java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

Issue:

java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)

        at java.security.AccessController.checkPermission(AccessController.java:560)

        at oracle.security.jps.util.JpsAuth$AuthorizationMechanism$3.checkPermission(JpsAuth.java:458)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:518)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:544)

        Truncated. see log file for complete stacktrace

Caused By: java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)

        at java.security.AccessController.checkPermission(AccessController.java:560)

        at oracle.security.jps.util.JpsAuth$AuthorizationMechanism$3.checkPermission(JpsAuth.java:458)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:518)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:544)

        Truncated. see log file for complete stacktrace

Fix/Resolution:

1.       Take the backup of weblogic.policy file to recover easily in case of any issues.

a.        Go to $WLS_HOME/server/lib/weblogic.policy

b.       cp weblogic.policy weblogic.policy_backup

2.       Add the below lines(end of the file) into weblogic.policy file

                        grant codeBase "file:$MW_HOME/patch_wls1036/patch_jars/*" {

permission java.security.AllPermission;

};

3.       Take the backup of system-jazn-data.xml file to recover easily in case of any issues

a.        Go to $DOMAIN_HOME/config/fmwconfig/system-jazn-data.xml

b.       $cp system-jazn-data.xml system-jazn-data.xml_backup

4.       Add the below lines (end of the file) into $DOMAIN_HOME/config/fmwconfig/system-jazn-data.xml:

<grant>

  <grantee>

    <codesource>

      <url>file:${wls.home}/../../patch_wls1036/patch_jars/*</url>

    </codesource>

  </grantee>

        <permissions>

                        <permission>
 <class>oracle.security.jps.service.credstore.CredentialAccessPermission</class>

     <name>context=SYSTEM,mapName=oim,keyName=*</name>

     <actions>read,write</actions>

                        </permission>

   </permissions>

</grant>

5.        Restart Admin and managed servers.

            NOTE: Kindly note, MW_HOME will vary from environment to environment depends on your machine path.

                          Also, similar solution is applicable to any component like OAM/OIF/OID etc..

           Hope this post helps you to resolve this issue. 

          

           Thank you for reading out my blog !!

OPSS Unable to start WL Server XML20108 Fatal Error JPS02592 Failed To Push Ldap Config Data To LibOvd

Issue:

 Jun 21, 2016 7:03:16 PM oracle.security.jps.internal.igf.ovd.OvdIGFServiceProvider pushLdapNamesTolibOvd SEVERE: JPS-02592
<Jun 21, 2016 7:03:16 PM SGT> <Error> <Security> <BEA-090892> <The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.>
<Jun 21, 2016 7:03:16 PM SGT> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: weblogic.security.SecurityInitializationException: The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
weblogic.security.SecurityInitializationException: The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.loadOPSSPolicy(CommonSecurityServiceManagerDelegateImpl.java:1402)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1022)
        at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:873)
        at weblogic.security.SecurityService.start(SecurityService.java:141)
        at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
        Truncated. see log file for complete stacktrace
Caused By: oracle.security.jps.JpsRuntimeException: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:172)
        at oracle.security.jps.internal.policystore.JavaPolicyProvider.<init>(JavaPolicyProvider.java:375)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        Truncated. See log file for complete stacktrace

Resolution:

1.       Please verify whether your file system having disk space issues ($df -h in case of Linux). One of the causes of XML files corruption is seen when there is a filesystem full condition.

2.       If it is not relates to file system space issues, then it might be because of corrupted adapters.os_xml

3.       As additional symptom $DOMAIN_HOME/config/fmwconfig/ovd/default/server.os_xml was detected as zero (0) bytes.

Corruption of the adapters.os_xml or server.os_xml under this LibOVD location file may lead to Weblogic server startup failure.

Please navigate to the fmwconfig folder and check the adapters.os_xml or server.os_xml file or both
$DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml

There are chances the any of those xml file could be corrupted due to which the Weblogic server fails to start.

4.       In case the file is corrupted, please perform the following steps:

a.       Take a backup of $DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml  or  server.os_xml

b.      Delete corrupted adapters.os_xml or server.os_xml files under
 $DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml

c.       Copy adapters.os_xml or server.os_xml from
         $MW_HOME/oracle_common/modules/oracle.ovd_11.1.1/templates/ to
         $DOMAIN_HOME/config/fmwconfig/ovd/default/. Or restore files from backup.

5.        Restart the server. It should works!!

 Hope this post helps you to resolve this issue.

How to checks the logs for Weblogic/SOA/OIM and OAM Servers in Linux

Server Log locations :

1. Weblogic Server : $DOMAIN_HOME/servers/Admin_server and view admin_server_diagnostic.log

2. SOA Server : $DOMAIN_HOME/servers/soa_server1 and view soa_server1_diagnostic.log

3. OIM Server : $DOMAIN_HOME/servers/oim_server1 and view oim_server1_diagnostic.log

4. OAM Server : $DOMAIN_HOME/servers/oam_server1 and view oam_server1_diagnostic.log

Enabling The Logging in OIM 11g

Enabling The Logging in OIM 11g

Any Custom Schedule Task and Event Handlers to debug in the OIM 11g Server to enable the logging. The following way to enable the logging in Oracle Identity Manager 11g.

Pre-Requisite

Java Code Configuration

Add the following line into your java code.

Import Statement

import com.thortech.util.logging.Logger;

private Logger logger=Logger.getLogger("Logger-Name");

Configuration Of Logging
Go to the $DOMAIN_HOME/config/fmwconfig/servers/oim_server1 directory and edit the logging.xml file.

Configure The Log Handler

< log_handler name='logger Handel Name' level='FINEST' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
< property name='logreader:' value='off'/>
< property name='path' value='Log File Location'/>
< property name='format' value='ODL-Text'/>
< property name='useThreadName' value='true'/>
< property name='locale' value='en'/>
< property name='maxFileSize' value='5242880'/>
< property name='maxLogSize' value='52428800'/>
< property name='encoding' value='UTF-8'/>

Include The Logger Handler Logger Configuration

< logger name="Logger-Name" level="Log Level" useParentHandlers="false">
< handler name="logger-Handel-Name"/>
< handler name="console-handler"/>
< /logger>

Oracle Identity Manager 11G Log Levels

Log Level ODL Message Type:Level

SEVERE.intValue()+100   INCIDENT_ERROR:1
SEVERE                             ERROR:1
WARNING                        WARNING:1
INFO                                  NOTIFICATION:1
CONFIG                            NOTIFICATION:16
FINE                                 TRACE:1
FINER                              TRACE:16
FINEST                            TRACE:32

The FINEST log level will give the more debug info. If you want to debug your schedule task or event handlers, please use FINEST Log level.

Also, you can change the log levels using EM console as well.

Please refer the below URL for more information on this Loggers
http://docs.oracle.com/cd/E21764_01/doc.1111/e14308/log.htm#OMADM4235

Configure OID as User Identity Store for OAM 11G R2 PS2

OAM’s default user store is weblogic’s embedded ldap server which is not a recommended user store for production environment.

After OAM installation it is suggested to set Oracle Internet Directory as OAM’s primary identity store.

Steps to configure OAM to use OID as Identity Store:

1. Create a group called “Administrators” in OID under dc= <your_domain>, cn=groups using ODSM

2. Create a user in OID under dc= <your_domain>, cn=users (This user will be used to connect to login to oam console)

3. Add this user to the “Administrator” group in OID. Use ODSM to create user/group in OID 11g

4. Login to OAM Console (http://server:7001/oamconsole where 7001 is Weblogic admin server port on which OAM is deployed)

5. Click tab “System Configuration” and select User Identity Stores under Data Source

6. From Actions -> select Create

7. Specify OID server location and credentials along with Users and Groups search base and click on Test Connections

8. Click Apply when connection is successful

9. Select newly created User Store from OAM Console and click “Set as System Store”. Also select “Set as Default Store”

10. Add the group Administrator that was created in OID to this Identity Store which will make users under this group to act as ‘admin’ for OAM. Click Apply.

11. In OAM console under System Configuration tab, go to Access Manager->Authentication modules–> LDAP Authentication Module.

Double click LDAP and change identity store to the New System Store value–> Click Apply

12. Log out from OAM console and login using newly created user in OID

Difference Between DCC and ECC in OAM

DCC : Detached Credential Collector (AKA Authenticating Webgate), new feature introduced in  11gR2

ECC  : Embedded Credential Collector, default 11g behavior

In OAM 10g user credentials are submitted to Webgate and than Webgate communicate to OAM server with mitigate the changes. when OAM 11G version was introduced, it had different flow. user credentials are submitted to Webgate and Webgate displays OAM server login page(for credential collection). so, you have to expose OAM server for credentials submissions that is not a good practice for companies who don't want to have  OAM exposed, it is security volatility for them. so Oracle provided DCC feature in OAM 11gR2.
Now, when you are configuring 11gR2 Webgate you have a check box "Allow Credentials Collector Operators". if you click this check box users credentials will be submitted to Webgate(middle tier) and Webgate will submit user credentials to OAM server.
DCC is the way to go now a days, now companies have option to separate Webgate in web tire from OAM server.
Access Manager supports the embedded credential collector (ECC) by default and also enables you to configure the latest Webgate to use as a detached credential collector (DCC, also known as an Authenticating Webgate).

For more detailed information, please refer the below URL :
http://www.ateam-oracle.com/part-2-custom-login-and-logout-with-detached-credential-collector-dcc/

WebGate plug-in is unable to contact any Access Server

One of the most common error in OAM is "WebGate plug-in is unable to contact any Access Server".

First of all, there are many reasons for this error to happen. Most of the time it is environment specific and hence, there is no straight forward/standard solution to this error.

However, the issue must be resolved if following points are verified to be working

1. As the error clearly states that webgate is not able to connect Access Server. There could be a connection problem between webgate & Access Server. check if firewall is terminating the connection between webgate & Access Server.

2. Check if the Access Server is up & running by issuing netstat command and look for the Access Server ip and port number.

3. Check if other webgates connected to Access Server is able to connect. If other webgates are connecting then it rule out the problem with Access Server.

4. Restart Access Server and Webserver. If restarting resolves the issue it means that while restarting Access Server terminates the old connections and new connection is being established.

5. Make sure all the components involved in OAM architecture is working fine for ex: directory server, load balancer, firewalls, database etc.

6. If it is a new installation, then verify the clock settings of Access Server host and webgate host. Access Server clock must be running ahead of webgate.

7. Verify the webgate diagnostic page. http(s)://hostname:port/access/oblix/apps/ webgate/bin/webgate.cgi?progid=1. If the page is not opening then webgate is not installed correctly.

8. If the Access Server and Webgate are configured in CERT mode then check if certificate is Valid.

9. Change the log level to TRACE and diagnose the oblog.log file for Access Server and Webgate.

OAM 11g Webgate Flow

OAM 11g Webgate flow:

   1. An OAM 11g Webgate intercepts the incoming request for a resource, determines whether the resource is protected.

          a.  If it is Unprotected : User will able to see the requested application page without authentication and  authorization.
       
        b.  If it is Protected – the OAM 11g server constructs and returns a response back to the Webgate. That response contains the authentication scheme required to authenticate the user.
  
   2. Next the Webgate sets a cookie (OAM_REQ) to keep track of the target/requested URL and then redirects to the OAM 11g server, which routes the request to the credential collector.
   
   3. The detached credential collector (DCC) serves up the login page, which captures credentials and posts the credentials to the OAM server.
  
   4. The credentials are validated against the ID store configured for this particular authentication scheme.

   5. Once the credentials are validated, the OAM server creates an authentication token, the session in Coherence, and creates a server side session cookie called the OAM_ID cookie, which has details about the user, the time the session was created, the idle timeout, and session identifier to the coherence session.
   
   6. Then the OAM server constructs a response which is encrypted with the Webgate's key and redirects to the Webgate.
  
   7. The Webgate decrypts the response, extracts the authentication token and the session identifier, and uses that information to set OAMAuthnCookie, which is set as a host cookie: OAMAuthnCookie_. (In this step if you are using an OAM 10g webgate, the response from the server will contain the information required to set ObSSOCookie, if you are using mod_osso, the response will contain the information required to set the OHS host cookie.)
   
    8.When subsequent requests are made from that Webgate, the authentication token is passed by the Webgate to the OAM server, which validates the authentication token, checks the validity of the OAM_ID cookie and session timeout, and does the appropriate authorization checks.

    9.As the result of authorization checks, additional attributes may be added to HTTP Headers and passed to downstream applications. This is especially useful when asserting user identity and group or role information to downstream applications such as those running on Oracle Weblogic Server.

Differences between OAM 10g Webgates and OAM 11g Webgates

OAM 10g Webgates:

1.   C-based agents that are to be deployed on Web servers
2.   Domain-based cookie
3.   ObSSOCookie (one for all 10g Webgates)
4.   One Web server configuration supported per Webgate. Need to have multiple WebGates for multiple instances
5.   There is no detached credential collector (DCC)
6.   OAM 10g provides a proprietary multiple network domain SSO capability that predates Oracle Identity Federation. Complex configuration is required.

OAM 11g Webgates:

1.  Java-based agents that are to be deployed on Web Servers (Specific to OHS Server)
2.   Host-based cookie.
3.   Individual Webgate OAMAuthnCookie_ making it more secure
4.   Has separate install and configuration option.  Hence, single install and multiple instance configuration is supported. 
5.  Capability to act as a detached credential collector (DCC)
6.  OAM 11g supports cross-network-domain SSO out of the box.Oracle recommends you use Oracle Identity Federation for this situation.
   

Event Handler ordering for User entity create/modify operations

Here is the list of MDS documents and corresponding event handlers that need to be changed.

MDS document name: /metadata/iam-features-identity/event-definition/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
CreateUserPreviewHandler	CREATE	FIRST	1000
ModifyUserPreviewHandler	MODIFY	FIRST	1000
CreateUserValidationHandler	CREATE	FIRST	1000
ModifyUserValidationHandler	MODIFY	FIRST	1000
CreateUserPreProcessHandler	CREATE	FIRST	1000
ModifyUserPreProcessHandler	MODIFY	FIRST	1000
CustomPreProcessHandler	CREATE	LAST	2147483647 (MAXINT)
CustomPreProcessHandler	MODIFY	LAST	2147483647 (MAXINT)
CreateUserActionHandler	CREATE	FIRST	1000
ModifyUserActionHandler	MODIFY	FIRST	1000
CreateUserPostProcessHandler	CREATE	FIRST	1060
CustomPostProcessHandler	CREATE	LAST	2000000
CustomPostProcessHandler	MODIFY	LAST	2000000
CreateUserFinalizationHandler	CREATE	FIRST	1000
CreateUserVetoHandler	CREATE	FIRST	1000
CreateUserRequestFailedHandler	CREATE	FIRST	1000
UserCreateFailedHandler	CREATE	LAST	1000000

MDS document name: /metadata/iam-features-passwordmgmt/event-definition/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
UserPasswordValidationHandler	CREATE	2	1020
PasswordNotificationHandler	CREATE	FIRST	1180
PasswordHistoryPostProcessHandler	CREATE	SECOND	1200

MDS document name: /metadata/iam-features-transUI/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
GetCurrentUser	ANY	1	-2147483648 (MININT)
UpdateUsrPwdFields	CREATE	2	1040
UserAuditHandler	ANY	2	1000
ProvisionXellerateUserResource toUserOrg	CREATE	1	1080
TriggerUserProcesses	MODIFY	3	1080
RevokeResourcesOnDeProvisionedDate	MODIFY	LAST	1000000

MDS document name: /metadata/iam-features-request/event-definition/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
PostSubmissionDataActions	ANY	FIRST	1020
PostProcessingInitiation	ANY	SECOND	-2147483648
RequestCompleted	ANY	LAST	2147483647

MDS document name: /db/ldapMetadata/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
UserCreateLDAPPreProcessHandler	CREATE	9990	10020
UserModifyLDAPPreProcessHandler	MODIFY	9990	10020
UserCreateLDAPPostProcessHandler	CREATE	2	1120
UserModifyLDAPPostProcessHandler	MODIFY	FIRST	1020
LDAPAddMissingObjectClasses	CREATE	FIRST	1140

MDS document name: /metadata/iam-features-reconciliation/event-definition/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
UserPostProcessEventHandler	CREATE	FIRST	1040
UserPostProcessEventHandler	MODIFY	FIRST	1040
ReconUserPasswordHandler	CREATE	2	1020
ReconScheduledTaskHandler	CREATE	2	1100
ReconScheduledTaskHandler	MODIFY	2	1060

MDS document name: /metadata/iam-features-autoroles /event-definition/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
RoleChangeCalculator	CREATE	5	1220
RoleChangeCalculator	MODIFY	5	1100

MDS document name: /metadata/iam-features-accesspolicy /event-definition/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
PolicyEvaluator	CREATE	6	1240
PolicyEvaluator	MODIFY	6	1120

MDS document name: /metadata/iam-features-asyncwsclient /event-definition/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
AsyncHandler	CREATE	1000	1260
AsyncHandler	MODIFY	1000	1140

MDS document name: /metadata/iam-features-selfservice/event-definition/EventHandlers.xml

Event Handler Name	Operation	Current Order	New Order
SelfServiceNotificationHandler	CREATE	FIRST	1160
SelfServicePostHandler	CREATE	LAST	1000000