladmin -w myPassword -f createGroups.ldif
script:
cn=MyGroup,cn=groups,dc=myDivision,dc=myCompany
cn=MyGroup
objectclass=top
objectclass=orclGroup
objectclass=groupOfUniqueNames
owner=cn=orcladmin
displayname=MyGroup
description=My Script Created Group
orclisvisible=true

Remove members from groups in OID with LDIF scripts:
command: ldapmodify -c -h servername -p 389 -D cn=orcladmin -w myPassword -f removeMembersFromGroup.ldif
script:
dn: cn=myGroup,cn=groups,dc=myDivision,dc=myCompany
changetype: modify
delete: uniquemember

Add members to groups in OID with LDIF scripts:
command: ldapmodify -c -h servername -p 389 -D cn=orcladmin -w myPassword -f addMembersToGroup.ldif
script:
dn: cn=myGroup,cn=groups,dc=myDivision,dc=myCompany
changetype: modify
add: uniquemember
uniquemember: cn=jdoe,cn=Users,dc=myDivision,dc=myCompany
uniquemember: cn=user2,cn=Users,dc=myDivision,dc=myCompany
uniquemember: cn=user3,cn=Users,dc=myDivision,dc=myCompany

Disable users in OID with LDIF scripts:
command: ldapmodify -c -h servername -p 389 -D cn=orcladmin -w myPassword -f DisableUsers.ldif
script:
cn=jdoe,cn=Users,dc=myDivision,dc=myCompany
changetype: modify
orclisenabled :DISABLED