oracle.iam.oimupgrade.exceptions.OIMUpgradeException: Error in running target :migrateJazn-unix

Error while running OIM Post Patching script : sh patch_oim_wls.sh

ERROR Logs:

[java] INFO: buffer : migrateSecurityStore.py -type policyStore -dst default -configFile /app/oracle/middleware/Oracle_IDM1/server/patching/policiestomigrate/jps-config-jse_patching.xml -src jazn-data-oim.xml
[java] oracle.iam.oimupgrade.exceptions.OIMUpgradeException: Error in running target :migrateJazn-unix
[java]     at oracle.iam.oimupgrade.standalone.utils.AntUtil.runTargetWithNoProcessing(AntUtil.java:150)
[java]     at oracle.iam.oimupgrade.standalone.utils.OfflineUpgradeUtil.migrateSecurityStore(OfflineUpgradeUtil.java:813)
[java]     at oracle.iam.oimupgrade.standalone.utils.OfflineUpgradeUtil.migrateJAZN(OfflineUpgradeUtil.java:760)
[java]     at oracle.iam.patching.authz.AuthzPolicyMigration.migrateJaznFilesToPolicyStore(AuthzPolicyMigration.java:149)
[java]     at oracle.iam.patching.authz.AuthzPolicyMigration.main(AuthzPolicyMigration.java:99)
[java]     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
[java]     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
[java]     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
[java]     at java.lang.reflect.Method.invoke(Method.java:606)
[java]     at org.apache.tools.ant.taskdefs.ExecuteJava.run(ExecuteJava.java:217)
[java]     at org.apache.tools.ant.taskdefs.ExecuteJava.execute(ExecuteJava.java:152)
[java]     at org.apache.tools.ant.taskdefs.Java.run(Java.java:764)
[java]     at org.apache.tools.ant.taskdefs.Java.executeJava(Java.java:218)
[java]     at org.apache.tools.ant.taskdefs.Java.executeJava(Java.java:132)
[java]     at org.apache.tools.ant.taskdefs.Java.execute(Java.java:105)
[java]     at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:288)
[java]     at sun.reflect.GeneratedMethodAccessor1.invoke(Unknown Source)
[java]     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

[java]     at java.lang.reflect.Method.invoke(Method.java:606)

Solution:

1) Open file $WL_HOME/server/lib/weblogic.policy for edit

2) Search for the string For standard extensions directories and add after the comment and before the grant codeBase "file:/opt/oracle/Middleware/wlserver_10.3/common/lib/ext/*" { the following grant:

grant codeBase "file:/opt/oracle/Middleware/patch_wls1036/patch_jars/*" {

  permission java.security.AllPermission;
};

Once the change done , restart the weblogic servers and rerun sh patch_oim_wls.sh

-Arihant

java.security.AccessControlException: access denied ("javax.management.MBeanTrustPermission" "register")

Error while running OIM Post Patching script : sh patch_oim_wls.sh

ERROR Logs:

[oracle@oracle bin]$ tail -f patch_oim_wls.log
tail: cannot open ‘nohup.out’ for reading: No such file or directory
==> patch_oim_wls.log <==
     [java] Mar 11, 2019 2:02:47 PM oracle.iam.oimupgrade.standalone.utils.WriteLog writeMessage
     [java] INFO: Updating the JPS Config File
     [java] Mar 11, 2019 2:02:48 PM oracle.iam.oimupgrade.standalone.utils.WriteLog writeMessage
     [java] INFO: Update of JPS Config Complete
     [java] Mar 11, 2019 2:02:48 PM oracle.iam.oimupgrade.standalone.utils.WriteLog writeMessage
     [java] INFO: Policy Backup Required :: false
     [java] Mar 11, 2019 2:02:48 PM oracle.iam.oimupgrade.standalone.utils.WriteLog writeMessage
     [java] INFO: AuthorizationMAPIUtil : JPS COnfig Location:/app/oracle/middleware/Oracle_IDM1/server/patching/policiestomigrate/jps-config-jse_patching.xml
     [java] Mar 11, 2019 2:02:48 PM oracle.iam.oimupgrade.standalone.utils.WriteLog writeMessage
     [java] INFO: AuthorizationMAPIUtil : Domain Home  Location:/app/oracle/middleware/user_projects/domains/base_domain
     [java] Mar 11, 2019 2:02:51 PM oracle.jdbc.driver.OracleDriver registerMBeans
     [java] WARNING: Error while registering Oracle JDBC Diagnosability MBean.
     [java] java.security.AccessControlException: access denied ("javax.management.MBeanTrustPermission" "register")
     [java]     at java.security.AccessControlContext.checkPermission(AccessControlContext.java:372)
     [java]     at java.lang.SecurityManager.checkPermission(SecurityManager.java:585)

Solution:

Add the following lines to java.policy file under $JAVA_HOME/jre/lib/security and re-run the script.

grant {
permission javax.management.MBeanTrustPermission "register";
};

-Arihant

Oracle released Office 365, Salesforce and ServiceNow connectors

Oracle released Office 365, Salesforce and ServiceNow connectors

URL: http://www.oracle.com/technetwork/middleware/id-mgmt/downloads/connectors-101674.html

1) Office 365: http://download.oracle.com/otn/nt/ias/connectors/111/Office365-11.1.1.5.0.zip

2) Salesforce :http://download.oracle.com/otn/nt/ias/connectors/111/Salesforce-11.1.1.5.0.zip

3) ServiceNow :http://download.oracle.com/otn/nt/ias/connectors/111/ServiceNow-11.1.1.5.0.zip

Regards,
Arihant

Issue while running "LDAP Connector User Sync Reconciliation" Job with error "Failed: Error Message can not be retrieved"

Issue while running "LDAP Connector User Sync Reconciliation" job  with error code

"Failed: Error Message can not be retrieved"

Error in Logs:

diagnostic.log:org.identityconnectors.framework.common.exceptions.ConnectorException: javax.naming.NameNotFoundException: [LDAP: error code 32 - The entry cn=changelog specified as the search base does not exist in the Directory Server]; remaining name 'cn=changelog'

Solution :

1) Create a replication server using below command

/app/oracle/middleware/asinst_1/OUD/bin/dsconfig -h localhost -p 4444 -D "cn=directory manager" -j ~/password.txt -X -n create-replication-server --provider-name  'Multimaster Synchronization' --set replication-port:8989 --set  replication-server-id:1 --type generic

(Note - Created a password file and provide the location file location in above command)

2) Create a replication domain using below command

/app/oracle/middleware/asinst_1/OUD/bin/dsconfig -h localhost -p 4444 -D "cn=directory manager" -j ~/password.txt -X -n create-replication-domain --provider-name  'Multimaster Synchronization' --set base-dn:dc=oud,dc=com --set  replication-server:arihant.com:8989 --set server-id:1 --type generic --domain-name dc=oud,dc=com

3) Now run the  "LDAP Connector User Sync Reconciliation" job and check the execution status

Thanks,

Arihant

PS3 Offline Upgrade Failing During BIP Upgrade

Migrating from OIM 11g R2 PS2 to R2 PS3 and running the Middle Tier Upgrade - Offline mode, the following upgrades failed:

1.BIPUpgrade

2.RoleRequestDataSetUpgrade.

Solution:

1) Open the config.xml kept at the location $DOMAIN_HOME/config folder.

2) Locate

<file-store>

 <name>BipJmsStore</name>

 <directory>BipJmsStore</directory>

 <target>$DOMAIN_NAME$</target>

 </file-store>

    Replace  $DOMAIN_NAME$ with BIP Server Name. By Default it is bi_server1.

3) Add the following along with other <jms-server> tags and put your bi server name in <target>.

 <jms-server>

 <name>BipJmsServer</name>

 <target>bi_server1</target>

 <persistent-store>BipJmsStore</persistent-store>

</jms-server>

4)  Run the OIMUpgrade.sh offline again and complete the upgrade process

Thank you.

Arihant

OIM 11G R2 PS3 Lab 13: How to setup SOD (Segregation of Duties) Policy violation in OIM 11g R2 PS3?

High Level Steps

* Create SOD Rule
* Create SOD Policy 
* Attach SOD rule to SOD Policy

* Login to Identity Console and lock on Compliance Tab

* Click on Identity Audit and select Rules

* Click on Create Rule

* Click on Add Condition and Create

* Rule Created

* Go back to Compliance tab > Identity Audit > Policy

* Click on Create

* Create the Policy and Click on Add to attached the Rule

* Select the Rule

* Policy Created

* Create a User ( In this lab we need 2 fresh user or existing user)

* Click on Submit

* Login with that user

* Change the password and setup up the challenge questions

* Click on Request Access >> Request for Self

* Requests for Conflicted Entitlements and add to Cart

* Click on Next

* Click on Submit button.

* Since smith selected conflicting entitlement,He got Policy Violation Alert

* Request got create

* Request summary from tracking request page

* Login with Another user who is manger of Smith

*  * Change the password and setup up the challenge questions

* Click on Pending Approvals

* Manager will be notified with Policy Violation  Alert while approving the request.

Thanks,
Arihant

Release of Bundle Patch (BP) 01 for OIM 11.1.2.3

 BP 01 for OIM 11.1.2.3 is released now.

Oracle Identity Manager Bundle Patches: 11.1.2.3.x (11gR2PS3) Version (Doc ID 2031368.1).

Patch Number -21169810 (Download from Oracle Support)

Bug Fixed :

Bug:20417471 : ACCESS POLICIES STILL AFFECT SERVICE ACCOUNTS VIA AP HARVESTING
Bug:20470640 : MULTI-PHASE CERTIFICATION REQUEST TASK HANGS IN PHASE 2 IF NO CERTIFIER DEFINED
Bug:20694423 : NON-CERTIFIABLE ACCOUNT REVOCATION TO DISPLAY IN UI AND/OR FORCE AUTO CERTIFY
Bug:20716805 : DEPARTMENT NUMBER NOT POPULATED IN UPA_FIELDS TABLE AFTER APPLYING OOB 20591469
Bug:20730776 : CERTIFICATION REASSIGNED FROM INBOX LABELED AS PROXY IN HISTORY REPORT
Bug:20735186 : CUSTOMER CAN'T SELECT MORE ENTITLEMENTS
Bug:20786230 : NON-CERTIFIABLE AP INSTANCE SHOWN IN CERTIFICATION
Bug:20901208 : COMMENTS FOR CERTIFICATIONS NOT WORKING.


Regards,
Arihant