Thursday, September 5, 2019

Troubleshooting the Self Service Framework with Oracle Applications (Doc ID 231137.1)

Troubleshooting the OA Framework

Table Of Contents

  1. Troubleshooting Guide
  2. Profile Options Reference

FAQ and Troubleshooting Guide


General

  1. When starting a framework application you get an HTML page with the following error:

    The page cannot be displayed
    The page you are looking for is currently unavailable.
    The Web site might be experiencing technical difficulties, or you
    may need to adjust your browser settings.
    Check to make sure your Apache Server has been started properly. Check your error_log, jserv.log and mod_jserv.log for any errors.Note: One user reported that he encountered"the page cannot be displayed" error even after following the above instructions. He reports that the error was resolved, by making sure his DISPLAY was set to an x-server that was working (his variable was set correctly , but the x-server was not working, tested by pointing to an active x-term on PC using reflections) and when he switched it, the advanced task page rendered correctly.
     
  2. How do I test my Webserver setup for Self Service Framework Applications?

    To do this run the AOL test UI. This option consists of a collection of tests that you can run to determine if your web server is configured properly. You can access these tests via :
    http://<Hostname:port>/OA_HTML/jsp/fnd/aoljtest.jsp
After you sign in, some preliminary information about your environment will be displayed. Click on the Enter Aol/J Setup Test link to get to the menu of tests. You must run the tests under the "Connection Test" and "Apps Framework Agent" categories.
    Test NameComments
    Locate DBC FileMandatory. Run this test first.
    Verify DBC SettingsMandatory. Run this test second.
    AOL/J Connection testMandatory. Run this test third.
    Apps Framework AgentMandatory
    Virtual Directory SettingsMandatory
    Jsp PingMandatory
    Cabo Setup TestsMandatory
    X Server Accessibility TestMandatory
    OA Framework System InfoMandatory
    Servlet PingOptional
    Versions for Loaded ClassesOptional
  1. How do I test my Self Service Framework installation?

    To test your Self Service Framework installation and setup, use the following instructions
    1. Log in to Applications using the System Administrator responsibility.
       
    2. Using the Define User Form, add the following responsibility to any user who will access the Oracle Self Service Applications:Preferences (This is the standard Oracle Self Service Preferences Responsibility.)
      Workflow User Web Applications (This is the standard Workflow User Responsibility. This will allow your users to access the new Workflow Worklist Notification User Interface.) 
    3. To add Lookup Type/Lookup Codes HTML interface for a System Administrator who will add new lookup types of codes, use the Define User Form, add the following responsibilitiesSystem Administration
      (This is the standard Oracle Self Service Administration Responsibility.) 
    4. Test the setup of your Self Service Framework Apache Environment.
       
      1. Add the "Workflow User Web Applications" responsibility to a test user, using the standard User Definition Form.
         
      2. Bring up a browser and log in to Self Service Applications using the test user name to which you just added the "Workflow User Web Applications" responsibility.
           
      3. From the Navigate Region on the Self Service Personal Home Page, click on the Workflow User Web Applications responsibility.
         
      4. From the list of Workflow functions under the Workflow User Web Applications on the right side of screen, click on the Advanced Worklist option.After a few seconds of initialization on the Http Server, the new Workflow Worklist will appear. If it does not, then please review the Troubleshooting guide below to ensure the various components are setup correctly.
  2. How can I figure out the version of the Self Service Framework I am using?

    Execute the following command to determine the version of OA.jsp :
    ident $FND_TOP/html/OA.jsp and
    ident $OA_HTML/OA.jsp and
    The version of OA.jsp in $FND_TOP should be the same as the one in $OA_HTML.  Use the table below to figure out the version of the Framework installation.

    OA.jsp VersionOA Framework VersionARU Patch Number
    115.565.10Patch:3875569.
    115.365.7Patch:2771817.
    115.275.6Patch:2278688.
  3. Which version of the JDK should I use?

    You must use jdk 1.3. If you don't have this version follow the upgrade instructions found in MetaLink Note 130091.1, titled Upgrading to JDK 1.3 with Oracle Applications 11i.
     
  4. Which JDBC drivers (classes12.zip, jdbc12.zip etc.) Should I use?

    When you upgrade from JDK 1.1.8 you must use the jdbc drivers rehosted by Oracle Applications in jdbc12.zip. For complete details on this topic please refer to MetaLink Note 164317.1, titled Upgrading Oracle JDBC Drivers with Oracle Applications 11i and MetaLink Note 130091.1, titled Upgrading to JDK 1.3 with Oracle Applications 11i 
     
  5. Why do I need to set FND_TOP on the webserver? And how do I set it?

    FND_TOP is used to derive the location of the dbc file which is then used to make connections to the appropriate database. If this is not set Oracle Applications will resort to using the old env.txt mechanism for figuring out FND_TOP so it can locate the dbc file. The env.txt mechanism for storing the location for FND_TOP will NOT work in an HTTPS environment.
     
  6. How do I configure Self-Service Applications with Oracle Parallel Server?

    If you are using Oracle Applications 11.5.6, please refer to the System Administrator's Guide, section G59.
     
  7. I have installed Self-Service Applications with NLS. After submitting a page I get garbage characters.For NLS Customers, if after submitting a page you get garbage characters then you need to install OJSP1.1.2 as the initial release of Oracle Applications 11iconfigures your web server to use Oracle JavaServer Pages (OJSP) version 1.0.0.6.1. Please check ARU release notes and metalink note 132604.1 for more details.
  1. I am getting a Framework exception raised associated with the servlet.framework.code property.Make sure in the root.zone you have the following:
servlet.framework.code = oracle.apps.fnd.framework.provider.OAFrameworkHttpProvider
not
servlet.framework.code = oracle.apps.fnd.framework.provider.OAFrameworkHttpProvider
Remove the two extra spaces around the " = " if present.
  1. AD patches prereq patch 2729622.When you apply AD patch 2708116 you will notice that it prereqs the FWK patch 2729622. If you apply this patch please be sure to do the following:
    If you are using AutoConfig then obtain and apply the fix for bug 2715734.
    If you are not using AutoConfig then make the following manual changes to your configuration files:
    • Replace each <full location of JAVA_TOP>/apps.zip with <full location of JAVA_TOP> in the configuration files jserv.properties and zone.properties.
    • If any of these files do not exist or do no not reference JAVA_TOP you do not need to modify them.
       
  2. Why am I seeing the error "Request URI:/OA_HTML/OA.jsp Exception: oracle.jsp.parse.JspParseException:...."

    This error will be seen if you haven't changed the apps.zip reference to JAVA_TOP. See "AD patches prereq patch 2729622." for more information. The exact text the error message you see will resemble the following:
  3. Request URI:/OA_HTML/OA.jsp
    
    
    Exception:
    oracle.jsp.parse.JspParseException: Line # 13, scope = "request"> 
    Error: Unable to find class for bean: pageBean defined by tag with class: 
      oracle.apps.fnd.framework.webui.OAPageBean
      at oracle.jsp.parse.OpenJspTagHandler.defineBeans(OpenJspTagHandler.java:299)
      at oracle.jsp.parse.OpenJspTagHandler.defineBeans(OpenJspTagHandler.java:258)
      at oracle.jsp.parse.OpenJspTagHandler.validateTagAttributes(OpenJspTagHandler.java:221)
      at oracle.jsp.parse.JspParseTag.parse(JspParseTag.java:672)
      at oracle.jsp.parse.OpenJspTagHandler.parse(OpenJspTagHandler.java:467)
      at oracle.jsp.parse.JspParseTag.parseNextTag(JspParseTag.java:548)
      at oracle.jsp.parse.JspParseTagFile.parse(JspParseTagFile.java:100)
      at oracle.jsp.parse.OracleJsp2Java.transform(OracleJsp2Java.java:40)
      at oracle.jsp.app.JspAppLoader.translatePage(JspAppLoader.java:1513)
      at oracle.jsp.app.JspAppLoader.reloadPage(JspAppLoader.java:1146)
      at oracle.jsp.app.JspAppLoader.loadPage(JspAppLoader.java:1005)
      at oracle.jsp.app.JspAppLoader.getPage(JspAppLoader.java:671)
      at oracle.jsp.app.JspApplication.dispatchRequest(JspApplication.java:337)
      at oracle.jsp.JspServlet.doDispatch(JspServlet.java:259)
      at oracle.jsp.JspServlet.internalService(JspServlet.java:178)
      at oracle.jsp.JspServlet.service(JspServlet.java:148)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:588)
      at org.apache.jserv.JServConnection.processRequest(JServConnection.java:456)
      at org.apache.jserv.JServConnection.run(JServConnection.java:294)
      at java.lang.Thread.run(Thread.java:479)
  4. Why is the framework hanging?

Previously we had advised technical staff to set "wrapper.bin.parameters=-Djava.compiler=NONE" in their jserv.properties file in order to enable the error stack dumps to show line numbers, instead they display the literal "(compiled code)". If the java.compiler remains set to "NONE" it will cause the framework to hang.
Hanging could also be a result of logging. Please see "I have enabled logging and now the framework hangs or is horribly slow. What can I do?".
  1. Why, when I try to run a self-service application I see an error similar to "oracle.apps.fnd.framework.OAException: Application: FND, Message Name: FND_NO_REGION_CODE. Tokens: REGION = WFNTFWORKLISTFNPAGE; REGIONAPPLID = 601"?This can occur when the OS locale is set differently from the database locale. For example, if the OS locale setting is: LC_CTYPE=en_UK and the Oracle locale setting is: NLS_LANG=AMERICAN_AMERICA.WE8ISO8859P1 then you may see this error. To get around this error, in jserv.properties add the following line:
    wrapper.env.copy=NLS_LANG 
    
  2. When applying OA 5.7H (2771817) D driver, I get an error: FAILED: file CustMigrationTool.class on worker 1. and the log file shows Error: No database connection available. Io exception: Invalid number format for port number.This problem is related to running the customization migration tool on a 9.2.0.2 database on some platforms, one being Linux. The problem is resolved in a later version of jrad.zip which is included in the OAF 5.7 V1 rollup patch (2800986). The issue is that the copy driver for 2800986 needs to be installed before running the database driver for the base OAF 5.7 (2771817) installation. This step is required so that the database driver d2771817.drv will run the Customization Tool succussfully. The order that the patch drivers should be applied are:
    • c2771817.drv
    • c2800986.drv
    • d2771817.drv
    • d2800986.drv
    • g2771817.drv
    • g2800986.drv
If you're in the middle of a d-driver and want to save your state then backup the applsys tables fnd_install_processes and ad_deferred_jobs ( if you have it ). Then, rename the $APPL_TOP/admin/SID/restart directory and kick off the c driver for the rollup patch's c-driver, restore the tables and the restart directory and you should be able to resume where you left off.
For more deatails please see bug # 2881752.

Dynamic Gif Generation / X (display) Server / Images, Buttons

  1. Why do I need to configure an X server for Framework applications?

To take advantage of the dynamic image generation support Framework applications require access to graphical capabilities on the middle tier. In practical terms this means you need to configure your Webserver to use an X server for dynamic gif generation.
  1. My framework application does not render or is missing a number of icons.

Check for the following directory under <OA_HTML>
<OA_HTML>/cabo/jsps
<OA_HTML>/cabo/styles
<OA_HTML>/cabo/images
<OA_HTML>/cabo/OAImages
<OA_HTML>/cabo/jsLibs
If you do not see these directories, make sure you have applied the latest AD patch available on MetaLink. At the very minimum you should have applied patch 1238573 to ensure you can unzip the various image files that are required by the new Self Service Framework. Note, that this AD patch is from a while back and you most likely have the correct version of AD by now.
The zip files containing the images that are not rendering are included in the framework patch you applied. Once you have confirmed that you have the correct version of AD you should run the copy driver for your patch to ensure these files are unpackaged.
The <FND_TOP>/html/marlin_html.zip <FND_TOP>/media/marlin_media.zip must be unzipped in your <OA_HTML> directory to lay down all the required html, javascript, and image files.
  1. My application page does not render Global buttons and tabs. And the submit buttons are being rendered as basic (gray) html buttons.

This can happen for one of the following reasons :
- The web server that is running framework applications does not have access to an X Server, so it cannot do dynamic gif generation.
- The /OA_HTML/cabo/images and /OA_HTML/cabo/styles directories are not writable by the user who owns the apache process.
- The /OA_HTML/cabo/styles directory is either missing oa.xss and/or blaf.xss or it contains old or corrupt versions of them. We provide a collection for jsps for testing X server accessibility and the setup for the cabo directories. For details on how to use these tests refer to Test your Webserver setup for Self Service Framework Applications step in the section above Configuring Http Server for Self Service Framework Applications.
  1. I get a "Document contained no data" error when I try to launch the framework from the Personal Home Page.

This could happen for a number of reasons. The most common ones are : your apache server is down; jserv is down; jserv is pointing to an X server that is down; jserv is pointing to an X server that is not configured properly.
In order to fix this please make sure both apache and jserv are up and running.
  1. Why do I get the error "Can't connect to X11 window server using ':0.0' as the value of the DISPLAY variable" when I try to run my Self Service Framework application on Unix? (Everything works fine on Windows.)

This can happen if you didn't configure your Webserver to use an X server; or if the X server is down or otherwise not accessible by your Webserver. You may also see the following related error :
Request URI:/OA_HTML/OA.jsp
Exception:
java.lang.NoClassDefFoundError:sun/awt/X11GraphicsEnvironment
  1. I see a oracle.apps.fnd.framework.OAException: java.lang.NullPointerException in my error log and my error stack resembles this sample error stack.

If you get the following error stack check the file system permissions for the physical directory structure that is referenced as OA_HTML in your httpd.conf or httpds.conf file. Make sure that this physical directory structure is writeable by the user who is launching the apachectl command. We write dynamic gifs to this location at runtime, so the user who launches Apache must be able to write to that directory. You must also run the test called "Cabo Setup Tests" listed under Test your Webserver setup for Self Service Framework Applications
oracle.apps.fnd.framework.OAException: java.lang.NullPointerException
at oracle.apps.fnd.framework.OAException.wrapperException
(OAException.java, Compiled Code)
at oracle.apps.fnd.framework.webui.OAPageBean.prepareException
(OAPageBean.java, Compiled Code)
at oracle.apps.fnd.framework.webui.OAPageBean.renderBody
(OAPageBean.java, Compiled Code)
at oa_html.OA._jspService(OA.java, Compiled Code)
at oracle.jsp.runtime.HttpJsp.service(HttpJsp.java, Compiled Code)
at oracle.jsp.app.JspApplication.dispatchRequest
(JspApplication.java, Compiled Code)
at oracle.jsp.JspServlet.doDispatch(JspServlet.java, Compiled Code)
at oracle.jsp.JspServlet.service(JspServlet.java, Compiled Code)
at javax.servlet.http.HttpServlet.service(HttpServlet.java, Compiled Code)
at org.apache.jserv.JServConnection.processRequest
(JServConnection.java, Compiled Code)
at org.apache.jserv.JServConnection.run(JServConnection.java, Compiled Code)
at java.lang.Thread.run(Thread.java, Compiled Code)
java.lang.NullPointerException
at oracle.cabo.ui.laf.browser.TabBarRenderer._getImage
(TabBarRenderer.java, Compiled Code)
at oracle.cabo.ui.laf.browser.TabBarRenderer.prerender
(TabBarRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.render(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseUINode.render(BaseUINode.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.renderChild(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.renderNamedChild(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.laf.browser.PageHeaderLayoutRenderer.renderContent
(PageHeaderLayoutRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.render(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseUINode.render(BaseUINode.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.renderChild(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.renderNamedChild(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.laf.browser.BorderLayoutRenderer._renderStackedChild
(BorderLayoutRenderer.java, Compiled Code)
at oracle.cabo.ui.laf.browser.BorderLayoutRenderer.prerender
(BorderLayoutRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.render(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseUINode.render(BaseUINode.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.renderChild(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.renderIndexedChild
(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.renderIndexedChild
(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.renderContent(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseRenderer.render(BaseRenderer.java, Compiled Code)
at oracle.cabo.ui.BaseUINode.render(BaseUINode.java, Compiled Code)
at oracle.apps.fnd.framework.webui.OAPageBean.renderBody
(OAPageBean.java, Compiled Code)
at oa_html.OA._jspService(OA.java, Compiled Code)
at oracle.jsp.runtime.HttpJsp.service(HttpJsp.java, Compiled Code)
at oracle.jsp.app.JspApplication.dispatchRequest
(JspApplication.java, Compiled Code)
at oracle.jsp.JspServlet.doDispatch(JspServlet.java, Compiled Code)
at oracle.jsp.JspServlet.service(JspServlet.java, Compiled Code)
at javax.servlet.http.HttpServlet.service(HttpServlet.java, Compiled Code)
at org.apache.jserv.JServConnection.processRequest
(JServConnection.java, Compiled Code)
at org.apache.jserv.JServConnection.run(JServConnection.java, Compiled Code)
at java.lang.Thread.run(Thread.java, Compiled Code)
  1. I see "java.lang.IllegalArgumentException: /d1/dB/apache139/apache/htdocs/html//cabo/styles/blaf.xss does not exist" in my error_log?

Same as answer to question #6 above.
  1. I see "java.lang.IllegalArgumentException: Couldn't create /d1/dB/apache139/apache/htdocs/html/cabo/images/cache" in my error_log?

Same as answer to question 6 above.
  1. Buttons are not being rendered correctly with Simplified Chinese / Traditional Chinese / Japanese / Korean / Thai characters. When logging in to the Personal Home Page, I see that the buttons that are displayed on the page show every character as a rectangle, instead of the correct language characters.If you encounter this problem you need to copy Albany WTJ font file into <JRE_TOP>/lib/fonts directory to support characters for these languages for images generated at server side. i.e. copy the Albany fonts from FND_TOP/resource to the jre/lib/fonts subdirectory of your JDK directory (/usr/java/jdk*.*.*/jre/lib/fonts). After restarting the apache server, the icons should now be rendered with the correct language characters.
    For more information on this topic please refer to the document "How to install Unicode fonts for Apps 11i" in Oracle's Metalink.

Performance

  1. After restarting the server, the response time for the first user to log in is really slow. How can I fix it?

You can use a servlet that will load a large of chunk of most commonly used Framework classes at server startup time. This servlet is currently available via patch 2342925 for 5.5.2, 5.6 and 5.7 customers. It will be available for 5.6 customer shortly. Here's how you can use the servlet.
  • Update the the following parameter in the context file using the Oracle Applications Manager Context Editor from:
<oafwkstartup oa_var="s_oafwkstartup">#</oafwkstartup>
to
<oafwkstartup oa_var="s_oafwkstartup"></oafwkstartup>
  • Run AutoConfig to propagate the change.
Note: For more information about AutoConfig, refer to MetaLink Note 165195.1 "Using AutoConfig to Manage System Configurations with Oracle Applications 11i".
  1. Why am I getting java.lang.outOfMemory errors and what can I do to fix them?

OutOfMemory exceptions are thrown when the JVM runs out of heap space. Make sure that you have allocated enough memory for your JVM. Check the following entry in the jserv.properties file to make sure you the appropriate heap size range was specified. Here's an example of the how the heap size is specified in the jserv.properties file.
wrapper.bin.parameters=-Xms255m -Xmx400m
You should also make use of the AM Pool monitor to keep track of memory consumption as various applications are used. It will help you determine if the application is misbehaving or if the JVM heap size needs to be tweaked.
  1. How can I limit middle-tier resource consumption by a user?

The Self Service Framework includes a profile option for limiting the number of rows that any user can return to an HTML application through a query operation. The profile name is "FND: View Object Max Fetch Size". The default site level value for this profile is 200 rows. This profile ensures that no single user can consume all the memory of a Jserv Listener through a wide open search in an inquiry or LOV. You can reduce this number to ensure that the middle tier resources (memory) are shared evenly across all your users. When you hit this limit, you are not allowed to fetch the next set of rows by clicking on a Next button or some other UI control. Unfortunately we are not able to display a warning to the user when this limit is reached. They simply cannot get to the next set of rows. The next version of the Self Service Framework will be able to display such a good warning showing the current limit.
  1. How can I setup and access the Application Module Pool Monitor?

    1. Make sure you have <JAVA_TOP> in the repositories directive in the zone.properties file.
       
    2. Add the following servlet alias for the pool monitor servlet, to the zone.properties file.
      servlet.OAAppModPoolMonitor.code=oracle.apps.fnd.framework.webui.perf.OAAppModPoolMonitor
    3. Stop and start Apache.
        
    4. Access the pool monitor via the following url. Please note that Rapid Install creates a a default servlet zone for you. It is called "servlets" and can be used as the servlet_zone_name in the following url.
      http://<Hostname:port>/<servlet_zone_name>/OAAppModPoolMonitor
  2. How can I access the Application Module Pool Monitor in multiple (load-balanced) jserv environment?

The Application Module Pool Monitor setup steps (described above) still apply.
If your server has a load-balanced jserv configuration and all servlets use the same servlet zone name, you cannot choose what JVM the pool monitor servlet will connect to. In fact, it turns out that in such a configuration the pool monitor will eventually connect to all active JVMs and will hence show different results almost every time it is run.
In order to get a consistent view from the pool monitor you will have to alter your jserv configuration so that the pool monitor is forced to connect to the JVM of your choice. You can achieve this by creating unique zone names. Following is an example configuration.
Load-balanced configuration where the pool monitor chooses the JVM it will connect to
ApJServMount /servlets balance://set1/root
ApJServBalance set1 Jserv1
ApJServBalance set1 Jserv2

ApJServHost Jserv1 ajpv12://127.0.0.1:9001
ApJServHost Jserv2 ajpv12://127.0.0.1:9002

ApJServRoute JS1 Jserv1
ApJServRoute JS2 Jserv2
If you have configuration similar to the above example, then when you access the pool monitor via http://<hostname:port>/servlets/OAAppModPoolMonitor, the monitor can connect to Jserv1 or Jserv2. It will randomly switch between the two every time you access the monitor.
If however, you use the following configuration then instead of using the generic zone name as in :
http://<hostname:port>/servlets/OAAppModPoolMonitor
you can use following :
http://<hostname:port>/monitor1/OAAppModPoolMonitor
http://<hostname:port>/monitor2/OAAppModPoolMonitor
Load-balanced configuration where you choose what JVM the pool monitor will connect to
ApJServMount /servlets balance://set1/root
ApJServMount /monitor1 ajpv12://127.0.0.1:9001/root
ApJServMount /monitor2 ajpv12://127.0.0.1:9002/root

ApJServBalance set1 Jserv1
ApJServBalance set1 Jserv2

ApJServHost Jserv1 ajpv12://127.0.0.1:9001
ApJServHost Jserv2 ajpv12://127.0.0.1:9002

ApJServRoute JS1 Jserv1
ApJServRoute JS2 Jserv2
Attention : You should keep the generic servlet zone name around if you are using any applications like CRM that use the Apps Servlet Agent profile option. The reason being that the value of this profile option is usually set to http://<hostname:port>/servlet_zone_name. Let's say that, as in our example above, the servlet zone name is "servlets" so your profile option is set to http://<hostname:port>/servlets. If you take away the "servlets" zone name your CRM applications would suddenly stop working. More importantly, even if you now changed the profile option to one http://<hostname:port>/monitor1 or http://<hostname:port>/monitor2 then the CRM application would work but they could no longer take advantage of the load-balanced Jserv configuration. CRM users will always connect to the same JVM, the one that the Apps Servlet Agent profile option points to.
In other words, the generic servlet name is necessary to keep the jserv load-balancing working properly. The new ApJServMount points are simply additions to control the am pool monitor behavior.
  1. How do I know if the Application Modules are being released?

Look for the following diagnostics in the error_log file:
BC4J HTTP Container was timed out
The binding listenerfor <:your_ApplicationModule_name> was timed out
You should also rely on the AM Pool monitor to get detailed information.
  1. How can I set up a load-balanced Jserv configuration for my http server?

There are many ways to balance the load of your applications across many Apache Listeners and Jserv (Java Servlet Listener) instances. Setting the Framework Agent profile at different profile levels is one method. The Apache Web Server itself has the ability to load balance many different JServ (Java Servlet Listener) instances for high volume usage. Load balancing Jserv instances under one Apache Listener is a more robust approach than setting up numerous Apache Listeners. You can learn more about load balancing an Apache Java Servlet engine from a variety of sources. The most thorough discussion on this topic can be found at:
http://java.apache.org/jserv/howto.load-balancing.html
Future versions of the Self Service Framework will provide HTML Configuration User Interfaces that will assist you setting up a load balanced Apache/Jserv Listener.
  1. How do I enabling browser caching in OA Framework Applications in SSL Mode?
We are planning to use an Apache module called mod_expires to enable browser caching under SSL. Mod_expires controls the setting of the HTTP Expires header field in server responses. Please note this caching technique currently works under IE only. We are still investigating why Netscape is unable to make use of this Apache capability.
To enable caching under SSL the following directives should be added to the httpd.conf file of the Apache configuration. The expiration should be set relative to the time of the source document's last client access. In addition, the expiration date should be specialized by the content type and applied only to the documents under the virtual directory mapping /OA_HTML/.
<Directory "<physical_path_corresponding_to_the_alias_/OA_HTML/>"> 
#enable the generation of the Expires header for files under /OA_HTML/
ExpiresActive On 
#expire images one month after last client access 
ExpiresByType image/gif "access plus 1 month" 
#expire stylesheets one week after the last client access 
ExpiresByType text/css "access plus 1 weeks" 
#expire javascript libraries one day after the last client access 
ExpiresByType text/javascript "access plus 1 days"  
</Directory>
  1. How do I set the session timeout limit appropriately?In order to appropriately set the session timeout limit for Self Service Framework Applications you need to synchronize the value used by the webserver with the value specified in an Oracle Applications profile option called ICX: Session Timeout. For a list of session related options please refer to the section below on profile options.
    The ICX: Session Timeout option sets the the maximum number of minutes to wait before invalidating an idle ICX Session. The default value is null. The web server session timeout value, or more appropriately the Apache Jserv Session value is used to specify the number of milliseconds to wait before invalidating an unused session. The default value is 1800000 or 30 minutes.
    We recommend that you set the ICX: Session Timeout and the Apache Jserv Session to be the same. It's better to be consistent and let the ICX session and the Apache Jserv (middle tier) session expire at the same time. If the ICX session expires before the Jserv session, the user will be presented with a login page even though the Jserv session is still active. If the user logs back in before the Jserv session expires, they will see the old state of their middle-tier transaction. This can be confusing, since from the point of view of the user there is no distinction between the ICX session and the Jserv session.
    We also recommend that you do not set the Apache Jserv Session timeout to be any higher than 30 minutes. Longer idle sessions will drain the JVM resources and can also cause out of memory errors.
    The session timeout for the webserver is specified via the following directive in the <ORAHTTP_TOP>/Jserv/etc/zone.properties file.
  2. session.timeout=180000
  3. Why am I getting horrible performance problems since I turned on statement level logging?Turning on the profile for statement level logging without setting the module name logging profile can result in horrendous performance problems. The profile option names are in the profile reference in this document.

Classpath

  1. I get the error : java.lang.NoClassDef FoundError:sun/tools/javac/Main

Check jserv.properties for the following entries:
wrapper.classpath=<location of tools.jar under your JDK 1.3 installation>
wrapper.classpath=<location of rt.jar under your JDK 1.3 installation>
Make sure the value is pointing to the correct java directory based on the JDK 1.3 upgrade instructions found in MetaLink Note 130091.1, titled Upgrading to JDK 1.3 with Oracle Applications 11i.
  1. I get the error : java.lang.NoClassDefFoundError: org/xml/sax/ContentHandler

Check wrapper.classpath settings in jserv.properties. Make sure they include:
wrapper.classpath=<JAVA_TOP>/sax2.zip
  1. I get the error : java.lang.NoClassDefFoundError: oracle/xml/parser/v2/XMLParseException

Check wrapper.classpath settings in jserv.properties. Make sure they include:
 wrapper.classpath=<JAVA_TOP>/xmlparserv2.zip 
  1. I get an FND_BAD_DBC_PARAMETER when I try to launch my framework application from the Personal Home Page

This can occur if in your classpath $OA_JAVA/jdbc12.zip is placed after the JAVA_TOP. To fix this reverse the order - put JAVA_TOP before jdbc12.zip in your classpath. Bounce the server and run the application again.
  1. How to deal with NoClassDef... Exceptions?

Such exceptions usually indicate that the classpath is either not complete or it is incorrect. Check and double-check to ensure that the classpath has all the required components and in the right order. Usually such exceptions are informative enough to let you know which component is missing. For instance, when you see an exception like java.lang.NoClassDefFoundError: org/xml/sax/ContentHandler - it is safe to conclude that sax2.jar is either missing from your classpath or that you are looking at an incorrect version.

DBC File

  1. What is a DBC file? What is used for and how do I create one?

A DBC (Database Connection) file is a text file which stores all the information required to connect to a particular database. It allows a user or administrator to easily load groups of environment variable settings. At the minimum it contains the value of the GWYUID, FNDNAM, TWO_TASK and GUEST_USER_PWD.

Location: $FND_TOP/secure
How it is created : Please refer to "Oracle Applications System Administrator's Guide" How to test it: Please refer to Test your Webserver setup for Self Service Framework Applications in the section Configuring Http Server for Self Service Framework Applications.
  1. Why am I getting the error oracle.apps.fnd.framework.OAException: Application: FND, Message Name: FND_ONLY_ONE_DBC_ALLOWED_PER_JVM.

You will see this error message when you try to access more than one database within the same JVM. The dbc file is used by the middle-tier to figure out which database to connect to. If User A and User B point to the same webserver and User A launches framework applications by using a dbc file that points to database1, then User B cannot launch framework applications by using a dbc file that points to a different database. The only way to get around this problem is to bounce the web server and to make sure all users of your server point to the same dbc file. Some examples scenarios which lead to such an error include :
- User A launches framework applications using dbc1 which connects to database1. The file dbc1 is changed to point to database2 and the webserver is not bounced. When a new user connects or User A reconnects they will now try to connect to database2 within the JVM.
- Applications Database ID profile option for framework users isn't set to the same database. This profile option is set to null by default.
- Your users launch framework applications via local test JSPs and/or the Personal Home Page. Since the test JSPs have the dbc file name hardcoded in them, it is possible that the user who connects through the test.jsp uses a different dbc file than the user who connects through the Personal Home Page. It is also possible that you have various test JSPs and each of them points to a different database.
Note : The dbc file is located under the $FND_TOP/secure directory of your $APPL_TOP.
  1. I get an HTML page with the error message: oracle.apps.fnd.framework.OAException: Application: FND, Message Name: FND_GENERIC_MESSAGE. Tokens: MESSAGE = java.io.FileNotFoundException: /apps/vis115bappl/fnd/11.5.0/secure/ap506dbs_vis115b.dbc (No such file or directory);

Check jserv.properties for the following entry:
wrapper.bin.parameters=-DFND_TOP=<Your physical path to FND_TOP>
Make sure this FND_TOP setting is correct so Oracle Applications can load your dbc file to make connections to the appropriate database. There are more details on testing DBC file in #1 above.
  1. I see the following error message when I try to launch my application from the Personal Home page :
    oracle.apps.fnd.framework.OAException: Application: 
    FND, Message Name: SECURITY_APPL_LOGIN_FAILED.
    (NOTE: This message could not be looked up because 
    an Application Module has not been set on the exception) 
This happens when the GUEST_USER_PWD parameter in the dbc file contains an invalid user/password combination. Please make sure that you specify an existing applications user with a valid password.

Debugging and Using Diagnostics

The Self Service Framework ARU includes context sensitive help on the following topics. To access this information use the Help global button on the framework pages.
  1. How do I enable the diagnostics global button?
Setting the FND : Diagnostics (FND_DIAGNOSTICS) profile option to "Yes" will enable the diagnostics global button to be rendered on the screen. Pressing this button brings the user to an interface where the user can choose what type of logged messages to display.
  1. How do I enable logging?

Refer to the Logging Options described under Profile Options Reference.
  1. I have enabled logging and now the framework hangs or is horribly slow. What can I do?When you enabling logging at the statement level (AFLOG_LEVEL=STATEMENT) without applying a module filter (AFLOG_MODULE=%) you are asking for thousands of messages to be logged a minute. This should only be done in extreme situations where more selective filters have failed. Even if you can live with the horrible performance, you are going to have a hard time wading through all the messages produced to find what you're looking for.
    Note: this is only a problem if Statement is set at the Site level. The hanging will not occur if Statement is set at the User level.

HTTPS/SSL Problems

  1. Do framework applications support HTTPs?

Yes. Remember to set the Apps Framework Agent profile option to point to https instead of http, once you have configured SSL.
  1. SSL won't work if FND_TOP is not set in jserv.properties file.

FND_TOP is used to derive the location of the dbc file which is then used to make connections to the appropriate database. If this is not set APPS will resort to using the old env.txt (hyperlink it) mechanism for figuring out FND_TOP so it can locate the dbc file. The env.txt mechanism is no longer supported and will NOT work in an HTTPS environment. You may also see the following error message in error_log :
mod_ssl: SSL handshake failed: HTTP spoken on      
HTTPS port; trying to send HTML error page (OpenSSL library error follows)
OpenSSL: error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http
request [Hint: speaking HTTP to HTTPS port!?]

Note: a common mistake is to forget to change the jserv.properties and zone.properties to change apps.zip reference to JAVA_TOP.

Apache and Jserv

  1. Which apache log file(s) should I look at when looking for problems?

For Apache specific errors please refer to the error_log. For unhanded application exceptions it is useful to look at both error_log and jserv.log as these two my contain more detailed appropriate error messages then the ones displayed on the browser. For Jserv specific problems, for instance when you are unable to start/access Jserv, refer to mod_jserv.log file.
  1. I can't run my java applications and I see the following error messages in my mod_jserv.log file :

    (EMERGENCY) ajp12 : ping: no reply error
    Premature end of script headers: (null)
    (EMERGENCY) ajp12[1]: cannot scan servlet headers
The most common causes for this problem are:
  • Incomplete and/or incorrect JServ classpath. Check to make sure that the ApacheJServ.jar is being pointed to in wrapper.classpath. Also make sure that it is the right version.
     
  • If Apache/Jserv is running on a heavily loaded system, the JVM can take a long time to start up. Set the ApJServVMTimeout in the jserv.conf file to a higher number. The default is 10 seconds. Change it to 20 seconds or higher to see if it gets around this error. 
  1. I am unable to start Apache/Jserv and see the following exceptions in my log file :

    ApacheJServ/1.1: Exception creating the server socket: java.net.BindException:          
    Address already in use: make_sock: could not bind to port <webserver_port_number>        
Such errors usually mean that Apache and/or Jserv did not shutdown properly. It is best to wait for a few minutes for the various processes to clear up before restarting the server and/or the JVM.
  1. How do I set the character set in Apache?

Add the following line to apps.conf.
<IfModule mod_mime.c>
AddType "text/html; charset=us7ascii" html
</IfModule> 

Profile Options Reference

  1. Quick Reference
  2. User's Guide

Quick Reference

TypeNameCodeDescriptionDefault ValueSuggested Setting
WebServerApplication Framework AgentAPPS_FRAMEWORK_AGENTHttp server to be used by the framework applications  
SessionICX: Limit TimeICX_LIMIT_TIMEDetermines maximum session length4 hours 
 ICX:Session TimeoutICX_SESSION_TIMEOUTMaximum idle time for user session (specified in minutes) Should be set to the same value as the Jserv session timeout.
LoggingFND: Debug Log EnabledAFLOG_ENABLEDEnables/Disables LoggingNoYes
 FND: Debug Log FilenameAFLOG_FILE_NAMESpecifies location of log file; when undefined logs to database null
 FND: Debug Log ModuleAFLOG_MODULELog all modules (package+classname) that match this parameter%%
 FND: Debug Log LevelAFLOG_LEVELLog all messages with level equal to or greater than this settingUnexpectedUnexpected
 FND: DiagnosticsFND_DIAGNOSTICSEnable the Diagnostics global buttonNoNo
 FND: Developer ModeFND_DEVELOPER_MODEEnable the Edit Region global buttonYesNo
PerformanceICX: MatchCase ViewICX_MATCHCASE_VIEWUsed for avoiding poor performing queriesUnchecked 
 FND: View Object Max Fetch SizeVO_MAX_FETCH_SIZETruncates result set returned from a query.200 
Personalization FrameworkPersonalize Self-Service DefnFND_CUSTOM_OA_DEFINITIONEnables the Personalize global buttonNoYes for administrators; No for users
 Disable Self-Service PersonalFND_DISABLE_OA_CUSTOMIZATIONSDisplays only the original base definition of a pageNoNo
Dates & TimezoneServer TimezoneSERVER_TIMEZONE_IDSpecifies the TimeZone for the database  
 Client TimezoneCLIENT_TIMEZONE_IDSpecifies TimeZone for the client(user)  
 ICX: Date format maskICX_DATE_FORMAT_MASKUser's date format31-12-1999 
Application Module Pool & Passivation FrameworkFND: Application Module Pool Monitor Sleep IntervalAMPOOL_MONITOR_SLEEP_INTERVALSets the application module pool monitor sleep interval  
 FND: Application Module Pool Minimum Available SizeAMPOOL_MIN_AVAIL_SIZESets the number of minimum available application modules allowed per pool  
 FND: Application Module Pool Maximum Available SizeAMPOOL_MAX_AVAIL_SIZESets the number of maximum available application modules allowed per pool  
 FND: Application Module Pool Maximum Inactive AgeAMPOOL_MAX_INACTIVE_AGESets the timeout value for the available inactive application module  
 FND: Application Module Pool EnabledAMPOOL_ENABLEDEnables application module poolingYes 
 FND: Application Module Pool Recycle ThresholdAMPOOL_RECYCLE_THRESHOLDSets the number of application modules the pool will create before recycling the application modules for reuse by other threads.  
 FND: Passivation LevelPASSIVATION_LEVELPassivation level for state persistence. If this is None then there will be no passivation (state persistence) support.None 
 FND: Session Failover EnabledSESSION_FAILOVER_ENABLEDIndicates whether the default session failover handling is enabled. If this is Yes then the user will be taken to a generic error page when failover occurs.Yes 
BrandingFND: Branding SizeFND_BRANDING_SIZEControls the size of the global buttonsMedium 

User's Guide

All the profile options listed below need to be updated via the Applications Profile form. The only exception is the ICX_DATE_FORMAT profile option, which can be updated via the Preferences function on the Personal Home Page. In the near future, we will allow the user to update the Client Timezone profile option via the Preferences function as well.

Webserver Options

Application Framework Agent (APPS_FRAMEWORK_AGENT) 
This profile option specifies the host and port of the web server that will be used by the framework applications. It can be set at the site and the user level. The Application Framework Agent represents the java listener for your http Server. Both the http server and the java listener should be properly configured and started before the framework applications can be launched.

User Session (Time Related) Options

ICX: Limit Time (ICX_LIMIT_TIME)
Determines the maximum number of hours a user can be logged on per session. Default Value is 4 hours.
ICX: Session Timeout (ICX_SESSION_TIMEOUT)
Sets the maximum number of minutes to wait before invalidating an idle ICX session. Default value is null. Set this value to be same as the Apache/Jserv session timeout which is usually set to 30 minutes or 1800000 milliseconds.

Logging Options

Profiles used by the logging APIs can be set at any profiling level include application, responsibility, user, etc. The profiles that are used include the following:
FND: Debug Log Enabled (AFLOG_ENABLED)
Setting for whether to log any messages. Valid values are Yes or No. This option is set to No by default. Logging is an expensive operation and should not be enabled unless necessary. However, if the FND: Debug Log Level Profile option is set to Unexpected, then it makes sense to enable logging as well since only unexpected exceptions will get logged.
FND: Debug Log Level (AFLOG_LEVEL) 
The log level for messages that you would like to write to the database. Valid values are from 0 - 7. The framework will log all messages with log level higher than this profile option, so the higher this value is set to the fewer and more specific the messages will be that are logged. When this level is set then we will only log messages that are greater than or equal to the current log level. We log all message levels by default.
FND: Debug Log Module (AFLOG_MODULE) 
The module names that you would like to log. This profile relates to the module parameter that is passed to the writeAppsLog function. You can use wildcards for this value like oracle.apps.fnd.% to show all log messages created by fnd java classes. We log all modules by default.
FND: Debug Log Filename (AFLOG_FILE_NAME) 
Use this profile option to write the log messages to a file instead of the databases.
FND: Diagnostics (FND_DIAGNOSTICS) 
Setting this to "Yes" causes the Diagnostics global button to be rendered on the screen. Pressing this button brings the user to an interface where the user can choose what type of messages to log and what modules to log. The settings made here are only valid for the current user session.
Usage guidelines for logging profile options 
In normal operations, only UNEXPECTED errors, those that require administrator attention, should be logged. Also, normal users should not be accessing the Diagnostics page. These settings should be used at the site level:
  • FND_DIAGNOSTICS : No
  • AFLOG_ENABLED : Yes
  • AFLOG_MODULE : %
  • AFLOG_FILENAME: null
  • AFLOG_LEVEL : Unexpected

Performance Options

ICX: Match case View (ICX_MATCHCASE_VIEW) 
This profile option is available for pages that are rendered by ICX Web Inquiries from Phase 5.2.2: This profile option operates on the "Match Case" checkbox in the "Advanced Search" region of Web Inquiries. Setting this profile option value to "Checked" or "Hidden" would avoid poor performing product team's queries which would normally disable indexes via the upper() clause in Advanced Search. This profile option can be set at all levels and has three options:
  1. Unchecked (Default - Match Case will be rendered and unchecked)
  2. Checked (Match Case will be rendered and checked)
  3. Hidden (Match Case will NOT be rendered but checked) - instead of the match case checkbox you would have a message that says "Match Case has been selected for you".
FND: View Object Max Fetch Size (VO_MAX_FETCH_SIZE) 
The Self Service Framework includes this profile option for limiting the number of rows that any user can return to an HTML application through a query operation. The default site level value for this profile is 200 rows. This profile ensures that no single user can consume all the memory of a Jserv Listener through a wide open search in an inquiry or LOV. You can reduce this number to ensure that the middle-tier resources (memory) are shared evenly across all your users. When you hit this limit, you are not allowed to fetch the next set of rows by clicking on a Next button or some other UI control. Unfortunately we are not able to display a warning to the user when this limit is reached. They simply cannot get to the next set of rows. The next version of the Self Service Framework will be able to display such a good warning showing the current limit.
Usage guidelines for View Object Max Fetch Size 
This profile option can be set at the application level. If you are running applications for which the default 200 rows limit is low, you can set a higher value for the profile option at the the application level.

Personalization Framework Options

Personalize Self-Service Defn (FND_CUSTOM_OA_DEFINTION) 
This profile option is intended for administrators who wish to perform admin personalizations for AK regions at the localization, site, verticalization, org and responsibility levels. On enabling this profile option for the administrator, every self-service web application page will contain a global Personalize button. By clicking on this global button, the administrator can personalize the regions available on that page.
Disable Self-Service Personal (FND_DISABLE_OA_CUSTOMIZATIONS) 
This is a system profile option specifically created for use by Oracle Support. You can set this profile option to Yes or No at the site or application level. If this system profile option is set to Yes, any personalizations made by the customer, regardless of the level at which the personalizations were made, will not be applied. All pages using the Self Service Framework will now display the regions based on the base AK definitions they were shipped with.

Dates & Timezone options

ICX: Date format mask (ICX_DATE_FORMAT_MASK) 
The format to be used when displaying date fields. When a field displays both date and time, the date component will be displayed in the format specified here and the time component will be displayed in a 24 hour format including hours, minutes and seconds, e.g. 14:45:30 for 45 1/2 minutes past 2:00 pm.
Server Timezone (SERVER_TIMEZONE_ID) 
The time zone in which the database server is running. It is assumed that all dates stored in the database will be interpreted as per this time zone. This profile is only updatable at the Site level.
Client Timezone (CLIENT_TIMEZONE_ID) 
The time zone in which the client, or user, is located. This profile is updatable at all levels - Site, Application, Responsibility and User. Fields that specify a date and time will be queried and displayed to the user after automatically applying a time zone conversion as indicated by the Server Timezone profile and the particular Client Timezone profile. Conversely, a date and time entered by the user will undergo the opposite conversion before being stored into the database.

Application Module Pool options (Available as of Framework release 5.6E)

FND: Application Module Pool Monitor Sleep Interval (AMPOOL_MONITOR_SLEEP_INTERVAL)
Sets the application module pool monitor sleep interval in milliseconds. Default value is 600000 (10 minutes). The monitor thread will wake up every 10 minutes to clean up unused AMs. Only available AMs will be cleaned up.
FND: Application Module Pool Minimum Available Size (AMPOOL_MIN_AVAIL_SIZE) 
Sets the number of minimum available application modules allowed per pool. Default value is 0. If an AM timeout value is set for the available application modules, BC4J framework tries to clean up those timed out AMs until the minimum size is reached.
FND: Application Module Pool Maximum Inactive Age (AMPOOL_MAX_INACTIVE_AGE)
Sets the timeout value for the available inactive application module in milliseconds. Default value 600000 (10 minutes).
FND: Application Module Pool Enabled (AMPOOL_ENABLED)
Indicates whether AM pooling is enabled or not. Default value is "Yes". If AM pooling is disabled, set to "No" application module pool instance will be destroyed instead of being checked into the pool. In other words, if AM pooling is disabled, application module instance will not be reused by another thread.

Branding

FND: Branding Size (FND_BRANDING_SIZE)
Controls the size of the global buttons found at the top of an OA Framework page. "Regular" is larger than the default size which is "Medium". "Small" has not yet been implemented but will result in text only global buttons.

Oracle Access Manager (OAM) 11.1.2.3 Idle Timeout not Working, Regardless of User Activity, Within the 15 Minutes the Users are Redirected for Authentication (Doc ID 2328750.1)

In this Document
Symptoms
Cause
Solution


APPLIES TO:

Oracle Access Manager - Version 11.1.2.3.170418 and later
Information in this document applies to any platform.

SYMPTOMS

  • Oracle Access Manager (OAM) 11.1.2.3 Idle Timeout not Working, Regardless of User Activity, Within the 15 Minutes the Users are Redirected for Authentication
  • No Multi Data Center (MDC) architecture
  • Using Embedded Credential Collector (ECC)
  • Does not have any Application Domain timeouts set

CAUSE

SSOONLYMode parameter in oam-config.xml file is set to "true"

When SSOOnlyMode is set to TRUE , authorization is skipped by OAM so the last access time is never updated.
 

SOLUTION

1. Change
<Setting Name="SSOOnlyMode" Type="xsd:boolean">true</Setting>
to
<Setting Name="SSOOnlyMode" Type="xsd:boolean">false</Setting>
2. Increase the version value in the oam-config.xml file to one numerical value higher
For Ex.
<Setting Name="FilePollingInterval" Type="xsd:integer">30000</Setting>
<Setting Name="NotificationLockWait" Type="xsd:integer">20000</Setting>
<Setting Name="Version" Type="xsd:integer">346</Setting>
o
<Setting Name="FilePollingInterval" Type="xsd:integer">30000</Setting>
<Setting Name="NotificationLockWait" Type="xsd:integer">20000</Setting>
<Setting Name="Version" Type="xsd:integer">347</Setting> -------------------> you only need to change this Version parameter value
3. Start OAM Admin Server followed by Managed Servers

Alternative Methods to Allow Access to Oracle WebLogic Server Administration Console from Trusted Hosts for Oracle E-Business Suite Release 12.2 (Doc ID 2542826.1)

Alternative Methods to Allow Access to Oracle WebLogic Server Administration Console from Trusted Hosts for Oracle E-Business Suite Release 12.2 (Doc ID 2542826.1)

Alternative Methods to Allow Access to Oracle WebLogic Server Administration Ports from Trusted Hosts for Oracle E-Business Suite Release 12.2

This knowledge document describes alternative methods to allow access to the Oracle WebLogic Server Administration Console and Fusion Middleware Control if you cannot individually specify all the trusted hosts from which an Oracle E-Business Suite administrator will access these consoles.
The most current version of this document can be obtained in My Oracle Support Knowledge Document 2542826.1.
There is a change log at the end of this document.

In This Document

Section 1: Overview

After you apply either the April 2019 Critical Patch Update (CPU) or the Oracle E-Business Suite Technology Stack Delta 11 release update pack (R12.TXK.C.Delta.11) to Oracle E-Business Suite Release 12.2, AutoConfig will secure access to the Oracle WebLogic Server ports using Oracle WebLogic Server connection filters. All the existing application tier nodes of the Oracle E-Business Suite instance are allowed unrestricted access to Oracle WebLogic Server ports. However, by default, there are no trusted hosts defined for the Oracle WebLogic Server Administration ports, which are used by the Oracle WebLogic Server Administration Console and Fusion Middleware Control. You have three options to allow your administrators access to the consoles. These options are described in Section 2.
This security enhancement reflects our secure-by-default initiative in Oracle E-Business Suite and is intended to reduce the attack surface. Controlling access to the Oracle WebLogic Server ports, and particularly the administration ports, is very important to the security posture of the Oracle E-Business Suite infrastructure, and this new feature has been put in place to automate the use of the Oracle WebLogic Server connection filters.

Section 2: Configuring Access for Administrators

Option 1: Adding Specific Trusted Hosts

You can use the context variable s_wls_admin_console_access_nodes to specify the trusted hosts used by administrators that require access to the consoles. In the value for this context variable, you must list the host name or IP address for each trusted host. For details, see Only Allow Access to Oracle WebLogic Server Administration Console from Trusted HostsOracle E-Business Suite Setup Guide.
If you cannot list the specific host names or IP addresses for all your trusted hosts, then you can use one of the alternative methods in the following sections to allow access to the Oracle WebLogic Server Administration ports.

Option 2: Allowing an IP Range

Apply Patch 29781255:R12.TXK.C on top of either the April 2019 Critical Patch Update (CPU) or the Oracle E-Business Suite Technology Stack Delta 11 release update pack (R12.TXK.C.Delta.11). This patch allows you to specify resolvable hosts as well as a range of IP addresses such as a Classless Inter-Domain Routing (CIDR) range in the context variable s_wls_admin_console_access_nodes.
For example, for the CIDR range 192.0.2.0/24, set the context variable as follows:
<s_wls_admin_console_access_nodes oa_var="s_wls_admin_console_access_nodes">192.0.2.0/24</s_wls_admin_console_access_nodes>

Option 3: Using SSH Tunneling

Administrators who already have operating system access to the primary application tier node can use SSH tunneling to access the Oracle WebLogic Server Administration Console and Fusion Middleware Control through the Oracle WebLogic Server Administration ports. 
Establish the tunnel as follows:
ssh <OS_user>@<remhost> -L localhost:<WLS_admin_port>:<remhost>:<WLS_admin_port>
where <remhost> is the host name of your primary application tier node.
On a Windows client, you can use either one of the following executables:
  • Windows 10: OpenSSH ssh from Microsoft
    If you use ssh, follow the syntax for ssh shown in the preceding example.
  • Windows 7: plink from PuTTY
    If you use plink, use the following command:
    C:\> plink.exe -N -Llocalhost:<WLS_admin_port>:<primary-apptier>:<WLS_admin_port> <OS_user>@<primary-apptier>
    For example, if the Oracle WebLogic Server Administration port is 7001 and the OS user is oracle, use the following command:
    C:\> plink.exe -N -Llocalhost:7001:<primary-apptier>:7001 oracle@<primary-apptier>
After setting up SSH tunneling from your UNIX or Windows client, you can securely access the Oracle WebLogic Server Administration Console and Fusion Middleware Control. Launch a browser from your client and connect to the following administrative URLs as required.
  • Oracle WebLogic Server Administration Console - http://localhost:<WLS_admin_port>/console
  • Fusion Middleware Control - http://localhost:<WLS_admin_port>/em
Note: You must reestablish the SSH tunnel each time the client tier is disconnected from the network, each time the client tier is rebooted, or if you log off of the client.

Change Log

DateDescription
2019-08-09
  • Added information on Patch 29781255:R12.TXK.C in Section 2 Option 2 and information on Windows clients in Section 2 Option 3.
2019-07-01
  • Added link to Administration Console Online Help in Section 2 Option 2.
2019-06-19
  • Expanded overview in Section 1.
2019-05-31
  • Updates to clarify terminology.
2019-05-21
  • Initial publication.
My Oracle Support Knowledge Document 2542826.1 by Oracle E-Business Suite Developmen

Oracle E-Business Suite Release 12.2 System Schema Migration

In This Document Section 1: Overview of the EBS System Schema Section 2: Requirements for Using the EBS System Schema Section 3: Migrating t...