OAM 11g BP02 with Kerberos is not working on AIX

Hi,
We are trying to configure OAM 11g with Kerberos on AIX with no success..
Resource is protected according to OAM documentation guide but the oam logs shows the following:
[2012-08-28T00:03:22.305-05:00] [oam_server1] [TRACE] [] [oracle.oam.engine.authn] [tid: [ACTIVE].ExecuteThread:
'2' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 0000J_fbCuS9h^k5kzWByZ1GF532
00000G,0] [APP: oam_server] [SRC_METHOD: log] [SRC_CLASS: oracle.security.am.engines.common.adapters.OAMLoggerImp
l] Authentication Failed.[[
javax.security.auth.login.LoginException: Bad JAAS configuration: bad URL /home/oracle/oam.keytab
Error java.net.MalformedURLException: no protocol: /home/oracle/oam.keytab
at com.ibm.security.jgss.i18n.I18NException.throwLoginException(I18NException.java:5)
at com.ibm.security.auth.module.Krb5LoginModule.j(Krb5LoginModule.java:537)
at com.ibm.security.auth.module.Krb5LoginModule.b(Krb5LoginModule.java:146)
at com.ibm.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:274)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:60)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:37)
at java.lang.reflect.Method.invoke(Method.java:611)
we are using OAM 11g BP 02.
oam-config.xml is configured as follow:
<Setting Name="KerberosModules" Type="htf:map">
<Setting Name="6DBSE52C" Type="htf:map">
<Setting Name="keytabfile" Type="xsd:string">/home/oracle/oam.keytab</Setting>
<Setting Name="krbconfigfile" Type="xsd:string">/etc/krb5/krb5.conf</Setting>
<Setting Name="name" Type="xsd:string">Kerberos</Setting>
<Setting Name="principal" Type="xsd:string">HTTP/myssoserver@mydomain</Setting>
</Setting>
</Setting>
Please let me know how to get this resolved. Thanks in advance.
Regards.

David,
Your Principal name should be the SSO LB URL.(ie :sso.mycomany.com)
ktpass -princ HTTP/sso.mycomany.com@DOMAIN -pass XXXXXXX mapuser DOMAIN\user -out oam.keytab.
Also make sure sso.mycomany.com has a reverse DNS configured correctly.
you can check using dig command
ping sso.mycomany.com
What ever the ip-address
dig -x <IP-ADDRESS>
Check in the reverse DNS section there should be 1 record.
;; ANSWER SECTION:
1.1.1.1.in-addr.arpa. 3600 IN PTR sso.mycomany.com.
Let me know if you have more questions.
Thanks
Saurabh

Similar Messages

  • OAM 11g integration with Kerberos on cluster with load-balanced virtualhost

    Hello!
    I need to make a Kerberos integration with OAM.
    I find following notes about OAM 11g: WNA Configuration for HA Clusters [ID 1365888.1] (https://support.oracle.com/epmos/faces/ui/km/SearchDocDisplay.jspx?_afrLoop=223640518878014&type=DOCUMENT&id=1365888.1&displayIndex=1&_afrWindowMode=0&_adf.ctrl-state=14ehvbh4z2_61).
    "In an OAM Clustered environment, the OAM Principal for WNA must be the same on all tiers i.e. the load-balanced virtualhost for the OAM cluster.
    Therefore each OAM managed server will reference the same keytab file, generated for Principal HTTP/<virtualhost.domain>, and the keytab file will be in the same location on all OAM managed servers.
    For example: ${DOMAIN_HOME}/domains/${DOMAIN_NAME}/config/fmwconfig/oam/<keytab filename>.
    After copying the keytab file to the same directory on all OAM managed server machines, complete the configuration of the Kerberos authentication module in OAM Administration Console (/oamconsole).
    The AdminServer will ensure that the oam-config.xml file on all OAM managed server tiers in the cluster is updated with this configuration."
    The question is; When I generate oam.keytab with following command, What is the name of the server that I will must put in the command? Virtualhost (load-balanced), Node1 or Node2?
    ktpass -princ HTTP/<servername>@DOMAIN -pass XXXXXXX mapuser DOMAIN\user -out oam.keytab.
    Thanks in advance and best regards!
    PS: Sorry if my english is not clear.

    David,
    Your Principal name should be the SSO LB URL.(ie :sso.mycomany.com)
    ktpass -princ HTTP/sso.mycomany.com@DOMAIN -pass XXXXXXX mapuser DOMAIN\user -out oam.keytab.
    Also make sure sso.mycomany.com has a reverse DNS configured correctly.
    you can check using dig command
    ping sso.mycomany.com
    What ever the ip-address
    dig -x <IP-ADDRESS>
    Check in the reverse DNS section there should be 1 record.
    ;; ANSWER SECTION:
    1.1.1.1.in-addr.arpa. 3600 IN PTR sso.mycomany.com.
    Let me know if you have more questions.
    Thanks
    Saurabh

  • HT4235 iPod nano 6th generation, syncing with audiobooks does not work now, had been working.  Sync test says:  No iPod touch, iPhone, or iPad found.  Connectivity test OK, no physical problems, iTunes shows the iPod.  Any clues what to do?

    iPod nano 6th generation, syncing with audiobooks does not work now, had been working.  Sync test says:  No iPod touch, iPhone, or iPad found.  Connectivity test OK, no physical problems, iTunes shows the iPod.  Any clues what to do?

    Hmm.. Thank you for the response.
    Have you tried using the iPod with another user account or computer, to help narrow down whether the problem lies with the computer, account, or the iPod itself?
    Maybe try reformatting it, using the tools provided by Windows. Instructions on how to reformat your iPod can be found in this article.
    http://www.methodshop.com/gadgets/ipodsupport/erase/index.shtml
    B-rock

  • Brand new Mac user help please! How do you connect a 17" monitor to the MacBook? I have the monitor plugged into the Mac, but the F8 that I am used to with PC does not work. Please help. Thanks.

    Brand new Mac user help please! How do you connect a 17" monitor to the MacBook? I have the monitor plugged into the Mac, but the F8 that I am used to with PC does not work. Please help. I am getting lots of spelling errors as the MacBook laptop screen is too small. Thank you so much! .

    Contentmom6 wrote:
    Brand new Mac user help please! How do you connect a 17" monitor to the MacBook? I have the monitor plugged into the Mac, but the F8 that I am used to with PC does not work.
    Normally, you just connect the monitor to the MacBook using a VGA adaptor that you can buy from an Apple Store.  Now try System Preferences > Displays > Detect Displays.  You should now be able to select a display mode for the monitor.  If it still doesn't work, then I'd check that everything is properly connected.  I've had problems with colours disappearing due to a faulty connection in the VGA adaptor.
    Bob

  • FIND with MATCH OFFSET not working

    Hi,
    I have a statement:
    FIND '/' IN <ls_data_package>-/bic/zbib_sysn MATCH OFFSET off2.
    this works in all the case except for when <ls_data_package>-/bic/zbib_sysn = SSULTANA-VMC/.
    (i.e. when /bic/zbib_sysn = USERID-VMC/, here SSULTANA is the user ID)
    *In this case off2 = .
    Value of sy-subrc is 0 after this statement is executed
    Can some one please point out what I am doing wrong.
    Thank you,
    CD
    Edited by: CSD . on Sep 26, 2008 9:53 PM

    >FIND with MATCH OFFSET not working  
    Most unlikely.  More likely is that it isn't doing what you think it should be doing.  Or you're using it incorrectly!
    I can't really follow what your problem is.  I assume you mean that you are getting off2 with value 0, when /bic/zbib_sysn contains USERID-VMC/
    Can you be a little clearer in what the issue is?
    DATA: off2 TYPE i.
    FIND '/' IN 'this string /' MATCH OFFSET off2.
    WRITE: / sy-subrc, off2.
    This little program returns 0 and 12 
    matt

  • I am having trouble with my speakers not working while online in particular on windows.My audio works when playing audio files

    I am having trouble with my speakers not working while online particular on facebook. My audio works when playing audio files.

    Hi,
    Did it happen all the time or sometime?
    Please check online browser status:
    Click Volume icon in the taskbar, click Mixer link button as below:
    If it's fine, follow this guide to run troubleshooter to detect and fix the issue:
    Tips for fixing common sound problems
    http://windows.microsoft.com/en-in/windows/tips-fixing-common-sound-problems#tips-fixing-common-sound-problems=windows-7
    Meanwhile, this similar thread also could be referred:
    https://social.technet.microsoft.com/forums/ie/en-US/a4a1cfe5-93a5-4c0b-9bf6-f7db0304f2ba/no-sound-on-youtube-or-any-other-webpage
    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • Serial number provided with download does not work, now what?

    serial number provided with download does not work, now what?

    Chrish29593217 you are welcome to contact our directly at Contact Customer Care.  What Adobe software title are you facing difficulties with?

  • TS3297 i bot a 3g iphone 2nd hand and it is trobleing a lot with os and not working plese help me

    i bot a 3g iphone 2nd hand and it is trobleing a lot with os and not working plese help me

    The following guide gives information on how to sync ringtones from your computer to the phone. The reference section at the bottom of the quide also gives instructions on how to convert a song to a ringtone. https://discussions.apple.com/docs/DOC-3792

  • [svn] 4323: Bug: LCDS-544 - Scenario where two components have seperate channel sets with overlapping channels not working .

    Revision: 4323
    Author: [email protected]
    Date: 2008-12-15 19:23:10 -0800 (Mon, 15 Dec 2008)
    Log Message:
    Bug: LCDS-544 - Scenario where two components have seperate channel sets with overlapping channels not working.
    QA: Yes
    Doc: No
    Checkintests Pass: Yes
    Details:
    * Hunting to a new channel within a channelset never triggered a disconnect from the previous channel(s). This isn't a problem in general, but does becomes a problem when an app defines two distinct channelsets containing at least one shared channel at the head of the list. In this case, the first channelset hunts past it and connects on a later channel. But when the second channelset hunts through (triggering a connect fault when it hits that initial shared channel that can't connect), the fault is processed by the first channelset as well (incorrectly).
    Ticket Links:
    http://bugs.adobe.com/jira/browse/LCDS-544
    Modified Paths:
    flex/sdk/trunk/frameworks/projects/rpc/src/mx/messaging/ChannelSet.as

    Running the script by python2 solves it for me:
    su - mythtv -c "nice -n 19 python2 /usr/bin/tv_grab_nl_py --output ~/listings.xml"
    Best regards,
    Cedric

  • I have downloaded skype, but after synchronizing with itunes skype not working, why?

    i have downloaded skype, but after synchronizing with itunes skype not working, why?  when I was synchronizing I believe there was some message in itune saying software not backed up or somethin to that effect.

    Thanks for your response.
    However, I did not find any solution to my problem.
    in my phone the skype application skype is not opening up, same is the caseiwth mobile voip. Both these applications were downloaded last night and it worked then, but not working now.
    Thanks in advance for anyone willing to help. I am new to the iphone.

  • Hello, all of a sudden I fell down my system and completely erased all bookmarks. Your progress with restoration does not work, send me ansver,please

    Hello, all of a sudden I fell down my system and completely erased all bookmarks. Your progress with restoration does not work, write me of bookmarks could not be loaded. Please advice on everything because I came and they seriously need it.

    Did your computer crash or did Firefox crash causing the loss of the bookmarks?
    You can check for problems with the places.sqlite database file in the Firefox Profile Folder.
    *http://kb.mozillazine.org/Bookmarks_history_and_toolbar_buttons_not_working_-_Firefox
    *https://support.mozilla.org/kb/Bookmarks+not+saved#w_fix-the-bookmarks-file
    See also:
    *http://kb.mozillazine.org/Lost_bookmarks
    *http://kb.mozillazine.org/Firefox_crashes
    *https://support.mozilla.org/kb/Firefox+crashes

  • Oratab not working in AIX 5.3

    Hi All,
    We changed the below entries in oratab in AIX server,
    orcl:/oracle/Ora10g:Y
    even after changing this above entries on oratab oracle DB and listener services are not starting in the AIX server, have any pupils come across this scenario, need your help on this...
    Hariharan .T

    The line was like
    orcl:/oracle/Ora10g:N
    we changed to
    orcl:/oracle/Ora10g:Y
    I am sure the Oracle SID and ORACLE HOME is correct...
    this works fine in sun solaris and Linux machine i don't know why this is not working in AIX,
    Hariharan.T

  • OAM 11g reports with BI publisher 11g

    Hi Guys,
    I am facing issue while configuring the reports in BI Publisher for 11g while generating report i am getting error
    oracle.xdo.XDOException: oracle.xdo.XDOException: oracle.xdo.XDOException: Could not get data source connection for: Audit
    i will list down the steps
    1. Created a audit database using RCU
    2.Created a jdbd data source in weblogic
    3. Attach this data source to Audit store in Enterprise manager.
    4.deploy the reports in BI publisher
    5. created a jdbc data source to point to audit database.
    6.Attach this datasource to data modal and then to report. Now when i run the report i am getting this error
    oracle.xdo.XDOException: oracle.xdo.XDOException: oracle.xdo.XDOException: Could not get data source connection for: Audit
    guys provide me with some pointers.

    Hi,
    Here is a set of instructions on how to run the OAM 11g reports in BI 11g:
    http://oraclemiddlewareblog.com/2012/07/31/how-to-run-oam-11g-audit-reports-in-bi-publisher-11g/
    Basically, even if you have created the datasource to the XX_IAU schema, you still need to make sure that you enable the audit on the OAM side and that you configure the right filters for the audited operations.

  • Start-mdbs-with-application does not work

    Hi,
    We have a cluster with two managed servers and a JMS server on a migratable target on WLS 10.3.2. We have some MDBs within an EAR module deployed on the cluster. When the managed servers are restarted, WLS produces the following warning:
    <The Message-Driven EJB: LogReceiver is unable to connect to the JMS destination: jms/loggingQueue. The Error was:
    javax.naming.NameNotFoundException: Unable to resolve 'jms.loggingQueue'. Resolved 'jms'; remaining name 'loggingQueue'
    at weblogic.jndi.internal.BasicNamingNode.newNameNotFoundException(BasicNamingNode.java:1139)
    at weblogic.jndi.internal.BasicNamingNode.lookupHere(BasicNamingNode.java:252)
    at weblogic.jndi.internal.ServerNamingNode.lookupHere(ServerNamingNode.java:182)
    at weblogic.jndi.internal.BasicNamingNode.lookup(BasicNamingNode.java:206)
    at weblogic.jndi.internal.BasicNamingNode.lookup(BasicNamingNode.java:214)
    at weblogic.jndi.internal.WLEventContextImpl.lookup(WLEventContextImpl.java:254)
    at weblogic.jndi.internal.WLContextImpl.lookup(WLContextImpl.java:393)
    at javax.naming.InitialContext.lookup(InitialContext.java:392)
    at weblogic.jms.common.CDS$2.run(CDS.java:222)
    at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
    at weblogic.jms.common.CDS.getDDMembershipInformation(CDS.java:216)
    at weblogic.ejb.container.deployer.MessageDrivenBeanInfoImpl.createMDManagers(MessageDrivenBeanInfoImpl.java:1295)
    at weblogic.ejb.container.deployer.MessageDrivenBeanInfoImpl.activate(MessageDrivenBeanInfoImpl.java:1092)
    at weblogic.ejb.container.deployer.EJBDeployer.activate(EJBDeployer.java:1324)
    at weblogic.ejb.container.deployer.EJBModule.activate(EJBModule.java:480)
    at weblogic.application.internal.flow.ModuleListenerInvoker.activate(ModuleListenerInvoker.java:227)
    at weblogic.application.internal.flow.DeploymentCallbackFlow$2.next(DeploymentCallbackFlow.java:415)
    at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:83)
    at weblogic.application.internal.flow.DeploymentCallbackFlow.activate(DeploymentCallbackFlow.java:75)
    at weblogic.application.internal.flow.DeploymentCallbackFlow.activate(DeploymentCallbackFlow.java:67)
    at weblogic.application.internal.BaseDeployment$2.next(BaseDeployment.java:1267)
    at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:83)
    at weblogic.application.internal.BaseDeployment.activate(BaseDeployment.java:409)
    at weblogic.application.internal.EarDeployment.activate(EarDeployment.java:54)
    at weblogic.application.internal.DeploymentStateChecker.activate(DeploymentStateChecker.java:161)
    at weblogic.deploy.internal.targetserver.AppContainerInvoker.activate(AppContainerInvoker.java:79)
    at weblogic.deploy.internal.targetserver.BasicDeployment.activate(BasicDeployment.java:184)
    at weblogic.deploy.internal.targetserver.BasicDeployment.activateFromServerLifecycle(BasicDeployment.java:361)
    at weblogic.management.deploy.internal.DeploymentAdapter$1.doActivate(DeploymentAdapter.java:51)
    at weblogic.management.deploy.internal.DeploymentAdapter.activate(DeploymentAdapter.java:196)
    at weblogic.management.deploy.internal.AppTransition$2.transitionApp(AppTransition.java:30)
    at weblogic.management.deploy.internal.ConfiguredDeployments.transitionApps(ConfiguredDeployments.java:233)
    at weblogic.management.deploy.internal.ConfiguredDeployments.activate(ConfiguredDeployments.java:169)
    at weblogic.management.deploy.internal.ConfiguredDeployments.deploy(ConfiguredDeployments.java:123)
    at weblogic.management.deploy.internal.DeploymentServerService.resume(DeploymentServerService.java:173)
    at weblogic.management.deploy.internal.DeploymentServerService.start(DeploymentServerService.java:89)
    at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
    at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
    at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
    We have configured a System module with a ConnectionFactory on a default targetting and a Queue deployed on the JMS Server. The jndi names for the ConnectionFactory and the Queue have been properly configured.
    Apparently, the container tries to bind the MDBs with their relative destination, but is unable to proceed due to the cluster jndi not having been loaded yet. According to the documentation, we could manage to avoid this early binding by specifying
    <wls:start-mdbs-with-application>true</wls:start-mdbs-with-application>
    in weblogic-application.xml. I tried (also using false, because the documentation is not that clear in this aspect), but without any result. Is there a reason why we cannot manage to have the mdbs connecting later with their destination?
    Also, we got a warning message in the deployment page, claming that the MDBs in the server that is not hosting the JMS server are not connected to their destination. They stuck on state "initializing". While, if we manually resume the connection, via console, the state turns to "Connected". Are these issues correlated somehow?
    Any help will be very much appreciated.
    Thanks in advance,
    - Francesco.

    Hi Francesco,
    From the link below (i.e. Oracle link for WLS-11g) it states that
    “Set to false to defer message processing until after WebLogic Server opens its listen port.”
    Search for: start-mdbs-with-application
    Link-1 http://download.oracle.com/docs/cd/E15523_01/web.1111/e15493/summary.htm
    *# Conclusion:*
    This means that “false” should have resolved your issue but it is not so this might be a bug. Similar bug was seen in WLS-9.2 version which was fixed in WLS-9.2 Mp-1 version check out the link below.
    Search for: CR293982 or CR299012
    Link-2 http://download.oracle.com/docs/cd/E13222_01/wls/docs92/issues/known_resolved.html
    However if it was fixed in WLS 9.2 Mp-1 then the same issue is most probably taken care in WLS 10.x.x version also.
    *# Suggestion:*
    - Try to set “start-mdbs-with-application” as “true” and check if that works for you.
    This is because if you read the “Link-1″ carefully it states that “With default setting of true”, however when you check the “Default” column it shows “false”. Hence cant say which one is default. It might be document bug as well. However you have tried it so you can skip this suggestion.
    *# How to solve this issue:*
    1) Create a simple test case to prove that “start-mdbs-with-application” when set as “false” does not work.
    2) Open a ticket with Oracle and provide all the details with the test case and let them do their job.
    Hope this information helps.
    Regards,
    Ravish Mody

  • Windows AD with Kerberos authentication not supported for NW AS JAVA 7.1

    The Admin guide for BO 3.1 states that Windows AD with Kerberos authentication is not supported on NetWeaver AS.
    Can anybody suggest & confirm on this???

    I know we haven't been receiving cases for it, but I think in theory it should work fine. BO doesn't really care what web/app kerberos comes from as the manual authentication uses the java SDK (i.e tomcat 5.5 would use Sun JDK 1.5), and SSO kerberos (vintela) uses 3rd party libraries. It's possible our 3rd party libraries may not support netweaver yet. If I hear anything else I'll post.
    Regards,
    Tim

Maybe you are looking for