Security Evaluation of Oracle Application Server

Are there any published documents on security evaluation of Oracle Application Server?
Is it secure as a tool against some attacks, for example, are following vulnerabilities when applicable to the server dealt with or should be handled by application? :
failure to restrict url access,
broken authentication and session management
insecure cryptographic storage,
injection flaws
failure to restrict directory browsing
Are there available document that we can refer to on these issues?
Regards
Farbod

Thank you again.
Can you advise on this part of my message also?
"Also I see in oracle recommended architectures that there is a firewall between each http server and application server. Does the built in OHS in OAS provide the firewall? or I need to install another firewall?"
I am going to explain it but I think it is completely inconsistent with the thread title which I got some of my answers in, so let me start a new thread here:
Application Server Recommended Deployment Architectures, How to?
Thanks for your useful inputs.
Best Regards,
Farbod

Similar Messages

Flex on Oracle Application Server 10g - security problems

Hi,
I'm working with Flex components (swf files), I'm trying to view them in a browser and i'm facing some security problems.
The server i'm trying to run the files on is: Oracle application server 10g on Unix server.
Please help me with the server's configuration to allow running swf files on it.
In the relation of Flex, there is a file that must be on the server's root named: "crossdomain.xml". This file defines which IPs can the swf object can take/get data from. Maybe there are configurations to that file that needs to be done on the server?
Thank you,
Inbal

No. Not only it isn't certified, but it is also impossible to run forms compiled with the 11g compiler with the 10g runtime. For 11g there is a install bundle for the developer suite / application server.
cheers

SSL test in Oracle Application Server 10.1.2

Hi ,
we are using one Oracle Application Server Web Cache 10.1.2 as our web server.This redirects users to the Application Server.(EBS 12.0.4)
Now we need to implement SSL to secure user credentials.So i am planing to implement SSL in our web cacahe server.Will this be enough to secure user credentials??I dont have any idea.Please help.
Moreover our web cache is not configured in SSL during the time of installation.Can any body suggest me a place from where i could get one demo Certificate to put it onto my web server and test the SSL confiration.EBS has provided one demo for application tier(inside $ORACLE_HOME/apache/certs/).
But we will have to implement in web cahe tier not in application tier.
We are using EBS 12.0.4 in Hp-Ux v11.23.

Hi susmit;
Please chekc below note which could be helpful for your issue:
SSL Primer on Using OpenSSL as a Certificate Authority with E-Business Suite (with a Windows Example) [ID 1175193.1]
Enabling SSL in Release 12 [ID 376700.1]
R12.0.6+ : Oracle Application Object Library SSL Test Transaction Data Test [ID 732282.1]
R12.0.[3-4] : Oracle Application Object Library SSL Test Transaction Data Test [ID 564066.1]
Regard
Helios

Client-cert auth impl in web.xml does not work in Oracle Application Server

Hi,
I am new to implementing security features on the web applications.. I have developed a new web service using jdev1012 and deployed in OAS 10.1.2. Its working fine according to the business requirements, but I am in need of implementing client-cert authentication to enable the web service available to only those who have client certificate.
My server details are:
Oracle Application Server 10g Release 2 (10.1.2)
Server certificate is in place and SSL mode have been already enabled.. able to access my web service through https://<mydomain.com>/myws/TreqWS as well able to see the WSDL file through https://<mydomain.com>/myws/TreqWS?WSDL.
I tried to include the following in my web.xml file as part of implementing CLIENT-CERT authentication.
<security-constraint>
<display-name>SecurityConstraint</display-name>
<web-resource-collection>
<web-resource-name>WSCollection</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>CLIENT-CERT</auth-method>
<realm-name>WSCollection</realm-name> 
</login-config>
It is not woking as expected, though I have restarted my oc4j container after including this content to the web.xml file. i.e, I am able to invoke the web service though my sample java client program, though I donot have client certificate/keystore.
I believe I am missing something..Can anyone help me in this regard to implement CLIENT-CERT authentication successfully?
Thanks,
Ms

I am having the same problem with doc and xsl. I have added this
<mime-mapping>
<extension>xls</extension>
<mime-type>application/vnd.ms-excel</mime-type>
</mime-mapping>
<mime-mapping>
<extension>doc</extension>
<mime-type>application/msword</mime-type>
</mime-mapping>
to my web.xml. I even restarted the server. I still see doc and xsl in binary.
Is there some other setting that needs to take place?
I am using WL6.1 with fixpack 1.
I can see the doc and excel files in the browser if I don't go through the weblogic
server. That just confirms it's not my browser.
Kumar Allamraju <[email protected]> wrote:
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
It works fine for me in 6.1 SP1.
 
If the following doesn't work , can you
 try application/winword instead of application/msword?
--
 Kumar
Siming Mu wrote:
<blockquote TYPE=CITE>Hi,
I setup in my web.xml a mime mapping as follows,
<mime-mapping>
 <extension>doc</extension><mime-type>application/msword</mime-type>
 </mime-mapping>
When I specify a test.doc url, the doc file appears in my browser
as
binary data
 instead of download.
Please reference change request 055002, which decribes this problem.
According
 to edocs, it has been fixed in wls6.1sp1.
But I am seeing it fixed. Am I doing anything wrong? Thanks.
Siming</blockquote>
</html>

Oracle Application Server 10g Release 2 (10.1.2.0.2) on 64bit RHEL

HI,
EBS-12.1.3
DB 11gR1
I am Facing following Error: while installing Oracle Application Server 10g Release 2 (10.1.2.0.2) on 64bit RHEL
pwd
pwd
/shared/bishiphome/Disk1/install/linux64
[oravis@erptest linux64]$./runInstaller -ignoreSysPreReqs
Starting Oracle Universal Installer...
Preparing to launch Oracle Universal Installer from /tmp/OraInstall2011-07-20_08-52-57AM. Please wait ...The Java RunTime Environment was not found at /tmp/OraInstall2011-07-20_08-52-57AM/jdk/jre/bin/java. Hence, the Oracle Universal Installer cannot be run.
Please visit http://www.javasoft.com and install JRE version 1.3.1 or higher and try again.
: No such file or directory
Should i install JRE in the Server
Thanks
Vishwa
Edited by: Vi**** on Jul 19, 2011 10:18 PM
Edited by: Vishwa on Jul 25, 2011 3:30 AM

HI,
Change the above to the following and see if you get any error:
$ /shared/bishiphome/Disk1/install/linux64/runInstaller ignoreSysPrereqs -jreLoc /usr/shared/bishiphome/Disk1/install/linux64/runInstaller ignoreSysPrereqs -jreLoc /usr
Starting Oracle Universal Installer...
Preparing to launch Oracle Universal Installer from /tmp/OraInstall2011-07-26_08-46-15AM. Please wait ...[oravis@erptest ~]$ Exception in thread "main" java.lang.ClassFormatError: oracle.as.install.engine.modules.install.exception.InvalidInventoryPointerException (unrecognized class file version)
at java.lang.VMClassLoader.defineClass(libgcj.so.7rh)
at java.lang.ClassLoader.defineClass(libgcj.so.7rh)
at java.security.SecureClassLoader.defineClass(libgcj.so.7rh)
at java.net.URLClassLoader.findClass(libgcj.so.7rh)
at java.lang.ClassLoader.loadClass(libgcj.so.7rh)
at java.lang.ClassLoader.loadClass(libgcj.so.7rh)
at oracle.sysman.oio.oioc.OiocOneClickInstaller.main(OiocOneClickInstaller.java:488)

How to use JavaMail 1.4 with Oracle Application Server 10g (9.0.4.0.0)

Hi all,
I'd like to know if it's possible and how to use JavaMail 1.4 with Oracle Application Server 10g (9.0.4.0.0), Windows version.
With the following code, I can see that the mail.jar used by the server is the one included in the jdk installation :
// I'm testing InternetAddress.class because I want to use commons-email-1.2.jar that requires mail.jar 1.4 (or higher) and activation.jar 1.1 (or higher)
// and I know that inside the commons-email-1.2.jar file, I need to call the InternetAddress.validate() method that throws a java.lang.NoSuchMethodError: javax.mail.internet.InternetAddress.validate()V if it is used with mail.jar 1.2.
Class cls = javax.mail.internet.InternetAddress.class;
java.security.ProtectionDomain pDomain = cls.getProtectionDomain();
java.security.CodeSource cSource = pDomain.getCodeSource();
java.net.URL location = cSource.getLocation();
System.out.println(location.toString());
This code returns : file:/C:/oracle/app/jdk/jre/lib/ext/mail.jar and this mail.jar file has an implementation version number: 1.2
- I've tried to include my own mail.jar (1.4.2) and activation.jar (1.1.1) files in the war file that I deploy, but it doesn't work (the server still uses the same mail.jar 1.2)
- I've tried to put the mail.jar (1.4.2) and activation.jar (1.1.1) files in the applib directory of my OC4J instance, but it doesn't work (the server still uses the same mail.jar 1.2)
- I know that a patch exists : I've read the following document: How to Make Libraries such as mail.jar and activation.jar Swappable ? [ID 552432.1]
This article talks about the Patch 6514136, but this patch only applies to : Oracle Containers for J2EE - Version: 10.1.3.3.0
Can you please help me ?
Thanks in advance for your answers,
Laurent

I strongly suggest to upgrade to AS 10.1.3 to get this.
Think of future support of AS 9.0.4. You will get not critical patch updates anymore.
--olaf

Configuring Oracle Application Server to use a user friendly url

Hi All,
I am having trouble configuring the apache httpd.conf file within an applicaton server to be able to use user-friendly urls for the infrastructure identity management tools server. I also need this for security reasons as well as hardware reasons - loadbalancing.
At the moment I have a standard setup, whereby the sso application server is using port 7777. I would like the user not to enter the port, but to enter just a standard url, like http://login.<company>.com.au, so that if the user needs to modify oid using the oiddas web application, they can enter something like http://login.<company>.com.au/oiddas/ rather than http://<machine host name>:7777/oiddas/. This would also be used by portal for sso logins.
From the standard installation, Apache was configured as follows:
Port 7777
Listen 7777
ServerName <machine host name>
DocumentRoot <root document folder>
Now reading the documentation from the Oracle Application Server Installation notes for the Http Server, they document how to do this (in the loadbalancer section - this will eventually be used in the hardware setup):
Port 80
Listen 7777
Listen 80
# Virtual Hosts
# This section is mandatory for URLs that are generated by
# the PL/SQL packages of the Oracle Portal and various other components
# These entries dictate that the server should listen on port
# 7777, but will assert that it is using port 80, so that
# self-referential URLs generated specify www.oracle.com:80
# This will create URLs that are valid for the browser since
# the browser does not directly see the host server.oracle.com.
NameVirtualHost <machine ip>:7777
<VirtualHost <nameofmachine>:7777>
ServerName login.<company>.com.au
Port 80
</VirtualHost>
# Since the previous virtual host entry will cause all links
# generated by the Oracle Portal to use port 80, the server.company.com
# server needs to listen on 80 as well since the Parallel Page
# Engine will make connection requests to Port 80 to request the
# portlets.
NameVirtualHost <machine ip>:80
<VirtualHost <nameofmachine>:80>
ServerName login.<company>.com.au
Port 80
<VirtualHost>
Note that I used slightly different names for the url's rather than the oracle names www.oracle.com and server.oracle.com
Now after applying this, I noticed not only could I not go to the oiddas from the original machine name, but also couldnt go there from the new machine name.
Also I was not even able to go to the standard index page whereby you can go to the enterprise manager for the application server, from either names.
The following urls provide me with "The Page Cannot Be Displayed" error message:
http://login.<company>.com.au:7777/
http://<nameofmachine>:7777/
The following urls provide me with "Page Under Construction" error message:
http://login.<company>.com.au/
http://<nameofmachine>/
Could someone please tell me why this is the case, considering I am using the installation procedures Oracle has published within the Oracle Http Server Admistrators Guide (http://download-west.oracle.com/docs/cd/B14099_19/web.1012/b14007/netconf.htm#sthref379).
Cheers
Rodney

Hi Rondey,
Ik think that I can see your probleem.
Just change the following line at your httpd.conf, then restart the component.
First of all if the port is installed with nr. 7777. then the listen process will be on port 7778
the second thing is just try to do the following steps
((Port 80 to Port 7777)))
Listen 7778
%%%% In loadbalancer section %%%%%%
just add the following lines
Listen 80
Listen 8103
Listen 8102
NameVirtualHost *
NameVirtualHost *:8103 or 80
If you want to use this ports (8103 or 8102) for other site (url), then
<VirtualHost *:80>
ServerName <machine ip> or (host name)
Hear from U,
Regards,
Hamdy

Data sources in deploying web app. to Oracle Application Server

I am using simple web application - JSP with BC4J (JDeveloper 9.0.5.1).
I want to configure my application to use Data Source instead of JDeveloper connection and deploy it to production database, so DB administrator will take care of username and password.
First, I create a new application module configuration that uses a data source instead of a JDeveloper connection with BC config. name TestAppModuleWithDS.
Then I modify my application client (DataBindings.cpx) to use the new configuration (TestAppModuleWithDS).
After that I create deployment profile and deploy to application server connection and try to test it on standalone server, and on production server together with my DBA.
But the application is not running, always displaying error messages...
Please what is the procedure and how to set Config of ApplModule.
It is working properly with embeded server, but on standalone server there is an error:
java.lang.UnsupportedClassVersionError: oracle/jdeveloper/cm/ConnectionDescriptor (Unsupported major.minor version 48.0)
 at java.lang.ClassLoader.defineClass0(Native Method)
 at java.lang.ClassLoader.defineClass(Unknown Source)
 at java.security.SecureClassLoader.defineClass(Unknown Source)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].util.OC4JSecureClassLoader.defineClassEntry(OC4JSecureClassLoader.java:172)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].naming.ContextClassLoader.defineClass(ContextClassLoader.java:1154)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].naming.ContextClassLoader.findClass(ContextClassLoader.java:390)
 at java.lang.ClassLoader.loadClass(Unknown Source)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].naming.ContextClassLoader.loadClass(ContextClassLoader.java:138)
 at java.lang.ClassLoader.loadClass(Unknown Source)
 at java.lang.ClassLoader.loadClassInternal(Unknown Source)
 at oracle.jbo.common.ampool.PoolMgr.createPool(PoolMgr.java:271)
 at oracle.jbo.common.ampool.PoolMgr.findPool(PoolMgr.java:473)
 at oracle.jbo.common.ampool.ContextPoolManager.findPool(ContextPoolManager.java:165)
 at oracle.jbo.http.HttpContainer.findSessionCookie(HttpContainer.java:817)
 at oracle.jbo.html.jsp.datatags.ApplicationModuleTag.doStartTag(ApplicationModuleTag.java:169)
 at lastcoil.jspService(_testjsp.java:52)
 [SRC:/testjsp.jsp:11]
 at com.orionserver[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].http.OrionHttpJspPage.service(OrionHttpJspPage.java:56)
 at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:349)
 at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:509)
 at oracle.jsp.runtimev2.JspServlet.service(JspServlet.java:413)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:765)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:317)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:790)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].server.http.HttpRequestHandler.run(HttpRequestHandler.java:270)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].server.http.HttpRequestHandler.run(HttpRequestHandler.java:112)
 at com.evermind[Oracle Application Server Containers for J2EE 10g (9.0.4.0.0)].util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:192)
 at java.lang.Thread.run(Unknown Source)
Application module in testjsp.jsp (_testjsp.java) is:
oracle.jbo.html.jsp.datatags.ApplicationModuleTag __jsp_taghandler_1=(oracle.jbo.html.jsp.datatags.ApplicationModuleTag)OracleJspRuntime.getTagHandler(pageContext,oracle.jbo.html.jsp.datatags.ApplicationModuleTag.class,"oracle.jbo.html.jsp.datatags.ApplicationModuleTag id configname releasemode");
__jsp_taghandler_1.setParent(null);
__jsp_taghandler_1.setId("TestAppModule");
__jsp_taghandler_1.setConfigname("test.TestAppModule.TestAppModuleWithDS");
__jsp_taghandler_1.setReleasemode("Stateful");
__jsp_tag_starteval=__jsp_taghandler_1.doStartTag();
if (OracleJspRuntime.checkStartTagEval(__jsp_tag_starteval))
DataBindings.cpx is configured like this:
?xml version='1.0' encoding='windows-1252' ?>
<JboProject
id="DataBindings"
xmlns="http://xmlns.oracle.com/adfm/application"
version="9.0.5.15.88"
SeparateXMLFiles="false"
Package=""
ClientType="JClient" >
<Contents >
<DataControl
id="TestAppModule"
SubType="DCBC4J"
SupportsFindMode="true"
SupportsTransactions="true"
Package="test"
FactoryClass="oracle.adf.model.bc4j.DataControlFactoryImpl"
Configuration="TestAppModuleWithDS" >
<Parameters >
<Parameter
name="Sync"
value="Batch" >
</Parameter>
</Parameters>
</DataControl>
</Contents>
</JboProject>
D:\JDeveloper10\j2ee\home\config\data-sources.xml je:
<?xml version="1.0" standalone='yes'?>
<!DOCTYPE data-sources PUBLIC "Orion data-sources" "http://xmlns.oracle.com/ias/dtds/data-sources.dtd">
<data-sources>
 
 <data-source
 class="com.evermind.sql.DriverManagerDataSource"
 name="OracleDS"
 location="jdbc/OracleCoreDS"
 xa-location="jdbc/xa/OracleXADS"
 ejb-location="jdbc/OracleDS"
 connection-driver="oracle.jdbc.driver.OracleDriver"
 username="scott"
 password="tiger"
 url="jdbc:oracle:thin:@localhost:5521:oracle"
 inactivity-timeout="30"
 />
 <data-source
 class="com.evermind.sql.DriverManagerDataSource"
 name="TestAppModuleWithDS"
 location="jdbc/hmlCoreDS"
 xa-location="jdbc/xa/hmlXADS"
 ejb-location="jdbc/hmlDS"
 connection-driver="oracle.jdbc.driver.OracleDriver"
 username="user1"
 password="psw1234"
 url="jdbc:oracle:thin:@server.com:1521:sidname"
 inactivity-timeout="30"
 />
D:\HotStripMill Projects\bc4j\src\lastcoil\common\bc4j.xcfg
<?xml version = '1.0' encoding = 'UTF-8'?>
<BC4JConfig>
<AppModuleConfigBag>
<AppModuleConfig name="TestAppModuleWithDS">
<DeployPlatform>LOCAL</DeployPlatform>
<JDBCDataSource>jdbc/hmlCoreDS</JDBCDataSource>
<jbo.project>bc4j</jbo.project>
<AppModuleJndiName>test.TestAppModule</AppModuleJndiName>
<java.naming.factory.initial>oracle.jbo.common.JboInitialContextFactory</java.naming.factory.initial>
<ApplicationName>test.TestAppModule</ApplicationName>
</AppModuleConfig>
</AppModuleConfigBag>
<ConnectionDefinition name="hml">
<ENTRY name="JDBC_PORT" value="1521"/>
<ENTRY name="ConnectionType" value="JDBC"/>
<ENTRY name="HOSTNAME" value="server.com"/>
<ENTRY name="user" value="user1"/>
<ENTRY name="ConnectionName" value="hml"/>
<ENTRY name="SID" value="sidname"/>
<ENTRY name="JdbcDriver" value="oracle.jdbc.driver.OracleDriver"/>
<ENTRY name="password">{904}05437B2C11AE10318B521E7C6EE279666E</ENTRY>
<ENTRY name="ORACLE_JDBC_TYPE" value="thin"/>
<ENTRY name="DeployPassword" value="true"/>
</ConnectionDefinition>
</BC4JConfig>
</data-sources>
Thanks!

iAS 1.0.x is StoneAge Technology (TM).
Using the E-Business Suite you should look into the newer versions of the Application Server. I believe that 10.1.2.x supports the EBS, otherwise 9.04 should do the trick. Webservice support is much better in the newer versions. 1.0.x is from around 2000/2001 so the Webservice technology back than was "different" :-)
cu
Andreas

Oracle Application Server 10g Disaster Recovery

Hi all,
This is regarding Disaster Recovery approach for Oracle Application Server 10g. There are two environments Active (DC-PROD) and Stand-By (DR-PROD). Each environment have 2 nodes where OAS Instances are installed in both nodes and each environment has a Virtual Hostname (Virtual IP) used. The 2 nodes hostnames of DC-PROD environment differs from 2 nodes of the other environment DR-PROD.
However the Virtual Hostname is same between two environments.
The env DC-PROD is setup already and is working fine. Now we have to setup DR-PROD env for disaster Recovery purpose. DR-PROD is also setup independently from DC-PROD. Each env has seperate DB servers in RAC mode. We are using EMC SRDF replication technology to do DB replication between DC-PROD and DR-PROD environments.
There is no disk replication between Oracle Application Servers of two environments DC-PROD and DR-PROD. DC-PROD is NOT setup using Oracle AS Guard for some reasons and we are in a situation that DC-PROD should not be touched at all.
So if the Database is replicated from DC-PROD to DR-PROD servers using EMC SRDF replication technology, while bring up OAS Infra services in DR-PROD node, OC4J is failing to come up. After some workarounds, OC4J cameup but we are unable to login to OIDDAS console.
ssoServer.log shows the following: -
Mon May 30 11:01:23 IST 2011 [DEBUG] AJPRequestHandler-ApplicationServerThread-8 DatabaseConfigReadergetting partner apps configs: select site_id, site_token, site_name, home_url, success_url, logout_url, encryption_key, encryption_mask_pre, encryption_mask_post, start_date, end_date, administrator_id, administrator_info from wwsso_papp_configuration_inf_t where site_id = '06B9F06C'
Mon May 30 11:01:23 IST 2011 [DEBUG] AJPRequestHandler-ApplicationServerThread-8 Partner Site ID: 06B9F06C
Mon May 30 11:01:23 IST 2011 [DEBUG] AJPRequestHandler-ApplicationServerThread-8 exception before getAuthLevel
oracle.security.sso.server.conf.ConfigurationException: Partner application configuration not found:06B9F06C
at oracle.security.sso.server.conf.DatabaseConfigReader.getPartnerConfiguration(DatabaseConfigReader.java:143)
Please provide us the inputs to achieve Disaster Recovery for OAS 10g without using Oracle AS Guard.
This is very urgent and your inputs are greatly appreciated.
Regards,
Mahendra.

Another point to add for the environment details. Both DC-PROD and DR-PROD environments does not have connectivity at all. Only the DB connectivity is there for doing DB replication.
EMC SRDF replication technology is a block by block replication i.e., a disk replication. Hope these details are sufficient for environment specifications.

How to convert HTTP to HTTPS in Oracle Application Server 10g(10.1.3)

Can you please suggest notes to convert HTTP to HTTPS in Oracle Application Server 10g(10.1.3) as we need this to integrate the custom apps with EBS(12.1.3)?
Appreciate your quick response,
RM

For Oracle EBS R12, the docs provided above should be helpful. If you want to configure the application server with SSL (assuming you have 10gAS installed), please refer to Oracle AS10g documentation -- Secure Sockets Layer (SSL)
Oracle Application Server 10g Release 3 Documentation
http://www.oracle.com/technetwork/middleware/ias/documentation/index.html
Secure Sockets Layer (SSL)
http://download.oracle.com/docs/cd/B25221_04/core.1013/b25209/part4.htm#BEHBDFGD
Thanks,
Hussein

[XI 3.1] Deployment problems to Oracle Application Server

Hello everybody.
I'm new on BO products, and i have problems with installation on Oracle Application Server 10.1.3
BuildVersion=12.1.0.882.BOE_Mira_RTM
I have success installed OAS 10.1.3 (with patch 10.1.3.3.0), and when i'm installing BO following documentation, after installation no any BO applications in OAS found. This is first.
Then i attempt install BO applications (CmcApp, AdminTools, etc...) manualy... I have success installation of CmcApp, but when try it to run, i get error ([logon_error_attach|http://www.sendspace.com/file/u8gyoj]), page with logo BO, but logon form (logon.faces) could't be found... i think *.faces on OAS does not work/support, it must be something like *.jsp, *.jspx, but not *.faces, or i must configure OAS in special way.
Any suggestions?
Thanks, Evgeny.
Spasibo)
p.s. With Tomcat which comes with BO all works fine.
from documentation
To use a Java web application server, select Java Web Application
Server and choose one of the following options:
Automatically deploy to a pre-installed Web Application Server.
This will prompt you to enter the configuration and authentication
information on the next screen.
Admin is Secure?: Select this option to use Secure Sockets Layer (SSL) encryption for authentication.
Note:
If Admin is Secure? is not selected, you will still have to specify the username and password to access the server.
u2022 Port: Administration port of the application server (for example u201C6003u201D). This should be the request port of the <notification-server> element in the opmn.xml file.
u2022 Username: User with administration rights to the application server.
u2022 Password: Password for account with administration rights to the application server.
u2022 Server Instance: Name of the Oracle Application Server application server instance (for example u201Chomeu201D).
u2022 Server Name: Name of the target application server (for example, u201Cmyserver.domain.comu201D).
u2022 Group Id: Name of the server group to which the target application belongs (for example "Default_group").
u2022 Application Server Installation Directory: The directory where the web application server is installed
(for example C:\product\10.1.3\OracleAS_1).

Thanks, guys for reply.
To Denis Konovalov: Привет! Есть один срочный вопрос, не мог-ли бы ты мне на него ответить. если есть возможность, напиши, пожалуйста, на evgeny (точка) shekalev (собака) гмэйл.ком (защита стоит - не разрешают общаться ) - p.s. куда приятней общаться на родном) p.p.s. обещаю, сильно мучать не буду ))

Patching Oracle Application Server

Hi, I'm trying to patch my Oracle Application Server that's going to be running a PeopleSoft softare installation. I've been having trouble making sure I have all the patches I need. I'm running version 10.1.3.1 of the Oracle Application Server. I downloaded the patches recommended by the PeopleSoft guides and the latest security patch supported by version 10.1.3.1. If your wondering why I'm using such an old version, it's simply because its the latest version the PeopleSoft guiddes certify as supported.
So I have these patches, and I searched on metalink for Oracle Application Server, iAS version 10.1.3.1.0 and there were no other recommended patches. However, I notices the patches I already installed weren't under the list of patches for OAS, not even when I searched under classification any. That's when I realized that the patches that PeopeSoft recommends are listed under Containers for J2EE version 10.1.3.1.0, which is why it wasn't coming up in the search. Now I thought Containers for J2EE were part of the Oracle Application Server, so why don't patches for it show up when I simply search for OAS patches? Is there any was to find all the recommended patches for all software that was installed with OAS? I feel like I may be missing important patches
One wrinkle is that I used the SOA 10.1.3.1.0 CD to install OAS, but I used the option for "J2EE Server and Web Server" without installing the SOA appllications. The only reason I did this was again because this is how the PeopleSoft install guide showed installing OAS.
Thanks

Dont worry about not install the SOA products, because you dont need them, at the end the patches will upgrade only the necesary.
You may try to dowload 10.1.3.4 patch, it include the previus patches and newers.
Regards

Start Oracle Application Server in Debug mode

We have oracle application server 10g with oc4j. How do we configure App server to start in debug mode so remote debugging from different machine can be done.
I am new Oracle Application Sever. OC4j is java container and it starts automatical when ORacleAServer starts.
Thanks,
MS

MadanShah, how did you start Oracle Application server? Let us say, you start it with opmnctl. In order to do java remote debugging with the oc4j process inside the OAS, you have to add the java remote debugging option to the "java-options" in the $ORACLE_HOME/opmn/config/opmn.xml.
<ias-component id="OC4J">
<process-type id="home" module-id="OC4J" status="enabled">
<module-data>
<category id="start-parameters">
<data id="java-options" value="-Xdebug -Xnoagent -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5050 -Xrs -server -Djava.security.policy=$ORACLE_HOME/j2ee/home/config/java2.policy -Djava.awt.headless=true"/>
</category>
The "-Xdebug -Xnoagent -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5050" is what I added. After starting OAS, you can connect to the oc4j process by selecting port 5050 using a java remote debugger that is included in any major IDE, like Jdeveloper. For more information, search for "remote debug" in the online help of Jdeveloper.

Oracle Application Server crashes due to Socket Write Error

I am using Oracle Application Server 9.0.3. Simple JSP application is running on it. We are using the application server connection pooling functionality. Following errors are occuring on it frequently and it causes the application server crash.
First application response gets slow and eventually application server gets lock and it wont respond and we have to restart the application server. Our application is in production mode and we need to solve this issue immediately.
----------------Error1---------------------
com.evermind.server.http.HttpIOException: Connection aborted by peer: socket write error
     at com.evermind.server.http.EvermindServletOutputStream.write(EvermindServletOutputStream.java:249)
     at com.evermind.server.http.EvermindJSPWriter.writeOut(EvermindJSPWriter.java:424)
     at com.evermind.server.http.EvermindJSPWriter.jspflush(EvermindJSPWriter.java:341)
     at com.evermind.server.http.EvermindJSPWriter.write(EvermindJSPWriter.java:490)
     at com.evermind.server.http.EvermindJSPWriter.write(EvermindJSPWriter.java:415)
     at schedule.schedulehome._jspService(_schedulehome.java:542)
     at com.orionserver.http.OrionHttpJspPage.service(OrionHttpJspPage.java:56)
     at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:317)
     at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:465)
     at oracle.jsp.runtimev2.JspServlet.service(JspServlet.java:379)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:65)
     at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:283)
     at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:560)
     at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:306)
     at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:767)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:148)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:72)
     at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:803)
     at java.lang.Thread.run(Thread.java:479)
------------Error2---------------------
com.evermind.server.http.HttpIOException: Connection aborted by peer: socket write error
     at com.evermind.server.http.EvermindServletOutputStream.write(EvermindServletOutputStream.java:249)
     at com.evermind.server.http.EvermindJSPWriter.writeOut(EvermindJSPWriter.java:424)
     at com.evermind.server.http.EvermindJSPWriter.jspflush(EvermindJSPWriter.java:341)
     at com.evermind.server.http.EvermindJSPWriter.write(EvermindJSPWriter.java:490)
     at com.evermind.server.http.EvermindJSPWriter.write(EvermindJSPWriter.java:415)
     at schedule.schedulehome._jspService(_schedulehome.java:557)
     at com.orionserver.http.OrionHttpJspPage.service(OrionHttpJspPage.java:56)
     at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:317)
     at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:465)
     at oracle.jsp.runtimev2.JspServlet.service(JspServlet.java:379)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:65)
     at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:283)
     at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:560)
     at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:306)
     at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:767)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:148)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:72)
     at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:803)
     at java.lang.Thread.run(Thread.java:479)

I am using Oracle Application Server 9.0.3. Simple JSP application is running on it. We are using the application server connection pooling functionality. Following errors are occuring on it frequently and it causes the application server crash.
First application response gets slow and eventually application server gets lock and it wont respond and we have to restart the application server. Our application is in production mode and we need to solve this issue immediately.
----------------Error1---------------------
com.evermind.server.http.HttpIOException: Connection aborted by peer: socket write error
     at com.evermind.server.http.EvermindServletOutputStream.write(EvermindServletOutputStream.java:249)
     at com.evermind.server.http.EvermindJSPWriter.writeOut(EvermindJSPWriter.java:424)
     at com.evermind.server.http.EvermindJSPWriter.jspflush(EvermindJSPWriter.java:341)
     at com.evermind.server.http.EvermindJSPWriter.write(EvermindJSPWriter.java:490)
     at com.evermind.server.http.EvermindJSPWriter.write(EvermindJSPWriter.java:415)
     at schedule.schedulehome._jspService(_schedulehome.java:542)
     at com.orionserver.http.OrionHttpJspPage.service(OrionHttpJspPage.java:56)
     at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:317)
     at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:465)
     at oracle.jsp.runtimev2.JspServlet.service(JspServlet.java:379)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:65)
     at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:283)
     at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:560)
     at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:306)
     at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:767)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:148)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:72)
     at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:803)
     at java.lang.Thread.run(Thread.java:479)
------------Error2---------------------
com.evermind.server.http.HttpIOException: Connection aborted by peer: socket write error
     at com.evermind.server.http.EvermindServletOutputStream.write(EvermindServletOutputStream.java:249)
     at com.evermind.server.http.EvermindJSPWriter.writeOut(EvermindJSPWriter.java:424)
     at com.evermind.server.http.EvermindJSPWriter.jspflush(EvermindJSPWriter.java:341)
     at com.evermind.server.http.EvermindJSPWriter.write(EvermindJSPWriter.java:490)
     at com.evermind.server.http.EvermindJSPWriter.write(EvermindJSPWriter.java:415)
     at schedule.schedulehome._jspService(_schedulehome.java:557)
     at com.orionserver.http.OrionHttpJspPage.service(OrionHttpJspPage.java:56)
     at oracle.jsp.runtimev2.JspPageTable.service(JspPageTable.java:317)
     at oracle.jsp.runtimev2.JspServlet.internalService(JspServlet.java:465)
     at oracle.jsp.runtimev2.JspServlet.service(JspServlet.java:379)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:65)
     at oracle.security.jazn.oc4j.JAZNFilter.doFilter(JAZNFilter.java:283)
     at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:560)
     at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:306)
     at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:767)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:148)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:72)
     at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Worker.run(PooledExecutor.java:803)
     at java.lang.Thread.run(Thread.java:479)

Ipv6 + oracle application server 10.1.3.3

Hi,
Installed oracle application server 10.1.3.3 on hpux 11.31. I want to access through IPV6 address like http://[ipv6]:7777. what i have to do to access through ipv6 address. i tried by specifying <category id="start-parameters">
<data id="java-options" value="-server -Djava.security.policy=$ORACLE_HOME/j2ee/home/config/java2.policy -Djava.awt.headless=true -Dhttp.webdir.enable=false -Xms512M -Xmx1024M -XX:MaxPermSize=128M -XX:AppendRatio=3 -Djava.net.preferIPv4Stack=false -Djava.net.preferIPv6Addresses=true"/>
</category>
Even this also did not help.
Any suggestion, Thanks in advance

Assuming you're wanting to front OC4J with OHS/Apache, for IPv6 support you'll need to install Apache 2 from the companion CD. Make sure it is still listening on an IPv4 address too though for the OPMN ping (otherwise OPMN will think it's dead - see other OTN threads for discussions).
You'll have to check OC4J support for IPv6. You may have to front the application with Apache running an IPv6 address but pass it back to an IPv4 address for OC4J.
Either way, if IPv6 isn't a firm requirement you might find you might find things easier for yourself if you can stick with IPv4 throughout for a year or two.

Security Evaluation of Oracle Application Server

Similar Messages

Maybe you are looking for