How to configure N+1 HA

Hi,, everyone...
My messaging server version is as follow...
root@idm02/users/leeky/mail6.3/sbin>./imsimta version
Sun Java(tm) System Messaging Server 6.3-8.01 (built Dec 16 2008; 32bit)
libimta.so 6.3-8.01 (built 17:17:19, Dec 16 2008; 32bit)
SunOS idm02 5.10 Generic_120011-14 sun4u sparc SUNW,Sun-Fire-280R
Question is how to configure N+1 HA with Messaging Server 6.3.
I am using Veritas Cluster S/W and I already configured my message servers N+1 with iMS5.2p2 and one Asymmetric HA configuration with Messaging Server 6.3.
No problem with iMS5.2p2(N+1 configuration) and Asymmetric HA configuration(6.3).
In near future,however, I will upgrade all of my Messaging Servers to 6.3 with N+1 HA configuration.
With iMS5.2p2, I had no problem to configure N+1.
But I do not know how to configuire N+1 with 6.3 because 6.3 can be installed only one instance in one machine.
-- iMS5.2p2 N+1 configuration --
A node: have mount point + shared disk
B node: have mount point + shared disk
HA node: have only A and B mount point
all binary,config and user data are stored in shared disk.
When A node and(or) B node are failed, Veritas cluster stops all service(=unmounts shared disk ) and mounts to HA node.
It was possible way because iMS5.2p2 supports multi instance environment.
I read under books, but I could not found relevant information
http://docs.sun.com/app/docs/doc/819-4428/gedso?a=view <-- very unkind explanation
http://www.sun.com/bigadmin/features/hub_articles/message_srvr_cluster.pdf <-- only describe Asymmetric
According to those books, binaries can be installed on a local disk in each A,B and HAnode and then run useconfig in HA node.
Config and user data is stored in a shared disk.
With this way, I can bulid up between A and HA node(it's find because it's the same as Asymmetric configuration method )
But between B and HA node, what should I do ?
What kind of way should I use to install or configure B and HA node ? I can not install 6.3 in HA node and link files under {ServerRoot}
I tried many ways, but I failed and failed.
Any Good idea, advice or document ?
Thanks
Edited by: leeky41 on Nov 4, 2009 1:48 AM

leeky41 wrote:
Question is how to configure N+1 HA with Messaging Server 6.3.The JES installer (used with Communication Suite 5) doesn't allow for this configuration.
I am using Veritas Cluster S/W and I already configured my message servers N+1 with iMS5.2p2 and one Asymmetric HA configuration with Messaging Server 6.3.
No problem with iMS5.2p2(N+1 configuration) and Asymmetric HA configuration(6.3).
In near future,however, I will upgrade all of my Messaging Servers to 6.3 with N+1 HA configuration.
With iMS5.2p2, I had no problem to configure N+1.
But I do not know how to configuire N+1 with 6.3 because 6.3 can be installed only one instance in one machine.The new communication suite installer (provided with MS6.3 64bit/MS7 and above) allows you to install multiple copies of Messaging Server via the use of the altroot mechanism.
http://docs.sun.com/app/docs/doc/820-2124/6ndofheo2?a=view
"Performing Multiple Installations with an Alternate Root"
According to those books, binaries can be installed on a local disk in each A,B and HAnode and then run useconfig in HA node.
Config and user data is stored in a shared disk.Using the altroot mechanism, binaries can be installed (and patched) on a shared disk. When you patch you use the "-R <altroot> path" e.g. patchadd -R /opt/comms/inst1/ 123456-78
Any Good idea, advice or document ?I recommend you move to MS7u3 (Communication Suite 7) and use the altroot functionality.
Regards,
Shane.

Similar Messages

How to configure oracle listener profile for multiple oracle database

Hi,
I am going to install solution manager system in the same server of ERP EHP4 on Windows. Both DB are oracle.
I'd like to know how to configure listener in this kind of envirnmonent.
a. use two listener and different ports
b. use same listener but different ports
c. use same listener and same port
Which is the correct mothed?
And, after installation, there seem three set of profiles of listten, one for ERP, one for SLM, and the other for OS?(%windir%system32), which one is functional?
Please advise.
Thanks a lot.
Regards,
Alex

Hi,
standard installation is creating new configs for listener for each instance.
I would recommend to use one listener per each instance.
YOU CAN NOT HAVE one port number for two differnet systems!
If you want to use one listener than you must adapt tnsnames.ora, listener.ora and ensure that both systems will use different port numbers.
For example PORT= 15<system number>
Peter

How to configure one TREX host with multiple index servers ?

Hi All,
Does anyone know how to configure TREX on the one host,
with multiple index servers ?
Reason for this is to make better use of resources available on the host server(4 Gig, 4 Processor, Windows2003), to improve the search performance of
our KM content for portal users.
I am using TREX 7 and have not been able to do this,
despite reading the Single and Distributed install
documentation.
Any help would be appreciated.
Regards,
Andres

Hi Andres,
To make use of the RAM a Server provides you have to run two indexserver processes (each can then consume 2 GB);
Proceed like this:
1. Go to TREXdeamon.ini; check if section [indexserver2] is there (it is already provided, but not active in standard installation)
2. In TREXdeamon.ini go to
[daemon]
references sections below
programs=nameserver,preprocessor1,indexserver1,queueserver,alertserver
and add indexserver2 here. Restart TREX; second porcess is then started; can be checked in TREX monitor in Portal as well
3. To distribute existing indexes to the new process, start TREXadmintool and go to Index: Landscape
Go to the last two columns and move the indexes (move master here/secondary mouse click)
If you don't distribute the indexes the new index server process will be regarded when an new index is created.
Hope this helps!
cheers
Bettina

How to configure request manager service for multiple website in one web application

I have set up sp 2013 as below:
web application : wa1
site collection : sc1
sp site: site1, site2
I used 2 WFE, 1 APP, how can I use request manager service to control site1 to wfe1, site2 to wfe2?
Awen

That's not what i'd describe as load balancing.
A better description would be load-isolation. In your description then if the load on site1 was large (and growing) but site2 was quiet then site1 would struggle and eventually become unable to handle the number of users but site2 would still be ok. That's
fine from a QOS point of view but it's not the norm for load balancing. It would work in simple scenarios but the out of the box load balancing tools are much better suited than that sort of approach.
This article shows how to configure the RMS and may help show how your request is difficult to configure:
http://www.harbar.net/articles/sp2013rm2.aspx

How to configure 3 different members under a single Month column

Hi SAP Gurus,
My client requirement is to show the report in following format, where under a Month column 3 different columns having
1) Quantity (Number of unit ) of a product,
2) its rate (Amount per unit), and
3) Total (amount)    will appear in a single report.
   I have Month as a Time Dim, while Qty, Rate and Total are members of account dim.
Que: How to configure such scenario in a single report?
Jan.2011
Product Category:            Qty (Input)   Rate (Input)   Total (Output)
Product 1
Product 2
Product 3
Product 4
Group1
     Where: Total = Qty X Rate
Thanks and Regards,
SouarbhD

Hi,
Use an EVDRE to create your input schedule. You need to have one row with products and 2 columns with time and account. Choose the memberset options as per the requirement. For the accounts, is total calculated with a dimension formula? If yes, then you just need to enter the values for quantity and rate and send the data. The total will be calculated by the system and will be displayed automatically.
Hope this helps.

How to configure an Alert message if communicationChannel(JMS) stops

All,
Is there a way how to configure an alert when the communication channel stops.
<b>Scenario:</b>
In the path Runtime workbench->Component Monitoring->Adapter Engine->Communication Channel monitoring, if we see that a communication channel has stopped(RED traffic light as Status), then can we trigger an alert notification for same.
Currently we have alrerts configured for any message/s failure in the JMS Adapter Framework. So can we trigger simmilar alerts when a comm channel stops(for whatever reason).
Thanks in advance
RK

Hi Sreeram,
Thanks for the quick reply.
We have a scenario where we activate individual channels at a given time. So in this case, Adapter will always be in RED as all queues are never running in our scenario.
So we need an ALERT to be triggered for individual comm channels. Is theer any way that you can think of ?
Thanks and regards
RK

How to configure multiple IP addresses on one NIC?

Hi,
I just installed a OVM Server in version 3.2.1 and the according VMManager. Now i wanted to try to configure the Server/Server Pool. Now i come across a problem, which was already a big problem in OVM 2 while configuring the Networks.
All our OVM Servers have three NICs in them. One is for VMs and Management, the others are for connection to our SAN (Dell PowerVault MD 3220i). My problem is, that due to the network setup, the two NICs for storage need two IP addresses in two different networks each. This shouldn't be a problem, because usually in linux all you have to do is configure something like eth1:1. I remember having huge trouble configuring it in our OVM 2 cluster up to the point where I had to write a shell script to configure the second IP.
Anyways, I have configured two of the storage networks on eth1 and eth2 of the VM Server. Now i cannot configure any more IP addresses, because eth1 and eth2 are not available anymore for configuration in a third network. I really hoped that it would be possible in OVM 3 to configure multiple IP addresses. And probably it is only my lack of knowledge of how to configure it.
So any advice is well appreciated.
Thanks!
Regards,
Marek Hubatka

You should be able to do this by using "VLAN Groups".
http://docs.oracle.com/cd/E35328_01/E35332/E35332.pdf
Check out the VLAN groups section. You must great the VLAN groups before you can assign them to interfaces.

IAS 10.1.2-how to configure different oc4j listen to different virtualhost?

Hi
I have requirement,
we have oracle portal based web site that can be used by outside users over the internet.
And then we have are deploying few new apps/webservices/ear files on a oc4j called core_ws. These web services should not be accessed outside.
I have created a virtaul host in apache on a different port(7799) which was not exposed to public world.
But, how to configure core_ws to inform Apache to listen on only port 7799 but not on port 80?
I tried a diffent route to attack the problem(as mentioned below) which managmenet did not like:
created location directive, worked in dev but not in production as there ISA sitting front of apache.
We could apply filter on the URLs of these web services in ISA but my director did not like the idea as each time there is additional web service we have mess with it.
So, he prefers running these web services on a different port that will not have access to public.
Appreciate your help if have acheived the same earlier.

By your description, it sounds like you want to do what is in this My Oracle Support document:
How To Create Virtual Host Specific OC4J Applications (Doc ID 389819.1)
https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=389819.1
(requires login)
You said you were using 10.1.2, so that will work, its a method of creating separate virtualhosts and using rewrites to direct to error pages if an incorrect request is made. For 10.1.3, but there is a dynamic method which is a better approach.
...Ken

How to configure sync with my local ftp server?

I have used XMarks since now because it hallow me to synchronize my bookmarks with my local server. Now XMarks don't work anymore because it's not more possible to synchronize the passwords.
Any other alternative imposes to use an external server and I don't want to use an external server. My data must remain on my machine it's absolutely excluded that i use an external unknown server for this.
The only solution must be a free solution (a real free solution) and the firefox synchronization seems to me the best/only one.
But I've not found how to configure it to use my own server.
So how to do it, where are the options to the synchronizer to give my own ftp server or whatever other server it needs?

iAS 6.0 sp4 officially does only support iPlanet Directory Server 5.0 sp1 and 4.13.
For more details visit: http://docs.iplanet.com/docs/manuals/ias/60/sp4/ig/prep.htm#42084
I guess, you can specify the directory server during the time of installation.
Thanks,
Rakesh.

ASA 5505 8.4. How to configure the switch to the backup channel to the primary with a delay (ex., 5 min) using the SLA?

I have ASA 5505 8.4. How to configure the switch to the backup channel to the primary with a delay (for example 5 min.) using the SLA monitor?
Or as something else to implement it?
My configuration for SLA monitor:
sla monitor 123
type echo protocol ipIcmpEcho IP_GATEWAY_MAIN interface outside_cifra
num-packets 3
timeout 3000
frequency 10
sla monitor schedule 123 life forever start-time now
track 1 rtr 123 reachability

Hey cadet alain,
thank you for your answer :-)
I have deleted all such attempts not working, so a packet-trace will be not very useful conent...
Here is the LogLine when i try to browse port 80 from outside (80.xxx.xxx.180:80) without VPN connection:
3
Nov 21 2011
18:29:56
77.xxx.xxx.99
59068
80.xxx.xxx.180
80
TCP access denied by ACL from 77.xxx.xxx.99/59068 to outside:80.xxx.xxx.180/80
The attached file is only the show running-config
Now i can with my AnyConnect Clients, too, but after connection is up, my vpnclients can't surf the web any longer because anyconnect serves as default route on 0.0.0.0 ... that's bad, too
Actually the AnyConnect and Nat/ACL Problem are my last two open Problems until i setup the second ASA on the right ;-)
Regards.
Chris

I want to set up the Time Machine and I would love to use the Time Capsule but since I already have a wireless router I need suggestions on what other external disks Apple could recommend to use with the Time Machine and how to configure that disk

I want to set up the Time Machine and I would love to use the Time
Capsule but since I already have a wireless router I need suggestions on
what other
external disks Apple could recommend to use with the Time Machine and
how to configure that disk.
A complication that I need to resolve is the fact that I am using Vmware
Fusion to be able to use Windows on my Mac. Now it seems that Time
Machine is not backing up my files
on that virtual Windows without additional configuration and my question
is whether you can advise me here or whether this is only a matter for
the Fusion virtual machine.

If you want to use Time Capsule you can.. you simply bridge it and plug it into the existing router.. wireless can be either turned off or used to reinforce the existing wireless.. eg use 5ghz in the TC which is much faster than your 2.4ghz.
You can also use a NAS.. many brands available but the top brands are synology, qnap and netgear readynas series. These will all do Time Machine backups although how well always depends on Apple sticking to a standard. There are cheaper ones.. I bought a single disk zyxel which was rebadged and sold through my local supermarket. It actually works very well for TM at least on Snow Leopard. Major changes were made in Lion and again ML so do not instantly think it will work on later versions. I haven't tried it yet with those versions.
Any external drive can be plugged into the mac. Use the one with the fastest connection or cheapest price according to your budget. USB2 drives are cheap and plentiful. But no where near as fast as USB3 or FW800. So just pick whichever suits the ports on your Mac. Interesting Apple finally moved to USB3 on their latest computers.
TM should exclude the VM partition file.. it is useless backing it up from Mac OS side.. and will slow TM as it needs to backup that partition everyday for no purpose.. TM cannot see the files inside it to backup just the changes.
You need to backup windows from windows. Use MSbackup to external drive.. if you have pro or ultimate versions you can backup to network drive. But MSbackup is a dog.. at least until the latest version it cannot restore the partition without first loading windows. There are about a zillion backup software versions for windows.. look up reviews and buy one which works for you. I use a free one Macrium Reflect which does full disk backups and is easy to restore.. to do incremental backups though you have to pay for it.

Don't know which technology to utilize or how to configure ASA5505

I have an ASA5505. Currently, it is using static NAT on several ports to forward traffic to several devices inside my network. It is a pain not only to configure but from the end user side.
The issue I am having is the applicatoins I am using to access the devices become a mess with dual configurations, one for when I am connected to the internal network and one for when I am away from the office and accessing from the internet. For example, I have 2 Cisco VC240 IP Cameras behind the ASA5505. One is set use port 9091 and the other 9092. When I am inside the office, I access them via http://10.1.2.215:9091 and http://10.1.2.216:9092. But when I am away from the office, I have to have another configuration in an Android app to use them, http://external_ASA_IP:9091 and 9092 and then NAT 9091 to the object for Camera1 and 9092 for Camera2. This is only one scenario. I also have a UC320W that I would like to put an IP phone at home and it sounds like AnyConnect is the only way to do this.
It sounds like to me that if I use some type of VPN, I can access the same devices using the same IP whether internal or external with the external connection using the VPN to tunnel the IP to the local network. There seems to be quite a few ways to do this with an ASA 5505.
AnyConnect seems like the way to go but after reading Cisco documentation, it requires your Android device to be root'd if it is not a particular Samsung model. If I understand correctly, root'ing your phone voids the warranty. I know it is common practice but would think Cisco would have a better solution as I am sure Cisco would not want another manufacturer telling their customers to void the warranty on their Cisco equipment in order to get it to work.
I believe I can just use IPSEC and use the native VPN of the Android OS and also tunnel L2TP as the Android supports IPSEC-PSK/L2TP or IPSEC-CRT/L2TP. But will either of these will support the IP phone to the UC320W?
A friend also told me to use NginX to proxy URL's so the URL http://www.fqdn.com/camera1 gets proxy'd to the internal IP of Camera1 and http://www.fqdn.com/camera2 gets proxy'd to Camera2. He says I should be able to store a cookie on the phone and let the phone authenticate to the camera and if the phone cannot, the proxy can authenticate internally to the IP camera over SSL.
I don't know anymore, I am so confused and just want to simplify my life as I am just a small business with me and a couple other employees but I have full-time job and it is not IT/Network Technician, it is only CTO/CEO/CIO/CFO. I don't have hours upon hours to set this up and test and I don't have hours upon hours to manage it. I just need to simplify this and have so that it is a set-it-and-forget-it for 6 months to 1 year and re-evaluate or update. So, if someone suggests IPSEC, I would not know how to configure anyway and you should expect another post. The same for AnyConnect or any of the other suggestions.
Thanks in advance for any advice.

Hi!
1. Set Calculation Mode property of ITEM_5 to Formula.
Formula property:
nvl(:Block_Name.ITEM_1, 0) + nvl(:Block_Name.ITEM_2, 0) + nvl(:Block_Name.ITEM_3, 0) + nvl(:Block_Name.ITEM_4, 0)
OR
Function_Name(Param_1,... Param_N);
Have in view of, that the ITEM_5 data will not be saved in DataBase.
2. When-Validate-Item trigger is usfull when is necessary to store calculated item data in DataBase.
Rename you Post-Query trigger to When-Validate-Item.
Modify trigger: Store calculation result in the variable.
(Don't forget to round variable value!)
Then compare it with ITEM_5. If they are different - :ITEM_5 := var_name.
I prefer the first method.

How to configure sso with SSL step by step

Purpose
In this document, you can learn how to configure SSO with SSL. After user have certificate installed in browser, he can login without input username and password.
Overview
In this document we will demonstrate:
1.     How to configure OHS support SSL
2.     How to Register SSO with SSL
3.     Configure SSO for certificates
Prerequisites
Before start this document, you should have:
1.     Oracle AS 10g infrastructure installed (10.1.2)
2.     OCA installed
Note:
1.     “When you install Oracle infrastructure, please make sure you have select OCA.
2.     How Certificate-Enabled Authentication Works:
a.     The user tries to access a partner application.
b.     The partner application redirects the user to the single sign-on server for authentication. As part of this redirection, the browser sends the user's certificate to the login URL of the server (2a). If it is able to verify the certificate, the server returns the user to the requested application.
c.     The application delivers content. Users whose browsers are configured to prompt for a certificate-store password may only have to present this password once, depending upon how their browser is configured. If they log out and then attempt to access a partner application, the browser passes their certificate to the single sign-on server automatically. This means that they never really log out. To effectively log out, they must close the browser.
Enable SSL on the Single Sign-On Middle Tier
The following steps involve configuring the Oracle HTTP Server. Perform them on the single sign-on middle tier. In doing so, keep the following in mind:
l     You must configure SSL on the computer where the single sign-on middle tier is running.
l     You are configuring one-way SSL.
l     You may enable SSL for simple network encryption; PKI authentication is not required. Note though that you must use a valid wallet and server certificate. The default wallet location is ORACLE_HOME/Apache/Apache/conf/ssl.wlt/default.
1.     Back up the opmn.xml file, found at ORACLE_HOME/opmn/conf
2.     In opmn.xml, change the value for the start-mode parameter to ssl-enabled. This parameter appears in boldface in the xml tag immediately following.
<ias-component id="HTTP_Server">
<process-type id="HTTP_Server" module-id="OHS">
<module-data>
<category id="start-parameters">
<data id="start-mode" value="ssl-enabled"/>
</category>
</module-data>
<process-set id="HTTP_Server" numprocs="1"/>
</process-type>
</ias-component>
3.     Update the distributed cluster management database with the change: ORACLE_HOME/dcm/bin/dcmctl updateconfig -ct opmn
4.     Reload the modified opmn configuration file:
ORACLE_HOME/opmn/bin/opmnctl reload
5.     Keep a non-SSL port active. The External Applications portlet communicates with the single sign-on server over a non-SSL port. The HTTP port is enabled by default. If you have not disabled the port, this step requires no action.
6.     Apply the rule mod_rewrite to SSL configuration. This step involves modifying the ssl.conf file on the middle-tier computer. The file is at ORACLE_HOME/Apache/Apache/conf. Back up the file before editing it.
Because the Oracle HTTP Server has to be available over both HTTP and HTTPS, the SSL host must be configured as a virtual host. Add the lines that follow to the SSL Virtual Hosts section of ssl.conf if they are not already there. These lines ensure that the single sign-on login module in OC4J_SECURITY is invoked when a user logs in to the SSL host.
<VirtualHost ssl_host:port>
RewriteEngine on
RewriteOptions inherit
</VirtualHost>
Save and close the file.
7.     Update the distributed cluster management database with the changes:
ORACLE_HOME/dcm/bin/dcmctl updateconfig -ct ohs
8.     Restart the Oracle HTTP Server:
ORACLE_HOME/opmn/bin/opmnctl stopproc process-type=HTTP_Server
ORACLE_HOME/opmn/bin/opmnctl startproc process-type=HTTP_Server
9.     Verify that you have enabled the single sign-on middle tier for SSL by trying to access the OracleAS welcome page, using the format https://host:ssl_port.
Reconfigure the Identity Management Infrastructure Database
Change all references of http in single sign-on URLs to https within the identity management infrastructure database. When you change single sign-on URLs in the database, you must also change these URLs in the targets.xml file on the single sign-on middle tier. targets.xml is the configuration file for the various "targets" that Oracle Enterprise Manager monitors. One of these targets is OracleAS Single Sign-On.
1.     Change Single Sign-On URLs
Run the ssocfg script, taking care to enter the command on the computer where the single sign-on middle tier is located. Use the following syntax:
UNIX:
$ORACLE_HOME/sso/bin/ssocfg.sh protocol host ssl_port
Windows:
%ORACLE_HOME%\sso\bin\ssocfg.bat protocol host ssl_port
In this case, protocol is https. (To change back to HTTP, use http.) The parameter host is the host name, or server name, of the Oracle HTTP listener for the single sign-on server.
Here is an example:
ssocfg.sh https login.acme.com 4443
2. Restart OC4J_SECURITY instance and verify the configuration
To determine the correct port number, examine the ssl.conf file. Port 4443 is the port number that the OracleAS installer assigns during installation.
If you run ssocfg successfully, the script returns a status 0. To confirm that you were successful, restart the OC4J_SECURITY instance:
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
Then try logging in to the single sign-on server at its SSL address:
https://host:ssl_port/pls/orasso/
     3. Back up the file targets.xml:
cp ORACLE_HOME/sysman/emd/targets.xml ORACLE_HOME/sysman/emd/targets.xml.backup
4. Open the file and find the target type oracle_sso_server. Within this target type, locate and edit the three attributes that you passed to ssocfg:
·     HTTPMachine—the server host name
·     HTTPPort—the server port number
·     HTTPProtocol—the server protocol
If, for example, you run ssocfg like this:
ORACLE_HOME/sso/bin/ssocfg.sh http sso.mydomain.com:4443
Update the three attributes this way:
<Property NAME="HTTPMachine" VALUE="sso.mydomain.com"/>
<Property NAME="HTTPPort" VALUE="4443"/>
<Property NAME="HTTPProtocol" VALUE="HTTPS"/>
5.Save and close the file.
6.     Reload the OracleAS console:
     ORACLE_HOME/bin/emctl reload
7. Issue these two commands:
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
Registering mod_osso
1.     This command sequence that follows shows a mod_osso instance being reregistered with the single sign-on server.
$ORACLE_HOME/sso/bin/ssoreg.sh
     -oracle_home_path $ORACLE_HOME
     -config_mod_osso TRUE
     -mod_osso_url https://myhost.mydomain.com:4443
2.     Restarting the Oracle HTTP Server
After running ssoreg, restart the Oracle HTTP Server:
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
Configuring the Single Sign-On System for Certificates
1.     Configure policy.properties with the Default Authentication Plugin
Update the DefaultAuthLevel section of the policy.properties file with the correct authentication level for certificate sign-on. This file is at ORACLE_HOME/sso/conf. Set the default authentication level to this value:
DefaultAuthLevel = MediumHighSecurity
Then, in the Authentication plugins section, pair this authentication level with the default authentication plugin:
MediumHighSecurity_AuthPlugin = oracle.security.sso.server.auth.SSOX509CertAuth
2.     Restart the Single Sign-On Middle Tier
After configuring the server, restart the middle tier:
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server
ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY
Bringing the SSO Users to OCA User Certificate Request URL
The OCA server reduces the administrative and maintenance cost of provisioning a user certificate. The OCA server achieves this by authenticating users by using OracleAS SSO server authentication. All users who have an Oracle AS SSO server account can directly get a certificate by using the OCA user interface. This reduces the time normoally requidred to provision a certificate by a certificate authority.
The URL for the SSO certificate Request is:
https://<Oracle_HTTP_host>:<oca_ssl_port>/oca/sso_oca_link
You can configure OCA to provide the user certificate request interface URL to SSO server for display whenever SSO is not using a sertificate to authenticate a user. After the OracleAS SSO server authenticates a user, it then display the OCA screen enabling that user to request a certificate.
To link the OCA server to OracleAS SSO server, use the following command:
ocactl linksso
opmnctl stoproc type=oc4j instancename=oca
opmnctl startproc type=oc4j instancename=oca
You also can use ocactl unlinksso to unlink the OCA to SSO.

I have read the SSO admin guide, and performed the steps for enabling SSL on the SSO, and followed the steps to configure mod_osso with virtual host on port 4443 as mentioned in the admin guide.
The case now is that when I call my form (which is developed by forms developer suite 10g and deployed on the forms server which is SSO enabled) , it calls the SSO module on port 7777 using http (the default behaviour).
on a URL that looks like this :
http://myhostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=.......
and gives the error :
( Forbidden
You don't have permisission to access /sso/auth on this server at port 7777)
when I manually change the URL to :
https://myhostname:4443/pls/orasso/orasso.wwsso_app_admin.ls_login?Site2pstoreToken=.......
the SSO works correctly.
The question is :
How can I change this default behaviour and make it call SSO on port 4443 using https instead ?
Any ideas ?
Thanks in advance

How to configure ADF application to use OAM Identity Assertion ? web.xml

We have a web application developed using ADF (application development framework) and deployed on WebCenter 11.1.1.2 (weblogic 10.3.2)
OID Authentication and OAM identity assertion is configured in WebLogic 10.3.2 .
How to configure security in ADF application (web.xml or weblogic.xml) so that it uses OAM identity assertion (already configured as authentication providers in weblogic server)
Any pointers or documentation so that application (developed using ADF) check for identity tocken and verifies it with one of identity assertion providers.

John,
I have to concur. With OAM you don't need this. OAM intercepts the calls and inserts a cookie for WLS to get user information from.
I strongly advise to go through the above mention OFM Security Guide. Esp. Chapter 10 tells you in every detail how to implement OAM SSO with WLS (with or without OHS as a proxy).
Reading this chapter saves you time and turnarounds on this topic...
--olaf

How to configure the web interface of service desk

Hi All,
We are currently doing a configuration on solman service desk. I am on a stage where in i need to use the web interface of service desk via tcode notif_create_bsp. However, every time i call the transaction code (call the url) i cant view the web. Only an error the "Network Access Message: The website cannot be found".
I already activate needed services and already publish
SIAC_PUBLISH_ALL_INT but it still doesnt work.
I might have missed some configs/procedure on how to do it correctly.
My questions are.
1. How am i going to know the qualified domain name
of the Web AS for solman? How to configure it?
2. Can anyone give me some guide and any step by step documentation/procedure on this.
You help/suggestion will be very much appreciated
Thank you very much,
Ice

Hi,
+"Check the following 2 things. See if the port 8000 is open and in the url for the BSP in internet explorer, replace the host name with the IP address of your Solman server.+
+"+
That was a helpful tip. I change the host name with the ip address ofour solman server. However, upon login, it promts me to enter username and password. I've tried to login using my solman password but it shows an error like this.
Business Server Page (BSP) error
What happened?
Calling the BSP page was terminated due to an error.
SAP Note
The following error text was processed in the system:
Die URL enthält keine vollständige Domainangabe (10.123.161.125 statt 10.123.161.125.).
Exception Class CX_FQDN
Error Name
Program CX_FQDN=======================CP
Include CX_FQDN=======================CM002
ABAP Class CX_FQDN
Method CHECK
Line 10
Long text -
Error type: Exception
Your SAP Business Server Pages Team
Is there anything i need to configure so that i can maintan the username and password?
Thank you for your assistance,
Ice

How to configure proxy services in OSB for Rest based services?

how to configure proxy services in OSB for Rest based services implemented using Jersey (Rest).
The Client need to contact OSB proxy servies by posting application/xml using jersey client and OSB proxy service will call the OSB business service.
i would like to know how to get this request in OSB proxy service and send it to the business service and get the response back.

I would suggest you refer to the below links:
https://blogs.oracle.com/jeffdavies/entry/restful_services_with_oracle_s_1
https://blogs.oracle.com/jamesbayer/entry/using_rest_with_oracle_service
Hope this helps.
Thanks,
Patrick

How to configure N+1 HA

Similar Messages

Maybe you are looking for