java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

Issue:

java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)

        at java.security.AccessController.checkPermission(AccessController.java:560)

        at oracle.security.jps.util.JpsAuth$AuthorizationMechanism$3.checkPermission(JpsAuth.java:458)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:518)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:544)

        Truncated. see log file for complete stacktrace

Caused By: java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=OIMSchemaPassword" "read")

        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:366)

        at java.security.AccessController.checkPermission(AccessController.java:560)

        at oracle.security.jps.util.JpsAuth$AuthorizationMechanism$3.checkPermission(JpsAuth.java:458)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:518)

        at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:544)

        Truncated. see log file for complete stacktrace

Fix/Resolution:

1.       Take the backup of weblogic.policy file to recover easily in case of any issues.

a.        Go to $WLS_HOME/server/lib/weblogic.policy

b.       cp weblogic.policy weblogic.policy_backup

2.       Add the below lines(end of the file) into weblogic.policy file

                        grant codeBase "file:$MW_HOME/patch_wls1036/patch_jars/*" {

permission java.security.AllPermission;

};

3.       Take the backup of system-jazn-data.xml file to recover easily in case of any issues

a.        Go to $DOMAIN_HOME/config/fmwconfig/system-jazn-data.xml

b.       $cp system-jazn-data.xml system-jazn-data.xml_backup

4.       Add the below lines (end of the file) into $DOMAIN_HOME/config/fmwconfig/system-jazn-data.xml:

<grant>

  <grantee>

    <codesource>

      <url>file:${wls.home}/../../patch_wls1036/patch_jars/*</url>

    </codesource>

  </grantee>

        <permissions>

                        <permission>
 <class>oracle.security.jps.service.credstore.CredentialAccessPermission</class>

     <name>context=SYSTEM,mapName=oim,keyName=*</name>

     <actions>read,write</actions>

                        </permission>

   </permissions>

</grant>

5.        Restart Admin and managed servers.

            NOTE: Kindly note, MW_HOME will vary from environment to environment depends on your machine path.

                          Also, similar solution is applicable to any component like OAM/OIF/OID etc..

           Hope this post helps you to resolve this issue. 

          

           Thank you for reading out my blog !!

OIM11g R2 PS2 (11.1.2.2) configuration steps throws Exception occurred while encrypting the configuration and database

Issue: 

When progressing through the Oracle Identity and Access Management Configuration, the 'Configure OIM Server' status would fail with the error Exception occurred while encrypting the configuration and database, step Configure OIM Server failed

Investigation: Try to find the error details from logs as per the screenshot. i.e... /home/oracle/app/oraInventory/logs/<latest log>.

As per log, (DEV_OIM.UK_MLS_LOCALE_MLS_LOCALE_CODE) violated error whilst accompanied with Caused by: java.lang.Exception: Exception occurred in updateMLSLocale method while updating Locale to OIM DB as well as Caused by: java.lang.Exception: Exception occurred while encrypting the database error

Fix: 

1. Simply take the backup of existing MLS_LOCALE table under DEV_OIM schema by following the below steps.

a.       Connect to your database using DEV_OIM schema(sql developer)

b.      Take the backup of MLS_LOCALE using below sql command

                Create table MLS_LOCALE_bkp as (select * from MLS_LOCALE);

c.       Truncate the original table name MLS_LOCALE

                Truncate table MLS_LOCALE;

2. Re-run the OIM configuration step

    Go to cd $OIM_HOME/bin (or) $MW_HOME/Oracle_IDM1/bin -> ./config.sh 

NOTE: If you are trying to connect to your database using sys account, then you have append Schema name before table. 

 Eg: truncate table DEV_OIM.MLS_LOCALE;  --- If you are using sys account in DB

It should fix the issue. 

OPSS Unable to start WL Server XML20108 Fatal Error JPS02592 Failed To Push Ldap Config Data To LibOvd

Issue:

 Jun 21, 2016 7:03:16 PM oracle.security.jps.internal.igf.ovd.OvdIGFServiceProvider pushLdapNamesTolibOvd SEVERE: JPS-02592
<Jun 21, 2016 7:03:16 PM SGT> <Error> <Security> <BEA-090892> <The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.>
<Jun 21, 2016 7:03:16 PM SGT> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: weblogic.security.SecurityInitializationException: The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
weblogic.security.SecurityInitializationException: The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.loadOPSSPolicy(CommonSecurityServiceManagerDelegateImpl.java:1402)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1022)
        at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:873)
        at weblogic.security.SecurityService.start(SecurityService.java:141)
        at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
        Truncated. see log file for complete stacktrace
Caused By: oracle.security.jps.JpsRuntimeException: JPS-02592: Failed to push ldap config data to libOvd for service instance "idstore.ldap" in JPS context "default", cause: org.xml.sax.SAXException: Error Parsing at line #1: 1.
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; <Line 1, Column 1>: XML-20108: (Fatal Error) Start of root element expected.
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:172)
        at oracle.security.jps.internal.policystore.JavaPolicyProvider.<init>(JavaPolicyProvider.java:375)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        Truncated. See log file for complete stacktrace

Resolution:

1.       Please verify whether your file system having disk space issues ($df -h in case of Linux). One of the causes of XML files corruption is seen when there is a filesystem full condition.

2.       If it is not relates to file system space issues, then it might be because of corrupted adapters.os_xml

3.       As additional symptom $DOMAIN_HOME/config/fmwconfig/ovd/default/server.os_xml was detected as zero (0) bytes.

Corruption of the adapters.os_xml or server.os_xml under this LibOVD location file may lead to Weblogic server startup failure.

Please navigate to the fmwconfig folder and check the adapters.os_xml or server.os_xml file or both
$DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml

There are chances the any of those xml file could be corrupted due to which the Weblogic server fails to start.

4.       In case the file is corrupted, please perform the following steps:

a.       Take a backup of $DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml  or  server.os_xml

b.      Delete corrupted adapters.os_xml or server.os_xml files under
 $DOMAIN_HOME/config/fmwconfig/ovd/default/adapters.os_xml

c.       Copy adapters.os_xml or server.os_xml from
         $MW_HOME/oracle_common/modules/oracle.ovd_11.1.1/templates/ to
         $DOMAIN_HOME/config/fmwconfig/ovd/default/. Or restore files from backup.

5.        Restart the server. It should works!!

 Hope this post helps you to resolve this issue.

Creating a wlfullclient.jar and Design console configuration

Use the following steps to create a wlfullclient.jar file :

   1. Change directories to the server/lib directory.

         $cd WL_HOME/server/lib

   2. Use the following command to create wlfullclient.jar in the server/lib directory:

         $java -jar wljarbuilder.jar

    3. wlfullclient.jar file will created under $WL_HOME/server/lib

   4.You can now copy and bundle the wlfullclient.jar to $OIM_HOME/designconsole/lib and

       $OIM_HOME/designconsole/ext folders.

   5.  Add the wlfullclient.jar to the client application's class path.

Note : For both Windows and Linux platforms, wlfullclient.jar file generation procedure is same in OIM.

Hope this will helps you !!

javax.security.auth.login.LoginException in OIM Design Console

Issue :

javax.security.auth.login.LoginException: java.lang.RuntimeException: Failed to instantiate MD5 SecureRandom: Unsupported algorithm

The javax.security.auth.login.LoginException: java.lang.RuntimeException: Failed to instantiate MD5 SecureRandom: Unsupported algorithm exception is thrown after clicking the Login Button in the Oracle Identity Manager Design Console.

Error:

Error Keyword: DAE.LOGON_DENIED
Description: Invalid Login.
Remedy: Contact your system administrator.
Action: E
Severity: H
Help URL:
Detail:
javax.security.auth.login.LoginException: java.lang.RuntimeException: Failed to instantiate MD5 SecureRandom: Unsupported algorithm, MD5Random, selected for FIPS140 mode: FIPS140_SSL
at com.certicom.tls.interfaceimpl.TLSSystem.getRandomNumberGenerator(Unknown Source)
at com.certicom.tls.record.handshake.MessageRandom.initialize(Unknown Source)
at com.certicom.tls.record.handshake.MessageRandom.<init>(Unknown Source)
at com.certicom.tls.record.handshake.HandshakeHandler.startHandshake(Unknown Source)
at com.certicom.tls.interfaceimpl.TLSConnectionImpl.startHandshake(Unknown Source)
at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
at com.certicom.tls.record.WriteHandler.write(Unknown Source)
at com.certicom.io.OutputSSLIOStreamWrapper.write(Unknown Source)
at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:66)
at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:124)
at java.io.DataOutputStream.flush(DataOutputStream.java:107)
at weblogic.rjvm.t3.MuxableSocketT3.connect(MuxableSocketT3.java:406)
at weblogic.rjvm.t3.ConnectionFactoryT3S.createConnection(ConnectionFactoryT3S.java:44)
at weblogic.rjvm.ConnectionManager.createConnection(ConnectionManager.java:1784)
at weblogic.rjvm.ConnectionManager.findOrCreateConnection(ConnectionManager.java:1424)
at weblogic.rjvm.ConnectionManager.bootstrap(ConnectionManager.java:443)
at weblogic.rjvm.ConnectionManager.bootstrap(ConnectionManager.java:322)
at weblogic.rjvm.RJVMManager.findOrCreateRemoteInternal(RJVMManager.java:254)
at weblogic.rjvm.RJVMManager.findOrCreate(RJVMManager.java:197)
at weblogic.rjvm.RJVMFinder.findOrCreateRemoteServer(RJVMFinder.java:238)
at weblogic.rjvm.RJVMFinder.findOrCreateInternal(RJVMFinder.java:200)
at weblogic.rjvm.RJVMFinder.findOrCreate(RJVMFinder.java:170)
at weblogic.rjvm.ServerURL.findOrCreateRJVM(ServerURL.java:153)
at weblogic.rjvm.ServerURL.findOrCreateRJVM(ServerURL.java:96)
at weblogic.security.auth.Authenticate.authenticate(Authenticate.java:80)
at weblogic.security.auth.login.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:184)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:684)
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at Thor.API.Security.LoginHandler.weblogicLoginHandler.login(weblogicLoginHandler.java:62)
at oracle.iam.platform.OIMClient.login(OIMClient.java:134)
at oracle.iam.platform.OIMClient.login(OIMClient.java:114)
at com.thortech.xl.client.base.tcAppWindow.internalLogin(tcAppWindow.java:585)
at com.thortech.xl.client.base.tcAppWindow.login(tcAppWindow.java:504)
at com.thortech.xl.client.base.tcAppWindow.<init>(tcAppWindow.java:118)
at com.thortech.xl.client.base.tcAppWindow.main(tcAppWindow.java:174)

Solution 1:

The cryptoj.jar file is missing in the $WLS_HOME/lib directory. Copy the cryptoj.jar file from

$WLS_HOME/lib to $OIM_HOME/designconsole/ext directory.

Solution 2:

If crypto.jar file available, still you are getting an login issue means try the following options :

1. Try to create wlfullclient.jar file and copy it to design console lib and ext directories

2. Verify provided OIM Username and Password is correct

Hope this will helps you!

Enabling the SSL Oracle Identity Manager Design Console

To enable the SSL for Oracle Identity Manager Design Console by following the below steps:

1. Configuring the OIM Design Console

The following task's needs to be performed to enable the SSL for Oracle Identity Manager Design Console. They are

1.1 Copy Jar Files

1.1.1 Login into the OIM Server.
1.1.2 Copy the webserviceclient+ssl.jar and cryptoj.jar from the $WLS_HOME/lib to $OIM_ORACLE_HOME/designconsole/ext directory

1.2 Configuring classpath.sh


1.2.1 Go to the Go to the $OIM_ORACLE_HOME/designconsole directory and edit the classpath.sh file and add the following content before $CLASSPATH. They are

:./ext/cryptoj.jar:./ext/webserviceclient+ssl.jar

1.2.2 Define the TRUSTSTORE_LOCATION variable in the classpath.sh file.

TRUSTSTORE_LOCATION = "OIM Trust Store.jks"

export TRUSTSTORE_LOCATION

1.3 Configuring xlconfig.xml


1.3.1 Go to the $OIM_ORACLE_HOME/designconsole/config directory and edit the xlconfig.xml file.

1.3.2 Modify the following parameters

< ApplicationURL>https://localhost:<sslport>/xlWebApp/loginWorkflowRenderer.do</ApplicationURL>

< java.naming.provider.url>t3s://localhost:<sslport>/oim</java.naming.provider.url>

1.4 Configuring xlclient.sh


1.4.1 Go to the Go to the $OIM_ORACLE_HOME/designconsole/ directory and edit the xlclient.sh file and add the following content if your using Self Signed Cert or root certificate is not trusted authority provider.

1.4.1.1 Turn off the SSL Constraints
-Dweblogic.security.SSL.enforceConstraints=off \

1.4.1.2 Turn Off the Host Name Verification
-Dweblogic.security.SSL.ignoreHostnameVerification=true \

1.4.1.3 Turn Off the default Random Number Generator.
The changing default Random Number generator shown in the log as follows

<Dec 05, 2015 11:51:50 AM IST> <Info> <Security> <BEA-090906> <Changing the default Random Number Generator in RSA CryptoJ from ECDRBG to FIPS186PRNG. To disable this change, specify -Dweblogic.security.allowCryptoJDefaultPRNG=true>

To turn of the off the random generator number in the log add the following flag.

-Dweblogic.security.allowCryptoJDefaultPRNG=true \


1.4.1.4 Debug the SSL Parameters
-Dssl.debug=true \

-Dweblogic.StdoutDebugEnabled=true \

1.5 Sample xlclient.sh file

After configuring the xlclient.sh file and the file content should be following format.

java -DXL.ExtendedErrorOptions=TRUE \
-DXL.HomeDir=. -Djava.security.policy=config/xl.policy \
-Djava.security.manager -Djava.security.auth.login.config=config/authwl.conf \
-Dlog4j.configuration=config/log.properties \
-Dweblogic.security.SSL.trustedCAKeyStore=$TRUSTSTORE_LOCATION \
-Dweblogic.security.SSL.enforceConstraints=off \
-Dweblogic.security.SSL.ignoreHostnameVerification=true \
-Dweblogic.security.allowCryptoJDefaultPRNG=true \
-Dssl.debug=true \
-Dweblogic.StdoutDebugEnabled=true \
-cp $CLASSPATH com.thortech.xl.client.base.tcAppWindow -server server

How To Configure Auto-Approval for End User Self-Registration in OIM 11g?

In the default self-registration template, the Organization field is designated as an approver-only field. This means that an approver must manually supply a value for the Organization field when approving the request.


To configure the self-registration template so that registrations are approved automatically, remove the approver-only flag from the dataset (i.e. SelfCreateUserDataset.xml) for the Organization field.


In OIM 11g, each request work-flow goes through three levels of approvals.


    Template Level

    Request Level

    Operational Level


By default Template Level is auto approved, so here only two levels of approvals need to be configured as auto approval. To achieve this, create two new approval policies, one with the request level approval enabled for self-registration, and the other with the operational level approval enabled.


For 11gR1 versions:


Steps:

    Modify the Self-Register User OOTB request template by restricting the Organization attribute with a mandatory default value.

    Modify the Self-Register user dataset by removing "approver-only" flag or setting it to "false" for Organization AttributeReference. Make sure you import the updated dataset and clear the cache.

    Create two new approval policies, one with the request level approval enabled for self-registration, and the other with the operational level approval enabled with a rule that evaluates to true.


1. Modify the Self-Register User OOTB request template


Modify the Self-Register User OOTB request template by restricting the Organization attribute with a mandatory default value.


2. Modify the Self-Register user dataset


Modify the Self-Register user dataset by setting it to "false" for Organization AttributeReference. Make sure you import the updated dataset (SelfCreateUserDataset.xml) and clear the cache.


See the Example of MDS Utility Usage and Purging Cache.


metadata_files=/metadata/iam-features-requestactions/model-data/SelfCreateUserDataset.xml

<AttributeReference name="Organization" attr-ref="act_key" available-in-bulk="false" type="Long" length="20" widget="ENTITY" required="true" entity-type="ORGANIZATION" approver-only="false"/>


3. Create two new approval policies


Create two new approval policies, one with the request level approval enabled for self-registration, and the other with the operational level approval enabled with a rule that evaluates to true.


Now try to submit a request from self-registration, End user will be created into OIM directly without any manual approval.


For 11gR2 versions:


The things you need to do:


-     Create 2 approval policies


o   Request level auto approval for all self-register type requests.

o   Operation level auto approval for all self-register type requests and for all the scopes.


-    Register a pre-process handler which will provide a default home organization for all the self-registered users. This is because home organization is a mandatory user attribute.