Dynamic Role -- Group Mapping not working in WebLogic 10

I have an installation I am migrating from 9.2 to 10. It uses Dynamic Role Mapping:
From my Weblogic.xml within the deployment:
    <security-role-assignment>
        <role-name>EELSSystemAdministrator</role-name>
        <externally-defined/>
    </security-role-assignment>I am using SPNEGO SSO, and it is working fine, it retrieves the principles from LDAP and adds them to the subject, so everything is fine there. I have defined the deployment constraint "EELSSystemAdministrator" as a Global Role, and then Added a condition "group" and set it to the LDAP Group (SMS EELSSystemAdministrator) which is one of the three principles being returned from LDAP.
When the Role mapper runs, it returns the following in the logs:
<SecurityRoleMap> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users, SMS EELSSystemAdministrator,SMS EELSReportAnalyst]>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(SMS EELSSystemAdministrator ,[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]) -> false>
<SecurityRoleMap> <primary-rule evaluates to NotApplicable because of Condition>
<SecurityRoleMap> <urn:bea:xacml:2.0:entitlement:role:EELSSystemAdministrator:top, 1.0 evaluates to Deny>
<SecurityRoleMap> <XACML RoleMapper: accessing role EELSSystemAdministrator: DENIEDIn my 9.2 Installation that is working I get the following in the logs:
<SecurityRoleMap> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(SMS EELSSystemAdministrator,[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]) -> true>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:or(true) -> true>
<SecurityRoleMap> <primary-rule evaluates to Permit>
<SecurityRoleMap> <urn:bea:xacml:2.0:entitlement:role:EELSSystemAdministrator:type@E@Furl@G@M@Oapplication@EEELSWeb@[email protected]@O$@S@VDSTAMP@S@W@M@OcontextPath@E@UEELS@M@Ouri@E@U, 1.0 evaluates to Permit>
<SecurityRoleMap> <XACML RoleMapper: accessing role EELSSystemAdministrator: GRANTED> I am not sure why my 9.2 deployment lists the role type as a "url" (which points to the right deployment, and 10 lists it as the word "top". Either way, it is not authenticating to my global role based on the Group returned from LDAP.
I'm pretty much out of troubleshooting idea's, having compared every config file/log file etc to find descrepancies in my setup. Anyone have any suggestions, perhaps something that has to be setup differently in 10 then in 9.2?
Thanks in Advance,
John

Update:
I checked a bunch of settings, and it seems to be working now, very odd.

Similar Messages

In human task, dynamically assign group doesn't work

Oracle SOA 11.1.1.4
My bpel process invokes a human task.
On the human task Assignment tab, I assigned 3 users (by name), 1 group (by expression).
The group is configured in LDAP
When I tested the bpel process, I entered the group and other data required.
From the worklist app, I see the task listed. It is assigned to the 3 users, but not the dynamically passed-in group.
From the Audit trail, I saw all data I entered (include the group). Everything seems correct, but I still can’t make the dynamically-pass-group work.
If I assign the group by name in human task, it works fine.
The problem is: dynamically assign group doesn't work.
Please kindly advice.

Yes, it is possible assign a group as participant of some human task, passing the group name as parameter.
I have tested just now.
It works pretty well in SOA 11.1.1.4 (BPEL or BPM).
Make sure add a data parameter in your human task definition and pass a valid group name to it.
At the Assignment tab, in the participants' list, add a group, data type by expression, and set the value to the right xpath expression to the corresponding parameter.
For example: /task:task/task:payload/task:group
If it is not working look the SOA log files, probably you'll find some information about the error there. Maybe there is some problem with your jazn.com configuration.
You can also test if there is something wrong related to the group name, trying to transfer some task to the same group by the worklist.

Alternate Access Mapping not working for Zone : Intranet

One of our client want to set Alternate Access Mappint (intranet) with url "intranet.theirDomain.com" with local IP address.
is it possible?
subsequest to my previous question (
http://social.technet.microsoft.com/Forums/sharepoint/en-US/3f39711e-301a-40e8-aa7a-855fa2c268b1/alternate-access-mapping-not-working?forum=sharepointadmin )
I want to ask one more question
Can we configure "intranet.theirDomain.com" with local IP address for any other zone?
or
If there is ".com" within the url then it can't be configured for InTRAnet?
Thanks
S H A J A N

The names for the zones don't matter. You could use the 'extranet' zone for another intranet name if you wanted, the names are just to make it a bit more friendly for beginners.
What you describe sounds routine, you create a web application with a name, then use an AAM to allow users to access it with a more friendly name. Frequently you end up creating
http://intranet.domain.com and
http://intranet as an AAM, or vice versa.
You can use .com for an intranet site, you would need to add the site as an A Host record in your DNS server so that traffic is sent to your internal server rather than out into the wider world.

Value mapping not working properly

Hi All,
I am using value mapping twice in same mapping program. But only 1 field is coming with value and other is taking same value from source payload, can you please tell me what can be issue here?
Value mapping 1 -
Context - http://sap.com/xi/XI
SenderParty- SenderSchema
ReceiverParty- ReceiverSchema
Value Mapping table in ID -
Value mapping at field 2 -
Context - http://sap.com/xi/XI
SenderParty1- SenderSchema1
ReceiverParty2- ReceiverSchema2
Value Mapping table in ID -
Source payload -
<?xml version="1.0" encoding="UTF-8"?>
<ns0:MT_VM_Send xmlns:ns0="http://xyz.com/Rashmi_CollectPatternDemo">
   <Record>
      <Emp_ID>123</Emp_ID>
      <Name>rash</Name>
      <Surname>sumit</Surname>
      <Gender>Male</Gender>
     <Grade>E2</Grade>
</Record>
</ns0:MT_VM_Send>
Target Payload -
<?xml version="1.0" encoding="UTF-8"?>
<ns0:MT_VM_Receiver xmlns:ns0="http://xyz.com/Rashmi_CollectPatternDemo">
<Record>
<Emp_ID>123</Emp_ID>
<Full_Name>rash sumit</Full_Name>
<Designation>E2</Designation>
<Gender>M</Gender>
<Travel_Mode>Train</Travel_Mode>
</Record>
</ns0:MT_VM_Receiver>
Here travel_mode is coming perfect, but designation is same as defined in source payload. Why here Value mapping not working???
Thanks & regards,
Rashmi Joshi

Hi Rashmi,
The problem would either be in cache update or your mapping. Please provide the sceenshot of mapping (after clicking the value mapping function).
you can also choose the option to throw error in value mapping function, so it will throw error when value not found.
regards,
Harish

Dynamic drill link is not working when i substitute some parameters in Plus

Hi Gurus,
Dynamic drill link is not working when i substitute some parameters in Discoverer plus(Tools--->Manage Links--->Edit links--->Parameters options), when i substitute some parameters it working when i click on drill value the link is popping up to go another worksheet.For some parameters link is not popping up. Could you please give any ideas.
Thanks & Regards
Vikram

Hi Vikram
Oh gosh, me and my big mouth!
Patch 5381032 has two references to issues with links. You might want to discuss your scenario with Oracle and ask them if this patch would resolve your issue.
Another solution would be to upgrade to 10.1.2.2 (available as a patch on MetaLink) which has most of the fixes from all of the patches applied. Again I would advise you speak with Oracle Support as they are the only one who can actually confirm whether this particular issue was fixed in this release.
Are you by any chance seeing zero numbers display as 00 and are you seeing any graying out of icons? If so, then patch 5345595 (sometimes referred to as 5345528) fixes this and is a good patch to apply if you haven't already done so.
All of these patches require a password which can only be obtained from Oracle by raising a service request to Support and stating the issues that you have.
Hope this helps
Regards
Michael

Camera, Browser & Maps Not Working

Hi,
It been since yesterday my Z10 camera, broser & maps not working.
Whenever I click the camera icon, it is not even opening.
Browser icon had changed, it turned to a triangle square & circle.
Can anyone help me out.
Thanks,
Chris

The update may not have loaded properly, you can reload this way: http://btsc.webapps.blackberry.com/btsc/viewdocument.do?externalId=KB34045&sliceId=2&docType=kc&noCo...
Or do a Security Wipe (Reset to Factory Settings) this way:
http://btsc.webapps.blackberry.com/btsc/viewdocument.do?externalId=KB33591&sliceId=2&docType=kc&noCo...
Please read both carefully !

IOS Group Messaging not working when Android phones are involved

Group Messaging not working for me when there are both Iphones and Androids involved. iPhones still using iOS 7 don't seem to be having problems leading me to believe this is an iOS 8 problem. Is there a workaround for this yet, or is this a legitimate bug fix that Apple will have to address?

Hey geoff_zen,
Thanks for the question. After reviewing your post, it sounds like you arr having trouble with group messages. I would recommend that you read this article, it may be able to help you resolve or isolate the issue.
iOS: Troubleshooting Messages
To resolve issues with sending and receiving iMessages, follow these steps
Check iMessage system status for current service issues.
Go to Settings > Messages > Send & Receive and make sure that you registered iMessage with your phone number or Apple ID and that you selected iMessage for use. If the phone number or Apple ID isn't available for use, troubleshoot iMessage registration.
Open Safari and navigate to www.apple.com to verify data connectivity. If a data connection isn't available, troubleshoot cellular data or a Wi-Fi connection.
iMessage over cellular data might not be available while you're on a call. Only 3G and faster GSM networks support simultaneous data and voice calls. Learn which network your phone supports. If your network doesn't support simultaneous data and voice calls, go to Settings > Wi-Fi and turn Wi-Fi on to use iMessage while you're on a call.
Restart your device.
Tap Settings > General > Reset > Reset Network Settings on your iPhone.
If you still can't send or receive an iMessage, follow these steps
Make sure that the contact trying to message you isn't blocked in Settings > Messages > Blocked.
Make sure that the contact you're trying to send a message to is registered with iMessage.
If the issue occurs with a specific contact or contacts, back up or forward important messages and delete your current messaging threads with the contact. Create a new message to the contact and try again.
If the issue occurs with a specific contact or contacts, delete and recreate the contact in the Contacts app. Create a new message to the newly created contact and try again.
Back up and restore your device as new.
Thanks for using Apple Support Communities.
Have a nice day,
Mario

Apple maps not working on iMac

apple maps not working on iMac the little thing just keeps turning

Do a backup.
Quit the application.
Go to Finder and select your user/home folder. With that Finder window as the front window, either select Finder/View/Show View options or go command - J. When the View options opens, check ’Show Library Folder’. That should make your user library folder visible in your user/home folder. Select Library. Then go to Preferences/com.apple.Maps.plist. Move the .plist to your desktop.
Restart the computer, open the application and test. If it works okay, delete the plist from the desktop.
If the application is the same, return the .plist to where you got it from, overwriting the newer one.
Thanks to leonie for some information contained in this.

Group chat not working on Mac

Suddenly stopped working, but personal messages works. Had to login via skype for web and that's where I saw that I had tons of group messages. Tried updating Skype to latest version (7.10), restarted several times, to no avail. Group Chat is still dead.

The same here. Group chats not working, and some 2-person chats not working too.

Groups does not work in Mail under Mavericks

Its not just smart groups, by I cannot get any of my Groups to work with Mail under Mavericks. I am weary of having to type out the address for each person separately. Is there some better way?

I don't know why typing he name of a regular group does not work for you, but…
Another way is to open the address panel, select a group, then select all in the group, then click the two button.

Type-mapping not working correctly, get "Unable to find a javaType for the xmlType" WARNING

I'm manually creating a web-services.xml file, and using the autogen ant task to
generate the codec XML/Java classes. The XML definition is provided by SAP.
The ant build.xml file:
<project name="buildWebservice" default="stubgen">
<target name="stubgen">
<clientgen ear="C:\projects\RMIS\ifrrequests\RMIS.ear"
packageName="com.aa.rmis.webservice.client"
clientJar="C:\projects\RMIS\ifrrequests\rmisws-client.jar"
autotype="False" />
</target>
<target name="all" depends="stubgen"/>
</project>
The problem is seen below in the output from Ant. Note the WARNINIG. The problem
is that the xml type cannot be mapped to the Java type.
C:\projects\RMIS\ifrrequests>ant -buildfile clientbuild.xml
Buildfile: clientbuild.xml
stubgen:
[clientgen] Generating client jar for RMIS.ear ...
[clientgen] WARNINIG: Unable to find a javaType for the xmlType:['urn:sap-com:do
cument:sap:business']:PaymentRequest.Create. Make sure that you have registered
this xml type in the type mapping
[clientgen] Using SOAPElement instead
[clientgen] Compiling 4 source files to C:\DOCUME~1\944377\LOCALS~1\Temp\rmisws-
client.jar-836624340
[clientgen] Building jar: C:\projects\RMIS\ifrrequests\rmisws-client.jar
BUILD SUCCESSFUL
Total time: 17 seconds
The Java source that has the implementation of the service methods is simply:
package com.aa.rmis.webservice;
import com.aa.rmis.ifr.request.*;
public class TestService
public TestService()
public int serviceRequest(PaymentRequestCreate request)
System.out.println("Received serviceRequest message");
return 0;
public void testStringRequest(String request)
The web-service.xml file is attached, which contains the schema for the SAP PaymentRequest.Create
object definition.
Another problem I have, which is probably related, is that the service method
that has a complex data type (non-built in data type) is not being deployed into
the WebLogic server. But the other service method that simply takes a String
parameter is.
The steps I took are:
1. Get XML from SAP Interface Repository (IFR) for PaymentRequest
2. Use ant task autogen to generate the request codec classes
3. Create the web-services.xml file by inserting the schema definition and the
mapping file created by the autogen task, and defining the operations
4. Build web-services.war file that contains all autogen compiled class files,
the web-services.xml file, and the service implementation class
5. Build the ear file that holds the web service files
6. Use the clientgen ant task to generate (included above) to generate the client
jar file that should contain the proxy for both of the service methods
Environment:
* WebLogic 7.02
* JDK 1.3.1_06
* JBuilder 9 Enterprise
* Ant 1.4
Possible causes:
* Namespace not being used correctly
* copied verbatim the mapping xml file generated by autogen into the web-services.xml
file
* xml-schema part of web-services.xml might not be set correctly
* operation definition might not be using the correct namespace
* Classpath used for ant might not be right
* Doubt this is the problem, but I'm out of other ideas
* Set by using the setWLEnv.cmd file provided by WebLogic
* Tried adding the generated classes directory for my project to the classpath,
but did not work
I've been referencing the Programming WebLogic Web Services document throughout
this entire process. I must be missing something.
Can anybody from BEA help me out with this problem?
Thanks in advance.
[web-services.xml]

Hi JD,
I spent a few cycles looking over your web-services.xml file, however I
don't have any suggestions other that one that looks like you have
already tried, at the top, in the <schema...>
targetNamespace="urn:sap-com:document:sap:business"
Making edits to these generated files can be tricky and my only
suggestion is to create a small reproducer to run by our outstanding
support team.
A quick look at our problem database shows one issue (CR095109) related
to a similar problem at deploy time that was fixed with 7.0SP3. Again,
the support folks will be able to help focus in on the issue.
Regards,
Bruce
JD wrote:
>
The first posting contains the wrong web-services.xml file. Please refer to this
one instead.
"JD" <[email protected]> wrote:
I'm manually creating a web-services.xml file, and using the autogen
ant task to
generate the codec XML/Java classes. The XML definition is provided
by SAP.
The ant build.xml file:
<project name="buildWebservice" default="stubgen">
<target name="stubgen">
<clientgen ear="C:\projects\RMIS\ifrrequests\RMIS.ear"
packageName="com.aa.rmis.webservice.client"
clientJar="C:\projects\RMIS\ifrrequests\rmisws-client.jar"
autotype="False" />
</target>
<target name="all" depends="stubgen"/>
</project>
The problem is seen below in the output from Ant. Note the WARNINIG.
The problem
is that the xml type cannot be mapped to the Java type.
C:\projects\RMIS\ifrrequests>ant -buildfile clientbuild.xml
Buildfile: clientbuild.xml
stubgen:
[clientgen] Generating client jar for RMIS.ear ...
[clientgen] WARNINIG: Unable to find a javaType for the xmlType:['urn:sap-com:do
cument:sap:business']:PaymentRequest.Create. Make sure that you have
registered
this xml type in the type mapping
[clientgen] Using SOAPElement instead
[clientgen] Compiling 4 source files to C:\DOCUME~1\944377\LOCALS~1\Temp\rmisws-
client.jar-836624340
[clientgen] Building jar: C:\projects\RMIS\ifrrequests\rmisws-client.jar
BUILD SUCCESSFUL
Total time: 17 seconds
The Java source that has the implementation of the service methods is
simply:
package com.aa.rmis.webservice;
import com.aa.rmis.ifr.request.*;
public class TestService
public TestService()
public int serviceRequest(PaymentRequestCreate request)
System.out.println("Received serviceRequest message");
return 0;
public void testStringRequest(String request)
The web-service.xml file is attached, which contains the schema for the
SAP PaymentRequest.Create
object definition.
Another problem I have, which is probably related, is that the service
method
that has a complex data type (non-built in data type) is not being deployed
into
the WebLogic server. But the other service method that simply takes
a String
parameter is.
The steps I took are:
1. Get XML from SAP Interface Repository (IFR) for PaymentRequest
2. Use ant task autogen to generate the request codec classes
3. Create the web-services.xml file by inserting the schema definition
and the
mapping file created by the autogen task, and defining the operations
4. Build web-services.war file that contains all autogen compiled class
files,
the web-services.xml file, and the service implementation class
5. Build the ear file that holds the web service files
6. Use the clientgen ant task to generate (included above) to generate
the client
jar file that should contain the proxy for both of the service methods
Environment:
* WebLogic 7.02
* JDK 1.3.1_06
* JBuilder 9 Enterprise
* Ant 1.4
Possible causes:
* Namespace not being used correctly
* copied verbatim the mapping xml file generated by autogen into
the web-services.xml
file
* xml-schema part of web-services.xml might not be set correctly
* operation definition might not be using the correct namespace
* Classpath used for ant might not be right
* Doubt this is the problem, but I'm out of other ideas
* Set by using the setWLEnv.cmd file provided by WebLogic
* Tried adding the generated classes directory for my project to
the classpath,
but did not work
I've been referencing the Programming WebLogic Web Services document
throughout
this entire process. I must be missing something.
Can anybody from BEA help me out with this problem?
Thanks in advance.
Name: web-services.xml
web-services.xml Type: ACT Project (text/xml)
Encoding: base64

Navigation not working in Weblogic Server but working from JDeveloper.

Hi
I created a simple application with some page navigations (some declarative and some dynamic using Managed Bean).
The navigation works fine when I run from JDeveloper. (Local System)
So I deployed the application to the WebLogic server (Local system with a domain configured with ADF.)
The pages are getting rendered correctly, bu on button clicks, the navigation is not happening from any of the pages.
Could I have missed something or is there a way to track what the problem might be?
JDev : 11.1.1.3
Web Logic Server : 11gR1 (1.3) which comes with JDeveloper
Thanks for any help.
Sameer

Hi John
I am not using task flows. I just have some jspx pages defined in the unbounded task flow adfc-config.xml connected with navigation.
I run from JDEveloper by right clicking on the jspx files.
The URL when run from jdeveloper is as follows.
http://127.0.0.1:7101/SessionsPOC-ViewController-context-root/faces/MainPage
From Weblogic server I am using the link given in the Testing tab of the weblogic administration console.
The URL is as follows.
http://10.9.73.103:7001/SessionsPOC-ViewController-context-root (default)
http://10.9.73.103:7001/SessionsPOC-ViewController-context-root/MainPage.jspx
Actually, the URL given in the weblogic testing tab is not runnable. I am changing the link as follows to be able to run it.
http://10.9.73.103:7001/SessionsPOC-ViewController-context-root/faces/MainPage.jspx
I have defined the MainPage.jspx in the web.xml 's Welcome page. But it is not taking it I guess.
Also, I am able to run the other page by giving the following url. But the navigation buttons are not working in that page also.
http://10.9.73.103:7001/SessionsPOC-ViewController-context-root/faces/SecondPage.jspx
Thanks
Sameer

Dynamic selection in s_alr_87012079 not working.

Dear All,
Dynamic selection for Standard FI report S_ALR_87012079 seems not working properly. When users here are specifying period range in dynamic selection , all the data is being fetched.
I searched the forum and found the following link , but its unanswered.
[Dynamic Selection in S_ALR_87012079;
Do i need to copy the program and do any customized coding or any other options.
Thanks n regards,
Sij.

Hi Sij,
1) Go t se36 and before that you have t get logical database name 2) From there go to menu and check the views 3) Take the view and click on chnage 4) Get the exact node which one you need and check the fields .In the same way you can add function groups also and then save.This is did for s_alr_87011990 report with custom fields.You can try and see.
Regards,
Madhu.

Credential Mapping Mapping not working

"Please tell where I am wrong in configuring and calling credential mapper???
I wanted to achieve single sign on using in-built Credential mapping feature of weblogic server.
I thought of getting connected to pointbase which can act as Enterprise Information System(EIS).
I did following steps.
Configuration Phase
1 I made Examples as user and Examples as password in pointbase which will act as my EIS.
2 I wrote and deploy one connector class for connecting to pointbase.
3 I configured Admin as user and Admin as password in my configured security realm which will act as Weblogic User.
4 I did credential mapping in the connector class for mapping my Weblogic (Admin) user to EIS(Examples) user.
Calling Phase
1 I deployed one application to call pointbase server using the connector class.
2 I try to get connection to pointbase server using following code
getConnection("Admin","Admin");
Where Admin user is my weblogic user mapped to Examples user of point base server whose mapping is done in the connector.
I hope it to work for getting the connection.But it didn't work.
whearas when i try to get connection using
getConnection("Examples","Examples");
which is my pointbase user.It works.
So,I can assume it is not working for mapped user for credential provider.
I don't know where I am

Mario
There is a bug with this, but in SP10 and SP11 - I found out the hardware and impleneted some didgy fixes from SAP that broke more than they fixed...
What's the error you were getting? Were both paths evaluated?
These are the two OSS Notes I know of:
Note 1061202 - Function "if" evaluates both branches
https://service.sap.com/sap/support/notes/1061202
Note 1053706 - Function "if" produces wrong result in Message-Mapping
https://service.sap.com/sap/support/notes/1053706

ListenerAdmin not working in WebLogic

I seem to be having the same issue that folks are having within the Glassfish server. I've configured the APEX listener on WebLogic 11g (10.3.5). Followed the instructions to create the adminlistener and managerlistener and their respective groups: Admin and Manager and assigned the users apppropriately (followed the installation instructions). I've used listenerConfig to configure the listener but when trying to access listenerAdmin URL I get the dreaded 403 error. Any help would be appreciated.
Thanks,
Jack

Hi Jack,
could you post some additional information of what exactly you did and which version of APEX Listener you use?
And did you try to reset your browsers authentication cache? As I've learned when investigating similar problems (also discussed here) both listenerStatus and listenerAdmin use the same realm for basic authentication ("APEX"). If your browser stores your authentication information for one of these realms (which it usually does) and you try to enter the other part, it resends these information, which can lead to a 403 (as discussed in Link http://localhost:8080/apex/listenerConfigure not working).
Possibly this caching is even instance-independent (as the realm doesn't include any host/instance/... information), so if you've entered different credentials for another instance, this could be an explanation as well. Could you try to erase any entry concerning APEX Listener from your browser cache? Or try a different browser you ususally don't use, perhaps even a portable version of Firefox or something like that, where you can be sure you have a fresh start and can safely abandon everything once you've done?
The latter case would only be relevant if you aren't even asked before you get the 403. So the question is: Can you enter the credentials at all, or do you get the 403 right away?
Another possibility: Did you try with a simple password (without any special character)? And did you restart your WLS after adding those users? Possibly these changes aren't effective immediately.
-Udo

Dynamic Role -- Group Mapping not working in WebLogic 10

Similar Messages

Maybe you are looking for