IIS6 and Tomcat

This is a little bit off topic as OAM goes but everytime I want a quick OAM / Servlet container working environment, it takes me too long to discover this info. So, here it is in a nutshell:

The quickest, cheapest, most readily available solution to getting OAM up and running with a servlet container as the server side technology is to use IIS6 on Win2K3 and Tomcat 5.5. The crux is that you want to be able to stick a webgate in front of the container resources (by default, on port 8080). Now, there is a ton of info on the web about how to do this. But the one resource that you need is here:

http://wiki.apache.org/tomcat/Tomcat_and_IIS_Howto

There is an MSI package that will do most of the picky IIS and registry config for you (link near the top of the page)

http://www.apache.org/dist/tomcat/tomcat-connectors/jk/binaries/win32/jk-1.2.15/isapi_redirect.msi

The setup program is a great help but there is one final detail (mentioned thanks to someone who added a note to the page) that reads:

The setup file included here and the script to add the ISAPI filter work just fine in IIS6, but there is one additional step needed. You must also allow access to the filter through the Web Service Extensions part of IIS. To do this graphically, do the following:
1) open the IIS Manager and go to the Web Service Extensions item under the appropriate server 2) Click the "Add a new Web service extension" item under "Tasks" 3) Give it a name like "jakarta" 4) Browse to the isapi_redirect.dll file you installed above as a "Required File" 5) Check the box to enable this extension.
This detail is there in the docs as point #8 on the IIS How-To but it is easy to miss.

The only other note I have is that all the documentation talks about the workers.properties file. Be aware that the setup program referenced here creates a file called workers.properties-minimal. This is ok as it also writes the same filename value into the registry. Just good to be aware that both the registry key and the filename need to jive before you go renaming it.

Dot Net Parsing Oracle Access Manager XML

This is slightly off topic, and extends well beyond just Oracle Access Manager but was a little less than obvious to me the first time I had to do this in .NET (well, also the second time). If the XML you are trying to process with SelectNodes or SelectSingleNode contains a namespace then you need to associate that namespace with a namespace manager and include it in the SelectNodes or SelectSingleNode statement (see example below).

XmlDocument xml = new XmlDocument();
xml.LoadXml(someXmlString);
XmlNamespaceManager ns = new XmlNamespaceManager(xml.NameTable);
ns.AddNamespace("default", "http://www.oblix.com/");
attrNodes=xml.SelectNodes("/default:ObEventParams/default:ObParamList[@name='WfAttribute']/default:ObParam", ns);

IDXML - There is no profile configured for this kind of user

IDXML can be cool. It can also cause one to question one's future in front of a keyboard.

Take, for example, the error message: "There is no profile configured for this kind of user". This is usually a very helpful message that tips you off that you have a typo in the DN value of the UID parameter.

But if you are getting this message and you are sure that your request looks perfect there can be another simple explanation for the error: your HTTP client might be sending the request to the wrong application.

That's right - if you send a perfect Modify User request to /identity/oblix/apps/objservcenter/bin/objservcenter.cgi instead of /identity/oblix/apps/userservcenter/bin/userservcenter.cgi, you will find that 'There is no profile configured for this kind of user'...

Don't let this happen to you. Life is short.

Creating Custom Style Shared Folder

When creating a custom style for Oracle Access Manager (formerly COREid) the product creates a localized directory for you in the default language, but all of the files in the localized copy point back to the main style sheets in the shared directory. In order to keep the vanilla sheets for style0 (Classic Style) intact it is advisable to create a duplicate shared directory (i.e. newstyle_shared).

In order to let this all hang together, however, one must update all of the references in the new styles localized directory (created by the product as part of the new style function) so that they point to the new shared directory (created by you).

As there are many files to update it is adviseable to use a batch search and replace tool for this task.

On a unix system with perl installed this is a very easy proposition. The following command will suffice...
perl -p -i.bak -e "s|\/shared|/newstyle0_shared|" *.xsl

However, on windows it is a little trickier at the windows shell does not like the *.xsl reference. Therefore, a small change is required to make it work in the windows shell...
for %I in (*.xsl) do perl -p -i.bak -e "s|\/shared|/newstyle0_shared|" %I

WebGate Cannot Initialize

A web server with a WebGate installed on it suddenly does not serve pages and generates 500 errors. There have been no changes to the server or the web server configuration. Upon further investigation the Oracle Access Manager (formerly COREid) oblog.log of the WebGate generates a line in the WebGate initialization indicating that it is failing.

ACCESS_GATE FATAL 0x00001520 \Oblix\coreid702\palantir\webgate\src\iisentry_web_gate.cpp:249 "Exception thrown during WebGate initialization" Error^2--- STATUS ------ ERROR ---\Oblix\coreid702\palantir\webgate\src\web_gate.cpp:371: Error: Exception rethrown from ObWebGate::Init( <null> = <null>, <null> = <null> )%0a\Oblix\coreid702\palantir\aaa_client\src\aaa_service_client.cpp:363: Error: ObAAAServiceClient::Initialize()%0a\Oblix\coreid702\palantir\netlib\src\obcreatewrapperfactory.cpp:65: Error: create_tls_wrapper_factory()%0a\Oblix\coreid702\palantir\netlib\src\obtlswrapperfactory.cpp:235: Error: %0a

This indicates that WebGate cannot create a TLS connection to the Access Server so it cannot initialize so it leaves the web server in an unusable state. The likely cause of this is that the certificates on the WebGate have expired.

The certificate expiration dates can be checked by reading this.

The certificates can be regenerated by reading this.

Policy Domain/Policy Not Enforced

Successful migrations of Oracle Access Manager (formerly COREid) configuration data rely heavily on consistent directory naming of entries between envionments. It is not enough for configuration data objects to share the same user friendly names, they must have the same RDN (Relative Distinguished Name) values in the directory server. This forms the basis of clean migrations. As well, objects must share the same properties. If this setup is performed in advance of using the COREid Migration Service or alternatively, corrected in a pre-existing environment using the COREid Migration Service migrations will run smoothly. The situation described below illustrates how having inconsistent environments can cause problems.

After copying a policy domain or policy to a new environment the resources protected by the policy domain and/or policy are not actually protected there. Checking the resources in the Oracle Access Manager Access Tester reveals that the resources are indeed not protected.

This error highlights a mismatch in host identifier data between the source and target environments. It may look the same (i.e. have the same user friendly description in the UI), however, the distinguished name (DN) that names the object in the directory is probably different.

The short term solution is to add the host identifier for that environment in all of the locations in the policy domain(s) and/or policy(ies) where resources are specified. This will get the policy domain(s) and or policy(ies) working again in the target environment. However, there is still a longer term problem that will affect future migrations of policy domain data.

This long term solution is to use the COREid Migration Service to migrate host identifiers and policy domains from a stable environment (production) to all of the other evironments (i.e. quality, test and dev) and systematically update the host identifier entries with host names specific to the environment. This will make the other environments consistent a prevent this problem from occurring in the future.

Anonymous Authentication Resources SLOW

Problem Oracle Access Manager (formerly COREid) is extremely slow or does not serve content from servers protected by the Anonymous Authentication Scheme (formerly Netpoint None). This can include FAQ pages, login pages, images, style sheets, etc.

Background The Anonymous Authentication scheme is used in cases where the WebGate has its DenyOnNotProtected property set to TRUE. The anonymous authentication scheme maps the OblixAnonymous user int eh credential_mapping plugin. By default this is mapped to the uid attribute. The uid attribute is indexed by default in some directory servers but not in AD/AM. In AD/AM the attribute is added as part of the iNetOrgPerson schema extension and is not indexed.

Solution If you are having a problem similar to this one, check to see if the Anonymous Authentication scheme is using the uid attribute in teh credential_mapping plugin. If it is then check to see if the attribtue is indexed in the directory server (if using AD/AM it will not be indexed by default). If it is not indexed then there are a couple of options:

1. index the attribute in the directory (may be harder on some directory platforms than others; very easy on AD/AM)


2. change the attribute in the Anonymous Authentication Scheme's credential mapping step to an attribute that IS already indexed

Potential Cause How did this problem occur? It seemed to just appear over night. The likely cause of this problem is an increase in the amount of data in the user directory server. More data will cause a search on an unindexed attribute to yield incorrect incomplete results more frequently than if there is less data in the directory. This is because the look thur limit the directory imposes on the searhcing user may be exhausted before the entry (or entries) is located.