Weblogic Single Sign On on Active Directory doesn't work

Hello!
Please help me to work out what my mistake is.
I configured Weblogic for SSO on Active Directory using article, described on support.oracle.com.
My krb5.ini file is
[libdefaults]
default_realm = DOMAIN.RU
default_tkt_enctypes=des-cbc-crc
default_tgs_enctypes=des-cbc-crc
udp_preference_limit = 1
[realms]
DOMAIN.RU= {
kdc=192.168.1.1
admin_server = DC.DOMAIN.RU
default_domain = DOMAIN.RU
[domain_realm]
.DOMAIN.RU= DOMAIN.RU
DOMAIN.RU= DOMAIN.RU
When I try to launch check by running kinit command I get following error
C:\Users\testuser>kinit -k -t "C:\Oracle\Middleware\user_projects\domains\base_d
main\test.keytab" HTTP/[email protected] -J-Dsun.security.krb5
debug=true
KinitOptions cache name is C:\Users\testuser\krb5cc_testuserPrincipal is HTTP/[email protected]
Kinit using keytab
Kinit keytab file name: C:\Oracle\Middleware\user_projects\domains\base_domin\test.keytab
KeyTabInputStream, readName(): DOMAIN.RU
KeyTabInputStream, readName(): HTTP
KeyTabInputStream, readName(): test01.domain.ru
KeyTab: load() entry length: 66; type: 1Added key: 1version: 5
Ordering keys wrt default_tkt_enctypes list
Config name: C:\Windows\krb5.ini
default etypes for default_tkt_enctypes: 1.
0: EncryptionKey: keyType=1 kvno=5 keyValue (hex dump)=
0000: 79 02 0D 8A 19 29 67 E0
Kinit realm name is DOMAIN.RU
Creating KrbAsReq
KrbKdcReq local addresses for test01 are:test01/192.168.1.2
IPv4 address
test01/ga80:0:0:0:te2e:3de1:crew:a409%11
IPv6 address
default etypes for default_tkt_enctypes: 1.
KrbAsReq calling createMessage
KrbAsReq in createMessage
Kinit: sending as_req to realm DOMAIN.RUException: krb_error 0 Cannot get kdc for realm DOMAIN.RU No error
KrbException: Cannot get kdc for realm DOMAIN.RU
at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:168)
at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:147)
at sun.security.krb5.internal.tools.Kinit.sendASRequest(Kinit.java:298)
at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:237)
at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:107)
Thank you!

Hi,
Refer this..
http://help.sap.com/saphelp_crm52sp01/helpdata/EN/89/6eb8deaf2f11d5993700508b6b8b11/frameset.htm
Regards
Nandha

Similar Messages

OBIEE 11G with Single Sign-On and Active Directory

Hi guys,
Release Version: Oracle Business Intelligence 11.1.1.5.0
Patch applied: 11.1.1.5.0 BP3 (Patch 13832750)
OBIEE Server operating system: Windows Server 2008 SP2 (32-bits Operating System).
We are trying to configure Single Sign-On according to TechNote_WNA_SSO_AD_V4.0.doc.
Our krb5login.conf:
com.sun.security.jgss.krb5.initiate {
com.sun.security.auth.module.Krb5LoginModule required
principal="[email protected]"
keyTab=cgdkobi2.keytab
useKeyTab=true
storeKey=true
debug=true
com.sun.security.jgss.krb5.accept {
com.sun.security.auth.module.Krb5LoginModule required
principal="[email protected]"
keyTab=cgdkobi2.keytab
useKeyTab=true
storeKey=true
debug=true
We generate de keytab file:
C:\OracleBI11g\user_projects\domains\bifoundation_domain>C:\OracleBI11g\jrockit_160_24_D1.1.24\bin\ktab.exe -k cgdkobi2.keytab -a [email protected]
Password for [email protected]:XXXXXXX
Done!
Service key for [email protected] is saved in cgdkobi2.keytab
C:\OracleBI11g\user_projects\domains\bifoundation_domain>C:\OracleBI11g\jrockit_160_24_D1.1.2-4\bin\kinit -k -t cgdkobi2.keytab cgdkobi2
New ticket is stored in cache file C:\Users\cgdkobi2\krb5cc_cgdkobi2
C:\OracleBI11g\user_projects\domains\bifoundation_domain>C:\OracleBI11g\jrockit_160_24_D1.1.2-4\bin\klist -k -t cgdkobi2.keytab
Key tab: cgdkobi2.keytab, 1 entry found.
[1] Service principal: [email protected]
KVNO: 1
Time stamp: Mar 15, 2013 10:34
C:\OracleBI11g\user_projects\domains\bifoundation_domain>klist
Current LogonId is 0:0x406163f5
Cached Tickets: (0)
We re-start the services and logon into analytics web and SSO doesn't work but there's not an error. It runs successfully with and Active Directoy user and password. Seems like SSO wasn't enabled, but I checked is enabled.
Any suggestion?
Thanks in advanced

Follow the posts : OBI 11.1.1.6.SSO and You are not currently signed in to Oracle BI Server" for OBIEE 11.1.1.6 SSO do the troubleshooting mentioned there.
Also check your logs for error like the one below:
[2012-03-09T16:42:36.000-05:00] [OBIPS] [NOTIFICATION:1] [] [saw.securitysubsystem.checkauthentication.runimpl] [ecid: 6c98b5cce1f24814:2a613331:135f95fbdff:-8000-0000000000005b7a,0:1:1] [tid: 5932] Authentication Failure.
Odbc driver returned an error (SQLDriverConnectW).
State: 08004. Code: 10018. [NQODBC] [SQL_STATE: 08004] [nQSError: 10018] Access for the requested connection is refused.
[nQSError: 43113] Message returned from OBIS.
[nQSError: 13039] The impersonator does not exist in the BI Security Service. (08004)[[
If you are getting this when you login to OBIEE : You are not currently signed in to Oracle BI Server"
then you need to apply this patch : 13553428 QA:BLK:DELIVER TO CORP. OID LDAP USERS FAILED WITH IMPERSONATOR DOES'NT EXIST. 11.1.1.6.0 Generic Platform (American English) General Oracle BI Suite EE Apr 5, 2012 799.4 KB
Let us know the updates. Hope this helps. Mark if it does.!
Thanks,
SVS

I cannot sign into iCloud on my iMac. I have read all of the help information, but that isn't working. I cannot do anything with my system preferences - like add a new printer - because it won't log me in, sign me out, forget password doesn't work, etc.

I have been unable to log in to iCloud on my iMac. None of the hints online have worked. I can't sign in (with any password), sign out, the forget password doesn't work, the support button doesn't work. It's locked. I can't find anyway to fix this - I need to add a new printer ASAP - help!!!

The "Mail, Contacts & Calendars" window popped up a couple of weeks ago and is asking for my Apple ID password, which it will not accept, It won't sign me out (I am not logged in), the support or forgot password buttons won't work. With this window stuck open, I cannot access anything on system preferences. I can't find any way to make it go away. I have tried both my current and old Apple ID passwords, tried using FaceTime to login with the newer password, etc.

Search for single member in an Active Directory Group

Hello all,
I'm attempting to find a better method to search if a user is a member of a group in Active Directory. I currently retrieve the entire member attribute of the group.
I need to reduce the time of the query. I would like to be able to search for a specific member (user) of the group instead of retrieving the entire member list of the group.
I can post my current code if that would help.
I believe the default Active Directory group object is the ldap group. I know that there are posixGroup and groupOfUniqueNames ldap classes available, but I'm not sure if Active Directory has access to those classes.
Is my request possible using the group ldap object?

Thanks for the reply.
I have read the first post you gave, but not the second. I'm off to read that now.
My main concern is that I don't have access to the DN of the user in the member attrib. I have access to their CN and uid (which is indexed). From what I can recall from when I last updated this code, I couldn't create a wildcard search filter e.g.,:
(&(cn=All Scientists)(objectClass=Group)(member=CN=Albert Einstein*))
If that's correct and I require a DN, is there any way around this?
I was interested in the posixGroup and groupOfUniqueNames classes. I wasn't aware that these were available through Active Directory, but I see them listed in the AD schema (http://msdn.microsoft.com/en-us/library/ms683908(VS.85).aspx).
If I'm correct, posixGroup would allow for a filter of (&(cn=All Scientists)(objectClass=posixGroup)(memberUid=AEinstein))
I'm not sure how typical it is to use the posixGroup class in AD and I'll have to check with my AD team before moving forward with this. But I wanted to get some more direction/ideas before asking them to create some posixGroup objects for me.
I'm now going to go and read the second post you linked, but I wanted to put the rest of my details out there.
Thanks again.

Active Directory Offline Login work??

Hey all,
I'm having an issue with loging in to a Leopard client which is bound to Active Directory. Whenever I unhook this MacBook, off the network, it won't allow me to login to the machine via the domain credentials. In Tiger, I remember there was a check mark option under the AD plugin referring to Caching login credentials for AD, but this is not present in the Active Directory plugin in Leopard.
I also read that caching is a bit dicey in Leopard, so users have just been check marking creating a Mobile User account, and this seems to offer the ability to signing in to your machine without being connected to the network.
But what happens in my case, is that the user goes from being an admin account to a standard account, when offline from the network. Once I re-hook the machine back on to the network, I regain admin control of the machine. This is very odd, as I have not run into this issue before. I am not interested in syncing the home folder to the server at all, and I hope I have not accidentally triggered this, although I think you have to set this up also on the server in order for the syncing to occur, right?
Anyway...all I want to be able to do, is setup offline login of AD credentials on a MacBook. Is this possible while retaining the admin rights of the computer?
Message was edited by: Syrcle

We've always used the "Create Mobile Account at Login" check in both 10.4 and 10.5, but I have experienced the admin coming and going like you mentioned (If I remember right 10.4 did it too). On my personal machine (and others in the tech department) I've just opened system prefs and checked the "Allow User to administer this computer" box which makes it permanant, though it's unfortunately not a good solution for large scale deployment.
It does work for our situation because generally we're the only ones administering machines and ours are the only ones we need the rights off the network, so it may be a solution for you as it sounds like you're only working with one machine.

Active Directory binding not working

Hi
I'm trying to bind to my active directory at work.
On tiger I used the following settings
serverdomain.ad
the servers name is machine
Which worked fine.
On leopard when I use either serverdomain.ad or machine.serverdomain.ad I get the following error message
(loosely translated from swedish)
An unknown combination of domain and treecollection was used. You should use a complete DNS-name for the domain and tree collection (i.e something.company.se)
Does anyone know what I should use..the FQDN is machine.serverdomain.ad - shouldnt that work?

The answer was dns.. my client was using the correct nameserver.
The binding worked after that..although I'm not sure its autenticating as it should

Create Directory Doesn't Work!!! (stupid computers, mumble grumble)

Ok, so maybe I'm an ass.... but this rather simple section of code to dynamically create a timestamped directory if it's not there, and not create it if it is, doesn't work. I can't understand why it doesn't, but it doesn't. Can someone please help me out, I've written a huge super complex imaging program and finished it this past sunday only to have the very last problem in the software be with this stupid save file routine!
Thanks so much for the help!
Jonathan
Attachments:
createnewdir.vi ‏18 KB

Jonathon,
When I run your VI on my Mac, I get a File not Found error from the File/Directory Info function. That error is fed into the New Directory function, which probably prevents it from running. I think the same thing will apply to other OSes, but I am not sure.
Try putting a probe on the error in line inside the case structure and see what you get.
Lynn

My activation code doesn't work. I HAVE PAID YOU!

My activation code (Product Key) doesn't work! Why even send it at all if you know its not going to work.
Why does Adobe software install so easily yet Microsoft . . . nothing but problems.
Your order number:
[Deleted number]
Order date:
November 14, 2014
Bill to:
[Deleted OP's private information]

My activation code (Product Key) doesn't work! Why even send it at all if you know its not going to work.
Why does Adobe software install so easily yet Microsoft . . . nothing but problems.
Your order number:
[Deleted number]
Order date:
November 14, 2014
Bill to:
[Deleted OP's private information]
Which Office version?
Office 2013? Office 365? Something else?

Valid license code for activation that doesn't work HELP!

I had to reinstall CS3 back on to my computer after having to do a factory reset on the computer. I downloaded CS3 from Adobe.com since my CDs are in another state. After installation I go to enter my code for the programs and CS3 won't accept my VALID license code to activate the account. It worked perfectly fine before I had to reset my computer and it is currently installed on one other computer but I need it on this one! Please help! I talked with Adobe already and they said that since the product is outdated I needed to visit the forums to find an answer as to why my activation code won't work or if anyone can help with suggestions. Thank you!

Contact serial number support by web chat.
Mylenium

WebLogic Server 8.1 Integrating Active Directory Filtering Users by Group

I am trying to specify the User Base DN value with a Group. I only want users with in that group retrieved from AD. Any assistance would be appreciated.
Using AD examples from this site:
http://support.bea.com/support_news/product_troubleshooting/LDAP_Issues_Pattern.html
I attempted to enter LDAP config values in the following way. However, while users DO exist in the group Users, which is specified in the UserBaseDN parameter, no users from LDAP show up on the Admin Console's users screen. No error occurs on the lookup either, so this values agrees with the directory structure:
<weblogic.security.providers.authentication.ActiveDirectoryAuthenticator
ControlFlag="SUFFICIENT" Credential="{3DES}96Kl0euDFQQ="
GroupBaseDN="CN=Users,DC=supportLDAP,DC=example,DC=com"
GroupFromNameFilter="(&(cn=%g)(objectclass=group))"
Host=" HOST IP or NAME OF LDAP"
Name="Security:Name=myrealmActiveDirectoryAuthenticator"
Principal="CN=Administrator,CN=Users,DC=supportLDAP,DC=example,DC=com
Realm="Security:Name=myrealm"
StaticGroupDNsfromMemberDNFilter="(&(member=%M)(objectclass=group))"
StaticGroupNameAttribute="cn"
StaticGroupObjectClass="group"
StaticMemberDNAttribute="member"
UserBaseDN="CN=Users,DC=supportLDAP,DC=example,DC=com"
UserFromNameFilter="(&(cn=%u)(objectclass=user))"
UserNameAttribute="cn" UserObjectClass="user"/>

Hi
I didn't filter it on the provider configuration.
Instead I removed some presentation services prvileges from authenticated users and granted them only to some specific application roles. You don't have to remove authentiated users from much privileges just some basic ones as "see Dashboards" and so on.
Now everyone can authenticate on the login page but after logon they get a message that the don't have permissions to access answers, dashboards and so on.
Regards

Groups field in Windows Active Directory doesn't get updated

Hello IDM Experts,
I am trying to append one more group to a few hundred users in AD. When I run the below code, I am not getting any error and at the same time the groups field in AD doesn't seem to get updated either. Any thoughts? Thanks!
<Activity id='1' name='CheckOut'>
<Action id='0' name='Check Out AD' application='com.waveset.session.WorkflowServices'>
    <Argument name='op' value='checkoutView' />
    <Argument name='type' value='User' />
    <Argument name='id' value='$(userId)' />
    <Argument name='authorized' value='true' />
    <Argument name='subject' value='Configurator' />
    <Argument name='Form' value='Empty Form'/>
    <Return from='view' to='userview' />
</Action>
<Action id='2' name='Change AD Values'>
    <expression>
      <block>
        <append name='userview.accounts[Sample Domain].groups'>
          <s>CN=grp_ext_owner,OU=Task Groups,OU=Groups,DC=sample,DC=com</s>
        </append>
        <ref>userview.accounts[Sample Domain].groups</ref>
      </block>
    </expression>
</Action>
<Action id='3' name='Check In AD' application='com.waveset.session.WorkflowServices'>
    <Argument name='op' value='checkinView' />
    <Argument name='view' value='$(userview)' />
    <Argument name='authorized' value='true' />
    <Argument name='subject' value='Configurator' />
</Action>
<Transition to='end' />
</Activity>

Some ideas...
1) Do you have a mapping of the groups attribute in your Sample Domain resource adapter? One element should read similar to:
<AccountAttributeType id='10' name='groups' syntax='string' mapName='groups' mapType='string'/>2) Is the groups attribute already a list? If not (e.g. no groups yet assigned), the append statement might not actually do anything.
3) Your statement below the append doesn't actually do anything. Well, it should not break anything, but who knows.

Flat File Active Sync doesn't work for account creation without unique id

Hi,
I'm trying to set up a FlatFileActiveSync for creation and update of accounts in IDM 7.0. I've followed the below steps for this purpose :-
1) Create a correlation rule (confirmation rule not reqd in my case).
2) Create a proxy admin and assign him a empty form. Also give him control over Top organisation.
3) Create a Flat-File Resource Adapter.
4) Create ActiveSync input form using the (Active Sync) wizard.
5) Start Active Sync...
My feed file contains only 3 fields firstname, lastname, email Id.
My correlation rule has the logic of matching up with IDM accounts(Lighthouse accountId) by taking first letter of firstname and concat with lastname from the data coming from feed file.
Now everything works fine for account updates i.e. if I change somebody's email Id who already exists in IDM I can actually see the changed email Id in Configurator's console.
But if I put in a record that doesn't exist, and which I expect to be created, it gives me an error.
Although, if I introduce a unique identifier in my feed file and link it with Lighthouse.accountId the account creation works fine.
Is this a limitation or I'm not doing something right ?
Exception I saw in resource log with log level 4 :
2007-04-30T10:02:12.291-0400: Error Processing Line: {lastname=Pogu, firstname=Gogu, [email protected]}
com.waveset.adapter.iapi.IAPIException: There was a conflict with the record [{lastname=Pogu, firstname=Gogu, [email protected]}]
and no resolution process has been specified on the adapter.
It is recommended that you define the process for handling unmatched accounts
on this load process.
2007-04-30T10:02:12.292-0400: Poll complete.
2007-04-30T10:02:12.292-0400: SARunner: loop 1076
2007-04-30T10:02:12.314-0400: Started, paused until Mon Apr 30 10:07:12 EDT 2007
2007-04-30T10:07:12.024-0400: Pause completed
2007-04-30T10:07:12.038-0400: Polling
2007-04-30T10:07:12.056-0400: Error Processing Line: {lastname=Poker, firstname=Hoker, [email protected]}
com.waveset.adapter.iapi.IAPIException: There was a conflict with the record [{lastname=Poker, firstname=Hoker, [email protected]}]
and no resolution process has been specified on the adapter.
It is recommended that you define the process for handling unmatched accounts
on this load process.

That logic is in my correlation rule as I specified in my initial post and here's the XPRESS code for it :-
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC 'waveset.dtd' 'waveset.dtd'>

<Rule subtype='SUBTYPE_ACCOUNT_CORRELATION_RULE' id='#ID#D23CC16ECF6E5D42:-4527465C:11224925657:-769F' name='HR_DB_CORR' creator='Configurator' createDate='1177449448746' lastModifier='Configurator' lastModDate='1177686884156' lastMod='61'>
<Description>Find out if a resource account is correlated to an IDM account</Description>
<cond>
<and>
<notnull>
<ref>firstname</ref>
</notnull>
<notnull>
<ref>lastname</ref>
</notnull>
</and>
<block>
<concat>
<substr>
<ref>firstname</ref>
<i>0</i>
<i>1</i>
</substr>
<ref>lastname</ref>
</concat>
</block>
<s>false</s>
</cond>
<MemberObjectGroups>
<ObjectRef type='ObjectGroup' id='#ID#Top' name='Top'/>
</MemberObjectGroups>
</Rule>
Although this is not specified in Active Sync input form but in the correlation rule attribute of Active Sync config (using the wizard). Do I need to specify it there using the Field function.
Also, I figured out today that I needed to restart IDM instance after changing the value of "Create Unmatched Accounts" flag and now the error is as below :-
<WavesetResult>
<ResultItem type='error' status='error'>
<ResultError throwable='com.waveset.util.WavesetException'>
<Message id='SES_VIEW_CHECKIN_ERROR'>
</Message>
<StackTrace>com.waveset.util.WavesetException: Unable to checkin view. No account ID specified.
	at com.waveset.view.UserViewer.checkinView(UserViewer.java:1165)
	at com.waveset.object.ViewMaster.checkinView(ViewMaster.java:727)
	at com.waveset.sync.IAPIUserImpl.processCommand(IAPIUserImpl.java:526)
	at com.waveset.sync.IAPIUserImpl.submitCreate(IAPIUserImpl.java:195)
	at com.waveset.sync.IAPIUserImpl.submit(IAPIUserImpl.java:749)
	at com.waveset.adapter.FlatFileActiveSyncAdapter.processLine(FlatFileActiveSyncAdapter.java:404)
	at com.waveset.adapter.FlatFileActiveSyncAdapter.processFlatFile(FlatFileActiveSyncAdapter.java:350)
	at com.waveset.adapter.FlatFileActiveSyncAdapter.poll(FlatFileActiveSyncAdapter.java:307)
	at com.waveset.task.SARunner.doRealWork(SARunner.java:288)
	at com.waveset.task.Executor.execute(Executor.java:154)
	at com.waveset.task.TaskThread.run(TaskThread.java:132)
</StackTrace>
</ResultError>
</ResultItem>
</WavesetResult>

Can't sign in, can't quit, doesn't work.

Honestly, I am completely done with Skype. I have been using this application for over 2 years now and there is this one problem that continuously persists and appears on my laptop, as well as others.
When I log in, everything seems to be working fine and well until you actually try to use the application. I cannot change my status from online to away, offline or anything at all. I can still click buttons, open my settings, but nothing changes and calling/messaging others won't work either.
When I sign out and generally quit Skype, it continues running in my taskbar and will even say "this program cannot be stopped" when I try to force-quit it. Then, if I try to log in again, it will say that I am still logged in on this computer while I clearly am not. Only shutting down my laptop will quit the program.
I have tried deleting, reinstalling and nearly every method suggested but nothing changes.
I run Windows 8 and yes, even installed the latest update every single time in hopes that the problem would be solved. Nothing ever changed though.
Hopefully anyone has a solution for this, because I am about to quit Skype altogether.

Reboot your computer in Safe Mode and then try to reset all Skype settings.
Go to Windows Start and in the Search/Run box type %appdata% and then press Enter or click the OK button. The Windows File Explorer will pop up. There locate a folder named “Skype”. Rename this folder to something different, e.g. Skype_old.
Next go to Windows Start and in the Search/Run box type %temp%\skype and then press Enter or click the OK button. Delete the DbTemp folder.
Reboot in normal mode and restart Skype.

Activating CS5 doesn't work because of two reasons

Hello,
I have been using CS5 (student and teacher edition) for a long time and upgraded to Creative Cloud.
When I switched over to CC, I did not deactivate CS5, because I thought, I never wanted to use it anymore.
Now I wanted to install it in my notebook, to have a good graphics-software on that device, too. Unfortunately, I couldn't activate it, as there were too many acivations before.
I understand that, but I can not deactivate CS5 on the other computer, as I don't have it installed anymore.
Could you please do that for me?
One more problem I have: In the activation process, I am adviced to establish an internet connection.
But the internet connection is up and running (Webbrowser loads any website I am trying to access) and I am not using a proxy.
Can you give me a hint on that issue, too?
Regards
Christian Heisch

You'll have to do that through Web Chat:
http://helpx.adobe.com/x-productkb/policy-pricing/account-password-sign-faq.html

My ipod always has a charged sign. My selector button doesn't work too!!!

when ever i finish charging my ipod, it says charged and when i unplug it, it still says charged. there's like some invisible charger plug in it but it always says charged. this depletes it's battery source. My selector round button in the middle is weird. it works to reset the ipod but it cant click anything else. it's not broken just doesn't wanna respond.

Have you tried doing a restore on it yet? Since the middle button works for a reset, it must be working, but that it doesn't do anything normally makes me think your iPod may need a full Restore.
http://www.apple.com/support/ipod/five_rs/
Patrick

Weblogic Single Sign On on Active Directory doesn't work

Similar Messages

Maybe you are looking for