OWSM gateways and incoming HTTPS

Hi,
Does anyone know how to configure OWSM (10.1.3 standalone) gateway for both HTTP and HTTPS incoming web services? Do I need two gateways with different port settings? I'm sure there is a simple way of doing this, but I can't find any good documentation for it.
Any help would be appreciated.
Regards,
Anders

Hi Anders,
I think you would need to create gateways with different port settings.
Kalyan

Similar Messages

Can you run Embedded PL/SQL Gateway and Oracle HTTP Server at the same time

Hi,
I know this will sound a bit odd but their is a business case for asking this. Can you run APEX via the Embedded PL/SQL Gateway and the Oracle HTTP Server at the same time? Would their be any security/stability/etc issues I'd need to worry about? I know that I'll need to run them on different ports.
Thank you,
Martin Giffy D'Souza
[http://apex-smb.blogspot.com/]

I think I've done this in the past. Theres no technical reason why you can't do this as far as I know.
I can't remember if I used different ports or same port.

OWSM - Gateway and Agents

Hi,
I have just started with OWSM, Can any1 ps through some light on what is Gateway and what is an agent. I looked into Oracle Supplied docs. bt was nt able to gather much.
Thanks,
Is

Hi,
The Oracle WSM Gateway is deployed in a J2EE container. It functions independently of the Web service it protects and acts as a proxy to the Web service clients.
Oracle WSM Agents – There are two types of Oracle WSM Agents:
– Client Agents
– Server Agents
The OWSM Agent protects access to a web service at the web service provider (server-side Agent).
The OWSM Client-Side Agent enforces web services policies from within the same web application as the service client.
Regards,
Govinda

Error When Sending Service Request Through OWSM Gateway

We are trying to test using OWSM Gateways and Server Agents to sign and then verify messages being passed to a web service on a server. We have been able to get this to work with a simple HelloWorld type service without any problems. We then followed the exact same steps to do this with an actual service and it is not working.
We run the test from the "Test Page" inside the ccore GUI. We first test the connection directly to the service and receive a message about it missing the WS Security header. This is somewhat expected. Then, we send through the gateway which is set up to sign the message and pass along the header and receive the same error message:
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"><env:Header/><env:Body><env:Fault xmlns="http://schemas.oblix.com/ws/2003/08/Faults"><faultcode xmlns="">:GenericFault</faultcode><faultstring xmlns="">WS-Security process failure:FAULT CODE: InvalidSecurity FAULT MESSAGE: Missing WS Security header in the SOAP message</faultstring><faultactor xmlns=""></faultactor></env:Fault></env:Body></env:Envelope>
We have checked the OWSM logs and can see that both times the server agent receives the request. The gateway logs, however, do not show any requests or responses even though the message should have gone through it. We do see these messages in the logs when testing our HelloWorld service with the same sign/verify settings. A review of the gateway.log file shows the following message displayed each time we submit a test to the malfunctioning service:
2007-10-18 10:30:22,263 INFO [AJPRequestHandler-HTTPThreadGroup-54] gateway.WSDLRegistry - Exception occured in updateWSDL
We have until tomorrow to get this issue resolved before development presses to move forward without OWSM security and we cannot have that. Your immediate assistance is required. Thank you.

Some additional research has been done here and it seems that web services created with SOAP 1.1 (such as the HelloWorld service) work just fine. The problem is with services created with SOAP 1.2. Are there separate configurations or changes that need to be made for SOAP 1.2 services?

OWSM Gateway intercept by URL

Hi everybody. As I'm diving deeper into OWSM (10.1.3) the question is raised: is it possible to install OWSM Gateway and configure it in the way that this gateway will listen not only on gateway URL (generated from Register Service) but also on original service endpoint without having changed all my client code to point to gateway URL instead of original service endpoint. If this is not possible then how to prevend client apps from calling service endpoint directly?
Edited by: Baan, Jos on 23-feb-2010 15:56

Can anyone post any help from Oracle?

OWSM: BPEL callback bypasses Gateway and ServerAgent

Hi,
I have a BPEL Process A that asynchronously calls BPEL Process B. For securing the processes I use OWSM.
I have tried both a Gateway as well as a ServerAgent but in both cases the callback message from B back to A bypasses either Gateway or ServerAgent.
Whereas the requests for invoking both processes A and B do show up in the OWSM logs as expected.
The entire system works fine, with either Gateway and / or ServerAgent.
Perhaps some BPEL-internal-magic going on (e.g. for improving performance)?
What does it take to have the response from process B go through either the Gateway or the ServerAgent and be subject to the policy pipeline specified in there?
Thanks!
Regards, Sjoerd

Hi Denis,
Thanks for your reply.
Although I have not solved the problem, I have some more insights to share. Questions remain though ...
In the SOAP message that follows HelloWorld3 calls HelloWorld2 asynchronously. WS-Addressing at work to correlate the callback to the original instance of the HelloWorld3 process.
<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<env:Header>
<ReplyTo xmlns="http://schemas.xmlsoap.org/ws/2003/03/addressing">
<Address xmlns="http://schemas.xmlsoap.org/ws/2003/03/addressing">
http://localhost/orabpel/default/HelloWorld3/1.0/HelloWorld2/HelloWorld2Requester
</Address>
<PortType xmlns:ptns="http://xmlns.oracle.com/HelloWorld2" xmlns="http://schemas.xmlsoap.org/ws/2003/03/addressing">
ptns:HelloWorld2Callback
</PortType>
<ServiceName xmlns:snns="http://xmlns.oracle.com/HelloWorld2" xmlns="http://schemas.xmlsoap.org/ws/2003/03/addressing">
snns:HelloWorld2CallbackService
</ServiceName>
</ReplyTo>
<MessageID ans1:rootId="950001"
ans1:parentId="950001"
ans1:priority="0"
xmlns="http://schemas.xmlsoap.org/ws/2003/03/addressing" xmlns:ans1="http://schemas.oracle.com/bpel">
bpel://localhost/default/HelloWorld3~1.0/950001-BpInv0-BpSeq0.3-3
</MessageID>
</env:Header>
<env:Body>
<HelloWorld2ProcessRequest xmlns="http://xmlns.oracle.com/HelloWorld2">
<input xmlns="http://xmlns.oracle.com/HelloWorld2">
showmethemoney
</input>
</HelloWorld2ProcessRequest>
</env:Body>
</env:Envelope>
Could the WS-Addressing information be used as a 'shortcut' for the callback to the HelloWorld3 process? Any way, the callback is not picked up by the ServerAgent ...
The processes finish as expected but the message traffic is not properly regulated and, hence, not subject to proper policy enforcement.
Any ideas?
Thanks, Sjoerd

Unable to acess BPEL WSDL from OWSM Gateway

Hello all,
I'm trying to register a BPEL Process as a service on a OWSM gateway.
The BPEL WSLD is as follows:
<definitions name="WR01" targetNamespace="http://xmlns.oracle.com/WR01">
−
     <types>
−
     <schema attributeFormDefault="qualified" elementFormDefault="qualified" targetNamespace="http://xmlns.oracle.com/WR01">
−
     <element name="WR01ProcessRequest">
−
     <complexType>
−
     <sequence>
<element name="input" type="string"/>
</sequence>
</complexType>
</element>
−
     <element name="WR01ProcessResponse">
−
     <complexType>
−
     <sequence>
<element name="result" type="string"/>
</sequence>
</complexType>
</element>
</schema>
−
     <xsd:schema>
<xsd:import namespace="http://xmlns.oracle.com/pcbpel/adapter/db/top/WR01" schemaLocation="WR01.xsd"/>
</xsd:schema>
</types>
−
     <message name="WR01RequestMessage">
<part name="payload" element="ns1:Input"/>
</message>
−
     <message name="WR01ResponseMessage">
<part name="payload" element="ns1:Input"/>
</message>
−
     <portType name="WR01">
−
     <operation name="process">
<input message="tns:WR01RequestMessage"/>
<output message="tns:WR01ResponseMessage"/>
</operation>
</portType>
−
     <binding name="WR01Binding" type="tns:WR01">
<soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
−
     <operation name="process">
<soap:operation style="document" soapAction="process"/>
−
     <input>
<soap:body use="literal"/>
</input>
−
     <output>
<soap:body use="literal"/>
</output>
</operation>
</binding>
−
     <service name="WR01">
−
     <port name="WR01Port" binding="tns:WR01Binding">
<soap:address location="http://dcmsinusapp02.dc.local:7780/orabpel/default/WR01/1.0"/>
</port>
</service>
−
     <plnk:partnerLinkType name="WR01">
−
     <plnk:role name="WR01Provider">
<plnk:portType name="tns:WR01"/>
</plnk:role>
</plnk:partnerLinkType>
</definitions>
The WSDL generated from the service registation on the gateway is as follows:
<definitions name="WR01" targetNamespace="http://xmlns.oracle.com/WR01">
−
     <types>
−
     <schema attributeFormDefault="qualified" elementFormDefault="qualified" targetNamespace="http://xmlns.oracle.com/WR01">
−
     <element name="WR01ProcessRequest">
−
     <complexType>
−
     <sequence>
<element name="input" type="string"/>
</sequence>
</complexType>
</element>
−
     <element name="WR01ProcessResponse">
−
     <complexType>
−
     <sequence>
<element name="result" type="string"/>
</sequence>
</complexType>
</element>
</schema>
−
     <xsd:schema>
<xsd:import namespace="http://xmlns.oracle.com/pcbpel/adapter/db/top/WR01" schemaLocation="WR01.xsd"/>
</xsd:schema>
</types>
−
     <message name="WR01RequestMessage">
<part name="payload" element="ns1:Input"/>
</message>
−
     <message name="WR01ResponseMessage">
<part name="payload" element="ns1:Input"/>
</message>
−
     <portType name="WR01">
−
     <operation name="process">
<input message="tns:WR01RequestMessage"/>
<output message="tns:WR01ResponseMessage"/>
</operation>
</portType>
−
     <binding name="WR01Binding" type="tns:WR01">
<soap:binding style="document" transport="http://schemas.xmlsoap.org/soap/http"/>
−
     <operation name="process">
<soap:operation style="document" soapAction="process"/>
−
     <input>
<soap:body use="literal"/>
</input>
−
     <output>
<soap:body use="literal"/>
</output>
</operation>
</binding>
−
     <service name="WR01">
−
     <port name="WR01Port" binding="tns:WR01Binding">
<soap:address location="http://dcmsinusapp02.dc.local:7780/gateway/services/SID0003002"/>
</port>
</service>
−
     <plnk:partnerLinkType name="WR01">
−
     <plnk:role name="WR01Provider">
<plnk:portType name="tns:WR01"/>
</plnk:role>
</plnk:partnerLinkType>
</definitions>
When i test the acess using OWSM console or try and consume it on JDeveloper I get the following error:
java.io.IOException: The document 'http://dcmsinusapp02.dc.local:7780/gateway/services/WR01.xsd' contains HTML tags.
Reason is:
404 Not Found
OracleJSP: java.io.FileNotFoundException:
Set the init-param debug_mode to "true" to see the complete exception message
This file not found exception is related to /gateway/services/WR01.xsd of course.
I've mostly followed the OWSM documentation in order to register the service.
Am I doing anything wrong referencing xsd's or something similar?
Thanks in advance

Answer to my own question:
BPEL processes exposed via OWSM can't be used from JDEV ws proxy generator
But the real question is: how do I prevent relative paths to xsd's on bpel wsdl?
Any pointers?
Thanks

OWSM GATEWAY PROBLEM .xsd error

Hi,
I am working on OWSM gateways.I deployed a mail web service and tried to virtualise it using OWSM gateways. I have registered the service . When i use the link for service wsdl generated by OWSM in internet explorer i can see the wsdl file but when do the same using test page in OWSM i get the following error.
java.io.IOException: The document 'http://localhost:8888/gateway/services/alshirawiMail.xsd' contains HTML tags.
Also i have only tried with web services but when i try to virtualise THE WHOLE BPEL PROCESS i get error like
java.io.IOException: The document 'http://localhost:8888/gateway/services/rule_doesnot_work.xsd' contains HTML tags.
Please reply.
Thanks and regards.
Vishnu
Message was edited by:
user607746

Hi
The problem with xsd resolved but now when i invoke the service from test page i am getting this error.
<env:Envelope
xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">null
<env:Body>
<env:Fault
xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
<faultcode>env:Server</faultcode>
<faultstring>ORABPEL-08021 Cannot find partner wsdl. parnterLink "OWSM_SYNC_BPEL_PROCESS" is not found in process "OWSM_SYNC_BPEL_PROCESS" (revision "1.0") Please check the deployment descriptor of the process to find the correct partnerLink name. </faultstring>
null</env:Fault>
</env:Body>
</env:Envelope>

OWSM gateway

I've installed Oracle SOA suite (10.1.3.1.0) successfully. I followed the OWSM QuickStart to create a new gateway and register a service. But I can't open the wsdl of registered service, also when I entered http://{myhost}:8888/gateway/ in browser, and tried to open the gateway I got the following error.
Request URI:/gateway/common/ErrorPage.jsp
Exception:
OracleJSP:java.io.FileNotFoundException: C:\product\10.1.3.1\OracleAS_1\j2ee\home\applications\gateway\gateway\common\ErrorPage.jsp (The system cannot find the path specified)
Could anyone please let me know how to fix the problem?
Thanks

Hi Kersten
I have restarted the Oracle Application Server but the problem still exists.
Please update with the message at the earliest.

OWSM Gateway on a separate server?

Hi,
I am trying to get the OWSM working in an architecture where the Gateway resides on one server and the rest of the SOA Suite on another. The only documentation I could find was
in the Deployment Guide under Configuring Oracle WSM in a Clustered Environment:
http://download.oracle.com/docs/cd/E10291_01/doc.1013/e10298/depovrvw.htm#BABEHJDI
We are not using a cluster though. We just want the gateway in the DMZ and the rest on the LAN. I keep getting the below error when accessing the WSDL after finising the setup.
Failed to read WSDL from http://wmsi001370.corp.wmdata.net:8888/gateway/services/SID0003007?wsdl: HTTP connection error code is 500Anybody got any ideas?
<b>Here is our setup</b>
- soaSuite server. Full SOA Suite + database
- gateway server. Full SOA Suite + OLITE
Step 1:
I have installed the full SOA Suite 10.1.3.1.0 on both the soaSuite and the gateway server and patched them to 10.1.3.3.0 with patchset 6148874.
Step 2:
On the soaSuite server I have undeployed the Gateway with wsmadmin undeploy gateway
Step 3:
On the gateway server I have undeployed the policymanager, monitor and control via
wsmadmin undeploy policymanager
wsmadmin undeploy monitor
wsmadmin undeploy control
Step 4:
On the soaSuite server I have registered a Gateway using a Component URL that points to the gateway server and made a not of the component id.
Step 5:
On the gateway server I have edited ORACLE_HOME/owsm/config/gateway/gateway-config-installer.properties. I filled in the component id and changed the policymanagerURL to point back to the soaSuite server
The I redeployed the gateway with wsmadmin deploy gateway
Step 6:
On the soaSuite server I register the Web Service to the Gateway and commits the changes.
Step 7:
Now everything should be ready and working but it is not :-(
Regards Pete

Hi,
How did you resolve this issue?
Kris

OWSM: Gateway is not ready to process requests

OWSM: Gateway is not ready to process requests
After I registered a service in a gateway with OWSM and when I intialize a client call using gateway virtualized URL fro BPEL, the first time call I always get the following fault. It is like a "wake-up" call. I had to initialize second call imediately following the first call get through gateway.
Can anyone help me to figure out how to keep the OWSM Gateway "awake" all the time and avoid first call gateway failure?
Thanks
<fault>
-<remoteFault xmlns="http://schemas.oracle.com/bpel/extension">
-<part name="code">
<code>Client.GenericFault
</code>
</part>
-<part name="summary">
<summary>Gateway is not ready to process requests
</summary>
</part>
-<part name="detail">
<detail>
<detail/>
</detail>
</part>
</remoteFault>
</fault>

Can anyone post any help from Oracle?

SOS~!!!About OWSM Gateway Question

Hi,
I've used the OWSM (SOA SUITE 10.1.3.1-linux)to do the following:
1) Created a Gateway Component
2)set policy
3)Registered a Service
4)Commited the policy
Service URL: http://b.cn.oracle.com:3115/gateway/services/SID0003004
Service WSDL URL: http://b.cn.oracle.com:3115/gateway/services/SID0003004?wsdl
I can access my original service,however failed by it.
the error info is "Oracle Web Services Manager Gateway C0003001: No policies found for service "SID0003004". Make sure the service is registered correctly and the gateway policies are up to date."

Hi,
Take a look at Re: OWSM gateway issue It might help.
Regards,
Mathias

[URGENT]Error in OWSM gateway.

Hi Mathias ,
Oracle SOA suite version: 10.1.3.1.0
I started the OWSM with the quick start tutorial. Instead of using the time service I used another service deployed. When I started I had created a gateway which I then deleted.
Then I created a new gateway and done the steps specified by the tutorial.
The problem is occuring when I try to access the proxy wsdl url.
It giving an error :-
Oracle Web Services Manager Gateway C0003001: Cannot find WSDL for service "SID0003006"
I have updated the gateway.component.id with C0003007 the next possible component ID in gateway-config-installer.properties located in OH/owsm/config/gateway and then redeployed the gateway successfully.Now I am getting a little bit different error :
Oracle Web Services Manager Gateway : Cannot find WSDL for service "SID0003007"
I deleted all other gateways and this is the only gateway remaining.
Please tell me another way to fix this.
Thanks and Regards,
Vargab Pathak

To debug the problem, bump up the log level as mentioned in this post http://ws-security.blogspot.com/2007/04/howto-10131-owsm-change-log-level.html
Try to see if the detailed logs help in resolving the problem.
Vikas

Recommended configuration for load balanced Portal with load balancer, multiple gateways and multiple servers.

Does anyone have a recommended network, hardware and software configuration guide for a Portal installation running with multiple gateways load balanced (ie one URL) that talk to multiple servers?

David,
We've used Resonate (software) to load balance the gateways. It allows
you to group all the gateways under 1 virtual URL and load balance the
incoming connections over each gateway depending on the rules that you
define in Resonate. Look in the SUN portal whitepapers there is one that
talks about it specifically.
As far as load balancing the calls to the portals, the gateways will
automatically load balance across all the portals that they know about
using a simple round-robin rotation. You may be able to use Resonate in
front of the portals but you may need to activate persistance within
Resonate to ensure that the user always ends up on the portal that he
established his initial connection on (if you want that), check with Sun
on this one.
David Broeren wrote:
Recommended configuration for load balanced Portal with load balancer,
multiple gateways and multiple servers.
Does anyone have a recommended network, hardware and software
configuration guide for a Portal installation running with multiple
gateways load balanced (ie one URL) that talk to multiple servers?
Try our New Web Based Forum at http://softwareforum.sun.com
Includes Access to our Product Knowledge Base!

Publish RD Gateway and Web Access with One-Time Password (OTP) / Two-factor Authentication WITHOUT ISA/TMG server

Hi everybody,
I've been struggeling with this problem for a few weeks now and can't find a way to solve it.
We have an RD farm (Server 2012) which consists of two Remote Desktop Servers with Connection Broker and Web Access.
I've recently published a new server, containing RD Gateway and Web Access in our perimeter network.
Now we've got restrictions that OTP/2FA must be used for the external deployment and we've decided to go for a solution from Gemalto.
The "program" is called IDConfim and the server is called SA Server (Strong Authentication).
Also it's important that NO ISA/TMG server is supposed to be used, the OTP/2FA is supposed to work seamless with the Web Access/Gateway.
After hours discuss we came to a point were their NPS agent setup would be the only way to accomplish our goals.
The setup is supposed to be like this:
LAN:
1 DC (2008 R2)
RD Farm (2012)
1 SA Server (2012)
DMZ:
RD Gateway/Web Access (2012)
Were Gateway and Web Access should forward the authentications with NPS to the NPS agent on the SA server.
When you print your AD account to authenticate you add the 6 digits of OTP which you recieve from you mobile app.
Initially this seems to work, the Gateway forwards the request to the remote NPS server, BUT only if you write the correct AD password
(without the OTP extension).
If you write the correct AD password the authentication is forwarded to out SA Servern and it's beeing rejeced because the password doesn't
contain the correct OTP extension.
The problem comes here.
When you write you AD password along with the OTP extension you get a Windows Security error in the eventlog (On thw Gateway server) like this:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: user
Account Domain: domain
Failure Information:
Failure Reason: Unknown username or password.
Status: 0xc000006d
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: server
Source Network Address: 192.168.x.x
Source Port: 63003
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
What i can see it's a NTLM error, but hey?! aren't we supposed to forward all authentication handeling to the remote NPS server?
The problem is that no matter what i try the above problem stays there.
Is it not possible to just forward ALL authentication handeling to a remote server?
The only solution I've found to get it working someday in the future is this:
"Remote Desktop Pluggable Authentication and Authorization", which is supposed to be introduced in 2012 R2.
Also this link describes it:
http://archive.msdn.microsoft.com/Release/ProjectReleases.aspx?ProjectName=rdsdev&ReleaseId=3745
Please, bring me some answers before my head explodes! :)
PS, long question = maybe some errors, ask me if something is unclear.

Hi,
Based on our experience, if the NTLM error occurs, please check the password.
Regards,
Mike
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

OWSM gateways and incoming HTTPS

Similar Messages

Maybe you are looking for