Shared Services, using openldap to query MSAD

Hello,
I would like to know if this is possible to configure. I would like to setup an openldap server and use that to query MSAD. Shared Services would have a connection to that openldap server and the openldap server would query MSAD and in return pass that to SS. Has anyone had any experience doing so? Yes I know I can setup just an ldap connection but within our AD structure, user's do not sit in one OU. They are all over the place. I could setup the base dn to the 'root' but we have over 15,000 users and that would result in a slow SS startup. The openldap server would be used to filter out the queries to AD and have it's own cache/database..
Thanks

Hi Randy,
Thank you for your question. I am trying to involve someone more familiar with this topic for a further look at this issue. Sometime delay might be expected from the job transferring. Your patience is greatly appreciated.
Thank you for your understanding and support.
If you have any feedback on our support, please click
here.
Regards,
Elvis Long
TechNet Community Support

Similar Messages

After reconfiguring shared service using Config utility

Hi,
I am unable to see my applications under Projects after reconfiguration from Config utility, i selected reuse existing tables. Does it require any additonal steps to see my existing applications under projects?
Secondly i have backup for openLdap, but not relational backup of shared services before reconfiguration. is there any possibilty to recover HSS with openldap backup (no backup available for RDBMS)?
Any solution to this problem.

I am hoping this is not related to the post yesterday where I advised against running the config utility again.
First of all if you ever run the config utility you should make sure you definitely have a backup of everything.
Unfortunatey it sounds like the registration to the products has been lost, shared services db holds information relating to product registration, Openldap contains the provisioning information.
You may end up having to reregister the products with shared services.
Cheers
John
http://john-goodwin.blogspot.com/

Analytic Services vs Shared Services using maxl

when i execute maxl disable, enable and drop, it only applies toAnalytic Services and not Shared Services. how do i write code inmaxl to directly disable, enable, and drop users in SharedServices? If there's no way, how can I automate navigating Shared Serviceswithout having to manually login each time?

i found a work-around for disabling and enabling users inSS. alter user USERNAME add/remove application_access_typeEssbase; now all i have to find is to delete users from SSdynamically. any other suggestions/comments? Thanks in advance.

Login on to workspace and Shared Service using FireFox

I can log on to Share Services and Workspace in IE 8
but Not Firefox
Please advise

KVC wrote:
Firefox 3.5, for 11.1.1.0.00 release.
11.1.1.3.x, and on where IE8 and Firefox 3.6 are supported check ur firefox versionYour begging for points when the support matrix says
11.1.1.3 - Firefox 2.0.x
11.1.1.4 - Firefox 3.5+ Firefox 5.x (starting with 5.0.1)
11.1.2.1 - Firefox 3.5+
Cheers
John
http://john-goodwin.blogspot.com/

Shared Services Mixed Native-MSAD group nesting

Is anyone doing this?
I am trying to make an MSAD group a member of a native group using shared services and after adding the MSAD group, the console errors out for the group i just made whenever trying to view the group members. This is repeatable and happens before i have even provisioned the parent group when i am trying to view the group members.
When i nest a native group inside another native group, it works fine.
In the SharedServices_Security.log found in Oracle/Middleware/user_projects/domains/EPMSystem/servers/FoundationServices0/logs
I see the following stack trace:
[2010-12-14T09:09:22.156-06:00] [FoundationServices0] [ERROR] [EPMCSS-7019] [oracle.EPMCSS.CSS] [tid: 7] [userId: <anonymous>] [ecid: 0000In_RR_eDKeoLwUg8yW1D1Yoh00001G,0] [APP: SHARE
DSERVICES#11.1.2.0] [SRC_METHOD: execute:129] [SRC_CLASS: com.hyperion.css.web.action.CSSStatefulAction] Failed to process the request.
[2010-12-14T09:16:16.365-06:00] [FoundationServices0] [NOTIFICATION] [EPMCSS-17306] [oracle.EPMCSS.CSS] [tid: 7] [userId: <anonymous>] [ecid: 0000In_T0hhDKeoLwUg8yW1D1Yoh00001J,0] [AP
P: SHAREDSERVICES#11.1.2.0] [SRC_METHOD: ] [SRC_CLASS: ] [arg: native://nvid=af1814bfd20d7272:58ecdd0:12ce020823f:-7f66?GROUP] x
[2010-12-14T09:16:17.473-06:00] [FoundationServices0] [ERROR] [EPMCSS-37000] [oracle.EPMCSS.CSS] [tid: 8] [userId: <anonymous>] [ecid: 0000In_T0z1DKeoLwUg8yW1D1Yoh00001K,0] [APP: SHAR
EDSERVICES#11.1.2.0] [SRC_METHOD: execute:128] [SRC_CLASS: com.hyperion.css.web.action.CSSStatefulAction] Error while processing the request.[[
java.lang.NullPointerException
at com.hyperion.css.web.util.DTOFactory.createGroupDTO(DTOFactory.java:49)
at com.hyperion.css.web.util.DTOFactory.createGroupDTOEscDoubleQuote(DTOFactory.java:75)
at com.hyperion.css.web.action.EditGroupAssignGroupsFormAction.executeAction(EditGroupAssignGroupsFormAction.java:109)
at com.hyperion.css.web.action.CSSStatefulAction.execute(CSSStatefulAction.java:119)
at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421)
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164)
at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:415)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3594)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2202)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2108)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1432)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
I think its a bug and have opened an SR with oracle, but i'm curious what others out there are doing.
Edited by: Javanator on Dec 14, 2010 10:25 AM

Hi Dear
Is this issue resolved? i too get the similar error in the log file . Please let me know if it is reolsved for you

Shared services trouble shooting

Hi
I installed the 9.3.1 on my machine...mistakenly my machine was shutdown and openLDAP service was corrupted , I do have back-up of shared services folder so I replace the regular SS folderr with that. Now the problem was I am unable to see the Hyperion planning , Reports, Business rules to provision . I do have only shared serrvices>glodal rules, So I again registered planning ,reports ,EAS with shared services using config utility..but I am not succeed..Is there any way to view all of them in the provision list.So that I can provision to different users.I I didn't configure again (after ldap corruption)anything under shared services of config utility.but the funny thing I am able to login in to planning as admin, but I am unable to see it in the shared services provision list... Can anyone tell me what exactly happend in the background of this.
Thanks

Hi,
Have you tried running the sync option in shared services, this syncs shared services repository with open ldap.
Administration > Sync Native Directory.
I am not how succesful it will be now you have been registering and provisioning again but worth a try.
Cheers
John

Intermittent Workspace/Shared Services issue - 11.1.2.1

All
Version 11.1.2.1
Using Shared Services with Native (1) and MSAD (2) ; IDs are members of Native groups which are provisioned to the application
We are experiencing an intermittent problem in Workspace where one day we can login without issue, and the next, we are stuck at “Authenticating User..” for a long time before login finally fails with:
“EPMCSS-00387: Failed to authenticate user xxxxxxx from user directory MSAD. Invalid password. LDAP response read timed out, timeout used: 120000ms..Enter valid credentials.”
More details shows ”URI: http://.....:19000/workspace/login
Code: 1000
Description: An error occurred processing the result from the server”
Alternately, sometimes login will succeed, but will receive the message:
“The startup document does not exist in the repository. Select a new startup document in the General preferences tab”.
We have opened an SR with Oracle but can’t seem to make much progress resolving the issue. Any ideas?

Hi,
Did you ever get to the bottom of this? We are on 11.1.2.1 and facing the exact same issue when logging on to HSS or Workspace:
EPMCSS-00387: Failed to authenticate user sebastien.lejarle from user directory EXWC. Invalid password. LDAP response read timed out, timeout used:120000ms.. Enter valid credentials.
We cant figure out what s wrong.
We have applied Oracle's recommended IE 7 and IE8 settings to no avail.
Thanks again.
Seb

Shared services not responding...

Previous shared services used to work fine..
today all of a sudden it stoped showing login page....after 30 minutes.. internet explorer cannot display this page.....
tried to restart the services for ldap and shared services....its showing that the services can't be stopped....
even restart of the server didnt work....
can anyone let me know the reason for this
even tried to use recovery.bat scripts.....
one more question do i need to re-configure all the applications installed on the server....
Thanks in advance....
Edited by: user649524 on Jan 6, 2009 7:39 PM

If you remove the OpenLdap directory (\Hyperion\SharedServices\9.3.1\openLDAP) , then run the shared services installer again it should create it again.
You will have to configure Shared services again, as for keeping your registered apps I am not so sure on, you might be lucky and reuse the same database when you configure, if not then you will have lost it all and will have to reregister the products with SS.
Strange you couldn't recover the openldap db usually it is fine if you roll it back to a date when it was working fine.
Cheers
John
http://john-goodwin.blogspot.com.

Hyperion workspace log-in issue for only one (in Shared Services) active di

Hi All,
This is Raj, working as Hyp support analyst.
I have big issue in Hyperion production environment. (version No. 9.3.1)
Issue is, we had issues with TWO active directories of Hyperion Shared Servces which ad1 and ad2. We found that the TWO respective active directories (ad1 and ad2) of their hosts are not working.
After that we changed those two active directories hosts with new host names respectively. We have implemented these changes in DEV first and those TWO active directories user able to access Hyperion workspace (HFM users) which are under ad1 active directory. offcourse we have all the servers as well.
But ad2 users are NOT able log-in to the Production workspace but they are able to log-in with DEV workspace.
Not really sure what happened... (Please note that, No access is changed for any of the users)... if it is LDAP issue...how it to resolve...
Can some one please help oout in this...
Thank you very much in advance.
- Thanks,
Raj.

Hi,
Those error messages usually happen when Shared Services has just started up and before the other services have started, it sends out a ping to see if it gets a response from the other application servers, the pings will fail until the other services have started, once they have started them messages should disappear.
I would check that if any changes have happened to your MSAD or the account that shared services uses.
Cheers
John
http://john-goodwin.blogspot.com/

Hyperion Shared Services issue

Hi All,
We use Hyperion Planning 9.3.0.1. The servers were restarted yesterday and the services were started manually in the correct sequence. But I am having issues with MSAD users not been able to logon.
When I looked at the Shared Services I tried searching for user/groups in the MSAD directory but it says communication error. I understand that it could be a change in the MSAD configuration that might have broken the link, however when I look at the log file I find the following entries:
2009-04-27 14:25:28,141 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/workspace: Refer log in debug mode for details
2009-04-27 14:25:49,032 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:10080/eas: Refer log in debug mode for details
2009-04-27 14:25:53,188 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/HyperionPlanning/: Refer log in debug mode for details
2009-04-27 14:25:57,344 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/workspace: Refer log in debug mode for details
2009-04-27 14:26:19,109 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:10080/eas: Refer log in debug mode for details
2009-04-27 14:26:23,594 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/HyperionPlanning/: Refer log in debug mode for details
2009-04-27 14:26:28,313 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/workspace: Refer log in debug mode for details
2009-04-27 14:26:49,203 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:10080/eas: Refer log in debug mode for details
2009-04-27 14:26:53,453 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/HyperionPlanning/: Refer log in debug mode for details
2009-04-27 14:26:57,937 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/workspace: Refer log in debug mode for details
2009-04-27 14:27:10,687 [Timer-0] ERROR com.hyperion.cas.web.util.memory.CASUsedMemoryTracker.run(CASUsedMemoryTracker.java:27) - Memory in use[12880 kb] = Total memory available[793837 kb] - Free memory available[780957 kb]
2009-04-27 14:27:18,937 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:10080/eas: Refer log in debug mode for details
2009-04-27 14:27:22,984 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/HyperionPlanning/: Refer log in debug mode for details
2009-04-27 14:27:27,140 [Timer-1] ERROR com.hyperion.cas.server.task.CASInActiveContextPingerTask.run(CASInActiveContextPingerTask.java:52) - IOException occured while pinging app with registered context path: http://servername:19000/workspace: Refer log in debug mode for details
Recently there was an exercise done to change the Java heap size settings. I am wondering if it is related to that.
Thanks in advance,
Amol
Edited by: AmolDatt on Apr 27, 2009 7:05 PM

Hi,
Those error messages usually happen when Shared Services has just started up and before the other services have started, it sends out a ping to see if it gets a response from the other application servers, the pings will fail until the other services have started, once they have started them messages should disappear.
I would check that if any changes have happened to your MSAD or the account that shared services uses.
Cheers
John
http://john-goodwin.blogspot.com/

Shared Services Configuration & Deployment

Hi,
I have a general query on the Shared Services Deployment. In the config. utlility you find an option to deploy shared services using an application server. After that we dont deploy it using web server. This being the case how are we able to access shared services using the url http://servername:28080/interop ??
I searched many places but couldnt find exactly what i am looking for. Thanks in advance for all your inputs...
Edited by: user12136330 on Nov 13, 2009 5:11 AM

The configuration utility deploys all the components and creates the application to run on the specified port, if you point the configuration utility to the installation location of web logic it does the rest for you. So basically once you have configured using the configuration utility the shared services app should be running and accessible by the standard url.
If you are struggling I think you should have a look at the installation documents
V9 - http://download.oracle.com/docs/cd/E10530_01/doc/nav/portal_1.htm
V11 - http://download.oracle.com/docs/cd/E12825_01/nav/portal_1.htm
Cheers
John
http://john-goodwin.blogspot.com/

Essbase registration to Shared Services failed - Hyp 11.1.1.3 on 2 Win XP

Hi All,
I have Hyperion 11.1.1.3 installation on two XP Pro machines. Pure system, with no global policies, firewalls, etc. My users are in Administrators group. Computers are not in any domain also.
On first server (called HypTSerwer1) there is: Foundation (Shared Services Web Application and OpenLDAP Service)
On second server (called HypTSerwer3) there are: Oracle DB (10R2) + Essbase Services Server 32-bit
I've configured Shared Services, I can log as admin to Shared Services Console without any problem. Validation report contains all greens.
But when I try to configure HypTSerwer3 (essbase) I get: Register with Shared Services Failed. Validation report contains one failure in Hyperion Foundation (
EXT: External Authentication Check Native Directory external authentication provider configuration
Error: Provider is not reachable
Recommended Action: Check Shared Services Configuration
)(OpenLDAP is green and runs fine)
In HypTSerwer3 in C:\Hyperion\logs\config\SharedServices_Security_Client.txt I found:
Got hub location from Registry:http://HypTSerwer1:28080 com.hyperion.css.registry.RegistryManager.getHubLocationFromRegistry(Unknown Source)
Got native directory location from Registry::28089 com.hyperion.css.registry.RegistryManager.getNativeProviderLocationFromRegistry(Unknown Source)
URL constructed out of values in Registry database:ldap://:28089/dc=css,dc=hyperion,dc=com com.hyperion.css.common.configuration.CSSConfigurationImplXML.initConfiguration(Unknown Source)
27:1112:Failed to connect to at 28089.[Root Cause: Connection refused: connect ] com.hyperion.css.spi.util.jndi.pool.JNDIConnectionPool.validateSocketConnection(Unknown Source)
27:1112:Failed to connect to at 28089.[Root Cause: Connection refused: connect ] com.hyperion.css.spi.util.jndi.pool.JNDIConnectionPool.validateSocketConnection(Unknown Source)
Failed to instantiate provider for factory: com.hyperion.css.spi.impl.nv.NativeFactory. [Root Cause: 27:1112:Failed to connect to at 28089. ] com.hyperion.css.spi.CSSManager.getProvider(Unknown Source)
Native Directory is not reachable. Attempting to re-connect... com.hyperion.css.spi.CSSManager.getProviderInstance(Unknown Source)
The part connect to at 28089* looks strange for me, as it sugests, that there is no server name, only port.
I really don't know what to do next. I reinstalled it many times, checked if all services are running. Deployed it with Tomcat or WebLogic 9.2. And always with the same result. When I install everything in only one machine, than it is working fine.
Thanks for any help or suggestion.

Just out of interest why have you used OAS as it is pretty much dead product now and is not used in future releases.
Anyway I am not sure why you have closed ports between those servers, you will end up spending a lot of time trying to open all the required ports between the servers.
Can you not get all the ports open for a time just to check it definitely is a ports issue.
It is probably also worth checking the following spreadsheet out - http://www.oracle.com/technetwork/middleware/bi-foundation/epm-components-communications-fd-11-128629.xls
It highlights the ports used in communication.
Cheers
John
http://john-goodwin.blogspot.com/

Hyperion Shared Services URL

Hi,
I'm new in setting up and installing the Hyperion product as well as web server concept. I managed to setup Hyperion shared services using LDAP/MSAD and able to login into the Hyperion Shared Services but not able to login into Hyperion workspace. I realized that the URL for Hyperion Shared Services still on port 58080 while the current port is 50000. I tried to update the instanceconfig.xml file as well as the css.xml file (correct me if i'm wrong) but the port still goes to 58080. any idea how to resolve this? any help really appreciated.

Hi,
I'm new in setting up and installing the Hyperion product as well as web server concept. I managed to setup Hyperion shared services using LDAP/MSAD and able to login into the Hyperion Shared Services but not able to login into Hyperion workspace. I realized that the URL for Hyperion Shared Services still on port 58080 while the current port is 50000. I tried to update the instanceconfig.xml file as well as the css.xml file (correct me if i'm wrong) but the port still goes to 58080. any idea how to resolve this? any help really appreciated.

Creation of Group in Shared Services

Hi All,
I am creating groups in Shared Services using Import export utility, to create a group I have given record like
#group,,,,,,,
id,provider,name,description,internal_id,,,
Test.30.7202,Native Directory,Test.30.7202,,,,,
But group is not getting created, when I checked the trace log file I found
Trace...
     2010-06-09 15:28:20,822 Attempting a import operation
     2010-06-09 15:28:22,147 Import : Attempting to create group Test.30.7202
     2010-06-09 15:28:22,162 Import : Create group Test.30.7202 failed.
Can you please someone explain, is there I missed any information?
We are using Hyperion system 9.3.1
Thanks in Advance

Hi John,
Thanks for the prompt response, its working fine without intenal id. One more issue, Now I am provisioning groups for Planning Application
project_name     application_name     role_id     product_type     user_id     user_provider     group_id     group_provider
HyperionPlanning     Testapp     Planner     HP-9.3.1               Test.30.7202     Native Directory
Like the above, is there any syntax to provide access to Essbase "Server Access" (Minimum access to access to Essbase) and Business Rules?
Thanks in Advance,

Shared Services Registration Failed While Re-Configuring EAS

Hi
I was re-configuring EAS and my shared services and deployment failed.I reached out to oracle and they gave me a solution to delete the HBR instances.
But when I try to open the url in microsoft word it opens in html format .And i am unable to delete any HBR instance.What is the correct way to do it?
The solution offered by Oracle Support:
To resolve this issue, do the following steps:
1. Log into the User management console using the URL http://localhost:58080/interop/index.jsp.
2. Append the URL to show the files http://localhost:58080.interop/content/files
3. Copy this URL and open in Microsoft Word. (file->open option in MS Word)
4. Provide username (admin) and password (password).
5. Check in AdminProjects, Products and Projects folders for the files and folders related to HBR and delete any occurences.
6. Save and close the file.
7. Restart the services.
8. Configure EAS with Shared Services using the config utility.
9. For Business Rules to work, go to \Hyperion\AnalyticAdministration\storage\easuser location and delete all contents from the easusers folder.
10. Restart the EAS server.
Thanks
Z

I never really used the method with word and always used davexplorer which can be downloaded from http://www.davexplorer.org/download.html
Follow the rest of the instructions which you posted to delete HBR.
Cheers
John

Shared Services, using openldap to query MSAD

Similar Messages

Maybe you are looking for