Oracle Techies

Best upgrade practices for adopting Oracle E-Business suite

noreply@blogger.com (Anonymous) — Tue, 28 Jan 2014 00:52:00 -0800

INTRODUCTION

This blog describes major upgrade areas to consider in determining whether an upgrade is appropriate for your Organization. It also offers practical advice from Oracle support, consulting and development Organization on how to do a R12 upgrade. This blog tells you “things you need to do” before and after R12 upgrade project.

Why Upgrade?

There are many compelling reasons for upgrading yourEBS version such as:

Unlocking new mature functionalities to keep your organization well positioned to meet business objectives.
Staying current with the highest and latest levels of the product support. The extended support to R11.5.10.2 is ending on December, 2014.
Upgrade allows you to see best performance and usage of enhanced features like functional capabilities, technical infrastructure etc. which enables you to increase application’s efficiency for your business.

[Refer Oracle Applications Documentation Resources Release 12 Note 394692.1] For more detailed information of finance and procurement upgrade impacts, see Oracle Financials and Oracle Procurement Functional Upgrade Guide: Release 11i to Release 12.

The Upgrade phases

An upgrade is similar to implementation; however upgrade can be more efficient than implementation as it leverages earlier implementation efforts and business processes. Also, upgrade can be executed within existing change management system by your organization.

Below graphic presents the standard upgrade phases at a high level:

Upgrade – Best Practices

This section describes Oracle R12 best practices for pre and post upgrade and testing activities.

Pre Upgrade Best Practices

Evaluation: Before initiating upgrade, it is important to thoroughly evaluate the new release to confirm the capabilities and enhancements which will provide expected benefits and justified returns from the upgrade to the business. Information on release notes can help in determining what exactly will change in newly upgraded system along with the new features. [Refer Oracle note 461705.1 which provide a consolidated view of information you may need for an upgrade project]

Planning: Asuccessful upgrade begins with a crystal clear definition of project scope and detailed project plan. Though R12 has new significant changes in data model and functionality specifically in financial modules, defining realistic schedule for upgrade project considering implemented modules in R11, integration with other third party systems and respective development, expected new modules to be introduced in R12, end user training and their confidence to go with R12, any change in terms of hardware or operating system or merging multiple instances into one single global instance should be considered while planning the project scope and timelines. You may separate such activities as a separate project than upgrade to minimize the risk. Though standard upgrade moves you from R11 to R12 with same setups and functionality with additional and default functionality about tax, sub-ledger accounting, still you have option to implement new functionality at desired time.

Data validation approach: Aminimal upgrade requires some functional setups which come by default like Trading Community Architecture (TCA) for customer/ supplier data, payments and E-business tax. If you have inconsistencies within R11 setups, then you should resolve them before R12 upgrade. You can run “Accounting Setup Manager Pre-upgrade Diagnostics” report to view R11 setup for financial modules, through you can identify setups that are potentially problematic. Also, results of standard reports from each module would also help to know successful upgrade – the reports have to run before and after upgrade as well.

Technical Iterations: Executing technical upgrade is critical initial phase. A best approach would suggest at least three iterations. The first iteration may be taken up to identify hurdles/ issues throughout upgrade (including functional/ technical configurations and testing activities). The second would be taken up to minimize issues which are identified within first iteration and further UAT activities. The third iteration would be taken up to identify exact down time (including all end to end activities) and help for Production upgrade. Capturing regular backups throughout the upgrade process would be enabling you to restore the environment to a specific point rather than re-initiating the entire process.

Fall-back planning: Approaching towards production stage upgrade, fallback planning is most essential and important. You can have multiple modes of backup which are capableenough to restore immediately and enable end users to work on. One round of resting on restoring the environment is recommended.

Pre-requisites: You can start the upgrade post completing month end activities, clearing all interfaces and posting all journals to General Ledger, closing all sub-ledger/ ledger periods. All such activities (including DBA, functional and technical) have to be sequentially listed down with

priority, navigation, activity owner, specific notes (if any) and respective estimated time against the activity. Many of such activities can be done in parallel mode to minimize upgrade time. Closure of major service requests prior to upgrade is highly required. Allocation to appropriate owners to activities and involvement of respective business users to their activities is most important for this project. Running of key reports before and after upgrade is one of the important activities in terms of data verification and reconciliation.

Cook-Book concept: Cook-Book includes end to end activities along with various phases which are sequentially listed down.Each activity should have respective owner, activity duration, activity sequence, activity mode (parallel/ standalone). Building and maintaining ‘Cook-Book’ is a proven concept which requires experienceto minimize cutover time, avoid last minute surprises and a very successful upgrade project.

A detailed, well planned and coordinated production upgrade is important in successful upgrade and minimizing risk factors.

Below is high level pictorial view of Cook-Book:

End User Training: Organize key user training and make them familiar to R12 environment, new features and functionalities. Prepare training documentation and update user guide to reflect changes in both functionality and business processes.

Post Upgrade Best Practices

At cutover, the final “Production” upgrade pass is completed.

Smoke Testing: Formulate robust testing strategy with required testing rounds, team involvement with overall performing to see end to end testing of all business scenarios. In addition to CRP testing to validate setups, ensure that you do full functional testing with business users. Testing should be guided by detailed test scripts in advance along with enough time to complete end to end scenarios.

Data Reconciliation: Running Oracle’s standard reporting from each module (based on each and every operating unit implemented) and mapping the outputs with R11 instance reports is standard approach of data reconciliation. Majority of reports are from financial modules which need to run and validate.

Hand hold Period: Keep your key project members in place at least for successful closure of first financial period within new R12 environment to increase end user confidence level. Consider doing a mock period closing at least 5 days before the actual close. The team can monitor the R12 environment, logging the service requests (if required). Re-examine user roles and responsibilities due to change in business processes introduced in R12. For example, global process owners reviewed R12 process changes with business users and redefined roles and responsibilities accordingly.

Conclusion

Oracle R12 has been adopted by many enterprises across the globe and is well accepted as the most reliable, stable from the family of Oracle EBS suite. Thus it is crucial for existing 11i users or may be older versions to consider future business process alignment, scalability and lowest TCO while mapping to Oracle R12 and eventually Fusion Application.

Oracle is committed to supporting customer investments in technology platforms for applications as well as certified infrastructure products (hardware, operating systems, databases and middleware). Details can be accessed at the following location:
http://www.oracle.com/us/support/lifetime-support/index.html

Configuring Oracle Unified Directory (OUD) 11g as a Directory Server

noreply@blogger.com (Anonymous) — Tue, 20 Nov 2012 00:44:00 -0800

I used Oracle Unified Directory (OUD) Version 11.1.1.5.0 during my test deployment locally here. I tried to collect as much information possible in this post for configuration.

Ideally, there are three possible configuration options for OUD:

as a Directory Server
as a Replication Server
as a Proxy Server

Directory Server provides the main LDAP functionality in OUD. Proxy server can be used for proxying LDAP requests. And Replication Server is used for replication from one OUD to another OUD or even to another ODSEE (earlier Sun Java Directory) server. You can my previous posts on OUD here and here.

In this post, we will talk about configuring OUD after installation as a Directory Server. You can read about OUD installation in my previous post here.

Once installation is completed, you will find following files in $ORACLE_HOME Directory.

-rwxr-x---  1 oracle oracle 1152 May 17 11:16 oud-proxy-setup  -rwxr-x---  1 oracle oracle 1482 May 17 11:16 oud-proxy-setup.bat  -rwxr-x---  1 oracle oracle 1180 May 17 11:16 oud-replication-gateway-setup  -rwxr-x---  1 oracle oracle 1510 May 17 11:16 oud-replication-gateway-setup.bat  -rwxr-x---  1 oracle oracle 1141 Aug 10 16:50 oud-setup  -rwxr-x---  1 oracle oracle 1538 May 17 11:15 oud-setup.bat

In this listing, .bat files are used in windows. So, In Linux (that is what I am using), we will be using following files.

oud-setup – To configure Directory Server
oud-replication-gateway-setup – To configure Directory Replication Server
oud-proxy-setup – To Setup Proxy Server

You can run the script shown below.

$ ./oud-setup OUD Instance location successfully created - /u01/oracle/Middleware/Oracle_OUD1/../asinst_2 Launching graphical setup...  The graphical setup launch failed.  Check file /tmp/oud-setup-8836874387532698932.log for more details.  Launching command line setup...  Oracle Unified Directory 11.1.1.5.0 Please wait while the setup program initializes...  What would you like to use as the initial root user DN for the Directory Server? [cn=Directory Manager]: Please provide the password to use for the initial root user: Please re-enter the password for confirmation:  On which port would you like the Directory Server to accept connections from LDAP clients? [1389]: 389  ERROR:  Unable to bind to port 389.  This port may already be in use, or you may not have permission to bind to it.  On UNIX-based operating systems, non-root users may not be allowed to bind to ports 1 through 1024 On which port would you like the Directory Server to accept connections from LDAP clients? [1389]:  On which port would you like the Administration Connector to accept connections? [4444]: Do you want to create base DNs in the server? (yes / no) [yes]:  Provide the base DN for the directory data: [dc=example,dc=com]: Options for populating the database:  1)  Only create the base entry 2)  Leave the database empty 3)  Import data from an LDIF file 4)  Load automatically-generated sample data  Enter choice [1]: 1  Do you want to enable SSL? (yes / no) [no]: yes On which port would you like the Directory Server to accept connections from LDAPS clients? [1636]:  Do you want to enable Start TLS? (yes / no) [no]: yes Certificate server options:  1)  Generate self-signed certificate (recommended for testing purposes only) 2)  Use an existing certificate located on a Java Key Store (JKS) 3)  Use an existing certificate located on a JCEKS key store 4)  Use an existing certificate located on a PKCS#12 key store 5)  Use an existing certificate on a PKCS#11 token  Enter choice [1]: Provide the fully-qualified host name or IP address that will be used to generate the self-signed certificate [ut1ef1]:  Do you want to start the server when the configuration is completed? (yes / no) [yes]:  Setup Summary ============= LDAP Listener Port:            1389 Administration Connector Port: 4444 LDAP Secure Access:            Enable StartTLS Enable SSL on LDAP Port 1636 Create a new Self-Signed Certificate Root User DN:                  cn=Directory Manager Directory Data:                Create New Base DN dc=example,dc=com. Base DN Data: Only Create Base Entry (dc=example,dc=com)  Start Server when the configuration is completed  What would you like to do?  1)  Set up the server with the parameters above 2)  Provide the setup parameters again 3)  Print equivalent non-interactive command-line 4)  Cancel and exit  Enter choice [1]: 3  Equivalent non-interactive command-line to setup server:  oud-setup \ --cli \ --baseDN dc=example,dc=com \ --addBaseEntry \ --ldapPort 1389 \ --adminConnectorPort 4444 \ --rootUserDN cn=Directory\ Manager \ --rootUserPassword ****** \ --enableStartTLS \ --ldapsPort 1636 \ --generateSelfSignedCertificate \ --hostName ut1ef1 \ --no-prompt \ --noPropertiesFile  What would you like to do?  1)  Set up the server with the parameters above 2)  Provide the setup parameters again 3)  Print equivalent non-interactive command-line 4)  Cancel and exit  Enter choice [1]: 4 No configuration performed. OUD Instance directory deleted. $

Then you need to run the oud-setup with the options provided for creating the directory server.

$ ./oud-setup –cli –baseDN dc=example,dc=com –addBaseEntry –ldapPort 1389 –adminConnectorPort 4444 –rootUserDN cn=Directory\ Manager –rootUserPassword ****** –enableStartTLS –ldapsPort 1636 –generateSelfSignedCertificate –hostName ut1ef1 –no-prompt –noPropertiesFile

OUD Instance location successfully created – /u01/oracle/Middleware/Oracle_OUD1/../asinst_2

An error occurred while parsing the command-line arguments: An unexpected error occurred while attempting to initialize the command-line arguments: Argument “bat” does not start with one or two dashes and unnamed trailing arguments are not allowed

Here, the issue is with the rootUserPassword value. Since I put * here, it replaced with all the files in the local directory, so it failed. Replace it with the required password for the “cn=Directory Manager” as shown below.

$ ./oud-setup           --cli           --baseDN dc=example,dc=com           --addBaseEntry           --ldapPort 1389           --adminConnectorPort 4444           --rootUserDN cn=Directory\ Manager           --rootUserPassword pass_t3st           --enableStartTLS           --ldapsPort 1636           --generateSelfSignedCertificate           --hostName ut1ef1           --no-prompt           --noPropertiesFile OUD Instance location successfully created - /u01/oracle/Middleware/Oracle_OUD1/../asinst_2  Oracle Unified Directory 11.1.1.5.0 Please wait while the setup program initializes...  See /tmp/oud-setup-5822533240188214866.log for a detailed log of this operation.  Configuring Directory Server ..... Done. Configuring Certificates ..... Done. Creating Base Entry dc=example,dc=com ..... Done. Starting Directory Server ......... Done.  To see basic server configuration status and configuration you can launch /u01/oracle/Middleware/asinst_2/OUD/bin/status $  cd bin $ ./status  >>>> Specify Oracle Unified Directory LDAP connection parameters  How do you want to trust the server certificate?  1)  Automatically trust 2)  Use a truststore 3)  Manually validate  Enter choice [3]: 1  Administrator user bind DN [cn=Directory Manager]:  Password for user 'cn=Directory Manager':  --- Server Status --- Server Run Status:        Started Open Connections:         1  --- Server Details --- Host Name:                ut1ef1 Administrative Users:     cn=Directory Manager Installation Path:        /u01/oracle/Middleware/Oracle_OUD1 Instance Path:            /u01/oracle/Middleware/asinst_2/OUD Version:                  Oracle Unified Directory 11.1.1.5.0 Java Version:             1.6.0_26 Administration Connector: Port 4444 (LDAPS)  --- Connection Handlers --- Address:Port : Protocol               : State -------------:------------------------:--------- --           : LDIF                   : Disabled 0.0.0.0:161  : SNMP                   : Disabled 0.0.0.0:1389 : LDAP (allows StartTLS) : Enabled 0.0.0.0:1636 : LDAPS                  : Enabled 0.0.0.0:1689 : JMX                    : Disabled  --- Data Sources --- Base DN:     dc=example,dc=com Backend ID:  userRoot Entries:     1 Replication: Disabled

Now, your newly created OUD Directory Server is running in the machine. You can check this with the ldapsearch command.

$ ldapsearch -h localhost -p 1389 -D “cn=Directory Manager” -w ebs_t3st -s sub -b “dc=example,dc=com” “(objectclass=*)” cn
dn: dc=example,dc=com

LDAP Search command will return one entry as shown above.

Here are some of my Observations:

If you want to use the port 389/636 for your Directory Server, then you need to run the setup using root user. Then you need to use start-ds and stop-ds commands using root user only.
There are six scripts to setup OUD components (three for unix/linux and three for windows environments)
You can setup a new TLS based certificate as part of configuring a new Directory Server.

Okay, thats all for now. We will meet in another post. Until then

HP DIAGNOSTICS

noreply@blogger.com (Anonymous) — Mon, 19 Nov 2012 01:00:00 -0800

Overview
Identifying and correcting availability and performance problems can be costly, time consuming and risky. IT organizations spend more time identifying an owner than resolving the problem.
HP Diagnostics helps to improve application availability and performance in pre-production and production environments. HP’s diagnostics software is used to drill down from the end user into application components and cross platform service calls to resolve the toughest problems. This includes slow services, methods, SQL, out of memory errors, threading problems and more.

How HP Diagnostics software works

During a performance test, HP Diagnostics software traces J2EE, .NET, ERP, and CRM business processes from the client side across all tiers of the infrastructure. The modules then break down eachtransactionresponse time into time spent in the various tiers and within individual components.

• Easy to use view of how individual tiers, components, memory, and SQL statements impact
Overall performance of a business process under load conditions. During or after a load test, you can
inform the application team that the application is not scaling and provide actionable data to them.

• The ability to triage and find problems effectively with business context, which enables to focus onproblems impacting business processes

Why? The Benefits
Diagnostics falls into the middle ground between Quality Assurance and Operations Performance Validation.
For developers, having Diagnostics means that tracing code doesn’t have to be added and removed. This is a big side effect of why diagnostics can improve performance.
Diagnostics is the science of pinpointing the root cause of a problem. Load Runner is the first load testing tool to provide a set of Diagnostics modules that trace, time, and troubleshoot end-user transactions acrossALL tiers of the system. These modules extend LoadRunner to provide a unified view of both end-user experience and application component (method, SQL) level performance. The intuitive visual interface allows the user to drill down from a problematic business process all the way to the poorly performing component. This granularity of results ensures that every load test provides development with actionable results, thus reducing the cost and time required to optimize J2EE/.NET applications.

Diagnostics can be integrated with HP Business Availability Center software, HP LoadRunner, and HP Performance Center
As the response times alone will not suffice the report, more people(client ,developer etc) are interested to know the key features why the bottlenecks .As a part of performance engineering identifying the root cause as where the bottleneck is and why is it caused.

Any application framework we test has numerous lines of code.it is difficult for a developer to identify why the application response in more on load if we just produce them with response times,if team has to fix them ,they will be in a doubt as which part of the code and methods are causing the increased response time.

Supported platforms

• WebSphere, WebLogic, Oracle 10g, SAP Web
Application Server, JBoss, Tomcat, Sun ONE, ATG,Borland ES, FUJITSU Interstage, Tmax Soft JEUS,
.NET 1.1 to 3.5
• WebSphere Portal Server, WebLogic Portal Server,SAP Enterprise Portal, Oracle 12i applications

Consider a J2EE/.net framework
As of the probes are installed on each layer like web,application layer, database layer the metrics are collected by diagnostics tool illustrating the behavior of the layers when a request is sent..
Key concern when it comes to metrics:
1.J2EE/.NET Framework –Average Method response time
2. J2EE/.NET Framework-Server requests response
2. J2EE/.NET Framework-server method calls persecond

When it comes in direct invoking of the diagnostics we have the following metrics
1. Average memory used
2. Average CPU used
3. JVM heap memory used
4. Connection pool, Thread pool
5. Collection leaks
6. EJB Methods /time
7. Server requests/time
8. Worst transaction
9. Worst SQL Queries
10. Network latency
11. Server request -exceptions

The report which we consolidate will speak clearly as where the
Developer-Which method or part of code should he fix?(methods and calls)
DBA-Which query should be tuned (any indexes are used for the query)
Integration team-Any increase in servers and CPU are necessary for scalability.

Key Functions of Diagnostics:
Various Metrics (such as JVM heap size, garbage collection frequency, method invocation counts, etc.) are grabbed by Probes which pass metric data out to the Profiler web service (installed with and runs on the same server with the probe) to produce web pages in HTML or XML or format which can be parsed dynamically by Scripts running withing load runner programmed to store diagnostics values as user-defined values along with metrics maintained by LoadRunner (such as the number of vusers running concurrently).
HP(Mercury) Tuning Console product which tracks the impact of server configuration changes on metrics

When many app servers are involved add in (Diagnostic)to LoadRunner displays metrics files obtained from the
Diagnostic Server, also called the Commander, which stores data from the Collector and Mediator which filter and aggregate data obtained from probes on app servers.
Probe Profiler Tabs
Below is the sample of the probe metric page and listen below are the few metrics.

Summary
Memory
Load
Shortest Requests
Hotspots
Slowest Methods
CPU Hotspots (Methods)
Slowest SQL
Metrics
System (Host) CPU, Memory Usage, PageInsPerSec, PageOutsPerSec, PageCutsPerSec, Disk, Network
JVM: Probe: HeapFree, HeapTotal, HeapUsed
Java Platform: Classes, GC, Threads
Mercury System
Web logic: EJB, Execute Queues, JDBC, etc.

The final summary is that report plays a major role in making the performance of the application as desired by the User (Fast and scalable).Response times can be brought down by fixing these issues.
Hence forth diagnostics is the heart and soul for the Performance engineering Practice.

Performing Manual Correlation with Dynamic Boundaries in LR

noreply@blogger.com (Anonymous) — Mon, 19 Nov 2012 00:58:00 -0800

What is Correlation: It is a Process to handle dynamic values in our Script. Here the dynamic value is replaced by a variable which we assign or capture from the server response.

Ways to do correlation: There are two ways to do this Correlation.

They are as follows:

Auto-Correlation: The Correlation Engine in LR Package captures the value and replaces it with another value
Manual Correlation: Understanding of the Script and its response is highly needed to do this. It is bit complex to do Manual Correlation sometimes but this is always the preferred method to handle Dynamic Values in our Script

Usually the Manual Correlation is done by capturing the dynamic value which is present in between the Static left and right Boundaries.

Objective: The intention of this article is that to give a method which will be useful when we wanted to capture and handle Dynamic Values when even the Left and right Boundaries are also dynamic.

The Solution can be much simple, Instead of determining the boundaries to the String we can actually use Text flags.

Before Getting into the Topic we should know about the Text Flags:

Text flags are the Flag used just after the text with Forward Slash.

Some of the commonly known and used Text flags are:

/IC to ignore the case
/BIN to specify binary data
/DIG to interpret the pound sign (#) as a wildcard for a single digit
/ALNUM<case> to interpret the caret sign (^) as a wildcard for a single US–ASCII alphanumeric character

Case 1: Digit Value

Suppose the response data is the string literal, but the issue is that the left boundary is changing every time; you get the left boundary as axb, where x ranges between 0 and 9, as follows:
a0b=Boundaryrb
a1b=Boundaryrb
a2b=Boundaryrb
——–
——–

a9b=Boundaryrb

We can capture the desired string by putting the following correlation function in place, using the /DIG text flag in combination with Left Boundary:

web_reg_save_param (“Corr_Param”, “LB/DIG=a#b\=”, “RB=rb”, LAST);

The corresponding place, which you expect to be dynamically filled in with a digit, should be replaced by a pound sign (#).

If there are multiple digits, we can use ‘##’.

Case 2: Boundary is String and case sensitive

web_reg_save_param (“Corr_Param”, “LB/IC/DIG=a#b\=”, “RB/IC=rb”, LAST);

Case 3: A Place to be filled either by a Digit or a letter

web_reg_save_param (“Corr_Param”, “LB/ALNUM=a^b\=”, “RB/IC=rb”, LAST);

HP Ajax TruClient – Overview with Tips and Tricks

noreply@blogger.com (Anonymous) — Mon, 19 Nov 2012 00:57:00 -0800

Overview

In LoadRunner 11.5, TruClient for Internet Explorer has been introduced. It is now possible to use TruClient on IE-only web applications.

Note: This still supports only HTML + JavaScript websites. It does not support ActiveX objects or Flash or Java Applets, etc.

TruClient IE was developed as an add-in for IE 9, so it will not work on earlier versions of IE. This version of IE was the first version to expose enough of the DOM to be usable by a TruClient-style Vusers. Note that your web application must support IE9 in “standard mode”.
Some features have also been added to TruClient Firefox. These include:
- The ability to specify think time
- The ability to set HTTP headers
- URL filters
- Event handlers, which can automatically handle intermittent pop-up windows, etc.

Web page breakdown graphs have been added to TruClient (visible in LoadRunner Analysis). Previously they were only available for standard web Vusers.

Tips and Tricks

NTLM authentication -

Scenario: Some applications when accessed on Mozilla, demand NTLM authentication. If these steps appear while recording, they don’t get recorded. Hence while replaying, due to the absence of these steps; the application fails to perform the intended transactions.

Solution: To avoid a situation in which an application asks for NTLM authentication while recording and replaying, one has to specify the application as a trusted NTLM resource. To make that, follow these steps.

Open the file “user.js” located in “%lr_path%\dat\LrWeb2MasterProfile”.
Locate the preference setting “network.automatic-ntlm-auth.trusted.uris”.
Specify the URL of the trusted resource as the value of this setting.
Save the file “user.js”

These changes are done only where the VUgen is used to develop the script. These changes get saved with the script and apply on different machines during load tests.

Disable pop-ups during recording -

Scenario: The occurrence of unwanted pop-ups creates hurdles during script development.

Solution: To disable the pop-ups, we can do it by following the below mentioned steps –

In the Firefox address bar, enter ‘about: config’. Click ‘I’ll be careful, I promise’ tab
In the filter field, enter disable_open_during_load
Right click on ‘disable_ open_during_load’ and select ‘Toggle’. The value changes to ‘false’
Record initial Navigation step again
Your pop-ups will be disabled

Displaying the value in a parameter or variable -

Scenario: To understand the value that gets stored in a parameter while replaying the script.

Solution: This can be achieved using alert () function.

Example:

var x=”Good Morning”;

window.alert (x);

Calculating number of text occurrences -

Scenario: Scripting of most of the modern internet applications with number of dynamic features demand this requirement. Be it to check the presence of a text on the web page or to count the number of tickets generated in the application during run time, calculating text occurrences and using this count with right logical code.

Solution: In AJAX, using JavaScript functions, we can achieve this objective. This can be done as –

Drag ‘Evaluate JavaScript code’ from toolbox
In the arguments section add the following code -
var splitBySearchWord = (document.body.textContent).split (‘Text to search for);
Then display the total number of occurrence of the text using Alert () method.
window.alert (splitBySearchWord. Length);

Inserting random think time -

Scenario: End-user behavior is unpredictable and as a performance tester, while executing a performance test, our aspiration should always be to reach closest to the real time scenario. Some end users may spend only 2 secs before navigating to the next page, while many others may think for more time. Hence in many test scenarios, it would not be ideal to insert a fixed think time value before a web request; rather one must use random think time in such cases.

Solution: The above scenario can be achieved using advanced JavaScript functionality. They are:

From ‘Toolbox’, copy a wait function and paste it before the web request
In the argument section, replace the interval value ’3′ by ‘Math.floor (11*Math.random () +5); ‘

The above function will return a random number between 5 and 15.

Math.floor () method rounds a number Downwards to its nearest integer (Eg. The output of code ’Math.floor (1.8); ‘is 1). Hence 11 are used as a multiplication factor so that an integer in the upper decimals of 10 will be rounded to 10.Math.random () method returns a random number between 0 and 1.

Handling browser cache -

Scenario: You may wish to manage the cache handling features of the browser to replicate different types of test scenarios.

Solution: This can be achieved by following these steps -

Open the Script under Interactive mode.
Go to VUser > Run-Time Settings > General > Load mode Browser Settings
Inside the Settings frame display the option Advanced
Select the option “Compare the page in cache to the page on the network”; select one of the four values above according to your test requirements

0 = Once per session

1 = Every time the page is accessed

2 = Never

3 = When the page is out of date (Default value)

Conclusion

In Hexaware, we have used TrueClient protocol to record many applications for different clients. Some of the benefits we fruited are as follows – HP TruClient Protocol works with many frameworks like jquery, Ajax, YUI, GWT, JS, etc. Rich internet applications developed on Web 2.0 technologies can be easily scripted and replayed. Script development is interactive with script flow at one side of the window and application opened in the browser at the other. This makes scripting with AJAX TruClient protocol easier and faster. Object identification features minimize the use of complex correlations and make script more dynamic. Thus the scripts become more resilient to back-end changes. Complex client side events like Mouse over, slider bars, calendar items, dynamic lists, etc. can be very easily scripted, customized and replayed. Thus testing cycle is much shorter in case of Ajax TruClient as compared to that with other web protocols. Using AJAX TruClient, API + GUI response time can be obtained, as opposed to other protocols that provide only API response time.

XML Optimization through custom Properties

noreply@blogger.com (Anonymous) — Mon, 19 Nov 2012 00:48:00 -0800

1. Problem Statement:

I am creating a XML file as an output . If my source is empty, is there a way to avoid the creation of an empty XML file?

Sample output Data with source data :

Case 1 : Empty Source – Creation of Minimal XML file

We have to set the following properties of an XML Target at session level under the Mapping tab.

Null Content Representation – “No Tag”

Empty String Content Representation – “No Tag”

Null Attribute Representation – “No Attribute”

Empty String Attribute Representation – “No attribute”

The Output file is as follows

Note: It generates the minimal XML and parent tag. The parent tags are shown as Unary Tag in the browser.

Case 2: Creation of Zero Byte XML file.

Even though setting all the above property you will get an empty XML file with no data or only with parent tags. If downstream system Like MFT (Managed File Transfer) consumes this garbage file, you will end up with errors while processing. To avoid these kinds of errors we have to set two custom properties in the Integration Service:

WriteNullXMLFile = No

The WriteNullXMLFile custom property skips creating an XML file when the XML Generator transformation or Target doesn’t receive data
. The Default value for this parameter is Yes and
. if you set No , the minimal XML document will not be generated and the target XML file size will be of zero byte.

2) Suppress the Empty Parent Tag

A PowerCenter session with an XML target writes empty parent tags to the XML file when all child elements are null. This may occur even when the Null Content Representation option is set to No Tag in the session properties.

SuppressNilContentMethod = ByTree

The SuppressNilContentMethod server parameter will suppress the parent tags as well as the child tags when all the child elements are null. To achieve this, set the custom property to “ByTree”.

ByTree

The ByTree flag suppresses non-leaf elements up to (but not including) the document root, when the entire element chain originating at the specified element contains no data. ByTree flag is always optimal.

For example the Street1 and Street2 values are empty, without setting the property you will get the below output with Street Unary tag:

If you set the Property SuppressNilContentMethod = ByTree the entire Street tag will be vanished.

3) To reduce the Session log size while using XML as Target

XMLWarnDupRows =No

By default; it is Yes, the Informatica Server writes duplicate row warnings and duplicate rows for

XML targets to the session log.

4 ) To reduce the cache file size created by XML target and increase the performance of reading large XML files.

XMLSendChildFirst=Yes

How to set the Custom Properties?

Infa 8.x and Above

1. Connect to the Administration Console

2. Stop the Integration Service

3. Select the Integration Service

4. Under the Properties tab, click Edit in the Custom Properties section

5. Under Name enter WriteNullXMLFile = No

6. Under Value enter No

7. Under Name enter SuppressNilContentMethod

8. Under Value enter ByTree

9. Click OK

10. Restart the Integration Service

Starting with PowerCenter 8.5, this change could be done at the session task itself as follows:

These custom properties would override the DI service level properties.

1. Edit the session

2. Select Config Object tab

3. Under Custom Properties add the attribute WriteNullXMLFile=No and SuppressNilContentMethod=ByTree

4. Save the session

Session Properties:

Advanced Replication Setup for High availability and Performance

noreply@blogger.com (Anonymous) — Mon, 19 Nov 2012 00:43:00 -0800

In my personal opinion, Oracle leads the market in Directory Product offerings (LDAP Directories). Starting from Oracle Internet Directory (OID), to the latest Oracle Unified Directory (OUD), Oracle definitely provides variety of LDAP Directory related products for integration.

With increasing demand for mobile computing and cloud computing offering, there is a need to standardize LDAP Deployments for Identification, Authentication and (sometimes) Authorization (IAA) services. With a highly scalable, highly performing, highly available, highly stable and highly secure LDAP Directory, these IAA services will be easier to integrate with applications in the cloud or for the mobile applications.

Introduction

Oracle Unified Directory (OUD) is a latest LDAP Directory offering from Oracle Corp. As mentioned in my previous post, OUD comes with three main components. They are:

Directory Server
Proxy Server
Replication Server

Here, Directory Server provides the main LDAP functionality (I assume you already know what an LDAP Directory Server means). Proxy server is used for to proxy LDAP requests (how?). AndReplication Server is used for replicating (copying) data from one OUD to another OUD or even to ODSEE server (we will talk more about replication in this post). You can read about my first post on OUD here. In this current article, I will write about replication server and advanced replication setup for Oracle Unified Directory.

Many people want a step by step guide (kind of cheat sheet) to setup something like OUD or OID for replication. Unfortunately I am not going to give you that here. In my personal opinion, that (cheat sheet) is not a right approach at all and will not be helpful in the long run for gaining concepts or knowledge. First of all, we need to give importance to the basic concepts behind how something works.

First of all, read OUD Documentation

Product Documentation must be read before you plan your deployment. You can find the OUD Documentation here. This link is for OUD Version 11.1.1. Make sure to refer the latest product manual. Documentation provides lot of details about the product and save lot of time with investigation later. For Replication, you need to start with “Architecture Reference” Guide.

When do you want to setup replication?

There should be a reason, right? If there is no reason, then there is no need for you to setup replication at all. Instead, you can have a beer and pass the time happily doing something else.

Ideally, you need replication setup for “High Availability” and “Performance”. Usually, there will be multiple instances of OUD Directory Server processes running in Production. Let’s say we need to have around four OUD Directory Servers (and four more for Business Continuity/Disaster Recovery).

Unfortunately, there is no single process to update all the eight OUD Directory Servers in our example. We need to find a mechanism to synchronize the directory entries across these servers. For this, we need to use the OUD Replication Server Component.

Securing the Replication Traffic

We don’t want network sniffers taking away critical user information (even inside the internal network, it is possible). We need to encrypt the traffic between the replication servers. Do not consider setting up a Replication Server communication without encrypted traffic.

Since OUD provided identity data, all the network traffic is prone to sniffing attacks. Always use encrypted or secure connections to OUD or to any LDAP Directory.

Deciding a Replication Method to use

Next important thing is to decide what replication method you are going to use. This is mostly site specific and you need to know lot of details before deciding a replication method to use. I am planning to use the following sample architecture for this post. Let’s understand our sample OUD Architecture first.

Here are the quick components of the architecture:

We have one master OUD Server called PROD-01. All the updates to the directory happens here. Most probably, HR System will update the directory. Also, Updates can happen using a custom developed application plug-in for LDAP Directory or using a Identity and Access Management System (IAM) system such as Oracle Identity Manager or Tivoli Identity Manager.
PROD-02 will be used with PROD-01 for High Availability and Performance in this Production Deployment.
In Disaster Recovery deployment, we have PROD-03 and PROD-04 servers. These servers need to synchronize the user data from the master server PROD-01.

One way to setup replication is by provisioning users into all the six OUD Directory Servers by an Identity and Access Management (IAM) System (such as Oracle Identity Manager or Tivoli Identity Manager). However this provisioning can be time consuming to complete because it will be treated as updating six different LDAP Directories. So a better way to achieve this is using a Replication Server.

We will continue setting up the Replication Server for this architecture. Lets meet in another post - Until then.

Transitioning to a New World – An Analytical Perspective

noreply@blogger.com (Anonymous) — Mon, 19 Nov 2012 00:40:00 -0800

Recently, I had the opportunity to speak at the Silicon India Business Intelligence Conference. The topic I chose for the discussion was focused on providing the BI & Analytics perspective for companies transitioning to a new world. You can view my presentation at this link –http://bit.ly/VLDDfF

The gist of my presentation is given below:

1) First, established the fact that the world indeed is changing by showing some statistics:

Data Deluge: Amount of digital data created in the world right now stands at 7 Zettabytes per annum (1 Zettabyte = 1 Trillion Terabytes)
Social Media: Facebook has touched 1 Billion users which makes it the 3^rd largest country in the world
Cloud: Tremendous amount of cloud infrastructure is being created
Mobility: There are 4.7 billion mobile subscribers which covers 65% of world population

2) Enterprises face a very different marketplace due to the profound changes taking place in the way people buy, sell, interact with one another, spend their leisure time etc.

3) To ensure that BI can help business navigate the new normal, there are 3 key focus areas.

Remove Bottlenecks – Give business what they want
Enhance Intelligence
End to End Visibility by strengthening the fundamentals

For each of the 3 areas mentioned above, I gave some specific examples of the trends in the BI space.

1) For Removing Bottlenecks, the impact of in-memory and columnar databases were elaborated.

2) For enhancing intelligence, working with unstructured data and using big data techniques were discussed.

3) For the 3^rd point, the focus was on strengthening the fundamentals in the BI landscape.

Please do check out my complete presentation at http://bit.ly/VLDDfF and let me know your views.

Thanks for reading.

Collaborative Data Management – Need of the hour!

noreply@blogger.com (Anonymous) — Tue, 16 Oct 2012 23:08:00 -0700

Well the topic may seem like a pretty old concept, yet a vital one in the age of Big Data, Mobile BI and the Hadoops! As per FIMA 2012 benchmark report Data Quality (DQ) still remains as the topmost priority in data management strategy:

‘What gets measured improves!’ But often Data Quality (DQ) initiative is a reactive strategy as opposed to being a pro-active one; consider the impact bad data could have in a financial reporting scenario – brand tarnish, loss of investor confidence.

But are the business users aware of DQ issue? A research report by ‘The Data Warehousing Institute’, suggested that more that 80% of the business managers surveyed believed that the business data was fine, but just half of their technical counterparts agreed on the same!!! Having recognized this disparity, it would be a good idea to match the dimensions of data and the business problem created due to lack of data quality.

Data Quality Dimensions – IT Perspective

Data Accuracy – the degree to which data reflects the real world
Data Completeness – inclusion of all relevant attributes of data
Data Consistency – uniformity of data across the enterprise
Data Timeliness – Is the data up-to-date?
Data Audit ability – Is the data reliable?

Business Problems – Due to Lack of Data Quality

Department/End-Users	Business Challenges	Data Quality Dimension*
Human Resources	The actual employee performance as reviewed by the manager is not in sync with the HR database, Inaccurate employee classification based on government classification groups – minorities, differently abled	Data consistency, accuracy
Marketing	Print and mailing costs associated with sending duplicate copies of promotional messages to the same customer/prospect, or sending it to the wrong address/email	Data timeliness
Customer Service	Extra call support minutes due to incomplete data with regards to customer and poorly-defined metadata for knowledge base	Data completeness
Sales	Lost sales due to lack of proper customer purchase/contact information that paralysis the organization from performing behavioral analytics	Data consistency, timeliness
‘C’ Level	Reports that drive top management decision making are not in sync with the actual operational data, getting a 360^o view of the enterprise	Data consistency
Cross Functional	Sales and financial reports are not in sync with each other – typically data silos	Data consistency, audit ability
Procurement	The procurement level of commodities are different from the requirement of production resulting in excess/insufficient inventory	Data consistency, accuracy
Sales Channel	There are different representations of the same product across ecommerce sites, kiosks, stores and the product names/codes in these channels are different from those in the warehouse system. This results in delays/wrong items being shipped to the customer	Data consistency, accuracy

*Just a perspective, there could be other dimensions causing these issues too

As it is evident, data is not just an IT issue but a business issue too and requires a ‘Collaborative Data Management’ approach (including business and IT) towards ensuring quality data. The solution is multifold starting from planning, execution and sustaining a data quality strategy. Aspects such as data profiling, MDM, data governance are vital guards that helps to analyze data, get first-hand information on its quality and to maintain its quality on an on-going basis.

Collaborative Data Management – Approach

Key steps in Collaborative Data Management would be to:

Define and measure metrics for data with business team
Assess existing data for the metrics – carry out a profiling exercise with IT team
Implement data quality measures as a joint team
Enforce a data quality fire wall (MDM) to ensure correct data enters the information ecosystem as a governance process
Institute Data Governance and Stewardship programs to make data quality a routine and stable practice at a strategic level

This approach would ensure that the data ecosystem within a company is distilled as it involves business and IT users from each department at all hierarchy.

Thanks for reading, would appreciate your thoughts.

Hexaware sees strong order pipeline; 20% growth: Nishar

noreply@blogger.com (Anonymous) — Wed, 12 Sep 2012 01:02:00 -0700

Atul Nishar, chairman, Hexaware, says that we remain quite positive on growing at 20% or more. We feel that if the situation improves with US elections and no debacle in Europe then the environment could only improve.

Atul Nishar, chairman, Hexaware , says that we remain quite positive on growing at 20% or more. We feel that if the situation improves with US elections and no debacle in Europe then the environment could only improve.

He also says that currently there are five deals in the pipeline and one is in the advance stage. The deals are spread across from the United States and Europe, and across major verticals like capital markets, travel and emerging verticals. And in the last nine quarters the company has signed seven large deals.

Below is the edited transcript of his interview to CNBC-TV18.

Q: Hexaware recently had a deal and there have been reports or analyst notes which suggest that the company is in conversation with potential clients for four deals and one is in advance stages. Do you think something could fructify in the near-term?

A: Currently, there are five deals in the pipeline and one is in the advance stage. The deals are spread across from the United States and Europe, and across major verticals like capital markets, travel and emerging verticals. And in the last nine quarters we have signed seven large deals.

Q: Are billings under pressure even if the deals are coming? Are they coming from tight fisted managements?

A: In over last two years, we have marginally improved our average billing on both on onsite and offshore. We don’t see any pressure on pricing on the IT industry. Repeatedly, we have guided that our pricing should be assumed to be stable.

The important point is that the client want value, greater performance, result oriented projects and fixed priced or greater commitment by off shoring companies. Clients do want to cut their costs and get more value, but they also know if it is all done at the cost of the service provider, it will not sustain that particular situation.

Q: How much do you think is Nasscom’s 13-14% growth target under threat? What might it fall to half or high single digits?

A: Nasscom has guided for 11-14% and it is a wide enough range. In the industry we saw that some companies like mid-sized companies and companies who are scale players have also done very well. It is a mixed reason. We have seen more client specific issues coincidence for downsizing for whatever reason that may dent revenue that doesn’t mean they will not be able to grow in future.

Q: Do you think Nasscom will hold the lower end of their 11% range?

A: That is the current optimism. So, there is no reason to believe that there is material change from the guided number.

Q: The one concern around Hexaware has been for some time that you have seen an improvement in margins, but going forward it would come under pressure because in Q3 wage hikes are expected to shave off margins to a certain extent. How do you respond to that?

A: In Q2, ours being calendar year, Hexaware reported 22.9% EBITDA which was higher than Q1. We gave normal 10% increment to all our off shore employees. The impact was absorbed in our margin and in spite of that the margin improved.

We also absorbed the significant visa costs that traditionally come in that quarter. In the coming quarter there will be onsite increase in wages. For off shore workers the date of increment is April 1 and for onsite employees the date is July 1, which remains unchanged. And we feel with this we can guide stable margins.

We are proud that at Hexaware, we have grown at higher than the industry average at good margins. We don’t believe in taking new deals by compromising on margins in any manner.

Q: So at this juncture you don't want to change your guidance of 20% dollar revenue growth any which way, up or down?

A: We remain quite positive on growing at 20% or more. We feel that if the situation improves with US elections and no debacle in Europe then the environment could only improve.

Watch Video

Excerpts from Midcap Radar on CNBC-TV18 Watch the full show »

Job: Peoplesoft Tester In Chennai

noreply@blogger.com (Anonymous) — Wed, 22 Aug 2012 02:31:00 -0700

Title	Peoplesoft Tester
Categories	India
Grade	G4
Skill	Peoplesoft, HRMS Testing, Payroll
Start Date	21-08-2012
Location	Chennai
Job Information	3-5 years of experience in ERP Related Product Testing.
	Knowledge of complete testing life-cycle and different testing methodologies.
	Min. 2 – 3 years of hands on experience on PeopleSoft – HRMS.
	Min. 1 year of experience on writing Test Scripts on PS Payroll Module.
	Good knowledge on HP QC.
	Strong analytical and troubleshooting skills.
Unit	10
	Apply Now

Short-term contracts give mid-cap IT cos new lease of life

noreply@blogger.com (Anonymous) — Fri, 10 Aug 2012 09:24:00 -0700

With the duration of outsourcing deals getting shorter, deals worth nearly USD 85 billion are up for renegotiations this year, reports CNBC-TV18’s Shreya Roy.

Midcap IT players may get a new lease of life. With the duration of outsourcing deals getting shorter, deals worth nearly USD 85 billion are up for renegotiations this year, reports CNBC-TV18’s Shreya Roy.
Over the last few years, uncertain times have forced IT companies to go in for more short-term contracts. For mid-cap IT companies, this may have been a blessing in disguise.
Data from outsourcing advisory firm TPI says that around 700 contracts will be up for renegotiations this fiscal year, compared to 530 last year.
“There is a significant reduction in the tenure of contracts as they were originally signed. Compared to 10 years ago, when 500 of these were being done, there are 1000 a year. The tenure has gone down to five years instead of seven, so a lot of deals are naturally coming back to the market as renewals. In itself, this is a very large opportunity,” said Siddharth Pai, partner and MD at TPI India.
For many IT players, this may be just what the doctor ordered. After all, renewals account for almost 65% of the outsourcing market. Advisory firm Everest estimates that by October 2013, deals worth nearly USD 85 billion will be up for renewal.
These include a contract between HP and Bank of America, a mega deal from Shell group which is currently with AT&T, HP, and T-Systems, a blue cross blue shield deal with Dell and Manu Life's deal with IBM.
Many of these contracts are expected to be broken up into smaller chunks, as outsourcers are looking increasingly towards multi-sourcing. Analysts say this could work in the favour of the smaller players, especially those like Mindtree and Hexaware, which have been focusing on developing niche capabilities to help differentiate from larger players.

Watch Video

Excerpts from India Business Hour on CNBC-TV18 Watch the full show »

Hexaware Technologies :Riding High! --nirmal bang,

noreply@blogger.com (Anonymous) — Tue, 7 Aug 2012 10:02:00 -0700

Riding High!
Hexaware Technologies Limited (HTL) is a mid-sized IT company mainly catering to the capital markets (BFSI) and the airline (transportation) sector. It also focuses on enterprise software provided by PeopleSoft and Oracle. Recent large client wins has bought back the focus on this company which has good expertise in the niche areas.

Investment Rationale

 Improved Revenue visibility due to large wins in the past 5 quarters

The deal wins of over $ 625 mn which HTL has gained in the past 5 quarters is commendable. HTL’s efforts of mining the existing clients in the gloomy days are paying off now reflecting in the incremental revenue streams it has earned. These long term deals give enough revenue visibility for CY12. In addition, HTL is negotiating almost 4 deals above $25mn which are in the pipeline.

 Margins moving northwards – room for further heights
EBIDTA margins have improved 812 basis points in the past 5 quarters led by drastic control in the operating costs. The company has in addition utilized its offshorablity lever in its advantage by moving almost 14% of work offshore during the same period. Currently, onsite: offshore mix stands at 53:47, utilization in early 70’s and plans to hire freshers would further aid the margins going forward. We expect HTL to report EBIDTA margins of 20% + in CY12E and CY13E.

 Proficiency in niche segments paying off
HTL earns 60% of its revenues from the Capital Markets and Travels industries and almost 30% of revenues come from enterprise solutions in terms of its service lines. In enterprise solutions, 60-65% of its revenues are from PeopleSoft where other software vendor’s focus is less.

 Guidance Revision of 20% on USD revenues for CY12E

On the back of good deals won recently, the company has revised the revenue guidance in USD terms to 20%. We feel this is a little conservative and the company can easily beat the guidance for CY12E.
Valuation & Recommendation

We expect HTL’s revenues to grow at a CAGR of 25% and adjusted profits to grow at a CAGR of 21% over CY11-CY13E. Margin improvement would remain under focus and we expect HTL’s EBIDTA margins improving by 313bps to 21.2% in CY13E from 18.03% in CY11. At CMP, the stock is trading at 10.4x and 8.6x for CY12E and CY13E respectively. On the back of improved financials and good revenue visibility, we recommend a BUY on the stock, assigning a target multiple of 11x for CY13E EPS with a price target of Rs. 147 which is a potential 28% upside.

Risks to our Rationale:

 Concentration in Discretion spending Revenues
Hexaware derives more than 50% of its revenues from Enterprise solutions and Business Intelligence and Analytics which could get affected in economic downturn. However, the recent deal wins re-affirms the revenue visibility for the company for CY12E.

 Industry Risks of wage pressures, rupee appreciation and competition
Rupee depreciation has acted in favor of the company and Industry per say. Any severe reversal of the rupee trend would affect the prospects of the firm.

 Exposure in the European Region
The company has 28.4% exposure in the European region and few of the major deals have been signed with clients in this region. Looking at the current economic scenario prevailing in the Euro zone, any delay in commencement of these deals or cancellation may impact the margins severely.

Valuation & Recommendation
We expect HTL’s revenues to grow at a CAGR of 25% and adjusted profits to grow at a CAGR of 21% over CY11-CY13E. Margin improvement would remain under focus and we expect HTL’s EBIDTA margins improving by 313bps to 21.2% in CY13E from 18.03% in CY11. At CMP, the stock is trading at 10.4x and 8.6x for CY12E and CY13E respectively. On the back of improved financials and good revenue visibility, we recommend a BUY on the stock, assigning a target multiple of 11x for CY13E EPS with a price target of Rs. 147 which is a potential 28% upside.

Hexaware Q2 net rises 48% on higher revenues

noreply@blogger.com (Anonymous) — Mon, 6 Aug 2012 11:51:00 -0700

Software service provider hexaware technologies has reported a 48 per cent increase in net profit at Rs 89.03 crore for the second-quarter ended june 2012 against the same period last year.

Click here to read more…

Hexaware bets on UK, new verticals to lead mid-tier IT growth

noreply@blogger.com (Anonymous) — Mon, 6 Aug 2012 11:05:00 -0700

Infosys, TCS and Wipro may be getting cautious in their outlook, but not hexaware technologies

After nine quarters of positive growth, the mid-tier leader is confident of a 20% year-on-year (yoy) growth in dollar revenues for fiscal 2013.

Configuring Oracle Unified Directory (OUD) 11g as a Directory Server

noreply@blogger.com (Anonymous) — Wed, 16 Nov 2011 22:06:00 -0800

I used Oracle Unified Directory (OUD) Version 11.1.1.5.0 during my test deployment locally here. I tried to collect as much information possible in this post for configuration.

Ideally, there are three possible configuration options for OUD:

as a Directory Server
as a Replication Server
as a Proxy Server

In this post, we will talk about configuring OUD after installation as a Directory Server. You can read about OUD installation in my previous post here.

Once installation is completed, you will find following files in $ORACLE_HOME Directory.

-rwxr-x---  1 oracle oracle 1152 May 17 11:16 oud-proxy-setup

-rwxr-x---  1 oracle oracle 1482 May 17 11:16 oud-proxy-setup.bat

-rwxr-x---  1 oracle oracle 1180 May 17 11:16 oud-replication-gateway-setup

-rwxr-x---  1 oracle oracle 1510 May 17 11:16 oud-replication-gateway-setup.bat

-rwxr-x---  1 oracle oracle 1141 Aug 10 16:50 oud-setup

-rwxr-x---  1 oracle oracle 1538 May 17 11:15 oud-setup.bat

In this listing, .bat files are used in windows. So, In Linux (that is what I am using), we will be using following files.

oud-setup – To configure Directory Server
oud-replication-gateway-setup – To configure Directory Replication Server
oud-proxy-setup – To Setup Proxy Server

You can run the script shown below.

$ ./oud-setup
OUD Instance location successfully created - /u01/oracle/Middleware/Oracle_OUD1/../asinst_2
Launching graphical setup...

The graphical setup launch failed.  Check file /tmp/oud-setup-8836874387532698932.log for more details.

Launching command line setup...

Oracle Unified Directory 11.1.1.5.0
Please wait while the setup program initializes...

What would you like to use as the initial root user DN for the Directory
Server? [cn=Directory Manager]:
Please provide the password to use for the initial root user:
Please re-enter the password for confirmation:

On which port would you like the Directory Server to accept connections from
LDAP clients? [1389]: 389

ERROR:  Unable to bind to port 389.  This port may already be in use, or you
may not have permission to bind to it.  On UNIX-based operating systems,
non-root users may not be allowed to bind to ports 1 through 1024
On which port would you like the Directory Server to accept connections from
LDAP clients? [1389]:

On which port would you like the Administration Connector to accept
connections? [4444]:
Do you want to create base DNs in the server? (yes / no) [yes]:

Provide the base DN for the directory data: [dc=example,dc=com]:
Options for populating the database:

    1)  Only create the base entry
    2)  Leave the database empty
    3)  Import data from an LDIF file
    4)  Load automatically-generated sample data

Enter choice [1]: 1

Do you want to enable SSL? (yes / no) [no]: yes
On which port would you like the Directory Server to accept connections from
LDAPS clients? [1636]:

Do you want to enable Start TLS? (yes / no) [no]: yes
Certificate server options:

    1)  Generate self-signed certificate (recommended for testing purposes
        only)
    2)  Use an existing certificate located on a Java Key Store (JKS)
    3)  Use an existing certificate located on a JCEKS key store
    4)  Use an existing certificate located on a PKCS#12 key store
    5)  Use an existing certificate on a PKCS#11 token

Enter choice [1]:
Provide the fully-qualified host name or IP address that will be used to
generate the self-signed certificate [ut1ef1]:

Do you want to start the server when the configuration is completed? (yes /
no) [yes]:

Setup Summary
=============
LDAP Listener Port:            1389
Administration Connector Port: 4444
LDAP Secure Access:            Enable StartTLS
                               Enable SSL on LDAP Port 1636
                               Create a new Self-Signed Certificate
Root User DN:                  cn=Directory Manager
Directory Data:                Create New Base DN dc=example,dc=com.
Base DN Data: Only Create Base Entry (dc=example,dc=com)

Start Server when the configuration is completed

What would you like to do?

    1)  Set up the server with the parameters above
    2)  Provide the setup parameters again
    3)  Print equivalent non-interactive command-line
    4)  Cancel and exit

Enter choice [1]: 3

Equivalent non-interactive command-line to setup server:

oud-setup \
          --cli \
          --baseDN dc=example,dc=com \
          --addBaseEntry \
          --ldapPort 1389 \
          --adminConnectorPort 4444 \
          --rootUserDN cn=Directory\ Manager \
          --rootUserPassword ****** \
          --enableStartTLS \
          --ldapsPort 1636 \
          --generateSelfSignedCertificate \
          --hostName ut1ef1 \
          --no-prompt \
          --noPropertiesFile

What would you like to do?

    1)  Set up the server with the parameters above
    2)  Provide the setup parameters again
    3)  Print equivalent non-interactive command-line
    4)  Cancel and exit

Enter choice [1]: 4
No configuration performed. OUD Instance directory deleted.
$

Then you need to run the oud-setup with the options provided for creating the directory server.

OUD Instance location successfully created – /u01/oracle/Middleware/Oracle_OUD1/../asinst_2

$ ./oud-setup           --cli           --baseDN dc=example,dc=com           --addBaseEntry           --ldapPort 1389           --adminConnectorPort 4444           --rootUserDN cn=Directory\ Manager           --rootUserPassword pass_t3st           --enableStartTLS           --ldapsPort 1636           --generateSelfSignedCertificate           --hostName ut1ef1           --no-prompt           --noPropertiesFile
OUD Instance location successfully created - /u01/oracle/Middleware/Oracle_OUD1/../asinst_2

Oracle Unified Directory 11.1.1.5.0
Please wait while the setup program initializes...

See /tmp/oud-setup-5822533240188214866.log for a detailed log of this operation.

Configuring Directory Server ..... Done.
Configuring Certificates ..... Done.
Creating Base Entry dc=example,dc=com ..... Done.
Starting Directory Server ......... Done.

To see basic server configuration status and configuration you can launch /u01/oracle/Middleware/asinst_2/OUD/bin/status
$  cd bin
$ ./status

>>>> Specify Oracle Unified Directory LDAP connection parameters

How do you want to trust the server certificate?

    1)  Automatically trust
    2)  Use a truststore
    3)  Manually validate

Enter choice [3]: 1

Administrator user bind DN [cn=Directory Manager]:

Password for user 'cn=Directory Manager':

          --- Server Status ---
Server Run Status:        Started
Open Connections:         1

          --- Server Details ---
Host Name:                ut1ef1
Administrative Users:     cn=Directory Manager
Installation Path:        /u01/oracle/Middleware/Oracle_OUD1
Instance Path:            /u01/oracle/Middleware/asinst_2/OUD
Version:                  Oracle Unified Directory 11.1.1.5.0
Java Version:             1.6.0_26
Administration Connector: Port 4444 (LDAPS)

          --- Connection Handlers ---
Address:Port : Protocol               : State
-------------:------------------------:---------
--           : LDIF                   : Disabled
0.0.0.0:161  : SNMP                   : Disabled
0.0.0.0:1389 : LDAP (allows StartTLS) : Enabled
0.0.0.0:1636 : LDAPS                  : Enabled
0.0.0.0:1689 : JMX                    : Disabled

          --- Data Sources ---
Base DN:     dc=example,dc=com
Backend ID:  userRoot
Entries:     1
Replication: Disabled

$

Now, your newly created OUD Directory Server is running in the machine. You can check this with the ldapsearch command.

$ ldapsearch -h localhost -p 1389 -D “cn=Directory Manager” -w ebs_t3st -s sub -b “dc=example,dc=com” “(objectclass=*)” cn
dn: dc=example,dc=com

LDAP Search command will return one entry as shown above.

Here are some of my Observations:

If you want to use the port 389/636 for your Directory Server, then you need to run the setup using root user. Then you need to use start-ds and stop-ds commands using root user only.
There are six scripts to setup OUD components (three for unix/linux and three for windows environments)
You can setup a new TLS based certificate as part of configuring a new Directory Server.

Okay, thats all for now. We will meet in another post. Until then

Read More about Oracle Unified Directory

Advanced Replication Setup for High availability and Performance

noreply@blogger.com (Anonymous) — Mon, 24 Oct 2011 21:43:00 -0700

Introduction

Oracle Unified Directory (OUD) is a latest LDAP Directory offering from Oracle Corp. As mentioned in my previous post, OUD comes with three main components. They are:

Directory Server
Proxy Server
Replication Server

Here, Directory Server provides the main LDAP functionality (I assume you already know what an LDAP Directory Server means). Proxy server is used for to proxy LDAP requests (how?). And Replication Server is used for replicating (copying) data from one OUD to another OUD or even to ODSEE server (we will talk more about replication in this post). You can read about my first post on OUD here. In this current article, I will write about replication server and advanced replication setup for Oracle Unified Directory.

First of all, read OUD Documentation

When do you want to setup replication?

There should be a reason, right? If there is no reason, then there is no need for you to setup replication at all. Instead, you can have a beer and pass the time happily doing something else.

Securing the Replication Traffic

Since OUD provided identity data, all the network traffic is prone to sniffing attacks. Always use encrypted or secure connections to OUD or to any LDAP Directory.

Deciding a Replication Method to use

Here are the quick components of the architecture:

We have one master OUD Server called PROD-01. All the updates to the directory happens here. Most probably, HR System will update the directory. Also, Updates can happen using a custom developed application plug-in for LDAP Directory or using a Identity and Access Management System (IAM) system such as Oracle Identity Manager or Tivoli Identity Manager.
PROD-02 will be used with PROD-01 for High Availability and Performance in this Production Deployment.
In Disaster Recovery deployment, we have PROD-03 and PROD-04 servers. These servers need to synchronize the user data from the master server PROD-01.

We will continue setting up the Replication Server for this architecture. Lets meet in another post - Until then.

Read More about Advanced Replication Setup

My exploration with Oracle Unified Directory 11g

noreply@blogger.com (Anonymous) — Tue, 23 Aug 2011 00:00:00 -0700

When I read the blog post about the introduction of a new product Oracle Unified Directory, first thing that came to my mind was, why another LDAP directory from Oracle? Oracle already has two LDAP Directory offerings, ODSEE (Sun Directory) and OID. However my impression changed after attending this webcast from Oracle (which justified about the new product in general). You can find the Q & A from the webcast here. It looks like “unified” summarizes about the new product.

Personally, I have interests in all the products that deal with LDAP Protocol and LDAP Directories. So, I was interested to know more about the new product. I read about Oracle Unified Directory (OUD) 11g release notes here. You can find the OUD documentation for 11g R1 release (11.1.1.5.0) here.

OUD is one of a brand new directoty product from Oracle as part of the Fusion Middleware Identity Management. OUD comes with Oracle Directory Services Plus (ODS Plus) suite. So, if you already have a license for ODS Plus, then you already have a license to use OUD in your enterprise (Please check with Oracle Licensing before any major deployments to see the existing license covers it).

There are too many TLAs (Three Letter Acronyms) used in this post – I tried to use this minimally but that was not easy. If you hate TLAs, here is a quick recap:

OUD – Oracle Unified Directory

OID – Oracle Internet Directory

ODS (ODSEE) – Oracle Directory Server (previously, Sun Java System Directory Server – also, iPlanet Directory)

DIP – Directory Integration Platform

A brand new LDAP v3 Implementation

LDAP Protocol is the standard way for storing directory entries for an enterprise. With more than 5 years of development (mentioned in the webcast), OUD is a LDAP v3 implementation from Oracle. It was also mentioned that OUD was written in Java.

OUD comes with three main components. They are:

Directory Server
Proxy Server
Replication Server

Directory Server provides the main LDAP functionality. Proxy server can be used for proxy LDAP requests. And Replication Server is used for replication from one OUD to another OUD or even ODSEE server.

Embedded Berkeley DB

This is my favorite part of OUD. There is no separate Oracle Database requirement for OUD (unlike Oracle Internet Directory). Personally I like LDAP Directories embedded with an attached database such as Berkeley DB for storing the data entries. Some may argue that we can use Database features in the LDAP Directory. However I feel that we can use file based storage features for the DB files which can be better.

OUD Replication for ODSEE

Replication is one of the major requirements for LDAP Directories now. To setup high availability environments, we need replication to be setup in almost every LDAP Directory deployment. We need to propagate changes from one OUD directory to another using replication for High-Availability.

One of the important features I like about OUD is its replication gateway for ODSEE (also for OUD). Definitely this is aimed for deployments with ODSEE to migrate to the OUD easily.

Directory Integration Platform (DIP)

Oracle DIP provides functionality to synchronize data from one LDAP Directory to another, such as Active Directory (also from database to the LDAP Directory). Oracle DIP was already available earlier. Now, DIP is supported in OUD as well.

Performance and Security

In existing LDAP Directories, we face performance issues related to writing data entries. In OUD, it was mentioned in the webcast that it provides “5 times write” and “3 times read” performance.

OUD will be used for storing user information for authentication and sometimes for authorization purposes. Also, it can be used to store personnel information. So, security is one of the major concerns during the deployment. I need to explore more on this.

Some of the other features:

dsconfig command – dsconfig command line is used to configure most of the system administration functions for OUD.
ODSM – ODSM is a graphical utility for managing OUD.

So what’s next? Obviously it is time to download the new product and play around with its features.

Installation and Configuration

Installation is a simple task with Oracle Installers. This is no exception for OUD too. OUD installation is a simple process. We just need to download the software and run the runInstaller utility (I have Oracle Linux in my laptop – All my examples below is on Linux).

./runInstaller –jreloc /usr

[I have Oracle Linux 6.0 in my laptop. I installed OUD in this laptop with jre 1.6.0_20 installed under /usr by default. The Java executable is /usr/bin/java/]

OUD installation is a simple process with 7 step installation process:

Welcome
My Oracle Support Updates
Prerequisite checks
Installation Location
Installation Summary
Installation Progress
Installation Complete

[Since the prerequisite checks failed in my laptop (Issue with Linux Version), I have to tweak little bit for the OUD installation, by editing /etc/redhat-release and /etc/oracle-release files]

Once Installation is completed, then we need to configure OUD based on what components we want to deploy.

For each component, OUD comes with a GUI utility for configuration. We can configure OUD for Directory Server, Proxy Server and/or Replication Server. We can run these utilities using command line options for configuration too. The utilities are located under the install folder:

oud-setup

oud-proxy-setup

oud-replication-setup

Once configuration is completed using these utilities, you can use the commands in bin folder to start or stop the components. You can refer the installation guide for more details on this.

Note:

I faced issues during the Server Startup for using the jre in /usr (delivered with Oracle Linux). I will write about it in my next post.

All right… that’s all for now. I will continue to write more on OUD for advanced options for deployment. Also, I will be deploying the ODS connector in OIM to integrate with OUD. We will meet in another post with more details on them. Until then

Read More about Oracle Unified Directory

Let’s talk about Oracle’s Secure Enterprise Search (SES) 11g

noreply@blogger.com (Anonymous) — Wed, 20 Jul 2011 21:43:00 -0700

Introduction

Since the acquisition of Sun few years ago, Oracle is now has more things to offer (especially in the hardware side). From a company of Software Products, Oracle is now a company with lot of hardware stuff as well. Oracle’s Exadata and Exalogic are some of the top-tier hardware offerings that we all know. They are based on Sun SPARC hardware. There are lot of things to talk about… However, in this post, I wanted to explore something less talked about.

If you are an Oracle Shop running Enterprise Applications from Oracle, then you may want to look for Enterprise Search Application from Oracle to provide search capabilities for your intranet applications (especially for content management systems). I came to know about this recently when I was reading the Release Value Propositions for Peopletools 8.52. Then, I realized that this product is used in many other products from Oracle.

Functionality of SES

Secure Enterprise Search (SES) 11g (11.1.2) is a product from Oracle for Search Operations in enterprise systems. Also, Oracle’s Secure Enterprise Search (SES) comes with Oracle Database 11g Enterprise Edition – for use with limited license with Oracle database 11g. SES 11g requires Weblogic Application Server for the functionality (so, obviously it uses lot of Java for sure).

Oracle SES can crawl, search and index for several source types. Some of the content types that are built-in for SES are web content, files, emails, database tables and other SES sources. Also, using connectors you can use many of the content management products for search purposes.

Here are some of the Oracle products that uses/will use SES as part of providing search operations:

Proposed Peopletools 8.52
Fusion Applications
Oracle iAS/Portal
EBS
Siebel
Web Center etc

My personal opinion is, installing something is the simple thing to do with any of the Oracle Products that I know of. If you can understand some of the basic concepts behind Oracle Installers, then you are all set with the installation, nothing complicated here – installation is easy. During the SES installation, you need to make sure the port numbers and the data storage locations are correctly setup. Configuring a product for a specific implementation is something more work to do, some conceptual knowledge will be required at this time.

Most of the time, contents are not public for SES to search. So the search engine should provide crawling and indexing functions for private content. So, a kerberos based authentication or LDAP based authentication can be used in SES as an authentication plug-ins.

SES Scheduler is used to run jobs for crawling and related purposes. Also, we can write a custom Scheduled Tasks for SES using Search API.

If you have some basic understanding of the search engine concepts, then I think SES Administration Tool is simple and easy to understand.

SES Connectors

For searching, there are variety of content available from products from different vendors. SES can perform search and index operations in variety of other target systems using SES Connectors. Obviously, in heterogeneous IT environments, the content is not available in one single source or systems. So, there are different connectors available. Oracle SES 11g connectors are delivered free with the SES product for:

Microsoft Exchange
NTFS File Systems
JDBC Connections to Oracle and MS SQL Server
Microsoft Sharepoint
Oracle Portal 9/10 etc.

There are other SES Connectors available for different products, especially for content management systems. However it looks like they need a separate license to be purchased. You can check the available SES Connectors here.

SES and Oracle products

I checked few of the products that are using/planning to use SES. There are other Oracle Products too. This is only a short list that I know of:

Peopletools 8.52

In the next release of Peoplesoft’s Peopletools (expected in Q3/Q4 2011), SES framework will be used in the Peoplesoft Systems. Peoplesoft Applications already use Verity Software for the Search Operations. We need to wait until Peopletools 8.52 release to see what things are going to change.

To know more about PeopleSoft Application Search in next release of Peopletools, you can check here.

Fusion Middleware and Applications

Web Center uses SES as Search Provider. Also, Fusion Application uses SES as the default search Provider.

Oracle iAS/Portal

Going forward, SES will replace the Oracle’s earlier UltraSearch as the Search Provider in newer versions of Portal.

Oracle EBS

Latest versions of EBS support SES. You may want to check the system certifications for SES on EBS in My Oracle Support.

So, thats it for now. Lets meet you in another post. Until then

Read More about Oracle’s Secure Enterprise Search (SES) 11g

(Some) Internals of Oracle Identity Manager Access Policies

noreply@blogger.com (Anonymous) — Wed, 20 Jul 2011 21:33:00 -0700

Introduction

Many enterprises are considering (or already deployed) an identity management solution either for effective IT automation to reduce costs and/or for compliance purposes. Oracle Identity Manager is part of the Oracle’s identity and Access Management (IAM) solution. It provides functionalities such as, automatic user provisioning, compliance reporting, etc.

In my personal opinion, Oracle Identity Manager (OIM) is a wonderful product from Oracle. Many people don’t understand the basic concepts behind how OIM works. Worst thing is, they complain about the vendor product for their own failures in understanding basic concepts.

If you are planning to work with Oracle Identity Manager, then get ready for learning a lot of new things. OIM requires knowledge and you should be familiar with following:

LDAP Directory – especially Oracle Internet Directory or Oracle Directory Server (formerly Sun/Iplanet Directory)
Basic understanding of XML
Programming in Java
Concepts of Microsoft Active Directory and Microsoft Exchange (if you are planning to integrate them)
Most importantly, self-initiative and interest to research yourself for things you can’t find in “google”.

Oracle Identity Manager stores all the user information, metadata information, audit information, and everything related to data in the Database (similar to Oracle Internet Directory – OID). There are two supported database environments for OIM to store data. It can be:

Oracle Database Server
Microsoft SQL Server

The second major component of OIM is the connectors. OIM connectors provide functionality for connecting to various systems across an enterprise. Good thing about OIM is, there are many connectors available. Also, Oracle is standardizing some of the connector components to get the same feeling across all the connectors. So, if you can understand few connectors, then it will be easier for you to work with the remaining connectors.

Latest OIM connectors can be found here – You can download it as well.

OIM Connector Certification (supported systems for OIM for user provisioning) can be found here.

OIM Connector documentation can be found here.

Basic OIM Concepts

Before we talk about Access Policies, we need to understand few other OIM Concepts. OIM has various objects that work together to achieve the necessary functionality. In an ideal way, OIM should manage the complete lifecycle of user accounts in an enterprise – using automatic ways with no manual intervention during entire lifecycle of user creation, modification and deletion phases.

When a user is created in OIM, there will be corresponding entries available in USR table. USR table has many fields delivered OOTB (OOTB – Out of the box). However for some of the enterprises, this may not be sufficient. We can define additional fields as UDFs (User Defined Fields).

In OIM, almost everything revolves around the user account (I think that is what expected from an identity provisioning software such as OIM). User account is the central piece of data here.

In OIM, Users will be provisioned or de-provisioned with Resources. Resources are a target system, such as, Oracle Internet Directory or Active Directory.

What are OIM Access Policies?

There are three types of objects required to perform automatic provisioning based on policies. When you use Access Policies for auto-provisioning, then it is called as “Policy Based Provisioning”. The main objects required for policy based provisioning are:

Rules
Groups
Access Policies

We can use Rules for placing users to some specific OIM Groups. Once a user is a member of a group, then, Access policies can be used to perform policy-based provisioning in OIM. That’s why we need to understand the dependencies between Rules, Groups and Access Policies.

Rules get evaluated whenever an update is made to the user attributes (such as a password change, email address change etc). Also, we can use the OIM API updateUser() function to re-evaluate rules.

In Design Console, you can use “Policy History” form to view the details of the access policies and resources related to users.

Starting from OIM 9.1.0.2 and later versions (in Fusion Middleware Identity and Access Management 11.1.1.x too), there is a scheduled task called “Evaluate User Policies” delivered OOTB. This task will be useful if you want to provision users by validating all the rules, then automatically adding/removing groups, finally provisioning/de-provisioning resources by access policies.

Some Internals of working

POL table holds details about the Access Policies in OIM database. There are other tables related to OIM Access Policies as well. Some of the interesting ones are:

POP – data about parent table in Access Policies
POC – data about child policies in Access Policies
POG – mapping between access policies and OIM groups (based on pol_key and ugp_key)
POF – Field Values in Access Policies

In USR Table, there is a field called “USR_POLICY_UPDATE”. I think the values can be null or 1. This field is used when “Evaluate user policies” task is run for the evaluate criteria. This field will determine whether the access policies will be reevaluated next time.

User Policy Profile tables – UPP and UPD tables are important user related tables that stores details about access policies for a user and relevant details. These tables normally referred when “Policy History” form is being used for a user in OIM Design Console.

There are two other history tables UPH and UHD. They are history tables for the corresponding User Policy Profile Tables UPP and UPD.

OIU table has two columns, OIU_POLICY_BASED and OIU_POLICY_REVOKE. Based on my understanding, these two columns are set based on the resources provisioned access policy and “Revoke if no longer applies” setting.

Process form tables (UD_ tables) will contain POL_KEY column populated with Access policy. This POL_KEY column is applicable for the OIM Child tables as well.

In OIM, updating the underlying tables are not recommended and not supported by Oracle. These tables will be used when you investigate to try to find out scenarios such as, why a user was not revoked automatically or why she was not provisioned to a resource automatically.

A Sample Implementation

I was thinking of a scenario to explain the usage of access policies for automatic provisioning of Resources in OIM. You can consider an enterprise trying to move to OIM. They have some of the rules based on which user account will be created or modified or deleted. I just have these few rules as an example (in real world, there can be many up to 100+ or even 200+ rules).

All users in HR Department will be part of the AD Group “HR Department”
All users with “IT Operations” should be having a unix account server in “exadata-200”

So, in first case, you can define an OIM Rule, that will place the users with “HR Department” value in an OIM Group “Group_HR_Department”. Then whenever user is part of that OIM Group, then the user can be provisioned to “HR Department” AD Group automatically.

In the second case, we can check for the department with the Rules, place the user in a group – then we can define an access policy to provision user account to “exadata-200” automatically.

Closing note

Access Policies are just one of the features of OIM. There are many other features there in OIM. Implementing OIM is easy if you understand these underlying basic concepts. Also, understanding about the target systems will be useful when investigating issues during the implementation.

As in every project, collecting the requirements is important. In OIM implementations, this is really important, more than that, documenting the requirements is important. Also, sufficient amount of testing is another consideration for OIM implementation projects. I will cover the logistic details of an OIM implementation in another post.

As the saying goes “The more you know, the more you know what you don’t know”. This is true for OIM (for so many other things in IT too). There are still some things I don’t know about OIM Access Policies. I am just working with OIM on what I know now (and still learning). J

Okay. I hope that is it for this post. We will meet in another post with more interesting details about OIM. Until then

Part I – LDAP Directory for the Cloud – Which one do you recommend?

noreply@blogger.com (Anonymous) — Wed, 27 Apr 2011 00:48:00 -0700

I am planning to appear for the CISSP exam sometime this year (could be in the month of May – I believe it really needs more time to prepare). For my Exam, I just completed my reading the Access Control chapter. I am using the Shon Harris AIO guide for my CISSP Exam. Whether I take the exam or not, the more knowledge I gain, then I am good with that. Believe me “Access Control” is not an easy chapter for me (though I worked on that domain for last few years. I have to understand lot of terminologies for the CISSP Exam. I still have 9 more domains to complete before start taking other books (Access Control is just one of them). It looks like it needs a lot more preparation than I thought.

Definition of Cloud Computing

Directory as a Service

Oracle Directory Server (ODS) – formerly Iplanet or Sun LDAP.

Oracle Internet Directory (OID)

Microsoft Active Directory (AD)

IBM Tivoli Directory Server (ITDS)

Novell’s eDirectory

OpenLDAP

What do I think?

Anyways, I don’t want to talk about Access Control here. But it is about the webcast by Mark Wilcox from Oracle couple of weeks ago. Mark webcasted a presentation on “Choosing the right Directory for the Cloud”. You can find the recording here.

Let’s try to understand the general definition of cloud computing first. According to “The NIST Definition of Cloud Computing” Version 15, it is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

According to the definition, there should be shared pool of configurable computing resources. In this context, we are talking about LDAP Directory as a software service that can be configured to provide access through various resources through. In this webcast, Mark talked more about the OID and ODS (see below).

In this context, let’s try to understand how LDAP Directories can be a service in the cloud.

There are many LDAP Directory offerings from various vendors, such as the ones below:

I want to talk more about LDAP directories for the clouds more on covering famous Directories out there. We serve many customers and everyone has their own preference of a LDAP Directory. So, we can’t ignore the other famous LDAP Directories.

When we talk about LDAP Directory for a cloud, we are talking about an LDAP instance for the Cloud application for authentication purposes (in some cases, we can use it for authorization as well).

If you are working with Oracle Products, such as Oracle EBS etc, and you need to consider a integration with LDAP Directory, then I believe Oracle Internet Directory (OID) has more advantages than the others in the list (Also, Oracle certifies most of the Identity Management products for EBS aligning with OID). Main reason is that Oracle Products are certified with OID as a recommended LDAP Directory – they are easy to integrate with the support from the point of the Vendor. Other reasoning is because the data is stored in the database, so you can take advantage of the Database Security Features.

ODS (formerly Sun Java System Directory Server, before that Iplanet Directory Server) is a great product in itself. I am working with this directory for a long time now. The data is stored in the Operating System Files (it internally uses the database structure). ODS follows LDAP v3 protocol standard.

I don’t want to be Oracle-centric in my approach (both of the above two directory servers I mentioned are from Oracle Corp). Mark Wilcox is from Oracle, So he talked more about these two directories in general. Also,

So, how can we provide an LDAP Directory as a service in the cloud? And more importantly what are the important factors that we need to consider while providing this service?

Also, Let’s talk about other directories in coming posts.

Until then

Vijay Chinnasamy

Provisioning to two Active Directory Domains with Oracle Identity Manager – Connector Cloning – Part I

noreply@blogger.com (Anonymous) — Mon, 14 Feb 2011 21:39:00 -0800

In many large enterprises, there can be two Active Directory Domains used (sometimes more than two), for example, one for India users and one for North America users (Considering the company has two major locations). This requires two AD Connector instances to be created in OIM, for provisioning and reconciliation purposes. OIM Connector Guide for Active Directory User Management provides following description for creating copies of the Connector to provision into multiple target systems. However detailed instructions are not available in the connector.

From the Oracle Connector Documentation (Oracle Identity Manager Connector Guide for Microsoft Active Directory User Management – Release 9.1.1 – E11197-11 – Page 186):

Section: 4.15.1

To create a copy of the connector:

Create copies of the IT resource, resource object, process form, provisioning process, scheduled tasks, and lookup definitions that hold attribute mappings.
Create a copy of the Lookup.AD.Configuration lookup definition. In the copy that you create, change the values of the following entries to match the details of the process form copy that you create.
1. 1. ROUserID
  2. ROUserManager
  3. ROFormName
  4. ROUserGUID
Map the new process tasks to the copy of the Lookup.AD.Configuration lookup definition.

Initially I was not sure how I can setup the Cloning. I had two Active Directory Domains. When the users are created in OIM, access policies will identity to which one it has to be provisioned. However I have to setup two AD Connectors for these two domains.

Based on my investigation, following AD Connector Specific objects are involved:

Copy of the IT Resource
Copy of the RO
Copy of the Process form
Copy of the Provisioning Process
Copy of the Scheduled Tasks
Copy of the Lookup Definitions
Copy of the Reconciliation Rule

First, you need to export the relevant objects as XML file, rename them by manually editing the XML file, then re-import them. One recommendation, is run your XML file through “xmllint –format” on Linux, that should make it more readable, so it is easier for you to edit (Thanks to Oracle Support for providing this – xmllint – information).

Here are the steps for cloning a connector – based on my personal experience:

Identify all the connector Objects used by the Active Directory Connector (Mostly the below tables – but I am still not sure whether I covered all the objects – Please let me know if I missed any).
Export these Objects using Deployment Manager Export Utility. This will create an XML File during the export.
Once you have the XML file, you need to identity and replace the values for the objects in the XML file. This is the main reason you should be aware of the AD Connector Objects.
Then, you can import this manipulated XML file into the OIM System. I faced errors during the import. I will write about those errors in the next post.

AD Connector Objects:

S. No.	Object Type	Object Name for AD Connector
1.	IT Resource	AD IT Resource
2.	Resource Object	AD User
3.	Process Form	UD_ADUSERUD_ADUSRC
4.	Provisioning Process	AD User
5.	Scheduled Tasks	Target Recon
6.	Lookup Definitions	Many…
7.	Child Tables	UD_ADUSER*

In my current OIM System, I have the default connector configured to the First AD Domain. The cloned connector is configured to the second AD Domain. I thought it was confusing. So, I had a question about this and received the below information from Oracle Support. Hope it is useful.

The best approach is to import the connector twice for the two domains by using the cloning method to clone twice, and leave the original objects installed unused. That way, when you upgrade to newer connector version on top the existing one, you will update the original unused template objects, then clone the change on to the two domain objects.

Second method is, keeping the installed AD Connector for one domain, and the clone the AD Connector for the second AD Domain, will also work.

I liked the approach of keeping two connectors cloned. You may like the other approach, but it is up to you to decide.

I will write a continuation of this post later. Until then

Something I learned about Oracle Database 11g RMAN restore

noreply@blogger.com (Anonymous) — Mon, 1 Nov 2010 21:27:00 -0700

Last weekend (it was saturday night), I needed to restore a Development database from a old backup. I never did a RMAN restore before until last saturday. As the saying goes, “necessity is the mother of invention”. Though it is not really an invention (rman is there for a long time), for me, I learned to know about RMAN restore last week.
Our DBA was not available on Saturday. I needed to test few things on the Development and for that I need to restore a backup that was taken earlier couple of months ago. So I did the follow the procedures to restore the database using RMAN.
This could be a basic thing all the DBAs know about. But for me this is not something I do everyday. So this was new to me.
First, I ran the “shutdown immediate” command to shutdown my development database. Then I followed these steps to restore the database from a older backup taken by RMAN. Database was running on the Redhat Enterprise Linux Machine and the database version was 11.1.1.6.0.
$ rman
…
RMAN> list backup;
List of Backup Sets
===================
…….
I got the TAG details from here.
……
RMAN> restore datafile ‘/u02/oradata/OIMTST/system01.dbf’ from tag = ‘BEFORERECON’;
…
RMAN> restore datafile ‘/u02/oradata/OIMTST/sysaux01.dbf’ from tag = ‘BEFORERECON’;
….
RMAN> restore datafile ‘/u02/oradata/OIMTST/undotbs01.dbf’ from tag = ‘BEFORERECON’;
…
RMAN> restore datafile ‘/u02/oradata/OIMTST/users01.dbf’ from tag = ‘BEFORERECON’;
…
RMAN> restore datafile ‘/u02/oradata/OIMTST/oimtst4_tspace_01.dbf’ from tag = ‘BEFORERECON’;
…
RMAN> list backup of controlfile;
…
RMAN> restore controlfile to ‘/u02/oradata/OIMTST/control01a.ctl’ from tag = ‘TAG20100820T112653′
…
RMAN> quit
Recovery Manager complete.
$
Copying the Control Files:
============================
cd /u02/oradata/OIMTST # The conrol files are located here.
cp control01a.ctl control01.ctl
cp control01a.ctl control02.ctl
cp control01a.ctl control03.ctl
$ sqlplus / as sysdba….
SQL> startup
ORACLE instance started.
Total System Global Area 1073131520 bytes
Fixed Size                  2151248 bytes
Variable Size             264244400 bytes
Database Buffers          801112064 bytes
Redo Buffers                5623808 bytes
Database mounted.
ORA-01589: must use RESETLOGS or NORESETLOGS option for database open
SQL>
SQL> alter database open resetlogs;
Database altered.
SQL>
Hurray!!!! It is success!!!
This was my first restore using RMAN. I knew the concepts earlier, but I didn’t really restore a database like this before. I thought of sharing this knowledge.
We will meet in another post. Until then

Checking on Oracle Fusion Applications

noreply@blogger.com (Anonymous) — Wed, 29 Sep 2010 00:08:00 -0700

Sun Blogger Vijay Tatkar wrote in his blog about the eight technology innovations mentioned by Larry Ellision during his Oracle Open World Keynote speech during last week. Nearly half of them were Sun Hardware related (such as Exadata, ExaLogicSun ultraSPARC t3 etc). Here is the list:

Fusion Apps
Unbreakable Linux Kernel
Solaris Express 11
unltraSPARC t3 chip
mySQL 5.5
exadata
exalogic
Java 7 and 8

Since the beginning, I am always interested to know more about Fusion Apps, mainly out of curiosity. Oracle Fusion Applications were formally introduced during the Oracle Open World last week (during Open World 2010). As per Oracle Release, this was one of the major innovation or next big thing for Oracle. As you are aware, Fusion Middleware Products were released already. Now, it is time to talk about the Fusion Applications.
You may be already aware; I started my IT career as a Web Developer in a small web hosting company. I used to write perl CGI code and hosting them on Linux Servers running with Apache Web Server and mySQL Database. I got bored (or I wanted a change, I am not sure!) with that job and then moved into the Unix System Administration. I worked as a Sun Solaris Admin and HP Unix Admin for some time. Then I worked in both Peoplesoft System Administration for nearly 7 years and currently working in an Oracle Identity Management (which is part of Oracle Fusion Middleware products) project for nearly past one year.
So, the question is “now what?” And how can we develop the knowledge for Fusion Apps Administration.
I am not sure when Fusion Apps will be deployed full-fledged instead of the other ERP Applications like Peoplesoft. I don’t think it will be near soon, but may be after few years, Oracle may buy in customers who are going to do a new implementation of some ERP Applications.
You know what, Fusion middleware for Fusion Apps is like PeopleTools for Peoplesoft Applications. PeopleTools Technology is the abstract layer on top of which all the Peoplesoft Applications run on. PeopleTools was originally built on C and C++ and finally evolved into a Java Technology. However I still feel some of them are C++ code. While Fusion Middleware is more Java and J2EE apps, I believe Fusion Apps will be more J2EE apps than Peoplesoft. I need to spend little bit more time on implementing a Fusion Middleware and an application. As of now, I only worked on Identity Management Product Sure and little but of Oracle Portal Technologies.
For an IT Infrastructure Administrator like me (who mainly works on Oracle Server Technologies), I think understanding the Fusion Middleware Stack will be important.
Talk to you later. Until then

Read More about Oracle Fusion Applications

Peoplesoft Connectors for Oracle Identity Manager – Part I

noreply@blogger.com (Anonymous) — Thu, 12 Aug 2010 00:43:00 -0700

Introduction

Couple of weeks ago, I attended an Oracle Webcast titled “Introducing Oracle Identity Management 11g”. That webcast was about introducing the remaining components of Oracle Identity Management Product Suite which is part of the Oracle Fusion Middleware 11g (we can call it as a second set of product release!).

During the first phase release of Oracle Fusion Middleware Components, Oracle released the few components such as Oracle Internet Directory (OID), Oracle Virtual Directory (OVD) etc. Along with couple of other components, following are the major software releases (as part of second release) of the new Oracle Identity Management 11g Product Suite:

Oracle Identity Manager
Oracle Access Manager
Oracle Identity Analytics
… and few others …

In Identity Management, Oracle Identity Management 11g product suite provides Identity and Access Management (IAM) functions along with compliance/security related solutions. In Oracle Identity Management 11g, as usual, more features are added such as security development platform, integration with Fusion Middleware.

In this blog series, I am going to talk more about the Oracle Identity Manager (OIM) Product. Let us first understand about the Oracle Identity Manager Product and its features, and then we will talk more about various options available for integrating Peoplesoft Systems with Oracle Identity Manager Product. I used my personal experience with the product and referred the Oracle Identity Manager 11g Release 1 documentation for these. These are various guides available as part of Oracle Fusion Middleware Documentation. If you need in-depth knowledge about this product, you need to refer these manuals. Let’s understand OIM product first.

About Oracle Identity Manager

One of the Major and important Oracle Identity Management Component is Oracle Identity Manager (OIM). Earlier this product was called Xellerate Provisioning (by a company called Thor technologies). OIM product provides a central repository to store user and group information for any organization. One of the important features of OIM is it can integrate with various target systems available (such as Peoplesoft HRMS, SAP, Active Directory, Siebel etc). Also, various other Oracle products such as JD Edwards, EBS and Oracle Retail have connectors as well.

I like the OIM Connectors Page at the Oracle Website. You should visit once. There are connectors for most commonly used products in the market (such as Sun Java Directory, Novell eDirectory, SAP products, Databases, Siebel etc). In this post, I want to explore the Peoplesoft Connectors and how can we deploy these connectors in an enterprise implementing OIM. I am going to provide a conceptual understanding only, for more details on the Connectors; you should refer the connector documentation (Search for “oracle identity manager connector documentation” to visit the Connector Documentation page). Also, other products (that has no connectors) can be integrated with OIM using Generic Technology Connectors (GTC) which is delivered as part of OIM product. We will talk more about GTC in later posts.

Integrating Peoplesoft HRMS system with OIM

Peoplesoft HRM (or HRMS) Systems are ERP systems deployed in many enterprises across the world. Hexaware supports many such Peoplesoft HRMS systems implementation and support across the globe. There are two Peoplesoft connectors available for OIM product. They are:

PSFT Employee Reconciliation Connector
PSFT User Management Connector

These two connectors are used for different purposes in a Peoplesoft based environment. Let’s explore the use of these connectors using an Architecture diagram. I created the following diagram to show the integration and the use of PSFT connectors.

In this High-level Architecture, I used an existing Peoplesoft HRMS System as a trusted source for OIM. OIM will play a role of central repository to store user and group information. The User Provisioning will be happening to multiple target systems mentioned in the diagram.

PSFT Employee Reconciliation Connector is used to perform trusted source reconciliation with Peoplesoft HRMS system. In this scenario, Peoplesoft HRMS system is the source for all the user or employee related information during the entire user management lifecycle (user add, user delete, user modification etc). There are two versions of the PSFT Employee Recon Connector.

Version 9.0.4.x
Version 9.1.x

If you are in Peopletools 8.48 or earlier releases, then you should opt for 9.0.4. For detailed list of supported releases, you can refer the connector documentation.

Both Version 9.0.4.x and Version 9.1.x use Integration Broker Architecture for integrating with OIM. As you are aware, the IB architecture is considerably changed starting with Peopletools 8.48. There are new features added in Peopletools 8.49. For Version 9.1.x, the Supported Peoplesoft HRMS systems are 8.9, 9.0 and 9.1 with Peopletools 8.49 and 8.50.

Let’s explore these two Peoplesoft Connectors for OIM in future posts. I really like to share and learn more about these connectors, mainly for two reasons. I worked as Peoplesoft Admin for so many years and I also learned some basics of OIM recently. Let’s meet in next post. Until then