Configure SSO for multiple EBS instances

Often there used to be requirements in enterprises to configure SSO for multiple EBS instances  whether it be Dev, UAT, Prod instances or multiple production environments using the same access manager.In such cases mutiple instances can be secured using one application domain,SSO agent and webgate.

Adding Policies to an existing WebGate and Application Domain

Follow the steps below to add the required policies for additional Oracle E-Business Suite integration to an existing WebGate and Application Domain.

•     Change directories to <RREG_Home>/input.
•     Create a new file named EBS_OAM_PolicyUpdate.xml or use the existing to serve as a parameter file to the oamreg tool. Below is a sample.

 <?xml version="1.0" encoding="UTF-8"?>  
 <PolicyRegRequest>  
   <serverAddress>{protocol}://{oam_admin_server_host}:{oam_admin_server_port}</serverAddress>  
   <hostIdentifier>{Identifier for your existing WebGate}</hostIdentifier>  
   <applicationDomainName>{Identifier for your existing WebGate}</applicationDomainName>  
 </PolicyRegRequest>  

      

• Replace {protocol} with either http, or https if the component has been SSL enabled.
• Replace {oam_admin_server_host} with the fully qualified name for your OAM host.
• Replace {oam_admin_server_port} with the weblogic administration server port (the SSL port if the Admin Server has been SSL enabled).
• Replace {Identifier for your existing WebGate} within both the <hostIdentifier> and <applicationDomainName> elements with the Identifier for your existing WebGate.

Create a new file named ebs.oam.conf to serve as URIs file to the oamreg tool.Change directories to <RREG_Home> and run the following command to add the new policies.

     ./bin/oamreg.sh policyUpdate input/EBS_OAM_PolicyUpdate.xml

When prompted for the admin username and password, enter the credentials for your Oracle Access Manager Administrator, by default user "web logic".

When prompted "Do you want to import an URIs file?(y/n)", enter "y".

Enter the full path for the URIs file that you just created as <RREG_Home>/input/ebs.oam.conf.

The script should complete successfully with a Request summary. Login to the OAM console and check if the URIs are added for the new instance.

Configuring Access gate for multiple EBS Instances

The access gate can be deployed on dedicated managed server as eag_server1 protecting ebs_instance1, eag_server2 protecting ebs_instance2 or can be done on the same weblogic server with different context root.A unique name need to be  used for each application deployment.For example: ebsauth_myEBS1, ebsauth_myEBS2.Also the deployment for each Oracle E-Business Suite environment is performed from a separate file system directory.For example: <MW_HOME>/appsutil/accessgate/ebsauth_myEBS1,<MW_HOME>/appsutil/accessgate/ebsauth_myEBS2.Each Oracle E-Business Suite AccessGate application is tied to a single Apps DataSource configuration during deployment.

 Below entry is required on the OHS with the webgate for redirecting to the corresponding access gate.

   <Location /ebsauth_myEBS1>  
    SetHandler weblogic-handler  
    WebLogicHost eaghost.example.com  
    WebLogicPort 8099  
   </Location>  
   <Location /ebsauth_myEBS2>  
    SetHandler weblogic-handler  
    WebLogicHost eaghost.example.com  
    WebLogicPort 8099  
   </Location>  

Cleanup for Logout from Oracle E-Business Suite

On the WebTier, locate the file oacleanup.html that you copied during Oracle E-Business Suite AccessGate installation to the /public subdirectory on your htdocs root directory.For example $ORACLE_INSTANCE/config/OHS/ohs1/htdocs/public/oacleanup.html

Edit the file and replace CONTEXT_ROOT with the value of the context root for any deployment of Oracle E-Business Suite AccessGate protected by this WebGate. For example:

<script type="text/javascript" src='/ebsauth_myEBS/ssologout_callback?mode=cleanup'></script>

Search for the following line and add a callback for each additional logout callback.

 function doLoad()  
 {  
 logoutHandler.addCallback('/ebsauth_myEBS/ssologout_callback');  
 logoutHandler.addCallback('http://webgatehost2.example.com:7780/ebsauth_myEBS2/ssologout_callback');  

Oracle SOA -Payload Size threshold

Oracle JCA Adapters are designed to process large payloads but the BPEL engine consumes huge memory when processing large payloads due to XML conversions which can cause well known OutOfMemory(OOM) and jeopardize the whole system.Setting the payload threshold prevents any data burst from the downstream systems ensuring the JCA Adapters process only payloads that are less than the threshold limit and reject others.

Capping the payload size according to  the capacity of the infrastructure in place is always preferred since the servers will take time to recover from OOM error by garbage collection which is a "Stop the World" activity and no requests will be processed by the server during the time.

Maximum Request size for services

The threshold for maximum request size for any exposed service can be set by using this attribute.The value can be set through the EM console by navigating to the service endpoint -> Service/Reference Properties ->Exposed Service. A default value of -1 represents unlimited which can be set in units of bytes,KB,MB or GB to a suitable value that your infrastructure can handle.

This can be restricted at the DMZ level without the requests reaching the web logic servers if the architecture includes any of the below components.

• Oracle API Gateway
• Web Server that can restrict request size
• Load balancer like F5 BIG IP 

payloadSizeThreshold for adapters

Setting the payload threshold ensures that Oracle JCA Adapters rejects payloads greater than the threshold limit. In case of file and FTP adapters when the native size of the payload is not available and if the specific adapter does not use the native translation library, you cannot enforce the payload size threshold limit. For example, in case of xml-debatching, where the Oracle File and FTP Adapters pass a chunk of file content and the actual native size is not known, payload size threshold limit cannot be used.

To set the global property for capping payload size login to the EM console -> soa-infra   -> Administration -> System MBean Browser - > adapter and set the value for DefaultPayloadSizeThreshold . As per the documentation DefaultPayloadSizeThreshold  works only for the inbound adapters.There is no attribute as payloadSizeThreshold which seems to be a bug and DefaultPayloadSizeThreshold works for both inbound and outbound operations.

This threshold can be increased/decreased at adapter service level by overriding the values in composite.xml which takes precedence over the global settings.

 <reference name="insert" ui:wsdlLocation="insert.wsdl">   
 <interface.wsdl interface="http://xmlns.oracle.com/pcbpel/adapter/db/Application3/One2ManyJoining/insert#wsdl.interface(insert_ptt)"/>   
 <binding.jca config="insert_db.jca"/>   
 <property name="payloadSizeThreshold" type="xs:string" many="false" override="may">100</property> </reference>   

Below are some of the options when it is required to process huge data using database  adapter.

• MaxRaiseSize and MaxTransactionSize can be used while using database polling to restrict the number of records returned from the adapter.
• Setting the audit level to minimal can enhance  the processing of large data with a drawback of payload not getting saved to the database
• When processing large payload using XSLT set "streamResultToTempFile" to yes to avoid OutOfMemory error.But assign activities always perform better.
• Parking Lot pattern can be used to throttle the messages processed.See Throttling in SOA Suite via Parking Lot Pattern at http://www.ateam-oracle.com/throttling-in-soa-suite-via-parking-lot-pattern/  for how to implement in SOA.

Other adapters like AQ,MQ,File,FTP etc... have their own parameters that can be tweaked to control the payload size when used for inbound operations.

Weblogic - List running instances

Unix-List all instances of weblogic instances running on a server

At times we need to find the weblogic instances which are up and running on a particular machine mostly in clustered environments. This might be required to figure out weblogic process from a particular domain and kill that process.

You can do a grep as below which gives all the Java processes running on the machine and it may be tough to correlate PID with the running server instances.

$ps -ef | grep java 

Below shell script can be handy to list down the servers running on a particular machine.

clear

echo "PID and  webLogic instances"

echo  "**************************************"

/usr/ucb/ps -awwx | grep "weblogic.Name" | grep -v "grep weblogic.Name" | nawk 'BEGIN {print "PID\tWeblogicServer";

print  "**************************************" } ;

        {

        NUM = match($0, "weblogic.Name=") ;

        START_POS  = RSTART+RLENGTH ;

        START_STR = substr($0, START_POS) ;

        FINISH = match(START_STR, " ") ;

        FINISH_POS = START_POS+RSTART+RLENGTH ;

        FINISH_STR = substr($0, START_POS, FINISH_POS) ;

        NUM = split(FINISH_STR,FINISH_ARRAY) ;

        printf ("%s\t%s\n",$1, FINISH_ARRAY[1]) ;

        }

        END {

        print "**********************************"}'

Below is a sample output.

PID and  webLogic instances

**************************************************

PID     WeblogicServer

**************************************************

12624   AdminServer

13367   wls_soa1

13369   wls_wsm1

**************************************************

To stop a particular server issue the below.

$ kill -9 PID

If it's admin server,to avoid the conflict of existing .lok and .DAT files you can remove the tmp and cache folders or rename them.

Another handy way to find the running process will be using the jps script in the java bin folder. For example navigate to /usr/local/java/bin and run $jps -v which gives the server name in the parameter weblogic.Name  as below.

Oracle SOA DB Adapter Fails to return XML Type with MS SQLServer

When you use DB Adapter to access Microsoft  SQL Server Stored Procedures that return output  with XML types, a class type mapping exception can be thrown.

A stack trace similar to the below one can be thrown from the adapter.

Exception occured when binding was invoked. Exception occured during invocation of JCA binding: "JCA Binding execute of Reference operation 'Test' failed due to: Unimplemented string conversion. Conversion of JDBC type to String is not supported. An attempt was made to convert a Java object to String using an unsupported JDBC type: . Use a data type with a supported JDBC type. ". The invoked JCA adapter raised a resource exception. Please examine the above error message carefully to determine a resolution.

To fix this, change the driver from “com.microsoft.sqlserver.jdbc.SQLServerDriver “  to “weblogic.jdbc.sqlserver.SQLServerDriver “ by logging to the console and changing the driver class name or create a new connection by using of Oracle’s MS SQL server driver.

Also make sure to create a strong schema by introspecting the stored procedure using some input values. If weak schema is used, XML results greater than 2,033 characters in length will be returned  in multiple rows of 2,033 characters each.

For example,

CREATE PROCEDURE [dbo].[spSoaTest] @param1 int AS BEGIN SELECT TOP 500 FROM dbo.TableXX tbl ORDER BY  1 DESC  FOR XML PATH('test'),ROOT('test1'),TYPE END

If you omit the "type" after the "for xml" you may get the below exception while introspecting the stored procedure in JDeveloper.

BINDING.JCA-11819

Database type not supported.

Encountered a database type ntext that is either not supported or is not implemented.

Parameter XML_F52E2B61-18A1-11d1-B105-00805F49916B is of type ntext which is either not supported or is not an implemented datatype.

Check to ensure that the type of the parameter is one of the supported datatypes or that there is a collection or user defined type definition representing this type defined in the database.

                at oracle.tip.adapter.db.sp.xsd.sqlserver.DatabaseBrowser.expandParameter(DatabaseBrowser.java:88)

                at oracle.tip.adapter.db.sp.xsd.sqlserver.DatabaseBrowser.expandParameters(DatabaseBrowser.java:65)

Weblogic decrypt password

Weblogic Server uses AES encryption to save the passwords in file.The database passwords in the jdbc files or passwords in config.xml files are encrypted using a AES cipher and the AES secret key is stored in SerializedSystemIni.dat. At times we will need to decrypt this password to get the plain password.Below are the steps to decrypt the password.

1.Copy the SerializedSystemIni.dat from $DOMAIN_HOME/security folder to the $WL_HOME/common/bin folder.

The SerializedSystemIni.dat file varies across weblogic domains.

2.Create a simple python script file for example(DecryptWLPwd.py) and copy the below contents and save the file.

from weblogic.security.internal import *
from weblogic.security.internal.encryption import *
# Remind user about how to use
raw_input("Please ensure SerializedSystemIni.dat is in the current directory now, and press ENTER to continue.")
# Get encryption service
encryptionService = SerializedSystemIni.getEncryptionService(".")  
clearOrEncryptService = ClearOrEncryptedService(encryptionService)
# Get user to enter password
pwd = raw_input("Enter encrypted password (Eg. {3DES}Y1fA34S...): ")
# Remove unnecessary escape characters
preppwd = pwd.replace("\\", "")
# Decrypt the password
print "Decrypted password is: " + clearOrEncryptService.decrypt(preppwd)

3.Start the Weblogic Scripting tool from $WL_HOME/common/bin
./wlst.sh

4.Execute the script with the below command.

wls:/offline> execfile('DecryptWLPwd.py')

The script will  prompt to confirm the SerializedSystemIni.dat file in the current directory and get the encrypted password and output the decrypted password.