Login issue in OIM11g due to oim credsmap error

Question

We have OIM 11gR2PS1 installed on unix box. We have AD connector 11.1.1.5.0 installed on it .Also,peoplesoft recon connector PSFT_ER-11.1.1.5.0 is installed
In our scenario,we have webservice code in which using recon event we are creating users in OIM environment
This is hosted on same OIM server unix box.Inside webservice code we have refred oimclient.jar file to work with OIM APIs and Recon Service class.
When i tested webservice for first time it was unable to load OIM API classes as it was unable to find oimclient.jar in classpath.
So to resolve this issue i kept oimclient.jar in location- "WL_HOME/server/lib/"  and also added following entry in setDomainEnv.sh to load oimclient.jar explicitly in classpath
CLASSPATH="WL_HOME/server/lib/oimclient.jar:${CLASSPATH}"
export CLASSPATH
and made entry in system-jazn-data.xml present in DOMAIN_HOME//config/fmwconfig/ as :
<grant>
            <grantee>
                <codesource>
                    <url>file:${domain.home}/servers/oim_server1/stage/*</url>
                </codesource>
            </grantee>
            <permissions>
   <permission>
               <class>oracle.security.jps.service.credstore.CredentialAccessPermission</class>
                     <name>context=SYSTEM,mapName=oim,keyName=*</name>
                     <actions>read,write</actions>
    </permission>
            </permissions>
        </grant>
After this change, webservice was working as expected and OIM related things were working fine.
But,when we tried to run schedule task "Active Directory Group Lookup Recon" for AD, we are getting error message as :
java.lang.LinkageError: loader constraint violation: loader (instance of com/thortech/xl/dataobj/tcADPClassLoader) previously initiated loading for a different type with name "com/thortech/xl/dataaccess/tcDataProvider"
So,to resolve this AD schedule task issue,we rolled back changes made for webservice in setDomainEnv.sh and system-jazn-data.xml file
and removed explicit classpath entry line of oimclient.jar from  setDomainEnv.sh
But after restrating all admin and managed servers,we are currently facing issue in logging into OIM idenity/syadmin or design console with xelsyadm credentials
we have never made any changes of password for xelsyadm account or not made any change in any authenticatorproviders in weblogic console
we tried everything form reverting all changes to original setup without webservice or peoplesoft listener implementation
removed all explicit classpath entries or grant entry for oim credsmap from system-jazn-data.xml.
But still same issue persists
Any helpful suggestion is appreciated on this ASAP.
issue logs are:
TaskFlow Registration: TaskFlowDeployerThread.registerTaskFlowWithTask - Error while setting task display, this can happen with app loading issue, trying to load for 2
<Nov 11, 2013 11:24:20 PM EST> <Warning> <oracle.soa.services.workflow.worklist> <BEA-000000> <<.> Error while setting task display, this can happen with app loading issue, trying to load for 2>
<Nov 11, 2013 11:24:24 PM EST> <Error> <XELLERATE.ACCOUNTMANAGEMENT> <BEA-000000> <Class/Method: tcDefaultDBEncryptionImpl/initKeyStore encounter some problems: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=.xldatabasekey" "read")
java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=.xldatabasekey" "read")
  at java.security.AccessControlContext.checkPermission(AccessControlContext.java:372)
  at java.security.AccessController.checkPermission(AccessController.java:559)
  at oracle.security.jps.util.JpsAuth$AuthorizationMechanism$3.checkPermission(JpsAuth.java:458)
  at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:518)
  at oracle.security.jps.util.JpsAuth.checkPermission(JpsAuth.java:544)
  at oracle.security.jps.internal.credstore.util.CsfUtil.checkPermission(CsfUtil.java:643)
  at oracle.security.jps.internal.credstore.ldap.LdapCredentialStore.containsCredential(LdapCredentialStore.java:214)
  at oracle.iam.platform.utils.config.OIMPrivilegedExceptionAction.run(CSFCredentialProvider.java:236)
  at java.security.AccessController.doPrivileged(Native Method)
  at oracle.iam.platform.utils.config.CSFCredentialProvider.getPassword(CSFCredentialProvider.java:79)
  at oracle.iam.platform.utils.config.standalone.StandAloneCryptoConfig.getPassword(StandAloneCryptoConfig.java:76)
  at com.thortech.xl.crypto.tcDefaultDBEncryptionImpl.initKeyStore(tcDefaultDBEncryptionImpl.java:67)
  at com.thortech.xl.crypto.tcDefaultDBEncryptionImpl.getCipher(tcDefaultDBEncryptionImpl.java:96)
  at com.thortech.xl.crypto.tcDefaultDBEncryptionImpl.encrypt(tcDefaultDBEncryptionImpl.java:193)
  at com.thortech.xl.crypto.tcCryptoUtil.encrypt(tcCryptoUtil.java:118)
  at com.thortech.xl.crypto.tcCryptoUtil.encrypt(tcCryptoUtil.java:275)
  at oracle.iam.platform.auth.impl.Authenticator.encrypt(Authenticator.java:188)
  at oracle.iam.platform.auth.impl.Authenticator.authenticateWithPassword(Authenticator.java:161)
  at oracle.iam.platform.auth.impl.Authenticator.authenticate(Authenticator.java:134)
  at oracle.iam.platform.auth.providers.wls.OIMAuthLoginModule.login(OIMAuthLoginModule.java:46)
  at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
  at java.security.AccessController.doPrivileged(Native Method)
  at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106)
  at sun.reflect.GeneratedMethodAccessor951.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:606)
  at javax.security.auth.login.LoginContext.invoke(LoginContext.java:784)
  at javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)
  at javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)
  at javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)
  at java.security.AccessController.doPrivileged(Native Method)
  at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695)
  at javax.security.auth.login.LoginContext.login(LoginContext.java:594)
  at com.bea.common.security.internal.service.JAASLoginServiceImpl.login(JAASLoginServiceImpl.java:113)
  at sun.reflect.GeneratedMethodAccessor961.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:606)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
  at com.sun.proxy.$Proxy16.login(Unknown Source)
  at weblogic.security.service.internal.WLSJAASLoginServiceImpl$ServiceImpl.login(WLSJAASLoginServiceImpl.java:89)
  at com.bea.common.security.internal.service.JAASAuthenticationServiceImpl.authenticate(JAASAuthenticationServiceImpl.java:82)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:606)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
  at com.sun.proxy.$Proxy34.authenticate(Unknown Source)
  at weblogic.security.service.WLSJAASAuthenticationServiceWrapper.authenticate(WLSJAASAuthenticationServiceWrapper.java:40)
  at weblogic.security.service.PrincipalAuthenticator.authenticate(PrincipalAuthenticator.java:338)
  at weblogic.servlet.security.internal.SecurityModule.checkAuthenticate(SecurityModule.java:252)
  at weblogic.servlet.security.ServletAuthentication.login(ServletAuthentication.java:466)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:606)
  at oracle.idm.common.login.SignInBean.handleWeblogicAuthn(SignInBean.java:131)
  at oracle.idm.common.login.SignInBean.doLogin(SignInBean.java:97)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:606)
  at com.sun.el.parser.AstValue.invoke(AstValue.java:187)
  at com.sun.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:297)
  at org.apache.myfaces.trinidadinternal.taglib.util.MethodExpressionMethodBinding.invoke(MethodExpressionMethodBinding.java:53)
  at org.apache.myfaces.trinidad.component.UIXComponentBase.broadcastToMethodBinding(UIXComponentBase.java:1256)
  at org.apache.myfaces.trinidad.component.UIXCommand.broadcast(UIXCommand.java:183)
  at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
  at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
  at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
  at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
  at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
  at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
  at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
>
<Nov 11, 2013 11:24:24 PM EST> <Error> <OIM Authenticator> <BEA-000000> <Error encrypting password>
java.lang.reflect.InvocationTargetException
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:606)
  at oracle.idm.common.login.SignInBean.handleWeblogicAuthn(SignInBean.java:131)
  at oracle.idm.common.login.SignInBean.doLogin(SignInBean.java:97)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:606)
  at com.sun.el.parser.AstValue.invoke(AstValue.java:187)
  at com.sun.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:297)
  at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
  at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:139)
  at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
  at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
  at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
  at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
  at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
  at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
  at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
  at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
  at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
  at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
  at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
  at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Caused by: javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User xelsysadm javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User xelsysadm denied
  at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:261)
  at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
  at java.security.AccessController.doPrivileged(Native Method)
  at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106)
  at sun.reflect.GeneratedMethodAccessor951.invoke(Unknown Source)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
  at com.sun.proxy.$Proxy34.authenticate(Unknown Source)
  at weblogic.security.service.WLSJAASAuthenticationServiceWrapper.authenticate(WLSJAASAuthenticationServiceWrapper.java:40)
  at weblogic.security.service.PrincipalAuthenticator.authenticate(PrincipalAuthenticator.java:338)
  at weblogic.servlet.security.internal.SecurityModule.checkAuthenticate(SecurityModule.java:252)
  at weblogic.servlet.security.ServletAuthentication.login(ServletAuthentication.java:466)
  ... 72 more

Answer 1

Hi All,
I have tried out option of adding authwl.conf in java argument as mentioned. But,still same issue persists. I think it will be same whether we refer authwl.conf file from OIM_ORACLE_HOME/server/config or OIM_ORACLE_HOME/designconsole/config/ location.
We havent made any changes in USR table for xelsysadm user
Even system-jazn-data.xml is intact.
Actually,when i removed following classpath entry from setDomainEnv.sh file
CLASSPATH="WL_HOME/server/lib/oimclient.jar:${CLASSPATH}"
export CLASSPATH
Its working fine and i am not facing any login issue in OIM console.Also the Active Directory connector scheduled task are running fine without giving earlier error whic is becaus of explicit classpath addition in setDomainEnv.sh.This error was
java.lang.LinkageError: loader constraint violation: loader (instance of com/thortech/xl/dataobj/tcADPClassLoader) previously initiated loading for a different type with name "com/thortech/xl/dataaccess/tcDataProvider" .
This error was arising since i have explicitly mentioned oimclient.jar again in classpath and as OIM server also will load it at OIM server startup time. So it was finding two instance of tcDataProvider and was not able to decide to refer to which one of them.
But, I have to refer oimclient.jar in my webservice code to work.If we dont add classpath entry explicitly for oimclient.jar then it will throw error..that it is unable to load OIMClient class.
Webservice is deployed in OIM serveer . Is there any other way by which i can refer oimclient class in webservice code without causing this classpath conflict issue. ?
Also.is it correctthat for first time when we load Classpath explicitly like i did in my scenario,then it will always try to refer same classpath for that jar always.
For ex: in my env i made changes in setDomainEnv.sh and modifed classpath enrty as :
CLASSPATH="${OIM_ORACLE_HOME}/server/client/oimclient.jar:${CLASSPATH}"
export CLASSPATH
but this time it will start throwin the exception as :
<Nov 11, 2013 11:24:24 PM EST> <Error> <XELLERATE.ACCOUNTMANAGEMENT> <BEA-000000> <Class/Method: tcDefaultDBEncryptionImpl/initKeyStore encounter some problems: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=.xldatabasekey" "read")
java.security.AccessControlException: access denied ("oracle.security.jps.service.credstore.CredentialAccessPermission" "context=SYSTEM,mapName=oim,keyName=.xldatabasekey" "read")
Do i need to reinstall OIM setup to resolve this issue or is there any other way to refer oimclient.jar in my webservice code deployed in OIM env ?
Please suggest.
Thanks,
RPB