OIF+OAM: install/config issues

Question

This post is long. Hoping that at least one of the issues is seen by someone or someone has insights before we open SR(s) with Oracle.
We have a working OAM/OVD 11.1.1.5 installation (done according to the EDG at http://docs.oracle.com/cd/E21764_01/core.1111/e12035/toc.htm).
We started an evaluation of OIF and ran into some issues grouped under Install and Config categories.
h2. Install issues:
We installed it per chapter 16 of that EDG and and all the steps went OK except step 16.7 (http://docs.oracle.com/cd/E21764_01/core.1111/e12035/oif.htm#BAJCJHBG).The config properties userldaphaenabled, fedldaphaenabled are getting set via WLST but don't appear to be persisted anywhere. On a restart they are false again. Are they supposed to be saved to config.xml of the IDMDomain? Can I try adding them manually like this as child elements under each of the wls_oif managed servers?
<datastore>
<userldaphaenabled>true</userldaphaenabled>
<fedldaphaenabled>true</fedldaphaenabled>
</datastore>
If those settings were properly set what is it supposed to do? I can see that config.xml, cots.xml files are stored as blobs in one of the OIF db tables. Will the above setting move them from DB to LDAP?
h2. Config/Runtime Issues:
We proceeded with configuration because the /sp/metadata and /idp/metadata test URLs are working fine via the VIP address. we used this manual to do the integration.
http://docs.oracle.com/cd/E21764_01/doc.1111/e15740/oif.htm#CACJDDGE. In section 4.3.1.6 (Configure Oracle Identity Federation in SP Mode) of this document it says to configure Oracle SSO. We only have OAM and not osso. We went ahead and configured the second tab (OAM) in the screen capture in that section as well (is there any documentation on how to configure that tab?)
In SP mode (section 4.3) , testing of a resource protected with OIFScheme in OAM is not successful. It does not show any OIF login screen. Instead it takes the user to through these URLs:
     1.     https://sso.company.com/test-app/
     2.     https://sso.company.com/fed/user/sposso  
     3.     https://sso.company.com/fed/user/authnoam?refid=id-tB20kXzmHjpn6MUSdOr7qbmd2OU-
     4.     https://sso.company.com/fed/sp/art20?SAMLart=AAQAAbV1ElKBtte9uuhKoeo4h%2FMufCdY2wDlDIM2T9dL%2BvhsvtfUrwCuZg8%3D&RelayState=id-JPh8MY05pAZRckl4yOc2J4-80GI-
and then shows this error in the browser:
Error 401--Unauthorized
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
10.4.2 401 Unauthorized
The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.46) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity MAY include relevant diagnostic information. HTTP access authentication is explained in section 11.
The following errors are seen in the WLS_OIF1 (we turned off WLS_OIF2 during this test) managed server logs:
<Mar 10, 2012 10:58:37 AM PST> <Error> <oracle.security.fed.eventhandler.authn.engines.oam.OAMAuthnEventHandler> <FED-18068> <Authentication failed: WebGate did not authenticate the user>
<Mar 10, 2012 10:58:37 AM PST> <Emergency> <oracle.security.fed.model.config.Configuration> <FED-10174> <Property was not found: httpheaderattrcollector.>
<Mar 10, 2012 10:59:27 AM PST> <Warning> <oracle.security.fed.http.handlers.authn.LoginRequestHandler> <FED-18051> <Authentication instant was not sent from the authentication engine.>
<Mar 10, 2012 10:59:37 AM PST> <Error> <oracle.security.fed.util.ssl.KeystoreUtil> <FED-18080> <Could not retrieve key from the key store. Please verify that the key password is equal to the key store
< this error is followed by an exception shown below>
<Mar 10, 2012 10:59:39 AM PST> <Error> <oracle.security.fed.eventhandler.authn.engines.osso.OssoFinishSPSSOEventHandler> <FED-15134> <The service providercould not map the identity provider response to a user>
FED-18080 exception:
java.security.UnrecoverableKeyException: Cannot recover key
     at sun.security.provider.KeyProtector.recover(KeyProtector.java:311)
     at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:121)
     at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:38)
     at java.security.KeyStore.getKey(KeyStore.java:763)
     at com.sun.net.ssl.internal.ssl.SunX509KeyManagerImpl.<init>(SunX509KeyManagerImpl.java:113)
     at com.sun.net.ssl.internal.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactoryImpl.java:48)
     at javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:239)
     at oracle.security.fed.util.ssl.KeystoreUtil.createKeyManagers(Unknown Source)
     at oracle.security.fed.util.soap.OIFSSLProtocolSocketFactory.createSSLContext(Unknown Source)
     at oracle.security.fed.util.soap.OIFSSLProtocolSocketFactory.getSSLContext(Unknown Source)
     at oracle.security.fed.util.soap.OIFSSLProtocolSocketFactory.createSocket(Unknown Source)
     at oracle.security.fed.util.soap.OIFSSLProtocolSocketFactory.createSocket(Unknown Source)
     at org.apache.commons.httpclient.HttpConnection.open(HttpConnection.java:707)
     at org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.open(MultiThreadedHttpConnectionManager.java:1361)
     at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:387)
     at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:346)
     at oracle.security.fed.util.soap.SimpleSoapSender.sendMessage(Unknown Source)
     at oracle.security.fed.http.flow.profiles.sp.SendSoapRequestSSOResponseHandler.perform(Unknown Source)
     at oracle.security.fed.controller.ApplicationController.processServletRequest(Unknown Source)
     at oracle.security.fed.controller.web.servlet.FederationServlet.doGet(Unknown Source)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:821)
     at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
     at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
     at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:300)
     at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:27)
     at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
     at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:111)
     at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:313)
     at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:413)
     at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:94)
     at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:161)
     at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
     at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
     at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:136)
     at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
     at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3715)
     at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3681)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
     at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
     at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2277)
     at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2183)
     at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1454)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:178)
A minor other problem seems to be with adcri:
Cause: DFW-40112: There was an error executing adrci commands; the following errors have been found "Cannot run program "/app/iam/middleware/wlserver_10.3/server/adr/adrci": java.io.IOException: error=12, Cannot allocate memory"
Action: Ensure that command line tool "adrci" can be executed from the command line.
We can run the adcri tool from command line using the same LD_LIBRARY_PATH as used by the wls_oif1 server. Why is it trying to run it and failing and what is it trying to do? Can we turn it off?

Answer 1

I reinstalled the suite. This time, during the Policy Manager install I left the "Root Directory for Policy Domains" (step/page 7-12) at the default, which was "/". The GUI now works correctly.
On the previous install I changed the path to /AccessManagerPolicy -- it wasn't clear to me what the installer meant by 'root directory'. I did try to get /AccessManagerPolicy to work by creating a directory under my web root to match, but I still had issues with the Policy Domain -- the no policy domains would match. So, it looks like this parameter should never be changed in the installer.
Aaron.