This appendix describes common problems that you might encounter when using the Oracle Directory Integration Platform and explains how to solve them. It contains these topics:
See Also:
Oracle by Example for Oracle Identity Management, available from the Oracle Technology Network at http://www.oracle.com/technology/index.html
Use the following checklist as a starting point when troubleshooting Oracle Directory Integration Platform problems:
Verify that the Oracle Directory Integration Platform application has been deployed by using the WebLogic console.
Verify that the Oracle Directory Integration Platform application is running.
To verify the status of the Oracle Directory Integration Platform application using Oracle Enterprise Manager Fusion Middleware Control, open a Web browser and enter the Oracle Enterprise Manager Fusion Middleware Control URL for your environment. The format of the Oracle Enterprise Manager Fusion Middleware Control URL is: https://host:port/em.
You can view the status of the Oracle Directory Integration Platform application in the status column of the Fusion Middleware section on the Oracle Enterprise Manager Fusion Middleware Control home page for your environment.
To verify the status of the Oracle Directory Integration Platform application from the command-line, use the dipStatus utility. If Oracle Directory Integration Platform is running, dipStatus returns an ODIP Application is active at this host and port message.
Notes:
When using dipStatus, be sure you specify the host and port of the Oracle WebLogic Managed Server where Oracle Directory Integration Platform is deployed, not the host and port of the Administration Server.
Refer to "Viewing the Status of Oracle Directory Integration Platform Using the dipStatus Utility" for more information.
Verify the appropriate profiles are enabled by listing their names and status using the manageSyncProfiles command as follows:
manageSyncProfiles list -h host -p port -D user [-prfSt] [-help]
Note:
You will be prompted for the password.Verify that the third-party LDAP directory server is running by executing the following command:
ldapbind -h ldap_host -p ldap_port -D binddn -q
Note:
You will be prompted for the password.If you are using the PL/SQL plug-in, use sqlplus to verify that you can connect to the provisioning-integrated application.
This section describes common problems and solutions for Oracle Directory Integration Platform. It contains these topics:
Novell eDirectory and OpenLDAP Synchronization Errors and Problems
Oracle Password Filter for Microsoft Active Directory Errors and Problems
Note:
The Oracle Directory Integration Platform stores error messages in the appropriate file, as described in "Location and Naming of Files".This section provides solutions for provisioning errors and problems.
Unable to get the Entry from its GUID. Fatal Error...
Oracle Directory Integration Platform is attempting to retrieve an entry that has been deleted, but appears to not have been purged. However, when this error happens, the entry has been already purged. To avoid future errors, update the tombstone purge configuration settings in the Oracle Internet Directory garbage collection framework by referring to the "Managing Garbage Collection" chapter in the Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.
LDAP connection failure.
Oracle Directory Integration Platform failed to connect to the directory server. Check the connection to the directory server.
See Also:
If your Oracle back-end directory is Oracle Internet Directory, see the chapter about directory server administration in Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory. This chapter contains information about directory server connections.Initialization and database connection failures, and exceptions while calling an SQL operation.
To test the connection, use the Test Connection feature for the profile in Oracle Enterprise Manager Fusion Middleware Control. If the connection fails, examine the diagnostic log file at the following location for more information:
MW_HOME/user_projects/domains/DOMAIN_NAME/servers/NAME_OF_MANAGED_SERVER/logs/
Note:
The file name is NAME_OF_MANAGED_SERVER-diagnostic.logProvisioning Profiles Not Getting Executed by the DIP Provisioning Server.
Using Oracle Enterprise Manager Fusion Middleware Control or the oidprovtool command, verify the profile is enabled and that the Oracle Directory Integration Platform scheduling interval is set to a positive integer.
Unable to Connect to the Application Database.
The application database connection requirements in a provisioning profile may be incorrect. Use sqlplus to verify connectivity requirements.
User/Group Modify And Delete Events Not being consumed by the application.
Verify the host port details and credentials using the Test Connection feature for the profile in Oracle Enterprise Manager Fusion Middleware Control. If the connection fails after using the Test Connection option, an error message appears providing information about the failed connection.
For additional information about the failed connection, you can examine the diagnostic log using Oracle Enterprise Manager Fusion Middleware Control or from the command line. The diagnostic log is located at:
MW_HOME/user_projects/domains/DOMAIN_NAME/servers/NAME_OF_MANAGED_SERVER/logs/
Note:
The file name is NAME_OF_MANAGED_SERVER-diagnostic.logSubscription to binary attributes results in the event propagation error.
Binary attributes propagation is not supported. Remove the binary attribute assignments from the event subscription in the provisioning profile.
Insufficient Access Rights to do "proxy" as the Application DN.
The Oracle Directory Integration Platform server group has not been granted browse privilege by the application DN. Use the ldapmodify command to load the following ACIs, which grant browse privileges from the application DN to the Oracle Directory Integration Platform group:
orclaci: access to attr=(*) by group="cn=odisgroup,cn=DIPAdmins,cn=Directory Integration Platform,cn=products,cn=oraclecontext "(read,write,search,compare) orclaci: access to entry by group="cn=odisgroup,cn=DIPAdmins,cn=Directory Integration Platform,cn=products,cn=oraclecontext"(browse,proxy)
Insufficient access rights to use an application DN as a proxy.
The Oracle Directory Integration Platform server group has not been granted proxy privileges by the application DN. Use the ldapmodify command to load the following ACI, which grants proxy privileges from the application DN to the Oracle Directory Integration Platform group:
orclaci: access to entry by group=" cn=odisgroup, cn=odi,cn=oracle internet directory" (browse,proxy)
This section provides solutions for synchronization errors and problems.
See Also:
Note: 276481.1—Troubleshooting OID DIP Synchronization Issues in My Oracle Support (formerly MetaLink) athttp://metalink.oracle.com/LDAP: error code 50 - Insufficient Access Rights; remaining name 'CN=Users,dc=mycompany,dc=com'
The record target is not in a default container. Find the DST CHANGE RECORD. Check the ACIs for the target container. If they are blank, then use DIP Tester to apply a known set of ACIs to the new container.
LDAP: error code 50 - Insufficient Access Rights; ACTIVECHGIMP MAPPING IMPORT OPERATION FAILURE; Agent execution successful, Mapping/import operation failure
By default the cn=Users,default realm contains the proper ACIs. However, this error can occur when trying to synchronize into a different container within the default realm. Open the trace file, locate the change record that is causing the error, and then check the ACIs for the record's parent container. Apply the same ACIs to the target container.
Log File Error: Not able to construct DN Output ChangeRecord : Changetype: 1 ChangeKey: cn=users, dc=us,dc=oracle,dc=com Exception javax.naming. ContextNotEmptyException: [LDAP: error code 66 - Not Allowed On Non-leaf]; remaining name 'cn=users,dc=us,dc=oracle,dc=com' Missing mandatory attribute(s).
There is a problem with the mapping file. Refer to Note: 261342.1—Understanding DIP Mapping in My Oracle Support (formerly MetaLink) at http://metalink.oracle.com/.
Trace File Error: IPlanetImport:Error in Mapping Enginejava.lang.NullPointerException java.lang.NullPointerException at oracle.ldap.odip.engine.Connector.setValues(Connector.java:101).
The orclcondirlastappliedchgnum attribute is null or has no value. This may occur if bootstrapping failed or if you manually populated the Oracle back-end directory and did not assign a value to the orclcondirlastappliedchgnum attribute. Verify that the orclcondirlastappliedchgnum attribute has a value. If it does not have a value, set it using the DIP Tester utility or using WLST to configure the DIP Mbean.
Add and change operations are successful, but delete operations fail without being recorded in the trace file.
Tombstones are not enabled in Oracle Directory Server Enterprise Edition or Sun Java System Directory Server. Verify that tombstones are enabled by referring to Note: 219835.1 in My Oracle Support (formerly MetaLink) at http://metalink.oracle.com/.
In Microsoft Active Directory, the account used for the profile is not a member of the DIR SYNCH ADMIN group. This only occurs if you are not using a Microsoft Active Directory administrator account. Install the appropriate patch from Microsoft.
Data synchronization problems encountered after configuring Oracle Directory Integration import or export connectors to third-party LDAP directories.
Determine the cause using the testProfile operation of the manageSyncProfiles command.
Editing the attribute mapping rule for a synchronization profile using Oracle Enterprise Manager Fusion Middleware Control may cause the Schema not initialized for object class error.
The problem could be caused by an invalid directory type specified for the third party directory connection details. Verify you have specified the correct directory type and connection details.
The Oracle back-end directory profile in Oracle Enterprise Manager Fusion Middleware Control shows "synchronization successful" yet no changes show up in the directory.
First, determine if synchronization is occurring by examining the following parameters for the synchronization profile using Oracle Enterprise Manager Fusion Middleware Control:
Successful Completion Time (on DIP Server Home page)
Last Execution Time (on DIP Server Home page)
Scheduling Interval (on Advanced tab for profile)
Synchronization is occurring if the Successful Completion Time and Last Execution Time metrics have time values relevant to the current time of the system. If these metrics indicate time values that are considerably older than the current time of the system, synchronization is not occurring.
If synchronization is occurring:
Verify synchronization is configured to occur in the correct location by examining the Source Container setting on the profile's Mapping tab in Oracle Enterprise Manager Fusion Middleware Control.
Verify the correct objects are being filtered by examining the Source Matching Filter setting on the profile's Filtering tab in Oracle Enterprise Manager Fusion Middleware Control.
If synchronization is not occurring:
Verify the synchronization profile is enabled using the DIP Server Home page in Oracle Enterprise Manager Fusion Middleware Control.
Check the status of the Quartz Scheduler using the DIP Server Home page in Oracle Enterprise Manager Fusion Middleware Control.
Test the synchronization profile using the manageSyncProfiles command and its testProfile operation. Refer to "Managing Synchronization Profiles Using manageSyncProfiles" for more information about the manageSyncProfiles command.
This section provides solutions for errors and problems you may encounter when integrating Oracle Identity Management with Windows Native Authentication.
Note:
Oracle Directory Integration Platform 11g Release 1 (11.1.1) interoperates with and supports Oracle Application Server Single Sign-On 10g Release 10.1.4.3.0 and higher.See Also:
The "Problems and Solutions for Windows Native Authentication Errors" section in the Troubleshooting chapter of the Oracle Enterprise Single Sign-On Suite Plus Administrator's Guide for more information about Windows Native Authentication errors.Internal Server error. Please contact your administrator.
Windows Native Authentication is misconfigured on the middle-tier computer. To fix this problem, perform the following steps:
Check the opmn.log file for errors.
Check the ssoServer.log file for errors.
Make sure that the keytab file is located in the $ORACLE_HOME/j2ee/OC4J_SECURITY/config directory and that the principal name configured in the jazn-data.xml file is correct.
Make sure that the single sign-on middle tier computer is properly configured to access the Key Distribution Center.
Could not authenticate to KDC.
This error message may be invoked if the realm name in krb5.conf is incorrectly configured. Check the values default_realm and domain_realm in /etc/krb5/krb5.conf. Note that the realm name is case-sensitive.
Your browser does not support the Windows Kerberos authentication or is not configured properly.
The user's Web browser is not supported or is misconfigured. Follow the instructions in "Task 2: Configure Internet Explorer for Windows Native Authentication".
"Access forbidden" or "HTTP error code 403" or "Windows Native Authentication Failed. Please contact your administrator."
These error messages have the same cause: the user entry cannot be found in the Oracle back-end directory. A local administrator working at a Windows desktop may be trying to access a single sign-on partner application whose entry may not have been synchronized with the Oracle back-end directory. Determine whether the user entry exists in the directory and if the Kerberos principal attributes for the user are properly synchronized from Microsoft Active Directory.
The Windows login dialog box (with user name, password, and domain fields in it) comes up when accessing the partner application.
The single sign-on server was not able to authenticate the Kerberos token because the corresponding user entry could not be found in the Oracle back-end directory. Add the user entry to the directory.
Single sign-on server fails to start. Log file contains an exception bearing the message "Credential not found."
The parameter kerberos-servicename may not be configured correctly. To fix this problem, perform the following steps:
Make sure that kerberos-servicename is configured correctly in the files orion-application.xml and jazn-data.xml. In the orion-application.xml file, the format for this parameter is HTTP@sso.mycompany.com. In the jazn-data.xml file, the format is HTTP/sso.mycompany.com.
Check the ssoServer.log file for errors.
Make sure that the keytab file is located in the $ORACLE_HOME/j2ee/OC4J_SECURITY/config directory and that the principal name configured in jazn-data.xml is correct.
Make sure that the single sign-on middle tier computer is configured to access the Kerberos domain controller.
The following exception is raised when running the OracleAS Single Sign-On Server Configuring Assistant:
Repository Access API throws exception :
oracle.ias.repository.schema.SchemaException: Unable to establish secure
connection to Oracle Internet Directory Server
ldap://server.mycompany.com:636/ Base Exception :
javax.naming.CommunicationException: server.mycompany.com:636 [Root
exception is java.lang.UnsatisfiedLinkError: no njssl10 in java.library.path]
at
oracle.ias.repository.directory.DirectoryReader.connectSsl(DirectoryReader.java:
98)
at
oracle.ias.repository.directory.DirectoryReader.connect(DirectoryReader.java:106
)
at oracle.ias.repository.IASSchema.getDBPassword(IASSchema.java:440)
at
oracle.ias.repository.SchemaManager.getDBPassword(SchemaManager.java:310)
at oracle.security.sso.IMWNAConfig.getSSOHost(IMWNAConfig.java:903)
at oracle.security.sso.IMWNAConfig.parseArgs(IMWNAConfig.java:168)
at oracle.security.sso.IMWNAConfig.init(IMWNAConfig.java:194)
at oracle.security.sso.IMWNAConfig.work(IMWNAConfig.java:60)
at oracle.security.sso.SSOConfigAssistant.wnaConfig(SSOConfigAssistant.java:243)
at oracle.security.sso.SSOConfigAssistant.main(SSOConfigAssistant.java:218)
This exception occurs when the Windows version of the OracleAS Single Sign-On Server Configuring Assistant is run on UNIX and Linux platforms. Run the UNIX/Linux version of the OracleAS Single Sign-On Server Configuring Assistant by following the instructions in "Run the OracleAS Single Sign-On Server Configuration Assistant on each Oracle Application Server Single Sign-On Host".
With Windows Native Authentication, Internet Explorer is sending NT Lan Manager (NTLM) authentication instead of Kerberos credentials.
This issue is caused by an improperly configured Microsoft Active Directory installation. Refer to your Microsoft Active Directory documentation or contact Microsoft for information on how to resolve this issue.
Individual users cannot log in from specific computers using Windows Native Authentication.
If the users can log in using another computer, then there is a configuration problem with Windows or Internet Explorer on the original computer. Refer to the Microsoft Developer Network at http://msdn.microsoft.com or contact Microsoft for information on how to resolve this issue.
This section provides solutions to synchronization errors and problems that can occur with Novell eDirectory and OpenLDAP.
After configuring import synchronization, entries are not synchronizing from Novell eDirectory or OpenLDAP to the Oracle back-end directory, even though the profile's synchronization status is successful and the trace file does not show any exceptions.
Possible causes and their solutions:
Cause Incorrect value assigned to the modifiersname parameter of the odip.profile.condirfilter property in the import profile.
Solution Copy the connection DN from the Novell eDirectory or OpenLDAP export profile to the modifiersname parameter of the odip.profile.condirfilter property in the import profile.
Cause The entries that the Oracle Directory Integration Platform are attempting to synchronize are created using the same DN that is assigned to the modifiersname parameter of the odip.profile.condirfilter property in the import profile.
Solution Change the DN that is assigned to the modifiersname parameter of the odip.profile.condirfilter property in the import profile to a DN that does not create the entries in Novell eDirectory of OpenLDAP.
Cause There is a time difference between the computer that is running the Oracle back-end directory and the computer that is running Novell eDirectory or OpenLDAP.
Solution Assign to the ReduceFilterTimeInSeconds parameter of the odip.profile.configfile property in the import profile a value in seconds that is equal to the time difference between the two computers.
Unsupported exception thrown during reconciliation.
One or more of the Oracle back-end directory attributes that are specified in the Novell eDirectory or OpenLDAP reconciliation rules are not indexed. Index the corresponding attributes in the Oracle back-end directory.
Deleted entries are not synchronizing from Novell eDirectory or OpenLDAP to the Oracle back-end directory, even though the profile's reconciliation status is successful.
Possible causes and their solutions:
Cause The deleted entries are not specified in the Novell eDirectory or OpenLDAP reconciliation rules.
Solution Modify the Novell eDirectory or OpenLDAP reconciliation rules to include the deleted entries.
Cause There are more entries in Novell eDirectory or OpenLDAP for a particular reconciliation rule than there are in the Oracle back-end directory.
Solution Examine the $ORACLE_HOME/ldap/odi/log/profile_name.trc file for the following message:
No. of entries are less in destination directory compared to source directory.
The preceding message is usually generated when the entire Novell eDirectory or OpenLDAP DIT needs to be synchronized with the Oracle back-end directory. To resolve this problem, assign a value of true to the CheckAllEntries parameter of the odip.profile.configfile property.
Caution:
Assigning a value oftrue to the CheckAllEntries parameter of the odip.profile.configfile property will result in decreased performance.This section provides solutions to errors and problems that can occur with the Oracle Password Filter for Microsoft Active Directory.
The Oracle Password Filter for Microsoft Active Directory cannot be installed and the following error is reported in the log:
(Aug 23, 2010 8:26:52 PM), Install, com.oracle.installshield.adpwd.ldapModify, dbg, C:\Program Files (x86)\oracle\ADPasswordFilter\prepAD.ldif
(Aug 23, 2010 8:26:52 PM), Install, com.oracle.installshield.adpwd.ldapModify, err, in LDAPOperation
(Aug 23, 2010 8:26:52 PM), Install, com.oracle.installshield.adpwd.ldapModify, err, [LDAP: error code 19 - 000020B5: AtrErr: DSID-03152704, #1:
0: 000020B5: DSID-03152704, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9030e (objectCategory)
This error may occur if the ActiveDirectory schemaNamingContext object does not come under the defaultNamingContext.
To solve this problem do one of the following:
Replace the ObjectCategory attribute in prepAD.ldif with the value of CN=Organizational-Unit, schemaNaming Context
where schemaNamingContext is replaced by the schema naming context value.
Remove the ObjectCategory attribute from prepAD.ldif. Because the entry gets added in ActiveDirectory, the objectcategory attribute will be populated with the right value automatically.
Unable to find log file path.
Invalid log file path.
Specify a valid log file path by following the instructions in "Reconfiguring the Oracle Password Filter for Microsoft Active Directory".
Cannot connect to Oracle Internet Directory in non-SSL mode (mode 1).
Note:
Oracle Unified Directory and Oracle Directory Server Enterprise Edition do not support non-SSL mode (mode 1).Invalid Oracle Internet Directory configuration settings.
Correct the Oracle Internet Directory configuring settings by following the instructions in "Reconfiguring the Oracle Password Filter for Microsoft Active Directory".
Cannot connect to the Oracle back-end directory in SSL mode.
The Oracle back-end directory certificate authority's trusted certificate has not been imported into the Microsoft Active Directory domain controller.
Import the trusted certificate into Microsoft Active Directory by following the instructions in "Importing a Trusted Certificate into a Microsoft Active Directory Domain Controller".
Cannot connect to Microsoft Active Directory.
Invalid Microsoft Active Directory configuration settings.
Correct the Microsoft Active Directory configuration settings by following the instructions in "Reconfiguring the Oracle Password Filter for Microsoft Active Directory".
Cannot upload the prepAD.ldif file.
The specified Microsoft Active Directory base DN container cannot store organizationalUnit objects.
Specify a base DN for Microsoft Active Directory that can store organizationalUnit objects by following the instructions in "Reconfiguring the Oracle Password Filter for Microsoft Active Directory".
Password updates are looping between the Oracle back-end directory and Microsoft Active Directory.
The Oracle Password Filter is not configured to use the same bind DN and password that are specified in the synchronization profile that imports values from Microsoft Active Directory into the Oracle back-end directory.
Configure the Oracle Password Filter to use the same bind DN and password that are specified in the synchronization profile that imports values from Microsoft Active Directory into the Oracle back-end directory by following the instructions in "Reconfiguring the Oracle Password Filter for Microsoft Active Directory".
Some passwords are not synchronizing between the Oracle back-end directory and Microsoft Active Directory.
The Oracle back-end directory and Microsoft Active Directory specify conflicting password policies.
Set the Oracle back-end directory password policies to the same policies that are set in Microsoft Active Directory or remove the password policies from the Oracle back-end directory.
Passwords are not synchronizing for some users.
You performed an advanced installation of the Oracle Password Filter and specified different values for the attributes that you want to synchronize between the Oracle back-end directory and Microsoft Active Directory.
Specify the same values for the attributes that you want to synchronize between the Oracle back-end directory and Microsoft Active Directory by following the instructions in "Reconfiguring the Oracle Password Filter for Microsoft Active Directory".
User data synchronizes, but password synchronization is delayed.
Different time intervals are specified for user data synchronization and password synchronization.
Verify that the value assigned to the Oracle Password Filter's SleepTime parameter is the same as the default scheduling interval for the synchronization profile. You can use Oracle Enterprise Manager Fusion Middleware Control tool or the manageSyncProfiles command to view and change the default scheduling interval for synchronization profiles. To change the value assigned to the SleepTime parameter, follow the instructions in "Reconfiguring the Oracle Password Filter for Microsoft Active Directory" .
This section describes how to troubleshoot synchronization with Oracle Directory Integration Platform. It contains these topics:
When debugging synchronization issues between the Oracle back-end directory and a connected directory, it helps to understand the synchronization process flow of the Oracle Directory Integration Platform.
The Oracle Directory Integration Platform reads all import profiles at startup. For each profile that is set to ENABLE, the Oracle Directory Integration Platform performs the following tasks during the synchronization process:
Connects to a third-party directory.
Gets the value of the last change key from the connected directory.
Connects to the Oracle back-end directory.
Gets the value of the profile's last applied change key from the Oracle back-end directory.
If connecting from the Oracle back-end directory to Oracle Directory Server Enterprise Edition (previously Sun Java System Directory Server), the Oracle Directory Integration Platform searches the remote change logs for entries greater than the value of the last applied change key and less than or equal to the value of the last change key. For Microsoft Active Directory connections, the Oracle Directory Integration Platform searches for this information in the remote directory's USNChanged values. For the Novell eDirectory and OpenLDAP connectors, changes are identified based on the modifytimestamp attribute of each entry. For other types of connectors, such as the Oracle Human Resources connector, the Oracle Directory Integration Platform performs similar types of searches, although the method by which data is exchanged varies according to the type of connection.
Maps the data values from the connected directory to the Oracle back-end directory values.
Creates an Oracle back-end directory change record.
Applies the change (add, change, delete) in the Oracle back-end directory.
Updates the Oracle back-end directory import profile with the last execution times and the last applied change key from the connected directory.
Enters sleep mode for the number of seconds specified for the synchronization interval.
The Oracle Directory Integration Platform reads all export profiles at startup. For each profile that is set to ENABLE, the Oracle Directory Integration Platform performs the following tasks during the synchronization process:
Connects to a third-party directory.
Connects to the Oracle back-end directory.
Gets the value for the last change key from the Oracle back-end directory.
Gets the value of the profile's last applied change key from the Oracle back-end directory.
The Oracle Directory Integration Platform searches the Oracle back-end directory change logs for entries greater than the value of the last applied change key and less than or equal to the value of the last change key.
Maps the data values from the Oracle back-end directory to the connected directory values.
Creates a change record.
Applies the change (add, change, delete) on the connected directory.
Updates the Oracle back-end directory export profile with the last execution times and the last applied change key from the Oracle back-end directory.
Enters sleep mode for the number of seconds specified for the synchronization interval.
This section provides information about synchronization profile registration.
Validating Profiles Registered in DISABLED State
Validating registered profiles is not required. However, you may validate registered profiles as long as the validation does not prevent the profile from being created.
Registration of DISABLED Profiles that Fail Validation
If the validation of profile in DISABLED state fails, the profile is still registered. Profiles in the DISABLED state may contain errors or the credentials to the target system directory may be unknown, however, this does not prevent the profile from being registered.
If you receive errors while registering a profile, for example, due to an incorrect third party directory password, use the manageSyncProfiles command line tool to correct the errors in the profile. Refer to "Managing Synchronization Profiles Using manageSyncProfiles" for more information.
This section explains how to understand the Oracle Directory Integration Platform diagnostic.log file, which is located at the following location:
MW_HOME/user_projects/domains/DOMAIN_NAME/servers/NAME_OF_MANAGED_SERVER/logs/
Note:
The file name is NAME_OF_MANAGED_SERVER-diagnostic.log.This following is an example diagnostic.log file that is broken into sections and annotated to identify information that will be useful when troubleshooting Oracle Directory Integration Platform. Noteworthy information is shown in bold type, and the text Host: HOST_NAME: PORT indicates the host name and port of the machine on which Oracle Directory Integration Platform is connecting.
The following section of the diagnostic.log file shows information related to Oracle Directory Integration Platform startup. In this section, notice the following:
SSL Mode: indicates the connection mode used for connecting to the Oracle back-end directory. You may see SSL Mode: 1 or SSL Mode: 2. If you see SSL Mode: 2, Oracle Directory Integration Platform uses certificates to connect to the Oracle back-end directory. (Oracle Unified Directory and Oracle Directory Server Enterprise Edition only support SSL mode 2. They do not support mode 1 (non-SSL mode 1).
Scheduler initialized indicates that the profile scheduler has initialized properly. A string indicating that a successful connection to the Oracle back-end directory server follows.
Schema objects are initialized and profiles are scheduled for synchronization.
[2009-02-18T00:52:27.530-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] Copyright (c) 1982, 2009 Oracle. All rights reserved [2009-02-18T00:52:27.550-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] SSL Mode : 1 [2009-02-18T00:52:27.554-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] Host: HOST_NAME: PORT [2009-02-18T00:52:38.104-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] Scheduler intialized [2009-02-18T00:52:47.273-08:00] [wls_ods1] [NOTIFICATION] [DIP-10571] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] Connection to LDAP Server Successful [2009-02-18T00:52:47.334-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] OBJECT_SCHEMA_READER_INITIALIZING [2009-02-18T00:52:47.508-08:00] [wls_ods1] [NOTIFICATION] [DIP-10572] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] Object Schema Reader Initialized. [2009-02-18T00:52:47.510-08:00] [wls_ods1] [NOTIFICATION] [DIP-10573] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] Event Schema Reader Initialized. [2009-02-18T00:52:48.198-08:00] [wls_ods1] [NOTIFICATION] [DIP-10574] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] Data transfer interface defn initialized [2009-02-18T00:52:48.213-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] INITALIZE_PROVJOBS [2009-02-18T00:52:48.773-08:00] [wls_ods1] [NOTIFICATION] [DIP-10566] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] [arg: \n----------EVENT TYPE CONFIGURATION ---------------\n--------------------------------\nEventLDAPChangeType : ADD,MODIFY,DELETE\nobjectclass: inetorgperson,orcluserv2\n--------------------------------\nEventLDAPChangeType : ADD,MODIFY,DELETE\nobjectclass: orclservicesubscriptiondetail\n--------------------------------\nEventLDAPChangeType : ADD,MODIFY,DELETE\nobjectclass: *\n--------------------------------\nEventLDAPChangeType : ADD,MODIFY,DELETE\nobjectclass: inetorgperson,orcluserv2\n--------------------------------\nEventLDAPChangeType : ADD,MODIFY,DELETE\nobjectclass: orclsubscriber\n--------------------------------\nEventLDAPChangeType : ADD,MODIFY,DELETE\nobjectclass: orclgroup,orclprivilegegroup,groupofuniquenames,groupofnames\n------------------------------------- -------------] Print Event Type Configuration...[[ ----------EVENT TYPE CONFIGURATION --------------- -------------------------------- EventLDAPChangeType : ADD,MODIFY,DELETE objectclass: inetorgperson,orcluserv2 -------------------------------- EventLDAPChangeType : ADD,MODIFY,DELETE objectclass: orclservicesubscriptiondetail -------------------------------- EventLDAPChangeType : ADD,MODIFY,DELETE objectclass: * -------------------------------- EventLDAPChangeType : ADD,MODIFY,DELETE objectclass: inetorgperson,orcluserv2 -------------------------------- EventLDAPChangeType : ADD,MODIFY,DELETE objectclass: orclsubscriber -------------------------------- EventLDAPChangeType : ADD,MODIFY,DELETE objectclass: orclgroup,orclprivilegegroup,groupofuniquenames,groupofnames -------------------------------------------------- ]] [2009-02-18T00:52:48.826-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] INITALIZE_SYNCJOBS [2009-02-18T00:52:50.804-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] Job submission successfulActiveExport SYNC_JOB 60 [2009-02-18T00:52:50.809-08:00] [wls_ods1] [NOTIFICATION] [EVENT_NOT_ENABLED] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] [2009-02-18T00:52:52.184-08:00] [wls_ods1] [NOTIFICATION] [DIP-10605] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8^kIXF0FQ6ubn3EH19awhV000001,0] [APP: DIP#11.1.1.1.0] [arg: ActiveExport] Profile : ActiveExport added successfully for scheduling.
UpdateThread Checking for Changes in Profiles
The following section of the diagnostic.log file shows information related to the UpdateThread job, which checks for changes made to synchronization and provisioning profiles. If UpdateThread finds changes, the profile is modified and rescheduled. In this section, notice the following:
[2009-02-18T01:20:42.501-08:00] [wls_ods1] [NOTIFICATION] [DIP-10580] [oracle.dip] [tid:
UpdateThread] [userId: <anonymous>] [ecid: 0000Hy8fyF1F0FQ6ubn3EH19ax8V000003,0] [APP:
DIP#11.1.1.1.0] [arg:
(&(objectclass=changelogentry)(changenumber>=3340)(|(targetdn=*cn=Profiles,cn=Provisioning,cn=Direc
tory Integration Platform,cn=Products,cn=OracleContext)(targetdn=*cn=event definitions,cn=directory
integration platform,cn=products,cn=oraclecontext)(targetdn=*cn=object definitions,cn=directory
integration platform,cn=products,cn=oraclecontext)))] Changelog Filter :
(&(objectclass=changelogentry)(changenumber>=3340)(|(targetdn=*cn=Profiles,cn=Provisioning,cn=Direc
tory Integration Platform,cn=Products,cn=OracleContext)(targetdn=*cn=event definitions,cn=directory
integration platform,cn=products,cn=oraclecontext)(targetdn=*cn=object definitions,cn=directory
integration platform,cn=products,cn=oraclecontext)))
The following section of the diagnostic.log file shows information related to profile initialization. In this section, notice that the ActiveImport profile is scheduled:
[2009-02-18T02:26:19.604-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8unSqF0FQ6ubn3EH19ay88000001,0] [APP: dipapp#11.1.1.1.0] INITALIZE_SYNCJOBS [2009-02-18T02:26:19.695-08:00] [wls_ods1] [NOTIFICATION] [] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8unSqF0FQ6ubn3EH19ay88000001,0] [APP: dipapp#11.1.1.1.0] Job submission successfulActiveImport SYNC_JOB 60 [2009-02-18T02:26:19.703-08:00] [wls_ods1] [NOTIFICATION] [EVENT_NOT_ENABLED] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8unSqF0FQ6ubn3EH19ay88000001,0] [APP: dipapp#11.1.1.1.0] [2009-02-18T02:26:19.741-08:00] [wls_ods1] [NOTIFICATION] [DIP-10605] [oracle.dip] [tid: Scheduler] [userId: <anonymous>] [ecid: 0000Hy8unSqF0FQ6ubn3EH19ay88000001,0] [APP: dipapp#11.1.1.1.0] [arg: ActiveImport] profile added successfully for scheduling : ActiveImport
The following section of the diagnostic.log file shows information that appears if the database is not running:
Feb 18, 2009 3:01:19 AM org.quartz.impl.jdbcjobstore.JobStoreSupport$ClusterManager manage
SEVERE: ClusterManager: Error managing cluster: Failed to obtain DB connection from data source
'schedulerDS': java.sql.SQLException: Could not retrieve datasource via JNDI url 'jdbc/schedulerDS'
weblogic.jdbc.extensions.PoolDisabledSQLException:
weblogic.common.resourcepool.ResourceDisabledException: Pool schedulerDS is disabled, cannot
allocate resources to applications..
org.quartz.JobPersistenceException: Failed to obtain DB connection from data source 'schedulerDS':
java.sql.SQLException: Could not retrieve datasource via JNDI url 'jdbc/schedulerDS'
weblogic.jdbc.extensions.PoolDisabledSQLException:
weblogic.common.resourcepool.ResourceDisabledException: Pool schedulerDS is disabled, cannot
allocate resources to applications.. [See nested exception: java.sql.SQLException: Could not
retrieve datasource via JNDI url 'jdbc/schedulerDS'
weblogic.jdbc.extensions.PoolDisabledSQLException:
weblogic.common.resourcepool.ResourceDisabledException: Pool schedulerDS is disabled, cannot
allocate resources to applications..]
at org.quartz.impl.jdbcjobstore.JobStoreSupport.getConnection(JobStoreSupport.java:636)
at org.quartz.impl.jdbcjobstore.JobStoreTX.getNonManagedTXConnection(JobStoreTX.java:72)
at org.quartz.impl.jdbcjobstore.JobStoreSupport.doCheckin(JobStoreSupport.java:3070)
at org.quartz.impl.jdbcjobstore.JobStoreSupport$ClusterManager.manage(JobStoreSupport.java:3713)
at org.quartz.impl.jdbcjobstore.JobStoreSupport$ClusterManager.run(JobStoreSupport.java:3749)
Caused by: java.sql.SQLException: Could not retrieve datasource via JNDI url 'jdbc/schedulerDS'
weblogic.jdbc.extensions.PoolDisabledSQLException:
weblogic.common.resourcepool.ResourceDisabledException: Pool schedulerDS is disabled, cannot
allocate resources to applications..
at org.quartz.utils.JNDIConnectionProvider.getConnection(JNDIConnectionProvider.java:166)
at org.quartz.utils.DBConnectionManager.getConnection(DBConnectionManager.java:112)
at org.quartz.impl.jdbcjobstore.JobStoreSupport.getConnection(JobStoreSupport.java:633)
Successful Synchronization OPeration
The following section of the diagnostic.log file shows the successful synchronization of a user:
QuartzJobListener says: Job ActiveImport Is about to be executed.Wed Feb 18 03:36:00 PST 2009 createChangeRecord:ChangeRecord : ---------- Changetype: ADDRMODIFY ChangeKey: cn=myuser2,cn=users,dc=imtest,dc=com Attributes: Class: null Name: userprincipalname Type: null ChgType: DELETE Value: [ ] Class: null Name: givenname Type: null ChgType: DELETE Value: [ ] Class: null Name: employeeid Type: null ChgType: DELETE Value: [ ] Class: null Name: physicaldeliveryofficename Type: null ChgType: DELETE Value: [ ] Class: null Name: title Type: null ChgType: DELETE Value: [ ] Class: null Name: mobile Type: null ChgType: DELETE Value: [ ] Class: null Name: telephonenumber Type: null ChgType: DELETE Value: [ ] Class: null Name: facsimiletelephonenumber Type: null ChgType: DELETE Value: [ ] Class: null Name: l Type: null ChgType: DELETE Value: [ ] Class: null Name: thumbnailphoto Type: null ChgType: DELETE Value: [ ] Class: null Name: samaccountname Type: nonbinary ChgType: REPLACE Value: [MyUser2] Class: null Name: objectsid Type: nonbinary ChgType: REPLACE Value: [[B@1b994c4] Class: null Name: objectguid Type: nonbinary ChgType: REPLACE Value: [[B@1b990b5] Class: null Name: distinguishedname Type: nonbinary ChgType: REPLACE Value: [CN=MyUser2,CN=Users,DC=imtest,DC=com] Class: null Name: cn Type: nonbinary ChgType: REPLACE Value: [MyUser2] Class: null Name: objectclass Type: nonbinary ChgType: REPLACE Value: [top, person, organizationalPerson, user] ----------- copying : changeRecord to dstchange for writing In DIPSYNC: doOneIteration():execMapping status0 QuartzJobListener says: Job ActiveImport was executed.Wed Feb 18 03:36:00 PST 2009
This section describes how to troubleshoot integration with Microsoft Active Directory. It contains these topics:
Once you have configured Windows Native Authentication (see "Configuring Windows Native Authentication"), you can enable logging for this feature at run time. Open the opmn.xml file, located in $ORACLE_HOME/opmn/conf, and add the following parameter:
-Djazn.debug.log.enable = {true | false}
Assigning a value of true to the parameter enables debugging while assigning a value of false disables it.
The boldface text in the following example show where you should place the parameter in the opmn.xml file:
<process-type id="OC4J_SECURITY" module-id="OC4J">
<environment>
<variable id="DISPLAY" value="sun1.us.oracle.com:0.0"/>
<variable id="LD_LIBRARY_PATH" value="/private/ora1012/OraHome1/lib"/>
</environment>
<module-data>
<category id="start-parameters">
<data id="java-options" value="-server -Djazn.debug.log.enable=true
-Djava.security.policy=/private/ora1012/OraHome1/j2ee/OC4J_SECURITY/
config/java2.policy -Djava.awt.headless=true -Xmx512m
-Djava.awt.headless=true"/>
<data id="oc4j-options" value="-properties"/>
</category>
<category id="stop-parameters">
<data id="java-options" value="-Djava.security.policy=/private/ora1012/
OraHome1/j2ee/OC4J_SECURITY/config/java2.policy -Djava.awt.headless=true"/>
</category>
The log is written to the file OC4J~OC4J_SECURITY~default_island~1, found at $ORACLE_HOME/opmn/logs.
Note:
When accessing a protected application with Windows Native Authentication, Web browsers automatically return a "401 - Unauthorized" error that is logged by Oracle Enterprise Manager. This is normal behavior and can be safely ignored.See Also:
Note: 283268.1—Troubleshooting Oracle Application Server Single Sign-On Windows Native Authentication in My Oracle Support (formerly MetaLink) at http://metalink.oracle.com/
The "Problems and Solutions for Windows Native Authentication Errors" section in the Troubleshooting chapter of the Oracle Enterprise Single Sign-On Suite Plus Administrator's Guide for more information about Windows Native Authentication errors.
When the Oracle back-end directory is unavailable, changes are stored in Microsoft Active Directory. The Oracle Password Filter for Microsoft Active Directory attempts to synchronize these entries after connectivity is restored with the Oracle back-end directory. The SearchDeltaSize parameter determines how many incremental changes are processed during each iteration in a synchronization cycle. By default, the SearchDeltaSize parameter is assigned a value of 500. Depending on how long the Oracle back-end directory is unavailable, the default SearchDeltaSize value of 500 may be too low to catch up all of the unsynchronized changes. To resolve this problem, you must create a catchup profile by copying the existing Microsoft Active Directory import synchronization profile and modifying the value assigned to the SearchDeltaSize parameter.
To create a catchup synchronization profile:
Stop the Oracle Directory Integration Platform.
Deactivate the Microsoft Active Directory import synchronization profile using the deactivate operation of the manageSyncProfiles command.
Use the manageSyncProfiles copy command to create the catchup synchronization profile by copying the import synchronization profile. For example:
manageSyncProfiles copy -h myhost.mycompany.com -p 7005 -D weblogic -pf existing_import_sync_profile -newpf name_of_new_catchup_sync_profile
Activate the original Microsoft Active Directory import synchronization profile using the activate operation of the manageSyncProfiles command.
Start the Oracle Directory Integration Platform.
Obtain the current value of the highestCommittedUSN by searching the new domain controller's root DSE for the current highest USNChanged value (attribute value of the highestCommittedUSN attribute of the root DSE):
ldapsearch -h host -p port -b "" -s base -D binddn -q \ DN "objectclass=*" highestCommittedUSN
Note:
You will be prompted for the password.Experiment with the following ldapsearch command until you retrieve more than 100 entries but less than 200. Retrieving more than 200 entries may result in an internal buffer overrun.
ldapsearch -v -h adhost -p adport -D administrator@domain -q \ -b cn=users,dc=acme,dc=com -s sub \ "(&(objectclass=*)(usnChanged>=delta)(&(usnChanged<=highestCommittedUSN)))" dn
Note:
You will be prompted for the password.For example, the following command performs a search using a default search delta size of 500:
ldapsearch -v -h adhost -p adport -D administrator@domain -q \ -b cn=users,dc=acme,dc=com -s sub \ "(&(objectclass=*)(usnChanged>=55010)(&(usnChanged<=55510)))" dn
Note:
You will be prompted for the password.Create a text file named profile_config.txt that contains the following:
[INTERFACEDETAILS] Package: gsi Reader: ActiveChgReader SkipErrorToSyncNextChange: true SearchDeltaSize: 100000
Note:
You can also set theSkipErrorToSyncNextChange parameter to determine how the Oracle Directory Integration Platform handles an error when processing a change during synchronization. See the "Advanced" section for more information about the SkipErrorToSyncNextChange parameter in synchronization profiles.Use the update operation of the manageSyncProfiles command to load the profile_config.txt file into the catchup synchronization profile.
Use the activate operation of the manageSyncProfiles command to activate the catchup synchronization profile.
Note:
Be sure to continue running the original Microsoft Active Directory import synchronization profile along with the catchup synchronization profile.Allow the catchup synchronization profile to run for at least 12 hours. After all of the backlogged changes are synchronized, use the deactivate operation of the manageSyncProfiles command to deactivate the catchup synchronization profile.
You can find more solutions in My Oracle Support (formerly MetaLink) at http://metalink.oracle.com. If you do not find a solution for your problem, log a service request.
See Also:
Oracle Application Server Release Notes, available on the Oracle Technology Network:http://www.oracle.com/technology/documentation/index.html