Contents

Send Us Your Comments............................................... ix

Preface........................................................................... xi

Audience................................................................................................ xi

Related Documents............................................................................. xi

Customer Support................................................................................ xi

Review Patch Documentation.......................................................... xi

Improved Process for Oracle Retail Documentation Corrections xii

Oracle Retail Documentation on the Oracle Technology Network xii

Conventions......................................................................................... xii

1....................................................... Preinstallation Tasks 1

Implementation Capacity Planning................................................ 1

Check Supported Database Server Requirements....................... 2

Check Supported Application Server Requirements.................. 3

Check Single Sign-On Requirements............................................... 4

Check Directory Server Requirements............................................. 4

Check Third-Party Software Dependencies.................................. 4

Check Client PC and Web Browser Requirements...................... 4

Supported Oracle Retail Products.................................................... 5

UNIX User Account Privileges to Install the Software............... 5

SIM Installation Overview.................................................................. 5

2......................................................... RAC and Clustering 7

3............................................. Database Installation Tasks 9

Expand the SIM Database Schema Installer Distribution......... 9

Required Database Character Set..................................................... 9

Required Tablespaces........................................................................ 10

Create the SIM Database User......................................................... 10

Run the SIM Database Schema Installer...................................... 11

Resolving Errors Encountered During Database Schema Installation 11

Running Data Seeding...................................................................... 12

4................................ Database Installation Tasks – Patch 15

Upgrading SIM.................................................................................... 15

5......................................... Application Installation Tasks 17

Create the Domain with ADF Libraries and Enterprise Manager 17

Start the NodeManager..................................................................... 24

Start the AdminServer (admin console):...................................... 25

Start the Managed Server.................................................................. 25

Change the default (file based) Credential Store to use the Oracle Database 25

Creation of Required Schemas with RCU.................................... 26

Set up OPSS Schema Datasource in WebLogic domain.......... 31

Associate Policy Store to Database................................................ 36

Expand the SIM Application Distribution.................................. 40

SIM OID Authentication Provider set up:.................................... 41

Verify and Set OID Authenticator.................................................. 45

Set the LANG Environment Variable............................................ 47

Set the Environment Variables for the SIM Installer................. 47

Run the SIM Application Installer................................................. 48

Clustered Installations – Post-Installation Steps...................... 48

SIM Database Authentication Provider set up (to be done after the application deploy) 49

Review and/or Configure Oracle Single Sign-On.................... 52

Create the SIM SSO provider in the SIMDomain....................... 52

SIM Batch Scripts................................................................................ 54

Resolving Errors Encountered During Application Installation 54

Web Help Files..................................................................................... 54

Starting and Stopping the Wavelink Server................................ 54

6................................................. Test the SIM Application 57

A......... Appendix: SIM Database Schema Installer Screens 59

B Appendix: SIM Application WebLogic Server Installer Screens 65

C........................... Appendix: Common Installation Errors 115

EJB Deployment Errors during Installation to WebLogic..... 115

Output Freezes during Text Mode Installation to WebLogic 115

Database Installer Hangs on Startup......................................... 116

Warning: Could not create system preferences directory..... 116

Warning: Couldn't find X Input Context................................... 116

ConcurrentModificationException in Installer GUI.............. 117

A Second Login Screen Appears After Single Sign-On Login 117

Error Connecting to Database URL............................................. 118

GUI screens fail to open when running Installer.................... 118

D Appendix: Setting up SIM Reports/Tickets in BI Publisher 119

BiPublisher 11g – BI Server Component Installation Tasks 119

BiPublisher 11g only - Installation Process Overview.......... 119

BiPublisher 11g only – Install Oracle BI EE 11g..................... 120

BiPublisher 11g – Configuring the SIM JDBC connection... 137

Configuring SIM for CUPS printers using BIPublisher 11g. 138

E......................... Appendix: Single Sign-On for WebLogic 141

What Do I Need for Single Sign-On?.......................................... 141

Can Oracle Access Manager Work with Other SSO Implementations? 141

Oracle Single Sign-on Terms and Definitions.......................... 142

What Single Sign-On is not........................................................... 143

How Oracle Single Sign-On Works............................................. 143

Installation Overview...................................................................... 145

User Management............................................................................ 145

F Appendix: Setting Up Password Stores with wallets/credential stores 147

About Database Password Stores and Oracle Wallet............ 147

Setting Up Password Stores for Database User Accounts.... 148

Setting up Wallets for Database User Accounts...................... 149

For RMS, RWMS, RPM Batch using sqlplus or sqlldr, RETL, RMS, RWMS, and ARI 149

Setting up RETL Wallets................................................................ 151

For Java Applications (SIM, ReIM, RPM, RIB, AIP, Alloc, ReSA, RETL) 152

How does the Wallet Relate to the Application?.................... 155

How does the Wallet Relate to Java Batch Program use?..... 155

Database Credential Store Administration............................... 155

Managing Credentials with WSLT/OPSS Scripts.................. 159

listCred................................................................................................ 160

updateCred......................................................................................... 161

createCred........................................................................................... 161

deleteCred........................................................................................... 161

modifyBootStrapCredential........................................................... 162

addBootStrapCredential................................................................. 163

Quick Guide for Retail Password Stores (db wallet, java wallet, DB credential stores) 165

G................................ Appendix: Database Parameter File 175

H........................................... Appendix: Installation Order 177

Enterprise Installation Order........................................................ 177

Preinstallation Tasks

This chapter discusses the tasks to complete before installation.

Implementation Capacity Planning

There is significant complexity involved in the deployment of Oracle Retail applications, and capacity planning is site specific. Oracle Retail strongly suggests that before installation or implementation you engage your integrator (such as the Oracle Retail Consulting team) and hardware vendor to request a disk sizing and capacity planning effort.

Sizing estimates are based on a number of factors, including the following:

§ Workload and peak concurrent users and batch transactions

§ Hardware configuration and parameters

§ Data scarcity

§ Application features utilized

§ Length of time history is retained

Additional considerations during this process include your high availability needs as well as your backup and recovery methods.

Check Supported Database Server Requirements

General Requirements for a database server running SIM include:

Supported On

Versions Supported

Database Server OS

OS certified with Oracle Database 12cR1 Enterprise Edition. Options are:

§ Oracle Linux 6 for x86-64 (Actual hardware or Oracle virtual machine).

§ Red Hat Enterprise Linux 6 for x86-64 (Actual hardware or Oracle virtual machine).

§ AIX 7.1 (Actual hardware or LPARs)

§ Solaris 11 SPARC (Actual hardware or logical domains)

§ HP-UX 11.31 Integrity (Actual hardware, HPVM, or vPars)

Database Server 12cR1

Oracle Database Enterprise Edition 12cR1 (12.1.0.1.4) with the following specifications:

Components:

§ Oracle Partitioning

§ Examples CD

Patches:

§ 18522516: 12.1.0.1.4 Database Patch Set Update.

§ 18705901: 12.1.0.1.4 Database Patch Patch Set Update for Grid Infrastructure.

Oneoffs:

§ 18169693: ORA-28595: Extproc agent : Invalid DDL Path.

§ 17815049: ORA-600 [KPONMARKCONN1] WHEN STARTING INSTANCE

§ Patch 19623450: MISSING JAVA CLASSES AFTER UPGRADE TO JDK 7

§ 18404105: GETTING ORA-22345 WHILE TRYING TO RECOMPILE THE TYPE USING EXECUTE IMMEDIATE STM.

Other components:

§ Perl interpreter 5.0 or later

§ X-Windows interface

§ JDK 1.7

Note: By default, JDK is at 1.6. After applying the 12.1.0.1.4 patchset, follow the instructions on Oracle Database Java Developer’s Guide 12c Release 1 to upgrade JDK to 1.7, then apply patch 19623450. The Guide is available here:

http://docs.oracle.com/database/121/JJDEV/chone.htm#JDEV01000

Check Supported Application Server Requirements

The SIM application must be deployed on Oracle WebLogic 10.3.6

Note: SIM is certified to work with only Oracle Internet Directory LDAP server (OID), as specified in the Application Server Requirements section of the SIM Installation Guide. The sample, unsupported .ldif files that SIM includes are provided only as reference.

General requirements for an Oracle WebLogic Server capable of running the SIM application include the following.

Supported on:	Versions Supported:
Application Server OS	OS certified with Oracle Fusion Middleware 11g Release 1 (11.1.1.7). Options are: § Oracle Linux 6 for x86-64 (Actual hardware or Oracle virtual machine). § Red Hat Enterprise Linux 6 for x86-64 (Actual hardware or Oracle virtual machine). § AIX 7.1 (Actual hardware or LPARs) § Solaris 11.1 SPARC (Actual hardware or logical domains) § HP-UX 11.31 Integrity (Actual hardware, HPVM, or vPars)
Application Server	Oracle Fusion Middleware 11g Release 1 (11.1.1.7) Components: § Oracle WebLogic Server 11g Release 1 (10.3.6) § Oracle Identity Management 11g Release 1 (11.1.1.7) § ADF 11.1.1.7 § Oracle Enterprise Manager 11.1.1.7 Note: Oracle Internet Directory (OID) is the supported LDAP directory for Oracle Retail products. For alternate LDAP directories, refer to Oracle WebLogic documentation set. Java: § JDK 1.7+ 64 bit Optional (required for running reports) § BI Publisher 11.1.1.7 Optional (required for SSO) · Oracle WebTier 11g (11.1.1.7) Oracle Access Manager 11g Release 2 (11.1.2.2) Note: A separate WebLogic 10.3.6 installation is required for Oracle Access Manager 11.1.2.2. · Oracle Access Manager Agent (WebGate) 11g Release 2 (11.1.2.2)

Supported on:

Versions Supported:

Application Server OS

OS certified with Oracle Fusion Middleware 11g Release 1 (11.1.1.7). Options are:

§ Oracle Linux 6 for x86-64 (Actual hardware or Oracle virtual machine).

§ Red Hat Enterprise Linux 6 for x86-64 (Actual hardware or Oracle virtual machine).

§ AIX 7.1 (Actual hardware or LPARs)

§ Solaris 11.1 SPARC (Actual hardware or logical domains)

§ HP-UX 11.31 Integrity (Actual hardware, HPVM, or vPars)

Application Server

Oracle Fusion Middleware 11g Release 1 (11.1.1.7)

Components:

§ Oracle WebLogic Server 11g Release 1 (10.3.6)

§ Oracle Identity Management 11g Release 1 (11.1.1.7)

§ ADF 11.1.1.7

§ Oracle Enterprise Manager 11.1.1.7

Note: Oracle Internet Directory (OID) is the supported LDAP directory for Oracle Retail products. For alternate LDAP directories, refer to Oracle WebLogic documentation set.

Java:

§ JDK 1.7+ 64 bit

Optional (required for running reports)

§ BI Publisher 11.1.1.7

Optional (required for SSO)

· Oracle WebTier 11g (11.1.1.7)
Oracle Access Manager 11g Release 2 (11.1.2.2)
Note: A separate WebLogic 10.3.6 installation is required for Oracle Access Manager 11.1.2.2.

· Oracle Access Manager Agent (WebGate) 11g Release 2 (11.1.2.2)

Check Single Sign-On Requirements

If SIM is not being deployed in a Single Sign-On environment, skip this section.

If Single Sign-On is to be used, verify the Oracle Identity Management 11gR1 version 11.1.1.7 has been installed along with the components listed in the above Application Server requirements section. Verify the Oracle WebTier Server is registered with the Oracle Access Manager 11gR2 as a partner application.

Check Directory Server Requirements

SIM uses directory server based user authentication and searching. For LDAP, SIM is supported with the following directory servers:

§ Oracle Identity Management 11gR1 version 11.1.1.7

Check Third-Party Software Dependencies

§ Oracle Retail Wireless Foundation Server, provided by Wavelink 5.x.

Check Client PC and Web Browser Requirements

Requirement	Versions
Operating system	Windows 7 or 8
Display resolution	1024x768 or higher
Processor	1GHz or higher
Memory	512MBytes or higher
Oracle (Sun) Java Runtime Environment (JRE)	Java 7+
Browser	Microsoft Internet Explorer 11 Mozilla Firefox 24 The browser is used to launch the Java WebStart client.

Note: Oracle Retail does not recommend or support installations with less than 128 kb bandwidth available between the PC client and the data center. Limiting the client to less than 128 kb total available bandwidth causes unpredictable network utilization spikes, and performance of the client degrades below requirements established for the product. The 128 kb requirement provides reasonable, predictable performance and network utilization.

Supported Oracle Retail Products

The following Oracle Retail products can be integrated with SIM. Next to each product is an indication of whether it is required or optional for SIM to function properly:

§ Retail Integration Bus (RIB) 14.1 and all subsequent patches and hot fixes – Required

Although typically used to integrate SIM with RMS, RIB can also be used to integrate SIM with other merchandising systems.

Note: RIB requires custom modifications to use a merchandising system other than RMS.

Retail Merchandising System (RMS) 14.1 – Optional

§ Oracle Retail Price Management 14.1 – Optional

§ Oracle Retail POS Suite 14.1 – Optional

The above products can be installed before or after SIM. However, it is helpful to know the connection details for the other products ahead of time so that you can provide them to the SIM application installer, which will configure the connection points for you.

UNIX User Account Privileges to Install the Software

A UNIX user account is needed to install the software. The UNIX user that is used to install the software should have write access to the WebLogic server installation files.

For example, “oretail.”

Note: Installation steps will fail when trying to modify files under the WebLogic installation unless the user has write access.

SIM Installation Overview

The following basic steps are required to install and set up SIM for the first time.

1. Install the database (with or without RAC).

2. Install application server (WebLogic) if it has not been installed

3. Install the SIM database schema

4. Set role-based access control. See Chapter 3 of the Oracle Retail Store Inventory Management Implementation Guide, Volume 1 for instructions.

5. Install the SIM application.

6. Run data-seeding from RMS (Applicable only if SIM integrate with RMS)

Database Installation Tasks

This chapter describes the tasks required for a full database installation.

Note: If the SIM 14.0.1 software is already installed, please see “Database Installation Tasks – Patch” for information on Patching to SIM 14.1.

Expand the SIM Database Schema Installer Distribution

1. Log in to the UNIX server as a user which has sufficient access to run sqlplus from the Oracle Database installation.

2. Create a new staging directory for the SIM database schema installer distribution (sim14-dbschema.zip). There should be a minimum of 50 MB disk space available for the database schema installation files. This location is referred to as INSTALL_DIR for the remainder of this chapter.

3. Copy sim14-dbschema.zipto <INSTALL_DIR> and extract its contents.

Required Database Character Set

SIM 14.1 databases should be created with the AL32UTF8 database character set. This will ensure support for characters of all languages supported by SIM and ensure proper integration with other Oracle Retail applications.

Required Tablespaces

Before you run the SIM database schema installer, make sure that the required tablespaces have been created in the database: RETAIL_INDEX, RETAIL_DATA, USERS, and LOB_DATA. Shown below are examples of how to create tablespaces.

Tablespace Creation

CREATE TABLESPACE RETAIL_INDEX DATAFILE

'<datafile_path>/RETAIL_INDEX01.dbf' SIZE 500M

AUTOEXTEND ON NEXT 100M MAXSIZE 2000M

EXTENT MANAGEMENT LOCAL

SEGMENT SPACE MANAGEMENT AUTO

;

CREATE TABLESPACE RETAIL_DATA DATAFILE

'<datafile_path>/RETAIL_DATA01.dbf' SIZE 500M

AUTOEXTEND ON NEXT 100M MAXSIZE 2000M

EXTENT MANAGEMENT LOCAL

SEGMENT SPACE MANAGEMENT AUTO

;

CREATE TABLESPACE USERS DATAFILE

'<datafile_path>/users01.dbf' SIZE 100M

AUTOEXTEND ON NEXT 100M MAXSIZE 2000M

EXTENT MANAGEMENT LOCAL

SEGMENT SPACE MANAGEMENT AUTO

;

CREATE TABLESPACE LOB_DATA DATAFILE

'<datafile_path>/lob_data01.dbf' SIZE 50M

AUTOEXTEND ON NEXT 100M MAXSIZE 2000M

EXTENT MANAGEMENT LOCAL

SEGMENT SPACE MANAGEMENT AUTO

;

Create the SIM Database User

The user in the database which will own the SIM tables must be created prior to running the SIM database schema installer. A create_user.sql script has been provided that can be used for this:

<INSTALL_DIR>/sim/dbschema/dbutils/create_user.sql

The script takes three arguments on the command line in sqlplus: username, password, and temporary tablespace.

Example: SQL> @create_user.sql Please review this script and run it as a user with adequate permissions, such as SYSTEM.

Run the SIM Database Schema Installer

This installer installs the SIM database schema, compile SIM objects, insert SIM data, and produce the dba_create_directory.sql script.

1. Set the following environment variables:

§ Set the ORACLE_HOME to point to an installation that contains sqlplus. It is recommended that this be the ORACLE_HOME of the SIM database.

§ Set the PATH to: $ORACLE_HOME/bin:$PATH

§ Set the ORACLE_SID to the name of your database

§ Set the NLS_LANG for proper locale and character encoding

Example: NLS_LANG=AMERICAN_AMERICA.AL32UTF8

2. If you are using an X server such as Exceed, set the DISPLAY environment variable so that you can run the installer in GUI mode (recommended). If you are not using an X server, or the GUI is too slow over your network, unset DISPLAY for text mode.

3. Run the install.sh script. This launches the installer. After installation is completed, a detailed installation log file is created: <INSTALL_DIR>/ sim/dbschema/logs/sim-install-db.<timestamp>.log.

Note: Appendix A contains details on every screen and field in the database schema installer.

4. When the installer finishes it prints the values of the database SID and database schema user. Note these values as they are needed later when you run the SIM application installer.

5. The SIM database schema installer will produce a dba_create_directory.sql script which must be reviewed by a DBA and then run on the database server in order to complete the installation.

Resolving Errors Encountered During Database Schema Installation

If the database schema installer encounters any errors, it halts execution immediately and prints to the screen which SQL script it was running when the error occurred. It also writes the path to this script to the .dberrors file. When this happens, you must run that particular script using sqlplus. After you are able to complete execution of the script, delete the .dberrors file and run the installer again. You can run the installer in silent mode so that you do not have to retype the settings for your environment. See Appendix D of this document for instructions on silent mode.

See Appendix F of this document for a list of common installation errors.

Subsequent executions of the installer will skip the SQL scripts which have already been executed in previous installer runs. This is possible because the installer maintains a .dbhistory file with a listing of the SQL scripts that have been run. If you have dropped the SIM schema and want to start with a clean install, you can delete the .dbhistory file so that the installer runs through all of the scripts again. It is recommended that you allow the installer to skip the files that it has already run.

Running Data Seeding

After full fresh install SIM database schema and SIM application installation tasks completed, store foundation data must be seeded into SIM before user can login to SIM application.

(For migrating SIM from previous release, see “Oracle Retail Store Inventory Management Implementation Guide” for details).

The data seeding process seeds store foundation data from RMS into SIM.

See the “Data Seeding” section of the “Oracle Retail Store Inventory Management Implementation Guide, Volume 1” for additional data seeding details.

The SIM database installer extracts the data seeding scripts from the sim-database-data-seeding.zip to the following location:

STAGING_DIR/sim/dbschema/data_seeding

This folder is referred to as DATA_SEEDING_DIR for the remainder of this chapter.

Third-Party Software Dependencies

SIM data seeding requires groovy jar file to be installed. Download Groovy 2.3.7 from http://groovy.codehaus.org.

Extract the required jar file groovy-all-2.3.7.jar and place it under DATA_SEEDING_DIR/lib folder before executing the data seeding.

1. Set the following environment variables:

§ Set ORACLE_SID to the name of SIM database.

Example:

export ORACLE_SID=<SIM_DB_NAME>

§ Set the ORACLE_HOME. It is recommended that this be the ORACLE_HOME of the SIM database.

Example:

export ORACLE_HOME=/u00/oracle/product/12.1.0.1

§ Set JAVA_HOME

Example:

export JAVA_HOME= /path/java1.7+_64bit

Set NLS_LANG

Example:

export NLS_LANG=AMERICAN_AMERICA.AL32UTF8

§ Set the PATH to: $ORACLE_HOME/bin:

Example:

export PATH=$ORACLE_HOME/bin:$JAVA_HOME/bin:$PATH

2. Verify the directory and the file permissions:

The recommended permissions for data seeding directories are 775 (rwxrwxr-x).

3. View Data Seeding Options:

Change to <DATA_SEEDING_DIR>/bin directory:

startDataSeedCli.sh -h

4. Start Data Seeding Process:

The data seeding provides the following execution options. Please run the script with 1-6 consecutively as shown below.

Note: It is highly recommended to back up the SIM database before executing the data seeding scripts.

It is recommended to verify export log files before staring importing process.

§ Set Up

startDataSeedCli.sh -a 1 –s <simDBServer> -p <port> -d <simDB>

§ Export Foundation Data

startDataSeedCli.sh -a 2 -s <rmsDBServer> -p <port> -d <rmsDB>

§ Export Store Data

startDataSeedCli.sh -a 3 -s <rmsDBServer > -p <port> -d <rmsDB>

§ Import Foundation Data

startDataSeedCli.sh -a 4 –s <simDBServer> -p <port> -d <simDB>

§ Import Store Data

startDataSeedCli.sh -a 5 –s <simDBServer> -p <port> -d <simDB>

§ Cleanup

startDataSeedCli.sh -a 6 –s <simDBServer> -p <port> -d <simDB>

5. Check data seeding logs:

The data seeding process writes master log files into <DATA_SEEDING_DIR>/log directory.

Please check following the master log files:

§ export_foundation.log

§ export_store.log

§ import_foundtion.log

§ import_store.log

§ data_seed_common.log

The master log files may have references to sub-process log files:

§ <DATA_SEEDING_DIR>/export/foundation/log

§ <DATA_SEEDING_DIR>/export/store/log

§ <DATA_SEEDING_DIR>/import/foundation/log

§ <DATA_SEEDING_DIR>/import/store/log

6. Verify the seeding results files.

The verification files are located at directory <DATA_SEEDING_DIR>/verify/out:

§ verify_foundation_data.out

§ verify_store_data.out

§ disabled_constraints.out

7. After inspecting the result files, resolve the problematic data. A database administrator will need to manually enable the disabled constraints which are reported.

8. After data seeding is finished and you are convinced that your data was correctly seeded, you can remove all data seeding files from <DATA_SEEDING_DIR>

Application Installation Tasks

Before proceeding, you must install Oracle WebLogic Server 11g Release 1 (10.3.6), ADF 11.1.1.7 and any patches listed in the Chapter 1 of this document. The Oracle Retail Store Inventory Management application is deployed to a WebLogic Managed server within the WebLogic installation. It is assumed Oracle Database has already been configured and loaded with the appropriate Store Inventory Management schemas for your installation.

Installing a separate domain is mandated. It can be called “SIMDomain” (or something similar) and will be used to install the managed servers. The ADF libraries should be extended to this domain and the Enterprise Manager application should be deployed.

Note: If this domain is to be setup in a secure mode. Please set up weblogic as SSL and refer to ORACLE Retail Merchandising Security Guide for details on all items to change to be in secure mode. This would best be done before domain and application install. The domain example below is for unsecured setup.

Create the Domain with ADF Libraries and Enterprise Manager

Perform the following procedure to create the domain with ADF libraries and Enterprise Manager.

1. Run config.sh present in Weblogic home, wlserver_10.3/common/bin and select the create a new domain option

2. Select Create a new WebLogic domain and click Next.

3. Select Oracle Enterprise Manager and Oracle JRF and click Next.

4. Set the Domain name (for example: SIMDomain) and click Next.

5. Set the Administrator user and password and click Next.

6. Select Production Mode and click Next.

7. Select Administration Server and Managed Servers, Clusters and Machines. This will allow you to adjust the AdminServer port as well as create the sim-server and nodemanager. Click Next.

8. Set your AdminServer to an open port and click Next.

9. Click Add and create your sim-server managed server. Set the Listen Address to the server on which WebLogic is installed. Click Next.

Note: A cluster is not being configured in this install example.

10. Click the Unix Machine tab, click Add and create the nodemanager (port 5556 is the default port). Click Next.

11. Add the AdminServer and sim-server to the nodemanager we just created and click Next.

12. Create your new SIMDomain and click Create.

13. Click Done.

Note: Save the information for the Domain Location and Admin Server URL as that information is needed for the installation.

Start the NodeManager

1. Start up the nodemanager, the script is located at $WLS_HOME/wlserver_10.3/server/bin/startNodeManager.sh.

2. Edit the nodemanager.properties file at the following location with the below values:

$WLS_HOME/wlserver_10.3/common/nodemanager/nodemanager.properties

§ StartScriptEnabled=true

§ StartScriptName=startWebLogic.sh

3. After making changes to the nodemanager.properties file, NodeManager must be restarted.

Note: The nodemanager.properties file is created after NodeManager is started for the first time. It is not available before that point.

Start the AdminServer (admin console):

1. Start up the AdminServer using the SIMDomain/bin/startWebLogic.sh script.

With the initial startup you will be asked for the admin user credentials. Once the AdminServer has started up you can create a boot.properties file containing the credentials for the AdminServer to start up without the need to enter the information each time.

An example of the boot.properties would be:

mkdir –p SIMDomain/servers/AdminServer/security

vi SIMDomain/servers/AdminServer/security/boot.properties

- username=weblogic

- password=<password used at domain creation>

This file will be encrypted after the SIMDomain starts up.

Start the Managed Server

After NodeManager and AdminServer are started, the managed server(s) can be started via the admin console.

1. Navigate to Environments > Servers, Control tab. Select sim-server and click “start”.

Change the default (file based) Credential Store to use the Oracle Database

The SIMDomain that was just created will default to use a file based credential store for the wallet and policies. This needs to be changed so that it uses the Oracle Database. This change is for enhanced security and is also a requirement for a clustered SSO authentication setup.

Creation of Required Schemas with RCU

Some RCU database schemas are required to change the credential store, specifically we will need to create the OPSS and MDS schemas.

The following steps will show you the creation of the database schemas required:

1. Download the RCU 11.1.1.7 zip file and extract it to a new folder named RCU 11.1.1.7. This folder (RCU 11.1.1.7) is used as RCU_HOME for the remainder of this guide. You may use a Windows version of RCU to create the schemas.

2. Go to <RCU_HOME>\BIN and double click rcu.bat (Windows) or “./rcu” (Linux) .

3. Select Create and click Next.

4. Enter all the fields as explained below and click Next:

a. Host Name: Database server host name which Application will use.(example: ordbhost)

b. Port: Database port (example: 1521)

c. Service Name Database name (example: dvols143)

d. Username: SYS

e. Password: <SYS password>

5. Prerequisite requirements are verified and the following screen is displayed, click OK.

6. Expand “Oracle AS Repository Components” and select Metadata Services and Oracle Platform Security Services checkboxes as shown below, Enter a new prefix if needed (the example uses a prefix of “SIM”)

Click Next then OK for the prerequisites check.

7. Enter and confirm your password and click Next.

Note: Make a note of the password you give here as it will be used later.

8. Click Next, then OK when it states it is going to create the tablespaces if they are needed.

9. Click OK when tablespace creating and validation has completed.

10. Click Create to make the schemas.

11. When the schemas are created, click Close to exit RCU.

Set up OPSS Schema Datasource in WebLogic domain

Follow the below steps to set up the datasource with OPSS schema in WebLogic domain (SIMDomain).

1. Login to the Admin console and go to Services -> Data Sources.

2. Click Lock & Edit then click New -> Generic Data Source.

3. Enter the details and click Next:

§ Name: OPSSDataSource

§ JNDI Name: jndi/OPSSDS

§ Database Type: Oracle

4. Select Oracle’s Driver (Thin) for Service connections; Versions: 9.0.1 and later. Click Next.

5. Uncheck “Supports Global Transactions” and press Next.

6. Enter the details of the OPSS schema we just created and click Next:

§ Database Name: (i.e: dvols143)

§ Host Name: (i.e.: ordbhost.us.oracle.com)

§ Port: (i.e.: 1521)

§ Database User Name: SIM_OPSS (This is the OPSS schema which has been created using RCU earlier in this document.)

§ Password: <password (Password given at the time of OPSS schema creation)

7. Click Test Configuration and make sure you can connect to the schema successfully. Click Next if ok, click Back if it does not connect and check your settings.

8. Target all the servers (AdminServer & sim-server) and click Finish.

9. Click Activate Changes to get them incorporated into the domain.

A message is displayed indicating that the changes have been activated.

Associate Policy Store to Database

Follow the steps below to re-associate the domain policy store from file based to using the database:

1. Login to the WebLogic EM console using the Administrator credentials (for example: http://orapphost.us.oracle.com:17201/em).

2. Expand the Weblogic Domain and click the SIMDomain.

3. Select the dropdown WebLogic Domain->Security->Security Provider Configuration.

4. Click Change Store Type.

5. Select Oracle Database for the store type, then click the select button for the Data Source JNDI Name and choose the OPSS datasource we just created.

6. Enter the values:

§ User Name: (username of the OPSS schema created above)

§ Password/Confim: (password used for OPSS schema created above)

§ Root DN: cn=SIMPolicies

§ Select ‘Create New Domain’

§ Domain Name: SIMDomain (This must be the domain name which has been created earlier in this document)

7. Click OK, and then click Yes when it warns that it will require a restart of the management domain.

8. The message ‘Configure Security Stores – Completed Successfully’ appears. Click Close.

9. The following confirmation appears:

10. Restart the SIMDomain for the change to take affect.

Expand the SIM Application Distribution

To expand the SIM application distribution, do the following.

1. Log in to the UNIX server as the user who owns the Web Logic installation. Create a new staging directory for the SIM application distribution (sim14-application.zip). There should be a minimum of 250 MB disk space available for the application installation files.

This location is referred to as INSTALL_DIR for the remainder of this chapter.

2. Copy sim14-application.zip to <INSTALL_DIR> and extract its contents.

SIM OID Authentication Provider set up:

Note: This procedure is only needed if you plan on using LDAP authentication for the SIM application. This can be skipped if database authentication is going to be used.

1. Log in to the Administration Console.

http://<host>:<port>/console/

2. In the Domain Structure frame, click Security Realms.

3. In the Realms table, click myrealm. The Settings for myrealm page is displayed.

4. Click the Providers tab.

5. Click Lock & Edit and then click New. The Create a New Authentication Provider page is displayed.

6. Enter OIDAuthenticator in the Name field and select OracleInternetDirectoryAuthenticator as the type.

7. Click OK. The Settings for OIDAuthenticator page is displayed.

8. Set the Control Flag field to Optional and click Save. The Control Flag should be set as Optional so users do not get locked out of the Admin console if there is a typo.

9. Once your changes are saved, click Activate Changes.

10. Click the Provider Specific tab and click Lock & Edit.

11. Supply your LDAP connection and credentials.

The entries below are examples only. You should match the entries to your OID. Example:

§ Host: orapphost

§ Port: 3060

§ Principal: cn=orcladmin

§ Credential: <password>

§ Confirm Credential: <password>

§ User Base DN: cn=users,dc=us,dc=oracle,dc=com

§ Group Base DN: cn=Groups,dc=us,dc=oracle,dc=com

§ Check Propagate Cause For Login Exception

12. Click Save

13. Click Reorder.

14. Order OIDAuthenticator first and DefaultAuthenticator second.

15. Click OK.

16. Once your changes are saved, click Activate Changes.

17. Shut down all servers and restart the admin server.

Verify and Set OID Authenticator

1. Log in to the Administration Console.

http://<host>:<port>/console/

2. Click “Lock & Edit” so you can make changes

3. In the Domain Structure frame, click Security Realms.

4. In the Realms table, click Default Realm Name. The Settings page is displayed.

5. Click the Providers tab.

6. Click the Users and Groups tab to see a list of users and groups contained in the configured authentication providers.

You should see usernames from the Oracle Internet Directory configuration, which implicitly verifies that the configuration is working.

7. Click the Providers tab and click OIDAuthenticator.

8. Set Control Flag to SUFFICIENT and click Save.

9. Click Activate Changes and restart the entire SIMDomain.

Set the LANG Environment Variable

The LANG environment variable must be set in the profile of the UNIX user who owns the application server ORACLE_HOME files. If you change the value of LANG or set the value for the first time, you must restart the Application Server in order for the change to take effect.

Example:

LANG=en_US

export LANG

Set the Environment Variables for the SIM Installer

1. Set the following environment variables for the SIM installer (the following are just examples, use values for appropriate for your environment):

export ORACLE_HOME=/u00/webadmin/product/wls_retail

export WEBLOGIC_DOMAIN_HOME=/u00/webadmin/product/wls_retail/user_projects/domains/SIMDomain

export JAVA_HOME=/u00/webadmin/product/jdk_java

export PATH=$JAVA_HOME/bin:$PATH

2. If a secured datasource is going to be configured you also need to set “ANT_OPTS” so the installer can access the key and trust store that is used for the datasource security:

export ANT_OPTS="-Djavax.net.ssl.keyStore=<PATH TO KEY STORE> -Djavax.net.ssl.keyStoreType=jks -Djavax.net.ssl.keyStorePassword=<KEYSTORE PASSWORD> -Djavax.net.ssl.trustStore=<PATH TO TRUST STORE> -Djavax.net.ssl.trustStoreType=jks -Djavax.net.ssl.trustStorePassword=<TRUSTSTORE PASSWORD>"

An example of this would be:

export ANT_OPTS="-Djavax.net.ssl.keyStore=/u00/webadmin/product/wls_retail /wlserver_10.3/server/lib/orapphost.keystore -Djavax.net.ssl.keyStoreType=jks -Djavax.net.ssl.keyStorePassword=retail123 -Djavax.net.ssl.trustStore=/ u00/webadmin/product/wls_retail /wlserver_10.3/server/lib/orapphost.keystore -Djavax.net.ssl.trustStoreType=jks -Djavax.net.ssl.trustStorePassword=retail123"

Run the SIM Application Installer

This installer configures and deploys the SIM application and Java WebStart client files.

1. If you are using an X server such as Exceed, set the DISPLAY environment variable so that you can run the installer in GUI mode (recommended). If you are not using an X server, or the GUI is too slow over your network, unset DISPLAY for text mode.

2. Verify that the managed server to which SIM will be installed is currently running.

3. Run the install.sh script. This launches the installer. After installation is completed, a detailed installation log file is created: <INSTALL_DIR>/sim/application/logs/sim-install-app.<timestamp>.log.

Note: The manual install option in the installer is not functional for this release. See the section, “Files not available to copy at the end of installation, results in non working applications – Weblogic only” in Appendix E: Common Installation Errors.

Note: See Appendix: SIM Application WebLogic Server Installer Screens for details on every screen and field in the WebLogic application installer.

Note: See Appendix: Common Installation Errors for details on common installation errors.

Clustered Installations – Post-Installation Steps

Skip this section if you are not clustering the application server.

If you are installing the SIM application to a clustered WebLogic server environment, there are some extra steps you need to take to complete the installation. In these instructions, the application server node with the ORACLE_HOME you used for the SIM installer is referred to as the master server. All other nodes are referred to as the remote server.

1. Copy the <weblogic domain path>/retail/sim14 directory from the master server to each remote server that is a member of the cluster that contains the deployed sim application.

2. If SIM has been installed in a cluster the Migration Basis needs to be set to use “consensus” and all machines in the cluster chosen for migration. This is done with the following procedure.

Note: This needs to be done after the SIM application has been successfully installed to the sim-cluster using the SIM installer. If the SIM application is ever re-installed for any reason the following will have to be re-done as well.

3. Click Lock & Edit in the Change Center.

4. Go to cluster migration screen in the Weblogic Administration Console. i.e.:
SIMDomain > Environment > Clusters > sim-cluster > Configuration (tab) > Migration (tab).

5. Set migration basis to Consensus.

6. Select all machines in the SIM cluster as candidates.

7. Click Save.

8. Click Activate Changes in the Change Center.

9. Restart the servers in the SIM cluster.

The migration setup should look similar to the following:

SIM Database Authentication Provider set up (to be done after the application deploy)

Note: This procedure is only needed if you plan on using database authentication for the SIM application. This can be skipped if LDAP is going to be used for authentication.

1. Shut down all the servers of the WebLogic Domain created.

2. Once you extract the SIM installer to <INSTALL_DIR> copy the sim-security.zip present in <INSTALL_DIR>/sim/application/sim14 to the WEBLOGIC_DOMAIN_HOME/lib and extract it contents in the folder.

3. Start the domain admin server.

4. Log into the WebLogic console.

5. Navigate to: security realms -> myrealm (default realm) -> providers.

6. Start a Lock and Edit session.

7. Click New provider.

8. Select the provider type from the list: SimWlsDbAuthenticator.

9. Set the provider name (Default: SimWlsDbAuthenticator).

10. Click Ok.

11. Open the new provider configuration.

12. Under Common, set the Control Flag to SUFFICIENT.

13. Click Provider Specific.

14. The SIM Data Source Name defaults to SimDataSource which is what the SIM installer creates, so it should be left to the default value.

15. Check that the GroupName is set to the name of the group used for SIM secure users.

16. Click Ok.

17. On the provider list, click Reorder.

18. Move the SimDbAuthenticator to the top of the list, or above the DefaultAuthenticator.

19. Click Ok.

20. Click Activate Changes.

21. Shutdown the admin server.

22. Start the admin and managed servers for the domain.

Review and/or Configure Oracle Single Sign-On

Note: This procedure is only needed if you plan on setting up the SIM application using Single Sign On (SSO) authentication. This can be skipped if SSO is not going to be configured for this environment. The Oracle Access Manager must be configured and the Oracle http server (Webtier and webgate) must be registered into the Oracle Access Manager.

Create the SIM SSO provider in the SIMDomain

1. Shut down all the servers of the WebLogic Domain created.

2. Once you copy the contents to <INSTALL_DIR> copy the sim-security.zip present in <INSTALL_DIR>/sim/application/sim14 to the WEBLOGIC_DOMAIN_HOME/lib and extract it contents in the folder.

3. Start the domain admin server.

4. Log into the WebLogic console

5. Navigate to: security realms -> myrealm (default realm) -> providers.

6. Start a Lock and Edit session.

7. Click New provider.

8. Select the provider type from the list: SimWlsSsoAuthenticator.

9. Set the provider name (Default: SimSsoAuthenticator).

10. Click Ok.

11. Open the new provider configuration.

12. Under Common, set the Control Flag to SUFFICIENT.

13. Click Provider Specific.

14. Check that the GroupName is set to the name of the group used for SIM secure users (sim_secure_users by default).

15. All other values under the Provider Specific tab can be left as the default value.

16. Click Ok.

17. On the provider list, click Reorder.

18. Move the SimWlsSsoAuthenticator to the top of the list, or above the DefaultAuthenticator.

19. Click Ok.

20. Click Activate Changes.

21. Shutdown the domain.

22. Start the admin and managed servers for the domain.

After the SSO provider is created in the SIMDomain, you will also have to set the protection of the SIM application resources correctly in the Application Domain that has been registered in the Oracle Access Manager.

In the Webtier/Webgate http server you need to set the mod_wl_ohs.conf file to redirect the http call to the where the SIM application has been deployed.

For example, in mod_wl_ohs.conf set:

WebLogicCluster orapphost:17015

SetHandler weblogic-handler

ErrorPage downtime.html

</Location>

Then in Oracle Access Manager, set the protection of the resources in the Application Domain that has been registered for the SIM application. You must protect the /sim-client/launch resource and exclude the rest:

Resource URL: /sim-client/launch

Protection Level: Protected

Authentication Policy: Protected Resource Policy

Authorization Policy: Protected Resource Policy

Resource URL: /sim-client/.../*

Protection Level: Excluded

SIM Batch Scripts

The SIM batch programs are installed in the location that was specified during application installation.

The batch programs can be run from a different location if you cannot run them from under the application server <WEBLOGIC_DOMAIN_HOME>.. To install the batch files in a different location just copy the entire batch folder to the appropriate destination.

The batch directory is assumed to be located on the same server as the application server. If you copy the SIM batch directory to a location on a different server, then you need to configure the file path to the sim-batch.log file, which is defined in batch/resources/log4j.xml.

See the “Batch Detail” section of the Oracle Retail Store Inventory Management Operations Guide for information about how to run batches.

Resolving Errors Encountered During Application Installation

If the application installer encounters any errors, it halts execution immediately. You can run the installer in silent mode so that you do not have to retype the settings for your environment. See Appendix D of this document for instructions on silent mode.

See “Appendix: Common Installation Errors “for a list of common installation errors.

Since the application installation is a full reinstall every time, any previous partial installs are overwritten by the successful installation.

Web Help Files

The application installer automatically copies the web help files to the proper location. They are accessible from the help links within the application.

Starting and Stopping the Wavelink Server

In order to use handheld wireless devices with SIM, the Wavelink server must be running. The SIM application installer installs, configures, and starts the Wavelink server for you, so once the SIM application install is complete, the Wavelink server is ready to be used.

Note: Even if you use the AdminServer to restart SIM, you will still need to restart the Wavelink server manually.

The Wavelink server scripts are installed into the <sim-wireless-directory>/bin.

The following is an example for stopping and starting the Wavelink server:

# cd /u00/webadmin/product/wls_retail/user_projects/domains/SIMDomain/retail/sim14/wireless/bin

# ./wavelink-shutdown.sh

# ./wavelink-startup.sh

Note: The wireless functionality in SIM is dependent on Wavelink and includes a client and server component. Wavelink software ensures that the wireless user interface of SIM can work with various handheld devices.

Server:

The Oracle Retail Wireless Foundation Server is bundled with the SIM server.

Client:

For wireless device to interact correctly with SIM-server, it is required to install appropriate Wavelink studio client on each of the handheld devices.

Please visit the http://www.wavelink.com/download/downloads.aspx site to download studio-client specific to your device.

Please note that only those devices listed with "studio client", will support running of the SIM client.

If the device you need is not listed, you may log an enhancement request with Oracle Retail.

Oracle Retail will work with Wavelink for roadmap considerations.

Each Wavelink studio client has a single session free license. For multiple sessions additional licenses need to be obtained. Please contact your Oracle sales representative or client partner for Wavelink Studio Client and Oracle Retail with your needs.

Note: For configurations of physical handheld devices or wireless network setup, check your hardware manufacturer’s manual or Wavelink’s studio client information. This information is not covered in this guide.

Appendix: SIM Application WebLogic Server Installer Screens

You need the following details about your environment for the installer to successfully deploy the SIM application. Depending on the options you select, you may not see some screens.

Screen: Installation Type

Field Title	Which Installation Method will you use?
Field Description	Choosing “Standalone server” will deploy SIM to a non-clustered environment, if “Cluster Servers” is chosen then it will deploy SIM to a cluster of servers defined in WebLogic.

Screen: Cluster load-balancer Address

This screen will be displayed, if Cluster Servers option is selected in “Installation Type” screen.

Field Title	Load-Balancer/Cluster DNS Address
Field Description	This contains Virtual Host name of the load balancer that will be used if SIM is to be deployed to a clustered environment. Please note this screen will not appear in case you select Standalone server in previous screen.

Screen: Security Details

Field Title	Enable SSL for SIM?
Field Description	Choosing yes will deploy SIM using SSL, and will configure SIM to use SSL. In this case, SSL must be configured and enabled for the admin server and SIM managed server or cluster. Choosing no will deploy and configure SIM without SSL.

Screen: Turn off the application server’s non-SSL port

Field Title	Disable non SSL port?
Field Description	Selecting Yes will make that the application server’s non – SSL port inactive and a Selecting No will keep application server’s non-SSL port active.

Screen: Application Server Details

Field Title	WebLogic Server Hostname
Field Description	The hostname of the server where the WebLogic server is installed.
Example	Dev0234
Notes	Used by installer scripts to install the application and to create default inputs for client codebase and JNDI provider URL.

Field Title	WebLogic Server Port
Field Description	Listen port for the WebLogic Admin server.
Example	7001

Field Title	WebLogic Admin User Name
Field Description	The WebLogic user which will be used to install the SIM application.
Example	Weblogic
Notes	Used by installer scripts to install the application

Field Title	WebLogic Admin User Password
Field Description	The password of the WebLogic Admin User used above.
Notes	Used by installer scripts to install the application

Screen: Application Deployment Details

Field Title	Client Context Root
Field Description	Context root for sim client.
Example	sim-client

Field Title	WebLogic server/cluster
Field Description	This the managed server name for standalone deployment and Cluster name for deployment to clustered managed servers.
Example	sim-server

Screen: Choose Apps to Integrate with SIM

Field Title	Configure RIB for SIM?
Field Description	Select this option if you will be using RIB with SIM. Please note if you select this option then RIB Integration Details screen will be enabled and appropriate details have to be entered in RIB Integration Details screen.

Field Title	Configure RPM for SIM?
Field Description	Select this option if you will be using RPM with SIM. Please note if you select this option then RPM Integration Details screen will be enabled and appropriate details have to be entered in RPM Integration Details screen.

Field Title	Configure RMS for SIM?
Field Description	Select this option if you will be using RMS with SIM. Please note if you select this option then RMS Integration Details screen will be enabled and appropriate details have to be entered in RMS Integration Details screen.

Field Title

Configure Manifest for SIM?

Note: Refer to the Oracle Retail Store Inventory Management Operations Guide for more information.

Field Description

Manifest integration is configured if an external Shipment Management System is to be used in conjunction with SIM. (Optional). Please note if you select this option then the Manifest Integration Details screen will be enabled and appropriate details will be entered in the subsequent Manifest Integration Details screen.

Field Title

Configure OMS for SIM?

Note: Refer to the Oracle Retail Store Inventory Management Operations Guide for more information.

Field Description

OMS integration is configured if an external Shipment Management System is to be used in conjunction with SIM. (Optional). Please note if you select this option then OMS Integration Details screen will be enabled and appropriate details will be entered in the subsequent OMS Integration Details screen.

Screen: RIB Integration Details

This screen will be displayed if the Configure RIB for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Field Title	RIB SIM Provider URL
Field Description	This is the provider URL of the rib-sim application. If RIB SIM uses SSL, use t3s as the protocol, otherwise use t3.
Example	t3s://Dev01234.example.com:19106/rib-sim

Field Title	RIB User Name
Field Description	This is the user name for the JNDI connection to the RIB Admin Server.
Example	ribuser

Field Title	RIB user password
Field Description	Password for the RIBforSIM 14.1 user.

Screen: RPM Web service Policy

This screen will be displayed if the Configure RPM for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Field Title

Select the web service security policy for integration with RPM.

Field Description

Select the web service security policy for integration with RPM.

Please refer to the Oracle Retail Store Inventory Management Security Guide to learn more about Policy A and Policy B.

Screen: RPM Integration Details

This screen will be displayed if the Configure RPM for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Note: If the user chooses to integrate SIM with RPM then RPM installation is a pre-requisite to installing SIM.

Field Title

RPM Price Change WSDL URL

Field Description

This is the provider URL for RPM Price change WSDL.

Note: User just need to know the WSDL URL of RPM if it will have. SIM will install without RPM being there

Example

http://dev1234.us.oracle.com:18007/rpm-PriceChange-AppServiceDecorator/ProxyService/PriceChangeAppServiceProxy?wsdl

Field Title	RPM Price Inquiry WSDL URL
Field Description	This is the provider URL for RPM Price Inquiry WSDL.
Example	http://dev1234.us.oracle.com:18007/rpm-PriceInquiry-AppServiceDecorator/ProxyService/PriceInquiryAppServiceProxy?wsdl

Screen: RMS Web service Policy

This screen will be displayed if the Configure RMS for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Field Title

Select the web service security policy for Integration with RMS.

Field Description

Select the type of web service security policy for integration with RMS.

Please refer to the Oracle Retail Store Inventory Management Security Guide to learn more about Policy A and Policy B.

Example

None, PolicyA, PolicyB.

Screen: RMS Integration Details

This screen will be displayed if the Configure RMS for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Note: If the user chooses to integrate SIM with RMS then RMS installation is pre-requisite to install SIM.

Field Title	RMS Store Order WSDL URL
Field Description	This is the provider URL for RMS Store Order WSDL.
Example	http:/dev1234.us.oracle.com:18007/rms-StoreOrder-AppServiceDecorator/ProxyService/StoreOrderAppServiceProxy?wsdl

Screen: Manifest Web service Policy

This screen will be displayed if the Configure Manifest for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Field Title

Select the web service security policy for Manifest Integration

Field Description

Select the type of web service security policy for Manifest Integration.

Please refer to the Oracle Retail Store Inventory Management Security Guide to learn more about Policy A and Policy B.

Example

None, PolicyA, PolicyB

Screen: Manifest Integration Details

This screen will be displayed if the Configure Manifest for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Field Title

Manifest WSDL URL

Field Description

This is the provider URL for Manifest WSDL.

Note: Refer to the Oracle Retail Store Inventory Management Operations Guide for more information.

Example

http://orapphost:17015/ StoreShipmentManifestBean/StoreShipmentManifestService?WSDL

Screen: OMS Web service Policy

This screen will be displayed, if Configure OMS for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Note: This screen will appear when user chooses to integrate SIM with OMS

Field Title

Select the web service security policy for integration with OMS

Field Description

Selects the type of web service security policy for integration with OMS.

Please refer to the Oracle Retail Store Inventory Management Security Guide to learn more about Policy A and Policy B.

Destination

None, PolicyA, PolicyB

Screen: OMS Integration Details

This screen will be displayed if the Configure OMS for SIM option is checked on the Choose Apps to Integrate with SIM screen.

Field Title

OMS WSDL URL

Field Description

This is the provider URL for the OMS WSDL.

Note: Refer to the Oracle Retail Store Inventory Management Operations Guide for more information.

Example

http://orribhost:18007/oms-CustomerOrder-AppServiceDecorator/ProxyService/CustomerOrderAppServiceProxy?wsdl

Screen: JDBC Security Details

Field Title	Enable Secure JDBC connection
Field Description	Select Yes if you have a secured database already set up, otherwise select No.

Screen: Data Source Details

Field Title	SIM JDBC URL
Field Description	URL used by the SIM application to access the SIM database schema.
Destination	WebLogic admin server
Example	Standard Thin Connection: jdbc:oracle:thin:@myhost:1521:mysimsid If it is a pluggable db then use the URL as shown belowjdbc:oracle:thin:@myhost:1521/<service name> RAC connection: jdbc:oracle:thin:@(DESCRIPTION =(ADDRESS_LIST =(ADDRESS = (PROTOCOL = TCP)(HOST = myhost1)(PORT = 1521))(ADDRESS = (PROTOCOL = TCP)(HOST = myhost2)(PORT = 1521))(LOAD_BALANCE = yes))(CONNECT_DATA =(SERVICE_NAME = mysimsid)))

Field Title	SIM Database User Name
Field Description	The schema name.
Destination	WebLogic admin server
Notes	The schema name should match the name you provided when you ran the database schema installer.

Field Title	SIM Database User Password
Field Description	The password for the SIM Schema.
Destination	WebLogic admin server

Screen: Secure Data Source Details

This screen is displayed if Secure JDBC connection is enabled.

Field Title

Identity Keystore

Field Description

Path to the identity keystore, i.e.:

/u00/webadmin/product/identity.keystore

Field Title	Identity Keystore Type
Field Description	i.e. JKS

Field Title	Identity Keystore Password
Field Description	Password used to access the identity keystore defined above.

Field Title

Identity Trustore

Field Description

Path to the identity truststore, i.e.:

/u00/webadmin/product/identity.truststore

Field Title	Identity Truststore Type
Field Description	i.e. JKS

Field Title	Identity Truststore Password
Field Description	Password used to access the identity truststore defined above.

Screen: LDAP Server Details

Field Title

LDAP server URL

Field Description

URL for your LDAP directory server.

Example

Non-secured ldap:

ldap://myhost:3060/

Secured ldap:

ldaps://myhost:2484/

Field Title	LDAP Search Base DN
Field Description	The directory entry under which SIM will search for user and store entries.
Example	dc=us,dc=oracle,dc=com

Field Title	LDAP User DN
Field Description	Distinguished name of the user that RPM uses to authenticate to the LDAP directory.
Example	cn=sim.admin,cn=Users,dc=us,dc=oracle,dc=com

Field Title	LDAP User Password
Field Description	Password for the search user DN.

Alias - Name	ldap-user
Description	Please note that alias name is different from user name.

Screen: Mail Session Details

Field Title	SIM Mail SMTP Host
Field Description	The SMTP server that will be used to send notification emails from SIM.
Example	mail.oracle.com

Field Title

Enable SSL for Mail session connection

Field Description

Select Yes for secure connection.

Select No for plain connection.

Field Title	SIM Mail SMTP Port
Field Description	Port that the mail client is configured to use.

Field Title	SIM Mail User Name
Field Description	Username used to access the mail client.

Field Title	SIM Mail User Password
Field Description	Password for the above user.

Field Title	Enable authentication for mail session connection
Field Description	Yes or no depending on mail client configuration.

Field Title	Enable STARTTLS
Field Description	Yes or No depending on mail client configuration.

Screen: Wireless Server Details

Field Title	Wireless Server User Name
Field Description	User name for wireless server
Destination	Retail config wallet and installer creates WebLogic user with the given name above.

Field Title	Wireless Server User Password
Field Description	Password for wireless server user, the password must follow WebLogic password requirements (at least 8 characters in length and one non-alphabetic character).
Destination	Retail config wallet.

Field Title	SIM Wireless Server Port
Field Description	Choose an available port that the Wavelink server will use to listen for incoming messages from wireless devices.
Destination	wireless.cfg, wavelink-startup.sh
Example	40002

Alias - Name	wireless-user
Description	Please note that alias name is different from user name.

Screen: Batch Server Details

Field Title	Batch User Name
Field Description	User name for Batch.
Destination	Retail config wallet and installer creates WebLogic user with the given name above.

Field Title	Batch User Password
Field Description	Password for batch user, the password must follow weblogic password requirements (at least 8 characters in length and one non-alphabetic character).
Destination	Retail config wallet.

Alias - Name	batch-user
Description	Please note that alias name is different from user name.

Screen: Server User Details

Field Title	SIM Server User Name
Field Description	User name for SIM Server
Destination	Domain wallet and installer creates WebLogic user with the given name above.

Field Title	SIM Server User Password
Field Description	Password for SIM Server User, the password must follow WebLogic password requirements (at least 8 characters in length and one non-alphabetic character).
Destination	Weblogic Domain wallet/ weblogic default

Alias - Name	server-user
Description	Please note that alias name is different from user name.

Screen: Internal Security Installation User Details

Field Title	SIM Internal Security Installation User Name
Field Description	User name for SIM Internal Security Installation.
Destination	SIM database user for the SIM application and WebLogic user in database provider authentication. SIM stores are tied to this user. Example: orsimadmin

Field Title	SIM Internal Security Installation User Password
Field Description	Password for SIM Internal Security Installation User, the password must follow WebLogic password requirements (at least 8 characters in length and one non-alphabetic character).
Destination	SIM database user for the SIM application and WebLogic user in database provider authentication.

Screen: SIM Webservice Provider Policy

Field Title

Select the policy for securing SIM web service providers

Field Description

Select the type of web service policy for SIM.

Please refer to the Oracle Retail Store Inventory Management Security Guide to learn more about Policy A and Policy B.

Example

None, PolicyA, PolicyB

Screen: Printing Details

Field Title

Configure SIM reporting for BI publisher

Field Description

Select this option if you will be using BI Publisher for SIM reporting.

Please note if you select this option then the “Report BIP Details” screen will be enabled and appropriate details will have to be entered in the subsequent “Report BIP Details” Details screen.

Field Title	Configure SIM ticket Printing
Field Description	Choose the ticket printing option.

Field Title	Configure SIM ticket Printing “None”
Field Description	Select this option if you will not be using ticket printing feature.

Field Title

Configure SIM ticket Printing “BI Publisher”

Field Description

Select this option if you will be using an out of box BI Publisher ticketing implementation.

Please note if you select this option then the “Ticket Printing BIP Details” screen will be enabled and appropriate details will have to be entered in the subsequent “Ticket Printing BIP Details” Details screen.

Field Title

Configure SIM ticket Printing “External Web Service”

Field Description

Select this option if you will provide web service provider. See sim-141-impl4 “Item Ticket Printing” Section in SIM Implementation Guide for details.

Please note if you select this option then the “External Ticket Printing Service Details” screen will be enabled and appropriate details will have to be entered in the subsequent “External Ticket Printing Service Details” screen.

Screen: Reporting BIP Details 1

This screen will be displayed if you select the Configure SIM reporting for BI Publisher option on the Printing Details screen.

Field Title	BI Publisher Host
Field Description	Host name where BI Publisher is installed.
Destination	Updates the BI Publisher related default values in SIM database.
Example	redevlv0074.us.example.com

Field Title	BI Publisher Port
Field Description	Port where BI Publisher is configured.
Destination	Updates the BI Publisher related default values in SIM database.
Example	7003

Field Title	BI Publisher Context Root
Field Description	Context root where BI Publisher is installed.
Destination	Updates the BI Publisher related default values in SIM database.
Example	Xmlpserver

Field Title	Enable SSL for reporting
Field Description	The Protocol to be used for configuring reporting.
Example	https

Screen: Reporting BIP Details 2

This screen will be displayed if you select the Configure SIM reporting for BI Publisher option on the Printing Details screen.

Field Title	Reporting URL
Field Description	Confirmation field of address configured from values provided on previous screen.
Destination	Updates the reporting tool related default values in SIM database.
Example	http://dev01234.us.oracle.com:18005/xmlpserver/

Field Title

Report Template Base Path

Field Description

The root directory in which your SIM report templates are located.

Example

/Base/SIM

/u00/webadmin/product/10.3.X/WLS/user_projects/domains/bifoundation_domain/config/bipublisher/repository/Reports/Guest/SIM

Field Title	Reporting Username
Field Description	From the Oracle Retail Store Inventory Management Implementation Guide: <BIP_REPORTS_USER> or <SSO_USER>
Destination	This user MUST exist as a bipublisher user.
Example	retail.user

Field Title

Reporting user Password

Field Description

From the Oracle Retail Store Inventory Management Implementation Guide:

<BIP_REPORTS_USER_PASSWORD> or <SSO_PASSWORD>

Destination

Updates security wallet info

Screen: Ticket Printing BIP Details 1

This screen will be displayed if you select the Configure SIM ticket printing option on the Printing Details screen.

Field Title	BI Publisher Host
Field Description	Host name where BI Publisher is installed.
Destination	Updates the BI Publisher related default values in SIM database.
Example	redevlv0074.us.example.com

Field Title	BI Publisher Port
Field Description	Port where BI Publisher is configured.
Destination	Updates the BI Publisher related default values in SIM database.
Example	7003

Field Title	BI Publisher Context Root
Field Description	Context root where BI Publisher is installed.
Destination	Updates the BI Publisher related default values in SIM database.
Example	Xmlpserver

Field Title	Enable SSL for ticket printing
Field Description	The Protocol to be used for ticket printing.
Example	https

Screen: Ticket Printing BIP Details 2

This screen will be displayed if you select the Configure SIM ticket printing option on the Printing Details screen.

Field Title	Ticket Printing URL
Field Description	Confirmation field of address configured from values provided on previous screen.
Destination	Updates the ticket printing BIP related default values in SIM database.
Example	http://dev01234.us.oracle.com:18006/xmlpserver

Field Title

Ticket Template Base Path

Field Description

The root directory in which your SIM ticket templates are located.

Note: See Appendix: Setting up SIM Reports/Tickets in BI Publisher for instructions for migrating SIM reports/tickets to BI Publisher

Example

/Base/SIM

An example from this install guide is:

/u00/webadmin/product/10.3.X/WLS/user_projects/domains/bifoundation_domain/config/bipublisher/repository/Reports/Guest/SIM

Field Title	Ticket Printing Username
Field Description	From the Oracle Retail Store Inventory Management Implementation Guide: <BIP_TICKETPRINTING_USER> or <SSO_USER>
Destination	This user MUST exist as a bipublisher user.
Example	retail.user

Field Title

Ticket Printing user Password

Field Description

From the Oracle Retail Store Inventory Management Implementation Guide:

<BIP_TICKETPRINTING_USER_PASSWORD> or <SSO_PASSWORD>

Destination

Updates security wallet info

Screen: External Ticket Printing WebService Policy

This screen will be displayed if you select the External Webservice option on the Printing Details screen.

Field Title

Select the web service security policy for external ticket printing

Note: The user should refer the Oracle Retail Store Inventory Management Operations Guide to know what OMS to choose.

Field Description

Selects the type of web service security policy for external ticket printing.

Please refer to the Oracle Retail Store Inventory Management Security Guide to learn more about Policy A and Policy B.

Destination

None, PolicyA, PolicyB

Note: If web services are to be secured using either Policy A or Policy B, then user should have some basic knowledge about the same. A user can refer to security guide to know more about Policy A and Policy B

Screen: External Ticket Printing Service Details

This screen will be displayed if you select the External Webservice option on the Printing Details screen.

Field Title	External Ticket Printing WSDL URL
Field Description	This is the External Ticket Printing WSDL URL.
Example	http://hostname:18007/ticket-printing-AppServiceDecorator/ProxyService/ticketprintingAppServiceProxy?wsdl

Screen: Enable SSO in SIM

Field Title	Use Single Sign-On for user identification and authentication?
Field Description	This version of SIM has the option to use Single Sign-On (SSO) technology to authenticate users. If SSO is being used in your environment then click the check box. Leaving the box unchecked will configure SIM to use its own LDAP directory settings for authentication.

Screen: Single Sign-On Details

Field Title	SSO Webtier Server Host
Field Description	This is the host used to access the Single Sign-On web tier.
Example	WEBTIERSERVER.us.com

Field Title	SSO Server Port
Field Description	This is the HTTP port used to access the Single Sign-On web tier.
Example	18888

Screen: Manual Deployment Option

Field Title	Install files to app server ?
Field Description	The installer will configure the application and application server files. Then, it can proceed with installing the application into the server. If a user does not have filesystem access to application server, or wishes to deploy using a different method, he can choose to have the installer skip the final installation phase.
Example	Select Yes, I have write access to the application server.

Screen: Installation Summary

Field Title	Summary of Installation
Field Description	Lists the values entered in the previous install screens.
Example	Verify each value and if they are correct click next, else use back button to go back and change the value. Selecting Cancel will Cancel the installation.

Appendix: Setting up SIM Reports/Tickets in BI Publisher

SIM 14.1 reports and ticket printing supports BiPublisher 11g.

BiPublisher 11g – BI Server Component Installation Tasks

Oracle BI Publisher is used as the main RMS, RWMS, REIM, and SIM reporting engine and can be used in conjunction with external printing solutions like label printing. This section describes the installation of Oracle BI Publisher as a server application within WebLogic 10.3.6. One deployment of BI Publisher can be used for any of the RMS, RWMS, REIM, and SIM reports.

If you are installing BI Publisher as a part the Oracle OBIEE suite(which you will if installing BiPublisher 11g), refer to the appropriate Fusion Middleware guides for the installation of the product in a WebLogic server environment.

BiPublisher 11g only - Installation Process Overview

Installing the BI Publisher server as a standalone web application in a WebLogic server involves the following tasks:

1. Run RCU to create BiPublisher related database schemas and other db objects.

2. Install Oracle BI EE under an existing Weblogic Server (WLS) 10.3.6 and choose “software only install”.

3. Configure Oracle BI EE, create default bifoundation_domain and configure component “Business Intelligence Publisher” only.

4. Select the BIPlatform schema for update of the ORACLE 12.1.0.1 DB

5. Configure ports and document and test the URL’s that are created.

The following post-installation tasks are involved once BI Publisher has been installed:

6. Configure the BI Publisher repository. Set security model, add users, assign roles, add reports, add printers, set repository path, set data source, etc.

7. Set up the SIM reports in BIPublisher report repository.

8. Set up for the SIM application specific configuration files to integrate BI Publisher.

BiPublisher 11g only – Install Oracle BI EE 11g

1. Run the Repository Creation Utility to create the BiPublisher-related database schemas and other database objects. Create the BIPlatform schema into an existing ORACLE 12.1.0.1 DB

Note: Download Repository Creation Utility software from http://www.oracle.com/technetwork/middleware/bi-enterprise-edition/downloads/bi-downloads-1525270.html. Install it on your desktop

2. Export your DISPLAY.

Ex: Export DISPLAY=10.141.10.110:0.0

3. Go to $RCU_HOME/bin.

For example: /linux/x86_64/ofm_11g/RCU_11.1.1.7/rcuHome/bin>

Start RCU: ./rcu

4. Click Next.

5. Launch Oracle BI EE RCU Repository Creation Utility to create the Oracle BI EE schemas need for the Oracle BI EE BiPublisher installation. On this screen select “Create Repository”.

6. On the Database Connection Details screen, enter your Oracle Database information.

7. On the Select Components screen, select “Oracle Business Intelligence” check box.

The Summary of the Components created by the RCU tool is displayed.

8. Install a new instance of Weblogic Server 10.3.6 or use an existing one. Having one Weblogic Server for Oracle BI EE-BiPublisher 11g related items is recommended.

9. Install Oracle BI EE and select “Software Only Install”. You launch Oracle BI EE by going to OBIEE_INSTALL/obiee11.1.1.7/bishiphome/Disk1 and entering:

./runInstaller

10. Select the WebLogic home where you want to install Oracle BI EE.

11. Proceed to next and finish up the software install. Then go the <Weblogic home>/Oracle_BI1/bin and run config.sh to configure the bipublisher.

12. On the Create or Scale Out BI System screen, you are asked for the WebLogic password and provided with a recommended a Domain Name. Enter and confirm your WebLogic password and accept the recommended Domain Name; “bifoundation domain”

13. Configure Oracle BI EE, create default bifoundation_domain and configure component “Business Intelligence Publisher” only.

14. Enter the data base credentials of the BIPLATFORM schema.

15. Enter the Data base credentials for the MDS Schema.

16. Configure your BI ports. This screen allows you to assign Oracle BI EE ports from the staticports.ini file.

This file is located in the Oracle BI EE software at: /obiee11.1.1.7/bishiphome/Disk1/stage/Response/staticports.ini

17. Edit this file to make sure you will have the ports you want for your BiPublisher components. Otherwise the installer will assign default port numbers.

18. Document and test the URLs that are created.

This screen contains the URL’s for the components that got installed.

19. To test your BIPublisher installation, launch xmlpserver. Login with the credentials you entered in your Oracle BI EE configuration (weblogic / password).

20. Post install steps: Configure the BI Publisher repository.

21. On the System Maintenance Section, press Server Configuration.

22. Navigate to the Configuration Screen.

23. On this screen on the Configuration Folder section, enter the path to your repository. On the Catalog section enter Catalog Type: Oracle BI Publisher – File System from the drop down menu.

This is the path you entered in the Configuration Section and Catalog Section:

$OBIEE_HOME/WLS/user_projects/domains/bifoundation_domain/config/bipublisher/repository

24. Post install step: Set BiPublisher security model.

a. On the BiPublisher 11g Administration Screen, click Security Configuration from the Security Center.

b. Enable a superuser by checking the “Enable Local SuperUser” box and by entering name and password on the corresponding fields on this screen.

c. Mark “Allow Guest Access” check box. Enter “Guest” as Guest Folder Name.

d. Scroll down the screen and locate the Authorization section.

e. Select BI Publisher Security from the Security Model list.

f. The default user name for the BI Publisher Security Model is Administrator.

g. On the password text field, enter a value that you can remember. It is going to be the password for Login to xmlpserver.

h. Save the changes and re-start the BIPublisher server.

i. Launch xmlpserver. To Login you must use the new credentials that you set up in the former step: Username: Administrator Password: password.

Note: You will not be able to login to xmlpserver as weblogic any more because we have already changed the Security Model.

25. Post install step: Set the repository path.

Example: /u00/webadmin/product/10.3.X/WLS/user_projects/domains/bifoundation_domain/config/bipublisher/repository In the Oracle BI EE filesystem you will find the repository in the following location:

$OBIEE/wls/user_projects/domains/bifoundation_domain/config/bipublisher/repository

In the repository you will see the following directories:

§ Admin

§ DemoFiles

§ Reports

§ Tools

§ Users

26. Post install step: Create role Bipub_default_role.

a. From the xmlpserver Administration screen, scroll down to Security Center and click Roles and Permissions.

b. On the Roles and Permissions screen, click the Create Role button.

c. Create the Bipub_default_role. Enter in Create Role Section name of the role.

d. When the information has been entered press Apply changes.

27. Post install step: Assign BiPub system roles to the newly created Bipub_default_role.

a. To assign BiPub system roles to the newly create Bipub_default_role, go to Security Center section and navigate to the Roles and Permissions screen.

b. On the Roles and Permissions screen you should see the new role created: “Bipub_default_role” . Add multiple roles to the Bipub_Default_Role by pressing the corresponding green icon on the Add Roles column.

c. From the “Available Roles” panel, select the ones needed for your reports and move them to the “Included Roles” panel

d. Press the Apply button to save your changes.

28. Post install step: create Guest (XMLP_GUEST) user.

a. From the xmlpserver Administration screen scroll down to Security Center section and press Users to navigate to the next screen.

b. Select the “Create User” button to create the “xmlp_guest” user and save the changes

29. Post install step: Adding the Bipub_default_role to XMLP_GUEST user.

a. Open the Users section:

b. For xmlp_guest user, press on the “Assign Roles” icon to navigate to the next screen.

c. On the Assign Roles screen, select the BiPub_default_role from the Available Roles panel to the “Assigned Roles” panel and press the Apply button to save your changes.

BiPublisher 11g – Configuring the SIM JDBC connection

1. Click on the “Admin” tab, and then the “JDBC Connection” link under Data Sources. If there is no SIM data source then a new connection will need to be created, click the “Add Data Source” button and create the data source with your connection info, click the “test connection” before applying to ensure you have the information entered correctly:

Once the data source has been created, the SIM reports need to be moved into the location where BIP can find them.

Note: If using BIPublisher 11g, the Report Repository is available at Administration->System Maintenance->Server Configuration.

The Path given is in the base directory for all the BIP reports.

/u00/webadmin/product/10.3.X/WLS/user_projects/domains/bifoundation_domain/config/bipublisher/repository/

2. Manually copy SIM Reports to Reports repository

The SIM reports will be copied to the ‘Guest’ location. Create a directory named ‘SIM’ under ‘Guest’ and copy the reports into ‘SIM’ directory:

example,

/u00/webadmin/product/10.3.X/WLS/user_projects/domains/bifoundation_domain/config/bipublisher/repository/Reports/Guest/SIM

The reports are included in the SIM application distribution in a zip file. Copy that file from where you installed the SIM application into the new report directory and unzip it:

The following are the steps to extract the bip11g reports and copy them to the BIP11g repository:

cp <SIM14_MEDIA>/sim/application/sim14/reports/sim-reports.zip <TEMP_DIR> Where <TEMP_DIR> is a temporary directory where extract sim-reports.zip is extracted.

cd <TEMP_DIR>

unzip sim-reports.zip

cd <TEMP_DIR>/bip11g

cp * /u00/webadmin/product/10.3.X/WLS/user_projects/domains/bifoundation_domain/config/bipublisher/repository/Reports/Guest/SIM

Bounce the xmlpserver application. The new SIM reports should be available in the “Shared Folders > Guest > SIM” location of BI Publisher.

Configuring SIM for CUPS printers using BIPublisher 11g

Prerequisite: CUPS printer has to be set up on the BIPublisher server.

1. Login to BI Publisher using Administrator user and navigate to Administrator user.

Example: http://orapphost:29704/xmlpserver

2. Click on the CUPS servers.

3. Click Add Servers.

4. After adding, refresh the servers and printers.

Appendix: Single Sign-On for WebLogic

Single Sign-On (SSO) is a term for the ability to sign onto multiple Web applications via a single user ID/Password. There are many implementations of SSO. Oracle provides an implementation with Oracle Access Manager.

Most, if not all, SSO technologies use a session cookie to hold encrypted data passed to each application. The SSO infrastructure has the responsibility to validate these cookies and, possibly, update this information. The user is directed to log on only if the cookie is not present or has become invalid. These session cookies are restricted to a single browser session and are never written to a file.

Another facet of SSO is how these technologies redirect a user’s Web browser to various servlets. The SSO implementation determines when and where these redirects occur and what the final screen shown to the user is.

Most SSO implementations are performed in an application’s infrastructure and not in the application logic itself. Applications that leverage infrastructure managed authentication (such as deployment specifying Basic or Form authentication) typically have little or no code changes when adapted to work in an SSO environment.

What Do I Need for Single Sign-On?

A Single Sign-On system involves the integration of several components, including Oracle Identity Management and Oracle Access Management. This includes the following components:

§ An Oracle Internet Directory (OID) LDAP server, used to store user, role, security, and other information. OID uses an Oracle database as the back-end storage of this information.

§ An Oracle Access Manager (OAM) 11g Release 2 server and administrative console for implementing and configuring policies for single sign-on.

§ A Policy Enforcement Agent such as Oracle Access Manager 11g Agent (WebGate), used to authenticate the user and create the Single Sign-On cookies.

§ Oracle Directory Services Manager (ODSM) application in OIM11g, used to administer users and group information. This information may also be loaded or modified via standard LDAP Data Interchange Format (LDIF) scripts.

§ Additional administrative scripts for configuring the OAM system and registering HTTP servers.

Additional WebLogic managed servers will be needed to deploy the business applications leveraging the Single Sign-On technology.

Can Oracle Access Manager Work with Other SSO Implementations?

Yes, Oracle Access Manager has the ability to interoperate with many other SSO implementations, but some restrictions exist.

Oracle Single Sign-on Terms and Definitions

The following terms apply to single sign-on.

Authentication

Authentication is the process of establishing a user’s identity. There are many types of authentication. The most common authentication process involves a user ID and password.

Dynamically Protected URLs

A Dynamically Protected URL is a URL whose implementing application is aware of the Oracle Access Manager environment. The application may allow a user limited access when the user has not been authenticated. Applications that implement dynamic protection typically display a Login link to provide user authentication and gain greater access to the application’s resources.

Oracle Identity Management (OIM) and Oracle Access Manager (OAM) for 11g

Oracle Identity Management (OIM) 11g includes Oracle Internet Directory and ODSM. Oracle Access Manager (OAM) 11g R2 should be used for SSO using WebGate. Oracle Forms 11g contains Oracle HTTP server and other Retail Applications will use Oracle WebTier11g for HTTP Server.

MOD_WEBLOGIC

mod_WebLogic operates as a module within the HTTP server that allows requests to be proxied from the OracleHTTP server to the Oracle WebLogic server.

Oracle Access Manager 11g Agent (WebGate)

Oracle WebGates are policy enforcement agents which reside with relying parties and delegate authentication and authorization tasks to OAM servers.

Oracle Internet Directory

Oracle Internet Directory (OID) is an LDAP-compliant directory service. It contains user ids, passwords, group membership, privileges, and other attributes for users who are authenticated using Oracle Access Manager.

Partner Application

A partner application is an application that delegates authentication to the Oracle Identity Management Infrastructure. One such partner application is the Oracle HTTP Server (OHS) supplied with Oracle Forms Server or WebTier11g Server if using other Retail Applications other than Oracle Forms Applications.

All partner applications must be registered with Oracle Access Manager (OAM) 11g. An output product of this registration is a configuration file the partner application uses to verify a user has been previously authenticated.

Statically Protected URLs

A URL is considered to be Statically Protected when an Oracle HTTP server is configured to limit access to this URL to only SSO authenticated users. Any unauthenticated attempt to access a Statically Protected URL results in the display of a login page or an error page to the user.

Servlets, static HTML pages, and JSP pages may be statically protected.

What Single Sign-On is not

Single Sign-On is NOT a user ID/password mapping technology.

However, some applications can store and retrieve user IDs and passwords for non-SSO applications within an OID LDAP server. An example of this is the Oracle Forms Web Application framework, which maps Single Sign-On user IDs to a database logins on a per-application basis.

How Oracle Single Sign-On Works

Oracle Access Manager involves several different components. These are:

§ The Oracle Access Manager (OAM) server, which is responsible for the back-end authentication of the user.

§ The Oracle Internet Directory LDAP server, which stores user IDs, passwords, and group (role) membership.

§ The Oracle Access Manager Agent associated with the Web application, which verifies and controls browser redirection to the Oracle Access Manager server.

§ If the Web application implements dynamic protection, then the Web application itself is involved with the OAM system.

About SSO Login Processing with OAM Agents

1. The user requests a resource.

2. Webgate forwards the request to OAM for policy evaluation

3. OAM:

a. Checks for the existence of an SSO cookie.

b. Checks policies to determine if the resource is protected and if so, how?

4. OAM Server logs and returns the decision

5. Webgate responds as follows:

§ Unprotected Resource: Resource is served to the user

§ Protected Resource:
Resource is redirected to the credential collector.
The login form is served based on the authentication policy.
Authentication processing begins

6. User sends credentials

7. OAM verifies credentials

8. OAM starts the session and creates the following host-based cookies:

§ One per partner: OAMAuthnCookie set by 11g WebGates using authentication token received from the OAM Server after successful authentication.
Note: A valid cookie is required for a session.

§ One for OAM Server: OAM_ID

9. OAM logs Success of Failure.

10. Credential collector redirects to WebGate and authorization processing begins.

11. WebGate prompts OAM to look up policies, compare them to the user's identity, and determine the user's level of authorization.

12. OAM logs policy decision and checks the session cookie.

13. OAM Server evaluates authorization policies and cache the result.

14. OAM Server logs and returns decisions

15. WebGate responds as follows:

§ If the authorization policy allows access, the desired content or applications are served to the user.

§ If the authorization policy denies access, the user is redirected to another URL determined by the administrator.

SSO Login Processing with OAM Agents

Authentication and authorization processes

Installation Overview

Installing an Oracle Retail supported Single Sign-On installation using OAM11g requires installation of the following:

1. Oracle Internet Directory (OID) LDAP server and the Oracle Directory Services Manager. They are typically installed using the Installer of Oracle Identity Management . The ODSM application can be used for user and realm management within OID.

2. Oracle Access Manager 11gR2 has to be installed and configured.

3. Additional midtier instances (such as Oracle Forms 11gr2) for Oracle Retail applications based on Oracle Forms technologies (such as RMS). These instances must be registered with the OAM installed in step 2.

4. Additional application servers to deploy other Oracle Retail applications and performing application specific initialization and deployment activities must be registered with OAM installed in step 2.

Infrastructure Installation and Configuration

The Infrastructure installation for Oracle Access Manager (OAM) is dependent on the environment and requirements for its use. Deploying Oracle Access Manager (OAM) to be used in a test environment does not have the same availability requirements as for a production environment. Similarly, the Oracle Internet Directory (OID) LDAP server can be deployed in a variety of different configurations. See the Oracle Identity Management Installation Guide11g.

OID User Data

Oracle Internet Directory is an LDAP v3 compliant directory server. It provides standards-based user definitions out of the box.

Customers with existing corporate LDAP implementations may need to synchronize user information between their existing LDAP directory servers and OID. OID supports standard LDIF file formats and provides a JNDI compliant set of Java classes as well. Moreover, OID provides additional synchronization and replication facilities to integrate with other corporate LDAP implementations.

Each user ID stored in OID has a specific record containing user specific information. For role-based access, groups of users can be defined and managed within OID. Applications can thus grant access based on group (role) membership saving administration time and providing a more secure implementation.

User Management

User Management consists of displaying, creating, updating or removing user information. There are many methods of managing an LDAP directory including LDIF scripts or Oracle Directory Services Manager (ODSM) available for OID11g.

ODSM

Oracle Directory Services Manager (ODSM) is a Web-based application used in OID11g is designed for both administrators and users which enables you to configure the structure of the directory, define objects in the directory, add and configure users, groups, and other entries. ODSM is the interface you use to manage entries, schema, security, adapters, extensions, and other directory features.

LDIF Scripts

Script based user management can be used to synchronize data between multiple LDAP servers. The standard format for these scripts is the LDAP Data Interchange Format (LDIF). OID supports LDIF script for importing and exporting user information. LDIF scripts may also be used for bulk user load operations.

User Data Synchronization

The user store for Oracle Access Manager resides within the Oracle Internet Directory (OID) LDAP server. Oracle Retail applications may require additional information attached to a user name for application-specific purposes and may be stored in an application-specific database. Currently, there are no Oracle Retail tools for synchronizing changes in OID stored information with application-specific user stores. Implementers should plan appropriate time and resources for this process. Oracle Retail strongly suggests that you configure any Oracle Retail application using an LDAP for its user store to point to the same OID server used with Oracle Access Manager.

Appendix: Setting Up Password Stores with wallets/credential stores

As part of an application installation, administrators must set up password stores for user accounts using wallets/credential stores. Some password stores must be installed on the application database side. While the installer handles much of this process, the administrators must perform some additional steps.

Password stores for the application and application server user accounts must also be installed; however, the installer takes care of this entire process.

ORACLE Retail Merchandising applications now have 3 different types of password stores. They are database wallets, java wallets, and database credential stores. Background and how to administer them below are explained in this appendix

About Database Password Stores and Oracle Wallet

Oracle databases have allowed other users on the server to see passwords in case database connect strings (username/password@db) were passed to programs. In the past, users could navigate to ps –ef|grep <username> to see the password if the password was supplied in the command line when calling a program.

To make passwords more secure, Oracle Retail has implemented the Oracle Software Security Assurance (OSSA) program. Sensitive information such as user credentials now must be encrypted and stored in a secure location. This location is called password stores or wallets. These password stores are secure software containers that store the encrypted user credentials.

Users can retrieve the credentials using aliases that were set up when encrypting and storing the user credentials in the password store. For example, if username/password@db is entered in the command line argument and the alias is called db_username, the argument to a program is as follows:

sqlplus /@db_username

This would connect to the database as it did previously, but it would hide the password from any system user.

After this is configured, as in the example above, the application installation and the other relevant scripts are no longer needed to use embedded usernames and passwords. This reduces any security risks that may exist because usernames and passwords are no longer exposed.

When the installation starts, all the necessary user credentials are retrieved from the Oracle Wallet based on the alias name associated with the user credentials.

There are three different types of password stores. One type explain in the next section is for database connect strings used in program arguments (such as sqlplus /@db_username). The others are for Java application installation and application use.

Setting Up Password Stores for Database User Accounts

After the database is installed and the default database user accounts are set up, administrators must set up a password store using the Oracle wallet. This involves assigning an alias for the username and associated password for each database user account. The alias is used later during the application installation. This password store must be created on the system where the application server and database client are installed.

This section describes the steps you must take to set up a wallet and the aliases for the database user accounts. For more information on configuring authentication and password stores, see the Oracle Database Security Guide.

Note: In this section, <wallet_location> is a placeholder text for illustration purposes. Before running the command, ensure that you specify the path to the location where you want to create and store the wallet.

To set up a password store for the database user accounts, perform the following steps:

1. Create a wallet using the following command:

mkstore -wrl <wallet_location> -create

After you run the command, a prompt appears. Enter a password for the Oracle Wallet in the prompt.

Note: The mkstore utility is included in the Oracle Database Client installation.

The wallet is created with the auto-login feature enabled. This feature enables the database client to access the wallet contents without using the password. For more information, refer to the Oracle Database Advanced Security Administrator's Guide.

2. Create the database connection credentials in the wallet using the following command:

mkstore -wrl <wallet_location> -createCredential <alias-name> <database-user-name>

After you run the command, a prompt appears. Enter the password associated with the database user account in the prompt.

3. Repeat Step 2 for all the database user accounts.

4. Update the sqlnet.ora file to include the following statements:

WALLET_LOCATION = (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = <wallet_location>)))

SQLNET.WALLET_OVERRIDE = TRUE

SSL_CLIENT_AUTHENTICATION = FALSE

5. Update the tnsnames.ora file to include the following entry for each alias name to be set up.

<alias-name> =

(DESCRIPTION =

(ADDRESS_LIST =

(ADDRESS = (PROTOCOL = TCP) (HOST = <host>) (PORT = <port>))

)

(CONNECT_DATA =

(SERVICE_NAME = <service>)

)

In the previous example, <alias-name>, <host>, <port>, and <service> are placeholder text for illustration purposes. Ensure that you replace these with the relevant values.

Setting up Wallets for Database User Accounts

The following examples show how to set up wallets for database user accounts for the following applications:

· For RMS, RWMS, RPM Batch using sqlplus or sqlldr, RETL, RMS, RWMS, and ARI

For RMS, RWMS, RPM Batch using sqlplus or sqlldr, RETL, RMS, RWMS, and ARI

To set up wallets for database user accounts, do the following.

1. Create a new directory called wallet under your folder structure.

cd /projects/rms14/dev/

mkdir .wallet

Note: The default permissions of the wallet allow only the owner to use it, ensuring the connection information is protected. If you want other users to be able to use the connection, you must adjust permissions appropriately to ensure only authorized users have access to the wallet.

2. Create a sqlnet.ora in the wallet directory with the following content.

WALLET_LOCATION = (SOURCE = (METHOD = FILE) (METHOD_DATA = (DIRECTORY = /projects/rms14/dev/.wallet)) )

SQLNET.WALLET_OVERRIDE=TRUE
SSL_CLIENT_AUTHENTICATION=FALSE

Note: WALLET_LOCATION must be on line 1 in the file.

3. Setup a tnsnames.ora in the wallet directory. This tnsnames.ora includes the standard tnsnames.ora file. Then, add two custom tns_alias entries that are only for use with the wallet. For example, sqlplus /@dvols29_rms01user.

ifile = /u00/oracle/product/11.2.0.1/network/admin/tnsnames.ora

Examples for a NON pluggable db:

dvols29_rms01user =

(DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = tcp)

(host = xxxxxx.us.oracle.com) (Port = 1521)))

(CONNECT_DATA = (SID = <sid_name> (GLOBAL_NAME = <sid_name>)))

dvols29_rms01user.world =

(DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = tcp)

(host = xxxxxx.us.oracle.com) (Port = 1521)))

(CONNECT_DATA = (SID = <sid_name>) (GLOBAL_NAME = <sid_name>)))

Examples for a pluggable db:

dvols29_rms01user =

(DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = tcp)

(host = xxxxxx.us.oracle.com) (Port = 1521)))

(CONNECT_DATA = (SERVICE_NAME = <pluggable db name>)))

dvols29_rms01user.world =

(DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = tcp)

(host = xxxxxx.us.oracle.com) (Port = 1521)))

(CONNECT_DATA = (SERVICE_NAME = <pluggable db name>)))

Note: It is important to not just copy the tnsnames.ora file because it can quickly become out of date. The ifile clause (shown above) is key.

4. Create the wallet files. These are empty initially.

a. Ensure you are in the intended location.

$ pwd
/projects/rms14/dev/.wallet

b. Create the wallet files.

$ mkstore -wrl . –create

c. Enter the wallet password you want to use. It is recommended that you use the same password as the UNIX user you are creating the wallet on.

d. Enter the password again.

Two wallet files are created from the above command:

– ewallet.p12

– cwallet.sso

5. Create the wallet entry that associates the user name and password to the custom tns alias that was setup in the wallet’s tnsnames.ora file.

mkstore –wrl . –createCredential <tns_alias> <username> <password>

Example: mkstore –wrl . –createCredential dvols29_rms01user rms01user passwd

6. Test the connectivity. The ORACLE_HOME used with the wallet must be the same version or higher than what the wallet was created with.

$ export TNS_ADMIN=/projects/rms14/dev/.wallet /* This is very import to use wallet to point at the alternate tnsnames.ora created in this example */

$ sqlplus /@dvols29_rms01user

SQL*Plus: Release 12

Connected to:

Oracle Database 12g

SQL> show user

USER is “rms01user”

Running batch programs or shell scripts would be similar:

Ex: dtesys /@dvols29_rms01user

script.sh /@dvols29_rms01user

Set the UP unix variable to help with some compiles :

export UP=/@dvols29_rms01user

for use in RMS batch compiles, and RMS, RWMS, and ARI forms compiles.

As shown in the example above, users can ensure that passwords remain invisible.

Additional Database Wallet Commands

The following is a list of additional database wallet commands.

· Delete a credential on wallet

mkstore –wrl . –deleteCredential dvols29_rms01user

· Change the password for a credential on wallet

mkstore –wrl . –modifyCredential dvols29_rms01user rms01user passwd

· List the wallet credential entries

mkstore –wrl . –list

This command returns values such as the following.

oracle.security.client.connect_string1

oracle.security.client.user1

oracle.security.client.password1

· View the details of a wallet entry

mkstore –wrl . –viewEntry oracle.security.client.connect_string1

Returns the value of the entry:

dvols29_rms01user

mkstore –wrl . –viewEntry oracle.security.client.user1

Returns the value of the entry:

rms01user

mkstore –wrl . –viewEntry oracle.security.client.password1

Returns the value of the entry:

Passwd

Setting up RETL Wallets

RETL creates a wallet under $RFX_HOME/etc/security, with the following files:

· cwallet.sso

· jazn-data.xml

· jps-config.xml

· README.txt

To set up RETL wallets, perform the following steps:

1. Set the following environment variables:

§ ORACLE_SID=<retaildb>

§ RFX_HOME=/u00/rfx/rfx-13

§ RFX_TMP=/u00/rfx/rfx-13/tmp

§ JAVA_HOME=/usr/jdk1.6.0_12.64bit

§ LD_LIBRARY_PATH=$ORACLE_HOME

§ PATH=$RFX_HOME/bin:$JAVA_HOME/bin:$PATH

2. Change directory to $RFX_HOME/bin.

3. Run setup-security-credential.sh.

§ Enter 1 to add a new database credential.

§ Enter the dbuseralias. For example, retl_java_rms01user.

§ Enter the database user name. For example, rms01user.

§ Enter the database password.

§ Re-enter the database password.

§ Enter D to exit the setup script.

4. Update your RETL environment variable script to reflect the names of both the Oracle Networking wallet and the Java wallet.

For example, to configure RETLforRPAS, modify the following entries in
$RETAIL_HOME/RETLforRPAS/rfx/etc/rmse_rpas_config.env.

§ The RETL_WALLET_ALIAS should point to the Java wallet entry:

– export RETL_WALLET_ALIAS="retl_java_rms01user"

§ The ORACLE_WALLET_ALIAS should point to the Oracle network wallet entry:

– export ORACLE_WALLET_ALIAS="dvols29_rms01user"

§ The SQLPLUS_LOGON should use the ORACLE_WALLET_ALIAS:

– export SQLPLUS_LOGON="/@${ORACLE_WALLET_ALIAS}"

5. To change a password later, run setup-security-credential.sh.

§ Enter 2 to update a database credential.

§ Select the credential to update.

§ Enter the database user to update or change.

§ Enter the password of the database user.

§ Re-enter the password.

For Java Applications (SIM, ReIM, RPM, RIB, AIP, Alloc, ReSA, RETL)

For Java applications, consider the following:

· For database user accounts, ensure that you set up the same alias names between the password stores (database wallet and Java wallet). You can provide the alias name during the installer process.

· Document all aliases that you have set up. During the application installation, you must enter the alias names for the application installer to connect to the database and application server.

· Passwords are not used to update entries in Java wallets. Entries in Java wallets are stored in partitions, or application-level keys. In each retail application that has been installed, the wallet is located in <WEBLOGIC_DOMAIN_HOME>/retail/<appname>/config Example:
/u00/webadmin/product/10.3.6/WLS/user_projects/domains/14_mck_soa_domain/retail/reim14/config

· Application installers should create the Java wallets for you, but it is good to know how this works for future use and understanding.

· Scripts are located in <WEBLOGIC_DOMAIN_HOME>/retail/<appname>/retail-public-security-api/bin for administering wallet entries.

· Example:

· /u00/webadmin/product/10.3.6/WLS/user_projects/domains/REIMDomain/retail/reim14/retail-public-security-api/bin

· In this directory is a script to help you update each alias entry without having to remember the wallet details. For example, if you set the RPM database alias to rms01user, you will find a script called update-RMS01USER.sh.

Note: These scripts are available only with applications installed by way of an installer.

· Two main scripts are related to this script in the folder for more generic wallet operations: dump_credentials.sh and save_credential.sh.

· If you have not installed the application yet, you can unzip the application zip file and view these scripts in <app>/application/retail-public-security-api/bin.

· Example:

· /u00/webadmin/reim14/application/retail-public-security-api/bin

update-<ALIAS>.sh

update-<ALIAS>.sh updates the wallet entry for this alias. You can use this script to change the user name and password for this alias. Because the application refers only to the alias, no changes are needed in application properties files.

Usage:

update-<username>.sh <myuser>

Example:

/u00/webadmin/product/10.3.x/WLS/user_projects/domains/RPMDomain/retail/rpm14/retail-public-security-api/bin> ./update-RMS01USER.sh

usage: update-RMS01USER.sh <username>

<username>: the username to update into this alias.

Example: update-RMS01USER.sh myuser

Note: this script will ask you for the password for the username that you pass in.

/u00/webadmin/product/10.3.x/WLS/user_projects/domains/RPMDomain/retail/rpm14/retail-public-security-api/bin>

dump_credentials.sh

dump_credentials.sh is used to retrieve information from wallet. For each entry found in the wallet, the wallet partition, the alias, and the user name are displayed. Note that the password is not displayed. If the value of an entry is uncertain, run save_credential.sh to resave the entry with a known password.

dump_credentials.sh <wallet location>

Example:

dump_credentials.sh location:/u00/webadmin/product/10.3.x/WLS/user_projects/domains/REIMDomain/retail/reim14/config

Retail Public Security API Utility

=============================================

Below are the credentials found in the wallet at the location:/u00/webadmin/product/10.3.x/WLS/user_projects/domains/REIMDomain/retail/reim14/config

=============================================

Application level key partition name:reim14
User Name Alias:WLS-ALIAS User Name:weblogic
User Name Alias:RETAIL-ALIAS User Name:retail.user
User Name Alias:LDAP-ALIAS User Name:RETAIL.USER
User Name Alias:RMS-ALIAS User Name:rms14mock
User Name Alias:REIMBAT-ALIAS User Name:reimbat

save_credential.sh

save_credential.sh is used to update the information in wallet. If you are unsure about the information that is currently in the wallet, use dump_credentials.sh as indicated above.

save_credential.sh -a <alias> -u <user> -p <partition name> –l <path of the wallet file location where credentials are stored>

Example:

/u00/webadmin/mock14_testing/rtil/rtil/application/retail-public-security-api/bin> save_credential.sh -l wallet_test -a myalias -p mypartition -u myuser

=============================================

Retail Public Security API Utility

=============================================

Enter password:

Verify password:

Note: -p in the above command is for partition name. You must specify the proper partition name used in application code for each Java application.

save_credential.sh and dump_credentials.sh scripts are the same for all applications. If using save_credential.sh to add a wallet entry or to update a wallet entry, bounce the application/managed server so that your changes are visible to the application. Also, save a backup copy of your cwallet.sso file in a location outside of the deployment path, because redeployment or reinstallation of the application will wipe the wallet entries you made after installation of the application. To restore your wallet entries after a redeployment/reinstallation, copy the backed up cwallet.sso file over the cwallet.sso file. Then bounce the application/managed server.

Usage

=============================================

Retail Public Security API Utility

=============================================

usage: save_credential.sh -au[plh]

E.g. save_credential.sh -a rms-alias -u rms_user -p rib-rms -l ./

-a,--userNameAlias <arg> alias for which the credentials

needs to be stored

-h,--help usage information

-l,--locationofWalletDir <arg> location where the wallet file is

created.If not specified, it creates the wallet under secure-credential-wallet directory which is already present under the retail-public-security-api/ directory.

-p,--appLevelKeyPartitionName <arg> application level key partition name

-u,--userName <arg> username to be stored in secure

credential wallet for specified alias*

How does the Wallet Relate to the Application?

The ORACLE Retail Java applications have the wallet alias information you create in an <app-name>.properties file. Below is the reim.properties file. Note the database information and the user are presented as well. The property called datasource.credential.alias=RMS-ALIAS uses the ORACLE wallet with the argument of RMS-ALIAS at the csm.wallet.path and csm.wallet.partition.name = reim14 to retrieve the password for application use.

Reim.properties code sample:

datasource.url=jdbc:oracle:thin:@xxxxxxx.us.oracle.com:1521:pkols07

datasource.schema.owner=rms14mock

datasource.credential.alias=RMS-ALIAS

# =================================================================

# ossa related Configuration

# These settings are for ossa configuration to store credentials.

# =================================================================

csm.wallet.path=/u00/webadmin/product/10.3.x/WLS/user_projects/domains/REIMDomain/retail/reim14/config

csm.wallet.partition.name=reim14

How does the Wallet Relate to Java Batch Program use?

Some of the ORACLE Retail Java batch applications have an alias to use when running Java batch programs. For example, alias REIMBAT-ALIAS maps through the wallet to dbuser RMS01APP, already on the database. To run a ReIM batch program the format would be: reimbatchpgmname REIMBAT-ALIAS <other arguments as needed by the program in question>

Database Credential Store Administration

The following section describes a domain level database credential store. This is used in RPM login processing, SIM login processing, RWMS login processing, RESA login processing and Allocation login processing and policy information for application permission. Setting up the database credential store is addressed in the RPM, SIM, RESA, RWMS, and Alloc 14.1 install guides.

The following sections show an example of how to administer the password stores thru ORACLE Enterprise Manger Fusion Middleware Control, a later section will show how to do this thru WLST scripts.

1. The first step is to use your link to Oracle Enterprise Manager Fusion Middleware Control for the domain in question. Locate your domain on the left side of the screen and do a right mouse click on the domain and select Security > Credentials

2. Click on Credentials and you will get a screen similar to the following. The following screen is expanded to make it make more sense. From here you can administer credentials.

The Create Map add above is to create a new map with keys under it. A map would usually be an application such as rpm14. The keys will usually represent alias to various users (database user, WebLogic user, LDAP user, etc). The application installer should add the maps so you should not often have to add a map.

Creation of the main keys for an application will also be built by the application installer. You will not be adding keys often as the installer puts the keys out and the keys talk to the application. You may be using EDIT on a key to see what user the key/alias points to and possibly change/reset its password. To edit a key/alias, highlight the key/alias in question and push the edit icon nearer the top of the page. You will then get a screen as follows:

The screen above shows the map (rpm14) that came from the application installer, the key (DB-ALIAS) that came from the application installer (some of the keys/alias are selected by the person who did the application install, some are hard coded by the application installer in question), the type (in this case password), and the user name and password. This is where you would check to see that the user name is correct and reset the password if needed. REMEMBER, a change to an item like a database password WILL make you come into this and also change the password. Otherwise your application will NOT work correctly.

Managing Credentials with WSLT/OPSS Scripts

This procedure is optional as you can administer the credential store through the Oracle enterprise manager associated with the domain of your application install for RPM, SIM, RESA, or Allocation.

An Oracle Platform Security Scripts (OPSS) script is a WLST script, in the context of the Oracle WebLogic Server. An online script is a script that requires a connection to a running server. Unless otherwise stated, scripts listed in this section are online scripts and operate on a database credential store. There are a few scripts that are offline, that is, they do not require a server to be running to operate.

Read-only scripts can be performed only by users in the following WebLogic groups: Monitor, Operator, Configurator, or Admin. Read-write scripts can be performed only by users in the following WebLogic groups: Admin or Configurator. All WLST scripts are available out-of-the-box with the installation of the Oracle WebLogic Server.

WLST scripts can be run in interactive mode or in script mode. In interactive mode, you enter the script at a command-line prompt and view the response immediately after. In script mode, you write scripts in a text file (with a py file name extension) and run it without requiring input, much like the directives in a shell script.

For platform-specific requirements to run an OPSS script, see http://docs.oracle.com/cd/E21764_01/core.1111/e10043/managepols.htm#CIHIBBDJ

The weakness with the WLST/OPSS scripts is that you have to already know your map name and key name. In many cases, you do not know or remember that. The database credential store way through enterprise manager is a better way to find your map and key names easily when you do not already know them. A way in a command line mode to find the map name and alias is to run orapki. An example of orapki is as follows:

/u00/webadmin/product/wls_apps/oracle_common/bin> ./orapki wallet display –wallet /u00/webadmin/product/wls_apps/user_projects/domains/APPDomain/config/fmwconfig

(where the path above is the domain location of the wallet)

Output of orapki is below. This shows map name of rpm14 and each alias in the wallet:

Oracle PKI Tool : Version 11.1.1.7.0

Requested Certificates:

User Certificates:

Oracle Secret Store entries:

rpm14@#3#@DB-ALIAS

rpm14@#3#@LDAP-ALIAS

rpm14@#3#@RETAIL.USER

rpm14@#3#@user.signature.salt

rpm14@#3#@user.signature.secretkey

rpm14@#3#@WEBLOGIC-ALIAS

rpm14@#3#@WLS-ALIAS

Trusted Certificates:

Subject: OU=Class 1 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

OPSS provides the following scripts on all supported platforms to administer credentials (all scripts are online, unless otherwise stated. You need the map name and the key name to run the scripts below

· listCred

· updateCred

· createCred

· deleteCred

· modifyBootStrapCredential

· addBootStrapCredential

listCred

The script listCred returns the list of attribute values of a credential in the credential store with given map name and key name. This script lists the data encapsulated in credentials of type password only.

Script Mode Syntax

listCred.py -map mapName -key keyName

Interactive Mode Syntax

listCred(map="mapName", key="keyName")

The meanings of the arguments (all required) are as follows:

· map specifies a map name (folder).

· key specifies a key name.

Examples of Use:

The following invocation returns all the information (such as user name, password, and description) in the credential with map name myMap and key name myKey:

listCred.py -map myMap -key myKey

The following example shows how to run this command and similar credential commands with WLST:

/u00/webadmin/product/wls_apps/oracle_common/common/bin>

sh wlst.sh

Initializing WebLogic Scripting Tool (WLST)...

Welcome to WebLogic Server Administration Scripting Shell

wls:/offline> connect('weblogic','password123','xxxxxx.us.oracle.com:17001')

Connecting to t3://xxxxxx.us.oracle.com:17001 with userid weblogic ...

Successfully connected to Admin Server 'AdminServer' that belongs to domain 'APPDomain'.

wls:/APPDomain/serverConfig> listCred(map="rpm14",key="DB-ALIAS")

Already in Domain Runtime Tree

[Name : rms01app, Description : null, expiry Date : null]

PASSWORD:retail

*The above means for map rpm14 in APPDomain, alias DB-ALIAS points to database user rms01app with a password of retail

updateCred

The script updateCred modifies the type, user name, and password of a credential in the credential store with given map name and key name. This script updates the data encapsulated in credentials of type password only. Only the interactive mode is supported.

Interactive Mode Syntax

updateCred(map="mapName", key="keyName", user="userName", password="passW", [desc="description"])

The meanings of the arguments (optional arguments are enclosed by square brackets) are as follows:

· map specifies a map name (folder) in the credential store.

· key specifies a key name.

· user specifies the credential user name.

· password specifies the credential password.

· desc specifies a string describing the credential.

Example of Use:

The following invocation updates the user name, password, and description of the password credential with map name myMap and key name myKey:

updateCred(map="myMap", key="myKey", user="myUsr", password="myPassw")

createCred

The script createCred creates a credential in the credential store with a given map name, key name, user name and password. This script can create a credential of type password only. Only the interactive mode is supported.

Interactive Mode Syntax

createCred(map="mapName", key="keyName", user="userName", password="passW", [desc="description"])

The meanings of the arguments (optional arguments are enclosed by square brackets) are as follows:

· map specifies the map name (folder) of the credential.

· key specifies the key name of the credential.

· user specifies the credential user name.

· password specifies the credential password.

· desc specifies a string describing the credential.

Example of Use:

The following invocation creates a password credential with the specified data:

createCred(map="myMap", key="myKey", user="myUsr", password="myPassw")

deleteCred

The script deleteCred removes a credential with given map name and key name from the credential store.

Script Mode Syntax

deleteCred.py -map mapName -key keyName

Interactive Mode Syntax

deleteCred(map="mapName",key="keyName")

The meanings of the arguments (all required) are as follows:

· map specifies a map name (folder).

· key specifies a key name.

Example of Use:

The following invocation removes the credential with map name myMap and key name myKey:

deleteCred.py -map myMap -key myKey

modifyBootStrapCredential

The offline script modifyBootStrapCredential modifies the bootstrap credentials configured in the default jps context, and it is typically used in the following scenario: suppose that the policy and credential stores are LDAP-based, and the credentials to access the LDAP store (stored in the LDAP server) are changed. Then this script can be used to seed those changes into the bootstrap credential store.

This script is available in interactive mode only.

Interactive Mode Syntax

modifyBootStrapCredential(jpsConfigFile="pathName", username="usrName", password="usrPass")

The meanings of the arguments (all required) are as follows:

· jpsConfigFile specifies the location of the file jps-config.xml relative to the location where the script is run. Example location: /u00/webadmin/product/wls_apps/user_projects/domains/APPDomain/config/fmwconfig. Example location of the bootstrap wallet is /u00/webadmin/product/wls_apps/user_projects/domains/APPDomain/config/fmwconfig/bootstrap

· username specifies the distinguished name of the user in the LDAP store.

· password specifies the password of the user.

Example of Use:

Suppose that in the LDAP store, the password of the user with distinguished name cn=orcladmin has been changed to welcome1, and that the configuration file jps-config.xml is located in the current directory.Then the following invocation changes the password in the bootstrap credential store to welcome1:

modifyBootStrapCredential(jpsConfigFile='./jps-config.xml', username='cn=orcladmin', password='welcome1')

Any output regarding the audit service can be disregarded.

addBootStrapCredential

The offline script addBootStrapCredential adds a password credential with given map, key, user name, and user password to the bootstrap credentials configured in the default jps context of a jps configuration file.

Classloaders contain a hierarchy with parent classloaders and child classloaders. The relationship between parent and child classloaders is analogous to the object relationship of super classes and subclasses. The bootstrap classloader is the root of the Java classloader hierarchy. The Java virtual machine (JVM) creates the bootstrap classloader, which loads the Java development kit (JDK) internal classes and java.* packages included in the JVM. (For example, the bootstrap classloader loads java.lang.String.)

This script is available in interactive mode only.

Interactive Mode Syntax

addBootStrapCredential(jpsConfigFile="pathName", map="mapName", key="keyName", username="usrName", password="usrPass")

The meanings of the arguments (all required) are as follows:

· map specifies the map of the credential to add.

· key specifies the key of the credential to add.

· username specifies the name of the user in the credential to add.

· password specifies the password of the user in the credential to add.

Example of Use:

The following invocation adds a credential to the bootstrap credential store:

addBootStrapCredential(jpsConfigFile='./jps-config.xml', map='myMapName', key='myKeyName', username='myUser', password =’myPass’)

Quick Guide for Retail Password Stores (db wallet, java wallet, DB credential stores)

Retail app	Wallet type	Wallet loc	Wallet partition	Alias name	User name	Use	Create by	Alias Example	Notes
RMS batch	DB	<RMS batch install dir (RETAIL_HOME)>/.wallet	n/a	<Database SID>_<Database schema owner>	<rms schema owner>	Compile, execution	Installer	n/a	Alias hard-coded by installer
RMS forms	DB	<forms install dir>/base/.wallet	n/a	<Database SID>_<Database schema owner>	<rms schema owner>	Compile	Installer	n/a	Alias hard-coded by installer
ARI forms	DB	<forms install dir>/base/.wallet	n/a	<Db_Ari01>	<ari schema owner>	Compile	Manual	ari-alias
RMWS forms	DB	<forms install dir>/base/.wallet	n/a	<Database SID>_<Database schema owner>	<rwms schema owner>	Compile forms, execute batch	Installer	n/a	Alias hard-coded by installer
RPM batch plsql and sqlldr	DB	<RPM batch install dir>/.wallet	n/a	<rms schema owner alias>	<rms schema owner>	Execute batch	Manual	rms-alias	RPM plsql and sqlldr batches
RWMS auto-login	JAVA	<forms install dir>/base/.javawallet
			<RWMS Installation name>	<RWMS database user alias>	<RWMS schema owner>	RWMS forms app to avoid dblogin screen	Installer	rwms14inst
			<RWMS Installation name>	BI_ALIAS	<BI Publisher administrative user>	RWMS forms app to connect to BI Publisher	Installer	n/a	Alias hard-coded by installer
AIP app	JAVA	<weblogic domain home>/retail/<deployed aip app name>/config							Each alias must be unique
			aip14	<AIP weblogic user alias>	<AIP weblogic user name>	App use	Installer	aip-weblogic-alias
			aip14	<AIP database schema user alias>	<AIP database schema user name>	App use	Installer	aip01user-alias
			aip14	<rib-aip weblogic user alias>	<rib-aip weblogic user name>	App use	Installer	rib-aip-weblogic-alias
RPM app	DB credential store		Map=rpm14 or what you called the app at install time.	Many for app use					<weblogic domain home>/config/fmwconfig/jps-config.xml has info on the credential store. This directory also has the domain cwallet.sso file.
RPM app	JAVA	<weblogic domain home>/retail/<deployed rpm app name>/config							Each alias must be unique
			rpm14	<rpm weblogic user alias>	<rpm weblogic user name>	App use	Installer	rpm-weblogic-alias
			rpm14	<rpm batch user name> is the alias. Yes, here alias name = user name	<rpm batch user name>	App, batch use	Installer	RETAIL.USER
	JAVA	<retail_home>/orpatch/config/javaapp_rpm							Each alias must be unique
			retail_installer	<rpm weblogic user alias>	<rpm weblogic user name>	App use	Installer	weblogic-alias
			retail_installer	<rms shema user alias>	<rms shema user name>	App, batch use	Installer	rms01user-alias
			retail_installer	<reim batch user alias>	<reim batch user name>	App, batch use	Installer	reimbat-alias
			retail_installer	<LDAP-ALIAS>	cn=rpm.admin,cn=Users,dc=us,dc=oracle,dc=com	LDAP user use	Installer	LDAP_ALIAS
ReIM app	JAVA	<weblogic domain home>/retail/<deployed reim app name>/config							Each alias must be unique
			<installed app name, ex: reim14>	<reim weblogic user alias>	<reim weblogic user name>	App use	Installer	weblogic-alias
			<installed app name, ex: reim14>	<rms shema user alias>	<rms shema user name>	App, batch use	Installer	rms01user-alias
			<installed app name, ex: reim14>	<reim webservice validation user alias>	<reim webservice validation user name>	App use	Installer	reimwebservice-alias
			<installed app name, ex: reim14>	<reim batch user alias>	<reim batch user name>	App, batch use	Installer	reimbat-alias
			<installed app name, ex: reim14>	<LDAP-ALIAS>	cn=REIM.ADMIN,cn=Users,dc=us,dc=oracle,dc=com	LDAP user use	Installer	LDAP_ALIAS
	JAVA	<retail_home>/orpatch/config/javaapp_reim							Each alias must be unique
			retail_installer	<reim weblogic user alias>	<reim weblogic user name>	App use	Installer	weblogic-alias
			retail_installer	<rms shema user alias>	<rms shema user name>	App, batch use	Installer	rms01user-alias
			retail_installer	<reim webservice validation user alias>	<reim webservice validation user name>	App use	Installer	reimwebservice-alias
			retail_installer	<reim batch user alias>	<reim batch user name>	App, batch use	Installer	reimbat-alias
			retail_installer	<LDAP-ALIAS>	cn=REIM.ADMIN,cn=Users,dc=us,dc=oracle,dc=com	LDAP user use	Installer	LDAP_ALIAS
RESA app	DB credential store		Map=resa14 or what you called the app at install time	Many for login and policies					<weblogic domain home>/config/fmwconfig/jps-config.xml has info on the credential store. This directory also has the domain cwallet.sso file. The bootstrap directory under this directory has bootstrap cwallet.sso file.
RESA app	JAVA	<weblogic domain home>/retail/<deployed resa app name>/config							Each alias must be unique
			<installed app name>	<resa weblogic user alias>	<resa weblogic user name>	App use	Installer	wlsalias
			<installed app name>	<resa schema db user alias>	<rmsdb shema user name>	App use	Installer	Resadb-alias
			<installed app name>	<resa schema user alias>	<rmsdb shema user name>>	App use	Installer	resa-alias
	JAVA	<retail_home>/orpatch/config/javaapp_resa							Each alias must be unique
			retail_installer	<resa weblogic user alias>	<resa weblogic user name>	App use	Installer	wlsalias
			retail_installer	<resa schema db user alias>	<rmsdb shema user name>	App use	Installer	Resadb-alias
	JAVA	<retail_ home>/orpatch/config/javaapp_rasrm							Each alias must be unique
			retail_installer	<alloc weblogic user alias>	<alloc weblogic user name>	App use	Installer	weblogic-alias
Alloc app	DB credential store		Map=alloc 14 or what you called the app at install time	Many for login and policies					<weblogic domain home>/config/fmwconfig/jps-config.xml has info on the credential store. This directory also has the domain cwallet.sso file. The bootstrap directory under this directory has bootstrap cwallet.sso file.
Alloc app	JAVA	<weblogic domain home>/retail/config							Each alias must be unique
			<installed app name>	<alloc weblogic user alias>	<alloc weblogic user name>	App use	Installer	weblogic-alias
			<installed app name>	<rms schema user alias>	<rms schema user name>	App use	Installer	dsallocAlias
			<installed app name>	<alloc batch user alias>	<SYSTEM_ADMINISTRATOR>	Batch use	Installer	alloc14
	JAVA	<retail_ home>/orpatch/config/javaapp_alloc							Each alias must be unique
			retail_installer	<alloc weblogic user alias>	<alloc weblogic user name>	App use	Installer	weblogic-alias
			retail_installer	<rms schema user alias>	<rms schema user name>	App use	Installer	dsallocAlias
			retail_installer	<alloc batch user alias>	<SYSTEM_ADMINISTRATOR>	Batch use	Installer	alloc14
	JAVA	<retail_ home>/orpatch/config/javaapp_rasrm							Each alias must be unique

retail_installer

App use

Installer

weblogic-alias

SIM app

DB credential store

Map=oracle.retail.sim

Aliases required for SIM app use

<weblogic domain home>/config/fmwconfig/jps-config.xml has info on the credential store. This directory also has the domain cwallet.sso file.

JAVA

<weblogic domain home>/retail/<deployed sim app

name>/batch/resources/conf

oracle.retail.sim

App use

Installer

BATCH-ALIAS

JAVA

<weblogic domain home>/retail/<deployed sim app

name>/wireless/resources/conf

oracle.retail.sim

App use

Installer

WIRELESS-ALIAS

RETL

JAVA

<RETL home>/etc/security

n/a

App use

Manual

retl_java_rms01user

User may vary depending on RETL flow’s target application

RETL

<RETL home>/.wallet

n/a

App use

Manual

User may vary depending on RETL flow’s target application

RIB

JAVA

<RIBHOME DIR>/deployment-home/conf/security

<app> is one of aip, rfm, rms, rpm, sim, rwms, tafr

JMS

jms<1-5>

Integra-
tion use

Installer

jms-alias

WebLogic

rib-<app>-app-server-instance

<rib-app weblogic user alias>

<rib-app weblogic user name>

Integra-
tion use

Installer

weblogic-alias

Admin GUI

rib-<app>#web-app-user-alias

<rib-app admin gui user alias>

<rib-app admin gui user name>

Integra-
tion use

Installer

admin-gui-alias

Application

rib-<app>#user-alias

Integra-
tion use

Installer

app-user-alias

Valid only for aip, rpm, sim

rib-<app>#app-db-user-alias

<rib-app database schema user alias>

<rib-app database schema user name>

Integra-
tion use

Installer

db-user-alias

Valid only for rfm, rms, rwms, tafr

Error Hospital

rib-<app>#hosp-user-alias

<rib-app error hospital database schema user alias>

<rib-app error hospital database schema user name>

Integra-
tion use

Installer

hosp-user-alias

RFI

Java

<RFI-HOME>/retail-financial-integration-solution/service-based-integration/conf/security

rfiAppServerAdminServerUserAlias

App use

Installer

rfiAppServerAdminServerUserAlias

rfiAdminUiUserAlias

App use

Installer

rfiAdminUiUserAlias

rfiDataSourceUserAlias

App use

Installer

rfiDataSourceUserAlias

ebsDataSourceUserAlias

App use

Installer

ebsDataSourceUserAlias

smtpMailFromAddressAlias

App use

Installer

smtpMailFromAddressAlias

Field Title	SIM Schema Owner
Field Description	The pre-existing database user for this installation.
Destination	dba_create_directory.sql, dataseeding.cfg
Example	SIM14

Field Title	Sim Schema Password
Field Description	The SIM Schema Owner's password.

Field Title	SIM Oracle SID
Field Description	The name of the database or pluggable db service name where the SIM schema will be installed.
Example	dvols64

Field Title	Temporary tablespace name
Field Description	Temporary tablespace provided to the create_user.sql script at the time that the SIM database user was created.
Example	TEMP

Field Title	PL/SQL batch data file location
Field Description	A directory which will be the parent directory for all other PL/SQL batch processing directories.
Destination	dba_create_directory.sql
Example	/usr/oracle/retail/sim/batch

Field Title	StockCount upload directory
Field Description	A filesystem directory and database directory object used for processing StockCount data.
Destination	dba_create_directory.sql
Example	/usr/oracle/retail/sim/batch/stockcountUpload
Notes	The installer will not create these directories or directory objects. It will produce the dba_create_directory.sql script, which can be used to create them.

Oracle Retail VAR Applications

References for Configuration:

Application Installation Tasks

Screen: Data Source Details

Screen: PL/SQL Batch Setup – Base Directory

Screen: PL/SQL Batch Setup (3 screens)

Screen: Installation Summary

Screen: Installation Type

Screen: Security Details

Screen: Turn off the application server’s non-SSL port

Screen: Application Server Details

Screen: Application Deployment Details

Screen: Choose Apps to Integrate with SIM

Screen: RIB Integration Details

Screen: RPM Web service Policy

Screen: JDBC Security Details

Screen: Data Source Details

Screen: Secure Data Source Details

Screen: LDAP Server Details

Screen: Mail Session Details

Screen: Wireless Server Details

Screen: Batch Server Details

Screen: Server User Details

Screen: Internal Security Installation User Details

Screen: SIM Webservice Provider Policy

Screen: Printing Details

Screen: Reporting BIP Details 1

Screen: Reporting BIP Details 2

Screen: Ticket Printing BIP Details 1

Screen: Ticket Printing BIP Details 2

Screen: External Ticket Printing WebService Policy

Screen: External Ticket Printing Service Details

Screen: Enable SSO in SIM

Screen: Single Sign-On Details

Screen: Manual Deployment Option

Screen: Installation Summary

Appendix: Common Installation Errors

Symptom

Solution

Symptom

Solution

Symptom

Solution

Symptom

Solution

Symptom

Solution

Symptom

Solution

Symptom

Solution