Secure Mode Disabled by Default in Upgraded Environment

Issue

Bug Number: 36735609

Impacted Releases: 14.1.2.0.0

Impacted Platforms: All

When you upgrade from 12.2.1.4 to 14.1.2.0.0, the secure mode is disabled by default in the upgraded Oracle SOA Suite environment. If you choose to enable secure mode, and as a result, if the protocol, host, and port combination changes, it might cause issues in the existing Oracle SOA Suite flow instances created before the migration.

The existing Oracle SOA Suite instances created before the migration might be impacted in the following cases.
  • If SSL is disabled in the source environment before the migration.
  • If there is an external reference from a SOA composite to another SOA composite WSDL or service using a non-SSL URL, which changes.

    Workaround:

    For this case, the SOA composite must be updated to avoid the usage of hard coded URL using a token or a Load Balancer URL, which remains valid after the upgrade.

  • All the call backs from external systems for the instances created before the upgrade might fail if the call back is made to the SOA instance with an old SOA server URL, which gets modified as part of the upgrade.

    Workaround:

    For this case, you can temporarily enable the non-SSL URL to recover call back of instances. However, this might not work for all the cases. Ensure that there are no open instances expecting call backs from external systems before the upgrade.

The existing Oracle SOA Suite instances created before the migration are not impacted in the following cases.
  • If SSL is enabled in the source environment before the migration, and the protocol, host, and port remain unchanged as part of the upgrade.
  • If the customer is using Oracle HTTP Server or Load Balancer URL as the SOA Server URL, which is used to route calls and if all the external interactions occur through the SOA Server URL (assuming that the URL remains unchanged).

When you switch from non-secure mode to secure mode for the first time, ensure that you update the external client with the new endpoint URL. The call back requests are then routed to the new call back composite endpoint URL. For subsequent switches between secure mode and non-secure mode, the endpoint URL remains unchanged and the call backs function seamlessly.