LDAP and Certificates

We are authenticating to an LDAP (active directory) server for our OBIEE logins and are also using a certificate for SSL.
We are having issues from time to time that when someone logins in the presentation server using an account on the LDAP server, it crashes the presentation server. Even after restarting everything the problem still exists. The only thing that seems to correct the problem is to put the original copy of the ldap certificate back in the config directory.
Has anyone had a similar issue? Also, should there be some parameters in the NQSConfig.INI that were set for SSL? Are there other configuration items that we should look at?
we are running obiee 10.1.3.4.0 on a RH Linux server.

Have you enabled core dumps and inspected the core dump file? To enable it set this in your bash profile:
ulimit -S -c unlimited
then restart your session and restart all your OBIEE processes. the core dump should be created under [..]/OracleBI/server/Log/.

Similar Messages

SSL and Java and Certificate Renew

I was making a conection to AD through LDAP and SSL (LDAPS://server:636) and everything was working well.
So, the server certificate will expire 11/1/2006. We used the Certificates Add-in on MMC of the server to obtain a new certificate and imported him in cacerts (the truststore). We've deleted the old certificate from cacerts
Now, the connection cannot be done.
Why? How do I renew a certificate? If the certificate expires the conection cannot be done?
Thanks
Patrick

Hi,
Refer the below link ...
http://help.sap.com/saphelp_nw04/helpdata/en/f1/2de3be0382df45a398d3f9fb86a36a/content.htm
Thanks
Anil

Server 2012 R2 - Essentials Experience - - I jacked my CA and certificates all to @#&$%!!

Windows Server 2012 R2 - Essentials Experience
In trying to put pieces together, I jacked my CA and certificates all to @#&$%!!
Some of the factors involved are:
Server0 - Hyper-V Host
  Server1 - DC, 2012 R2 Essentials Experience role
  Server2 - Exchange 2013
Client Machines -
  Windows 7 Pro
  XP (Yes, these are my cross to bear... - worth noting their presence, but I'm working them out)
The functional requirements:
  Anywhere Access for Remote users
   - Remote Desktop for Windows 7 machines
  Outlook Web Access
The mistake... 'Web Application Proxy'
-which uninstalled the CA
There is a CA back now, but after days of spinning in cirles in a rare area where I feel nearly completely lost (Certificate services) I am asking for help getting these pieces put back together.
The current situation:
The network is up with all of the network and business services required to work 'Inside the Office' - so the client is "functional".
The "Essentials Experience" is broken and won't install to the clients, though it does provide the Essentials website, access to server shared files (fairly gracefully, I might add) and, as an administrator user, I can get to the servers via
RWA through the site and there are no certificate problems with that since I have a secured certificate for the domain.
OWA has been moved to a further back burner while I try to get the Essentials Experience functioning t the point where the remote users can get to their workstations through RWA... This is the biggest current hurdle... RWA for the clients.
Trying to install the client to the workstations nets me the "The Server is not available. Try connecting this computer again,..." message at the point of username and password authentication.
The clientdeploy.log finishes like this:
[4976] 141016.153746.2670: ClientSetup: Standard Error:
[4784] 141016.153746.2670: ClientSetup: The exit code of the process (C:\Windows\system32\nslookup.exe) is: 0
[4784] 141016.153746.2670: ClientSetup: Set CD Fail reason 10 for SQM in ClientDeployment.exe
[4784] 141016.153746.2670: ClientSetup: RecordClientDeploymentFailReason: Save registry failed in ClientDeployment.exe : System.UnauthorizedAccessException: Cannot write to the registry key.
  at Microsoft.Win32.RegistryKey.EnsureWriteable()
  at Microsoft.Win32.RegistryKey.CreateSubKeyInternal(String subkey, RegistryKeyPermissionCheck permissionCheck, Object registrySecurityObj, RegistryOptions registryOptions)
  at Microsoft.Win32.RegistryKey.CreateSubKey(String subkey, RegistryKeyPermissionCheck permissionCheck)
  at Microsoft.WindowsServerSolutions.ClientSetup.ClientDeploy.Helper.RecordClientDeploymentFailReason(UInt32 failReason)
[4784] 141016.153746.2670: ClientSetup: Exiting ValidateUserTask.Run
[4784] 141016.153746.2670: ClientSetup: Task with Id=ClientDeploy.ValidateUser has TaskStatus=Failed
[4784] 141016.153746.2670: ClientSetup: Task with Id=ClientDeploy.ValidateUser has RebootStatus=NoReboot
[4784] 141016.153746.2670: ClientSetup: Exting ConnectorWizardForm.RunTasks
[1272] 141016.153755.0976: ClientSetup: Back from the Client Deployment Wizard
[1272] 141016.153755.0976: ServerDiscovery:HostsFileUpdater: Removing hosts file entry: 1-WGB-01
[1272] 141016.153755.0976: ClientSetup: Saving Wizard Data
[1272] 141016.153755.0976: ClientSetup: End of ClientDeploy: ErrorCode=1603
The computerconnector.log shows nothing of value.
What I want to accomplish as a 'first step' toward recovery is to get the workstations properly connected so they show up in the Dashboard 'Devices' pane and can be managed and access by the Essentials tools.
Secondarily, I would like to get the client side tools in place and functioning (I expect the latter will be a side effect of the former).
So,... for anyone patient enough to have read this far... uh,... help?

Actually,... I can now confirm the delicacy of which you speak...
After a support incident with Microsoft which spanned a marathon 18+ hours on the phone and remote access by no fewer than 7 Microsoft Engineers, we got to a successful result.
It is a point of utter frustration for me when people put in threads like this then don't bother to come back and report 'how the issue was solved', and sadly, I am about to have done that merely because my span of functional attention and valuable reporting
capability was basically gone before I submitted the ticket and following all that was done in my state was not conceivably possible.
So - all I can do is apologize for not being able to report a valuable resolution and give a few little tidbits.
The net result is this - DO WHAT YOU CAN TO AVOID THE SITUATION IN THE FIRST PLACE. Once your CA is in place, LEAVE IT THE $%@& ALONE!!!! I mean... my best current advice.
In all, the CA was uninstalled and reinstalled 4 times after my blunder and significant work was done in ADSIEdit as well as substantial manual manipulation of certificates and CAs that was well outside of my (quite considerable) scope of expertise.
I wish I had more to offer in the world of resolution.
With this said, I will make one more request of viewers and moderators alike:
THIS QUESTION IS OFFICIALLY NOT ANSWERED. IT WILL NEVER BE ANSWERED. THE RESOLUTION IS NOT AVAILABLE TO THE MORTAL MAN.
DO NOT MARK IT AS ANSWERED
IF YOU MUST DO SOMETHING, DELETE THE WHOLE THREAD, BUT DO NOT BURDON PEOPLE WHO ARE LOOKING FOR REAL ANSWERS WITH THE NECESSITY OF READING THROUGH THIS.
DO NOT MARK THIS QUESTION AS ANSWERED
I hope this makes sense for people, and I hope people will appreciate NOT having to read this as though there is some 'resolution' contained within.

OD, LDAP and DNS

I am new to LDAP and I believe I have everything setup correctly on the server (everything under Open Directory in SA says "Running", logs don't show any errors). However, I can not access the LDAP server from a client machine using Directory Access. I suspect that client machines still can not "see" my LDAP server.
I believe the issue may be with DNS and I am trying to understand the interaction between DNS and OD, etc. First off, I do not have DNS turned on for my Mac OS X Server since my ISP has always hosted our DNS. Is this a problem? Do I need DNS activated on the same server that I am running this LDAP server? I have tried entering the IP and DNS name on the client server using Directory Access and neither worked.

The requirement is that references using your server's Fully Qualified Domain Name look up to its IP Address and its IP Address looks up to its Fully Qualified Domain Name. If your ISP does that for you, and does it correctly, Merry Christmas!
All others must set up their own tiny DNS service to do the lookups. If you are behind an NAT firewall, you can Make Up whatever names you like and look them up locally, because they are invisible from the Internet.
Remember that each workstation must have the address of the DNS available to it. It needs to be configured in the TCP/IP setup or dispensed via DHCP. If you use your own DNS (highly recommended) you must also dispense or configure the next upstream DNS (your ISP's DNS Address).
"An Open Directory master requires properly configured DNS so it can provide single sign-on Kerberos authentication.
Make sure DNS service is configured to resolve fully qualified DNS names and provide corresponding reverse lookups.
DNS must resolve the fully qualified DNS name and provide reverse lookups for the Open Directory master server, all replica servers, and other servers that are members of the Kerberos realm.
You can use the Lookup pane of Network Utility (in /Applications/Utilities/) to do a DNS lookup of a server's DNS name and a reverse lookup of the server's IP address.
For instructions on setting up DNS service, browse Network Services Overview."
-- from Server Admin 10.4 Help: Kerberos is Stopped on an Open Directory Master or Replica
Message was edited by: Grant Bennet-Alder

PKCS#11 Provider unable to fetch asymmetric keys and certificates

Hi,
I'm facing a problem while getting keys and certificate from Eracom HSM (ProtectServer Orange:38039 Model: PSO:PL50) using Sun PKCS#11 Provider. It gets only the symmetric keys but NEVER gets the asymmetric keys.
My code snippet and configuration file are:
     Java Code:
     java.io.InputStream is = new java.io.FileInputStream("pkcs11.cfg");
sun.security.pkcs11.SunPKCS11 pkcs11_provider = new sun.security.pkcs11.SunPKCS11(is);
System.out.println("Provider Name : " + pkcs11_provider.getName());
java.security.Security.addProvider(pkcs11_provider);
KeyStore ks = KeyStore.getInstance("PKCS11", pkcs11_provider);
ks.load(null, "password".toCharArray());
java.util.Enumeration obj_enumeration = ks.aliases();
while (obj_enumeration.hasMoreElements()) {
String str_certAlias = (String) obj_enumeration.nextElement();
System.out.println("Alias : " + str_certAlias);
     pkcs11.cfg:
     name = Eracom
     library = G:\Eracom\cryptoki.dll
     slot = 0
     attributes(*, CKO_PRIVATE_KEY, *) = {
     CKA_TOKEN = false
     CKA_SENSITIVE = false
     CKA_EXTRACTABLE = true
     CKA_DECRYPT = true
     CKA_SIGN = true
     CKA_SIGN_RECOVER = true
     CKA_UNWRAP = true
     attributes(*, CKO_PUBLIC_KEY, *) = {
     CKA_ENCRYPT = true
     CKA_VERIFY = true
     CKA_VERIFY_RECOVER = true
     CKA_WRAP = true
I also ran my program without specifying any attributes in configuration file, also tried many other combination, but in all cases (with or without attributes) only symmetric keys are loaded from HSM. I am able to get all keys (symmteric and asymmteric) and certificates from the same HSM using IAIK PKCS#11 Provider. Though, the Sun PKCS#11 Provider is working fine with SmartCard tokens (Rainbow, Alladin etc.)
Any help to resolve my problem would be highly appreciated.
Thanks in advance.

I recently had a problem with ECDSA and the PKCS#11 library of nCipher. Here's info from one of their engineers about the PKCS11 library:
"There are two separate issues - one is that our current pkcs11
release doesn't support ECDSA signature with SHA-2 hashes
(the v11.00 firmware adds support for it, but the main release version of
the pkcs11 library hasn't been updated to take advantage of it yet).
There is a hotfix version that does support SHA-2 hashes with some
restrictions, talk to [email protected] for details, and V11.10
should be out soon and have that merged in.
But the issue with setting CKA_SIGN is that our underlying HSM API
allows elliptic curve keys to be either key exchange (ECDH) or
signature (ECDSA) keys, but not both at one.
At the PKCS #11 level, if you specify CKA_DERIVE=true and let
CKA_SIGN default, it will default to false, and vice versa.
If you specify both CKA_DERIVE=true and CKA_SIGN=true, then we
return CKR_TEMPLATE_INCONSISTENT because we can't do both with
the same key. (However, the tests using C_GetMechanismInfo will
show that we can do both mechanisms, because we can - so long
as you use different keys, even though they have the same PKCS#11
type.)
I can't comment on when or how that will be changed."
I was using the PKCS#11 library through NSS when I ran into the problem, but I imagine Java would run into similar problems also using the PKCS#11 library. I was able to generate keypairs but not create a CSR (which required making a signature, which required SHA-2).
Can you just use the java classes to speak to the netHSM? I've never directly written code to do so myself, but I have used Corestreet's OCSP product that uses the java classes to speak to the nCipher HSMs (though not using EC). It might work better than going through the PKCS#11 layer. There should be a java directory under NFAST_HOME that contains some jars.
Please post back if you figure anything out as I'll probably be playing with this stuff myself soon.
Dave

10.6.6 Server Combo Update Crashes LDAP and Kerberos Services

Just updated apple server from 10.6.4 to 10.6.6 with combo server overnight.
Everything was working fine under 10.6.4
All users can no longer authenticate to server via mail or ldap logins
LDAP and Kerberos Services stopped.
Will downgrade from an open directory master to standalone then back to master again and post status...

I think there is something with LDAP on 10.6.6
I was forced to make clean install in combo from 10.6.0 to 10.6.6 and today LDAP crashed.
It seems to be an issue on ldap ACL.
Message was edited by: Xalio

MAC OS and LDAP and Samba Server

How can I make my Mac OS authenticate against LDAP and automatically map shared by a Samba server folders? (samba domain)? The idea is that any person who is registered in the database of LDAP can log into any Mac machine and automatically access the folders stored on the Samba server.

Are you using TopLink 11g or TopLink Essentials?
You seem to be wanting to use TopLink 11g, but you have the provider set to Essentials in your persistence.xml.
<provider>oracle.toplink.essentials.PersistenceProvider</provider>
Change this to,
<provider>oracle.toplink.PersistenceProvider</provider>
The sessions-xml properties are only supported with TopLink 11g.
Note that currently in 11g when using a sessions-xml it must contain a project xml that completely defines the mappings. It will not merge with annotations nor defaults.

LDAP and OID

FYI: I am new to Oracle (<1 month), and new to APEX (<3 weeks) so forgive me if I am asking the obvious.
I would like to have APEX authenticate against LDAP (active directory), and went about trying to set that up. Got all AD settings from our sys admin, and then tried them in the LDAP test tool. I kept getting " Authentication failed!" no matter what I did. Due to the detailed nature of that error message, I started trying to track down every possible avenue so I talked to one of our DBA's about DBMS_LDAP.SIMPLE_BIND_S. The answer I got back was that we don't have access to it because it is part of OIN which we would have to pay outrageous amounts of money for if we wanted to use it. Not likely to happen, so I was hoping that there was another way to authenticate APEX via LDAP.
Any suggestions would be most helpful.

John - DBMS_LDAP is not part of OID so you can use it as part of your existing database product installation. Search this forum for LDAP and AD and you'll find lots of discussions about what you are trying to do.
Also, just to clarify, you're not trying to authenticate Application Express using AD, you'll be authenticating users to your application (essentially a PL/SQL application in the database) using account information stored in AD. The authentication code that gets executed will belong to your application.
Scott

LDAP and SAP integration

Hi,
As a part of a project requirement, we are trying to integrate Solution manager with LDAP (Lightweight Directory Access Protocol).
Using the directory service, we are trying to synchronize the CUA (Central user administration within Solution manager) with Active directory of LDAP so that we can maintain the User data centrally from a single point in LDAP.
Problem description:
Currently, Client has implemented the LDAP and CUA integration and when a new user is added in LDAP, it is automatically getting copied in all SAP systems and at real time, when the useru2019s u201CLASTNAMEu201D field is updated in LDAP, it is automatically getting synchronized in all SAP systems.
But, If any attribute other than u201CLASTNAMEu201D is changed (i.e. The expiry /validity date of the User in LDAP, GLTGB in SAP), then the field value is not getting synchronized in the SAP Central User Adm.
Our Findings:
We have checked the configurations and imported mappings in SAP Solution Manager and everything looks fine. We have debugged the standard program RSLDAPSYNC_USER extensively and found out that an RFC call to function module LDAPRFC_SEARCH is not returning the expected values.
Thanks
Deb

Hi Deb,
It would be really nice if you can elaborate on the configurations that need to be done as part of this integration. I hope, you have been successfull by now.
Actually, I too need to perform the same as part of a project.
Thanks in advance.

Print out of Inspection report and Certificates

Hi Gurus,
I want to take inspection reports and certificates printout.
Is there any standard transaction other than QGA3 and QC21
Please let me know
Thanks and Regards
Hari

Hello Hari,
You can take the certificates printout with QC21 or QC22 (as applicable). What information you are looking in inspection reports ? Then we can suggest the appropriate set of the reports
Cheers
Kaushik

Hello, Identity manager fail to add entries in the LDAP and database table

Hello,
Well I installed identity manager 7 in a windows 2003 advanced server.
I I appended an NT server resource, a Mysql table, a solaris server resource and an ldap server resource.
I created the roles for these resources and then I assigned them to an account that I created for testing purposes.
After the aprooval, in the solaris machine, the user has been added in the user database but no home directory has been created as I didn't set the apropriate flag to true.
I the windows resource everything worked very smooth and with no problem.
In the ldap and mysql table resources I recieved a failure having error message null. and from a sniffing that I did for investigation I never saw a sigle packed arrive to the mysql server or to the directory server from the idm server.
Any ideas or suggestions on what to do ?

Well the problem with the directory server just solved.
But the problem with mysql remains.
The first thing that I do when I add a resource is to test the connection.
The problem with the LDAP is that the dn was not present in the directory server. They gave me an ou that didn't exist.

Domino ldap and weblogic server 6.1

Hi,
I am trying to use domino ldap for authentication in weblogic server 6.1
I configured a custom ldap realm.
But the users were not listed from domino ldap and authentication also failed.
Can anybody help me?
Thanx in advance.
- prabha.

at the moment it is possible for me to work, though. i worked around the
problem and i set web.xml as a read only file. i still can't use wizards to
create servlets and i can't edit web.xml with jbuilder.

Webservice call failed during execution (SSL and certificates) on NetWeaver 7.30

Hey experts,
i need your help!
We make webservice calls to sap me with our own software.
We connect to our software via SSL and certificates e.g. https://host:50001/XMII/CM/POD/MEDialogsWeb.irpt
At the beginning the software runs without any problems and than we become the following message on all our webservice:
thats the webservice configurations
(configuration - connectivity - single service administration):
(configuration - security - authentication and single sign-on)
if we restart the software after the error display, the webservice call runs successfully again.
is it a timeout?
can anybody help us?
Thanks,
Markus
our system info:
NetWeaver 7.30 Java
SAP ME 6.0
software runs log looks as following
software doesn't runs log looks as following
security Log Entry
more info from security_00.0.log
#2.0 #2014 06 06 14:51:17:136#+0200#Warning#/System/Security/WS#
com.sap.ASJ.wssec.020142#BC-ESI-WS-JAV-RT#tc~sec~wssec~service#C0000A650AD826FF0000000100000BEC#3855850000000005#sap.com/me~ws#com.sap.engine.services.wssec.authentication#Guest#0##207092CAED7111E3A01A0000003AD5EA#23386e31ed7911e39d560000003ad5ea#23386e31ed7911e39d560000003ad5ea#0#Thread[HTTP Worker [@648881277],5,Dedicated_Application_Thread]#Plain##
Received unsupported callback: com.sap.engine.interfaces.security.auth.SetLogonTicketCallback
Received unsupported callback: com.sap.engine.lib.security.http.HttpSetterCallback
Read data of type username and value MEFLEX from wsse:Security header and set on module javax.security.auth.callback.NameCallback
Read data of type username and value from HTTP header and set on module javax.security.auth.callback.NameCallback
Read data of type password and value xxx from wsse:Security header and set on module javax.security.auth.callback.PasswordCallback
Read data of type password and value xxx from HTTP header and set on module javax.security.auth.callback.PasswordCallback
Authentication for web service ShopOrderService, configuration ShopOrderService using security policy BASIC*SSO2*_*_*ws failed: Cannot authenticate the user.. (See SAP Note 880896 for further info).

Hi,
the authentication for the second call is failing. Have you tried suggest log level from note 880896 - Web Service authentication failure? I would also try to use something like SoapUI to test if the issue is caused by your application or something wrong on SAP side. Also coparing messages for the first and second calls might give you answer.
Cheers

Question concerning WebService and certificates

Hi, well i'd like to get data from a WebService. Scenario is RFC to WebService in SAP XI.
Therefore i also have to use user&pw and a certificate key i got previously!
So i created the receiver channel and now i am stuck. There is the option User Authentification and Configure Certificate Authentication. What do i have to use and how to configure. I know i have to use the keystore-service in VisualAdmin, but how?!
I already read this: /people/rahul.nawale2/blog/2006/05/31/how-to-use-client-authentication-with-soap-adapter but it does not fir my needs actually.
Again, i have user&pw AND certificate-key (only key in plain characters!). how to use these 3?!
thx in advance, br

Hi Jens,
Go through following pdf. It will clear some of you doubts.
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/964f67ec-0701-0010-bd88-f995abf4e1fc
-Pinkle

Authentication against both LDAP and BI repository

I have a lot of user who are authenticated against LDAP. I need add few users who aren't exist in LDAP. I can create user in BI repository and if this user is in an Administrator group he is able to log in. But if this user isn't in an Administrator group he get error "Succesfull execution of intitializtion block LDAP is required". Is there any way how to authenticate users agains both LDAP and BI repository?

Hi,
why dont you create a group in ldap and add the correspondng users to that group.
You can configure the LDAP server with that group and try...
Hope it works...
Regards
Venkat

LDAP and Certificates

Similar Messages

Maybe you are looking for