Dot Net Parsing Oracle Access Manager XML

This is slightly off topic, and extends well beyond just Oracle Access Manager but was a little less than obvious to me the first time I had to do this in .NET (well, also the second time). If the XML you are trying to process with SelectNodes or SelectSingleNode contains a namespace then you need to associate that namespace with a namespace manager and include it in the SelectNodes or SelectSingleNode statement (see example below).

XmlDocument xml = new XmlDocument();
xml.LoadXml(someXmlString);
XmlNamespaceManager ns = new XmlNamespaceManager(xml.NameTable);
ns.AddNamespace("default", "http://www.oblix.com/");
attrNodes=xml.SelectNodes("/default:ObEventParams/default:ObParamList[@name='WfAttribute']/default:ObParam", ns);

IDXML - There is no profile configured for this kind of user

IDXML can be cool. It can also cause one to question one's future in front of a keyboard.

Take, for example, the error message: "There is no profile configured for this kind of user". This is usually a very helpful message that tips you off that you have a typo in the DN value of the UID parameter.

But if you are getting this message and you are sure that your request looks perfect there can be another simple explanation for the error: your HTTP client might be sending the request to the wrong application.

That's right - if you send a perfect Modify User request to /identity/oblix/apps/objservcenter/bin/objservcenter.cgi instead of /identity/oblix/apps/userservcenter/bin/userservcenter.cgi, you will find that 'There is no profile configured for this kind of user'...

Don't let this happen to you. Life is short.

Creating Custom Style Shared Folder

When creating a custom style for Oracle Access Manager (formerly COREid) the product creates a localized directory for you in the default language, but all of the files in the localized copy point back to the main style sheets in the shared directory. In order to keep the vanilla sheets for style0 (Classic Style) intact it is advisable to create a duplicate shared directory (i.e. newstyle_shared).

In order to let this all hang together, however, one must update all of the references in the new styles localized directory (created by the product as part of the new style function) so that they point to the new shared directory (created by you).

As there are many files to update it is adviseable to use a batch search and replace tool for this task.

On a unix system with perl installed this is a very easy proposition. The following command will suffice...
perl -p -i.bak -e "s|\/shared|/newstyle0_shared|" *.xsl

However, on windows it is a little trickier at the windows shell does not like the *.xsl reference. Therefore, a small change is required to make it work in the windows shell...
for %I in (*.xsl) do perl -p -i.bak -e "s|\/shared|/newstyle0_shared|" %I

WebGate Cannot Initialize

A web server with a WebGate installed on it suddenly does not serve pages and generates 500 errors. There have been no changes to the server or the web server configuration. Upon further investigation the Oracle Access Manager (formerly COREid) oblog.log of the WebGate generates a line in the WebGate initialization indicating that it is failing.

ACCESS_GATE FATAL 0x00001520 \Oblix\coreid702\palantir\webgate\src\iisentry_web_gate.cpp:249 "Exception thrown during WebGate initialization" Error^2--- STATUS ------ ERROR ---\Oblix\coreid702\palantir\webgate\src\web_gate.cpp:371: Error: Exception rethrown from ObWebGate::Init( <null> = <null>, <null> = <null> )%0a\Oblix\coreid702\palantir\aaa_client\src\aaa_service_client.cpp:363: Error: ObAAAServiceClient::Initialize()%0a\Oblix\coreid702\palantir\netlib\src\obcreatewrapperfactory.cpp:65: Error: create_tls_wrapper_factory()%0a\Oblix\coreid702\palantir\netlib\src\obtlswrapperfactory.cpp:235: Error: %0a

This indicates that WebGate cannot create a TLS connection to the Access Server so it cannot initialize so it leaves the web server in an unusable state. The likely cause of this is that the certificates on the WebGate have expired.

The certificate expiration dates can be checked by reading this.

The certificates can be regenerated by reading this.

Policy Domain/Policy Not Enforced

Successful migrations of Oracle Access Manager (formerly COREid) configuration data rely heavily on consistent directory naming of entries between envionments. It is not enough for configuration data objects to share the same user friendly names, they must have the same RDN (Relative Distinguished Name) values in the directory server. This forms the basis of clean migrations. As well, objects must share the same properties. If this setup is performed in advance of using the COREid Migration Service or alternatively, corrected in a pre-existing environment using the COREid Migration Service migrations will run smoothly. The situation described below illustrates how having inconsistent environments can cause problems.

After copying a policy domain or policy to a new environment the resources protected by the policy domain and/or policy are not actually protected there. Checking the resources in the Oracle Access Manager Access Tester reveals that the resources are indeed not protected.

This error highlights a mismatch in host identifier data between the source and target environments. It may look the same (i.e. have the same user friendly description in the UI), however, the distinguished name (DN) that names the object in the directory is probably different.

The short term solution is to add the host identifier for that environment in all of the locations in the policy domain(s) and/or policy(ies) where resources are specified. This will get the policy domain(s) and or policy(ies) working again in the target environment. However, there is still a longer term problem that will affect future migrations of policy domain data.

This long term solution is to use the COREid Migration Service to migrate host identifiers and policy domains from a stable environment (production) to all of the other evironments (i.e. quality, test and dev) and systematically update the host identifier entries with host names specific to the environment. This will make the other environments consistent a prevent this problem from occurring in the future.

Anonymous Authentication Resources SLOW

Problem Oracle Access Manager (formerly COREid) is extremely slow or does not serve content from servers protected by the Anonymous Authentication Scheme (formerly Netpoint None). This can include FAQ pages, login pages, images, style sheets, etc.

Background The Anonymous Authentication scheme is used in cases where the WebGate has its DenyOnNotProtected property set to TRUE. The anonymous authentication scheme maps the OblixAnonymous user int eh credential_mapping plugin. By default this is mapped to the uid attribute. The uid attribute is indexed by default in some directory servers but not in AD/AM. In AD/AM the attribute is added as part of the iNetOrgPerson schema extension and is not indexed.

Solution If you are having a problem similar to this one, check to see if the Anonymous Authentication scheme is using the uid attribute in teh credential_mapping plugin. If it is then check to see if the attribtue is indexed in the directory server (if using AD/AM it will not be indexed by default). If it is not indexed then there are a couple of options:

1. index the attribute in the directory (may be harder on some directory platforms than others; very easy on AD/AM)


2. change the attribute in the Anonymous Authentication Scheme's credential mapping step to an attribute that IS already indexed

Potential Cause How did this problem occur? It seemed to just appear over night. The likely cause of this problem is an increase in the amount of data in the user directory server. More data will cause a search on an unindexed attribute to yield incorrect incomplete results more frequently than if there is less data in the directory. This is because the look thur limit the directory imposes on the searhcing user may be exhausted before the entry (or entries) is located.

Can't See Workflow

Successful migrations of Oracle Access Manager (formerly COREid) configuration data rely heavily on consistent directory naming of entries between envionments. It is not enough for configuration data objects to share the same user friendly names, they must have the same RDN (Relative Distinguished Name) values in the directory server. This forms the basis of clean migrations. As well, objects must share the same properties. If this setup is performed in advance of using the COREid Migration Service or alternatively, corrected in a pre-existing environment using the COREid Migration Service migrations will run smoothly. The situation described below illustrates how having inconsistent environments can cause problems.

Have you ever copied a workflow definition from one environment to another and had the workflow not appear in the Oracle Access Manager (formerly COREid) Workflow applet? You double check the target directory server and indeed all of the entries are there so you wonder what could possibly be happening.

If this sounds familiar, then this is likely highlighting a difference between your two environments that you might not know existed. The problem is probably related to when your environments were first built manually independent of one another.
The cause is that there are different objectclasses associated with the tab_id that the workflow is meant to manage.

For instance say in the development environment the Employees tab (default user tab in Oracle Access Manager) has associated with it structural objectclasses of user and oblixOrgPerson. But in the quality assurance environment where you migrated the work flow to it has objectclasses of user, obligOrgPerson and auxCompanyPerson.

This provides an obvious barrier to performing clean migrations between environments. The way to correct this problem is to make the objectclasses look the same. The best way to do this is to get one environment in a pure state (i.e. contains all of your active development) and then migrate it to the other environments. This way all of the environments will be the same and ready to migrate information from one environment to another.