This document describes the bug fixes that are included with Bundle Patch 12.2.1.3.200813.

The Bundle Patch requires a base installation of Oracle Access Management Webgate 12c (12.2.1.3.0). This document supersedes the documentation that accompanies Oracle Access Management 12c (12.2.1.3.0), and earlier documents if any. This document contains the following sections:

1.1 Understanding the Webgate Bundle Patch

Describes Bundle Patches and explains differences between Bundle Patches, patch set exceptions (also known as one-offs), and patch sets.

Topics

1.1.1 WebGate Bundle Patch Introduction

A bundle patch is an official Oracle patch for Oracle Access Management components on baseline platforms. In a bundle patch release string, the fifth digit indicated the bundle patch number. Effective November 2015, the version numbering format has changed. The new format replaces the numeric fifth digit of the bundle version with a release date in the form "YYMMDD" where:

  • YY is the last 2 digits of the year

  • MM is the numeric month (2 digits)

  • DD is the numeric day of the month (2 digits)

Each bundle patch includes the libraries and files that have been rebuilt to implement one or more fixes. All of the fixes in the bundle patch have been tested and are certified to work with one another.

Each bundle patch is cumulative: the latest bundle patch includes all fixes in earlier bundle patches for the same release and platform. Fixes delivered in bundle patches are rolled into the next release.

Bundle patches are released on a regular basis and are available on My Oracle Support (formerly Oracle MetaLink).

Note:

To remain in an Oracle-supported state, Oracle recommends that you apply the bundle patch to all installed components for which packages are provided.

Table 1-1 Bundle Patches versus Patch Sets

Mechanism Description

Bundle Patch

A bundle patch is an official Oracle patch mechanism for Access Manager components on baseline platforms. Each bundle patch includes the libraries and files that have been rebuilt to implement one or more fixes.

This bundle patch must be applied to Access Manager 12.2.1.3.0 WebGates.

See Also: Before Installing this WebGate Bundle Patch

Patch Set

All of the fixes in the patch set have been tested and are certified to work with one another on the specified platforms.

Each patch set provides the libraries and files that have been rebuilt to implement bug fixes (and new functions, if any). However, a patch set might not be a complete software distribution and might not include packages for every component on every platform.

1.2 WebGate Bundle Patch Requirements

Requirements for this WebGate release are discussed in the following topics:

1.2.1 WebGate Bundle Patch 12.2.1.3.200813

Access Manager 12c Release (12.2.1.3.0) WebGates are the required base for WebGate Bundle Patch 12.2.1.3.200813.

Note:

  • On AIX platform, along with WebGate Bundle Patch 12.2.1.3.200813, an additional OHS patch has to be applied for OHS server to function as expected.

    OHS patch for AIX- Patch ID: 31750289

  • On 12c Solaris WebGate, before starting the OTD server, add WebGate's lib dir in the LD_LIBRARY_PATH, this will ensure the libcurl getting bundled with the WebGate is loaded with the path if deafult libcurl is not found.

    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:<OTD Install directory>/webgate/otd/lib/

    Also, please note the Solaris 12c WebGate is not certified with OIDC flows.

See Also:

Certification Documentation for details about certification, installers, and downloads.

1.2.2 Bundle Patch Recommendations

Oracle recommends that you apply the WebGate bundle patch to all installed WebGates for which a bundle patch is provided.

Oracle also recommends that OAM Server components be at the same (or higher) bundle patch level as the installed 12c WebGate.

If you have ... Perform Following Steps...

12.2.1.3.0 Webgates

Apply the WebGate bundle patch:

1.3 Before Installing this WebGate Bundle Patch

Before installing this bundle patch, Oracle recommends that you review this section and follow these instructions carefully:
  1. Ensure that your system configuration is at the appropriate level:

    • Access Manager 12.2.1.3.0

    • Supported Operating System

    • Supported Web server release and type

  2. Confirm that any currently installed bundle patch level is lower than the one you intend to install.
  3. There is no need to remove an earlier bundle patch before installing a later one.
  4. Windows 64-bit OS: See Preparing 64-Bit Oracle HTTP Server 12c WebGates on Windows 2012 64-Bit Platforms

    Note:

    If your system configuration does not meet support requirements, or if you are not certain that your system configuration meets these requirements, Oracle recommends that you log an Service Request to get assistance with this bundle patch. Oracle Support will make a determination about whether you should apply this bundle patch or not.

1.4 Installing and Removing the Webgate Bundle Patch

This section contains the following topics to guide you, as you prepare and install the WebGate files (or as you remove a WebGate, should you need to revert to your original installation):

1.4.1 Preparing All Environments and Downloading the Bundle Patch

This section introduces the Oracle patch mechanism (Opatch) and requirements that must be met before applying the bundle patch. Opatch is a Java-based utility that runs on all supported operating systems and requires installation of the Oracle Universal Installer.

Note:

Oracle recommends that you have the latest version of Opatch (version 13.9.4.2 or higher) from My Oracle Support. Opatch requires access to a valid Oracle Universal Installer (OUI) Inventory to apply patches.

The patching process uses both unzip and Opatch executables. After sourcing the $ORACLE_HOME environment, Oracle recommends that you confirm that both of these exist before patching.

Perform steps in the following procedure to prepare your environment and download the bundle patch. Due to formatting constraints in this document, some sample text lines wrap around. These line wraps should be ignored.

Note:

Ignore line wrapping in syntax examples and ignore steps that do not apply to your environment or intended Opatch use.

Unless explicitly identified as relevant to only a specific condition, all steps apply to all Opatch environments. Steps that relate to only a specific condition are identified with a bold condition.

To prepare your environment and download the bundle patch:

  1. Download Opatch version 13.9.4.2 as follows:

    Note:

    If you already have Opatch, enter opatch -help to learn the version. You must download the 13.9.4.2 or later version.
  2. Confirm and add required executables to your system PATH:

    • Check your $ORACLE_HOME to confirm that it is pointing to the right Webgate$ORACLE_HOME.

    • Confirm the required executables are in your system PATH, and add these if needed:

      which opatch

      which unzip

    To add the required executables to your system path, you need to add the path of Opatch in PATH variable using the following: 

    export PATH=$ORACLE_HOME/OPatch:$PATH
  3. Verify the OUI Inventory using one of the following commands:
    opatch lsinventory

    or

    opatch lsinventory -jdk [Path to jdk8]

    If an error occurs, contact Oracle Support and work to validate and verify the inventory setup before proceeding.

  4. On the machine that will host the bundle patch files, create a directory to store the unzipped patch (referenced later as PATCH_TOP). For example:

    Linux: /home/12.2.1.3.0/tmp

    AIX: /opt/12.2.1.3.0/tmp

    Solaris: /opt/12.2.1.3.0/tmp

    Windows: C:\12.2.1.3.0\tmp

  5. Retrieve the Bundle Patch:

    • From My Oracle Support, click the Patches & Updates link.

    • Enter the Patch ID or Number, then click Search to display a Patch Search Results table.

    • Using the Release and Platform columns, find the desired patch, then click the associated Patch ID.

    • Download: In the page that appears, click the Download button to retrieve the packages.

  6. Unzip the patch zip file into the PATCH_TOP directory you created earlier. For example:
    unzip -d PATCH_TOP p31750289_122130_platform.zip
  7. Proceed as needed for your environment:

1.4.2 Preparing 64-Bit Oracle HTTP Server 12c WebGates on Windows 2012 64-Bit Platforms

If you are using Windows 2012 64-bit operating systems, you must install updated Microsoft Visual C++ 2010 libraries on the machine hosting the Oracle HTTP Server 12c Webgate for Oracle Access Manager.

To install Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package MFC Security Update

Install the Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package MFC Security Update for X64 systems, which can be downloaded from the following Web site:

https://www.microsoft.com/en-us/download/details.aspx?id=26999

Proceed to Installing a WebGate Bundle Patch on any Platform

1.4.3 Installing a WebGate Bundle Patch on any Platform

This section describes how to install WebGate bundle patches on any platform using Oracle patch (Opatch). While individual command syntax might differ depending on your platform, the overall procedure is the same for all platforms.

The files in each bundle patch are installed into the destination ORACLE_HOME. This enables you to remove (roll back) the bundle patch even if you have deleted the original bundle patch files from the temporary directory you created.

Oracle recommends that you back up the ORACLE_HOME using your preferred method before any patch operation. You can use any method (zip, cp -r, tar, and cpio) to compress the ORACLE_HOME.

When Opatch starts, it validates the patch to ensure there are no conflicts with the software already installed in your ORACLE_HOME:

  • Conflicts with a patch already applied to the ORACLE_HOME. In this case, stop the patch installation and contact Oracle Support Services.

  • Conflicts with subset patch already applied to the ORACLE_HOME. In this case, continue installation because the new patch contains all the fixes from the existing patch in the ORACLE_HOME. The subset patch is automatically rolled back before installation of the new patch begins.

See Also:

To install a Webgate bundle patch on any platform:

  1. Before applying the bundle patch stop the node manager and OHS component.
  2. Complete all activities in Preparing All Environments and Downloading the Bundle Patch
  3. Finish preparing your deployment using one of the following topics, as needed:
  4. Log in as the same user who installed the base WebGate and:

    • Turn off the Web server associated with the protected application.

    • Back up your ORACLE_HOME.

    • Move the backup directory to another location and record this so you can locate it later, if needed.

  5. Set your current directory to the directory where the patch is located. For example:
    cd PATCH_TOP/31750289
  6. Use one of the following Opatch commands to apply the patch to your ORACLE_HOME:
    opatch apply

    or

    opatch apply -jdk [Path to jdk8]

  7. Restart the Web server.

1.4.4 Failure During WebGate Bundle Patch Installation

If there is a failure during your WebGate installation, your original WebGate installation is restored automatically.

Note:

You can check the window to see if you can discern the problem, then correct the problem and restart the bundle patch installation.

1.4.5 Rolling Back a WebGate Bundle Patch on Any System

The steps to remove a WebGate bundle patch from all systems are provided in the following procedure, if needed. While individual command syntax might differ depending on your platform, the overall procedure is the same.

Note:

If you see "Patch not present in the Oracle Home, Rollback cannot proceed", enter opatch rollback -help to get more information. If the patch was applied using -no_inventoryoption, use -ph option.

After the WebGate bundle patch is removed, the system is restored to the state it was in immediately before the bundle patch installation.

To roll back a WebGate bundle patch on any system:

  1. Perform all steps in Preparing All Environments and Downloading the Bundle Patch to verify the inventory, set any environment variables, shut down any services running from the ORACLE_HOME or host machine.
  2. Stop the WebGate Web server, and change to the directory where the patch was unzipped. For example:
    cd PATCH_TOP/31750289
  3. Back up the ORACLE_HOME directory that includes the bundle patch and move the backup to another location so you can locate it later, if needed.
  4. Run Opatch to roll back the patch. For example:
    opatch rollback -id 31750289

    or

    opatch rollback -id 31750289 -jdk PathtoJDK8
  5. Start the WebGate Web server.

1.5 Resolved Issues

This Bundle Patch provides the fixes described in the below section:

1.5.1 Resolved Issues in 12.2.1.3.200813

Base Bug Number Description
31316696 OHS/WEBGATE THROWING AH00027: NO AUTHENTICATION DONE
31062117 WEBGATE : CHROME VERSION 80+ AND SAMESITE=NONE ISSUE (OTHER BROWSERS TO FOLLOW)
31134868 DIAGNOSTIC IMPROVEMENT FOR BUG#30806559 - HMAC FLOWS NEED MORE LOGGING
28200446 Fix for Bug 28200446
30884653 Fix for Bug 30884653
28319788 POLICY EVALUATION FOR OIDC WEBGATE NOT FUNCTIONING CORRECTLY
29054382 POST DATA PRESERVATION DOES NOT WORK STARTING WITH OAM 11.1.2.3.180417 BP14
29204353 OHS FAILS TO START AFTER UPGRADE FOR 11G WEBGATE
25429284 ENHANCED THE WEBGATE LOGGING WHEN CONNECTION ISSUES ARE SEEN
28780436 DCC LOGOUT CONSENT FLOW IS BROKEN IN THE APRIL 18 BP 27373151
28793688 WEBGATE CHANGES REQUIRED FOR BUG 28562000

1.5.2 Resolved Issues in 12.2.1.3.181207

Base Bug Number Description

29017484

REMOVAL OF RAPIDJSON USED FOR OIDC HEADERS FEATURE.

28921190

COMPILATION FAILURE ON BOTH SOLARIS PLATFORMS FOR 12CPS3 JAN BP

28381497

OHS 11.1.2.3.180417 RETURNS BAD REQUEST WITH DEFAULT SSL PORT

27724373

STRESS:122131OHS- 3GB PROCESS SIZE IN PS4 COMPARING 400MB PROCESS SIZE IN 12CPS3

27608453

WEBGATE SETS MULTIPLE ACCESS TOKEN COOKIES PER SCOPE COMBINATION IN CLOUD.POLICY

27204428

OAM LOGOUT URL HAVING QUERY STRING IN END_URL IS NOT RETAINED IN DCC CASE

1.5.3 Resolved Issues in 12.2.1.3.180622

Base Bug Number Description of the problem

28155915

NOT ABLE TO ACCESS RESOURCE OF APP HAVING ONLY OPENID SCOPE

27986254

DCC WEBGATE COMPATIBILITY SUPPORT 

Note: Administrator can add an user-defined parameter hmacEnabled=true , to the Webgate profile which is patched with bug fix 27258588 or April 2018 bundle patch..

If the hmacEnabled=true in the Webgate profile, the ECC/DCC expects the resource webgate is patched with the bug fix 27258588 and process accordingly.

By default, Webgate profile uses hmacEnabled=false, means the webgate is not patched with the bug fix 27258588.

27892813

OAUTH FLOWS NOT WORKING ON OTD (BOTH WINDOWS/LINUX)

27683326

WNA AUTHENTICATION THROWS BASIC PROMPT ON IDLE-TIMEOUT

27484889

ERROR AT IDLE TIMEOUT WITH DCC AND X509

27026287

OHS 12.1.2.0.0 WEBGATE : STALE/INVALID OAMAUTHNCOOKIE

26307941

ESSODIRECTSUBMIT DOES NOT WORK WHEN THE USER HAS A DOUBLE QUOTE IN HIS PASSWORD

1.5.4 Resolved Issues in 12.2.1.3.180414

Base Bug Number Description of the problem

27743823

NOT ABLE TO ACCESS THE HOME PAGE URL : EBEX 

27609018

WEBGATE (OIDC) SETS IDTOKEN AND ACCESS TOKEN COOKIES IN THE BROWSER UNENCRYPTED

27536251

REFRESH TOKENS (OAUTH/OPENID) IN WEBGATE IS NOT WORKING

27258588

Fix for bug 27258588

Note: All the WebGate behind the same LoadBalancer/Proxy must be Patched.

In case of DCC Webgate, fix for the bug is disabled. The fix for the DCC WebGate can be enabled by setting the globalHMACFlaguser-defined parameter of WebGate to true. By default, the DCC WebGate globalHMACFlag user-defined parameter value is false. Before enabling the fix, ensure that all Resource WebGates are patched with complementary fix (Bug:27258588).

The DCC WebGate globalHMACFlag user-defined parameter value & OAM Server globalHMACEnabled value must be same.

Example: If OAM Server globalHMACEnabled value is set to true then the DCC WebGate globalHMACFlaguser-defined parameter value must be set to true.

There is no configuration setting for Resource WebGate.

All the WebGate behind same proxy/loadbalancer must be patched simultaneously.

27568356

Fix for bug 27568356

Note: Please refer the note added for bug 27258588, the same implies for this bug also.

27355601

Fix for bug 27355601

Note: Please refer the note added for bug 27258588, the same implies for this bug also.

27793168

GETTING BAD ACCESS MANAGER ERROR ON FIRST TIME RESOURCE ACCESS

Note: Please refer the note added for bug 27258588, the same implies for this bug also.

27247346

SUPPORT FOR STANDARD BASED PROTOCOL (OAUTH/OPENID) IN WEBGATE

Note: This Feature is only supported for OHS WebGate.

26554694

WEBGATE FAILURES AFTER UPGRADE OF FEDRAMP POD CONFIGURED TO USE OHSRUN USER

24588634

Fix for bug 24588634

Refer to technical note Doc ID 2386892.1 available on My Oracle Support. You can access My Oracle Support at https://support.oracle.com

Note:

  • The fix is by default enabled, EnableHostPortValidation=true

  • To make this work, UseCanonicalName must be On and we must modify the httpd.conf's ServerName Directive to a valid HOST:PORT.

    Example: ServerName abc.ayx.ttz.com:7778 or http://abc.ayx.ttz.com:7778 or abc.ayx.ttz.com

  • If port is not specified, then 80/443 will be considered depending on http/https.

  • ServerName host and port will be validated against HOST header's host and port, on encountering any difference, an error page over 200 http request will be thrown on the browser's page.

  • Fix can be disabled by turning off the setting in webgate profile, EnableHostPortValidation=false

The above configuration is only for Apache based servers(OHS/APACHE/IHS).

IIS provides inbuilt protection for this kind of request hijacking. IIS "Site Bind" Settings needs to be modified with the valid HostName of the Server, upon encountering modified Host header request, IIS Server return 404 response.

22104011

Fix for bug 22104011

16369333

Fix for bug 16369333

1.5.5 Resolved Issues in 12.2.1.3.171214

Webgate Release Number Base Bug Number Description
12.2.1.3.171214

26389702

DCC WEBGATE NEED TO SEND DYNAMIC CONTEXT TO SERVER FOR AUTHENTICATE PROCESSING

Note:

This fix works along with other Server side fixes (included in 12.2.1.3.171121 OAM BP) to improve dynamic authentication support in DCC.
 

26256956

WNA-DCC, USER BEING CHALLENGED POST CONFIGURED IDLE TIME

 

25765974

Fix for Bug 25765974

1.6 Known Issues

Known issues and their workarounds in Oracle Access Management Release 12.2.1.3 are described in the Oracle Access Management chapter of the Release Notes for Oracle Identity Management document. You can access the Release Notes document in the Oracle Identity Management Documentation library at the following URL:

https://docs.oracle.com/middleware/12213/idmsuite/IDMRN/toc.htm

Note:

Some known issues listed in the Release Notes for Oracle Identity Management may have been resolved by this Bundle Patch. Compare the issues listed in Resolved Issues in 12.2.1.3.200813 of this document when reviewing the Release Notes for Oracle Identity Management

Bundle Patch Number Base Bug Number/Doc ID Bug Number/Doc ID Description of the Problem
12.2.1.3.200813

Note:

Also applicable to Bundle Patch 12.2.1.3.180414 and later.
N/A N/A After applying the WebGate patch successfully, OHS/OTD may fail to start due to unresolved dependencies in webgate.so.
Identify missing dependencies and ensure that they are available on the system.
bash-4.1$ ldd webgate.so
....
libcurl.so.4 => (not found)
libssl.so.1.0.0 => (not found)
libcrypto.so.1.0.0 => (not found)
....

Locate missing dependencies (specifically libcurl.so*, libssl.so* and libcrypt.so*) on the system. If they do not exist in system paths, check for available closest match instead.

The following examples mention only libcurl.so* on Solaris SPARC64 system. However, similar steps apply to other missing libraries and/or on different platforms. 

bash-4.1$ ls -lart /usr/lib/sparcv9/libcurl.so*
-r-xr-xr-x 1 root bin 629912 Mar 17 2015 /usr/lib/sparcv9/libcurl.so.3.0.0
lrwxrwxrwx 1 root root 16 Mar 17 2015 /usr/lib/sparcv9/libcurl.so.3 -> libcurl.so.3.0.0
lrwxrwxrwx 1 root root 16 Mar 17 2015 /usr/lib/sparcv9/libcurl.so -> libcurl.so.3.0.0
As libcurl.so.4 (as required by WebGate by running ldd command) is missing, you must create it. You may need root privileges to run the following command. If you do not have the root privileges you can create the symlink under Webgate OHS/OTD libraries location (WEBHOME/webgate/ohs/lib, WEBHOME/webgate/otd/lib or WEBHOME/lib)
bash-4.1$ ln -s /usr/lib/sparcv9/libcurl.so libcurl.so.4

bash-4.1$ ls -lart /usr/lib/sparcv9/libcurl.so*
-r-xr-xr-x 1 root bin 629912 Mar 17 2015 /usr/lib/sparcv9/libcurl.so.3.0.0
lrwxrwxrwx 1 root root 16 Mar 17 2015 /usr/lib/sparcv9/libcurl.so.3 -> libcurl.so.3.0.0
lrwxrwxrwx 1 root root 16 Mar 17 2015 /usr/lib/sparcv9/libcurl.so -> libcurl.so.3.0.0
lrwxrwxrwx 1 root root 27 Oct 16 07:56 /usr/lib/sparcv9/libcurl.so.4 -> /usr/lib/sparcv9/libcurl.so

Note:

If versions available on system for missing dependencies do not resolve the issue, you may have to download/compile/ install these versions on the system.

This can be done by locating and downloading them to a separate location and ensuring that the new location, with required library versions, is used by OHS/OTD startup.

1.7 Documentation

This section describes the documentation that is available to support the latest bundle patch and the original release. This section provides the following topics:

1.7.1 Oracle Access Manager Manuals and Release Notes

You can find release notes and manuals on Oracle Technology Network (OTN). If you already have a user name and password for OTN, you can go directly to the documentation section of the OTN Web site at:

http://www.oracle.com/technetwork/indexes/documentation/index.html

Oracle Access Manager 12c documentation link:

http://docs.oracle.com/middleware/12213/oam/index.html

1.7.2 Patch Set Notes and Bundle Patch Notes

You can download notes with software patches and bundle patches from My Oracle Support (formerly MetaLink) at:

http://support.oracle.com

This document, Oracle Access Manager WebGate Release Notes Bundle Patch 12.2.1.3.200813 for All Server Platforms, provides the following information for this specific bundle patch release:

  • General information about bundle patches.

  • General WebGate bundle patch requirements and installation details.

  • Details about what is included in the Webgate bundle patch.

The Oracle Access Manager WebGate Release Notes Bundle Patch 12.2.1.3.200813 for All Server Platforms is available in HTML format, as readme.htm, that you can view without downloading the zip file.

The companion, Oracle Access Management Release Notes, Bundle Patch 12.2.1.3.200813 Generic for All Server Platforms, provides the following information for this specific bundle patch release:

  • General information about bundle patches

  • General bundle patch requirements and installation details

  • Details about what is included in this bundle patch

The companion Oracle Access Management Release Notes, Bundle Patch 12.2.1.3.200813 Generic for All Server Platforms readme file is available in HTML format, as readme.htm, that you can view without downloading the zip file.

1.7.3 Certification Documentation

Support Information Sites

Certification Matrix

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html

Oracle Fusion Middleware Requirements

http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-requirements-100147.html

Oracle Fusion Middleware Downloads

http://www.oracle.com/technetwork/middleware/downloads/index-087510.html

1.8 Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible to all users, including users that are disabled. To that end, our documentation includes features that make information available to users of assistive technology.

This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at http://www.oracle.com/accessibility/.

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

Deaf/Hard of Hearing Access to Oracle Support Services

To reach Oracle Support Services, use a telecommunications relay service (TRS) to call Oracle Support at 1.800.223.1711. An Oracle Support Services engineer will handle technical issues and provide customer support according to the Oracle service request process. Information about TRS is available at http://www.fcc.gov/cgb/consumerfacts/trs.html and a list of phone numbers is available at http://www.fcc.gov/cgb/dro/trsphonebk.html