20 Troubleshoot Oracle Identity Management

1. Update the domain's environment setup script by performing one of the following steps that is appropriate to your environment:

   On UNIX systems, add the text shown in the following example to the bottom of the DOMAIN_HOME/bin/setDomainEnv.sh file:

   JAVA_OPTIONS="-Djava.util.logging.manager=oracle.core.ojdl.logging.ODLLogManager ${JAVA_OPTIONS}"
   export JAVA_OPTIONS
   FMWCONFIG_CLASSPATH=${FMWCONFIG_CLASSPATH}${CLASSPATHSEP}${ORACLE_COMMON_HOME}/modules/oracle.odl_11.1.1/ojdl.jar
   export FMWCONFIG_CLASSPATH
   

2. Log in to Fusion Applications Control as follows:
   1. Log in to Oracle Enterprise Manager Cloud Control.
   2. From the Targets drop-down, select Middleware, to display the Middleware page.
   3. From the Middleware Features drop-down, select Identity and Access to get to the Identity and Access Dash board.
   4. Select an OID instance from the Oracle Internet Directory table, to get to the appropriate OID instance page.
   5. In the OID instance page, from the Oracle Internet Directory pull-down select Fusion Middleware Control.
   6. Log in to the contol.
3. Navigate to the appropriate domain, then select Logs and Selective Tracing from the domain menu. The Selective Tracing page appears.
4. Click the Tracing Options tab, configure the following settings, and click Start Tracing to generate the selective trace:
   1. Option Name: Select User Name from the list and enter the name of the user that cannot access functionality.

      While this procedure describes troubleshooting inaccessible functionality by selective tracing on a user name, it is also possible to use the other options in the Option Names list for troubleshooting purposes.

   2. Level: Select TRACE:32 (FINEST).
   3. Description: Enter a description that will help you identify the trace results, such as: USER_NAME cannot access functionality.
   4. Duration: Enter the number of minutes the selective trace will run.
   5. Trace ID: Select Generate a New Unique Trace ID. Optionally, you can select Use a Custom Trace ID and enter an ID, but note that Fusion Middleware Control does not verify the uniqueness of Custom Trace ID strings.
   6. Loggers: Oracle recommends enabling the following loggers for troubleshooting inaccessible functionality:

      To quickly locate a specific logger, enter the logger name or a string in the logger name in the field above the list of loggers and press return.

      • oracle.jps.authorization

      • oracle.jps.common

      • oracle.security.jps.az.internal.runtime.policy.AbstractPolicyImpl

      • oracle.security.jps.internal.policystore.JavaPolicyProvider

      • oracle.security.jps.internal.policystore.ldap.BulkAuthorizer

      • oracle.security.jps.trace.logger

      • oracle.security.jps.util.JpsAuth

      Refer to the Debugging the Authorization Process section in the Oracle Fusion Middleware Applications Security Guide for information about system properties you can enable for extremely fine grained authorization debugging.

5. Instruct the user that cannot access functionality to try and access it again. Now that Selective Tracing has been enabled for that user, data specific to that user and the request will be collected.
6. Access the results from the selective trace by clicking the Active Traces And Tracing History tab and selecting the trace from either the Active Traces or Tracing History table. If the number of minutes specified in the Duration option has elapsed, the trace will be in the Tracing History table. If a description for the selective trace was provided, look for it in the Description column.
7. Provide the trace results to the Security Administrator.

   Typically, the Security Administrator performs the remaining steps in this procedure.

8. Locate the Failed ProtectionDomain string and its corresponding resourceName=, resourceType=, and Principal= strings in the trace results. These strings will provide information about the user and the inaccessible resource. As shown in the following example, the user named user1 was denied access to the resource named ResourceNameX:

   PolicyContext: [JeeScenarioApp]
   Resource/Target: [resourceType=TaskFlowResourceType,resourceName=ResourceNameX]
   Action:[read]
   Permission Class: [oracle.security.jps.ResourcePermission]
               Result:            [FAILED]
               Evaluator:         [ACC]
               FailedProtectionDomain:ClassLoader=weblogic.utils.classloaders.ChangeAwareClassLoader
   @c7cee9finder:weblogic.utils.classloaders.CodeGenClassFinder@a05da2 annotation: JeeScenarioApp@jeescenario
                                  CodeSource=file:/somepath/wls-jrfServer/servers/jrfServer_admin/tmp/
   _WL_user/JeeScenarioApp/gw8m4w/war/WEB-INF/lib/_wl_cls_gen.jar
                                 Principals=total 5 of principals(
                                  1. weblogic.security.principal.WLSUserImpl "user1"
                                  2. JpsPrincipal:
   oracle.security.jps.internal.core.principals.JpsAuthenticatedRoleImpl "authenticated-role" 
   GUID=null DN=null
                                  3. JpsPrincipal:
   oracle.security.jps.service.policystore.ApplicationRole "basic_role1"
   GUID=734342D04A2811E0AF671B4A95E1598C DN=cn=basic_role1,cn=Roles,cn=JeeScenarioApp,cn=testfarm_
   wilu_mlr6,cn=JPSContext,cn=jpsroot
                                  4. JpsPrincipal:
   oracle.security.jps.service.policystore.ApplicationRole "myrole2"
   GUID=738C80D04A2811E0AF671B4A95E1598C DN=cn=myrole2,cn=Roles,cn=JeeScenarioApp,cn=testfarm_wilu_
   mlr6,cn=JPSContext,cn=jpsroot
                                  5. JpsPrincipal:
   oracle.security.jps.internal.core.principals.JpsAnonymousRoleImpl "anonymous-role" GUID=null
   DN=null)
                                 Permissions=(
                                  (oracle.security.jps.service.credstore.CredentialAccessPermission
   context=SYSTEM,mapName=default,keyName=* read,write)
                                  (oracle.security.jps.service.policystore.PolicyStoreAccessPermission
   Context:SYSTEM Context Name:null Actions:getConfiguredApplications)
                                  (oracle.security.jps.service.policystore.PolicyStoreAccessPermission
   Context:APPLICATION Context Name:* Actions:getApplicationPolicy)
                                  (oracle.security.jps.service.policystore.PolicyStoreAccessPermission
   Context:SYSTEM Context Name:null Actions:*)
                                  (oracle.security.jps.service.policystore.PolicyStoreAccessPermission
   Context:APPLICATION Context Name:* Actions:*)
                                  (java.io.FilePermission file2.txt read)
                                  (java.io.FilePermission file2.txt write)
                                  (java.io.FilePermission file1.txt read)
                                  (java.util.PropertyPermission line.separator read)
                                  (java.util.PropertyPermission java.vm.specification.version read)
                                  (java.util.PropertyPermission java.vm.version read)
                                  (java.util.PropertyPermission java.vendor.url read)
                                  (java.util.PropertyPermission java.vm.specification.vendor read)
                                  (java.util.PropertyPermission java.vm.name read)
                                  (java.util.PropertyPermission os.name read)
                                  (java.util.PropertyPermission java.vm.vendor read)
                                  (java.util.PropertyPermission path.separator read)
                                  (java.util.PropertyPermission os.version read)
                                  (java.util.PropertyPermission java.specification.name read)
                                  (java.util.PropertyPermission os.arch read)
                                  (java.util.PropertyPermission java.version read)
                                  (java.util.PropertyPermission java.class.version read)
                                  (java.util.PropertyPermission java.vendor read)
   

9. Use Oracle Authorization Policy Manager to search for configured security policies that contain the resource and resource type listed in the trace results (look for resourceName= and resourceType=). In the example shown in Step 8, you would search for configured security polices that contain the resource named ResourceNameX that is of the type TaskFlowResourceType.

   After identifying the relevant security policies using the "Finding Application Policies that Match Entitlements or Resources" procedure, it will be possible to identify the principals and actions granted in each of those configured security policies.

10. Compare the security policies identified by the search in Step 9 against the relevant Failed ProtectionDomain strings in the trace results. Specifically, for each of the security policies, compare the granted actions and principals as follows:
    1. Ensure the action granted in the security policies is the same action listed for the Failed ProtectionDomain string in the trace results. In , you would ensure the security policy is granting the read action (identified by Action:[read] in the trace).

       If the action for the Failed ProtectionDomain string is granted in the configured security policy, proceed to Step 10.b.

       If the action for the Failed ProtectionDomain string is not granted in the security policy, compare the action against all security policies identified by the search in Step 9.

    2. Ensure the principals granted in the security policies are the same principals listed for the Failed ProtectionDomain string (identified by Principals=).

       If the principals configured in the security policy are application roles or external roles and they are not listed in the Failed ProtectionDomain string, use Oracle Authorization Policy Manager to determine if the roles are mapped to the relevant user.

    Be sure to consult your organization's security policies and the Oracle Fusion Applications security reference manuals before altering any aspect of the configured security policies, as it is possible the user is intentionally unauthorized to access the particular functionality.

    Access the Oracle Fusion Applications security reference manuals in the Oracle Fusion Applications Technology Documentation Library.

    If both the actions and principals granted in the security polices are consistent with the authorization request (as identified in the trace), examine Oracle Platform Security Services' cache refresh setting by referring to the problem and solution described in the Inappropriate User Access After Enterprise Role Membership Removal: Check Refresh Intervals section.

Problem

After migrating or patching the Oracle Platform Security Services policy store, data that was once available is now missing. This issue may be encountered after the policy store is:

• Migrated from the baseline ("out-of-the-box") jazn-data.xml file policy store to an Oracle Internet Directory instance.

• Migrated from one environment to another, such as moving from a test environment to a production environment.

• Patched using Oracle Authorization Policy Manager.

The problem may be the application role GUIDs in the Oracle Fusion Data Security repository are not identical to their corresponding application role GUIDs in the Oracle Platform Security Services policy store.

Solution

Run the oracle.apps.fnd.applcore.dataSecurity.util.DSDataMigrator java program to reconcile the application role GUIDs from the Oracle Platform Security Services policy store (which is the "source of truth" repository) to the Oracle Fusion Data Security repository.

A user with administrator privileges uses Oracle Authorization Policy Manager to search for database resources, but the search does not find any.

The problem may be data security policies that govern data security administration do not exist in the Oracle Fusion Data Security repository.

To troubleshoot this issue:

1. Use Oracle Authorization Policy Manager to verify that the application roles listed below are mapped to the external roles of the user performing the search. For details, search the Oracle Applications Help for Managing Policy Objects.

   • APM_CRM_APPLICATION_OBJECTS_DATA_ADMINISTRATION_DUTY

   • APM_HCM_APPLICATION_OBJECTS_DATA_ADMINISTRATION_DUTY

   • APM_FSCM_APPLICATION_OBJECTS_DATA_ADMINISTRATION_DUTY

   • APM_FND_APPLICATION_OBJECTS_DATA_ADMINISTRATION_DUTY

   If the application roles are mapped to the external roles of the user performing the search, go to Step 2

   If the application roles are not mapped to the external roles of the user performing the search, use Oracle Authorization Policy Manager to map them to the user's external roles and then go to Step 2.

2. Determine whether data security policies that govern data security administration exist in the Oracle Fusion Data Security repository. Log in to Oracle Authorization Policy Manager as a user with the Application Developer external role and search for the following roles. Ensure that data security policies for the roles exist on the FND_OBJECTS object and that the policies have not expired.

   • APM_CRM_APPLICATION_OBJECTS_DATA_ADMINISTRATION_DUTY

   • APM_HCM_APPLICATION_OBJECTS_DATA_ADMINISTRATION_DUTY

   • APM_FSCM_APPLICATION_OBJECTS_DATA_ADMINISTRATION_DUTY

   • APM_FND_APPLICATION_OBJECTS_DATA_ADMINISTRATION_DUTY

   If the policies do not exist in the Oracle Fusion Data Security repository, use Oracle Fusion Functional Setup Manager to upload the Applications Core data security seed data to the Oracle Fusion Data Security repository.

1. Log out of the portlet, and then log in again.
2. Execute the following diagnostic tests:

   • Data Security Configuration

   • Data Security Configuration with Application User Session Prerequisite

   • Data Security Run Time

   • Data Security Run Time with Application User Session Prerequisite

After creating a new user and external role using Oracle Fusion Human Capital Management, then granting duty roles to that user using Oracle Authorization Policy Manager, the user cannot log in and perform its granted duties.

The problem may be:

• User Does Not Exist: Verify if User is in the Identity Store

• A Cache Has Not Been Refreshed: Check Caches

After logging out of a resource secured by Oracle Access Manager and then attempting to access a different secured resource, access is granted without a login page appearing.

Oracle Platform Security Services manages logouts for Oracle Fusion Applications by providing the configured logout URL (typically the Oracle Access Manager logout URL) to Oracle Application Development Framework for redirection. Oracle Access Manager then sets the session status to logged out.

The problem may be:

• User Session Was Not Removed During Logout: Check Cookies and Session Management

• Oracle Platform Security Services Not Configured with Correct URL: Verify Settings

After successfully logging in to and working on a resource secured by Oracle Access Manager and then attempting to access a different secured resource, an unexpected page, such as Not Authorized, blank (empty), corrupted, or 500 error, appears.

The problem may be Oracle Access Manager's OAMAuthnCookie_<host:port>_<random number> and OAM_ID cookies are not in the user's browser. The OAMAuthnCookie_<host:port>_<random number> and OAM_ID cookies are encrypted, single sign-on, session-based cookies generated by the Oracle Access Manager Access Server when a user authenticates successfully.

While attempting to access a resource secured by Oracle Access Manager, an unauthenticated user gets an error page instead of the login page.

The problem may be:

• Oracle HTTP Server Web Servers Not Running: Verify Status

• Managed Servers or Oracle Access Manager Services Not Running: Verify Status

1. Verify the user does not exist in Oracle Internet Directory by using Oracle Directory Services Manager to examine the container where users are stored, such as cn=users,dc=us,dc=oracle,dc=com.

   Refer to the Displaying Entries by Using Oracle Directory Services Manager or the Searching for Entries by Using Oracle Directory Services Manager sections in the Oracle Internet Directory Administrator's Guide for more information.

The function security polices for a particular external role cannot be seen using Oracle Authorization Policy Manager.

The problem may be:

• Oracle Internet Directory Not Indexing displayName Attribute: Verify Configuration

• Oracle Internet Directory Authenticator Not Configured Correctly: Verify Connection Settings

• External Role Not Provisioned: Examine Identity Store Containers to Verify

• Administrator Does Not Have Access: Check Settings for Delegated Administrator Role

• Policy Store Does Not Have Correct Application Stripes: Verify Policy Stripes

• External Role is Not Mapped to Correct Application Roles: Verify Mapping

• Application Role Has No Policy Attached: Verify Policies

Data security polices for a particular data role cannot be seen in Oracle Authorization Policy Manager.

The problem may be:

• Oracle Internet Directory Not Indexing displayName Attribute: Verify Configuration

• Oracle Internet Directory Authenticator Not Configured Correctly: Verify Connection Settings

• User Searching for Data Security Policies Does Not Have Privileges to Do So: Verify

• Data Role Does Not Exist in Identity Store: Examine Identity Store Container to Verify

• Data Role Templates Did Not Create Policies for the Data Role: Verify

• Security Role GUIDs Not Synchronized: Use DSDataMigrator to Reconcile

While attempting to map an application role to an external role using Oracle Authorization Policy Manager, issues such as the following are encountered:

• Either the external role or application role cannot be seen in Oracle Authorization Policy Manager.

• The mapping succeeds in Oracle Authorization Policy Manager, but is activated after a delay.

The problem may be:

• Oracle Internet Directory Not Indexing displayName Attribute: Verify

• Configuration of Security Providers Is Incorrect: Verify

• Mapping Activated After a Delay: Consider Adjusting Cache Settings

Attempts to view application role hierarchies using Oracle Authorization Policy Manager fail.

The problem may be:

• LDAP Authenticator Configured to Use Wrong Identity Store: Verify

• Administrator Trying to View Role Hierarchy from Wrong Role in the Interface: Verify

• Role Hierarchies Are Not Defined: Verify

After using Oracle Authorization Policy Manager to add an application role to a hierarchy, no changes can be seen in the hierarchy.

The problem may be:

• The application role already exists as a member of the hierarchy.

• The incorrect application role was added to the hierarchy, or the correct application role was added to the incorrect hierarchy.

To verify the application role hierarchy:

1. Use Authorization Policy Manager to display the application role hierarchy the role was intended for.

2. Ensure that the application role does not already exist in the hierarchy.

3. Ensure that when the application role was added to the hierarchy, the intended application role and the intended hierarchy were used. It is possible the intended application role was added to the incorrect hierarchy, or the incorrect application role was added to the intended hierarchy.

Refer to the Permission Inheritance and the Role Hierarchy section in the Oracle Fusion Middleware Applications Security Guide for information about rules for application role hierarchies.

While attempting to create a data role using a data role template in Oracle Authorization Policy Manager, issues such as the following are encountered:

• The data role is not created

• The data role is created with a null displayName and description

The problem may be:

• SQL Query in Dimensions Tab is Invalid: Troubleshoot

• Oracle Authorization Policy Manager Application ID Privileged Problem

• Identity Store Problems: Troubleshoot

After an Oracle Fusion application invokes a web service, a key store or credential store error such as the following appears:

• WSM-00056: The key orakey is not retrieved

• WSM-00256: The property "Keystore Sign Alias" is not set

There are two potential reasons for the error:

The problem may be:

• The alias for the signature key or encryption key in the Oracle WSM keystore configuration does not exist in the Oracle WSM keystore file.

• The signature key, encryption key, or Oracle WSM keystore file password is not synchronized in the keystore file and the keystore configuration for Oracle WSM. That is, at least one of the passwords does not have identical values in both locations.

To resolve, perform the following:

• Check if the Key Alias Exists in the Keystore File

• Check if Key Passwords are Synchronized

After an Oracle Fusion application invokes a web service, a trust certificate error such as the following appears:

WSM-00138: The path to the certificate is invalid due to exception

The problem may be, if the web service is advertising its certificate in the Web Services Description Language (WSDL), the client is not configured correctly to trust that certificate or its issuer.

To verify the client is configured to trust the web service's certificate advertised in the WSDL or its issuer:

1. Verify the client keystore has either the public certificate of the web service or the public certificate of its issuer. Use the keytool –list command to identify the certificates in the client keystore. If either of the public certificates are missing from the client keystore, use the keytool –importcert command to add them.

   Refer to the keytool - Key and Certificate Management Tool document on the Java SE Technical Documentation Web site for more information about using keytool. You can access this document by searching for it on the Search Java SE Technical Documentation Web page at:

   http://download.oracle.com/javase/search.html

2. Verify the value for the keystore.recipient.alias override property of the client Oracle WSM policy is identical to the alias of the trusted public certificate in the Oracle WSM keystore file. Refer to the Attaching Web Service Policies Permitting Overrides section of the Administering Web Services for more information.

To troubleshoot the SAML issuer name configuration, verify the SAML Issuer Name the client is using is among the issuers configured on the Oracle WebLogic Server domain by performing the steps in the Adding an Additional SAML Assertion Issuer Name section of the Administering Web Services.

If the SAML Issuer Name that the client is using is not configured as an issuer in the Oracle WebLogic Server domain, Oracle recommends changing the issuer name on the client by updating its saml.issuer.name override to one of the issuers configured on the Oracle WebLogic Server domain.

If you cannot change the issuer name on the client, you can add its issuer name to the Oracle WebLogic Server domain by performing the steps in the Adding an Additional SAML Assertion Issuer Name section of the Administering Web Services.

To troubleshoot the subject.precendence configuration override, perform the following steps:

1. Set the subject.precedence override value in your current client policy to false to change the identity to a different user. By default, the subject.precendence override is set to true.

2. Set the appropriate Credential Store Framework key override on the client policy that contains the user name and password of the user you want to send to the service. If an entry for this user does not exist in the Credential Store Framework, you must add it. Refer to the Adding Keys and User Credentials to the Credential Store section in the Administering Web Services for more information.

3. Ensure the appropriate Web Services Identity Permission is set for the client application by performing the steps in the Configuring SAML Web Service Clients for Identity Switching section of the Administering Web Services.

While attempting to access a resource secured by Oracle Access Manager, a user changes the language preference on the login page. After logging in successfully, the secured resource appears in a language different from what the user selected on the login page.

The problem may be Oracle Access Manager's ORA_FUSION_PREFS cookie is not in the user's browser. The ORA_FUSION_PREFS cookie determines which language the secured resource appears in. After the user chooses a language preference on the login page and gets authenticated, Oracle Access Manager sends the ORA_FUSION_PREFS cookie to the user's browser.

Examine the cookies in the user's browser and try to locate the ORA_FUSION_PREFS cookie. If the ORA_FUSION_PREFS cookie is not in the user's browser:

• Examine the browser's security settings, as they may be too high and preventing cookies from being accepted.

• Add the Oracle Fusion application's domain to the browser's exception list.

After successfully logging in to a resource secured by Oracle Access Manager, a login page unexpectedly reappears. Regardless if the reappearing login page is for Oracle Access Manager or Oracle Fusion Applications, a user may not expect to see it in a single sign-on environment.

The problem may be:

• If the login page reappeared after attempting to access a different secured resource, the authentication level of the authentication scheme securing the subsequently accessed resource is greater (higher) than the authentication level of the authentication scheme securing the resource that was accessed first. In this situation, the reappearing login page is expected behavior.

• The Oracle Access Manager server's Idle Timeout or Session Lifetime configuration parameters are set to a value that is too small. The Idle Timeout parameter specifies the amount of time, in minutes, that a user's authentication session remains valid without accessing a resource secured by Oracle Access Manager. The Session Lifetime parameter specifies the amount of time, in minutes, that a user's authentication session remains valid. For both parameters, the smaller the value, the more frequently users must re-authenticate.

• Oracle Access Manager's ObSSOCookie and OAM_ID cookies are not in the user's browser. The ObSSOCookie and OAM_ID cookies are encrypted, single sign-on, session-based cookies generated by the Oracle Access Manager Access Server when a user authenticates successfully.

While attempting to access a resource secured by Oracle Access Manager, the Forgotten Password feature is inaccessible from the login page.

The problem may be:

• Network issues are preventing a connection to Oracle Identity Manager.

• Oracle Access Manager's configuration to Oracle Identity Manager's lost password functionality is incorrect.