1 Release Notes

New Support for Running Services Gatekeeper on Oracle Linux 7.2

New in this release, Services Gatekeeper is now supported to run on Oracle 7.2 (64-bit).

New Support for Virtual Platforms

This release of Services Gatekeeper is supported to run on these virtual platforms:

• VMware ESXi 5.5

• Oracle Virtual Machine 3.2.9

New Support for Oracle 12 RAC

Services Gatekeeper now supports the Oracle 12c RAC database, which now appears as an option in the installation GUI.

New Support for Oracle 12c CDB and PDB

Services Gatekeeper now supports the Container Database (CDB) and Pluggable Database (PDB) versions of the Oracle 12c database.

New MySQL/Oracle Database Options for Single-Tier Services Gatekeeper

You can now use the single-tier version of Services Gatekeeper with the MySQL or Oracle 12c databases. See (Optional) Installing a Different Database in Services Gatekeeper Getting Started Guide for details.

The JavaDB Port is Now Configurable

The single-tier installation GUI page now offers you the chance to change the default JavaDB port. It displays the default port, 1547, which you can change to any port number you use.

New Enhancements to the Json2Xml Action

The Json2Xml API management action now:

• Offers the instanceid, Default Name Space, and Root Tag attributes. See Json2Xml in Services Gatekeeper API Management Guide for details.

• Supports moving data directly from the request input stream to the output stream. See Common Actions Programming Tasks in Services Gatekeeper API Management Guide for details.

New Access URLs for the PRM Portals

You now access the portals by using these new URLs:

• Partner and API Management Portal:

  http://IP_address:port/portal/partner-manager/index/login.html

• Partner Portal:

  http://IP_address:port/portal/partner/index/partnerLogin.html

• Network Service Supplier Portal:

  http://IP_address:port/portal/service-supplier/index/ssLogin.html

The old URLs were:

• http://IP_address:port/partner-manager/index/login.html

• http://IP_address:port/partner/index/partnerLogin.html

• http://IP_address:port/service-supplier/index/ssLogin.html

New Ability to Add Your Own Custom Actions for APIs

You can now create your own custom Actions to add to the Partner and API Management portal for use by all your APIs. In previous releases, you could apply custom code to the Groovy action, but you were required to propagate that code across all APIs. Custom actions that you create are available to all your APIs. See ”Creating Custom Actions for Your APIs” in Services Gatekeeper Portal Developer's Guide for details.

IPv6 Mapping No Longer Required

In previous releases, using IPv6 addresses when configuring domains required that you create a mapping file. This step is no longer required. Instead, add the IPv6 addresses to the configuration GUI in square brackets "[]" when configuring domains.

New Actions and Features Available for API Actions

This section lists the new features available as actions for your APIs.

New API Management Options for Securing the Services Gatekeeper Methods

New in this release, Services Gatekeeper offers expanded options for authorizing applications to use the Services Gatekeeper API methods. You make this selection when you create each API using the Partner and API Management Portal. The Exposed API Security options allow you to use a combination of text-based and OAuth authorization, or use an application key (sometimes called an API key). If you use the application key option, Services Gatekeeper checks the query parameter first, then the header for the key. You can override this option using the AppKeyAuthorization action.

New Ability to Protect REST APIs with a While List of IP Addresses

New in this release, you have the ability to protect REST-based APIs by creating a list of IP addresses that are solely allowed to communicate with the Services Gatekeeper application tier (AT). You use a special key/value pair created for the updateAllSysConfig operation to create the list. See ”Protecting REST APIs with a White List of IP Addresses” in Services Gatekeeper Security Guide for details.

New Option to Create an API Without Authentication

In some cases automatic authentication is impractical for APIs, and new in this release you can create an API without a default authentication method. You can also authenticate it using an application key. See "New Action to Authenticate Applications Using Application Key" for a description.

New EDR/Alarm for ApiFirewall Violations

New in this release, the CreateViolationEdrs attribute has been added to the ApiFirewallMBean. This attribute is boolean, and the default value is true. In the event of a firewall violation, it creates an EDR and alarm for the violation.

See ”Configuring Network Traffic Security with ApiFirewallMBean” in Services Gatekeeper Security Guide for details.

API Management Now Accepts HTTP Delete Actions

In the Services Gatekeeper 6.0 release, the API management features did not allow RESTful HTTP DELETE operations on backend services. This has been changed and DELETE actions are now supported for use with API management.

New Clarification on Using Variables and Wildcards for API Resource Mapping

The new ”About Presenting APIs to Your Customers” section in Services Gatekeeper API Management Guide clarifies the mapping scheme that you can use to map the URLs in request messages to the URIs of actual API resources or services. This mapping allows you to create a different internal URL structure for your API services than you present to customers. This is particularly useful for REST-based communication, and allows you to change your internal URI scheme without requiring customers to change their existing request messages.

New Subscription Management Features

These new subscription management features are available for use with communication services:

• Changes to the loadAppSubscriptionsXml operation of the SubscriptionPluginMBean:

  • expirePeriod has been added. It scans for expired subscriptions. Set in minutes.

  • subscribeInfo.notification is now optional. In previous releases it was mandatory.

  • unsubscriptInfo.notification is now optional. In previous releases it was mandatory.

  • suspendInfo.notification is now optional. In previous releases it was mandatory.

  • unsuspendInfo.notification is now optional. In previous releases it was mandatory.

• The loadAppSubscriptionsXml operation now also includes the appendingExpirePeriod parameter.

• Subscription operations are now atomic.

• Subscription expiration behavior has changed. Services Gatekeeper now checks whether the subscription has expired each time it receives a retrieval request.

See ”Application Subscription Management” in Services Gatekeeper Communication Service Reference Guide for information on subscription management.

New Option to Create Applications Without APIs

New in this release, Partners can use the Partner Portal to create applications without first subscribing to an API. Partners have the option to subscribe APIs to applications after the application has been created and approved by the partner manager.

New Ability to Use 24- and 32-Byte Application Passwords

New in this release, Services Gatekeeper now takes advantage of the Java Cryptography Extension (JCE) features to allow you to use 24- and 32-byte passwords to protect applications. See ”Encrypting Application Passwords” in Services Gatekeeper Security Guide for instructions.

EDR Enhancements for API Management

This section lists the EDR enhancements that have been added since the last documentation reposting. See ”Managing and Configuring EDRs, CDRs, and Alarms” in Services Gatekeeper System Administrator's Guide for details these new features.

New Functionality for APIs

This section lists new and improved features for Services Gatekeeper APIs.

http://IP_Address:port:/daf/WeatherAPI/1

http://IP_Address:port/WeatherSouthWestAPI

http://IP_addr:port_no/api_name/version_no

http://IP_addr:port_no/daf/api_name/version_no

url:/daf/api_name/version

url:/api_name/version

Support for the New Diameter Timestamp Data Type - May Require that You Update Your Code

The Diameter specification has changed with regard to the timestamp data type. The old Diameter data type that previous releases of Services Gatekeeper supported defined a Diameter timestamp as an integer (seconds since from the start of the year 1970). Services Gatekeeper now supports the newer Diameter stack (version 6.3.0.1 and later) that defines a timestamp as Type.TIME_BYTES (number of seconds since the start of the year 1900). This type acts like a byte buffer, but limits the length of the buffer to 4 bytes.

New Non-Standard Diameter Rx AVP Support for QoS Features

Services Gatekeeper now supports these Diameter Rx AVPs to implement with QoS features. These AVPs are not included in the Diameter Rx 3GPP TS 29.214 Specification, but are supported by Services Gatekeeper.

• FramedPort - for Rx AAR messages

• requiredAccessInfo - for Rx AAR messages

• endUserOpaqueId - for Rx AAA messages

• msTimeZone - for Rx AAAmessages

• userLocationInfo - for Rx AAA messages

• apnAMBRUL - for Rx AAA messages

• apnAMBRDL - for Rx AAA messages

See "Non-Standard Supported Diameter AVPs" in Services Gatekeeper Statement of Compliance for details on these AVPs.

New Support for JavaDB with Multi-tier Services Gatekeeper

The Oracle JavaDB database is now supported for use with multi-tier implementations of Services Gatekeeper. Specifically, this database is appropriate for testing and smaller production implementations. JavaDB is embedded in Services Gatekeeper so you do not have to obtain it separately. If security and performance are not issues, you can also install this database on the same physical system as the Services Gatekeeper Administration server and managed servers. See ”Database Planning” and ”Installing JavaDB Software” in Services Gatekeeper Multi-tier Installation Guide for details on installing this database.

New Custom Native SMPP Error Code for Custom Interceptors

It is now possible to specify a custom SMPP errorcode to be used with SubmitSmResp/SubmitSmMultiResp methods. The new error code is designed to be sent back to a Native SMPP client in cases where the SubmitSm/SubmitSmMulti action is rejected by a custom interceptor.

If the custom interceptor wants to reject the SubmitSm/SubmitSmMulti request, it can specify the SMPP command status to send back to the Native SMPP client by throwing a DenyPlugin Exception created on this form:

new_DenyPluginException("custom_smpp_errorcode", <smpp commandstatus in decimal form>)

For example if the interceptor throws a new PluginDenyException("custom_smpp_errorcode", 123); the SubmitSmResp/SubmitSmMultiResp sends the 0x0000007b (hex 7b = 123 decimal) command status back to the Native SMPP client.

New Attributes for Native SMPP MO Messages

These MBean attributes have been added to the Native SMPP communication service MBean (SMPPServiceMBean) to process mobile-originated messages:

• rejectMOMessagesWithNoAppReceiverConnection

  Mobile-originated native SMPP communication service requests are successful only if Services Gatekeeper has a connection to both a receiver (SMSC), and an application that accepts DeliverSm. The default behavior is to reject any request that does not have these two connections, but the message is processed by the interceptor stack before probing for the Services Gatekeeper-application connection

  If the new attribute is set to TRUE, Services Gatekeeper probes for the application connection before the interceptor stack, which is faster and more efficient than the default behavior.

  SMPP mobile originated connection errors generate alarm 400514. See ”400514 SMPP Server Service: MO Request Failed” in Service Gatekeeper Alarms Handling Guide for details.

• native_smpp_mo_destAddressHasAppMapping

  This attribute is checked at the MO_SOUTH interception point.

  If TRUE an application matching the destination address in DeliverSm exists.

  If FALSE, no application matching the destination address is in DeliverSm.

• native_smpp_mo_hasActiveReceiver

  This attribute is only be checked at the MO_NORTH interception point.

  If TRUE, the application has an active receiver connection.

  If FALSE, the application has no active receiver connection.

See ”Native SMPP” in Services Gatekeeper Communication Services Reference Guide for details on this communication service.

Database Rollback Issue for Later Patchsets

After upgrading, if you need to rollback your Services Gatekeeper implementation, the database schema automatically reverts to the 6.0 + patchset 2 level.

See "Upgrade Restrictions" in Services Gatekeeper Multi-tier Installation Guide for details on this issue.

Message Payload Size Limitation

The maximum message payload size for the Dynamic Application Programming Interface Framework (DAF) that handles HTTP to HTTP traffic is 200 MB.

Known Issues

Table 1-2 lists the other known issues in this release.

{"requestError":{"serviceException":{"messageId":"SVC0001",
"text":"A service error occurred. Error code is 
%1","variables":["Not support oneAPI binary
message!"]}}}

      <property>
        <name>useSSL</name>
        <value>false</value>
      </property>

<Warning> <DeploymentService> <BEA-290064>
<Deployment service servlet encountered an exception while
handling the deployment service message for request id "-1" from
server "WLNG_AT1". Exception is: "java.io.OptionalDataException

<Error> <Cluster> <BEA-003122> <ORA-00942: table or view does 
not exist: A cluster that has migratable servers could not
create/execute SQL statement when validating the database
connection. The cluster is misconfigured. Check the leasing table
on the database and connection configuration.>

Replicated call
state manager could not initialize all partitions'

<New view for partition part-1: Partition viewId=0 Name=part-1
CreatingReplicaId:Name=0:Node1 Replicas=[0:Node1]>

Understanding the API Management Proxy Settings

These options determine the proxy settings that your APIs use. They are enforced in this order (the last one wins):

1. The Java operating system proxy settings (http.proxyHost, http.proxyPort, https.proxyHost, and https.proxyPort).

   See the Java documentation for instructions on how to configure these settings.

2. The proxy server that you enter in the Network Proxy field in each API.

   See Services Gatekeeper Partner and API Management Portal Online Help for information on using this field.

3. Creating a proxy object in a Groovy action in each API.

   See ”Using Actions to Manage and Manipulate API Traffic” in Services Gatekeeper API Management Guide for details on the actions you can create for each API.

Understanding API HTTP/HTTPs Proxy Access

The Network Proxy ip_address:port entry that each API can use supports both http and https API service URLs. For example, set Network Proxy to cn-proxy.jp.mydomain.com:80:

• If you specify an http service URL, the resulting proxy setting is http.proxyHost=cn-proxy.jp.mydomain.com, http.proxyPort=80

• If you specify an https service URL, the resulting proxy setting is https.proxyHost= cn-proxy.jp.mydomain.com, https.proxyPort=80

Setting the EDR Types to Send to EdrService

These descriptions for the EDR types were inadvertently left out of the documentation set. These settings determine what types of EDRs are sent out from EdrService

• publish_programmable_edr (Boolean) - Default: true. Sends out EDRs created manually by EdrDataHelper. These EDRs do not have a state attribute.

• publish_facade_edr - (Boolean) - Default: false. Sends out EDRs created in the AT. The state is either ENTER_AT or EXIT_AT. The default is false because all of these EDRs are created for EDR analytic already.

• publish_enabler_edr - (Boolean) - Default: true. Sends out EDRs with a state of either ENTER_NT or EXIT_NET.

• publish_protocalStack - (Boolean) - Default: true. Sends out EDRs with a state of either ENTER_NET, or EXIT_NT.

• publish_others_edr - (Boolean) - Default: true. Sends out all other EDRs; they do not have a state attribute, however their interface is set to other.

When Services Gatekeeper is in EDR analytic mode, be sure the change these settings to:

• publish_programmable_edr - false

• publish_facade_edr - true

• publish_enabler_edr - true

• publish_protocalStack - true

• publish_others_edr - false

You use the Administration Console (OCSG, then servername, then Container Services, then Attributes), or EdrServiceMBean in the OAM Java API Reference to change these settings. See ”When EDRs are Generated” in Services Gatekeeper System Administrator's Guide for more information on EDRs and EDR states

Client HTTP Headers Not Passed to Your Network Service

Services Gatekeeper automatically passes all HTTP headers from an application (client) to your network service, except the those listed in this section. If your network service requires them, you can create a Groovy action that gets them from the incoming message, and sets them on the outgoing message.

• Proxy-Authorization

• Authorization

• Content-Length

• Transfer-Encoding

• Transfer-Encoding

• Host

• OCSGOAuthBearer

• OCSGOAuthMAC

• Anonymous

• OCSGProxy-Authorization

• OCSGSoapHeader

• OCSGAppKeyHeader

The information in these sections will help you create the custom groovy action:

• ”Printing and Changing Message Content” in Services Gatekeeper API Management Guide.

• ”Creating Custom Actions for Your APIs” in Services Gatekeeper Portal Developer's Guide.

Implementing a Backend Service Protected by HTTPS

Services Gatekeeper supports exposing a Southbound URL secured with HTTPS, by first importing the required website certificate to the WebLogic server truststore.You add the required certificate to the WebLogic server truststore (DemoTrust.jks file) by running this keytool command from the install_home/wlserver/server/lib directory:

keytool -import -alias myCa1 -trustcacerts -file $cert_file -keystore DemoTrust.jks -storepass store_password

For example:

keytool -import -alias myCa1 -trustcacerts -file $myCertFile -keystore DemoTrust.jks -storepass trustme199

See ”Configuring Keystores” and ”Keytool Command Summary” in Fusion Middleware Administering Security for Oracle WebLogic Server for general information on creating keystores and details on the keytool command.

Incorrect Filenames for Creating Custom Actions

The ”Creating and Adding a Custom Actions to Services Gatekeeper” section in Services Gatekeeper Portal Developer's Guide contains references to the wrong files in step 5. The correct files to add to your Java compiler CLASSPATH are:

• Gatekeeper_home/ocsg/dynamic-action/oracle.sdp.registration.prs_release_level.jar.

• The /WEB-INF/lib/oracle.sdp.daf-release_level-SNAPSHOT.jar file in Gatekeeper_home/ocsg/applicatons/daf.war (unzip the .war file).

Incorrect Name for OneAPI MMS Response Field

The ”OneAPI Multimedia Messaging/MM7” chapter of the Services Gatekeeper Communication Service Reference Guide was based on an incorrect specification document. It erroneously specified the deliveryInfoList field instead of the correct deliveryInfoNotification field in OneAPI MMS delivery notification messages. The document has been corrected.

Corrections to How Sessions Operate with the validityTime Field

These additions to the description of the getSessionRemainingLifeTime operation to the SessionManager WSDL file were left out of the Services Services Gatekeeper Application Developer's Guide: