This chapter describes issues you might encounter when you install and configure supported Oracle Fusion Middleware products on IBM WebSphere. It includes the following topics:
This section describes general issues and workarounds. It includes the following topics:
Section 12.1.1, "Additional Debug/TRACE Details in Exception Message"
Section 12.1.4, "Cannot Create CSF Mapping in IBM WebSphere with Target Domain in WebLogic Server"
Section 12.1.7, "Task Details Page Might Throw ADFC-12000 Errors"
Section 12.1.8, "Oracle Identity Federation Audit Records Not Moved to Database"
Section 12.1.9, "All Channels Cannot be SSL Enabled between OIM and Database Server on Websphere"
Section 12.1.10, "Enterprise Manager Does Not Reflect the State of WebSphere Cell"
Section 12.1.13, "Provisioning of GTC-Based Connector Fails with Error"
Section 12.1.14, "Error on Closing the Request Tab When Inbox is Open"
Section 12.1.15, "Identity and Access Option Not Available in EM After Upgrade"
If a runtime exception is thrown by an EJB, IBM WebSphere adds additional debug details to the exception message. This can result in incorrect error messages on the UI.
To fix this issue, add the com.ibm.CORBA.ShortExceptionDetails JVM property to the Oracle Identity Manager server by using the WebSphere Console, and set its value to true. Make this change on all relevant application servers, save the configuration, and restart all the relevant servers.
For information about adding the JVM property, refer to IBM WebSphere Application Server documentation by navigating to the following URL:
As part of Oracle Identity Manager cell creation using was_config.sh or was_config.bat, if you select additional templates, such as Oracle Entitlements Server (OES) template, then cell creation fails.
To avoid this issue, first create the cell with Oracle Identity Manager template only, and then extend the cell with additional templates as required.
When configuring the Identity Directory Service Profile in Oracle Entitlement Server Administration Console (System Configuration tab > IDS Profile > Open), a warning popup may display. For example: Cannot acquire a read-write connection; using a read-only connection instead.
This can occur when Identity Directory Service is attempting to connect to the Mbean Server. When connecting to the Mbean Server, an exception may be thrown indicating the attempt to create a listener failed. In this case, check the standard output (for example, SystemOut.log) of the corresponding server. Before the exception stack trace the cause of the failure will be mentioned. For example:
[9/17/12 4:58:16:286 PDT] 00000020 ORBRas E com.ibm.ws.orbimpl.transport.WSTransport createServerSocket WebContainer : 0 ORBX0390E: Cannot create listener thread. Exception=[ org.omg.CORBA.INTERNAL: CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_SERVER_SOCKET, Exception=org.omg.CORBA.INTERNAL: UNABLE_TO_CREATE_SSL_SERVER_SOCKET Exception=java.net.BindException: Address already in use vmcid: 0x49421000 minor code: 76 completed: No vmcid: 0x49421000 minor code: 77 completed: No - received while attempting to open server socket on port 9404 ]
The problem is a port conflict exists when trying to open a socket on a port that is already in use. For more information about this issue, see the following IBM technical note at: http://www-01.ibm.com/support/docview.wss?uid=swg21248645.
To workaround this issue, change the port settings to be dynamic (by specifying port="0" for specific endpoints in serverindex.xml) as discussed in the IBM technical note.
When Oracle Privileged Account Manager is running on IBM WebSphere, you cannot add CSF mappings corresponding to a Oracle WebLogic Server domain.
Similarly, when Oracle Privileged Account Manager is running on Oracle WebLogic Server, you cannot add CSF mappings corresponding to a IBM WebSphere cell.
In an Oracle Identity Manager 11g Release 2 (11.1.2.1.0) deployment that has been upgraded from Release 9.x, OIMAdmin Keys Credential might be lost if SOA communication issues for authentication are found in the logs. There errors can occur if the user in the first run has not set .xldatabasekey, which is a prerequisite for running MT in PRE_CONFIG_MODE.
The following is an example of logged error:
[oim_server1] [ERROR] [] [oracle.soa.services.workflow.worklist] [tid: WebContainer : 5] [ecid: disabled,0] [APP: oracle.iam.console.identity.self-service.ear] <Fatal Error occurred while authenticating with EJB identity propagation. Unable to get the workflow context using authenticate.getWorkflowContextFromSession> oracle.bpel.worklistapp.util.WorklistUtil
To workaround this issue:
Login to Oracle Enterprise Manager.
Right click Cell_Websphere, and select Security, Credentials.
Expand oracle.wsm.security.
Select OIMAdmin key, and click Edit. If OIMAdmin key does not exist, then create it by clicking Create Key in the oracle.wsm.security map.
In the Edit Key dialog box, enter the xelsysadm credentials.
Stop Oracle Identity Manager Server, SOA Server, and Admin Server in respective sequence. Stop node, and stop Manager.
Start Manager, sync node, and start node. Start Admin Server, SOA Server, and Oracle Identity Manager Server in respective sequence.
The following warnings, errors, and stack traces often appear in the oaam_admin log of OAAM on IBM WebSphere Application Servers, but do not have any effect on functionality:
Failed to register connection type (WARNING)
Could not load properties file bharosa_server.properties (ERROR)
Could not load properties file oaam_custom.properties (ERROR)
Unable to customize Oracle, OAAM, view, or DataBindings.cpx. Empty or null value for tip customization layer user (stack trace)
The operation on the resource, pages, or loginPageDef.xml failed because the source metadata store mapped to the namespace or BASE DEFAULT is read only (stack trace)
Exception while querying the ExalogicOptimizationsEnabled attribute (WARNING)
In an Oracle Identity Manager deployment on IBM WebSphere Application Server, performing any action on the Task Details page of the Inbox might throw ADFC-12000 errors.
To workaround this issue, close the browser session, and access the Task Details page in a new session.
When you configure the audit service to move audit records to the database, the Oracle Identity Federation busstop file at: %DOMAIN_HOME%/servers/%INSTANCE_NAME%/logs/auditlogs/OIF is updated. However these audit records are not populated in the database.
To resolve this, enter the wsadmin scripting environment and run the following command:
wsadmin>sts_commands.putStringProperty("/notifierconfig/CommonAuditListenerConfig/auditbusstop","%DOMAIN_HOME%/logs/%INSTANCE_NAME%/auditlogs")
This action should result in a "Command was successful." message.
All channels can not be SSL enabled between OIM and Database server on Websphere.
OIM application has three different channels to the database:
Data Sources
Direct DB for DDL operations
Custom registry
Of the three listed above, only the Data Source channel can be SSL enabled. To do so, add the following custom property on each data source:
Name: connectionProperties
Value:javax.net.ssl.trustStore=TRUST_STORE_LOCATION;javax.net.ssl.trustStoreType=JKS;javax.net.ssl.trustStorePassword=TRUST_STORE_PASSWORD;oracle.net.ssl_version=3.0
replace TRUST_STORE_LOCATION and TRUST_STORE_PASSWORD with appropriate values.
Oracle Enterprise Manager is accessible, but it does not reflect the exact state of the WebSphere cell. Although all the servers are running, they are shown as DOWN.
To workaround this issue, copy the dmsapp.jar file to both the DMS Application locations. To do so:
Locate the dmsapp.jar file inside was-dms.ear by unzipping new was-dms.ear to a directory.
Replace dmsapp.jar inside both the DMS Application locations with the new dmsapp.jar. The directory paths for both DMS Application locations are:
./was5012/profiles/Dmgr01/installedApps/DefaultCell01/Dmgr DMS Application_11.1.1.1.0.ear/dms.war/WEB-INF/lib/dmsapp.jar
./was5012/profiles/Custom01/installedApps/DefaultCell01/DMS Application_11.1.1.1.0.ear/dms.war/WEB-INF/lib/dmsapp.jar
Restart all servers including the Node Manager and the Deployment Manager.
If you create an end user name in Oracle Identity Manager that contains a pound symbol (#) character, that user will not be able to log into Oracle Privileged Account Manager.
To workaround this issue, avoid using the pound symbol (#) character in end user names that will be logging into Oracle Privileged Account Manager.
The following error is generated when launching the Patch Set Assistant from ORACLE_HOME/bin of Oracle Identity and Access Management installs on Solaris 10 machines configured with WebSphere:
WAS_HOME=<PATH to WAS_HOME>: is not an identifier
To workaround this issue:
Before invoking the PSA for patching on Solaris, apply Patch:16270302 from My Oracle Support (MOS) to the Oracle Identity and Access Management install location.
After upgrading Oracle Identity Manager Release 9.x to 11g Release 2 (11.1.2.2) on WebSphere, the provisioning of GTC-based connector fails with the following error:
Response: org.apache.commons.pool.ObjectPool Response Description: Unknown response received Setting task status... "org.apache.commons.pool.ObjectPool" does not correspond to a known Response Code. Using "UNKNOWN".
To workaround this issue:
Stop IBM WebSphere Application Server.
Copy the commons-pool-1.2.jar file from oim.ear/xlWebApp.war/WEB-INF/lib/ directory to the oim.ear/APP-INF/lib directory.
Restart IBM WebSphere Application Server.
In a single-node or clustered deployment of Oracle Identity Manager 11g Release 2 (11.1.2.2), when the Inbox tab is open, after the request submission if you close the Catalog Request tab or click the Back to Catalog button, then the following error is displayed:
ADF_FACES-60096:Server Exception during PPR, #1[[ com.ibm.websphere.servlet.error.ServletErrorReport: java.lang.ClassCastException: [Ljava.lang.Object; incompatible with org.apache.myfaces.trinidad.component.StampState$RowState
This error does not have an impact on any functionality of Oracle Identity Manager. To avoid this error, close the Inbox before closing the Request tab. Also, the error disappears on refreshing the page.
After upgrading Oracle Identity Manager 11g Release 2 (11.1.2.1) to 11g Release 2 (11.1.2.2), the Identity and Access option is not available in Oracle Enterprise Manager. This issue is applicable to single-node and clustered upgrade.
To workaround this issue:
Stop all servers including the Deployment Manager.
Create a directory called oim under the $WAS_HOME/profiles/DmgrProfileName/config/cells/DefaultCellName/fmwconfig/mbeans/ directory, if it is not already present.
Copy the following file:
$MW_HOME/Oracle_IDM1/server/setup/templates/was/oim-mbeans.xml
To the following directory:
$WAS_HOME/profiles/DmgrProfileName/config/cells/DefaultCellName/fmwconfig/mbeans/
Next, copy the following file:
$MW_HOME/Oracle_IDM1/server/setup/templates/was/oim-clustermbean.jar
To the following directory:
$WAS_HOME/profiles/DmgrProfileName/config/cells/DefaultCellName/fmwconfig/mbeans/oim/
Verify that patch 17894163 is applied on ORACLE_COMMON. If the patch is not applied, then apply it on ORACLE_COMMON by downloading it from My Oracle Support web site at:
Start all servers.
Redeploy Oracle Enterprise Manager. To do so:
Login to IBM WebSphere Administrative Console.
Select Applications, Application Types, Websphere Enterprise Applications.
Select the em option from the list, and then click Update.
Select the em.ear file, which is available in the $MW_HOME/oracle_common/sysman/archives/fmwctrl/app/ directory. Then, click Next.
Click Next.
Click Next.
Verify that the module maps to OracleAdminServer by default, and then click Next.
Click Finish.
After the deployment is done, click Save to save the configuration.
Restart OracleAdminServer.
You can now login to Oracle Enterprise Manager and verify that the Identity and Access option is available along with all the submenu options.
This section describes configuration issues and their workarounds. It includes the following topics:
Section 12.2.1, "SSLHandshakeException Error for Google and Yahoo IdP Partners"
Section 12.2.4, "Error Displayed When Accessing DMS Spy for Oracle Access Manager on IBM Websphere"
Section 12.2.6, "Error Generated When Extending an OAAM WebSphere Cell to Include OIM Template"
Section 12.2.8, "Configuring Database Security Store Fails When the -D Path Contains "\r""
Section 12.2.9, "New IDS Profile Requires OES Server Restart"
Section 12.2.10, "Oracle Identity Manager Silent Installation Fails Without the -force Option"
Section 12.2.11, "Prerequisite Check Fails in Oracle Identity Manager Silent Installation"
Section 12.2.12, "The wsadmin Script Throws MissingResourceException"
When you integrate Access Manager with Identity Federation, and configure a Google or Yahoo IdP partner for federated SSO on IBM WebSphere application server through the OpenID protocol, you may see an SSLHandshakeException error when you attempt to access the resource.
For a Google partner, the error is as follows:
oracle.security.fed.controller.library.LibraryException:
oracle.security.fed.controller.frontend.action.exceptions.ResponseHandlerExcep
tion: oracle.security.fed.util.http.HttpException:
javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: PKIX path building
failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl
could not build a valid CertPath.; internal cause is:
java.security.cert.CertPathValidatorException: The certificate issued
by OU=XXX Secure Certificate Authority, O=XXX, C=US is not trusted;
...
For a Yahoo partner, the error is as follows:
[2013-02-15T15:18:58.747-08:00] [oam_server1] [WARNING] [OAM-12001]
[oracle.oam.audit] [tid: WebContainer : 5] [ecid: disabled,0] [APP:
oam_server_11.1.2.0.0] Cannot load audit configuration.
[2013-02-15T15:18:58.749-08:00] [oam_server1] [WARNING] [OAM-12001]
[oracle.oam.audit] [tid: WebContainer : 5] [ecid: disabled,0] [APP:
oam_server_11.1.2.0.0] Cannot load audit configuration.
[2013-02-15T15:18:58.750-08:00] [oam_server1] [WARNING] [OAM-12001]
[oracle.oam.audit] [tid: WebContainer : 5] [ecid: disabled,0] [APP:
oam_server_11.1.2.0.0] Cannot load audit configuration.
[2013-02-15T15:18:59.136-08:00] [oam_server1] [ERROR] [FEDSTS-12078]
[oracle.security.fed.controller.library.api.FedEngineInstance] [tid:
WebContainer : 5] [ecid: disabled,0] [APP: oam_server_11.1.2.0.0] Library
Exception: {0}[[
oracle.security.fed.controller.library.LibraryException:
oracle.security.fed.controller.frontend.action.exceptions.ResponseHandlerExcep
tion: oracle.security.fed.util.http.HttpException:
javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: PKIX path building
failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl
could not build a valid CertPath.; internal cause is:
java.security.cert.CertPathValidatorException: The certificate issued
by CN=XXX Root, OU="XXX, Inc.", O=XXX Corporation, C=US is not trusted;
...
This error is due to missing Yahoo/Google SSL certificates.
You need to import the Yahoo/Google SSL certificates into the IBM JSSE Trusted keystore.
First obtain the SSL certificates.
Using the Firefox browser, go to the https URL that is being accessed.
After viewing the page, right click on the page, then view page info, then details, then view certificate, then details tab.
Click export, then save.
Next, import the certificates into the keystore using the instructions provided in the following IBM Technote:
http://www-01.ibm.com/support/docview.wss?uid=swg21588087
Note: When executing the keytool command in Step 6 of the Technote:
The alias is whatever string you want to use to reference that certificate afterwards.
If you are not sure which cacerts to use, import the certificates to all the cacerts keystores.
Note: You may need to download Equifax certification from this URL:
http://www.geotrust.com/resources/root-certificates/index.html
Under Root Certificates, download Root1 - Equifax Secure Certificate Authority (.pem file).
Import this certificate using the steps described above.
In an Oracle Entitlements Server on IBM WebSphere environment, controlled-push policy distribution fails when the parameter oracle.security.jps.config is not configured. The oracle.security.jps.config parameter is configured to be the location of the jps-config.xml file. If this setting is missing, then policy distribution may fail in an IBM WebSphere environment. The configuration parameter is required for the policy distribution to succeed.
When you run the ORACLE_HOME/common/bin/wsadmin.sh script on Solaris Sparc64 5.10 machines, to configure Fusion Middleware products in a cell on IBM Websphere Application Server, the following error is displayed:
./wsadmin.sh: test: argument expected
Workaround:
Replace the following line in the ORACLE_HOME/common/bin/setWsadminEnv.sh file
if [ ! $WSADMIN_SCRIPT_LIBRARIES ]; then
with
if [ ! "${WSADMIN_SCRIPT_LIBRARIES}" ]; then
After making this change, re-run the ORACLE_HOME/common/bin/wsadmin.sh script to complete the configuration.
If you have not configured an external LDAP such as OID or OVD, and you try accessing DMS Spy servlet for Oracle Access Manager on IBM Websphere, the following error is displayed:
Error 403: AuthorizationFailed
If you have not created a user in the external LDAP with Admin roles, then the wsadmin user is not allowed to log in to DMS Spy by default. You must manually associate the wasadmin user with Admin roles to be able to log in.
Workaround:
Complete the following steps:
Log in to the IBM Console.
On the left pane, go to Applications > Application Types > WebSphere enterprise applications.
On the right pane, click on Dmgr DMS Application_11.1.1.1.0.
Click on Security role to user/group mapping.
Select Admin role and click on Map Users... button.
Type wasadmin in the search string and click on Search button.
Select wasadmin in the Available box and click on --> arrow.
Click OK to return to the previous page.
Click OK again.
Click Save directly to the master configuration.
Start Dmgr DMS Application_11.1.1.1.0.
Repeat the above step for DMS Application_11.1.1.1.0
If you provide a Sun JDK as the value for the -jreLoc parameter when installing Oracle Identity and Access Management components on IBM WebSphere, the installation is successful. However, when you try to configure Oracle Identity Manager Server, Design Console, and Remote Manager using the Oracle Universal Installer Configuration Assistant, the configuration fails.
Workaround:
Open the orapram.ini file located in the Oracle_Home/oui directory.
Search for JRE_LOCATION.
Change the value of the JRE_LOCATION to point to an IBM JDK.
Save the orapram.ini file.
Start the Oracle Universal Installer Configuration Assistant by running the config.sh file (on UNIX) or config.bat file (on Windows), located in the OIM_HOME/bin directory.
When you run the was_config command to extend an Oracle Adaptive Access Manager cell to include the Oracle Identity Manager template, you may see the following warning:
Conflict detected CFGFWK -42001: The following duplicate elements exists in a configuration, discarding new elements from a incomming template
You can safely ignore this error message.
If you are performing a silent installation of Identity and Access Management components on Solaris Sparc64 with WebSphere, then the configuration fails with the following error:
Java HotSpot(TM) 64-Bit Server VM warning: Exception java.lang.OutOfMemoryError occurred dispatching signal SIGTERM to handler-the VM may need to be forcibly terminated
Workaround:
To avoid this issue, add -javaoption "-XX:MaxPermSize=512m" in the wsadmin.sh command, as shown below:
IDM_HOME/common/bin/wsadmin.sh -f config_soa.py -profileName Dmgr01 -javaoption "-Doracle.cie.log=PATH/cielogs/config_soa_cie_debug.log -Doracle.cie.log.priority=debug" -javaoption "-XX:MaxPermSize=512m"
When you configure the Database Security Store using the configureSecurityStoreWas.py script on Windows operating systems, the configuration fails if the path specified with the -d parameter contains \r.
After adding an IDS profile and binding an application to the profile, you must restart the OES server for the new profile to function properly; otherwise, when you perform user/group searches on the bound application in APM, an error occurs and no search results are returned. The workaround is only required on IBM Websphere.
On a bare OS machine that does not have the libXext.so files, if you run the runInstaller command by setting the DISPLAY variable and do not use the -force option with the command, then the command fails with an error. To avoid this issue, perform any one of the following:
Do not set the DISPLAY variable, or remove the DISPLAY variable setting, as shown:
unsetenv DISPLAY
Run the runInstaller command with the headless option set to true, as follows:
./runIsntaller -J-Djava.awt.headless=true OTHER_ARGUMENTS
While silently installing Oracle Identity Manager on a bare OS machine without the X libraries, the installation completes successfully, bug the prerequisite check fails with the following error message:
Expected result: One of oracle-6,oracle-5.6,enterprise-5.4,enterprise-4,enterprise-5,redhat-6.1,redhat -6,redhat-5.4,redhat-4,redhat-5,SuSE-10,SuSE-11 Actual Result: oracle-Oracle Check complete. The overall result of this check is: Failed
To workaround this issue, install lsb_release rpm or pass the -ignoreSysPrereqs parameter with the runInstaller command.
While running the wsadmin scripts for silent configuration for cell, the following exception is logged:
java.util.MissingResourceException: Can't find resource for bundle
java.util.PropertyResourceBundle, key _shortDescription
at java.util.ResourceBundle.getObject(ResourceBundle.java:421)
at java.util.ResourceBundle.getString(ResourceBundle.java:435)
at com.oracle.cie.domain.script.help.Help.getHelpTopic(Help.java:561)
This is benign exception and can be ignored.
This section describes upgrade issues and their workarounds. It includes the following topics:
Section 12.3.1, "Errors Displayed When Running Patch Set Assistant on Solaris 10"
Section 12.3.2, "Some Approval Policies Not Deleted After Upgrade"
Section 12.3.3, "Exception When Upgrading Oracle Identity Manager Middle Tier"
On Solaris 10 machines, when you run the Patch Set Assistant for patching Oracle Identity and Access Management on WebSphere application server, the following error is displayed:
WAS_HOME=<PATH to WAS_HOME>: is not an identifier
Workaround:
Before running the Patch Set Assistant on Solaris 10 machines, you must download and apply the patch number 16270302 to the IAM_ORACLE_HOME directory.
To download the patch, do the following:
Log in to My Oracle Support.
Click Patches & Updates.
Select Patch name or Number.
Enter the patch number.
Click Search.
Download and install the patch.
The patching instructions are provided in the README.txt file that is provided with the patch.
In an Oracle Identity Manager 11g Release 2 (11.1.2.1.0) deployment on IBM WebSphere Application Server that has been upgraded from Release 9.x, some approval policies are not deleted.
To delete the policies, manually run the following SQL script:
DECLARE BEGIN DELETE FROM REQUEST_APPROVAL_POLICIES WHERE RAP_POLICY_NAME in ( 'AssignRolesWithCallbackRL', 'AssignRolesWithCallbackOL', 'CreateRoleWithCallbackRL', 'CreateUserWithCallbackRL', 'CreateUserWithCallbackOL', 'DeleteRoleWithCallbackRL', 'DeleteUserWithCallbackRL', 'DeleteUserWithCallbackOL', 'DisableUserWithCallbackOL', 'DisableUserWithCallbackRL', 'EnableUserWithCallbackRL', 'EnableUserWithCallbackOL', 'ModifyRoleWithCallbackRL', 'ModifyUserWithCallbackRL', 'ModifyUserWithCallbackOL', 'RemovefromRolesWithCallbackRL', 'RemovefromRolesWithCallbackOL'); COMMIT; END; /
This issue occurs when you upgrade Oracle Identity Manager 9.1.x.x to 11.1.2.2.0. The following exception is displayed when you upgrade Oracle Identity Manager middle tier:
Error Code: 900 Call: EXECUTE PROCEDURE OIM_RECOMPILE_DB_OBJECTS() Query: DataModifyQuery() Dec 16, 2013 10:15:39 PM com.thortech.util.logging.Logger info INFO: Result Size = 1 PACKAGE STATUS = VALID Dec 16, 2013 10:15:39 PM com.thortech.util.logging.Logger info INFO: Recompiling packages - RDBMS [EL Warning]: 2013-12-16 22:15:39.957--ClientSession(476657190)--Exception [EclipseLink-4002] (Eclipse Persistence Services - 2.3.1.v20111018-r10243): org.eclipse.persistence.exceptions.DatabaseException Internal Exception: java.sql.SQLSyntaxErrorException: ORA-00900: invalid SQL statement
This is a benign exception and can be ignored.
This section describes documentation errata. It includes the following topics:
When using the Oracle Identity Manager Configuration Assistant, the online help for the configuration screens does not describe the IBM WebSphere-specific options. For more information about the IBM WebSphere options, see "Configuring Oracle Identity Manager for Single-Node Setup" in the chapter, "Managing Oracle Identity Manager on IBM WebSphere" in the Oracle Fusion Middleware Third-Party Application Server Guide for Oracle Identity and Access Management.