Configuring SSL for SOA Server

Hi All,
I wrkin on SOA suite 11g. I am tryin to implement transport level security. Firstly 1-way authentication and than 2-way mutual authentication. For that I need to enable the SSL for SOA server which is managed by the WLS admin server. As per my knowledge the WLS comes with demoidentity and demotrust keystores. If I need to configure the SSL for SOA server do i need to create new keystores and CA,s or I can use the demo keystores.
Now, in case i need to create new keystores than can i do the same using keytool utility. Additionally, is it possible to make CA using keytool utility? If yes, kindly provide me some links about how to do the same.
Thanks in advance.

Hi Shomit,
If I need to configure the SSL for SOA server do i need to create new keystores and CA,s or I can use the demo keystores.You can use the Demo keystores for dev purpose but it is NOT recommended to use demo keystores for production use.
in case i need to create new keystores than can i do the same using keytool utilityYes, you can do it using Keytool utility.
is it possible to make CA using keytool utility?Actually you can generate a self-signed cert and use that as a CA for signing CSR's.
kindly provide me some links about how to do the sameYou should get everything here -
http://download.oracle.com/docs/cd/E14571_01/web.1111/e13707/ssl.htm#i1200848
Regards,
Anuj

Similar Messages

Need info to configure SSL for Portal Server in EP6SP2

Hello,
We need to configure SSL for Portal Server. We are using J2EE 6.20 Patch 25 and EP6SP2P4. The ITS is already using https and it creats lots of Session issues since Portal is not in https.
Is there any OSS Note or How to guide to configure Portal to use SSL.
Thanks.
- PK

Hi Marcel,
Thanx for your Post, I have a Question, we will use CISCO for load balancing and SSL termination but I have a big issue, the URL in the portal applciation is always the same ant the URL in the borwser, I guess al the other URL´s are in the Frames, how will we configure the SSL termination for the login page in example if the URL in the Browser appears always the same?
Thanx in Advanced!!!

How to configure SSL for SOA BPM/Webcenter 11.1.1.3

Hi,
I have installed BPM 11.1.1.3 and Webcenter 11.1.1.3 in the same HOME. First installed BPM and then extended the domain for webcenter. During the installation I selected the SSL check-box also. Now how do I disable the HTTP and enable only HTTPS. I need to configure SSL can someone please provide some steps or a link to some document around SSL configuration of BPM/Webcenter 11.1.1.3.
Thanks

Hi,
Anyone I too am looking for the same info.
Thanks

How to configure SSL for Oracle Weblogic Server

Hi,
Please help me to configure SSL in oracle weblogic server.
If possible, please provide step by step to configure SSL.

this should help
http://weblogic-wonders.com/weblogic/2010/05/19/configuring-ssl-on-weblogic-server-custom-identity-custom-trust/

How configure SSL for Oracle Lite

Hi all,
I'm trying to configure SSL but I've many doubts.
I already have one SSL certificate, I read in the documentation that is necessary to use the keytool.
Someone can help me for use this tool?
tks,
Everson

this should help
http://weblogic-wonders.com/weblogic/2010/05/19/configuring-ssl-on-weblogic-server-custom-identity-custom-trust/

Kerberos Configuration Manager for SQL Server: Access of system information failed!

I'm trying to use the new Kerberos Configuration Manager for SQL Server tool that was released recently to verify SPN on several SQL Servers, but any time I attempt to connect to a server I get the following error in the log:
6/24/2013 3:48:22 PM Info: Connect to WMI, \\<HOSTNAME>\root\cimv2
6/24/2013 3:48:25 PM Error: Access of system information failed System.DirectoryServices.AccountManagement.PrincipalOperationException: An error (1332) occurred while enumerating the group membership. The member's SID could not be resolved.
at System.DirectoryServices.AccountManagement.SAMMembersSet.IsLocalMember(Byte[] sid)
at System.DirectoryServices.AccountManagement.SAMMembersSet.MoveNextLocal()
at System.DirectoryServices.AccountManagement.SAMMembersSet.MoveNext()
at System.DirectoryServices.AccountManagement.FindResultEnumerator`1.MoveNext()
at System.Linq.Enumerable.Contains[TSource](IEnumerable`1 source, TSource value, IEqualityComparer`1 comparer)
at KerberosCM.WMIHelper.isUserLocalAdmin(SystemInfo si, UserPrincipal user)
at KerberosCM.WMIHelper.getUserInfo(SystemInfo mi)
6/24/2013 3:48:25 PM Error: Error System.Exception: Access of system information failed!
at KerberosCM.WMIHelper.getUserInfo(SystemInfo mi)
at KerberosCM.SystemInfo.GetInfo()
at KerberosConfigMgr.Utility.Login(String serverName, String login, String password, Boolean isCmdLine, Form uiForm)
Things I have tried to resolve this:
1. Verified that my account is a Domain Admin.
2. Attempt to connect locally without inputting any information for server/user/pw
3. Attempt to connect remotely using server/user/pw
I always receive the same error message and log: Access of system information failed!
Has anyone else run into this issue?

Update to this:
There were some invalid user accounts added to the Local Administrators group only showing up as a GUID. This caused the enumeration of the group to fail and generate the error in my original post. Removing those user accounts from the Administrators group
got past the enumeration error.
However, now when attempting to connect to the servers (locally or remotely) I get this error:
6/27/2013 10:24:24 AM Info: Connect to WMI, \root\cimv2
6/27/2013 10:24:38 AM Error: Access of system information failed System.Runtime.InteropServices.COMException (0x80070035): The network path was not found.
at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_AdsObject()
at System.DirectoryServices.PropertyValueCollection.PopulateList()
at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
at System.DirectoryServices.AccountManagement.SAMStoreCtx.ResolveCrossStoreRefToPrincipal(Object o)
at System.DirectoryServices.AccountManagement.SAMMembersSet.MoveNextForeign()
at System.DirectoryServices.AccountManagement.SAMMembersSet.MoveNext()
at System.DirectoryServices.AccountManagement.FindResultEnumerator`1.MoveNext()
at System.Linq.Enumerable.Contains[TSource](IEnumerable`1 source, TSource value, IEqualityComparer`1 comparer)
at KerberosCM.WMIHelper.isUserLocalAdmin(SystemInfo si, UserPrincipal user)
at KerberosCM.WMIHelper.getUserInfo(SystemInfo mi)
6/27/2013 10:24:38 AM Error: Error System.Exception: Access of system information failed!
at KerberosCM.WMIHelper.getUserInfo(SystemInfo mi)
at KerberosCM.SystemInfo.GetInfo()
at KerberosConfigMgr.Utility.Login(String serverName, String login, String password, Boolean isCmdLine, Form uiForm)

Kerberos Configuration Manager for SQL Server is available

This thread describes the Microsoft Kerberos Configuration Manager diagnostic tool for SQL Server. This tool is available for download from the Microsoft Download Center:
Download the package now.
About Kerberos Configuration Manager
The Kerberos Configuration Manager for SQL Server is a diagnostic tool that helps troubleshoot Kerberos related connectivity issues with SQL Server, SQL Server Reporting Services (SSRS), and SQL Server Analysis Services (SSAS). It can perform the following
functions:
Collect information on operating systems and Microsoft SQL Server instances that are installed on a server.
Report on all Service Principal Name (SPN) and delegation configurations on the server.
Identify potential problems in SPNs and delegations.
Fix potential SPN problems.
More information
This tools helps troubleshoot the following exceptions:
401
Note: This error message is for http errors, SSRS errors, and some other similar errors.
Login failed for user 'NTAUTHORITY\ANONYMOUS'
Login failed for user '(null)'
Login failed for user ''
Cannot generate SSPI Context
For more information about Kerberos Configuration Manager, go to the following related blogs:
Released: Kerberos Configuration Manager for SQL Server
Kerberos Configuration Manager updated for Reporting Services
Kerberos Configuration Manager updated for Analysis Services and SQL Server 2014
Reference from the following KB article: Kerberos Configuration Manager for SQL Server is available
Elvis Long
TechNet Community Support

Thanks for posting, Elvis. Can you post this to the SQL Security forum too?
Dan Guzman, SQL Server MVP, http://www.dbdelta.com

Configure logshipping for report server database

Hi All,
Could some one please let me know the steps to be followed to configure logshipping for report server databases.
Thanks in Advance,
Regards, Kranthi

Hi Kranthi,
Based on my understanding, you want to know how to change the roles between primary server and secondary server when primary server goes down. Also you want to know when you should install reporting service on secondary to make sure reporting service could
be used by application team.
When primary server goes down, you should manually fail over to the secondary server and make it your new primary server. Before changing roles between primary server and secondary server, you should initial role change. For more information, please refer
to this link: http://msdn.microsoft.com/en-us/library/ms178117.aspx.
Besides, considering lots of time of reporting service installation and downtime during failover, I recommend you to install reporting service on secondary before configuring log shipping. When application team want to use reporting service with reportserver
database after you performing fail over to the secondary server, you can follow bellow steps to reset the database which will be used by reporting service:
Open Reporting Services Configuration Manager\Database.
Click Change database in the Current Report Server Database section.
On Action page, check Choose an existing report server database box. Click Next.
On Database Server page, type the secondary sever name then connect to it. Click Next.
On Database page, select the reportserver database from the drop-down menu of Report Server Database. Click Next.
Set the credentials, then click Finish on Progress and Finish page.
If you have any questions, please feel free to ask.
Best regards,
Qiuyun Yu

How Do I Configure SSL for RAC Installation.

Experts,
Requesting your inputs on configuring SSL for my RAC environment.
- Oracle DB version is 11.2.0.2
- RAC is with two nodes.
- Two nodes are : rac1.oracle.com and rac2.oracle.com
- RAC setup has SCAN feature configured. SCAN FQDN : racscan.oracle.com
- All clients talk to RAC DB using SCAN feature as shown below.
client applications -> racscan.oracle.com ---> rac1.oracle.com
---> rac2.oracle.com
- tnsnames.ora file on both RAC instances has hostname as "racscan.oracle.com" instead of their individual phyiscal host names.
How do I configure SSL for RAC:
1. Do I need to generate certificate request for individual hostnames or only for SCAN hostname ?.
2. If I generate a certificate based on SCAN hostname, how does SSL work since SCAN hostname is not a phyiscal host name ?
3. What is recommended strategy for configuring SSL for RAC environment ?
Thanks

The documentation on the creation of Oracle Wallets is not specific to RAC, and the RAC SCAN instructions for TCPS are very vague on the specific requirements for the certificates required in the wallets for proper operation. I too am struggling to get it to work. Does anyone have a more technical guide to the specific configuration of the certificates needed and what specific configuration file changes need to be made?
Also, the self signed documentation is getting REALLY old. Oracle, please stop giving instructions that demonstrate irresponsibility and show the proper method of certificate requesting and importing to wallets.
Edited by: user11338513 on Mar 21, 2012 2:23 PM

Configure SSL for virtual web

Is it possible to achive the following:
-myhost is a web server.
-myweb1 is a virtual web located on myhost, so, it is an DNS alias of myhost. it's SSL runs on the server myhost.
-myhost2 is another virtual web located on myhost and it is an DNS alias of myhost also. it has another key/cert and run SSL on the server myhost also.
I have been asked to configure SSL termination on my CSS11506 to offload the SSLs trafic.
Could anyone advice me for a VIP, (myhost), can I use two key/CA? if so, how do I configure them?
Any comments will be appreciated
Thanks in advance.

ssl-proxy-list ssl-slot3
ssl-server 31
............. -> the one which working fine.
ssl-server 14
ssl-server 14 vip address 10.1.31.14
ssl-server 14 cipher rsa-with-rc4-128-sha 10.11.31.14 81
ssl-server 14 rsakey Myweb1Rkey
ssl-server 14 rsacert Myweb1Scert
ssl-server 15
ssl-server 15 vip address 10.1.31.15
ssl-server 15 rsakey Myweb2Rkey
ssl-server 15 rsacert Myweb2Scert
ssl-server 15 cipher rsa-with-rc4-128-sha 10.11.31.15 81
active
service ssl-slot3-srv
type ssl-accel
keepalive type none
slot 3
add ssl-proxy-list ssl-slot3
active
service myhost
ip address 10.4.31.14
keepalive type tcp
keepalive port 80
active
owner mytest
content myweb2-rule
add service ssl-slot3-srv
vip address 10.1.31.15
protocol tcp
port 443
content myweb2-rule2
vip address 10.4.31.15
protocol tcp
port 81
balance leastconn
add service myhost
active
content myweb1-rule
protocol tcp
port 443
add service ssl-slot3-srv
vip address 10.1.31.14
active
Do I miss anything?

Configuring SSL for Real-Time Collaboration

Hi,
We installed OCS10gR1 because we want to use Real-Time collaboration for delivering support. At this moment we are trying to configure SSL. We already worked through the following guides :
- Real-time collaboration admin guide
- OCS admin guide
- OCS Security guide
- OPMN admin guide
but it's still very fuzzy. It's hard to get a clear overview about the steps to follow to get SSL working for RTC. Is there some kind of "cookbook" or simple guide which describes all the steps in a clear way.
Thank you

Hi,
I ran the SSLconfigTool.sh script on the Infrastructure with success but the midtierSSLConfigTool.sh script didn't come to an end. Probably, I ran the script with the wrong options. I used the following options :
<oid hostname> gary.woerden.centric (hostname on which ocs resides)
<oid port> 389 (default)
<oid admin dn> I filled in orcladmin, but maybe dn=woerden,dn=centric would be better ???
<http server SSL port> 8250 (from portlist.ini)
<https> internet_appserver_registry (I really didn't know what value this must be)
<hostname of the computer> gary.woerden.centric
<True | False> False
The output of the script midtierSSLConfigTool.sh with the options mentioned above:
Modifying Collaboration Suite service registry
Exception in thread "main" javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]
at oracle.ldap.util.jndi.ConnectionUtil.returnInitialLdapContext(ConnectionUtil.java:492)
at oracle.ldap.util.jndi.ConnectionUtil.getDefaultDirCtx(ConnectionUtil.java:135)
at oracle.ldap.util.jndi.ConnectionUtil.getDefaultDirCtx(ConnectionUtil.java:157)
at URLUpdate.main(URLUpdate.java:32)
Done. Please go to /opt/oracle/product/10.1.1/ocs/apps/imeeting/logs/rtcctl directory to check the log file.
Starting the SSL Configuration Tool...
Log file recording the current execution is '/home/oracle/SSLConfigTool_20051104_091126.log'.
Below is the command line you have entered:
SSLConfigTool -config_w_default -opwd ******** -ptl_dad portal -ptl_inv_pwd ********
Executing command:
/opt/oracle/product/10.1.1/ocs/apps/bin/ldapbind -h gary.woerden.centric -p 636 -U 1
Querying password for Portal from OID.
Executing command:
/opt/oracle/product/10.1.1/ocs/apps/bin/ldapsearch -h gary.woerden.centric -p 636 -D cn=orcladmin -w ******** -U 1 -b "OrclResourceName=Portal,orclReferenceName=ocs.woerden.centric,cn=IAS Infrastructure Databases,cn=IAS,cn=Products,cn=OracleContext" -s sub "objectclass=*" orclpasswordattribute
Exit code: 0
Executing command:
/opt/oracle/product/10.1.1/ocs/apps/dcm/bin/dcmctl updateConfig
Executing command:
/opt/oracle/product/10.1.1/ocs/apps/opmn/bin/opmnctl stopproc ias-component=dcm-daemon
Configuring HTTPS for your ORACLE_HOME at:
/opt/oracle/product/10.1.1/ocs/apps
Backing up file '/opt/oracle/product/10.1.1/ocs/apps/opmn/conf/opmn.xml' to file '/opt/oracle/product/10.1.1/ocs/apps/opmn/conf/opmn.xml.orig_SSLConfigTool'.
Backing up file '/opt/oracle/product/10.1.1/ocs/apps/Apache/Apache/conf/ssl.conf' to file '/opt/oracle/product/10.1.1/ocs/apps/Apache/Apache/conf/ssl.conf.orig_SSLConfigTool'.
Backing up file '/opt/oracle/product/10.1.1/ocs/apps/webcache/webcache.xml' to file '/opt/oracle/product/10.1.1/ocs/apps/webcache/webcache.xml.orig_SSLConfigTool'.
Backing up file '/opt/oracle/product/10.1.1/ocs/apps/webcache/webcache.xml' to file '/opt/oracle/product/10.1.1/ocs/apps/webcache/webcache.xml.tmp'.
Executing command:
/opt/oracle/product/10.1.1/ocs/apps/sso/bin/ssoreg.sh -oracle_home_path /opt/oracle/product/10.1.1/ocs/apps -site_name SSLConfigTool_ssl_ocsapps.gary.woerden.centric -config_mod_osso TRUE -mod_osso_url https://gary.woerden.centric:8250 -u root
Backing up file '/opt/oracle/product/10.1.1/ocs/apps/j2ee/OC4J_Portal/applications/portal/portal/WEB-INF/web.xml' to file '/opt/oracle/product/10.1.1/ocs/apps/j2ee/OC4J_Portal/applications/portal/portal/WEB-INF/web.xml.orig_SSLConfigTool'.
Backing up file '/opt/oracle/product/10.1.1/ocs/apps/portal/conf/iasconfig.xml' to file '/opt/oracle/product/10.1.1/ocs/apps/portal/conf/iasconfig.xml.orig_SSLConfigTool'.
Executing command:
/opt/oracle/product/10.1.1/ocs/apps/portal/conf/ptlconfig -encrypt
Executing command:
/opt/oracle/product/10.1.1/ocs/apps/portal/conf/ptlconfig -dad portal -pw ********
Backing up file '/opt/oracle/product/10.1.1/ocs/apps/sysman/emd/targets.xml' to file '/opt/oracle/product/10.1.1/ocs/apps/sysman/emd/targets.xml.orig_SSLConfigTool'.
Executing command:
/opt/oracle/product/10.1.1/ocs/apps/dcm/bin/dcmctl updateConfig
This last command didn't come to an end.
Can you tell me what options are wrong and can I run the script again or should I first backup the backupped files ?
Thanx in advance!

How to install and configure configure IGS for J2EE server 700

Hi,
Please help me in installing and configuring IGS for J2EE server700 as i need it to run Business Graphics for my Web DynPro application. Earlier i had installed J2EE server 640 and i didnt have to do any separate installation for IGS. I just had to configure the IGS URL from Visual Admin. But i can't find any igswd.exe running on my J2EE700 engine.
Please let me know the procedure for this.
Thanks an Regards,
Smriti.

Hi,
Check the below link,
<a href="http://help.sap.com/saphelp_nw04/helpdata/en/17/86c039c7811f11e10000000a114084/frameset.htm">About IGS Configuration and Adminisatration</a>
Regards,
Suresh.T

Error Handling for SOA Server

Hi All,
I converted a java code into a webservice with the help of jdeveloper and deployed it into weblogic server, and it is working fine when I am invoking it through the SOA server. But, when I am passing some wrong input values I should suppose to get error, but I don't see any errors inside em and status is showing as completed. At the same time, I am able to view the complete error stack trace inside soa_server1 command prompt (StartManagedWeblogic soa_server1). How can I catch this errors inside em. I added catchall block but no success. My requirement is to catch this errors inside em and need to email it.
Thanks,

Hi,
Thanks for your reply. Can you let me know, where to modify the code in order to print the error inside em.
package com.ka;
import com.agile.api.APIException;
import com.agile.api.AgileSessionFactory;
import com.agile.api.IAdmin;
import com.agile.api.IAgileClass;
import com.agile.api.IAgileSession;
import com.agile.api.IServiceRequest;
import com.agile.api.ServiceRequestConstants;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.HashMap;
import javax.jws.WebService;
import javax.xml.soap.SOAPException;
import javax.xml.ws.BindingType;
import javax.xml.ws.WebFault;
import javax.xml.ws.soap.SOAPBinding;
@WebService(portName = "ClassTestSoap12HttpPort")
@BindingType(SOAPBinding.SOAP12HTTP_BINDING)
public class ClassTest {
public String TestAPIMet(String complaintNumber, String description, String disposition, String severity, String workflow ) {
IAgileSession m_session=null;
IAdmin admin=null;
try {
String error="invalid";
HashMap params = new HashMap();
params.put(AgileSessionFactory.USERNAME, "**********");
params.put(AgileSessionFactory.PASSWORD, "***********************");
System.out.println(""+params);
AgileSessionFactory instance = AgileSessionFactory.getInstance("http://*******************************");
System.out.println(""+instance);
m_session = instance.createSession(params);
System.out.println("Session ID:"+m_session);
admin = m_session.getAdminInstance();
IAgileClass cls = admin.getAgileClass( "ProblemReport" );
System.out.println("Class ID:"+cls);
IServiceRequest psr = (IServiceRequest)m_session.createObject( "ProblemReport", complaintNumber);
psr.setValue(ServiceRequestConstants.ATT_COVER_PAGE_DESCRIPTION, description);
psr.setValue(ServiceRequestConstants.ATT_COVER_PAGE_DISPOSITION, disposition);
psr.setValue(ServiceRequestConstants.ATT_COVER_PAGE_SEVERITY, severity);
psr.setValue(ServiceRequestConstants.ATT_COVER_PAGE_WORKFLOW, workflow);
DateFormat dateFormat = new SimpleDateFormat("MM/dd/yyyy HH:mm:ss a z");
Calendar cal = Calendar.getInstance();
psr.setValue( ServiceRequestConstants.ATT_COVER_PAGE_EXPECTED_RESOLUTION_DATE, dateFormat.format(cal.getTime()));
catch (APIException e) {
e.printStackTrace();
e.getMessage();
e.getRootCause();
finally {
System.out.println("Session is closing");
m_session.close();
System.out.println("Session closed");
return "Success";
}

HTTP Proxy setting for SOA server

Hi,
my intention is to enable SOA Server to connect through HTTP Proxy to external services. This occurred when I am trying to connect to Yahoo Mail Server, via User Messaging Service but it keep throwing connection time out. One of the possible solution is to make the service to connect via the HTTP Proxy server in our network.
There are no mention of how to setup HTTP Proxy connection for UMS, as well as SOA Server in any documents.
Please advice or direct me to the relevant solutions.
Appreciate any help rendered :)
yee thian

I have not worked in SoA server, but since it uses weblogic server underlying (I assume), you can try setting the -Dhttp.proxyHost , -Dhttp.proxyPort system properties ( https for secured URL's) to WLS to specify the proxy details. Also the product might not have the capability to pass user credentials for authentication at the proxy. The version of OSB we are using had this problem. To overcome this you might require to add the URL to the proxy free list in your proxy server. This prevents the proxy from prompting for the user name when you access that URL.

Hardware Configuration recommendation for SOA/BPM/OSB 11.1.1.5 Cluster

Hi,
Want to find out what is the recommended hardware configuration including Memory on the box. Trying to install a 2 Node Cluster of SOA 11.1.1.5 with SOA/BPM, BAM, OSB part of the same domain. All binaries to be installed on a NAS. OS is HP-UX. How much memory is ideal on each box if running SOA Service / BPM workflows and processes,BAM,OSB, Custom ADF Task Flow Apps with a large number of transactions. SO wondering what is an ideal configuration. IS there a matrix or a some kind of spreadsheet to come up with the numbers.
Thanks

Unfortunately there is no simple way to figure this out. The recommendation varies on the basis of multiple factors (from load to avg size of the payload). Please contact your local Oracle Sales Representative and they should help you out in identifying the best possible configuration/sizing for your system.
Regards,
Anuj

Configuring SSL for SOA Server

Similar Messages

Maybe you are looking for