Oracle Weblogic & Access Manager Administration

OID CPU performence Issue

2011-11-25T08:52:00.000-08:00

I've spent the last six months working on a major OAS upgrade project from one client going from 10.1.2.3 -> 11.1.1.5 OID and apparently we have hit know bug that only impacts our production environment. It would appear the emagent is issuing the following query against the infrastructure database:

SELECT
UDN.ATTRVALUE,
SUM(AT1.ATTRVAL),
SUM(AT2.ATTRVAL),
SUM(AT3.ATTRVAL),
SUM(AT4.ATTRVAL),
SUM(AT5.ATTRVAL),
SUM(AT6.ATTRVAL),
SUM(AT7.ATTRVAL),
SUM(AT8.ATTRVAL),
SUM(AT9.ATTRVAL),
SUM(AT10.ATTRVAL),
SUM(AT11.ATTRVAL),
SUM(AT12.ATTRVAL),
SUM(AT13.ATTRVAL),
SUM(AT14.ATTRVAL),
SUM(AT15.ATTRVAL),
SUM(AT16.ATTRVAL),
SUM(AT17.ATTRVAL),
SUM(AT18.ATTRVAL),
SUM(AT19.ATTRVAL),
SUM(AT20.ATTRVAL),
SUM(AT21.ATTRVAL),
SUM(AT22.ATTRVAL)
FROM ODS.P1_CT_ORCLUSERDN UDN,
ODS.P1_DS_ATTRSTORE AT1,
ODS.P1_DS_ATTRSTORE AT2,
ODS.P1_D

Which completely sucks up all CPU on the server and negatively impacting system response time. You will see this statement run for ~5 min, finish and drop off for another ~5min, and then repeat again under the same PID id. It appears this is know bug:

9078688 - SQLS IN OID'S METADATA XML FILE (SQL FETCHLETS) ARE NOT PERFORMANCE

That was suppose to be fixed in 11.1.1.5...but wasn't. If you are hitting this problem as a temporary work around you can shutdown the emagent with this command:

opmnctl stopproc ias-component=emagent

and life will go back to normal...if you consider not being able to use the administrative functionality of OID as "normal". Let's hope the DEV at Oracle will get this one fixed right on the NEXT release.

Tik-Tok on the clock the party never stops...until you try restarting OID that is

2011-08-25T18:48:00.000-07:00

So you have built out your dev/test/prod enviorments and have worked threw the process of getting all your customers migrated and life is finally looking up after all the misery you went threw. You are so confident now you are ready to actual take your system down and apply security patches! But after doing all your work OID won't come up and when you look @
4ORACLE_INSTANCE/diagnostics/logs/OID/oid1/oidldapd01sXXXX.log shows

ORA-28002: the password will expire within n days

where n is the number of days.
WTF you say? Rest assured my friend you have hit a new "feature" built into 11 R2 and it has just brought a moment of panic to your planned weekend outage. By default Oracle puts ODS & ODSSM on a 180 day self-destruct timer once you actually install the software. To avoid hitting this issue you can modify the default profile like so:

ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED;
or you can create a new profile and assign it to ODS & ODSSM. For further clarification you can take a look at note 1064334.1

Oracle DIP (Directory Interface Protocal) setup in 11g

2011-06-22T12:16:00.000-07:00

Purpose:

Identify the steps required to configure the DIP for directory synchronization. At the time of this writing the GUI Oracle ships with 11g is a pieace of shit and doesn't work correctly. It flags things that are invalid, when in fact, they are vaild and I highly recommend you avoid the GUI and use the command lines to setup intergration between OID and Active directory (or any directory for that matter)

Part I: Directory setup

Be sure prior to completing this document you have followed Oracle note 1203271.1 and have correctly provisioned service accounts in both OID & AD that have the appropriate permissions. I would recommend creating a new account and giving those user “administrative” permissions since they need to touch about every part of the directory.

Part II: Modify DIP configuration files

First step in configuration the DIP process is to be sure the A) DIP properties file is correct and B) The directory mapping file is correct. This post will not focus on how theses files should be configure, however if you wish to learn more you can review Oracle note 859177.1.

Part III: Configure keystore

In order to use SSL with the DIP process we must first configure the example.jks file to contain all the certificates public keys used by both AD & OID.

Create an empty keystore:

keytool -genkey -alias foo -keystore example.jks

keytool -delete -alias foo -keystore example.jks

Next import the various public key’s used by OID for SSL:

keytool -import -trustcacerts -alias "example" -file public-key.cer -keystore example.jks -storepass <password>

Next register the keystore with weblogic from the same server were OID is installed:

manageDIPServerConfig set -attr keystorelocation -val /app/infra/certs/example.jks -h localhost -p 7005 -wlsuser weblogic

Set the password within weblogic:

$ORACLE_HOME/common/bin/wlst.sh

connect ('weblogic', '<password>', 't3://localhost:7001')

createCred(map="dip", key="jksKey", user="jksuser", password="<password>")

At this point the setup should be complete. We will want to test the profile connection within EM once we have the profile registered (Since that is the only think in EM that appears to work correctly)

Part IV: Create DIP Profile & Mapping in OID

Once you have the configuration files as desired the next step is to load both the ExampleExport.profile and ExampleExport.map configurations into OID. This can be accomplished by execute the following commands:

manageSyncProfiles register -h localhost -p 7005 -D weblogic -f /app/infra/wl-home/Oracle_IDM/ldap/odi/conf/EXAMPLE/ExampleExport.profile

followed by a validation check:

manageSyncProfiles validateProfile -h localhost -p 7005 -D weblogic -pf ExampleProfile

At this point the profile exist is registered in OID and can be acceded through EM (It may show it as invaild when it is not). Be default the profile was NOT enabled. When you are at a point where you feel comfortable enabling it (IE ready to move to the new target directory) enabled the profile with the following command:

manageSyncProfiles activate -h localhost -p 7005 -D weblogic -pf ExampleProfile -fa true

However, prior to doing that please sure you have boot-strapped the directory first before enabling the profile

Part V: Bootstrap Directory

In order to get OID and AD in sync we must boot-strap the directory. To boot strap the directory execute this command:

syncProfileBootstrap -host 10.98.0.9 -port 7005 -D weblogic -profile ActiveImport_Groexample -lp 5

At this point you should also enable the profile

Installing Oracle Forms & Reports 11.1.1.4 on RHEL Linux

2011-06-22T11:56:00.000-07:00

Part I: O/S Setup

Running Oracle Forms/Reports linux is completely impossible on any platform other then 64-bit Linux. Yes, the certification documentation may indicate you can run on 32-bit Linux; but in reality you can’t. That is because at their minimal configurations the process will consume 3 gig’s of RAM just sitting there idling. So given you can only allocate 4 gigs of RAM in 32 bit Linux you can see where the problem exists. If you dig deep in the Oracle documentation you actually find that they require 6 gig’s of RAM for a bare-bones system. With that in mind we have the following:

Red Hat Enterprise Linux 5.6 64-bit (RHEL)

4 Gig’s of RAM (You can squeeze by with 2 in DEV if need be)
60 gigs of virtual storage mounted as /app/infra
1 virtual CPU
3 gigs of /tmp space (Necessary for web-logic to install)
3 gigs of swap space

The first action is to create a service account to own all of the software. We need to create the groups “dba” & “oinstall”. Next we need to create a user (which is “oracle” of course) to be granted access to those groups:

groupadd dba

groupadd oinstall
useradd –g dba –G oinstall oracle
passwd oracle

We also need to install a bunch of packages in RHEL to satisfy future dependence needs. This can be accomplished with the following yum command executed as root:

Now we need to re-configure the server’s operational parameters to give the various fusion middleware components the resources it needs to operate. Your numbers will differ based upon your hardware specs, but in /etc/sysctl.conf you will need to change theses:

kernel.shmmax = 68719476736

kernel.shmall = 4294967296

and append theses to the end of the file:

kernel.sem = 250 32000 100 128
net.core.rmem_default=4194304
net.core.rmem_max=4194304
net.core.wmem_default=262144
fs.file-max = 6815744
net.ipv4.ip_local_port_range = 9000 65500
net.core.wmem_max = 1048576
fs.aio-max-nr = 1048576
kernel.shmmni = 4096

followed by this command to make the kernel changes take-effect:

/sbin/sysctl -p

Next we need to modify /etc/security/limits.conf and append the following to the file:

oracle soft nproc 2047

oracle              hard    nproc   16384
oracle              soft    nofile 1024
oracle              hard    nofile 65536

and append this to /etc/pam.d/login:

session required pam_limits.so

Since fusion middleware runs a jillion different process, which would take forever to correctly configure with SELinux, we disable SELinux by editing /etc/selinux/config and setting this:

SELINUX=disabled

Finally, at this point we should bounce the server. We have pushed through a lot of changes and a nice clean bounce is advisable before continuing. Also, because of the complexities associated with fussion middleware and the fact that we are installing all the infrastructure components on the same machine with same service account a robust profile for oracle is strongly recommend.

Part II: Install Web-logic

The biggest challenging in installing OAS 11g is locating the components you need to install! I strongly recommend you pull any software you need from edelivery.oracle.com. The downloads may be slow; but usually the organization format is much better and the usually have the install software installed followed by patchsets. Remember patchsets are cumulative in 11g so it is save to install the software and then install the highest patchset and you are good to go. Assuming we have the latest version of Weblogic, which at the time of this writing is 10.3.5, we can begin the install by unzipping the file and issuing this command::

java –jar –d64 wls1035_generic.jar

During the installation un-check the “Coherence” components and un-check the evaluation database and specify the following for the installation path: /app/mid/wl-home. At the end of the installation be sure to un-check launch startup screen: We will configure the domain at the same time we configure the forms/reports/discoverer components.

Part IV: Install Forms/Reports software

From edelivery.oracle.com download 11.1.1.2 & 11.1.1.4 Forms/Reports/Discover software. Once you have all the components downloaded unzip them and make sure the “Disk” directories are all in the same folder and sequential to each other (IE Disk1, Disk2, etc) Once that is done execute the “setup.exe” located in disk one. Use the following for the Oracle home location:

/app/mid/wl-home/as_1

Once the installer is finished repeat the process and install the 11.1.1.4 patchset.

Following the patchset install we need to install a one-off patch to deal with a specific error that impacts compling forms. Download patch 9473270 and install it with opatch following by the following series of commands:

Cd $ORACLE_HOME/forms/lib

make -f ins_forms.mk frmcmp_install

make –f ins_forms.mk frmbld_install
make –f ins_forms.mk frmcmpb_install
make –f ins_forms.mk frmweb_install

Which causes another series of problems that need to be fixed by following note 1218994.1 and relinkings the reports process.

Part V: Configure WebLogic and Forms/Reports stack

Once both the base install, and the patchset, have been installed we can now configure the software. To do this execute the following command:

ORACLE_HOME/bin/config.sh

This will begin the process to actually configure a running instances of the software. From the configuration menu select the following components:

Oracle Forms

Oracle Reports

Oracle Forms Builder

Oracle Reports Builder

Oracle HTTP Server

And specify the following for the ORACLE_INSTANCE:

/app/mid/wl-home/asinst

And the following for the domain name to something a bit more descriptive: FormsDomain

Once the software finishes configuring we can verify everything is operating correctly by logging into the domain control:

http://<hostname>:7001/em

http://<hostname>:7001/console

Following the configuration of the software we need to setup a boot.properties file so we don’t have to specify weblogic credentials for the admin server and the various domain components. This can be accomplished by creating the boot.properties file in the following locations:

/app/mid/wl-home/user_projects/domains/FormsDomain/servers/AdminServer/security

/app/mid/wl-home/user_projects/domains/FormsDomain/servers/WLS_FORMS\security
/app/mid/wl-home/user_projects/domains/FormsDomain/servers/WLS_REPORTS\security

The file format should be as follows:

username=weblogic

password=<password>

The file will automatically encrypt itself on the next server startup and I recommend restarting the entire stack at this point to test the changes:

stopManagedWebLogic.sh WLS_FORMS

stopManagedWebLogic.sh WLS_REPORTS
opmnctl stopall
stopWebLogic.sh

followed by:

startWebLogic.sh &
opmnctl startall
startManagedWebLogic.sh WLS_FORMS
startManagedWebLogic.sh WLS_REPORTS

Also, we can remove the default report server with the following command:

opmnctl deletecomponent -adminUsername weblogic -adminHost localhost -adminPort 7001 -oracleHome /app/mid/wl-home/as_1 -oracleInstance /app/mid/wl-home/asinst -instanceName asinst -componentName <report name> -componentType ReportsServerComponent

Part VI: Configure Web-Util

The components/configuration for web-util are mostly in place, but we need to copy the in the Jacob.jar file to $ORACLE_HOME/forms/java and Jacob.dll to $ORACLE_HOME/forms/webutil. Can't rember the exact URL, but make sure you dowload version 1.10.1 as specified in note 1137293.1

Part VI: Configure Auto-start on Linux

Cut & past the following into /etc/init.d/orainit and then cd to /etc/rc5.d and execute the following commands;

ln –s /etc/init.d/orainit S99orainit
ln –s /etc/init.d/orainit K99orainit

#!/bin/sh

# description: webLogic adminServer and managedServer start script
WLS_DOMAIN=FormsDomain
WLS_BASE=/app/mid/wl-home
WLS_HOME=${WLS_BASE}/user_projects/domains/$WLS_DOMAIN
WLS_NODE_HOME=${WLS_BASE}/wlserver/server/bin
WLS_OWNER=oracle
WLS_ADMIN_PORT=7001
WLS_ADMIN_LOGIN=weblogic
WLS_ADMIN_PWD=admin
WLS_LOG_START=${WLS_BASE}/logs/start.`date '+%d%m%y'`.log
WLS_LOG_STOP=${WLS_BASE}/logs/stop.`date '+%d%m%y'`.log
WLS_MANAGED_SERVER1=WLS_FORMS

export ORACLE_INSTANCE=/app/mid/wl-home/asinst
export ORACLE_HOME=/app/mid/wl-home/as_1

if [ ! -f $WLS_HOME/startWebLogic.sh ]

then

echo "WebLogic startup: cannot $WLS_HOME/startWebLogic.sh "
exit
fi
startWeblogic()
{
#start node manager
su $WLS_OWNER -c "nohup $WLS_NODE_HOME/startNodeManager.sh > ${WLS_LOG_START} 2>&1 &"
sleep 10

#start admin server
su $WLS_OWNER -c "nohup $WLS_HOME/startWebLogic.sh >> ${WLS_LOG_START} 2>&1 &"
sleep 10

#start OHS proccess
su $WLS_OWNER -c "nohup ${ORACLE_HOME}/opmn/bin/opmnctl startall &"
sleep 30

#Start the rest of the IDM proccess

su $WLS_OWNER -c "nohup $WLS_HOME/bin/startManagedWebLogic.sh $WLS_MANAGED_SERVER1 >> $WLS_LOG_START 2>&1 &"

sleep 10
}

stopWeblogic()
{
#Stop node manager
su $WLS_OWNER -c "nohup $WLS_NODE_HOME/stopNodeManager.sh > $WLS_LOG_STOP 2>&1 &"
sleep 10

#Stop managed nodes
su $WLS_OWNER -c "nohup $WLS_HOME/bin/stopManagedWebLogic.sh $WLS_MANAGED_SERVER1 t3://localhost:$WLS_ADMIN_PORT >> $WLS_LOG_STOP 2>&1 &"
sleep 10

#stop OHS proccess

su $WLS_OWNER -c "nohup ${ORACLE_HOME}/opmn/bin/opmnctl stopall &"

sleep 30

#Stop admin server
su $WLS_OWNER -c "nohup $WLS_HOME/bin/stopWebLogic.sh >> $WLS_LOG_STOP 2>&1 &"
sleep 10
}

case "$1" in

'start')

        startWeblogic
        ;;

    'stop')
        stopWeblogic
        ;;

    'restart')

stopWeblogic

startWeblogic

;;

echo "Usage: $0 start|stop|restart"

exit 1

;;

esac

Finally, at long last you have finished setting up a forms instance. Remember the good old days of 10g when everything was done for you in one shot? L

Changing orclhostname in OID in 11g

2011-06-12T20:43:00.000-07:00

One of the major changes in 11g is you have to establish a new OID instance if you require certificate authentication. This is often necessary if you are using the DIP plug-in, or any other product that requires -U 2 authentication in the SSL handshake. More on that setup is here:

http://download.oracle.com/docs/cd/E12839_01/oid.1111/e10029/oid_server_instances.htm
One of the challenges of creating another component in 11g is it creates a new OID instance listening on the default hostname ip address listening on a non-standard port (vs 389 & 636) You can do the following to change the IP address:

1) Create a new virtual ip address on the server that contains a user-friendly DNS tag
2) Update orclhostname in OID @ cn=<oid name>,cn=osdldapd,cn=subconfigsubentr
3) Run the following command: $ORACLE_INSTANCE/bin/opmnctl updatecomponentregistration -adminHost localhost -host <new IP address> -adminPort 7001 -adminUsername weblogic -componentType OID -componentName oid2 -Port 3060 -Sport 3131
4) restart everything

When it comes back up you will notice that the OID process are up: But the server properties do not show up in the weblogic console! It show an error that it couldn't find the process on the OLD ip address. To resolve this problem do the following:

In your $DOMAIN_HOME/opmn/toplogy.xml file change the host value in both <ias-instance id="asinst" oracle-home="/app/infra/wl-home/Oracle_IDM" instance-home="/app/infra/wl-home/asinst" host="xxxx" port="6701"> and <property name="host" value="xxxx"/> to match your virtual IP address and start all your process and you are good to go! Once that is done you can configure your ports to listen on common ports & protocols and not conflicts with process that may already be listening in on that IP address!

Linux IDM Auto-start for OID SSO WebLogic

2011-05-31T20:51:00.000-07:00

So you have been reading my other post about OID + SSO setup and you got everything running, but now you need a way to auto-start everything from Linux right? Make sure you have a properly configured boot.properties under WL_HOME/security and cut-and-paste the rest to tailor your needs and drop into the desired rc.d folder for the target run-time. Don't forget to enable the auto-start within /etc/oratab for the database!

#!/bin/sh
# description: webLogic adminServer and managedServer start script
#
WLS_DOMAIN=IDMDomain
WLS_BASE=/app/infra/wl-home
WLS_HOME=${WLS_BASE}/user_projects/domains/$WLS_DOMAIN
WLS_NODE_HOME=${WLS_BASE}/wlserver/server/bin
WLS_OWNER=oracle
WLS_ADMIN_PORT=7001
WLS_ADMIN_LOGIN=weblogic
WLS_ADMIN_PWD=<password>
WLS_LOG_START=${WLS_BASE}/logs/start.`date '+%d%m%y'`.log
WLS_LOG_STOP=${WLS_BASE}/logs/stop.`date '+%d%m%y'`.log
WLS_MANAGED_SERVER1=wls_ods1
WLS_IDM_HOME=${WLS_BASE}/Oracle_IDM
DB_HOME=/app/infra/db/product/11.2.0/dbhome_1
SSO_HOME=/app/infra/sso-home
export ORACLE_SID=infradev
export PATH=/bin:/usr/bin
export ORACLE_HOME_LISTNER=${DB_HOME}
export ORACLE_INSTANCE=/app/infra/wl-home/asinst
if [ ! -f $WLS_HOME/startWebLogic.sh ]
then
    echo "WebLogic startup: cannot $WLS_HOME/startWebLogic.sh "
    exit
fi
startDb(){
export ORACLE_HOME=${DB_HOME}
#start DB & Listener
su $WLS_OWNER -c "${DB_HOME}/bin/lsnrctl start &"
su $WLS_OWNER -c "${DB_HOME}/bin/dbstart &"
sleep 60
}
stopDb(){
#Stop database
export ORACLE_HOME=${DB_HOME}
su $WLS_OWNER -c "${DB_HOME}/bin/lsnrctl stop &"
su $WLS_OWNER -c "${DB_HOME}/bin/dbshut &"
sleep 60
}

startWeblogic()
{
#start node manager
su $WLS_OWNER -c "nohup $WLS_NODE_HOME/startNodeManager.sh > $WLS_LOG_START 2>&1 &"
sleep 10
#start admin server
su $WLS_OWNER -c "nohup $WLS_HOME/startWebLogic.sh >> $WLS_LOG_START 2>&1 &"
sleep 10
#start OID & OHS proccess
export ORACLE_HOME=${WLS_IDM_HOME}
su $WLS_OWNER -c "nohup $WLS_IDM_HOME/opmn/bin/opmnctl startall &"
sleep 30
#Start SSO server
export ORACLE_HOME=${SSO_HOME}
su $WLS_OWNER -c "nohup $SSO_HOME/opmn/bin/opmnctl startall &"
sleep 30
#Start the rest of the IDM proccess
su $WLS_OWNER -c "nohup $WLS_HOME/bin/startManagedWebLogic.sh $WLS_MANAGED_SERVER1 >> $WLS_LOG_START 2>&1 &"
sleep 10
}
stopWeblogic()
{
#Stop node manager
su $WLS_OWNER -c "nohup $WLS_NODE_HOME/stopNodeManager.sh > ${WLS_LOG_STOP} 2>&1 &"
sleep 10
#Stop managed nodes
su $WLS_OWNER -c "nohup $WLS_HOME/bin/stopManagedWebLogic.sh $WLS_MANAGED_SERVER1 t3://localhost:$WLS_ADMIN_PORT >> ${WLS_LOG_STOP} 2>&1 &"
sleep 10
#stop SSO server
export ORACLE_HOME=${SSO_HOME}
su $WLS_OWNER -c "nohup $SSO_HOME/opmn/bin/opmnctl stopall &"
sleep 30
#stop OID & OHS proccess
su $WLS_OWNER -c "nohup $WLS_IDM_HOME/opmn/bin/opmnctl stopall &"
sleep 30
#Stop admin server
su $WLS_OWNER -c "nohup $WLS_HOME/bin/stopWebLogic.sh >> ${WLS_LOG_STOP} 2>&1 &"
sleep 10
}
case "$1" in
    'start')
startDb
        startWeblogic
        ;;
    'stop')
        stopWeblogic
stopDb
        ;;
    'restart')
        stopWeblogic
        startWeblogic
        ;;
    *)
        echo "Usage: $0 start|stop|restart"
        exit 1
        ;;
esac

Install 10.1.4.3 SSO Server

2011-05-31T20:43:00.000-07:00

At this point you should do another full cold backup of both the database and various components of software you installed. In order to setup the SSO server we must first manually create the schema used by the SSO server. To do this we will need to use the 10.1.4 MCU creation assistant (Note this is a different repository utility then what was used to create the OID schema). The technical requirements for installing the MCU are fairly ridged: Basically you need x86 environment running either windows XP or RHEL 4. Once you have overcome that challenge we need to execute the following command to downgrade the OID version (NOTE: You cannot bounce OID from this point forward without causing problems)

$ORACLE_HOME/perl/bin/perl $ORACLE_HOME/ldap/bin/inspre11.pl <oid host> 389 -nonssl oid1 chinook.pugetsound.edu:1521:infraprod <password> <password> -op1

Execute the repository creation tool against the infrastructure database. Follow the screens and select load & register to load both the database and OID. You will be prompted to supply an ORACLE_HOME directory understand this means the ORACLE_HOME of your infrastructure database and NOT the computer/server where the MCU is installed. (Example: /app/infra/db/oradata/infratst). Like-wise supply the same location for the oradata on your database server where you currently have all your DBF files location. You will get an error about knowledge base not found, ignore this and continue on.

Post install change back the ods password to the original in the database and execute the following:

ORACLE_IDM_HOME/ldap/bin/oidpasswd connect=OIDDB create_wallet=true

Followed by:

$ORACLE_HOME/perl/bin/perl $ORACLE_HOME/ldap/bin/inspre11.pl sso.example.com 389 -nonssl oid1 oiddb <password> <password> -op2

Download SSO server software and install it using the following commands:

linux32 bash

unset TNS_ADMIN

./runInstaller –ignoreSysPreReqs

Specify the following options:

1) ORACLE_HOME location: /app/infra/sso-home,

2) Select “Oracle Application Server Infrastructure”

3) Select “Identity Management” (Ignore all the errors on the next screen)

4) Select the following: “Oracle Application Server Single Sign-On”, “Oracle Application Server Delegated Administrator”, “High Availability & Replication”

5) Select Virtual host

6) For the virtual hostname specify sso.example.com (By doing this we avoid wiring in the SSO server to the same host name the SSO process run on).

During the installation you will receive an error that the opmnctl cannot start. This is normal. Manually start this process by issuing the following command from a different SSH session and then click on “continue”:

$ORACLE_HOME/opmn/bin/opmnctl startall

Further in the installation you will receive an error during the configuration of OC4J. While the installer is still up download patches 6880880 & 5649850 and install both (Be sure to use the 10.1 version for 6880880). Once both patches are installed click on retry within the install to complete the installation.

Once the first iteration of the SSO server is installed download and install patch 6265268 replacing the following files:

$STAGE_LOCATION/Disk1/stage/Queries/DBConnectQueries/8.4/1/DBConnectQueries.jar

$STAGE_LOCATION/Disk1/stage/Queries/IP_DBQueries/3.0/IP_DBQueries.jar

$ORACLE_HOME/inventory/Queries21/DBConnectQueries/8.4/DBConnectQueries.jar

$ORACLE_HOME/inventory/Queries21/IP_DBQueries/3.0/IP_DBQueries.jar

Next, we need to install 10.1.4 patchset to bring the server into the certification matrix. This can be down by downloading patchset 7215628. Make sure you issue this command before starting:

opmnctl stopall

This patch is MUCH better than the original 10.1.4 install and does not need any tweaking while installing and does not require any special tricks. Finally, we can change the OID version back to the normal version and it is save to bounce all the products. Be sure to change ods password back, again, before issuing this command:

$ORACLE_HOME/perl/bin/perl $ORACLE_HOME/ldap/bin/inspre11.pl <hostname> 389 -nonssl oid1 oiddb <password> <password> -op3

To judge he successfully of the install verify you can log into the various components:

http://<hostname>:7001/em

http://<hostname>:7005/odsm

http://sso.example.com:7777/pls/orasso

http://sso.example.com:7777/oiddas

Configure IDM stack & change OID ports

2011-05-25T16:28:00.000-07:00

If you have made it this far and have been following my post I STRONGLY urge you to take a full cold backup of both the database and IDM & web-logic homes. Once you are ready make sure your profile is set to use the IDM oracle home and execute the following command:

ORACLE_HOME/bin/config.sh

Follow the screens to configure a new weblogic domain and configure an OID instance. If you are using the profile I posted eariler the values will auto-populate and it is merely a matter of filling in database password and other admin information. Be sure to only select OID and DIP for the installed components (I have a need for the DIP for AD integration hence it's innconlusion). Once the software finishes configuring we can verify everything is operating correctly by logging into the domain control:

http://<hostname>:7001/em

http://<hostname>:7001/console

Following the configuration of the software we need to setup a boot.properties file so we don’t have to specify weblogic credentials for the adminServer and wls_ods1. This can be accomplished by creating the boot.properties file in the following locations:

/app/infra/wl-home/user_projects/domains/IDMDomain/servers/wls_ods1/security

/app/infra/wl-home/user_projects/domains/IDMDomain/servers/AdminServer/security

The file format should be as follows:

username=weblogic

password=<password>

The file will automatically encrypt itself on the next server startup and I recommend restarting the entire stack at this point:

stopManagedWebLogic.sh wls_ods1

opmnctl stopall

stopWebLogic.sh

followed by:

startWebLogic.sh &

opmnctl startall

startManagedWebLogic.sh wls_ods1 &

Prior to moving forward we should use this time to change the default OID port of 3060 & SSL port of 3160 to the standard ports of 389 & 636. To do this use the GUI built into http://<hostname>:7001/em under "oid1" to change the ports and bounce OID:

opmnctl stopall

opmnctl startall

Once finished execute the following command to update the EM components and make them aware of the new port defintions:

$ORACLE_INSTANCE/bin/opmnctl updatecomponentregistration \

-adminHost localhost \

-adminPort 7001 \

-adminUsername weblogic \

-componentType OID \

-componentName oid1\

-Port 389 \

-Sport 636

Finally update the DIP server to utilize the new port definitions:

manageDIPServerConfig set -h localhost -p 7005 -D weblogic -attr oidhostport -value <hostname>:636

Weblogic & OID install

2011-05-25T16:18:00.000-07:00

With the infrastructure setup we are ready to move to installing web-logic & OID. Prior to installing WebLogic we need to first install a 64-bit JDK. This can be accomplish by downloading the software from otn.oracle.com and unzipping it to the directory of your choice. For the infrastructure setup I used /app/infra/jdk1.6.0_24. Once the JDK is installed we are ready to install the web-logic software. I highly recommend downloading version 10.3.4 as this contains all the latest paths and will need no additional components installed once finished. Once you are ready to install the software issue the following command:

java –jar –d64 wls1034_generic.jar

Follow the install screens and un-check the “Coherence” components and un-check the evaluation database and specify the following for the installation path: /app/infra/wl-home. At the end of the installation be sure to un-check launch startup screen: We will configure the domain at the same time we configure OID. At this point you should be finished installing the web-logic software and ready to move onto the IDM software installation.

The installation of the IDM software is a two part process. First we need to install the 11.1.1.2.0 software without configuring the software. For my setup I specified /app/infra/wl-home/Oracle_IDM as the ORACLE_HOME. Once the 11.1.1.2.0 software finished we are ready to install the 11.1.4.0 pathset. Follow the same exact steps as identified previous and install into the same home and do not configure the software. At this point the IDM software/patching is complete.

Since Oracle has "improved" the proccess we must use Repository Creation Utility and mannually install the OID schema into the infrastructure database we created earlier in my blog. To stay on the certification matrix we need to use the RCU 11.1.1.5.0 utility. Most of the screens on the RCU are self-explanatory; but be sure to only select “OID” as the component to install. Once finished we are ready to actually configure the various components.

Installing the Infrastructure database for OAS 11.1.1.4

2011-05-24T17:58:00.000-07:00

Now that the server has been squared away we can move forward installing the infrastructure database. With version prior to 11g the database used as the meta-datat repository for OID and the SSO engine was installed automatically. With 11g you must install and configure this component yourself. In theory you could co-locate this with application data; but I would recommend against this approach. The database and it’s configurations have very tight tolerances on the support matrix that do not suit themselves to a given application development process or a conventional security patching model. So given those constraints I have co-located the database with on the same server I will install OID & SSO on.

So to start we need to download Oracle 11gr2, version 11.2.0.1.0 or higher 64-bit edition, an install just the software (do not configure a starter database at this point) into its own home @ /app/infra/db/product/11.2.0/dbhome_1. Once the software has finished we can move forward with creating an actual database. We do this by executing the dbca command and select create database. For our purposes here are the switches that must be thrown:

character set = al32utf8

open cursors = 600

processes = 600

aq_tm_proccesses = 1

db_cache_size=155189248

java_pool_size=171966464

large_pool_size=4194304

pga_aggregate_target=117440512

sga_target=637534208

shared_io_pool_size=12582912

shared_pool_size=272629760

streams_pool_size=8388608

pga_aggregate_target=100663296

The setting have to be precise on your database configurations otherwise steps related to object creation will fail later on for the SSO & OID schema creation. The above configurations where on the low end I had to go with; a busier production would probably need to be double in size.

Next we need to configure our listener.ora:

SID_LIST_LISTENER =

(SID_LIST =

(SID_DESC =

(GLOBAL_DBNAME = infradev.example.com)

(ORACLE_HOME = /app/infra/db/product/11.2.0/dbhome_1)

(SID_NAME = infradev)

)

LISTENER =

(DESCRIPTION_LIST =

(DESCRIPTION =

(ADDRESS_LIST =

(ADDRESS = (PROTOCOL = TCP)(HOST = sso.example.com)(PORT = 1521))

)

And tnsnames.ora.....

VHOST_ALIAS =

(ADDRESS = (PROTOCOL = tcp)(HOST = sso.example.com)(PORT = 1521))

infradev.example.com =

(DESCRIPTION =

(ADDRESS = (PROTOCOL = TCP)(HOST = sso.example.com)(PORT = 1521))

(CONNECT_DATA =

(SERVER = DEDICATED)

(SERVICE_NAME = infradev)

)

infradev =

(DESCRIPTION =

(ADDRESS = (PROTOCOL = TCP)(HOST = sso.example.com)(PORT = 1521))

(CONNECT_DATA =

(SERVER = DEDICATED)

(SERVICE_NAME = infradev.example.com)

)

Copy $ORACLE_INSTANCE/network/admin values here:

OIDDB=(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=sso.example.com)(PORT=1521))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=infradev.example.com)))

And replicated tnsames.ora to here:

/app/infra/wl-home/Oracle_IDM/network/admin

and lastly start our listener:

lsnrctl start

At this point the database setup is complete. It is highly advisable to take a cold-backup in case the oid & sso schema creation process fails and you need to start over again. I imaigne you could enable all the RMAN backup and recovery features at this point; but that may best to hold off till last. It took several attempts for me to get all the components installed successfully on my first try. More on that in my next blog...

Getting The Server Ready for OAS

2011-05-23T21:43:00.000-07:00

*Sigh* I knew this day would come. After watching Oracle on a relentless accusation spree the past 3 year and the release of 11g I knew I would be forced to start back from square one with Oracle Application Server (OAS). Oh well, such is the life of a consultant. With the release of 11g Oracle set multiple balls in motion but none as more important as the de-support date for both 10.1.2.3 and 10.1.4. for Q4 2011. For those of you out there in government land, or working for clients who know/understand the importance of staying within the certification matrix, you understand there is only direction and that is forward with Oracle. So let the fun begin! Oh, before I continue please don't take ever single sentence here as the gospel: I'm learning it as I am writing too. Some concepts I have a pretty firm grasp on; others I don't. I'll try and speak out when I hit a grey area.

Anyway, let's start with the basics and that is a good old fashion Infrastructure setup (11.1.1.4) with 10.1.4.3 SSO server. This will probably be the most absolutely painful install you have ever done in your OAS career and I'm not joking! You literally have to patch the install while it is executing to complete certain parts of the installation! However, I am jumping way ahead of myself here: First you need hardware to run OAS in all it's glory!

My preference is to run Linux. You could run OAS 11.x on Windows, and I have clients that do, but for the reminder of this blog Red Hat Enterprise (RHEL) 5.5 x64 is the way to go with a minimal of 2 gigs of RAM (for production you are looking at least 6 gigs if not higher) and 3 gigs of /tmp space (For the web-logic installer) and 60 gigs of storage . Now you have some decisions to make right away and that is to virtualize or not to virtualize and if I virtualize which product do I use? VMware or Oracle VM? Oracle has done a great job of putting the fear into its client base that if you use VMware you are going at it alone without Oracle support; but that is not quite true. If you dig deep enough what you will find is Oracle will make you reproduce the problem on a non-virtulized platform if a problem gets to the point where the support tech is looking for an easy way out from helping you. So back to the question to virtualize or not to virtualize and the answer is quite simple: VIRTUALIZE VIRTUALIZE VIRTUALIZE! In this case we are not looking to virtualize to gain every last dollar out of the hardware; instead we need a cost-efficient way to adequately fail-over OAS in the event of problems or disaster recovery. Sure we could use the clustering built into 11g but that implies you are paying X2 for Oracle software licensing. If your recovery time is that 5-20 min range then virtualize. If you can't lose a single transaction then break out your checkbook for more licensing.

Finally, time for the tech stuff. The first action is to create a service account to own all of the software. We need to create the groups “dba” & “oinstall”. Next we need to create a user (which is “oracle” of course) to be granted access to those groups:

groupadd dba

groupadd oinstall

useradd –g dba –G oinstall oracle

passwd oracle

We also need to install a bunch of packages in RHEL to satisfy future dependence needs. This can be accomplished with the following yum command executed as root:

yum install binutils-2.* elfutils-libelf-0.* glibc-2.* glibc-common-2.* libaio-0.* libgcc-4.* libstdc++-4.* make-3.* compat-libstdc++-33* elfutils-libelf-devel-0.* glibc-devel-2.* gcc-4.* gcc-c++-4.* libaio-devel-0.* libstdc++-devel-4.* unixODBC-2.* unixODBC-devel-2.* sysstat-7 xhost xclock xdpyinfo libXp libXtst gdbm.i386* libXp*.i386*

Followed up by this command to create the necessary symbolic link to be used by the OHS process later (Failure to do this will result in OPMN not starting correctly during the SSO installation):

ln -s /usr/lib/libgdbm.so.2.0.0 /usr/lib/libdb.so.2

kernel.shmmax = 68719476736

kernel.shmall = 4294967296

kernel.shmmni = 4096

and append theses to the end of the file:

kernel.sem = 250 32000 100 128

net.core.rmem_default=4194304

net.core.rmem_max=4194304

net.core.wmem_default=262144

fs.file-max = 6815744

net.ipv4.ip_local_port_range = 9000 65500

net.core.wmem_max = 1048576

fs.aio-max-nr = 1048576

followed by this command to make the kernel changes take-effect:

/sbin/sysctl -p

Next we need to modify /etc/security/limits.conf and append the following to the file:

oracle soft nproc 2047

oracle hard nproc 16384

oracle soft nofile 1024

oracle hard nofile 65536

and append this to /etc/pam.d/login:

session required pam_limits.so

Since fusion middleware runs a jillion different process, which would take forever to correctly configure with SELinux, we disable SELinux by editing /etc/selinux/config and setting this:

SELINUX=disabled

Up to this point this has been a generic Oracle fusionware installation, but we now we must begin to incorporate the architecture changes that take into account our identity management needs. The first order of business is to wire in a virtual IP address for sso.example.com which should show up as eth0:1 when issuing an ifconfig command. This will be critical later on in the process as we map back to this IP address within the SSO server. Next we need to make sure that ip/DNS entry is represented in /etc/hosts along with updated definition for the hostname reference. Here is an example from DEV:

127.0.0.1 localhost.localdomain localhost

#::1 localhost6.localdomain6 localhost6

10.98.0.29 sso.example.com sso
10.98.0.37 idm-host.example.com idm-host

# .bash_profile
echo "10g home or 11g home "
echo "Enter 1 for 11g database home "
echo "Enter 2 for 11g OID home"
echo "Enter 3 for 10g SSO home"
read i;
case $i in
   1)
        # 11g database home
unset ORACLE_HOME
unset PATH
unset LD_LIBRARY_PATH
        export ORACLE_HOME=/app/infra/db/product/11.2.0/dbhome_1
export ORACLE_SID=infradev
export ORACLE_PROFILE=db
    export PATH=/bin:$PATH:$HOME/bin:$ORACLE_HOME/bin:$ORACLE_HOME/jdk/bin:$PATH:$ORACLE_HOME/dcm/bin:.:$ORACLE_HOME/OPatch
        export LD_LIBRARY_PATH=/lib:$ORACLE_HOME/lib:$LD_LIBRARY_PATH
        echo "ORACLE_HOME is set to ${ORACLE_HOME}"
        echo "ORACLE_SID is set to ${ORACLE_SID}"
        ;;

   2)
        # 11g OID home
unset ORACLE_HOME
unset PATH
unset LD_LIBRARY_PATH
export ORACLE_PROFILE=oid
        export ORACLE_HOME=/app/infra/wl-home/Oracle_IDM
        export ORACLE_INSTANCE=/app/infra/wl-home/asinst
        export ORACLE_SID=infradev
export MW_HOME=/app/infra/wl-home
export JAVA_HOME=/app/infra/jdk1.6.0_24
export WL_HOME=/app/infra/wl-home/wlserver
export DOMAIN_HOME=$MW_HOME/user_projects/domains/IDMDomain
        export PATH=/bin:$PATH:$HOME/bin:$ORACLE_HOME/bin:$ORACLE_HOME/ldap/bin:$JAVA_HOME/jdk/bin:$PATH:$ORACLE_HOME/Apache/Apache/bin:$ORACLE_HOME/dcm/bin:$ORACLE_HOME/opmn/bin:.:$ORACLE_HOME/OPatch:$ORACLE_INSTANCE/bin:$WL_HOME/server/bin:$DOMAIN_HOME/bin
export LD_LIBRARY_PATH=/lib:$ORACLE_HOME/lib:$LD_LIBRARY_PATH
        echo "ORACLE_SID is set to ${ORACLE_SID}"
        echo "ORACLE_HOME is set to ${ORACLE_HOME}"
        ;;

   3)
        # 10g SSO home
unset ORACLE_HOME
unset PATH
unset LD_LIBRARY_PATH
export ORACLE_PROFILE=sso
        export ORACLE_HOME=/app/infra/sso-home
        export ORACLE_SID=infradev
export LD_LIBRARY_PATH=/lib:$ORACLE_HOME/lib:$ORACLE_HOME/ohs/lib:$LD_LIBRARY_PATH
        export PATH=/bin:$PATH:$HOME/bin:$ORACLE_HOME/bin:$ORACLE_HOME/jdk/bin:$PATH:$ORACLE_HOME/Apache/Apache/bin:$ORACLE_HOME/dcm/bin:$ORACLE_HOME/opmn/bin:.:$ORACLE_HOME/OPatch:$HOME/bin
        echo "ORACLE_SID is set to ${ORACLE_SID}"
        echo "ORACLE_HOME is set to ${ORACLE_HOME}"
        ;;
   *)
        echo "ORACLE_HOME is Not Set -------> ${ORACLE_HOME}"
        ;;
esac

TNS_ADMIN=/app/infra/db/product/11.2.0/dbhome_1/network/admin

alias cdo='cd $ORACLE_HOME'
alias cdi='cd $ORACLE_INSTANCE'

PS1='<'`whoami`'-${ORACLE_PROFILE}@'':${PWD}>
=>'
PS2='<...=>'

cd $ORACLE_HOME

if [ $USER = "oracle" ]; then
if [ $SHELL = "/bin/ksh" ]; then
    ulimit -p 16384
    ulimit -n 65536
else
    ulimit -u 16384 -n 65536
fi
fi

At this point we are done with the basic server configuration steps. Next up is the software installation; but that will have to wait another day.