Total Pageviews

Saturday, August 9, 2014

ldap upgrade ds 5.2 to ODSEE 11g

upgrade from 5.2 to 11g is not very complicated if you are allowed to have down time. if you cant afford down time then it is little sticky. here are steps if you already created suffix instances and basic infrastructure. you have corrected all the performance parameters at 11g dse.ldif


with down time allowed steps
1. have your 11g environment ready( create all the replication agreement between all the 11g servers)
2. stop 5.2 servers.
3. export data from 5.2 servers.
4. import data into all 11g servers or at one master server and initialize all remaining servers with once server(if your environment is small)
5. start 11g servers and check replication and data is there.



few steps to consider while migrating to 11g.
there are not complete steps.here are some points is learned my way into migration because I migrated environment with no down time.

1. mix environment of 5.2 and 11g can have max of 4 master.

2. in 11g you can have all master if your environment support it. it is not recommended to have all masters for security reason(in some environments) because you want some application should only do read operations and for write operations, send them to master for server.

3. you cant create replication from 11g to 5.2 thru console. you need to run command to create replication from 11g to 5.2.

you need to have following aci at 5.2 server in order for 5.2 to communicate to 11g server. in order to make ACI changes at dse.ldif you need to stop DS instance and after making changes you can start it


                                                                                     aci: (targetattr != "aci")(version 3.0; aci "rootdse anon read access"; allow( read,search,compare) userdn="ldap:///cn=Replication Manager,cn=replication,cn=config || ldap:///cn=repmanager,cn=config";)


        To avoid the object class violation, the 11g Release 1 (11.1.1) password policy schema file (00ds6pwp.ldif) must be copied to every version 5.2 server that will be supplied by a 11g Release 1 (11.1.1) master. When the password policy schema file has been copied, restart the version 5.2 server.



4. in order to retire your 5.2 ldap environment and add 11g servers you need to have replication going both way(modification at 5.2 needs to flow to 11g and vice versa) including consumers. this step is hard to achieve because in order for this to happen you need to create both way replication. As per oracle, replication from 11g to 5.2 should work but my experience was, it did not work until I initialize 11g master from 5.2 then they can communicate with each other. you can create replication agreement from 5.2 to 11g thru 5.2 console. keep in mind sometimes this replication does't work, so you need to create replication agreement thru command line.

here are some commands that I run to create replication between 11g and 5.2


·       Setup replication agreement by using the following command at 11g server

./dsconf create-repl-agmt -p 389 o=test.com 5.2-servername:port

 

·       Verify that the replication agreement is setup properly, by using the following command:

./dsconf get-repl-agmt-prop -p port o=test.com servername:port

 

·       If you are using default Replication Manager, the following command is used to set it up for newly created rep agreement:

./dsconf set-repl-agmt-prop -p 389 o=test.com 5.2-servername:port auth-pwd-file:pwd.txt

 

·       If using non-default Replication Manager,  then use the following command:

./dsconf set-repl-agmt-prop -p port o=test.com 5.2-servername:port auth-bind-dn:"cn=repmanager,cn=config" auth-pwd-file:pwd_pw.txt

·       Verify replication agreement is setup properly with Replication Manager, by using the following command:

./dsconf get-repl-agmt-prop -p port o=test.com 5.2-servername:port



5. if replication agreement is working between 11g and 5.2. you can initialize 5.2 server from 11g console. if your environment is big can cant afford initialization over the wire do the following to initialize DS 5.2 from 11g. make sure you MUST DISABLE all the replication going in/out of 5.2 server you are going to initialize. otherwise you will have to initialize whole down stream of 5.2 environment.

 Exporting the data from 11g Instance and Importing the Data in DS 5.2 Instance

 

Make sure that the replication agreement is set from 11g to 5.2 DS. Next, follow the below steps to export the data from 11g instance and to import it in DS 5.2 instance:

1.      Stop the Oracle 11g instance, by using the following command:

./dsadm stop <instance path>

 

2.      Export the data from 11g , 
 
./dsadm export /opt/dsee7/dsinstances/slapd-Users/ o=test.com /opt/dsee7/dsinstances/slapd-Users/ldif/ldifexport.ldif

 

3.      Stop the DS 5.2 instance, by using the following command:

<instance path>/slapd-stop

 

4.      Start the Oracle 11g instance, by using the following command:

./dsadm start <instance path>

5.      Import the data in DS 5.2 instance.

6.      Start the DS 5.2 instance, by using the following command:

<instance path>/slapd-start

 Points to remember

         i.  when you are initializing 5.2 from 11g you MUST need to disable all the down stream replication from 11g and from 5.2. i have learned the hard way. once i did not disabled down stream replications. i have to initialize whole down stream environment that is very time consuming and some of the server you cant afford to put down.

ii. make sure all the performance parameters are same at 5.2 or better at 11g.


i might missed a lot of information because i have done this migration long time ago, at that time i never thought to writing blog. so ask me if you face any issues during migration. good luck.



 

upgrading oam 10g to oam 11gR2

please follow this oracle documentation for complete migration. if you don't have a lot of custom policies and external policies. It will be very simple. as per experience it is highly recommended to run utility to Generate Assessment Report before your do the migration. Also make sure properties file is created correctly. Configuration store and Policy store urls are correct. if you are using OID base URL path for both will be under cn=OAM

click on this link to see oracle complete steps for this migration.
http://docs.oracle.com/cd/E27559_01/doc.1112/e28183/oam_mig.htm#CHDHFGJH
 

Thursday, July 24, 2014

how to check OHS version in Linux or solaris

Answer:

 Go to $OHS_HOME/inventory
Now run 'ls -d Components*/*/* |grep -i ohs2'
 

Wednesday, July 23, 2014

5.2 LDAP startup issue:

DS 5.2 have issue of keeping pid file when it is shutdown abnormally. when u restart DS it give following error. 11g automatically clear this attribute.


ERROR<5895> - Schema  - conn=-1 op=-1 msgId=-1 - User error:  Entry "cn=schema", single-valued attribute "nsSchemaCSN" has multiple values


Solution:
you need to clear PID file that is created under /instance/locks/server directory. remove any process file created under this /server directory and restart server. it will start after some recovery process.
 

user cant open crontab when running following command
 
$ crontab -l

crontab: can't open your crontab file.

Solution:

User don’t have access to run cronjob. User need to be in  cron.d/cron.allow  file in order to run cronjobs. contact you system administrator to add user id in cron.allow file

SSL communication between OAM and OID failing with error

OAM and OID authentication issue.
error while configuring SSL communication between OAM and OID

<oracle.ods.virtualization.engine.backend.jndi.adapter1> <LIBOVD-60024> <Connection error: simple bind failed: servername.port>
 <Warning> <oracle.igf.ovd> <IGF-00008> <Operations error: mesg=Protocol Error LDAP Error 2 : simple bind failed
 <Error> <oracle.oam.user.identity.provider> <OAMSSA-20023> <Authentication Failure for user


Solution

it is a bug  : OAM 11GR2PS2 - OID USER IDENTITY STORE ISSUES IF SSL ENABLED. there is no fix yet.
 

Sunday, July 6, 2014


 
Issue : OAM 10g Error

. <html><head><title>Oracle Access Manager Operation Error</title><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8"></head><body><h1>Oracle Access Manager Operation Error</h1><p>The mapping of credentials (Resource=/login.html RequesterIP=ipaddress HostTarget=http://servername:port Operation=GET) to a user profile failed. The Access Server may not be able to connect to the user directory, or the authentication scheme Anonymous Authentication may have an invalid obMappingFilter parameter for its credential_mapping plugin.</p><p>Contact your website administrator to remedy this problem.</p></body></html

 
solution.:
this issue happen when you are trying to put a login page at the place that is already protected by policy. in order to resolve this you have to create new Policy for anonyms user and unprotect your login page.

Create another policy to unprotect the page you are trying to access. at this policy you have to give access to anonymous users.
 
here are some steps to define Anynomys Policy to access login page that is under /login/login.html.

1.      General Tab à (specify name of authentication scheme)

 

2.      Resources à Resource Type (http) à Host Identifiers (hostname) à URL Prefix (page where your url exists e.g /login/login.html).

 

3.      Authorization Rules à Anonymous Authorization rule.

 

a.      Allow Acccess (OblixAnonymous) Role Any one.

4.      Default Rules à at General Authentication Scheme = Anonymous Authentication

a.      Authorizatoin Expression = Anonymous Authorization rule.
 
 

5.      Policies à Resouces types = http

a.      Resouce Operations Get POST Put

b.      Resource

                                                    i.     Host Identifiers = hostname

                                                   ii.     URL Prefix /login/login.html

                                                  iii.     Host Identifiers = Hostname

 or other reason can be your OID or LDAP is missing username defined in Plugin obMappingFilter
in order to fix this do following.

if u are using 10g go to Access console  --> Access System Console --> click on Authentication Management.

at Authentication Management scheme for Anonymous Authentication there is a Plugin defined like

credential_mapping
obMappingBase="dc=t-mobile,dc=com",obMappingFilter="(uid=OblixAnonymous)"


Make sure cn=OblixAnonymous is present in OID or LDAP. If not, import/create this user. This user is required to have anonymous access to Lost Password Management url.