Migrate Application Role from uat to prod in 11.1.1.6.10

Hi All,
We have to migrate the UAT Application Roles to Prod instance. I followed Rittman Mead policy store migration. servers in LINUX
http://www.rittmanmead.com/2011/04/oracle-bi-ee-11g-migrating-security-policy-store-part-2/
But at MigrateSecurityStore step, I am facing an issue with the wlst script which is throwing below error.
I am getting bellow error
wls:/offline> migrateSecurityStore(type="appPolicies",srcApp="obi",configFile="/ usr/app/MW/SecurityMigration/jps-config-policy.xml",src="sourceFileStore",dst="t                                                                                                         argetFileStore",overWrite="false")
Oct 17, 2013 11:41:27 AM oracle.security.jps.internal.config.xml.XmlConfigurationFactory initDefaultConfiguration
SEVERE: org.xml.sax.SAXParseException: The XML declaration must end with "?>".
Command FAILED, Reason: The XML declaration must end with "?>".
Traceback (innermost last):
File "<console>", line 1, in ?
File "/usr/app/MW/oracle_common/common/wlst/jpsWlstCmd.py", line 955, in migrateSecurityStore
File "/usr/app/MW/oracle_common/common/wlst/jpsWlstCmd.py", line 927, in migrateSecurityStoreImpl
        at oracle.security.jps.internal.tools.utility.source.JpsInitializerSource.getSources(JpsInitializerSource.java:155)
        at oracle.security.jps.internal.tools.utility.JpsUtility.<init>(JpsUtilty.java:62)
        at oracle.security.jps.internal.tools.utility.JpsUtilMigrationPolicyImpl.migrateAppPolicyData(JpsUtilMigrationPolicyImpl.java:151)
        at oracle.security.jps.tools.utility.JpsUtilMigrationTool.executeCommand(JpsUtilMigrationTool.java:231)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
oracle.security.jps.JpsException: oracle.security.jps.JpsException: The XML declaration must end with "?>".
This is config.xml file
<?xml version='1.0' encoding='utf-8'? standalone='yes'?>
<jpsConfig xmlns="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd">
   <property name="oracle.security.jps.jaas.mode" value="Off"/>
   <propertySets>
<propertySet name="sam1.trusted.issuers.1">
<property name="name" value="www.oracle.com" />
</propertySet>
</propertySets>
   <serviceProviders>
      <serviceProvider type="POLICY_STORE" name="policystore.xml.provider" class="oracle.security.jps.internal.policystore.xml.XmlPolicyStoreProvider">
         <description>XML-based PolicyStore Provider</description>
      </serviceProvider>
   </serviceProviders>
   <serviceInstance name="srcpolicystore.xml" provider="policystore.xml.provider" location="/usr/app/MW/SecurityMigration/uat/system-jazn-data.xml">
<description>File Based Policy Store Service Instance</description>
</serviceInstance>
<serviceInstance name="policystore.xml" provider="policystore.xml.provider" location="/usr/app/MW/SecurityMigration/prod/system-jazn-data.xml">
<description>File Based Policy Store Service Instance</description>
</serviceInstance>
   </serviceInstances>
    <jpsContexts default="default">

<jpsContext name="sourceFileStore">
<serviceInstanceRef ref="srcpolicystore.xml"/>
</jpsContext> <jpsContext name="targetFileStore">
<serviceInstanceRef ref="policystore.xml"/>
</jpsContext>
</jpsContexts>
</jpsConfig>
Please let me know if i need to provide further inputs.Appreciate your help.

make sure you are running the wlst.sh from this path /MWHOME/Oracle_BI1/common/bin/wlst.sh
you can take a look at this too Migrating Security Policies from Development to Standalone WLS 11g
http://ssssupport.blogspot.com/2013/02/obiee-11g-application-role-migration.html
Obiee11g: Migrating application role from DEV to Prod server in obiee11g

Similar Messages

How to migrate application server from Tomcat to WebSphere?

Hi,
I installed BO XI 3.1 32 bit in environment:
- AIX 5.3 64 bit
- Deployed Tomcat 5.5 from installing BO
- Oracle client 10G
I need to migrate application server from Tomcat to WebSphere 6.1 and WebSphere 6.1 Server 32 bit in Windows platform.
Could you someone give detail steps
Many thanks in advance and best regards,

I tried manually to deploy web applications, but not successful. This is my deployment step following:
AIX 5.3: BOE XI 3.1 :
Copy all <INSTALLDIR>/bobje/enterprise120/java/applications/ to Windows Websphere D:\BO_WAS
WebSphere 6.1 location & IP (windows) :
C:\Program Files\IBM\WebSphere\AppServer1\
IP: 192.168.69.10
Log in to WebSphere Applicaton Server Administrative http://192.168.69.10:9060/admin
1. Under the Applications heading of the console navigation menu, click
Enterprise Applications on the left navigational pane.
2. Click the Install button and navigate to the location of the WAR file to
deploy. If deploying from a remote file system, select the Remote File
System option.
3. Enter a context root for the WAR file (e.g. /CmcApp for CmcApp.war)
(this format (/CmcApp) for Unix OS, have different in Windows ? Could you give me fully path?)
and
press the Next button, followed by Continue.
4. In "Step 1", give a unique name for your web application and proceed to
"Step 2".
5. Highlight the server you created (or highlight server1 if you didn't create
your own) from the Clusters and Servers and enable the Select
checkbox. Proceed to "Step 3".
6. Select the virtual host you created (or default_host if you didn't create
your own) from the Virtual Host drop-down list. Proceed to "Step 4".
7. Review the summary page, and press Finish when done.
8. Click Save to Master Configuration.
9. Click the Save link, then the Save button.
Finally the output is not available.
Many thanks in advance and best regards

Best practice for moving portal solution using content db from UAT to PROD

Hi,
Would like to know can we backup the database from UAT env. and restore the same to PROD. if all of my functionality is working fine in UAT env.
I have event receivers[web level features], site collection level features,custom web parts, custom permissions, saved site templates, custom discussion forums etc.
Assuming that I have my custom solution deployed on the Prod. which will activate features for those web parts and my custom application page features.
Is there any issues I can anticipate in PROD.env, if i perform this activity.
or
Is this approach not recommended by Microsoft ? if yes , whats the best approach for deploying portal solution in PROD?
Should I create teh web application, site collections, everything in PROD.from scratch.
any links regarding this approach and the bext practices / helpful info is appreciated.

Thanks Trveor for the reply.
so, I can go ahead and create the web applns, site collections and deploy my web parts, item event receivers, appln pages and my timer jobs in UAT and take the backup of the same and restore it in PROD env.
But, i ahve a doubt here , as I have few site pages created it in my site template and when i take the backupof this web apppln's content db --- [ i think i can take the backup of web appln content db through power shell] ----
will the site pages also be part of this backup?
I had some experience in prev.version of SP, wherein i have few site pages and saved site template I have taken the backup of the web appln and restore it in another farm and associate the restored content db to the
newly created web appln in the targeted farm.
But when I navigated to thsoe restored site pages, it gave me "resource not found /file not found " error.
I had deployed the custom web parts as a custom wsp and added into those site pages.
and it failed to load those web parts UI.
I was not sute whether this happened because of backup or restore from source spfarm to the targeted sp farm .

Migrate BQY files from Test to Prod.

I have published some reports in workspace manually earlier. But, now i have so many reports which i need to migrate from Test to Prod.
Please suggest the steps, and how to handle the OCE files and Security.
Version is 11.1.2.1
windows 2008 server
Thanks in advance.

You can use LCM utility to migrate to different env's provided they are on same version.
http://docs.oracle.com/cd/E17236_01/epm.1112/epm_lifecycle_management.pdf
Thx

How to migrate document hierarchy from DEV to PROD?

Need some suggestions as to migration of the document hierarchy. The migration wizard is great for migration objects such as portlets, but it's cumbersome to migrate the entire document hierarchy from DEV to PROD as we will have to select all the leaves in the hierarchy to retain the tree. Does any one have the similar experience and have some suggestions? Thanks!

This is wrong forum for such question, you might want to post it here
General EBS Discussion

Migrating PDC role from SBS 2008 to Server 2012

Greetings everyone
Are there any special considerations or steps that need be done when elevating my BDC running Server 2012 from a PDC running SBS 2008? We are wanting to remove the SBS machine entirely as we no longer need it and could possibly be of use to one of our clients
down the road.
Thank You
Additional Info: We have already migrated Exchange to the cloud and is no longer hosted on our SBS server. The only function the SBS server has at the moment is being the PDC.

If you haven't seen it already you'll probably want to check out
http://blogs.technet.com/b/infratalks/archive/2012/09/07/transition-from-small-business-server-to-standard-windows-server.aspx which describes the entire process, though obviously in your case you don't need to worry about the Exchnage side of things.
The main thing in your case will moving the FSMO roles over to the new server so the old SBS box is no longer required. There's a link to the process in that blog post, though as I understand it when 2012 is the destination the recommended route is to grab
the roles from 2012 rather than give them up from 2008. There's a good step by step guide to the process here
http://www.waronerrors.com/kb/how-to-transfer-fsmo-roles-from-windows-server-2003--2008-to-windows-server-2012.aspx though obviously the main thing to note is that as soon as you move the FSMO roles you have 21 days in which to complete the migration. After
that time the SBS box will automatically restart periodically (I think after an hour from memory).

How to migrate xml report from test to prod?

Hi,
We are using BIP 10.1.3.2 standalone. I've one simple question for migrating report from test enviornment to production.
Is there any standard method for migration?
Like in Discoverer we can simply export report and import it in prod environment.
Thanks...

Thanks for your reply. That's one describes for EBS version of BIP. I'm looking for standalone version of BIP enterprise.

Tranport role from Dev to Prod without overwriting role menu

Hi Experts,
We have users who have saved BW workbooks in the roles. They appear as transactions in the role menu. Now when we are transporting the roles the role menu is getting overwritten and all the workbooks are no more in the Role menu and so not visible to the users.
How can we transport the BW roles without overwriting the Role menu ? Please help
Thanks a million
Sunil Kumar

How can we transport the BW roles without overwriting the Role menu ? Please help
I doubt whether this is possible or not.... Well for instant damage control you look in change history to find out what was there in menu before?? And put them back as it was before.
For a permanent solution it is already suggested in earlier posts... that is to have a menu role concept used only for query, work book saving pupose and these are not getting transported in any case.
Arpan

OBIEE Application Role Migration between environments in WLS

Hi,
Is there a way to migrate Application Roles etc., from one environment like Dev to Prod from WLS. Currently we are manually doing it between environments.
Thanks for your time and help.

Hi,
Can u please try this once..
Just copy the xml file system-jazn-data file from the following path from ur dev environment to prod environment..
D:\MWHOME\user_projects\domains\bifoundation_domain\config\fmwconfig
And restart the services..
Please mark if it correct/helpful....

Migrate OAF MDS customizations from TEST to PROD from UNIX

1. Copy the the files of JDEV_USER_HOME/jdevbin to TEST or PROD UNIX mid-tier
jdevbin/jdev/appslibrt/oamdsdt.jar
jdevbin/jdev/lib/mdsdt.jar
jdevbin/mds/lib/mdsrt.jar
jdevbin/BC4J/lib/collections.jar
jdevbin/lib/xmlparserv2.jar
jdevbin/jdev/appslibrt/share.jar
jdevbin/jdev/appslibrt/uix2.jar
jdevbin/jdbc/lib/classes12dms.jar
jdevbin/lib/dms.jar
jdevbin/jdev/appslibrt/oamdsdt.jar
2. environment variable for XMLExporter/XMLImporter:
($PRO_LIB is the path pointing to the jar files)
CLASSPATH=\
$PRO_LIB/jdevbin/jdev/appslibrt/oamdsdt.jar:\
$PRO_LIB/jdevbin/jdev/lib/mdsdt.jar:\
$PRO_LIB/jdevbin/mds/lib/mdsrt.jar:\
$PRO_LIB/jdevbin/BC4J/lib/collections.jar:\
$PRO_LIB/jdevbin/lib/xmlparserv2.jar:\
$PRO_LIB/jdevbin/jdev/appslibrt/share.jar:\
$PRO_LIB/jdevbin/jdev/appslibrt/uix2.jar:\
$PRO_LIB/jdevbin/jdbc/lib/classes12dms.jar:\
$PRO_LIB/jdevbin/lib/dms.jar:\
$PRO_LIB/jdevbin/jdev/appslibrt/oamdsdt.jar
3. for -mmddir needed in XMLExporter/XMLImporter:
copy the following files of JDEV_USER_HOME\myhtml\OA_HTML\jrad to TEST or PROD UNIX mid-tier
JRADElementList.xml
OAElementList.xml
UIXElementList.xml
4. Write a Unix shell script to export from TEST and import to PROD. (You may register it in Oracle apps to let the developers to promote it themselves using the assigned responsibility)
Notice:
1. Oracle puts OAF customization together with Oracle seeded customizations. It's impossible to tell them apart just from the OAF MDS document names.
2. Using responsibility_id in the document name to get the application_id from the apps table, you'll get an different application_id than the application_id in the document name.
3. The function_id in the document name is not consistent with the function_id in the apps table. The function_id in apps table has null value.

You may also use a PC to migrate OAF MDS from TEST to PROD. Instead of running an Unix script on the TEST or PROD mid-tier, you may write a batch file and run it on your PC.

Applications Roles in FMW (Enterprise Manager) OBIEE11g

Hi,
Please specify, how to migrate new created Application roles in production from Test @Enterprise Manager (FMW).
Regards
Rahul

Good question. In the documentation it's with the hand.
See: http://download.oracle.com/docs/cd/E14571_01/bi.1111/e10540/lifecycle.htm
Application Role (Policy Store) Migration
There are several options for migrating application roles between development, test, and production systems.
For simplicity, this document assumes you will re-key a small number of application role names by hand.
Links to additional content on migrating application roles for larger-scale batch cases are provided later in this appendix.And of course, no appendix ...
Cheers
Nico

Assign application roles after authentication

Hi,
It's been some time now I'm struggling with this issue...
I have a client application (not a web one) trying to access an EJB resource.
The EJB is first looked up through jndi and then asked to invoke a method, say test().
In ejb-jar.xml I have the following:
<security-role >
<role-name>AN_APP_ROLE</role-name>
</security-role>
<method-permission >
<role-name>AN_APP_ROLE</role-name>
<method >
<ejb-name>EJB NAME</ejb-name>
<method-intf>Remote</method-intf>
<method-name>test</method-name>
<method-params>
</method-params>
</method>
</method-permission>
I manage to have OID perform the authentication, so that I can perform the EJB lookup and call non protected methods. Issues arise when trying to get the roles working.
I know that i can <security-role-mapping> AN_APP_ROLE to an oid group; what I am trying to accomplish is to have oid do the authentication and be able to fetch the application roles from a database.
As a starting point what I've done is a client LoginModule that first authenticates against the OID (by looking up an EJB resource) and then, in the commit(), do the following:
this.subject.getPrincipals ().add (new RoleExtended("AN_APP_ROLE"));
Nevertheless access is denied when the client tries to access the protected test() method.
It seems that somehow even if the Subject has the role within its principals, the container doesn't threat it such.
I am pretty stuck, and starting to wonder if this is the right approach...Nevertheless I don't think putting the application roles in oid is a good idea, since application roles should remain an application property not a enterprise directory one.
Any hint?!
cheers,
Francesco
p.s: in jazn.xml I have
<property name="role.mapping.dynamic" value="true"/>

Hi,
It's been some time now I'm struggling with this issue...
I have a client application (not a web one) trying to access an EJB resource.
The EJB is first looked up through jndi and then asked to invoke a method, say test().
In ejb-jar.xml I have the following:
<security-role >
<role-name>AN_APP_ROLE</role-name>
</security-role>
<method-permission >
<role-name>AN_APP_ROLE</role-name>
<method >
<ejb-name>EJB NAME</ejb-name>
<method-intf>Remote</method-intf>
<method-name>test</method-name>
<method-params>
</method-params>
</method>
</method-permission>
I manage to have OID perform the authentication, so that I can perform the EJB lookup and call non protected methods. Issues arise when trying to get the roles working.
I know that i can <security-role-mapping> AN_APP_ROLE to an oid group; what I am trying to accomplish is to have oid do the authentication and be able to fetch the application roles from a database.
As a starting point what I've done is a client LoginModule that first authenticates against the OID (by looking up an EJB resource) and then, in the commit(), do the following:
this.subject.getPrincipals ().add (new RoleExtended("AN_APP_ROLE"));
Nevertheless access is denied when the client tries to access the protected test() method.
It seems that somehow even if the Subject has the role within its principals, the container doesn't threat it such.
I am pretty stuck, and starting to wonder if this is the right approach...Nevertheless I don't think putting the application roles in oid is a good idea, since application roles should remain an application property not a enterprise directory one.
Any hint?!
cheers,
Francesco
p.s: in jazn.xml I have
<property name="role.mapping.dynamic" value="true"/>

How to map Application Roles to Enterprise Roles

Hello,
i am having a problem with mapping Application Roles (from ADF Security) to the corresponding Enterprise Roles. I have already seen that it is possible with a tool called Enterprise Manager, but what if i do not have it??
Can i map the roles in WebLogic Server itself? I have searched for such ability and did not found it. Also have not seen any tutorial on the internet. Someone help me pls.
The version i am using is 12.1.2.0.0.

Application roles and permissions defined within WebCenter Portal are stored in its policy store and, consequently, apply to the WebCenter Portal application only.
Application Roles : Application roles control the level of access a user has to information and services in WebCenter Spaces. Specifically, application roles determine what a user can see and do in their personal space.
Application Permissions : Again every application role has specific, defined capabilities known as permissions. These permissions allow individuals to perform specific actions in their personal Portal.
Enterprise roles are different. Enterprise roles are stored within the application's identity store and do not imply any permissions within WebCenter Portal.
2. How and where do we create these 5 Application Roles in WC 11.1.1.8 version ?
You can create an application role from WebCenter Portal -> Portal Builder -> Administration tab -> Security -> Roles -> Create Role
See : Managing Security Across Portals for more info :
http://docs.oracle.com/cd/E29542_01/webcenter.1111/e27738/wcadm_ps_security.htm#WCADM398
3. Last, where and how do we MAP these Application Roles TO Enterprise Roles in 11.1.1.8 version ?
First, You can grant privileges to a specified group (say sales group) of users by granting Enterprise Roles in Enterprise LDAP.
Next, Create custom application roles (say Contributor, Moderator, UIDesigner, Application Specialist, etc) and assign the appropriate permissions as explained above.
Then, You can assign one or more Application Roles to a specified group (say sales group) from WebCenter Portal -> Portal Builder -> Administration tab -> Security -> users & Groups
I hope it helps.

Importing master role from ECC into portal throws derived role exception

Hello,
While uploading master and derived role from backend system into the portal I am getting the following exception.
com.sap.portal.pcd.rolemigration.RoleMigrationException: Nested Exception. Failure to execute native function. Nested Exception. ROLE_IS_DERIVED
Does it imply that the derived role is already imported with the import of master role and there is no need to explicitly import the derived role?
The landscape uses role upload tool of portal for UME.
Regards
Pooja

Hi Pooja,
There is a limitation with the role upload tool that the derived roles cannot be uploaded.
The migration is only able to upload roles which have their own menus. Derived R/3 roles does not have menus themselves as they derive them from other roles. The purpose of the migration is to bring the R/3 navigation structures into the portal. Therefore you can only migrate the role from which your role is derived.
Regards
Anja

Managing Application Roles in WebLogic

Greetings!
A need to manage Application Roles+ From my Application. The same way as it's done in Enterprise Manager console.
I found a file +"system-jazn-data.xml"+ under a config* directory. It seems, that's it.
I'm intrested is there a suitable API to work with Application Roles in WebLogic, or i have to manipulate with this file?
P.S. Sorry, there is another copy of this thread in WebLogic Server -> Services directory.
Admins, could you please delete another one.

Weblogic Does not provide any API to work with application roles.
Edited by: Faisal Khan on Feb 17, 2010 2:36 PM

Migrate Application Role from uat to prod in 11.1.1.6.10

Similar Messages

Maybe you are looking for