Error when starting Oracle Identity Manager Design Console (11.1.2): java.lang.NoClassDefFoundError: javax/ejb/CreateException

After a new installation of  Oracle Identity Manager (OIM) I tried to start the Design Console and all I got was the following error:

[oim@linux designconsole]$ ./xlclient.sh
Exception in thread "Main Thread" java.lang.NoClassDefFoundError: javax/ejb/CreateException
at java.lang.Class.getDeclaredMethods0(Native Method)
at java.lang.Class.privateGetDeclaredMethods(Class.java:2427)
at java.lang.Class.getDeclaredMethod(Class.java:1935)
at java.awt.Component.isCoalesceEventsOverriden(Component.java:5975)
at java.awt.Component.access$500(Component.java:169)
at java.awt.Component$3.run(Component.java:5929)
at java.awt.Component$3.run(Component.java:5927)
at java.awt.Component.checkCoalescing(Component.java:5926)
at java.awt.Component.<init>(Component.java:5895)
at java.awt.Container.<init>(Container.java:249)
at java.awt.Window.<init>(Window.java:430)
at java.awt.Frame.<init>(Frame.java:403)
at java.awt.Frame.<init>(Frame.java:368)
at javax.swing.JFrame.<init>(JFrame.java:158)
at com.thortech.xl.gui.base.tcFrame.<init>(tcFrame.java:34)
at com.thortech.xl.client.base.tcAppWindow.<init>(tcAppWindow.java:104)
at com.thortech.xl.client.base.tcAppWindow.main(tcAppWindow.java:173)

It turns out I missed one step in installation instruction. Fix:

• Change to MW_HOME/wlserver_10.3/server/lib directory
• Set JAVA_HOME
• Execute 

java -jar wljarbuilder.jar
.
.
.
Created new jar file: /oracle/oim0/mwh/wlserver_10.3/server/lib/wlfullclient.jar

• Copy wljarbuilder.jar to $OIM_ORACLE_HOME/designconsole/ext

After that it works.

I don't always dump mysql databases ...

... but when I do, I use commandline tools instead of phpmyadmin - it's much faster and you don't get in trouble with large databases and php filelimits. Today I had to clone some mysql databases from one linux server to another. This happens every few months and I always forget the exact mysqldump commands - so I will note them down here.

Export database

mysqldump -u db_user -pPasswordWithoutBlank --databases db_name --result-file=dbname.sql

Import database

mysql -u db_user -pPasswordWithoutBlank db_name < dbname.sql

Thanks to this post by Ramesh Natarajan which is always my favorite google result on this topic.

Error during sca deployment: unable to extend lob segment

Today I got an error while doing an sca deployment:

---->response code=500, error:There was an error deploying the composite on soa_server1: 

oracle.mds.transfer.TransferException:MDS-00001: exception in Metadata Services layerMDS-00522: failure to save document /deployed-composites/app/appfu_rev1.0/lib/bpm-services.jar to the metadata repository
ORA-01691: unable to extend lob segment SOA_MDS.SYS_LOB0000088234C00023$$ by 1024 in tablespace SOA_MDSORA-01691: unable to extend lob segment SOA_MDS.SYS_LOB0000088234C00023$$ by 1024 in tablespace SOA_MDS

The solution was quite simple: The tablespace for the mds repository was to small. After increasing the tablespace size, everything was fine.

Find out who / what is connected to weblogic server (or to specific tcp port generally)

In the past weeks I had to stick around with outbound and inbound firewall rules. Firewalls are sometimes a real pain in the ass, but if you observe some rules, it should be possible to generate a working ruleset.

One important thing when configuring a firewall is to know which network hosts are connecting to the protected host (inbound rules) and to which hosts the protected host connects itself (outbound rules).

Very usefull tools for linux here are netstat and lsof. With that tools you can find out, what is connected to an tcp-port and which outgoing connections there are.

With netstat, you can see what services are listening on which networking interface. For example, if you have a weblogic server running on ports 7001 (AdminServer) and 7002 (managed_server0) on a specific networking device you will get something like that:

[root@linux ~]# netstat -tnlp 

Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 192.168.0.20:7001         0.0.0.0:*                   LISTEN      22451/java        
tcp        0      0 192.168.0.20:7002         0.0.0.0:*                   LISTEN      22493/java          

Of course you will also see some open ports for sshd and so on.

Now if you want to know what process is behind a open port you can use ps in combination with grep.

[root@linux ~]# ps -ef | grep 22493 

  wluser   22493  6937  3 19:23 ?        00:20:13 /opt/oracle0/mwh/jrockit/bin/java -jrockit -Xms256m -Xmx1024m -Dweblogic.Name=managed_server0 -Djava.security.policy=/opt/oracle0/mwh/wlserver_10.3/server/lib/weblogic.policy -Dweblogic.ProductionModeEnabled=true -Dweblogic.security.SSL.trustedCAKeyStore=/opt/oracle0/mwh/wlserver_10.3/server/lib/cacerts -Dweblogic.ProductionModeEnabled=true -da -Dplatform.home=/opt/oracle0/mwh/wlserver_10.3 -Dwls.home=/opt/oracle0/mwh/wlserver_10.3/server -Dweblogic.home=/opt/oracle0/mwh/wlserver_10.3/server -Dcommon.components.home=/opt/oracle0/mwh/oracle_common -Djrf.version=11.1.1 -Dorg.apache.commons.logging.Log=org.apache.commons.logging.impl.Jdk14Logger -Ddomain.home=/opt/oracle0/projects/domains/domain0 -Djrockit.optfile=/opt/oracle0/mwh/oracle_common/modules/oracle.jrf_11.1.1/jrocket_optfile.txt -Doracle.server.config.dir=/opt/oracle0/projects/domains/domain0/config/fmwconfig/servers/AdminServer -Doracle.domain.config.dir=/opt/oracle0/projects/domains/domain0/config/fmwconfig -Digf.arisidbeans.carmlloc=/opt/oracle0/projects/domains/domain0/config/fmwconfig/carml -Digf.arisidstack.home=/opt/oracle0/projects/domains/domain0/config/fmwconfig/arisidprovider -Doracle.security.jps.config=/opt/oracle0/projects/domains/domain0/config/fmwconfig/jps-config.xml -Doracle.deployed.app.dir=/opt/oracle0/projects/domains/domain0/servers/AdminServer/tmp/_WL_user -Doracle.deployed.app.ext=/- -Dweblogic.alternateTypesDirectory=/opt/oracle0/mwh/oracle_common/modules/oracle.ossoiap_11.1.1,/opt/oracle0/mwh/oracle_common/modules/oracle.oamprovider_11.1.1 -Djava.protocol.handler.pkgs=oracle.mds.net.protocol -Dweblogic.jdbc.remoteEnabled=false -DEPM_ORACLE_HOME=/opt/oracle0/mwh/bip0 -DHYPERION_HOME=/opt/oracle0/mwh/bip0 -DEPM_ORACLE_INSTANCE=novalue -Dhyperion.home=/opt/oracle0/mwh/bip0 -DEPM_REG_PROPERTIES_PATH=/opt/oracle0/projects/domains/domain0/config/fmwconfig -Depm.useApplicationContextId=false -Doracle.biee.search.bisearchproperties=/opt/oracle0/mwh/bip0/bifoundation/jee/BISearchConfig.properties -Dweblogic.management.clearTextCredentialAccessEnabled=true -Doracle.notification.filewatching.interval=2000 -Dweblogic.security.SSL.ignoreHostnameVerification=true -Dweblogic.security.SSL.enableJSSE=true -Dfile.encoding=utf-8 -Duser.language=en -Duser.region=US -Dxdo.server.config.dir=/opt/oracle0/projects/domains/domain0/config/bipublisher -DXDO_FONT_DIR=/opt/oracle0/mwh/bip0/common/fonts -Dem.oracle.home=/opt/oracle0/mwh/oracle_common -Djava.awt.headless=true -Dweblogic.management.discover=true -Dwlw.iterativeDev=false -Dwlw.testConsole=false -Dwlw.logErrorsToConsole=false -Dweblogic.ext.dirs=/opt/oracle0/mwh/patch_wls1035/profiles/default/sysext_manifest_classpath:/opt/oracle0/mwh/patch_ocp360/profiles/default/sysext_manifest_classpath -Djava.io.tmpdir=/opt/oracle0/tmp -da -Dplatform.home=/opt/oracle0/mwh/wlserver_10.3 -Dwls.home=/opt/oracle0/mwh/wlserver_10.3/server -Dweblogic.home=/opt/oracle0/mwh/wlserver_10.3/server -Dcommon.components.home=/opt/oracle0/mwh/oracle_common -Djrf.version=11.1.1 -Dorg.apache.commons.logging.Log=org.apache.commons.logging.impl.Jdk14Logger -Ddomain.home=/opt/oracle0/projects/domains/domain0 -Djrockit.optfile=/opt/oracle0/mwh/oracle_common/modules/oracle.jrf_11.1.1/jrocket_optfile.txt -Doracle.server.config.dir=/opt/oracle0/projects/domains/domain0/config/fmwconfig/servers/managed_server0 -Doracle.domain.config.dir=/opt/oracle0/projects/domains/domain0/config/fmwconfig -Digf.arisidbeans.carmlloc=/opt/oracle0/projects/domains/domain0/config/fmwconfig/carml -Digf.arisidstack.home=/opt/oracle0/projects/domains/domain0/config/fmwconfig/arisidprovider -Doracle.security.jps.config=/opt/oracle0/projects/domains/domain0/config/fmwconfig/jps-config.xml -Doracle.deployed.app.dir=/opt/oracle0/projects/domains/domain0/servers/managed_server0/tmp/_WL_user -Doracle.deployed.app.ext=/- -Dweblogic.alternateTypesDirectory=/opt/oracle0/mwh/oracle_common/modules/oracle.ossoiap_11.1.1,/opt/oracle0/mwh/oracle_common/modules/oracle.oamprovider_11.1.1 -Djava.protocol.handler.pkgs=oracle.mds.net.protocol -Dweblogic.jdbc.remoteEnabled=false -DEPM_ORACL

OK, now you know what process runs the port. Now you can use lsof to determine which connections there are to and from the specified tcp-port.

[root@linux ~]# lsof -i tcp:7002

COMMAND   PID    USER   FD   TYPE   DEVICE SIZE NODE NAME
java    22493 wluser  290u  IPv4 61184208       TCP localhost:7002->clusterpartner1:55879 (ESTABLISHED)
java    22493 wluser  303u  IPv4 61184159       TCP localhost:7002->clusterpartner1:35736 (ESTABLISHED)
java    22493 wluser  382u  IPv4 61189759       TCP localhost:7002->clusterpartner1:55955 (ESTABLISHED)
java    22493 wluser  386u  IPv4 61170023       TCP localhost:7002->localhost:54803 (ESTABLISHED)
java    22493 wluser  389u  IPv4 61170863       TCP localhost:7002 (LISTEN)
java    22493 wluser  390u  IPv4 61170864       TCP
java    22493 wluser  398u  IPv4 61170992       TCP localhost:7002->localhost:54793 (ESTABLISHED)
java    22493 wluser  399u  IPv4 61171023       TCP localhost:7002->localhost:54799 (ESTABLISHED)
java    22493 wluser  400u  IPv4 61184168       TCP localhost:7002->clusterpartner1:35773 (ESTABLISHED)
java    22493 wluser  401u  IPv4 61171039       TCP localhost:7002->localhost:54903 (ESTABLISHED)
java    22493 wluser  405u  IPv4 61189776       TCP localhost:7002->clusterpartner1:55993 (ESTABLISHED) 

You can see my Managed Server (PID 22493) has some ingoing and outgoing connections to it's clusterpartner. So you can get an idea of which ports are needed and should be opened in local firewall.

Unlocking locked Accounts in Oracle Internet Directory (OID)

From time to time you may have to unlock an account in Oracle Internet Directory (OID) which isn't IDM/OIM-controlled (so no selfservice is available, for example for technical users).

There are at least two ways to achieve this:

1. Use OIDDAS (OID Delegated Administration Service)
Login to OIDDAS (this depends on which version of OID you are using), search and find the user and unlock it.

2. Use LDAP-Tools
I recommend this way, because it is much faster (for example if you have multiple accounts to unlock) and you see whats going on under the hood. It should work with all recent version of OID (from 10.1.2.0.2). Determine the distinguished name of the user (for example cn=lisa,cn=Users,dc=example,dc=com) and create a ldif file which sets the Attribute orclpwdaccountunlock to 1:

cn=lisa,cn=Users,dc=example,dc=com
changetype: modify
add: orclpwdaccountunlock
orclpwdaccountunlock: 1

Apply this via ldapmodify and the account is unlocked again. You also can set orclpwdaccountunlock directly via your favorite LDAP-Browser.

After that, the attributes pwdaccountlockedtime and pwdfailuretime (which mark the account as locked) will be gone.

And, by the way, you can find all locked accounts in your directory with executing the following ldap-search:

(pwdaccountlockedtime=*)

upgradeADF (ADF 11.1.2.3.0)

If you try to upgrade an ADF-Domain to ADF 11.1.2.3.0 you may encounter the following error:

wls:/offline> upgradeADF('/oracle/weblogic1/projects/domains/adfdomain0/')

Error: readDomain() failed. Do dumpStack() to see details.

com.oracle.cie.domain.script.jython.WLSTException: com.oracle.cie.domain.script.ScriptException: The domain directory must exist and contain config/config.xml

at com.oracle.cie.domain.script.jython.CommandExceptionHandler.handleException(CommandExceptionHandler.java:51)

at com.oracle.cie.domain.script.jython.WLScriptContext.handleException(WLScriptContext.java:1538)

at com.oracle.cie.domain.script.jython.WLScriptContext.readDomain(WLScriptContext.java:396)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:597)

at org.python.core.PyReflectedFunction.__call__(Unknown Source)

at org.python.core.PyMethod.__call__(Unknown Source)

at org.python.core.PyObject.__call__(Unknown Source)

at org.python.core.PyInstance.invoke(Unknown Source)

at org.python.pycode._pyx3.readDomain$18(/tmp/WLSTOfflineIni130404370312075564.py:83)

at org.python.pycode._pyx3.call_function(/tmp/WLSTOfflineIni130404370312075564.py)

at org.python.core.PyTableCode.call(Unknown Source)

at org.python.core.PyTableCode.call(Unknown Source)

at org.python.core.PyFunction.__call__(Unknown Source)

at org.python.pycode._pyx22.upgradeADF$1(/oracle/wls2/mwh/oracle_common/common/wlst/adfWLSTCommands.py:24)

at org.python.pycode._pyx22.call_function(/oracle/wls2/mwh/oracle_common/common/wlst/adfWLSTCommands.py)

at org.python.core.PyTableCode.call(Unknown Source)

at org.python.core.PyTableCode.call(Unknown Source)

at org.python.core.PyTableCode.call(Unknown Source)

at org.python.core.PyFunction.__call__(Unknown Source)

at org.python.pycode._pyx49.f$0(<console>:1)

at org.python.pycode._pyx49.call_function(<console>)

at org.python.core.PyTableCode.call(Unknown Source)

at org.python.core.PyCode.call(Unknown Source)

at org.python.core.Py.runCode(Unknown Source)

at org.python.core.Py.exec(Unknown Source)

at org.python.util.PythonInterpreter.exec(Unknown Source)

at org.python.util.InteractiveInterpreter.runcode(Unknown Source)

at org.python.util.InteractiveInterpreter.runsource(Unknown Source)

at org.python.util.InteractiveInterpreter.runsource(Unknown Source)

at weblogic.management.scripting.WLST.main(WLST.java:188)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:597)

at weblogic.WLST.main(WLST.java:29)

Caused by: com.oracle.cie.domain.script.ScriptException: The domain directory must exist and contain config/config.xml

at com.oracle.cie.domain.script.ScriptExecutor.readTemplate(ScriptExecutor.java:448)

at com.oracle.cie.domain.script.jython.WLScriptContext.readDomain(WLScriptContext.java:388)

... 35 more

 

This can be caused by specifying the wrong domain (or type in path), but also appears when not having write access to domain home.

Weblogic Server 10.3.6 Silent Install fails because of wrong formatting of silent.xml

Today I tried to silent install a Weblogic Server 10.3.6. As documentation recommends, I used the sample silent.xml and modified some parameters.

Then I tried to start the installation, but it fails:

[weblogic@linux silent]$ $JAVA_HOME/bin/java -jar /net/share/ofm11g/wls1036_generic.jar -Djava.io.tmpdir=$TMPDIR -mode=silent -silent_xml=./silent.xml
Extracting 0%....................................................................................................100%
[Fatal Error] :3:6: The processing instruction target matching "[xX][mM][lL]" is not allowed.
org.xml.sax.SAXParseException: The processing instruction target matching "[xX][mM][lL]" is not allowed.
at com.sun.org.apache.xerces.internal.parsers.DOMParser.parse(DOMParser.java:246)
at com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:284)
at javax.xml.parsers.DocumentBuilder.parse(DocumentBuilder.java:124)
at com.bea.plateng.wizard.installer.common.parsers.TemplateParser.parserWrapper(TemplateParser.java:53)
at com.bea.plateng.wizard.installer.common.parsers.TemplateParser.getTemplateInfo(TemplateParser.java:71)
at com.bea.plateng.wizard.installer.common.parsers.TemplateParserHelper.getTemplateInfo(TemplateParserHelper.java:96)
at com.bea.plateng.wizard.installer.utils.SilentXmlHelper.loadSilentXml(SilentXmlHelper.java:75)
at com.bea.plateng.wizard.installer.silent.tasks.ReadSilentXMLTask.execute(ReadSilentXMLTask.java:43)
at com.bea.plateng.wizard.silent.tasks.AbstractSilentTask.run(AbstractSilentTask.java:28)
at java.lang.Thread.run(Thread.java:662)
Silent Install Failed!! Reason: null

The problem with the sample silent.xml is that it uses comments before the XML prolog. According to the XML spec, you can't have anything at all before the XML prolog. So the file must start with "<?xml version...".

After deleting all the comment lines above XML prolog, silent install works fine.