EBS Asserter IDCS

IDCS EBS Asserter Cheat Sheet Introduction I worked with a number of customers to resolve issues with their E-Business Suite single sign-on setup using the IDCS asserter solution and saw a pattern in the misconfigurations causing these similar types of issues. In this blog, I want to share the basic EBS asserter flows to understand the runtime better and the commonly faced issues along with their resolutions. I hope this post will save you a lot of time and effort should you have any of these issues or will serve as a first-time guide to get this integration working. The starting point for anyone trying to set up EBS SSO using the asserter can be found here - https://www.oracle.com/webfolder/technetwork/tutorials/obe/cloud/idcs/ebs_asserter_obe/ebs-asserter.html Most customers are comfortable configuring the asserter and making the login/logout flows work as per the document, but when it comes to troubleshooting, a deeper understanding of the asserter flows helps. So, here are the 2 important flows : Login flow As you can see in the above figure, the EBS asserter makes a backend call to IDCS service and also to EBS DB to establish EBS session. So, make sure the asserter host can reach IDCS and EBS DB. Logout Flow This is a fairly simple flow. At the end of the logout flow, a user should land on the configured post logout URL. Important Steps During Setup Datasource connection At setup time many customers may struggle a bit with the datasource configuration step. Apart from the usual database connection parameters such as host, port and SID/Service name, following are the important things to verify when creating a datasource used by the asserter to connect to EBS DB The driver class - If you use a non-XA datasource, type oracle.apps.fnd.ext.jdbc.datasource.AppsDataSource If you are using an XA data source, type oracle.apps.fnd.ext.jdbc.datasource.AppsXADataSource and make sure that the driver jar file is copied to /lib and the admin server has been restarted. The user - EBS user with UMX|APPS_SCHEMA_CONNECT Role. For security reasons, do not use "APPS" DB user, this user has the highest privileges not required by the asserter. DBC file - A customer reported getting a NullPointerException when creating the data source. The issue turned out to be a missing DBC file on the asserter machine because the DBC file was created on the EBS system but was never copied over to the asserter machine. Asserter Bridge.properties The document does a good job of explaining all the parameters configured. Pay extra attention to - whitelist.urls - Lists the URL E-Business Suite Asserter can accept as the requestUrl parameter value. when a login session is initiated from a different page than the EBS home page, the asserter gets "requestUrl" parameter in the request and knows where to redirect upon successful authentication. The asserter keeps a list of the allowed URLs. If the white list does not contain the incoming "requestURL", the asserter will redirect the user to the configured homepage. post.logout.url - Mention the URL where a user should be redirected to upon EBS app logout. This must match the post redirect URL configured in IDCS for the asserter application. Context root and cookie path Customers may need to deploy the asserter WAR file multiple times on the same Weblogic server with different context roots ( e.g. devsso, testsso etc.) or a single WAR, but with a different context root than the default one. Make sure to match the cookie path with the new context root in Weblogic.xml before you deploy the asserter. true ASSERTERSESSIONID /ebs Common issues 1) The number one issue reported by the customers is with the WebADI templates. WebADI ( Web Applications Desktop Integrator ) provides the use of Microsoft Office applications such as Excel, Word, and Project to upload data to Oracle E-Business Suite. It initiates the login flow in an embedded browser. The authentication flow goes through as expected but the users don’t land on the expected page. So, when WebADI users click on the "upload document” button, they are taken to the EBS homepage rather than to the "user responsibilities" selection page. This happens when the asserter whitelist URLs are not configured correctly, either the WebADI specific URLs (like "/OA_HTML/BneApplicationService") are missing or there is a typo in the configuration. Another reason could be that an older version of the asserter is being used. Make sure you download the latest asserter from your IDCS tenancy and verify the whitelist URLs configured in bridge.properties. 2) User does not land on the expected URL post logout The user clicks on “logout” button in EBS application and lands on the IDCS login page instead of the one configured as a “post.logout.url” in the asserter configuration. The issue is that the asserter does not find the session cookie, but initiates IDCS logout anyway, without the necessary request data. IDCS session logout happens and the user is taken to the IDCS global session logout URL instead of the asserter application-specific post logout URL. Verify the asserter cookie path configured in "weblogic.xml" file within the asserter WAR. The cookie path must match the context root used for the asserter deployment. For example, if you used “/dev/asserter” as the context root, make sure the cookie path is set to “/dev/asserter” too. Summary Verify the asserter version and configurations mentioned in the tutorial and in this blog and your EBS SSO setup should be a cakewalk. https://www.ateam-oracle.com/post/idcs-ebs-asserter-cheat-sheet https://docs.rackspace.com/blog/set-up-oracle-access-manager-for-ebusiness-suite/

Implications of latest Oracle WebLogic Server connection filters for Oracle EBS r12.2 customers

Above screenshot might click many Apps DBAs who have recently applied - 1. April 2019 CPU Patch 2. Upgraded to Latest AD and TXK level (C.11) Recently I applied Oracle E-Business Suite Technology Stack Delta 11 on an EBS r12.2.7 implementation. After applying patch we went for sanity checks and when trying to open Weblogic Server console I got this - The Server is not able to service this request: [Socket:000445]Connection rejected, filter blocked Socket, weblogic.security.net.FilterException: [Security:090220]rule 2 Below are metalink ids ideally Apps DBAs should refer to for resolving this- Alternative Methods to Allow Access to Oracle WebLogic Server Administration Console from Trusted Hosts for Oracle E-Business Suite Release 12.2 (Doc ID 2542826.1) ORA-12547 While Client Connecting Via SSH Tunnel (Doc ID 454252.1) Oracle Community also has few tips for this- https://community.oracle.com/message/15413970#15413970 Troubleshooting Part - cd $FMW_HOME/user_projects/domains/EBS_domain_/config/ cat config.xml | grep connection-filte oracle.apps.ad.tools.configuration.wls.filter.EBSConnectionFilterImpl< connection-filter> appsnode * * allow 0.0.0.0/0 * * deny We will be exploring all the 3 scenarios with real-time usecases. Option 1: Adding Specific Trusted Hosts 1. This can be done by using context variable - s_wls_admin_console_access_nodes A comma seperated set of ips/hostnames(fqdns) can be used like as follows to allow set of system administrators/weblogic administrators to access console - host1.domain.com,host2.domain.com 2. Execute autoconfig on run filesystem. 3. Stop and start Oracle Weblogic admin server adadminsrvctl.sh stop adadminsrvctl.sh start 4. perform fs_clone to synchronize filesystems adop phase=fs_clone Option 2: Allowing an IP Range This option will be available after applying Patch 29781255:R12.TXK.C. There will be requirements where you need to provide IP range and it is important to first understandd how CIDR works. According to CIDR ruling, you can have a factor set to 4^n This implies we can have ip range as 4,16,64,256 Sample example to narrow down IP range - 195.168.1.32/24 ---> 256 IP Hosts 195.168.1.32/26 ---> 64 IP Hosts 195.168.1.32/28 ---> 16 IP Hosts 195.168.1.32/30 ---> 04 IP Hosts I first checked for patch if already applied as a standard practice. Query 1- set lines 1000 col APPLIED_FILE_SYSTEM_BASE for a40 SELECT b.bug_number, asp.adop_session_id, asp.bug_number patch#, asp.session_type, asp.applied_file_system_base, asp.start_date, asp.end_date FROM ad_bugs b, ad_patch_run_bugs prb, ad_patch_runs pr, ad_patch_drivers pd, ad_adop_session_patches asp WHERE b.bug_id = prb.bug_id AND prb.patch_run_id = pr.patch_run_id AND pr.patch_driver_id = pd.patch_driver_id AND pr.patch_run_id = asp.patchrun_id AND prb.applied_flag = 'Y' AND b.bug_number = '&bug_num'; Enter value for bug_num: 29781255 old 11: AND b.bug_number = '&bug_num' new 11: AND b.bug_number = '29781255' no rows selected Query 2- SELECT adb.bug_number,ad_patch.is_patch_applied('122', 1045, adb.bug_number) FROM ad_bugs adb WHERE adb.bug_number in (29781255); Query 3- select ad_patch.is_patch_applied('R12',-1,29781255) from dual; Once patch was applied, we update CONTEXT file on run fs as follows - cat $CONTEXT_FILE | grep wls | grep nodes 195.168.1.32/30 This can me below set of 4 ips - 195.168.1.32-to-195.168.1.35 Note: Easy way to calculate range of Ips is using online calculator - https://www.ipaddressguide.com/cidr Executed autoconfig and started admin server to reflect changes. Option 3: Adding Specific Trusted Hosts SSH tunneling is pre-requisite here and I achieved it using putty. For lab environment using static ips, this can be simply achieved using below - 1. Ssh -> Logging Provide Destination IP address and keep port for ssh as 22. Save it with some name to it can be loaded later for future reference. 2. Connection -> SSH -> Tunnels Provide Source port, client machine's port which is open and not blocked or used by any other application. In my case it was 81. Provide Destination Hostname:Port and click on 'Add' 3. Go back to session and save it. 4. If you are not intending to logon to server, you can use option under 'Ssh' - 5. Login to saved session and monitor Event log for putty Session - 5. Few more settings are required on your web-browser, I used Firefox here - 127.0.0.1 is for Localhost. Clear browser cache and try console again - https://maazdba.blogspot.com/2019/09/implications-of-latest-oracle-weblogic.html

 

Here’s how a 22-year-old made $1 million by selling NFT selfies

https://indianexpress.com/article/technology/crypto/heres-how-a-22-year-old-made-1-million-by-selling-nft-selfies-7728112/

https://photodoto.com/create-nft-from-photo/

 Hi,

Sometimes You can get “RMAN-06023: no backup or copy of datafile number found to restore ” error.

 

RMAN-06023: no backup or copy of datafile number found to restore

 

Details of error are as follows.

Details of error are as follows.

RMAN-06023: no backup or copy of datafile number found to restore

Cause: A datafile, tablespace, or database restore could not proceed because no backup or copy of the indicated

file was found. It may be the case that a backup or copy of this file exists but does not satisfy the

criteria specified in the user's restore operands.

Action: None - this is an informational message. See message 6026 for further details.

This error is related with autobackups in FRA ( Flash Recovery Area ), There are backup files but they are belonged to different incarnation than the available backups current incarnation.
 
To solve this error, reset the db_recovery_file_dest and db_recovery_file_dest_size parameters, and RMAN will not look for these files in the FRA.
 
SQL> alter system reset db_recovery_file_dest_size scope=spfile sid='*';

System altered.

RMAN-03002: failure of restore command at 03/05/2015 18:03:28
RMAN-06026: some targets not found - aborting restore
RMAN-06023: no backup or copy of datafile 4 found to restore
RMAN-06023: no backup or copy of datafile 3 found to restore
RMAN-06023: no backup or copy of datafile 2 found to restore

SQL> alter system reset db_recovery_file_dest scope=spfile sid='*';

System altered.

Restart database as follows.
SQL> shutdown immediate;
SQL> startup

Script to monitor RMAN progress

 Question:  I have a long running RMAN job, and I want a script to monitor the progress of RMAN execution.  How do you monitor RMAN progress?

Answer:  Oracle has several views that can monitor long running jobs, including v$session_longops and v$process with v$session.  Also see RMAN backup scripts from Windows DOS scripts for RMAN automated backups and example of RMAN shell script.

sselect
  sid,
  start_time,
  totalwork
  sofar,
 (sofar/totalwork) * 100 pct_done
from
   v$session_longops
where
   totalwork > sofar
AND
   opname NOT LIKE '%aggregate%'
AND
   opname like 'RMAN%';

select
   sid,
   spid,
   client_info,
   event,
   seconds_in_wait,
   p1, p2, p3
 from
   v$process p,
   v$session s
 where
   p.addr = s.paddr
 and
   client_info like 'rman channel=%';

Yousef Rifai has published this RMAN monitoring script, quite handy when you need to monitor the status of a long running RMAN backup job:

REM RMAN Progress
alter session set nls_date_format='dd/mm/yy hh24:mi:ss'
/
select SID, START_TIME,TOTALWORK, sofar, (sofar/totalwork) * 100 done,
sysdate + TIME_REMAINING/3600/24 end_at
from v$session_longops
where totalwork > sofar
AND opname NOT LIKE '%aggregate%'
AND opname like 'RMAN%'
/

REM RMAN wiats
set lines 120
column sid format 9999
column spid format 99999
column client_info format a25
column event format a30
column secs format 9999
SELECT SID, SPID, CLIENT_INFO, event, seconds_in_wait secs, p1, p2, p3
  FROM V$PROCESS p, V$SESSION s
  WHERE p.ADDR = s.PADDR
  and CLIENT_INFO like 'rman channel=%'
/

This script by Osama Mustafa will monitor the progress of a running RMAN job:

select
   to_char(start_time,'DD-MON-YY HH24:MI') "BACKUP STARTED",
   sofar,
   totalwork,
   elapsed_seconds/60 "ELAPSE (Min)",
   round(sofar/totalwork*100,2) "Complete%"
from
   sys.v_$session_longops
where  compnam = 'dbms_backup_restore';

Rename directory on ASM

 There are 2 type of Directories in ASM

1) Directories created by DBAC or RMAN are called as “System Directory” and they cannot be renamed.

2) Directories created Manually by issuing command “alter diskgroup add directory” or creating in ASMCMD console.

To check if the directory is system created or manually created check the view V$ASM_ALIAS column SYSTEM_CREATED, directories created by system will have the value as ‘Y’

To Rename “Manually” created directories

Login to the ASM console
[grid@tstdev01 ~]$ asmcmd
ASMCMD> cd DATA
ASMCMD> ls
ASM/
DEV/  — Here to rename DEV to TEST

SQL> ALTER DISKGROUP DATA RENAME DIRECTORY ‘+DATA/DEV’ to ‘+DATA/TEST’;
Diskgroup altered.

Once done longin to ASM console and verify the same
[grid@tstdev01 ~]$ asmcmd
ASMCMD> cd DATA
ASMCMD> ls
ASM/
TEST/

To Rename System Created directories

System created directory cannot be rename, use parameter db_unique_name of database. Oracle ASM and Oracle Diagnostic Dest create your own directory structure based on parameter DB_UNIQUE_NAME.

Move Database using RMAN

RMAN> report schema;

using target database control file instead of recovery catalog
Report of database schema for database with db_unique_name DEV

List of Permanent Datafiles
===========================
File Size(MB) Tablespace RB segs Datafile Name
—- ——– ——————– ——- ————————
1 17408 SYSTEM YES +DATA/DEV/DATAFILE/system.259.941719615
2 1800 UNDOTBS1 YES +DATA/DEV/DATAFILE/undotbs1.267.941720063
3 4696 SYSAUX NO +DATA/DEV/DATAFILE/sysaux.258.941719569
4 1243 EXAMPLE NO +DATA/DEV/DATAFILE/example.266.941719731
5 118 USERS NO +DATA/DEV/DATAFILE/users.260.941719669

List of Temporary Files
=======================
File Size(MB) Tablespace Maxsize(MB) Tempfile Name
—- ——– ——————– ———– ——————–
2 1300 TEMP 1300 +DATA/DEV/TEMPFILE/temp.271.942061583

$sqlplus sys as sysdba
SQL> show parameter db_unique_name
NAME TYPE VALUE
———————————— ———– ——————————
db_unique_name string DEV

SQL> show parameter control_files

NAME TYPE VALUE
———————————— ———– ——————————
control_files string +DATA/DEV/CONTROLFILE/current.262.941719717

SQL> Alter system set DB_UNIQUE_NAME=’TEST’ scope=spfile;

SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.

SQL> startup nomount
SQL> show parameter db_unique_name

NAME TYPE VALUE
———————————— ———– ——————————
db_unique_name string TEST

$rman target /
RMAN> restore controlfile from ‘+DATA/DEV/CONTROLFILE/current.262.941719717’;
Starting restore at 10-MAY-17
using target database control file instead of recovery catalog
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=162 device type=DISK
channel ORA_DISK_1: copied control file copy
output file name=+DATA/TEST/CONTROLFILE/current.263.981519213
Finished restore at 10-MAY-17

RMAN> startup mount;
database is already started
database mounted
released channel: ORA_DISK_1

RMAN> CONFIGURE DATAFILE BACKUP COPIES FOR DEVICE TYPE DISK TO 3;
new RMAN configuration parameters:

RMAN> CONFIGURE DATAFILE BACKUP COPIES FOR DEVICE TYPE DISK TO 3;
new RMAN configuration parameters are successfully stored

RMAN > CONFIGURE DEVICE TYPE DISK PARALLELISM 3 BACKUP TYPE TO BACKUPSET;
new RMAN configuration parameters:

RMAN> CONFIGURE DEVICE TYPE DISK PARALLELISM 3 BACKUP TYPE TO BACKUPSET;
new RMAN configuration parameters are successfully stored

RMAN> BACKUP AS COPY DEVICE TYPE DISK DATABASE FORMAT ‘+DATA’;
Finished backup at 10-MAY-17

RMAN> SWITCH DATABASE TO COPY;
datafile 1 switched to datafile copy “+DATA/TEST/datafile/system.290.793638779”

RMAN> run {
set newname for tablespace TEMP to ‘+DATA’ ;
switch tempfile all;
}

RMAN> report schema;
Report of database schema for database with db_unique_name TEST

List of Permanent Datafiles
==================
File Size(MB) Tablespace RB segs Datafile Name
—- ——– ——————– ——- ————————
1 17408 SYSTEM YES +DATA/TEST/datafile/system.290.793638779
2 1800 UNDOTBS1 YES +DATA/TEST/datafile/sysaux.291.793638757
3 4696 SYSAUX NO +DATA/TEST/datafile/undotbs1.292.793638823
4 1243 EXAMPLE NO +DATA/TEST/datafile/example.293.793638849
5 118 USERS NO +DATA/TEST/datafile/users.294.793638849

List of Temporary Files
=======================
File Size(MB) Tablespace Maxsize(MB) Tempfile Name
—- ——– ——————– ———– ——————–
1 1300 TEMP 1300 +DATA

RMAN> startup;
database is already started
database opened

Create the new redolog files and drop the old ones.

Once the above activity is completed backup the database.

RMAN> backup database;
Starting backup at 10-MAY-17
using target database control file instead of recovery catalog
allocated channel: ORA_DISK_1
channel ORA_DISK_1: SID=162 device type=DISK
allocated channel: ORA_DISK_2
channel ORA_DISK_2: SID=194 device type=DISK
allocated channel: ORA_DISK_3
channel ORA_DISK_3: SID=210 device type=DISK
.
.
Recovery Manager complete.

Now you can remove the copy:

RMAN> delete copy;

Advertisements

Oracle RMAN : Restore/ recover a database UNTIL TIME

 This tutorial explains you how to restore/ recover a database until a time.

Oracle RMAN : Restore/ recover a database UNTIL TIME

Here are the steps for Restoring/ Recovering an Oracle database until a specific time in the past:

 

1) Set the environment:

 

on Windows

set ORACLE_SID=DB10
echo %ORACLE_SID%
 

on AIX/Linux

export $ORACLE_SID=DB10

echo $ORACLE_SID

 

2) Connect to rman:

rman target / nocatalog
 

 

3) Start the database in "mount" state:

startup mount;
 

 

4) Run the following :
---------------------------------------
restore database UNTIL TIME
"to_date('11/03/2017 11:34:50 am','mm/dd/yyyy hh:mi:ss am')";

recover database UNTIL TIME
"to_date('11/03/2017 11:34:50 am','mm/dd/yyyy hh:mi:ss am')";

alter database open resetlogs;
---------------------------------------
OR

run
{
set UNTIL TIME "to_date('11/03/2017 11:34:50 am','mm/dd/yyyy hh:mi:ss am')";
restore database;
recover database;
alter database open resetlogs;
}

 

Note:

You have to put the right date/time.