Ssodatan and partner application

Hello,
I have configured successfully a java partner application.
The problem is that each time I run ssodatan command all the
records in the table WWSSO_PAPP_CONFIGURATION_INF_T are removed
(the one for ny partner application too) and only portal30 and
portal30_sso are recreated. So I loose all the parameter of the
my partner application. It does't appears anymore in the partner
application list...
Can anyone help me?
Thank you,
Lorenzo.

I didn't understand very well:
we need to launch ssodatan necessary because the portal url and
login server url changes often.
After that, we loose the partner application configuration (of
the java application), the portal is OK.
You suggest me to run ssodatax command, but according with the
comment in ssodatax script, I can't run it without creating
manually the partner application (ssodatax needs: site id,
Token, Encryption Key, ...).
What I want to avoid is to create manually the partner
application. Is possible to do this step in automatic way (using
script or something else)?
Thanks
Lorenzo.

Similar Messages

Choosing between external and partner application and problem with login

We have an application on Oracle App Server 10.1.3.3 and we have an OID server.
I had taken this for granted that I should define the application as 'Partner Application' and not external application for single sign on.
Now that we need the 'PASSWORD' retrieved by application, we are considering defining it as an external application.
There are at least two problems I have encountered defining the application as external:
1. 'pageConfig:serverDate' is among the login form's inputs in the login page, but I can't set it in orasso 'Edit External Applications' page
2. After login using SSO as external application and when I click on the application's new link, the login page is shown with the username and password field filled, but I have to click on login button anyway (no automatic and invisible login).
I will be very grateful if someone gives a general view on the differences between external and partner, whether in this case external has to be used or partner and finally give some comment on my specific problem with login button and manual login.
Thank you

Just some information :
- The problem with LOGIN page exists. I don't have that problem with for example GMAIL when defined as external application, but with my applications in Oracle Application Server.
- There is also another thing I don't understand. The link to external application is something like:
javascript:open_jwindow('../ealogin?ID=76D4766','76');
and couldn't be executed outside pls/orasso
in other words we can't give that to our users, can we? They should login to orassso and see that?
We don't want to involve them in Identity Management...
Any help is appreciated....
Regards

Java and Partner Applications - EXTREMELY URGENT

gurus,
i'm trying to register a single sign on servlet application as a partner application.
i followed ths steps as mentioned in the SSO SDK version 307 and when i try to run the application i get the following error -
******* START ERROR ********
Error oracle.security.sso.enabler.SSOEnablerException: oracle.security.sso.enabler.SSOEnablerException: java.sql.SQLException: ORA-06510: PL/SQL: unhandled user-defined exception ORA-06512: at "DVIPARTAPP.WWSEC_SSO_ENABLER_PRIVATE", line 304 ORA-06512: at line 1
********* END ERROR *********
the environment here is -
database - 8.1.7
portal - 3.0.8
os - windows NT
has anyone faced the same problem before.
any help would be greatly appreciated.
thanx a bunch.
null

Thank you very much once again for your prompt reply and suggestions. I tried the later solution using Developing Statically Protected PL/SQL (or j2ee) Applications described in Oracle® Application Server Single Sign-On Application Developer's Guide 10g (9.0.4).
Protect the servlet(or jsp) by entering the following lines in the mod_osso.conf file:
<Location /servlet>
require valid-user
authType Basic
</Location>
When this particular application added inside the portal (try to web clipp, it redirects to SSO login page.) In this case users have to login twice. Once to the default portal page, and another to this stand alone out side application. Defeats the purpose of SSO using Portal.
Your question "is it an app that you want to be able to invoke from a link within Portal?" hits the nail right on the head. The difference here is, I do not want to add as a page link, ideally I want this web application to be able to web clipped inside the portal.
Now, this is the external application (and not developed as a portlet). I have not completely understood how any web application developed as a portlet can get the user information (user/groups/roles etc) when user logs in to portal default page. And, the authorization is implemented inside this web application. They(users) do not need to authenticate once again since that is done when they login to the portal. I hope I am making sense.
I am not clear on the web application developed as a portlet. Can users, groups, and roles be implemented inside this application? If it is developed as portlet. The problem here is you have to rewrite all of your existing applications as a Portlet (either PL/SQL or J2EE). Not all applications are developed using this technology.
Your help is highly appreciated.
Very Best Regards,
-Dhiren.

Partner application and web clipping.

Hi All,
I am trying to add an external application (say my.yahoo.com) to a webclipping and its throwing the below error in the application log.
WC-517 : SSL handshake failed with the url ...
I have checked the file ca-bundle.crt and the certificates are in place. Does anybody know how to go about debugging this problem as I am quite new to portals and at my wits end to solve it.
Also I would be greatful if anybody can suggest me the steps on adding an Apex application configured as partner application with SSO authentication to a web clipping.There seems to be little or no-documentation at all in this regard(as far as my search goes).
Thanks in advance
-Venkat

I finally got it working by VERY CAREFULLY reading the instructions in the install.txt document in the SSO SDK package. You have to set up the partner application with a new schema in the login server database, and run the regapp.sql script AFTER editing it to insert data from the Login Server Partner Application admin screen. After you register the partner app in Portal, it gives you some info (site token, listener token, encryption key, etc). You have to MANUALLY copy these and paste them into the regapp.sql script, then run the script in the partner app schema. Make sure you don't confuse capital I with numeral 1 (like I did, since Oracle so nicely uses a non-serif font where you can not tell the difference).
Also make sure you copy the exact values for these parameters into your code when you use the SSOEnabler class. The listener token was very confusing since different documents appear to disagree on whether it should include the partner app name or not. It does require the partner app name:
app-name:hostname:port
hostname and port are for the web server that is handling http requests for the login server (usually your main portal web server).
John H.

Partner Application and Login Server

I have created a partner application using the samples provided in the ssosdk. In the SSOSignServlet I am checking a table to determine if the user returned from the login server has access to the partner application. If the user has access, I set the cookie and the user is redirected to the application. If the user does not have access, am not sure how to handle it. I can use response.sendRedirect(response.encodeUrl(m_cancelUrl), yet would rather display a message indicating that dont have access and are being redirected. If I try to output a message in the SSOSignOnServlet, I get into a loop. ANy ideas?

I finally got it working by VERY CAREFULLY reading the instructions in the install.txt document in the SSO SDK package. You have to set up the partner application with a new schema in the login server database, and run the regapp.sql script AFTER editing it to insert data from the Login Server Partner Application admin screen. After you register the partner app in Portal, it gives you some info (site token, listener token, encryption key, etc). You have to MANUALLY copy these and paste them into the regapp.sql script, then run the script in the partner app schema. Make sure you don't confuse capital I with numeral 1 (like I did, since Oracle so nicely uses a non-serif font where you can not tell the difference).
Also make sure you copy the exact values for these parameters into your code when you use the SSOEnabler class. The listener token was very confusing since different documents appear to disagree on whether it should include the partner app name or not. It does require the partner app name:
app-name:hostname:port
hostname and port are for the web server that is handling http requests for the login server (usually your main portal web server).
John H.

BC4J, Auditing, Partner Application and SSO

I am trying to figure out how to set up a BC4J-JSP app to use "database audit trail in entity objects" within a Portal/SSO environment.
Here is the situation;
Part 1:
I am able to partially get the auditing to work on a BC4J App Module in the tester by setting the appropriate history columns in the Entity Object and then setting the jbo.security.enforce property to "Test". Upon entering the tester I am challenged for a "username/password". At this point I can enter any credentials, I can then enter some data. Visually checking the database I find that the history "date" columns (date_created) are ok but the "user" columns (created_by) are not filled in.
Part 2:
Now if I set jbo.security.enforce property to "Test". I am not sure what user credential to enter here. I have looked at OID Manager for some clues for what username/password but I'm not sure if this is even in the ballpark.
Part 3:
At some point I will deploy this app as an SSO/Partner Application which will be accessed from a Portal page. Since authentication is handled by the SSO login page, I am confused about setting up the "database audit trail in entity objects" (from Part 1) as it talks about creating * another * login page. This seems contradictory so Long postings are being truncated to ~1 kB at this time.

Part 1:
When setting jbo.security.enforce property to "Test", BC4J does not throw exception if credential is invalid. You should set it to "Must" if you really want to validate the credential. The "Test" setting does perform the authentication, a warning stating authentication fail is in the diagnostic output if the username/password is invalid. The "Test" setting is just to exercise the authentication but if it fail it does not stop the rest of the application. The "user" column (created_by) does not get fill could be cause by failed authentication or if the column is marked as Refresh on Update or Refresh on Insert, or if the client app insert null or zero length string into it.
Part 2:
BC4J default authentication uses the LoginModule from Oracle9iAS JAAS (in j2ee\home\jazn.jar). This LoginModule by default configure to use the lightweight jazn-xml. You can check this by looking "<jazn provider=..." in the j2ee\home\config\jazn.xml. If you are interested in using OID, you need to change it to <jazn provider="LDAP" location="ldap://myoid.us.oracle.com:389" />, "myoid.us.oracle.com:389" should be host address and port of your OID. There are a few predefined users in the lightweight jazn-xml if you wish to test it, there are admin/Long postings are being truncated to ~1 kB at this time.

Mod_osso partner application and webcache site to server mapping

hi, need advice on the following.
i have an app server container (only OC4J and no portal,forms etc) hostname abc.test.net installed with the option to registered to the sso server (http://mylogin.test.net), which is on a physically seperate machine.
i have a java application deployed on a 10g app server container. the log in portion is handle by the login server using the mod_osso.conf file.
thus when i type http://abc.test.net:7777/myapps, i will be prompted to login via the sso server.
this is working fine.
then i put a webcache to front this app server, so that users will use a sitename (http://myapps.abc.com) defined in the webcache (mapped to the app server) to access that application.
so now when users type http://myapps.abc.com, they are still prompted the sso login screen. but after logging in, they are shown a red coloured bold text error message "ORASSO Failure-Unable to Process Request" page. this error page has the url of app server http://abc.test.net:7777/osso_login_successxxxx.
if i manually replace the 'acb.test.net' to 'myapps.abc.com', my application will be displayed correctly, and i am logged in.
how can i resolve this problem?
question:
1. do i need to re-register http://myapps.abc.com as a partner application?
2. if so, do i perform the registration from the webcache, the app server or the login server itself?
pls advice.
thx.

Follow the following notes:
Note:250532.1 Configuring HTTP Server to Use SSL in Oracle Application Server 10g (9.0.4)
===> Note:250532.1 Configuring HTTP Server to Use SSL in Oracle Application Server 10g (9.0.4) <===

Partner application single sign-on and Oc4j

hello,
I'm trying to test portal's partner application single sign-on, following the examples inside the "Oracle9 iAS Single Sign-On Application Developers Guide":
With Tomcat as jsp engine everything works fine, but with Oc4j when I try to enter the protected jsp page i have this exception:
oracle.security.sso.enabler.SSOEnablerException: java.lang.IllegalStateException: OutputStream already retrieved
     at SSOEnablerBean.getSSOUserInfo(SSOEnablerBean.java:153)
     at SSOEnablerJspBean.getSSOUserInfo(SSOEnablerJspBean.java:57)
     at /protetta.jsp._jspService(/protetta.jsp.java:37) (JSP page line 4)
Any suggestion?
Thanks in advance.

I get the same problem with my partner application. It runs fine on JServer but I get the following problem on oc4j:
oracle.security.sso.enabler.SSOEnablerException: java.lang.IllegalStateException: OutputStream already retrieved
at oracle.br.aerochain.sso.SSOEnablerBean.getSSOUserInfo(SSOEnablerBean.java, Compiled Code)
at oracle.br.aerochain.sso.SSOEnablerJspBean.getSSOUserInfo(SSOEnablerJspBean.java, Compiled Code)
at /jsp/papp.jsp._jspService(/jsp/papp.jsp.java, Compiled Code)
at com.orionserver[Oracle9iAS (9.0.2.0.0) Containers for J2EE].http.OrionHttpJspPage.service(OrionHttpJspPage.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.HttpApplication.serviceJSP(HttpApplication.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.JSPServlet.service(JSPServlet.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java, Compiled Code)     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.HttpRequestHandler.run(HttpRequestHandler.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].util.ThreadPoolThread.run(ThreadPoolThread.java, Compiled Code)
Did anyone get a solution for this?
TIA

Register the partner application through SSO Administer Partner Application

When should I use the "Administer Partner Applications" link on the SSO Server Administration page to register the application among the following cases?
1. sign-on SDK integrated application
2. mod_osso integrated application

Were you able to resolve the issue???
Can you pls try Rerunning ssodatan/x with the correct data. The ssodatan script is located in the directory ORACLE_HOME/portal30/admin/plsql/ssodatan.
Refer following link for more info on SSODATAN , SSODATAX and DIAGNOSTICS scripts in Portal 3.0.x:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=136138.1

Wwc- 41653 The partner application configuration is missing or expired.

We have the following scenerio.
Application server 9iR1, apache server, login server, portal3.0.9.8.4 on 9iR2 database on host A. There is another database in 9iR2 where portal3.0.9.8.4 installed on host B. I want to use this database for another website configuring apache on host A as virtual host. I want to use same login server on host A.
The website on host A is working fine while the website on host B does not allow me to log into the login server.
I have run ssodatan script for associating portal schema on host B. I have created partner application on host A portal for accessing portal on host B and run ssodatax script for associating partner application.
when I try to log into the another web site created for host B, I get portal welcome page. when I click on login, I get sso page but i am unable to log into it, getting error The partner application configuration is missing or expired. Please contact the administrator. (WWC-41653)
How to resolve this?

Were you able to resolve the issue???
Can you pls try Rerunning ssodatan/x with the correct data. The ssodatan script is located in the directory ORACLE_HOME/portal30/admin/plsql/ssodatan.
Refer following link for more info on SSODATAN , SSODATAX and DIAGNOSTICS scripts in Portal 3.0.x:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=136138.1

The partner application configuration is missing

Trying to login to portal with portal30 leads to
'The partner application configuration is missing or expired. Please contact the administrator. (WWC-41653)'
Please advise
db 8.1.7
portal 3.0.9
apserver 1.0.2.1
Thank you
Anatoliy Smirnov

Were you able to resolve the issue???
Can you pls try Rerunning ssodatan/x with the correct data. The ssodatan script is located in the directory ORACLE_HOME/portal30/admin/plsql/ssodatan.
Refer following link for more info on SSODATAN , SSODATAX and DIAGNOSTICS scripts in Portal 3.0.x:
http://metalink.oracle.com/metalink/plsql/ml2_documents.showDocument?p_database_id=NOT&p_id=136138.1

SSO to partner application running under IIS

Hi,
We have a complete set-up for 9iAS Release2 where some applications are running. In parallell we have an application running under IIS, and would now like to enable the IIS application as a partner application to 9iAS letting the 9iAS SSO server handle the authentication.
In the documentation of Oracle Proxy Plug-in I read that this proxy plug-in can be used to proxy requests from IIS to Oracle http server (OHS) and also in this way enable SSO.
My question is if this can be done only for applications running under 9iAS but having IIS as web server, or if it is also possible like in our case to enable SSO via the proxy plug-in to applications runnind under IIS?
If this is not supported is the only available solution to use the SSO SDK in my IIS application?
Thanks and regards,
Rikard

Here's a DIY answer.
See Metalink Note 269820.1 which shows you how to use Perl to overwrite the host name in the HTTP header and remove the port number.

HOW TO SET UP PARTNER APPLICATION TO USE SSO OUTSIDE OF PORTAL

If anyone knows how Portal switches context to run as the db user mapped to the lightweight schema and how it knows the db schema password please let me know.
Should you have any queries please do not hesitate to contact me on 07775 896738.
From document Oracle Portal Security Overview on PortalStudio.oracle.com:
In Single Sign On mode (EnableSSO=Yes in the DAD), mod_plsql determines the name of the light-weight user and mapped database schema by calling
WPG_SESSION_PRIVATE.GET_LW_USER and WPG_SESSION_PRIVATE.GET_DB_USER respectively.
** These calls are done using the Portal Schema (PORTAL30) and Portal schema password **
mod_plsql then executes the procedure in the requested URL by using the N-Tier Authentication feature to connect to the database as the user returned from
WPG_SESSION_PRIVATE.GET_DB_USER. ..... Note that N-Tier Authentication requires all schemas to be used for Portal user mappings to be granted 'connect
through' privleges to the Portal schema (PORTAL30).
The WWCTX packages are also used.
So this is how it works with standard Portal
- the document states that the WPG_SESSION_PRIVATE package is only accessible to the Portal schema
- but I checked and it is also available to PORTAL30_SSO
SQL> desc WPG_SESSION_PRIVATE
PROCEDURE CREATE_SESSION
Argument Name Type In/Out Default?
P_COOKIE_NAME VARCHAR2 IN
FUNCTION GET_DB_USER RETURNS VARCHAR2
FUNCTION GET_LW_USER RETURNS VARCHAR2
PROCEDURE GET_SESSION_INFO
Argument Name Type In/Out Default?
NUM_PARAMS NUMBER OUT
PARAM_NAMES TABLE OF VARCHAR2(32000) OUT
PARAM_VALUES TABLE OF VARCHAR2(32000) OUT
PROCEDURE RESET_SESSION
Argument Name Type In/Out Default?
P_COOKIE_NAME VARCHAR2 IN
In my case only the Login Server (PORTAL30_SSO) is going to be used/installed
- the SAMPLE_SSO_PAPP application will only work if the DAD used to access is it set to use Basic authentication, i.e. the actual integration with the Login Server
is done in the sample application code calls, stored in the database
- when a DAD has enableSSO=yes it automatically accesses Portal (PORTAL30) packages to implement N-Tier authentication
I'm currently testing:
1. Configuring the SAMPLE_SSO_PAPP sample as documented with a DAD with Basic authentication
2. Amending the ssoapp procedure to set context to another (db) user on successful authentication:
wwctx_api.set_context (
p_user_name => 'SCOTT',
p_password => 'TIGER' );
3. If this works then set_context with get_lw_user instead
I have now amended the ssoapp procedure as follows to print out
1. The userid entered when the login box is presented
2. The Database user which the Portal Lightweight user is mapped to
3. The Lightweight user Portal has used for authentication
Amendments to papp.pkb:
(ssoapp procedure, declare db_user_info and lw_user_info as VARCHAR2 in declare section)
htp.p('Congratulations! It is working! ');
db_user_info := wwctx_api.get_db_user;
lw_user_info := wwctx_api.get_user;
htp.p('User Information:' || l_user_info || ' ');
htp.p('DB User Information:' || db_user_info || ' ');
htp.p('LW User Information:' || lw_user_info || ' ');
The following shows the interesting results from my testing:
- if the user owning the sample_sso_papp package is PORTAL30_SSO then the call to wwctx_api.get_db_user succeeds
- if the user owning the sample_sso_papp package is a non-portal schema e.g. SSOAPP below the call to wwctx_api.get_db_user generates a User Defined exception
Steps to test:
Created new schema SSOAPP on the database
- edited it in Portal and checked the use this schema for Portal users checkbox
- created new Lightweight user SSO_LW in Portal, mapped it to SSOAPP schema
- created new Lightweight user SSO_SCOTT in Portal, mapped to SCOTT schema
- loadjava -user ssoapp/ssoapp@portal30 SSOHash.class
- sqlplus portal30/portal30@portal30
@provsyns ssoapp
- sqlplus ssoapp/ssoapp@portal30
@loadsdk.sql
@loadpapp.sql
Created DAD with basic authentication SAMPLE_SSO_PAPP
- username: ssoapp
- default home page: sample_sso_papp.ssoapp
Registered the Sample SSO Partner Application with the Login Server and ran regapp.sql
Commented out the calls to get_db_user in papp.pkb to avoid exception
- called http://<server>/pls/sample_sso_papp
- logged on as SSO_LW/sso_lw
- got output:
Congratulations! It is working!
User Information: SSO_LW
LW User Information: PUBLIC
So the Portal lightweight user is not returned as SSO_LW
if anyone knows why the Lightweight User in my test is returned as PUBLIC not SSO_LW
Best Regards
MIchael

http://support.mozilla.com/en-US/kb/Changing+the+e-mail+program+used+by+Firefox

SSO for partner applications

Hi All,
I have installed 10g AS Release 2 on a system. I also have Application Express(formerly HTML DB) installed on the same system. I registered one of the HTML DB applications as partner applications and have put SSO authentication for it.
When I try to login the AS looks at the OID installed on the system(which I gave during installation). I want it to look at the Oracle gmldap.oraclecorp.com server OID so that only Oracle employees login.
Can anybody tell me how to change the OID and what are the entries to be give to configure it to gmldap.oraclecorp.com server??
Thanks,
Swaroop

See Task 3 in the Section 9.4 of the Oracle Application Server Administrator's Guide:
http://download-west.oracle.com/docs/cd/B14099_17/core.1012/b13995/chginfra.htm#i1014978
See the following for information about what to specify on each page.
http://download-west.oracle.com/docs/cd/B14099_17/core.1012/b13995/reconfig.htm#i1013341

SSO requires double login for partner application

I'm having some trouble with SSO partner applications, when I login to a SSO protected application, the login works fine, but when I try to navigate to another application I'm presented with the login page again, the sso cookie seems to be working since clicking on the login button without entering the user credentials works. For example, I log in to portal and from there I navigate to a forms application that is on the same server and the same port (portal: https://apps.mydomain.com:4444/pls/portal --> forms: https://apps.mydomain.com/forms/frmservlet?config=app) I am presented with the login page and after clicking on the login button without entering any information everything works fine. This is happening for all the middle tiers that are connected to the same OID. Any ideas on what can be wrong on my configuration?

Hi Andrey,
The problem sounds really wierd.
Can you check your SSO settings for your Portal ECC system? I mean, please check the User Management/Administration properties in your System Adminstration of Portal System that points to ECC.
Regards
Raja Sekhar

Ssodatan and partner application

Similar Messages

Maybe you are looking for