16 Troubleshoot Oracle WebCenter Portal and Oracle WebCenter Content

WebCenter Portal provides collaborative and social features to Oracle Fusion applications. For example through WebCenter Portal features, users can participate in discussions about opportunities, customers, and projects; and create wikis.

Figure 16-1 shows the WebCenter Services tab, which lists all the spaces available within Oracle Fusion Applications. A space is a work area, supporting a group of people of any size, which is organized around an area of interest or a common goal. Several Oracle Fusion applications use spaces to provide collaborative features, such as discussion forums and document sharing.

Figure 16-1 The WebCenter Services Tab

Description of "Figure 16-1 The WebCenter Services Tab"

Oracle Fusion Applications leverages WebCenter Portal's Composer to enable users to customize the appearance of pages. Figure 16-2 shows the Oracle Fusion Applications Welcome page in Composer.

Figure 16-2 Customizing the Oracle Fusion Applications Welcome Page in Composer

Description of "Figure 16-2 Customizing the Oracle Fusion Applications Welcome Page in Composer"

Table 16-1 lists the ways in which WebCenter Portal is used within Oracle Fusion Applications.

The components required for WebCenter Portal are automatically installed in the Oracle Fusion Applications common domain by Oracle Fusion Applications Provisioning. In addition, any WebCenter Portal Framework services required by applications are obtained through shared libraries introduced by domain extension templates used in the various product family specific domains. There are no additional steps required during installation to ensure that WebCenter Portal is correctly installed.

The WebCenter Portal server is preseeded with the necessary portal templates required for use by Oracle Fusion applications, such as Oracle Fusion CRM and Oracle Fusion Project.

Administration tasks required for WebCenter Portal might include the following:

• Starting and stopping the WebCenter Portal or Discussions servers. For more information, see Start Administration Servers and Managed Servers and Stop Administration Servers and Managed Servers.

• Monitoring performance of the WebCenter Portal server. For more information, see Monitor Mid-Tier Elements.

• Backup and recovery. For more information, see Back Up and Recover Oracle Fusion Applications.

WebCenter Content provides a unified application for several different kinds of content management. It provides a unified repository to house unstructured content, and deliver it to business users in the proper format, and within the context of familiar applications to fit the way they work. Within Oracle Fusion Applications, WebCenter Content provides a way of including attachments for business objects, such as projects and procurement requisitions. Oracle Fusion Applications also uses WebCenter Content as the content repository for WebCenter Portal content.

When running Oracle Fusion Applications, it may not be readily apparent which portions of the user interface are implemented as portlets. The only time this may actually be evident is when there is a problem.

Useful Terminology

The following list defines some common terms for WebCenter Portal portlets:

• Portlet

  A portlet is a region of the screen that is displayed from a remote source. In Oracle Fusion Applications, portlets conform to the Web Services for Remote Portlets (WSRP) standard, and implement the JSR 286 portlet specification.

• Oracle JSF Portlet Bridge

  The Oracle JSF Portlet Bridge is a component that enables an ADF application to be exposed as a WSRP portlet producer application. Oracle Fusion applications are all implemented as ADF applications.

• Producer Application

  A producer application is an ADF application with pages or task flows that have been enabled to run as portlets. This type of application can run in dual modes: as a servlet (like a regular web application), or as a portlet (when consumed by a consumer application through the Oracle JSF Portlet Bridge).

• Consumer Application

  A consumer application is an application that consumes the portlets exposed by a producer application. Before consuming a portlet (by dropping it onto a page), application developers must first register the portlet producer application with the consumer application.

Useful Resources

The following list provides some useful resources to use when diagnosing problems with WebCenter Portal portlets:

• Portlet Consumer Test Page

  A page that provides diagnostic information about the consumer application. Access the Portlet Consumer Test Page using the following URL:

  http://host:port/context-root/faces/oracle/portlet/client/adf/diagnostic/pages/ConsumerTestPage.jspx
  

  where:

  • host is the server to which the consumer application is deployed

  • port is the port to which the server is listening for HTTP requests

  • context-root is the consumer web application's context root

  For example:

  http://mymanagedserver.example.com:8888/myapp/faces/oracle/portlet/client/adf/diagnostic/pages/ConsumerTestPage.jspx
  

  For more information, see Examine the Portlet Consumer Test Page.

• Producer Test Page

  A page that provides diagnostic information about the portlet producer application. You can access the Producer Test Page using the following URL:

  http://host:port/context-root/info
  

  where:

  • host is the server to which the portlet producer is deployed

  • port is the port to which the server is listening for HTTP requests

  • context-root is the producer web application's context root

  For example:

  http://portlets.example.com:9999/sample/info
  

  The Producer Test Page includes a link to the Web Service Definition Language (WSDL) document to use for registration, for example:

  http://portlets.example.com:9999/sample/portlets/wsrp2?WSDL
  

  For more information, see Examine the Producer Test Page.

• Running a Producer as a Servlet Application Through Faces

  This is also known as running the application as a servlet. Before an application can act as a portlet provider, it must be able to run correctly through standard HTTP requests.

  To run an application as a servlet, use the following URL:

  http://host:port/context-root/faces/path-to-page/page.jspx
  

  where:

  • host is the server to which the portlet producer is deployed

  • port is the port to which the server is listening for HTTP requests

  • context-root is the producer web application's context root

  • path-to-page is the path to the page you want to run

  • page is the name of the page you want to run

  For example:

  http://portlets.example:9999/sample/faces/index.jspx
  

  The Producer Test Page provides links to run such pages or task flows as servlets. For more information, see Run the JSF Portlet as a Servlet.

• Logging Configuration File

  The logging configuration file, logging.xml, is located in:

  DOMAIN_HOME/config/fmwconfig/servers/server/logging.xml
  

• Diagnostic Log File

  The default location of the diagnostic log file is:

  DOMAIN_HOME/servers/server/logs/server-diagnostic.log
  

There is a set of tools available for both the consumer and producer to help identify and resolve issues when running Oracle JSF Portlet Bridge portlets.

If a portlet error message is encountered when a portlet is rendered, or if the portlet displays but it is not possible to interact correctly with it, there are some general steps using these tools that should be followed to diagnose the issue. These include the following:

• Identify the Portlet Instance

• Examine the Portlet Consumer Test Page

• Examine the Producer Test Page

To troubleshoot portlet issues, it is useful to add portlet log-handlers and loggers to the logging configuration file, logging.xml.

The following example shows how to add the portlet log-handlers and loggers. The example assumes that you are running the consumer and producer applications on the same WebLogic Server instance. If you are running the consumer and producer applications on different instances, you must split them up appropriately, with the Portlet Servers and Portlet Bridge log handlers and loggers on the instance running the producer application and the Portlet Consumer log handler and logger on the instance running the consumer application.

MANDATORY: Add the log entries at the end of the file to ensure that they override any seeded settings.

The logging configuration file is located in the following location:

DOMAIN_HOME/config/fmwconfig/servers/server/logging.xml

The log file name is also defined in logging.xml. By default the log file name is:

DOMAIN_HOME/servers/server/logs/server-diagnostic.log

<!-- NOTE: You need to change the path where the logfile is located -->
<log_handlers>
...
   <!-- Portlet Consumer -->
   <log_handler name="portlet-consumer-handler" class="oracle.core.ojdl.logging.ODLHandlerFactory">
      <property name="format" value="ODL-Text"/>
      <property name="path" value="/scratch/logs/portlet-consumer.log"/>
   </log_handler>

   <!-- Portlet Producer -->
   <log_handler name="portlet-producer-handler" class="oracle.core.ojdl.logging.ODLHandlerFactory">
      <property name="format" value="ODL-Text"/>
      <property name="path" value="/scratch/logs/portlet-producer.log"/>
   </log_handler>

   <!-- Portlet Bridge -->
   <log_handler name="portlet-bridge-handler" class="oracle.core.ojdl.logging.ODLHandlerFactory">
      <property name="format" value="ODL-Text"/>
      <property name="path" value="/scratch/logs/portlet-bridge.log"/>
   </log_handler>
...
</log_handlers>

<loggers>
...
   <!-- Portlet Consumer -->
   <logger name="oracle.portlet.client" level="FINEST" useParentHandlers="false">
      <handler name="portlet-consumer-handler"/>
   </logger>

   <!-- Portlet Servers -->
   <logger name="com.bea.portlets" level="FINEST" useParentHandlers="false">
      <handler name="portlet-producer-handler"/>
   </logger>
   <logger name="com.bea.netuix" level="FINEST" useParentHandlers="false">
      <handler name="portlet-producer-handler"/>
   </logger>
   <logger name="com.bea.wsrp" level="FINEST" useParentHandlers="false">
      <handler name="portlet-producer-handler"/>
   </logger>
   <logger name="oracle.portlet.producer" level="FINEST" useParentHandlers="false">
      <handler name="portlet-producer-handler"/>
   </logger>

   <!-- Portlet Bridge -->
   <logger name="oracle.portlet.bridge" level="FINEST" useParentHandlers="false">
      <handler name="portlet-bridge-handler"/>
   </logger>
   <logger name="oracle.portlet.server.bridge" level="FINEST" useParentHandlers="false">
      <handler name="portlet-bridge-handler"/>
   </logger>
...
</loggers>

The message Portlet Consumer Error (shown in the following figure) typically indicates that an error occurred within the operation of the portlet parts of the portlet consumer application (as opposed to the remote portlet producer application).

Figure 16-9 Portlet Displaying a Portlet Consumer Error

Description of "Figure 16-9 Portlet Displaying a Portlet Consumer Error"

Consult the diagnostic log file to determine the cause of the exception. For information about portlet logging, see Configure the Portlet Logging File.

The exception that caused the error message to be displayed is logged. Wherever possible, a message is included in the log at the start of the exception stack to indicate for which portlet binding the exception occurred, see example below.

The cause is likely to be an internal error and the appropriate course of action is to contact Oracle Support with the log files of the consumer application.

<PortletRenderer> <setErrorState> An error has occured for Portlet Binding
portlet1.
oracle.portlet.client.container.PortletContentTypeException: Unexpected content
type "null" in WSRPGetMarkup response.
...

If a Portlet Timeout message is displayed in the area of the page that is expected to contain a portlet (as shown in the following figure), this means that the consumer waited for a configured period of time for the producer to respond and did not get a response during that time, or the response did not complete during that time.

Figure 16-10 Portlet Displaying a Portlet Timeout Error

Description of "Figure 16-10 Portlet Displaying a Portlet Timeout Error"

There are a number of possible causes/remedies, including the following:

• Producer Machine is Overloaded: Check Tuning and Hardware Needs

• Network is Overloaded: Ping Machines and Check Test Page in Browser to Verify

• Stuck Thread on Producer Machine: Check Logs to Diagnose

• Application Delay from Too Much Data: Analyze Hardware and Timeout Limits

• Portlet Timeout Limit is Too Short: Change Limits

When a section of the screen shows the Remote Portlet Communication Error message (as shown in the following figure), and there is an otherwise blank region surrounding it, this area is expected to be filled with a portlet, which the application is not able to contact.

Figure 16-11 Portlet Displaying a Remote Portlet Communication Error

Description of "Figure 16-11 Portlet Displaying a Remote Portlet Communication Error"

The causes/solutions discussed include the following:

• The Producer is Down: Restart the Application or Managed Server

• Web Services Security Configuration is Wrong: Troubleshoot Security Settings

• The Producer Managed Server Can't be Reached: Check the WSDL Endpoints to Confirm Routing

If the portlet displays a Remote Portlet Error message (as shown in the following figure), this indicates that the producer responded with an error message. The error message is returned in the form of a SOAP fault message inside the response document. There are a number of reasons the producer might return an error. The best strategy to diagnose these errors is to first find the corresponding exception stack trace in the consumer diagnostic logs (see Configure the Portlet Logging File). This stack trace shows what kind of fault was returned by the producer, plus any further information required in the response.

Figure 16-12 Portlet Displaying a Remote Portlet Error

Description of "Figure 16-12 Portlet Displaying a Remote Portlet Error"

The following document provides additional information related to subjects discussed in this section:

• For more information about persistence stores, see the Setting Up a Persistence Store for a WSRP Producer section in the Developing WebCenter Portal Assets and Custom Components with Oracle JDeveloper.

The errors/solutions discussed include the following:

• "OperationFailedException": Check Logs for Hints

• "InvalidRegistrationException": Check the Persistence Store Settings

• "InvalidHandleException": Check Persistence Store Settings

• "AccessDeniedException": Check Configurations

While in Composer's Edit mode, the user is unable to edit the properties of components on the page. It is also not possible to add content or delete some components. The icons that allow these operations on Composer's toolbar are grayed out.

For more information about MDS customization restrictions, see the Applying Component-Level Restrictions by Defining Customization Policies section in the Developing WebCenter Portal Assets and Custom Components with Oracle JDeveloper.

Causes and/or solutions include the following:

• User Has Inadequate Privileges: Check Privilege Settings

• MDS Customization Restriction: Remove if Needed

• Component ID is Not Found: Ensure that an ID is Specified

Problem

Some components do not show icons to collapse, expand, delete, edit properties, or add content while in Composer's Edit mode.

Solution

For possible problems and solutions, see User Unable to Edit a Component in Composer's Edit Mode: Check Various Causes/Solutions.

The end user can customize components on the page or task flow that are not intended to be edited.

For more information about MDS customization restrictions, see the Applying Component-Level Restrictions by Defining Customization Policies section in the Developing WebCenter Portal Assets and Custom Components with Oracle JDeveloper.

Possible causes and/or solutions include the following:

• "Edit Current Page" Link Displayed for Users Who Should Not See It: Set Appropriate Attribute

• User Has Wrong Permissions

• MDS Customization Restriction Needed: Specify Using an RDF File

When the end user collapses (or expands) a task flow, the personalization does not persist and the task flow continues to show as expanded (or collapsed) on revisiting the page even after logging out and back in.

The causes and/or solutions discussed include the following:

• MDS Customization Restriction: Remove or Relax the Restriction

• The adf-faces-config Settings are Wrong

Problem

When editing a page and bringing up the Property Inspector of a container component (such as PanelFormLayout, PanelGroupLayout, PanelCustomizable, and so on), the Child Components tab does not allow the listed child component to be rearranged. The Up and Down buttons are disabled. This problem indicates that the id is not specified on the child component that is required to be edited. Only components that have id specified can be edited.

Solution

It is highly recommended that all components on a page have an id specified. Ensure that all the child components have id specified.

Documents service is not available.

1. Shut down WebCenter Portal.
2. Start the Content Server.
3. Start WebCenter Portal: Space, so it can recheck if the Document service is configured.

Problem

Sometimes the "accept invitation" functionality does not work. For workflows to work, WS Security and Global Policy Attachment (GPA) should be configured on the client and server side. Local Policy Attachment (LPA) should be removed on the client side.

Solution:

To resolve this problem, perform the following steps:

1. Ensure that JVM is started with the following parameter in the setDomainEnv.sh file:

   -Dwebcenter.owsm.gpa.enabled=true
   

2. Remove LPA on the client side.

3. GPA should be configured on the client and server side. If GPA is configured correctly, the following policies are expected:

   • Policy on server side: oracle/wss_saml_or_username_token_service_policy

   • Policy on client side: oracle/wss10_saml_token_client_policy

The causes and solutions for no spaces showing are as follows:

• WebCenter Portal Spaces Instance Down: Check Status

• User Has Not Created Spaces: Create or Assign Membership to a Space

• Possible Problems with GPA or LPA

Possible causes and solutions for creating a space errors include the following:

• WebCenter Portal Spaces Instance Down: Check Status

• User Does Not Have Permissions to Create a Space: Check Permissions

• "InterruptedException" Because Services are not Provisioned: Change Timeout Settings

• "ConnectionRefused" Error: Authorize WC_Spaces IP Address

• Features Not Available in WebCenter Content Version: Check Version

Problem

The Oracle Secure Enterprise Search (SES) connection is not created correctly. The search query is not submitted to Oracle SES.

Solution

Confirm the Oracle SES connection by entering the following URL for Oracle SES Web Services operations in a browser:

http://host:port/search/query/

If the URL address does not render in the browser, then either the host or port for the Oracle SES server is incorrect, or Oracle SES has not been started.

If the Oracle SES connection is correct, review the remaining topics in this section for other possible causes.

Various issues can cause search results not to include secured resources. the possibilities covered here include the following:

• No Secured Resources: Check the for Proxy Login Errors

• No Secured Resources: Check Authorization Endpoints

• No Secured Resources: Consider Number of Crawl Sources

For information about configuring Oracle SES with an identity management system, see:

• Section Configuring the Identity Store of the Administering Oracle WebCenter Portal, in the Oracle Fusion Middleware Online Documentation Library.

• Section Oracle SES - Configuration of the Administering Oracle WebCenter Portal.

For information about configuring authorization endpoints, see the following sections in the Administering Oracle WebCenter Portal, in the Oracle Fusion Middleware Online Documentation Library:

• Configuring Oracle SES to Search Framework Applications

• Configuring Oracle SES to Search Spaces Applications

Problem

Crawling of WebCenter Portal Content Server documents fails.

Solution

To resolve this problem, perform the following steps:

1. In the Oracle SES administration tool, go to the Home - Schedules tab.

2. Click the Log File icon to display the log file for the source. To obtain the location of the full log, click the Status link.

3. The Crawler Progress Summary and Log Files by Source section displays the full path to the log file. If Oracle SES fails to log in to the Content Server crawl endpoint due to an authentication error, then the following errors are logged:

   EQP-60303: Exiting saxthread due to errors
   
   EQP-80330: Unrecognized QName <http://schemas.xmlsoap.org/soap/envelope/>:Envelope oracle.search.sdk.crawler.PluginException
   

4. Update the configuration parameters of the Content Server crawl source with the correct credentials.

The two following possibilities are discussed in this section:

• No Discussions and Announcements: Check Single Record Query

• No Discussions and Announcements: Check for Lowercase User Names

Problem

A new resource was created recently, but search results do not include the new resource.

Solution

New resources must be crawled and indexed before they can be returned in search results. Crawl schedules are run periodically to index new content. If new resources are created often, then increase the frequency of the crawl schedule. If new resources need to be crawled immediately, then start the crawl schedule manually.

Problem

Some resources are accessible to more users due to authorization changes in WebCenter Portal. For example, resources in a space are now accessible to all authenticated users. The affected users cannot search for those resources.

Solution

Authorization data is cached in Oracle SES. The cache is invalidated according to the Security Filter Lifespan global setting in Oracle SES. The default value is 1 day or 1440 minutes. Adjust the value according to the general frequency of changes to authorization data.

Problem

A space is publicly accessible, but unauthenticated users cannot see space resources in search results.

Solution

By default, view access of resources is granted to space members only, even if the space is accessible to the public. View access of resources must be granted to non-members explicitly.

In WebCenter Portal: Spaces, go to Spaces Administration, click the Security then Roles tabs, and for the affected role, check the view access to the different resources.

Problem

Navigating to a page containing the forums or announcements regions shows User xxxx is not authorized or Service not configured.

Solution

Ensure that the environment is configured properly by performing the following steps:

1. Check whether the discussions server is up and running by accessing the following URL:

   protocol://host:port/owc_discussions
   

2. Verify that the user is able to log in to the discussions server directly. If the user is unable to log in, then execute the WLST commands shown in the following table (adding server and node information as per your environment) to ensure that the environment is properly configured by comparing them with the expected values.

   Table 16-2 WLST Commands for Discussions Server Configuration

   WLST Command	Expected Value
   getDiscussionsServerProperty(appName='owc_discussions', key='AuthFactory.className')	oracle.jive.security.JpsAuthFactory
   getDiscussionsServerProperty(appName='owc_discussions', key='UserManager.className')	oracle.jive.security.JpsUserManager
   getDiscussionsServerProperty(appName='owc_discussions', key='GroupManager.className')	oracle.jive.security.JpsGroupManager
   getDiscussionsServerProperty(appName='owc_discussions', key='owc_discussions.setup.complete_11.1.1.2.0')	true
   getDiscussionsServerProperty(appName='owc_discussions', key='owc_discussions.sso.mode')	true

3. Verify that the discussions connection has been configured to use GPA. Execute the following WLST command to find out details about the connection and look for the highlighted entries.

   wlst:/> listDiscussionForumConnections(appName='webcenter', verbose=1)
   ...
   Policy URI For Authenticated Access: GPA
   Policy URI For Public Access: GPA
   

Problem:

A previously working user ID is no longer able to log in to the discussions server administration console. This can happen if the administrator accidentally deletes the group that has administration access.

Solution:

To regain access, execute the following WLST command:

addDiscussionsServerAdmin

Related Documentation:

• For more information about WLST commands, see the WLST Command Reference for WebLogic Server.

Problem:

The announcement region displays a SOAP fault exception instead of the announcements.

Solution:

To resolve this problem, consider the following possibilities:

• Verify that the discussions connection has been configured to use GPA. Execute the following WLST command to find out details about the connection and look for the highlighted entries:

  wlst:/> listDiscussionForumConnections(appName='webcenter', verbose=1)
  ...
  Policy URI For Authenticated Access: GPA
  Policy URI For Public Access: GPA
  

• Check that your wsm-pm application's configuration is correct and that there are no errors being reported in your log files. To validate the wsm-pm application, log in to the wsm-pm application's validation page as a user with administrative rights. Use the following format for validation:

  http://host:port/wsm-pm/validator
  

  If there are no issues with this application, then accessible policies display. If policies do not display, then investigate the related logged information on the server whose wsm-pm application is failing.

Problem:

Clicking login or accessing the discussions server administration console displays a form-based login instead of the configured SSO login screen.

Solution:

Verify that your discussion server settings are as described in Table 16-2, specifically that the owc_discussions.sso.mode property is set to true.

Announcement, Discussions not provisioned

1. Verify that the discussions server is configured properly as described in User Is Not Authorized / Service Not Configured: Troubleshoot Discussions Server Configuration.
2. Verify that your discussions server connection is correctly configured. You can check on the connection information using Fusion Applications Control.
3. Check the WC_Spaces-diagnostic.log files to see if there are any timeouts during space creation. Timeouts indicate that there is a bottleneck in the network. It could be that the server is unreachable or overloaded and taking more time to respond. Ensure that you are not routing the calls unnecessarily over the network when a direct access would be better.

Problem:

On creating a space based on a template with the Documents service, the space creation fails with an error such as the following:

Granting permissions for Documents failed

Solution:

View the WebCenter Portal log to see if there are any log messages indicating the source of the error.

If it is not clear what the cause of the error is, try resetting all the Document permissions for all the roles to see if the role mapping completes successfully. Any failures should be logged in the WebCenter Portal log.

For information about how to reset the permissions, see User Appears to Not Have the Correct Capabilities in the Documents Page for His Role: Resolve for Single or Mulitple Users.

When a user does not have the expected capabilities in the Documents page for his or her role, (for example the user is a Participant who has Write and Delete yet he or she cannot create content) it is possible that the permissions displayed in WebCenter Portal do not match those permissions actually stored in the Content Server.

1. Examine the Documents connection properties using Fusion Applications Control or WLST.
2. Verify that the client security policy is not set.
3. If it is set, clear the value. For example, using WLST:

   setJCRContentServerConnection(
     [application name],
     [connection name],
     clientSecurityPolicy=null);
   

Problem:

When the user attempts to add an attachment, the file selection field clears and they receive the following message:

Warning: The file upload failed.
The file could not be uploaded because it is too large.

Solution:

The maximum size of a file that can be uploaded is managed by the Apache MyFaces Trinidad settings. The UPLOAD_MAX_MEMORY context parameter in the web.xml file can be added or modified to change this size from the default of 2 MB. The profile option File Upload Maximum Size (code name FND_FILE_UPLOAD_MAX_SIZE) has been provided as a way for centrally managing the maximum file size. Where the entry in the web.xml has been set to #{applCorePrefs.maxUploadSize}, the profile option value should be checked.

For more information, see section Changing the Maximum File Upload Size in the Administering Oracle WebCenter Portal.

Problem:

When a connection failure occurs, it is not possible for any user to create, update or retrieve Content Server content. This occurs at the point where the application is attempting to connect and authorize the connection, such as when adding or accessing an attachment. The following are indications of a connection problem:

• Clicking on the link to an attachment displays a warning message instead of the attachment. For example:

  Warning: The attachment information cannot be retrieved. (FND-2403)
  

  The same text is shown for errors FND-2403 through to FND-2405. These errors are all indicative of problems connecting to Content Server when trying to retrieve content.

• Attempting to save an attachment results in an error message. For example:

  Error: Your attachments changes cannot be saved. (FND-2408)
  

  The same text is shown for errors FND-2407 through FND-2410. These errors are all indicative of problems connecting to Content Server when trying to save content.

• No connection, folder or document is available to the document picker.

• Message popup beginning with the following:

  oracle.stellent.ridc.protocol.ProtocolException
  

Solution:

To resolve this problem, perform the following steps:

1. Look for the error message number in the application log, for example, FND-2403. If there is no FND message then it is likely that the message is being bubbled up from Content Server or Oracle WebCenter Portal. Search for the text of the message in the application log. The exception message provides additional context to help determine the root cause of the problem.

2. Check that the Content Server is running. Restart Content Server if it is not available. See the Managing System Processes section in Administering Oracle WebCenter Content.

3. Determine if the JCR Connection is set correctly in this environment:

   • Check that the Content Server Connection has been defined. The connection name must be FusionAppsContentRepository, and must be defined as the primary Content Server connection.

   • The connection must of socket type jaxws, with the Web URL configured to point to the Content Server native web services endpoint (the idcnativews endpoint). The Client Security Policy must be null, indicating that GPA (Global Policy Attachments) should be leveraged. A valid administrative user must also be specified as part of the definition. This connection definition is persisted in Oracle Metadata Services Repository, which happens automatically as a part of the setup. Hence, MDS Repository issues may result in issues for Attachments. For example, the connection specified in a connections.xml is overridden by the MDS Repository configuration.

   It is possible to use Oracle Enterprise Manager Fusion Applications Control (Fusion Applications Control) or the Oracle WebLogic Scripting Tool (WLST) to view connection details. Verbose listing also shows that this is the primary connection.

   To view the connection details using the System MBean Browser, refer to the steps in Content Server Web Service Is Unavailable: Check Endpoints and Restart.

   To view the connection details using the Oracle WebLogic Scripting Tool (WLST), refer to the steps in Content Server Web Service Is Unavailable: Check Endpoints and Restart.

1. One way to confirm that the servlet is available is to go to the console:

   Deployments, Application, then Application Root, Monitoring, and then Servlets

2. Restart the GetHandler servlet if it is not running.
3. If the servlet is running then the issue is likely to be with the configuration of the application. Contact the Oracle Fusion Applications product team to resolve the issue with the configuration of the application.

Problem:

When the user attempts to create a new attachment or view an existing attachment, they receive an insufficient privileges message. The following are some sample error messages that either originate from the Content Server or are found in the logs:

Content item '(null)' was not successfully checked in. User 'USERNAME' does not have sufficient privileges.

Unable to download 'DOCUMENTID'. User 'USERNAME' does not have sufficient privileges.

Content item '(null)' was not successfully checked in. Unable to execute service method 'checkSecurity'. The error was caused by an internally generated issue. The error has been logged.

'USERNAME' does not have sufficient privileges

Invalid Security: error in processing the WS-Security header

MustUnderstand headers:{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\}Security are not understood

internal.messaging.saaj.SOAPExceptionImpl: No NamespaceURI, SOAP requires faultcode content to be a QName
com.sun.xml.internal.messaging.saaj.SOAPExceptionImpl: No NamespaceURI, SOAP requires faultcode content to be a QName

com.sun.xml.internal.messaging.saaj.SOAPExceptionImpl: No NamespaceURI, SOAP requires faultcode content to be a QName

Solution:

The sufficient privileges message originates from Content Server. It means that the user for the Content Server connection does not have sufficient privileges to complete the requested steps. There are many possible configuration errors that produce this message, but it indicates a problem with the configuration of the underlying technology stack.

To resolve this issue, first check the Oracle Fusion Applications client for the following possible errors and their resolutions:

• Misunderstood Headers or No Namespace URL Error

• Invalid Security Error

• Unable to Generate Digital Signature Error

• Keystore or Password Error

If that does not fix the issue, then check the Oracle Content Servers setup for the following possible errors and their resolutions:

• Public Certificate Map Error

• Legacy Signing Request Error

• Request Expiry Time Reached Error

• Unable to Base64 Decode Received Signature Error

• Unable to Verify Signature Error

When the end-user attempts to create a new attachment, or view an existing attachment they receive an access denied message. For example:

oracle.fabric.common.PolicyEnforcementException: access denied (oracle.wsm.security.WSIdentityPermission resouce=appName assert)

This indicates a problem with configuration or provisioning of the application. Contact the Oracle Fusion Applications product team to get them to resolve the issue.

The following exception is reported:

access denied (oracle.security.jps.service.credstore.CredentialAccessPermission context=SYSTEM,mapName=oracle.wsm.security,keyName=enc-csf-key read)

This issue indicates a problem with configuration or provisioning of the application.

Contact the Oracle Fusion Applications product team to get them to resolve the issue.

If applcore attachments fail during checkin, the likely causes can vary if the failure occurs across all domains or in a single domain. First, determine if attachment uploads to the central UCM instance are successful for any other domain in the installation. Then, see the following topics:

• Checkin Failure Causes for All Domains

• Checkin Failure Causes for Single Domain

• Checkin Failure Solution 1: Policy Manager Active

• Checkin Failure Solution 2: Correct Service Policy

• Checkin Failure Solution 3: Correct Client Policy

• Checkin Failure Solution 4: Correct JCR Connection