Oracle Adaptive Access Manger  is an Access Management product from Oracle Access Management Suite Plus (other products from Access Management Suite plus are OAM, OES, OIF, eSSO, OpenSSO Fedlet, OWSM, and STS ).  To know more about OAAM check Mahendra’s post and for OAAM version 11.1.1.5 my previous post here. For list of all Oracle Identity and Access Management products click here

This post covers OAAM 11g R1 (11.1.1.*) for beginners and highlight overview of OAAM installation, configuration, and accessing OAAM for first time .

1. OAAM 11g is a J2EE application deployed on Oracle WebLogic Server. If you are new to Oracle WebLogic Server then check  WebLogic Domain, Admin Server and Managed Server

2. OAAM 11g includes two components
a) OAAM Online : For Real-time risk analysis
b) OAAM Offline : For offline risk analysis

3. OAAM is part of Identity and Access Management software (IAM) same software that contains OAM, OIM, OES, and OIN .

4. OAAM’s deployed applications for OAAM 11g are

a) OAAM Server: OAAM Server is a run-time component that includes rules engine and end user interface flows deployed on WebLogic Managed Server. OAAM server provides Adaptive Risk Manager, Adaptive Strong Authenticator, Web Services etc.

b) OAAM Admin Console : Administration console (Web Application aka OAAM Admin) that contains customer service and security analyst case management functionality.

High Level Installation Steps for OAAM 11g:

1. Install Database for OAAM schema
2. Use RCU  to load OAAM schema

3. Install WebLogic Server, for 64 bit O.S. use steps mentioned here

4. Install Identity and Access Management Software as mentioned here  (Steps here are for 11.1.1.3. Use same steps but install version 11.1.1.5 Note: 11.1.1.5 is latest OAAM version as of May 2012)

5. Configure OAAM by running $MW_HOME/oracle_common/common/bin/config.sh

• when prompted for schema name, provide schema details creating using RCU

• OAAM configuration in online mode will create Admin Server and two Managed Servers (one for OAAM Admin Server and second for OAAM Server)

6. Start Node Manager, Admin Server, and Managed Servers (Do Not forget to set StartScriptEnabled=true in nodemanager.properties)

7. Create User for OAAM and add user in OAAM* group (to grant OAAM Role) using WebLogic Console

8. Access OAAM Admin Console http://host:OAAMAdmin_ManagedServer_port/oaam_admin

9. Access OAAM Server http://host:OAAMServer_ManagedServer_port/oaam_server

Last week Oracle released Fusion Applications (FA) 11g R1 Update 3 (11.1.4). I am going to cover new features in FA version 11.1.4 for Administrators in my upcoming posts .

• For now download Oracle Fusion Apps 11.1.4 from eDelivery
• Documentation of Fusion Apps 11.1.4 is available here

Contact Us If you are looking for Fusion Applications Installation, Implementation or Training.

In this post I am going to cover License Options available with Oracle WebLogic 12c , Contact Us If you are looking for any help on WebLogic Licenses.

WebLogic Server 12c is available in three licensing offering (with additional management packs) – WebLogic Standard Edition (SE), Enterprise Edition (EE), and WebLogic Suite

• a) WebLogic SE : Non clustered version of WebLogic Server + Web Tier + Java SE + TopLink Persistence Engine + Application Development Framework (ADF)
• b) WebLogic EE : everything in WebLogic SE + WebLogic Clustering + advanced Java SE + JRockit Real Time + Diagnostic Pack/AD4J (Application Diagnostics for Java) + Virtual Assembly Builder
• c) WebLogic Suite : everything in WebLogic EE + Coherence EE + Active GridLink for RAC + JRockit Realtime + iAS EE (Oracle Forms/Reports/Discoverer/Portal)

With all the three licenses above, you can add two additional products for Management and Provisioning (with additional price)

• d) WebLogic Server Management Pack EE : includes Application Performance Management, Business Transaction Management, Configuration Management, Service Level Management, Lifecycle Management
• e) Cloud Management Pack for Fusion Middleware (FMW) : Template Provisioning, Metering/Chargeback for business users, Virtual Assembly Deployment, Cloud Setup

With WebLogic EE & WebLogic Suite, you can add additional product Exalogic Elastic Cloud Software (if you are using Exalogic ) (with additional price)

• f) Exalogic Elastic Cloud : Exalogic Optimization

With WebLogic Suite, you can add additional product coherence for distributed data service platform (with additional price)

• g) WebLogic Coherence Grid Edition : Coherence Grid Edition

.

Last week for our Order Management training while checking transaction status in Order Management (Responsibility Order Management Super User, Vision Operations (USA) : Navigation : Shipping >> Transaction) trainees faced error APP-WSH-231210 An unexpected Error Occurred for Line .. The Error is ORA-04062 signature of package APPS.WSH_DELIVERY_DETAILS_INV has been changes

Looking at error message it is clear that fix is to compile invalid database objects and recompile form. Fix is well explained in My Oracle Support Note # 1315451.1 Shipping Transactions Form Errors: APP-WSH-231210, ORA-04062 which is to

a) Apply patch 8294645 (For EBS 12.1)
b) Drop package APPS.WSH_DELIVERY_DETAILS_INV
c) Create package spec and body by running  $WSH_TOP/patch/115/sql/@WSHDDICS.pls & @WSHDDICB.pls
d) Finally compile forms WSHSTREF.fmb, WSHFSTRX.fmb, WSHQSSUI.fmb

What this note doesn’t cover is how to compile forms and if you are not familiar with how to compile forms in EBS R12 then compiling forms is task in itself.

.

File with fmb extension is source form file where as file with fmx extension is compiled form . fmb’s in Oracle E-Business Suite (11i or R12) are stored in AU_TOP/forms/<US> directory where are fmx’s are stored in <PRODUCT_TOP>/forms/<US> directory (for example compiled forms related to WSH products should be in $WSH_TOP/forms/<US> directory )

To compile form in R12 (to convert fmb to fmx)

• Set environment file on apps tier R12_BASE/ apps/ apps_st/ appl/ APPS<sid>_<hostname>.env
• export FORMS_PATH and add AU_TOP/forms/US in FORMS_PATH like
  export FORMS_PATH=$FORMS_PATH:$AU_TOP/forms/US
• Change to form compilation executable directory (10.1.2 Oracle Home in R12)
  cd $ORACLE_HOME/bin
• Compile three forms using frmcmp_batch.sh|bat as./frmcmp_batch.sh module=$AU_TOP/forms/US/WSHSTREF.fmb userid=APPS/apps output_file=$WSH_TOP/forms/US/WSHSTREF.fmx module_type=form
• Repeat this for WSHQSSUI.fmb and WSHFSTRX.fmb

Note: Ensure that timestamp changes for above three fmx in $WSH_TOP/forms/US/

Note: If you get error like “ORA-12154: TNS:could not resolve the connect identifier specified” during forms compilation, check My Oracle Support Note 431324.1

Note: If you get error like “Compiling package body INVENTORY_CONTROLS…Compilation error on package body INVENTORY_CONTROLS:PL/SQL ERROR 49 at line 867, column 5 bad bind variable ‘parameter.wms_installed‘” make sure that FORMS_PATH includes $AU_TOP/forms/US

References/Related

• R12.1: Shipping Transactions Form Errors: APP-WSH-231210, ORA-04062 [ID 1315451.1]
• 1085928.1 – R12: How to Compile a Form in Release 12
• 431324.1 R12: Manual Forms compilation In R12 fails With: FRM-91500: Unable to start/complete the build

We are glad to announce the new Weekday batch of Oracle Weblogic Administrator  Training starting 14th May 2012.

Why this training is necessary:

This course trains system administrators and data center personnel on techniques for installing, configuring, deploying, and securing distributed, clustered applications and systems deployed on Oracle WebLogic Server. This training focuses on techniques for building high-availabilit,clustered configurations to ensure maximum application uptime. Methods for hardening the implementation to provide reliable security are also emphasized.

For course Content: Click Here

Course Fee:  USD 499

Training schedule: [Monday to Thursday (US) and  Tuesday to Friday (GMT)]

Timings : Click Here

Training Schedule : 18 Days

Payment Details: Click Here

Our Forte

•   Customized and flexible training packages
•   Customized course contents as per your implementation needs
•   Extremely competitive prices
•   Extensive Hands-on training
•   Certified Oracle Apps Instructors with real-time experience
•   Courses designed for the latest Oracle Apps versions
•   Study material with presentations & lab exercises designed by industry experts
•   Practice at your leisure 24/7 during the training
•   Email support post training completion

Mode of training:

Our trainings are conducted online using an interactive web-conferencing software which also has integrated VoIP. Participants will be able to view trainer’s desktop remotely & communicate with him at the same time. Trainer can also take control of your PC/Laptop in case you get stuck while performing exercises. For Audio, you need to have a headset (earphone & microphone).

To view the Training Testimonials – Click Here

For any queries send an email at training @ focusthread . com

We are glad to announce the new batch of Oracle Apps DBA R12 Training starting 13th May 2012.

Why this training is necessary:

Our online course gives you an exposure to Oracle Applications which enhances job prospects. Oracle Apps DBA’s are paid higher and face lesser competition in the job market as compared to Core DBA’s. We will see a growth in the requirement of Apps DBA’s thanks to Oracle’s Acquisition of Siebel, Peoplesoft, JDEdward and launch of Fusion Applications.

For course Content: Click Here

Course Fee:  USD 799

Training schedule:- 13, 19, 20, 26, 27 May 02 & 03 June 2012

Timings : 1:00PM GMT | 9:00AM EST | 6:00AM PST | 8:00AM CST | 7:00AM MST | 6:30PM IST

Training Duration:  7 Days

Payment Details: Click Here

Our Forte

•   Customized and flexible training packages
•   Customized course contents as per your implementation needs
•   Extremely competitive prices
•   Extensive Hands-on training
•   Certified Oracle Apps Instructors with real-time experience
•   Courses designed for the latest Oracle Apps versions
•   Study material with presentations & lab exercises designed by industry experts
•   Practice at your leisure 24/7 during the training
•   Email support post training completion

Mode of training:

Our trainings are conducted online using an interactive web-conferencing software which also has integrated VoIP. Participants will be able to view trainer’s desktop remotely & communicate with him at the same time. Trainer can also take control of your PC/Laptop in case you get stuck while performing exercises. For Audio, you need to have a headset (earphone & microphone).

To view the Training Testimonials – Click Here

For any queries send an email at training @ focusthread . com

This post talks about the command used to export and importing of OAM 11g policies. OAM 11g provides this functionality through WLST scripting tool. This is the only possible approach to automatically export all policies from OAM 11g. The below steps are appropriate in linux env for exporting policies.

1. Goto $ORACLE_HOME/common/bin.
2. Run ./wlst.sh
3. connect(‘weblogic’,'password’,'t3://weblogic_host:port’)
4. exportPolicy(pathTempOAMPolicyFile,’/app/shared/home/tmweb/Oracle/Middleware_Dev2/oam_policies.xml’)

Refer the below screenshot for the output.

For importing policies into target OAM environment, follow the below steps:

1. Goto $ORACLE_HOME/common/bin.
2. Run ./wlst.sh
3. connect(‘weblogic’,'password’,'t3://weblogic_host:port’)
4. importPolicy(pathTempOAMPolicyFile,’/app/shared/home/tmweb/Oracle/Middleware_Dev2/oam_policies.xml’)

The exported policies xml file (oam_policies.xml in this case) contains the below data:

1. Authentication schemes
2. Host Identifiers
3. Application domains: Resources, Authentication/Authorization policies etc.,

Hope this post helps.

Session & session attributes are newly introduced in OAM 11g. OAM 11g maintains a session at server side the sessionIds are managed by Session Management Engine SME. How to retrieve session IDs from OAM server are explained in post. So this post will give a sample code snippet to set and retrieve session attributes from session.

OAM session ID is around 20 characters and will be of the format d331ab34-2e17-4c5c-8ba1-a7cdf695150c. Session IDs can also be seen in OAM database schema by using sql command select * from oam_session;

The above sql command output will have results similar as shown below.

SESSIONID
——————————————————————————–
USERID
——————————————————————————–
IDENTITY_DOMAIN
——————————————————————————–
SESSION_INDEX
——————————————————————————–
CREATE_TIME
—————————————————————————
LAST_ACCESS_TIME
—————————————————————————
LAST_UPDATE_TIME
—————————————————————————
EXPIRY_TIME
4c2cdff7-0cbf-4723-aaab-489c06366d96
LN-Admin
NewOVDStore
-3226491390739477568
04-MAY-12 03.28.39.124000 AM
04-MAY-12 03.28.39.124000 AM
04-MAY-12 03.28.41.536000 AM
04-MAY-12 11.28.39.124000 AM

So it is merely easy to identify the session ID associated with which user IDs. The same behavior can also be seen in OAM console in Session Management section.

So the below snippet can be used to set and retrieve the session attributes from session.

Hashtable credentials = new Hashtable ();
credentials.put(“userid”, user_login);
credentials.put(“password”, user_passwd);
try{
AccessClient ac=null;
ResourceRequest req ;
ac = AccessClient.createDefaultInstance(Location,AccessClient.CompatibilityMode.OAM_10G);
req = new ResourceRequest(protocol, resource,method_way);
System.out.println(“Location–>”+Location);
UserSession session = new UserSession(req,credentials);
String sessionToken=session.getSessionToken();
System.out.println(sessionToken);
Set set=session.getSessionIds(user_login);

Iterator it = set.iterator();

String sessionID = “”;

while (it.hasNext()){

sessionID = it.next();

}
System.out.println(“Sessionattr—>”+set);

Hashtable sessionAttributes= new Hashtable ();
sessionAttributes.put(“userid”, “mahendra”);
sessionAttributes.put(“mobile”, “999123412″);

sessionAttributes.put(“email”, “mahendra@abcd.com”);

UserSession.setSessionAttributes(sessionID, sessionAttributes);

Hashtable sessionAttrs = UserSession.getSessionAttributes(sessionID);

System.out.println(“userid from session Attributes ===>”+sessionAttrs.get(“userid”));
System.out.println(“mobile from session Attributes ===>”+sessionAttrs.get(“mobile”));
System.out.println(“email from session Attributes ===>”+sessionAttrs.get(“email”));

}catch(Exception e){}

In OAM 11g user can have multiple sessions and based on this, the attributes can be retrieved in a loop.

I have worked on a OAM 11g requirement that needs to do authentication based on only username. There is a OOTB authentication scheme available in OAM 11g called LDAPNoPasswordValidationScheme. This authentication scheme uses the Authentication module LDAPNoPasswordAuthModule and that in turn points to Embedded Weblogic identity store by default.

I have to perform all this authentication using OAM 11g API. So I have created a dummy resource to test this. Pointed the LDAPNoPasswordAuthModule to OVD identity store as we are using OVD.

Used the below code snippet to test this and it worked fine.

ResourceRequest req  = new ResourceRequest(“http”, “http://host:port/dummy”,”GET”);

Hashtable credentials = new Hashtable();
credentials.put(“userid”, “mahendra”);

session = new UserSession(req,credentials);

String sessionToken=session.getSessionToken();

The Resource http://host:port/dummy is protected using LDAPNoPasswordValidationScheme and thus session token is created with just username.

We are extensively using OAM 11g API in our project out of which there is a requirement to set session attributes for a OAM user session.

Session attributes is a concept newly introduced in OAM 11g (not there in 10g). So once OAM session is created we can retrieve the session Ids by using the API method getSessionIds of UserSession class (package is oracle.security.am.asdk). This class is available in oamasdk-api-11.1.1.5.0.jar.

We are using Embedded Weblogic as System and default store. The concepts of these stores are well explained in this post.

While trying to retrieve the session IDs for a user using the below code snippet.

Hashtable<String,String> credentials = new Hashtable<String,String>();
credentials.put(“userid”, user_login);
credentials.put(“password”, user_passwd);
try{
AccessClient ac=null;
ResourceRequest req ;
ac = AccessClient.createDefaultInstance(Location,AccessClient.CompatibilityMode.OAM_10G);
req = new ResourceRequest(protocol, resource,method_way);
System.out.println(“Location–>”+Location);
UserSession session = new UserSession(req,credentials);
String sessionId=session.getSessionToken();
System.out.println(sessionId);
Set set=session.getSessionIds(user_login);
System.out.println(“Sessionattr—>”+set);

}catch(Exception e){}

We are getting the below exception while executing the above code snippet:

“oracle.security.am.asdk.OperationNotPermittedException: OAMAGENT-02005: Operation not permitted on this server.”

I can read the OAM sessions from the database by logging into DB as OAM DB schema user.

select * from oam_session;

I have found that there is a bug related to session IDs 12972630. Fix for bug# 12972630 will return session ids of a user in the specified user identity stores. Right now only sessions with default store are returned.

Well, the following statement is extracted from OAM documentation for default store:

Default Store: Used by Oracle Security Token Service, and for migration purposes when patching.

So the fix for bug is to use the user identity store as default store to retrieve the session IDs from OAM server. I can’t exactly make out the reason for bug fix and default store purpose.

Anyhow,  I am using OVD as user identity store for OAM authentication. So I have flagged the OVD identity store as Default store and then I am able to retrieve the session IDs from OAM server.