java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

Issue:

java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)

        at java.security.AccessController.checkPermission(AccessController.java:560)

        at oracle.security.jps.util.JpsAuth$AuthorizationMechanism$3.checkPermission(JpsAuth.java:458)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:518)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:544)

        Truncated. see log file for complete stacktrace

Caused By: java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)

        at java.security.AccessController.checkPermission(AccessController.java:560)

        at oracle.security.jps.util.JpsAuth$AuthorizationMechanism$3.checkPermission(JpsAuth.java:458)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:518)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:544)

        Truncated. see log file for complete stacktrace

Fix/Resolution:

1.       Take the backup of weblogic.policy file to recover easily in case of any issues.

a.        Go to $WLS_HOME/server/lib/weblogic.policy

b.       cp weblogic.policy weblogic.policy_backup

2.       Add the below lines(end of the file) into weblogic.policy file

                        grant codeBase "file:$MW_HOME/patch_wls1036/patch_jars/*" {

permission java.security.AllPermission;

};

3.       Take the backup of system-jazn-data.xml file to recover easily in case of any issues

a.        Go to $DOMAIN_HOME/config/fmwconfig/system-jazn-data.xml

b.       $cp system-jazn-data.xml system-jazn-data.xml_backup

4.       Add the below lines (end of the file) into $DOMAIN_HOME/config/fmwconfig/system-jazn-data.xml:

<grant>

  <grantee>

    <codesource>

      <url>file:${wls.home}/../../patch_wls1036/patch_jars/*</url>

    </codesource>

  </grantee>

        <permissions>

                        <permission>
 <class>oracle.security.jps.service.credstore.CredentialAccessPermission</class>

     <name>context=SYSTEM,mapName=oim,keyName=*</name>

     <actions>read,write</actions>

                        </permission>

   </permissions>

</grant>

5.        Restart Admin and managed servers.

            NOTE: Kindly note, MW_HOME will vary from environment to environment depends on your machine path.

                          Also, similar solution is applicable to any component like OAM/OIF/OID etc..

           Hope this post helps you to resolve this issue. 

          

           Thank you for reading out my blog !!

OID 11.1.1.7.0 Installation on Linux 6.5

Assuming you are planning to install OID 11.1.1.7.0 on Linux 64-bit environment

1. Install and Configure Oracle Database 11g R2

2. Run RCU 11.1.2.2.0 to create OID schema. (Hence run the pre-requisite for RCU)

                $unzip rcuHome

                $cd rcuHome/bin -> $./rcu

3. Install WebLogic 11g R1 (10.3.6)

                $unzip wls1036_generic.jar

                $java –jar –d64 wls1036_generic.jar (for 64-bit Linux)

4. Download and extract IDM 11.1.1.7.0 from OTN Site

                $unzip ofm_idm_linux_11.1.1.7.0_64_disk1_1of1

5. Install Identity Management (OID)

$cd Disk1

$./runInstaller –jreLoc <jdk/jre path>

6. Configure and create IDM domains and Managed servers 

                $cd $OID_ORACLE_HOME/bin

                $./Config.sh

7. Start WebLogic Server Console

                $cd $DOMAIN_HOME/bin

                $./startWeblogic.sh OR

    $nohup ./startWebLogic.sh > AdminServer.out &

    $tail -f AdminServer.out

8. OID Installation is successful.

Verify OID and other components status:

$ cd /u01/app/oracle1/oid/middleware/asinst_1/bin

$ ./opmnctl status   -> To Check the Status

$./opmnctl startall  -> To Start all components

$./opmnctl Stopall  -> To Stop all components

    Verify URL's:

Component	Access URL and Port
Oracle Directory Services Manager (ODSM)	http://host:7005/odsm
Oracle Enterprise Manager Fusion Middleware Control	http://host:7001/em/
Oracle WebLogic Server Administrative Console	http://host:7001/console/
Oracle Internet Directory LDAP	3060

Verify Connectivity via Command prompt:

ON SSL Mode:

$OID_ORACLE_HOME/bin/ldapbind –h <hostname> -p <port> -D cn=orcladmin –w <password> -U 1

Third-Party Tools:

You can use any of the below tools to perform the same operations similar to OID (Any Directory Server) target system.

1.       LDAP Browser

2.       JXplorer

3.       Apache Directory Studio

4.       LDIF Editor

Bulk password update Steps for OID

Steps to follow in order to bulk update users password in OID

1. create a file for all the users using below format

          dn: cn=test1,cn=Users,dc=abc,dc=com
          changetype: modify
          replace: userPassword
          userPassword: new_password

         dn: cn=test2,cn=Users,dc=abc,dc=com
         changetype: modify
         replace: userPassword
         userPassword: new_password

 
    dc=abc,dc=com (is as per your environment domain)

Things to consider while creating above file.

   a) get correct dn from OID. Go to OID select any users (users already exists in OID), right click on the users account and get dn, for example if it shows below

     cn=mani,cn=Users,dn=abc,dn=com

It means you need to get append cn=users,dn=abc,dn=com at the end of each record, for example users is test1 that you want to update the password you need to write the command like above I mentioned in step1.

 If users dn is uid=mani,cn=users,dn=abc,dn=com than users you will create file like

         dn: uid=test1,cn=Users,dc=abc,dc=com
         changetype: modify
         replace: userPassword
         userPassword: new_password

        dn: uid=test2,cn=Users,dc=abc,dc=com
        changetype: modify
        replace: userPassword
        userPassword: new_password

   b) Make sure there is a space between each record(empty line). if there is no space you will get error

   c) Make sure userPassword attribute exists in OID(it is default attribute) if it is changed in your environment please make sure to get correct attribute.

   d) Save file in .csv formate because sometimes extra spaces cause issues while running command

2. Load above file at OID server and run following "ldapmodify" command

 $ORACLE_HOME/bin/ldapmodify -h hostName -p port -D “cn=orcladmin” -w password -f usersPassword.ldif  > passwordusers.out

3. Test if user password is updated successfully

 $ORACLE_HOME/bin/ldapbind -h [oid_hostName] -p [oid_port] -D “uid=test1,cn=Users,dc=abc,dc=com” -w new_Password

 You should get message “bind successful”

Populate Orcllastlogintime for Users by Enabling Track Last Login Time OID 11.1.1.4 and later

Check if orclpwdtracklogin is set in the realm.

Issue the following ldapsearch on the password policy for the realm.

ldapsearch -h OIDhost -p OIDport -D cn=orcladmin -w pwd -b 

"cn=default,cn=pwdpolicies,cn=common,cn=products,cn=oraclecontext,%Default Realm%" -s base "objectclass=*" orclpwdtracklogin

Example:

ldapsearch -h myServer.oracle.com -p 3060 -D cn=orcladmin -w welcome1 -b "cn=default,cn=pwdpolicies,cn=common,cn=products,cn=oraclecontext,dc=us,dc=oracle,dc=com" -s base "objectclass=*" orclpwdtracklogin

If orclpwdtracklogin returns with 1, Track last login time is enabled in the password policy for this realm.
If orclpwdtracklogin returns with 0 or no return, Track last login time is disabled in this password policy for this realm.

To enable, create a text file (for example :track.ldif)

with the following

dn: cn=default,cn=pwdpolicies,cn=common,cn=products,cn=oraclecontext,%Default Realm%
changetype: modify
add: orclpwdtracklogin
orclpwdtracklogin: 1

Example:

dn: cn=default,cn=pwdpolicies,cn=common,cn=products,cn=oraclecontext,dc=us,dc=oracle,dc=com
changetype: modify
add: orclpwdtracklogin
orclpwdtracklogin: 1

Run ldapmodify

ldapmodify -h OIDhost -p OIDport -D cn=orcladmin -w pwd -f track.ldif

Example:
 ldapmodify -h myServer.oracle.com -p 3060 -D cn=orcladmin -w welcome1 -f track.ldif

Issue the search from step 1 again to confirm orclpwdtracklogin returns a value of 1.

Stop and restart OID

Bind as a user that resides under the realm of the password policy you've modified.

Example:

ldapbind -h myServer.oracle.com -p 3060 -D "cn=John.Smith,cn=users,dc=us,dc=oracle,dc=com" -w Mysecretpwd123

Ldapsearch the user to view the orcllastlogintime attribute


Example:

ldapsearch -h myServer.oracle.com -p 3060 -D cn=orcladmin -w welcome1 -b "cn=John.Smith,cn=users,dc=us,dc=oracle,dc=com" -s sub "objectclass=*" orcllastlogintime

 Expected output will look similar to this example:

ldapsearch -h myServer.oracle.com -p 3060 -D cn=orcladmin -w welcome1 -b "cn=John.Smith,cn=users,dc=us,dc=oracle,dc=com" -s sub "objectclass=*" orcllastlogintime

cn=John.Smith,cn=Users,dc=us,dc=oracle,dc=com
orcllastlogintime=20110919151040z

UseFul LDAP queries

Creating users in OID with LDIF scripts:
command: ldapadd -c -h servername -p 389 -D cn=orcladmin -w myPassword -f createUsers.ldif
script:
cn=jdoe,cn=Users,dc=myDivision,dc=myCompany
cn=jdoe
sn=jdoe
objectclass=top
objectclass=person
objectclass=organizationalPerson
objectclass=inetorgPerson
objectclass=orclUserV2
description=John Doe
userpassword=welcome2011
mail=john.doe@mycompany.com

Creating groups in OID with LDIF scripts:
command: ldapadd -c -h servername -p 389 -D cn=orcladmin -w myPassword -f createGroups.ldif
script:
cn=MyGroup,cn=groups,dc=myDivision,dc=myCompany
cn=MyGroup
objectclass=top
objectclass=orclGroup
objectclass=groupOfUniqueNames
owner=cn=orcladmin
displayname=MyGroup
description=My Script Created Group
orclisvisible=true

Remove members from groups in OID with LDIF scripts:
command: ldapmodify -c -h servername -p 389 -D cn=orcladmin -w myPassword -f removeMembersFromGroup.ldif
script:
dn: cn=myGroup,cn=groups,dc=myDivision,dc=myCompany
changetype: modify
delete: uniquemember

Add members to groups in OID with LDIF scripts:
command: ldapmodify -c -h servername -p 389 -D cn=orcladmin -w myPassword -f addMembersToGroup.ldif
script:
dn: cn=myGroup,cn=groups,dc=myDivision,dc=myCompany
changetype: modify
add: uniquemember
uniquemember: cn=jdoe,cn=Users,dc=myDivision,dc=myCompany
uniquemember: cn=user2,cn=Users,dc=myDivision,dc=myCompany
uniquemember: cn=user3,cn=Users,dc=myDivision,dc=myCompany

Disable users in OID with LDIF scripts:
command: ldapmodify -c -h servername -p 389 -D cn=orcladmin -w myPassword -f DisableUsers.ldif
script:
cn=jdoe,cn=Users,dc=myDivision,dc=myCompany
changetype: modify
orclisenabled :DISABLED