Shared Services Mixed Native-MSAD group nesting

Is anyone doing this?
I am trying to make an MSAD group a member of a native group using shared services and after adding the MSAD group, the console errors out for the group i just made whenever trying to view the group members. This is repeatable and happens before i have even provisioned the parent group when i am trying to view the group members.
When i nest a native group inside another native group, it works fine.
In the SharedServices_Security.log found in Oracle/Middleware/user_projects/domains/EPMSystem/servers/FoundationServices0/logs
I see the following stack trace:
[2010-12-14T09:09:22.156-06:00] [FoundationServices0] [ERROR] [EPMCSS-7019] [oracle.EPMCSS.CSS] [tid: 7] [userId: <anonymous>] [ecid: 0000In_RR_eDKeoLwUg8yW1D1Yoh00001G,0] [APP: SHARE
DSERVICES#11.1.2.0] [SRC_METHOD: execute:129] [SRC_CLASS: com.hyperion.css.web.action.CSSStatefulAction] Failed to process the request.
[2010-12-14T09:16:16.365-06:00] [FoundationServices0] [NOTIFICATION] [EPMCSS-17306] [oracle.EPMCSS.CSS] [tid: 7] [userId: <anonymous>] [ecid: 0000In_T0hhDKeoLwUg8yW1D1Yoh00001J,0] [AP
P: SHAREDSERVICES#11.1.2.0] [SRC_METHOD: ] [SRC_CLASS: ] [arg: native://nvid=af1814bfd20d7272:58ecdd0:12ce020823f:-7f66?GROUP] x
[2010-12-14T09:16:17.473-06:00] [FoundationServices0] [ERROR] [EPMCSS-37000] [oracle.EPMCSS.CSS] [tid: 8] [userId: <anonymous>] [ecid: 0000In_T0z1DKeoLwUg8yW1D1Yoh00001K,0] [APP: SHAR
EDSERVICES#11.1.2.0] [SRC_METHOD: execute:128] [SRC_CLASS: com.hyperion.css.web.action.CSSStatefulAction] Error while processing the request.[[
java.lang.NullPointerException
at com.hyperion.css.web.util.DTOFactory.createGroupDTO(DTOFactory.java:49)
at com.hyperion.css.web.util.DTOFactory.createGroupDTOEscDoubleQuote(DTOFactory.java:75)
at com.hyperion.css.web.action.EditGroupAssignGroupsFormAction.executeAction(EditGroupAssignGroupsFormAction.java:109)
at com.hyperion.css.web.action.CSSStatefulAction.execute(CSSStatefulAction.java:119)
at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421)
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:415)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3594)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2202)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2108)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1432)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
I think its a bug and have opened an SR with oracle, but i'm curious what others out there are doing.
Edited by: Javanator on Dec 14, 2010 10:25 AM

Hi Dear
Is this issue resolved? i too get the similar error in the log file . Please let me know if it is reolsved for you

Similar Messages

Shared Services Users Disappear from Groups

We have Native Groups in Shared Services that we added users from our MSAD directory to. Yesterday we found that the groups no longer have these users in them and IT did say they did some moves in the directory over the weekend. But I'm wondering if that would really cause SS to drop all the users from the groups like this.
Basically, no one is able to log in although we are testing adding users back to the groups and think that's working.
I just don't want to have to re-create our groups anytime our MSAD is updated.
I'd appreciate any help in understanding this better,
Paul

Our MSAD administrators moved some OU's around one day and it caused a lot of problems for us since our Shared Services MSAD configuration setting for "User DN" had all the OU's hard coded or what have you. I had to change them to the same that the AD folks had changed them to, then restart everything.
So on the native side I can see how if they moved OU's around that could throw off what you had done. There's a utility which I've been too scared to use (probably harmless but I can't afford any mishaps) which tells Shared Services to search for MSAD changes and to force them through Shared Services, which is probably a nice thing to do once in a while especially when MSAD OU's are moved around. SS does not automatically poll for that type of change but you should be able to automate this.
There's an updatenativedir utility that you can read up on which might help. Don't forget to do backups first of all the security-related databases & files, etc. first.
Perhaps someone reading this is comfortable running UPDATENATIVEDIR and can help provide better guidance, if that's the issue here.
Karen

Shared Services: Multi-domain MSAD based configuration issue

Hello to All,
Can someone tell me how to configure MSAD to use two domains X and Y under one user directory D.
My actual configuration is based on the domain X and provides some MSAD users groups in D user directory.
But I need to provisionne another user that belong to another AD in a foreign domain Y.
A trusted relationship (approbation relationship) have been created between the two domains X and Y.
Is this kind of multi-domain configuration allowed in Shared Services?
If yes, how can I configure this?
OS: Solaris
Hyperion Shared Services 9.3.1
Thanks in advance for your help

There are a couple of ways:
1) Add a new provider in Shared Services
2) Modify your current provider to go to a higher level in your domain which will likely require different parameters on your existing Active Directory provider
Option 2 is preferable if you see this will cascade and other domains will be needed and they are all under a global company domain.
Regards,
John A. Booth
http://www.metavero.com

Shared Services hangs after MSAD configuration (9.2.0.2)

Hi all,
I am trying to configure MSAD with shared services. I successfully add the MSAD domain and then add it to the search order, being number 2 after native. I then restart HSS. When I go to open HSS or the framework login the whole thing just hangs. HSS does always start correctly. For testing purposes I am restoring the CSS file each time. I have tried 3 different user accounts so I doubt it is a permissions issue.
I have also tried configuring the MSAD domain, restart HSS, then adding it to the search order and restarting HSS. It made no difference.
Has anyone seen this before? The same domain has been added to a different instance of HSS on another server (DR) so I can't understand why it is hanging.
Many thanks in advance,
Nathan

After extensive testing with Oracle Hyperion the root cause was runnong HSS as a service following the configuration with MSAD. The config framework page displayed 9.2.0.2 as the version when it was actually 9.2.0.3 as confirmed by the HSS console. Apparently this problem can happen in 9.2.0.3.
Just thought I'd let you know the solution.
Nathan

Shared Services issue with MSAD

Hi, I recently configured shared services to authenticate to a remote MSAD server. the configuration went well and all the users in the remote MSAD came thru to the shared services, and I can even provision the new users.
however, after the provisioning, no new users can login to the apps that were provisioned for them, there's always the authentication error.
p.s. there's already a working MSAD domain on shared service. I ran into the issue when I tried to configured a second one.
thanks

Hi
In shared service web interface, you will find in the top menu "synchronize external directory" or something like that.
Laurent

Migrate the users, groups from essbase 7.1.6 to shared services

Hi
Our current production is essbase version 7.1.6 and we are planning to migrate to EPM 11.1.2 . We would like to move the security administration from Essbase to Shared Services (want to use Native Directory).
can somebody please suggest
1) An utility that Oracle provides with EPM 11.1.2 that helps to migrate the users and groups from 7.1.6 to shared services?
2) After bringing the users groups from 7.1.6 to 11.1.2, do we need to externalize these users and groups or no need?
Appreciate the help. Thanks,

if you have LDAP/MSAD try to configure it first .That will get your users
Now using maxl
spool on to GROUP.txt
display gruoup all;
spool on to USER.txt
display user in group all;
for test purpose create a test group and a test user from the shared services.
Now using GROUP.txt
make up maxl statements to create groups(use any advanced text editor or MS excel to get your work done fast)
create group 'groupname';
now login into that shared services
go to FOundation Application group->click sharedservices->drop down native directory ->Right click on Groups and select export for edit.THat will save you Groups.csv file.
Now
1.Open that Groups.csv file
2.Using USER,txt ,paste the users in that file under their respective group.(Look for test group created that should give you an idea!!!)
3.Paste user correctly and save it to the same file Groups.csv
4.go to FOundation Application group->click sharedservices->drop down native directory ->Right click on Groups and select IMPORT for edit.
5.that will get your users into the groups.
________filters_______
Using maxl again
spool on to FILTER.txt
display filter row all;
spool on to GRPRIVILEGE.txt
display privilege group all;
Now using FILTER.txt
create maxl statements
(use any advanced text editor or MS excel to get your work done fast)
Ex: create filter app.database.filtername read/write/none/metaread on 'AREA ' ;
Using GRPRIVILEGE.txt
create maxl statements
grant filter app.databse.filtername to 'groupname';
that should get your filters created and assigned.
else you can use Advanced Security Manger
http://www.appliedolap.com/free-tools/advanced-security-manager
hope that should give you an idea!!!!!!!

Intermittent Workspace/Shared Services issue - 11.1.2.1

All
Version 11.1.2.1
Using Shared Services with Native (1) and MSAD (2) ; IDs are members of Native groups which are provisioned to the application
We are experiencing an intermittent problem in Workspace where one day we can login without issue, and the next, we are stuck at “Authenticating User..” for a long time before login finally fails with:
“EPMCSS-00387: Failed to authenticate user xxxxxxx from user directory MSAD. Invalid password. LDAP response read timed out, timeout used: 120000ms..Enter valid credentials.”
More details shows ”URI: http://.....:19000/workspace/login
Code: 1000
Description: An error occurred processing the result from the server”
Alternately, sometimes login will succeed, but will receive the message:
“The startup document does not exist in the repository. Select a new startup document in the General preferences tab”.
We have opened an SR with Oracle but can’t seem to make much progress resolving the issue. Any ideas?

Hi,
Did you ever get to the bottom of this? We are on 11.1.2.1 and facing the exact same issue when logging on to HSS or Workspace:
EPMCSS-00387: Failed to authenticate user sebastien.lejarle from user directory EXWC. Invalid password. LDAP response read timed out, timeout used:120000ms.. Enter valid credentials.
We cant figure out what s wrong.
We have applied Oracle's recommended IE 7 and IE8 settings to no avail.
Thanks again.
Seb

Reg: Hyperion Upgradation from 7.1.x to 9.3.x and Shared Services...

Hi Everybody,
New to this forum and i want to know about upgrading the essbase from 7.1.x to 9.3.x...As i gone through PDF, it is mentioning as upgrading of 9.3.x from earlier versions prior to release 9.2.x cannot be done directly...Here comes with the migration/upgradation topic wherein... Can we go ahead and install essbase 9.3.x on new box and migrate app's / db's from 7.1.x old box?
One more thing is like...if we are using External authentication using LDAP in 7.1.x version for security....will it be mandatory to implement shared services separately in system 9 or continue with native security mode without installing shared services...I have only essbase and no other tools implemented...
Hope u guys understand my queries!...If any body can explain on these two aspects...will be of great help to me...
Thanks for the help in advance!!

Hi,
You will have to migrate the Essbase server from 7.1.2 to 9.3.1
The steps you will follow are as below: --
1. Configure Essbase on new environment, 9.3.1 by using the same user as on 7.1.2 [THIS IS AN IMPORTANT STEP, TO MIGRATE SECURITY]
1. Take data exports of all application/databases in old environment
2. Take backups of all Essbase objects, including essbase.sec in old environment. Take security file backup after stopping Essbase 7.1.2
3. Create the applications/databases with same name in new environment 9.3.1
4. Copy the outlines and open outline in EAS in 9.3.1 and save them again.
5. Copy all objects, rules, reports, calc for all applications.
6. Stop essbase, Eas in new environment and copy security file from old environment to new environment Take backup of Essbase.sec on new environment
7. Start Essbase 9.3.1
8. Validate all databases using Esscmd "validate" command
9. Reimport all data and run default calc on all applications.
10. Now, you have the security in new Essbase server, as in old environment
11. Externalize the security in EAS.
Caution: When you migrate to Shared Services, Essbase users and groups are converted to equivalent roles
in Shared Services. Shared Services creates a superuser with the user ID named “admin,” which
is read-only. If Essbase contains a user ID named “admin”, that user ID cannot be migrated to
Shared Services. Before migrating, change the “admin” user ID (for example, from “admin” to
“asadmin”).
It is not compulsory to use shared services with Essbase 9.3.1, if you have Essbase only.
but since it the way to go, you will have to migrate your essbase security to shared services.
Let me know if it helps, by defining the reply as answered, Helpful or correct.
Cheers
RS

Problem assigning Essbase Security filters in Shared Services

We recently upgraded Planning/Essbase to System 9 version 931 in Test. Everything went smoothly except for few users Security didn't migrate properly.
In Shared Services, it shows that user has access to Planning & Native Essbase Applications. But in Essbase, only Planning Application access is shown.
Also when I try to apply security filters for these users in Native Essbase Applications (in Shared Services), I don't see these particular users.
There is no problem with Planning security, except when I refresh Security from Shared Services in Analytic Admin Console it wipes out Planning Application access in Essbase.
For other users there are no issues. Only for few users this is the problem. I have tried to deprovision user & provision back, but no use.
Please Help

Essbase/Planning security is multi tiered. In Shared Services you setup your groups. You provision your groups with adequate security access. Depending on whether you have updated a cetain .css file(to fix bug) you may have to assign the read, write calc access to the group not just calc, but all three if your users need the access to actually, read, write & calc. of need user to just read & write etc... then you have to go to EAS refresh, run maxl script to assign environment access to user, go back to shared services go into projects assign any needed access to calc & filter groups and essbase is setup. For planning you also have to go to workspace and migrate identities within the security setup for any of your dimensions. this comes into play when adding or removing users as filters are created in planning workspace. I just learned this from one good tech that helped me setup & remove users as I had issues getting them in and out of the system..Now to move on to actually getting security reports that make sense for planning with the associated access. If anyone has the maxl code let me know.

Shared Services External Authentication using LDAP in 9.3.1

Hi,
I have installed Hyperion Shared Services with native directory. And now planning to setup external authentication using LDAP. I need some guidance to understanding how the external authentication works.
Questions:
1. Is it possible to setup Shared Services to use both Native and LDAP user directory? What I mean is some users will be able to login using Native directory, and some others will need to login using User Directory (external authentication).
2. For User Directory (say we use LDAP), when the user is added into Shared Services, can they be assigned with Groups created in Native directory? We want to explore to use just the external authentication and define all of the groups within shared services.
If not possible, can we manage the Groups of the User directory using shared services? How is the groups work with external authentication?
Any feedback would be much appreciated.
Thanks,
Lian

Hi,
Yes you can use both Native and external authentication. When you add the external provider the native is left by defaut anyway.
Yes you can add your external users to native groups. You can also provision the groups in the AD if you wish.
Gee

Unable importing Shared Service artifacts from 11.1.1.3 to 11.1.2.1 thr LCM

Hi all ,
I am trying to migrate Financial Reporting from 11.1.1.3 to 11.1.2.1 using LCM. I have exported Shared Services & Reporting-Analysis data via LCM utility.
While importing the same through File System in 11.1.2.1 , I am getting errors related to Groups, Users import
            /Native Directory/Assigned Roles/Essbase:<11.1.1.3 servername>:1
           EPMIE-25029: Invalid project Essbase:<11.1.1.3 servername>
           /Native Directory/Assigned Roles/Foundation : Error : EPMIE-25026: Failed to import all of the provisioning info. Invalid product type/role for application Shared Services.
            /Native Directory/Assigned Roles/Planning: Error : EPMIE-25029: Invalid project Planning.
         What part of the 11.1.1.3 exported files need to be edited/modified before importing into 11.1.2.1 ?
Please help if you have any suggestions & other ways of migrating Financial Reporting from 11.1.1.3 to 11.1.2.1
Thanks in advance,
Santy.

Its Possible. You have to make changes in exported files according to 11.1.2.1 way. Probably John knows about the same.
Thanks,
Santy

Register with Shared Services Failing in 11.1.1.3

Hi,
We installed 11.1.1.3 in Linux operating system and the application server is Websphere 6.1.After Installation and Configuration of EPM products we Externalized users from EAS Console and configured Active Directory in Shared Services and now want to migrate users of Existing Production environment to new Environment.For that created a new testgroup in Shared Services under Native Directory and when I am refreshing it's displaying an error as shown below:
Essbase failed to get roles list for [ESB:Analytic Server] from Shared Services Server with Error [32:1062:Failed to connect to the user directory [msadServer]
Can anyone suggest on this.
Any help is appreciated...

This usually happens when the application exists in Essbase but does not exist in Shared Services.
To resolve this you need to go into the AAS console, right click on the Sample application and select the 'REGISTER' option.
This will register the application with Shared Services. You should then see the application listed in Shared Services under the Analytic Server project.
You will need to make sure that the list of applications in the Analytic Server matches the list of applications under the project in Shared Services. If you have any other applications missing then please register those as well.
HTH-
Jasmine.

Hyperion Shared Services URL

Hi,
I'm new in setting up and installing the Hyperion product as well as web server concept. I managed to setup Hyperion shared services using LDAP/MSAD and able to login into the Hyperion Shared Services but not able to login into Hyperion workspace. I realized that the URL for Hyperion Shared Services still on port 58080 while the current port is 50000. I tried to update the instanceconfig.xml file as well as the css.xml file (correct me if i'm wrong) but the port still goes to 58080. any idea how to resolve this? any help really appreciated.

Hi,
I'm new in setting up and installing the Hyperion product as well as web server concept. I managed to setup Hyperion shared services using LDAP/MSAD and able to login into the Hyperion Shared Services but not able to login into Hyperion workspace. I realized that the URL for Hyperion Shared Services still on port 58080 while the current port is 50000. I tried to update the instanceconfig.xml file as well as the css.xml file (correct me if i'm wrong) but the port still goes to 58080. any idea how to resolve this? any help really appreciated.

Failed to register Planning with Shared Services

Hi,
I am trying to configure Hyperion Planning and it says "failed" for all the components. It doesn't want to reconfigure Shared Sevices either.
I am using EPM 11.1.1.3.
Can someone help?
Thank you!

I have finally managed to install and configure all the components, and when I try to log in to workspace I either get the message error: "1009902" or I log in and I can't find Planning Administration in Navigate->Administer->Classic Application Administration->Planning Administration. I have previously created using Shared Services a new application group called Planning. Plus, Shared Services only works if I periodically restart the database services, otherwise I get a communication error, either when loading the view pane, or when loading tree data etc.
And when I try to access the following url: http://servername:8300/HyperionPlanning/AppWizard.jsp, i receive the following error:
"The requested resource (/HyperionPlanning/AppWizard.jsp) is not available."
Here is the log for error 1009902:
1009902
com.brio.one.common.DatabaseException: 1009902
     at com.brio.one.common.utils.CommonIdlUtility.convert(Unknown Source)
     at com.brio.one.common.utils.CommonIdlUtility.convertCorbaException(Unknown Source)
     at com.brio.one.common.utils.CommonIdlUtility.convertCorbaException(Unknown Source)
     at com.brio.one.services.proxy.BusinessServiceProxy.convertCorbaException(Unknown Source)
     at com.brio.one.services.sessionmanager.proxy.SessionManagerProxy.createSession(Unknown Source)
     at com.brio.one.client.proxy.ClientProxy.recreateSession(Unknown Source)
     at com.brio.one.client.proxy.ClientProxy.createSession(Unknown Source)
     at com.brio.one.web.launcher.util.LauncherUtil.login(Unknown Source)
     at com.sqribe.WS.WebSQRIBE.loginToRepository(Unknown Source)
     at com.sqribe.WS.WebSQRIBE.newUser(Unknown Source)
     at com.sqribe.WS.WebSQRIBE.run(Unknown Source)
     at com.sqribe.WS.WSBaseServlet.executeRequest(Unknown Source)
     at com.sqribe.WS.WSBaseServlet.service(Unknown Source)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
     at com.hyperion.bpm.LocalizationServletFilter.doFilter(LocalizationServletFilter.java:69)
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
     at com.hyperion.i18n.filter.Utf8Filter.doFilter(Unknown Source)
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
     at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:199)
     at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:282)
     at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:754)
     at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:684)
     at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:876)
     at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
     at java.lang.Thread.run(Thread.java:595)
I would greatly appreciate any help! Thank you!

Shared Service Security Setup - Demo Doc

Hello Friends,
Was just checking if anyone of you have a quick small document which would explain the security setup module in Shared services
with Users, Roles, Groups, filters
Type of access READ WRITE, META READ WRITE etc in a pictorial format.
Just have to give a demo to my fellows.
Thanks in advance
MS

Try
http://docs.oracle.com/cd/E17236_01/epm.1112/hss_admin_1112200/apas02.html
http://docs.oracle.com/cd/E17236_01/epm.1112/hss_admin_1112200/ch09s04s08.html
http://docs.oracle.com/cd/E17236_01/epm.1112/hss_admin_1112200/ch09s04s07s01.html
http://docs.oracle.com/cd/E17236_01/epm.1112/esb_dbag/dsefilt.html
Cheers
John
http://john-goodwin.blogspot.com/

Shared Services Mixed Native-MSAD group nesting

Similar Messages

Maybe you are looking for