401 Unauthorized” error when tried to loging into SSO application

Recently I have faced one issue in one of our development node. The problem is “401 Unauthorized” when tried to login into sso integrated application and upto two days back it was working fine.

Environment details:
 Oracle Application Server Single Sign-On – Version: 10.1.4.3 and OAM 10.1.4.3 running in same node. OAM_OSSO are integrated.

 I  got 401 Unauthorized error when I tried to access the oiddas application and I have seen the below exception in ssoServer.log

 Thu Jun 07 20:55:04 IST 2012 [ERROR] AJPRequestHandler-ApplicationServerThread-9 Could not get attributes for user, orcladmin

oracle.ldap.util.NoSuchUserException: User does not exist – SIMPLE NAME = orcladmin

        at oracle.ldap.util.Subscriber.getUser_NICKNAME(Subscriber.java:1160)

        at oracle.ldap.util.Subscriber.getUser(Subscriber.java:923)

        at oracle.ldap.util.Subscriber.getUser(Subscriber.java:870)

        at oracle.security.sso.server.ldap.OIDUserRepository.getUserProperties(OIDUserRepository.java:537)

        at oracle.security.sso.server.auth.SSOServerAuth.authenticate(SSOServerAuth.java:508)

        at oracle.security.sso.server.ui.SSOLoginServlet.processSSOPartnerRequest(SSOLoginServlet.java:1076)

        at oracle.security.sso.server.ui.SSOLoginServlet.doPost(SSOLoginServlet.java:547)

        at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)

        at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

        at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:826)

        at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:332)

        at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:830)

        at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:224)

        at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:133)

        at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:192)

        at java.lang.Thread.run(Thread.java:534)

 Please find the workaround as below
    I have found one metalink Id(987877.1) which is deals the same issue. It’s says, issue in custom plugin configured for Oracle SSO (OSSO) and I have executed the following action plan.
        Recompile the custom plugin with a different name e.g. SSOSMAuth, so that file SSOSMAuth.class is created instead of SSONeteAuth.class
        Copy file SSOSMAuth.class to $ORACLE_HOME/sso/plugin
        Edit file $ORACLE_HOME/sso/conf/policy.properties and set the following:
        MediumSecurity_AuthPlugin = oracle.security.sso.server.auth.SSOSMAuth
        Restart OC4J_SECURITY:
        $ORACLE_HOME/opmn/bin/opmnctl stopproc process-type=OC4J_SECURITY
        $ORACLE_HOME/opmn/bin/opmnctl startproc process-type=OC4J_SECURITY
    I got the same error when tried to login again.
    After some workaround I found the root cause for this issue. The problem is common user search base (orclcommonusersearchbase attribute) was modified or new values were added.  More details as follow,
    At least one of the search bases configured (orclcommonusersearchbase attribute in the  cn=Common,cn=Products,cn=OracleContext,<realm DN> entry) does not exist in OID or wrongly configured. Here, Configured searchbase not exist in OID.
    The entries set for orclcommonusersearchbase attribute are used by SSO as search bases to locate the user entry. If the base does not exist in OID, the ldap search operation is failing with “Ldap error code 32: LDAP_NO_SUCH_OBJECT”. Ldap error code 32 means the base specified for the operation does not exist.
    Login to oidadmin tool and navigate to cn=Common,cn=Products,cn=OracleContext,<realm DC>
    Go to orclcommonusersearchbase attribute and correct / delete the incorrect values. All the entries defined in the orclcommonusersearchbase attribute must exist in OID.

 Or

    Connect the OID using LDAPbrowser or JXplorer and navigate to cn=Common,cn=Products,cn=OracleContext and correct orclcommancusersearchbase attribute according to the environment. After this change I have restart the infra node and tried to login. The issue is vanished.

Or

using ldapmodify command:
a. Then create ldif plain file adding.ldif like:
dn: cn=Common,cn=Products,cn=OracleContext,dc=shamrockfoods,dc=com
changetype: modify
replace: orclcommonusersearchbase
orclcommonusersearchbase: cn=users, dc=dec,dc=co,dc=in
 b. Then run ldapmodify command:
ldapmodify -h hostname -p 389 -D cn=orcladmin -w <passwd> -v -f adding.ldif
c. Restart components in the infra node and test.

Questions for Oracle Apps 11i & R12 Integration with 10g AS/SSO

Here are few questions which you should think/ask/discuss for Oracle Applications 11i & R12 Integration with 10g Application Server (Portal, Discoverer, SSO, OID)

Do you need 10g Portal component of 10g AS with Oracle Applications 11i & R12 ?
(*Integration of 10g AS can be without portal and dicoverer as well i.e. OID & SSO only. For 10g portal Integration you must have SSO and OID)

Do you need 10g Discoverer component of 10g AS with Oracle Application 11i ?
(* You can have discoverer with or without SSO access)

Do you need SSO and OID component of 10g AS with Oracle Applications 11i / R12 ?
(*You can configure only SSO/OID for Single Sign-On access with or without Portal and Discoverer)

Do you need 10g Web Cache component of 10g AS with Oracle Applications 11i ?
(*You can configure webcache with or without Portal/OID/SSO. With Portal webcache is default)

Do you have third party access management (Netegrity SiteMinder, Oblix COREid) for Single Sign-On ?
(* You can configure 10g SSO with third party access management via Oracle SSO)

Source of Authentication in Oracle Apps 11i / R12?
(* –You can configure authentication at E-Business Suite, Oracle SSO, Third party SSO or combination of above.
–Configuring authentication, local to E-Business for some users and for others SSO is also supported)

–Do you have third party LDAP directory (Microsoft Active Directory, Sun iPlanet) which you want to synch with OID and E-Business Suite ?
(* You can use third party ldap server for user store integrated with OID and then synched to E-Business Suite Users)
—– If third party LDAP Server is in place check following things for OID to third party integration (DIT, Default Realm, nickname attribute)
—–As of Integration build 5 synching users from E-Business to OID is supported with default realm only. Take special care if you have multiple realms in LDAP Server


–One SSO User account can be mapped to Multiple Users in E-Business Suite (other way is not supported), Do you need this ?

–Multiple E-Business Suite can use Single OID/SSO Instance or each E-Business Suite Instance can be registered with its own OID/SSO. For Dev & Test E-Business Suite you may be interested in registering them to single OID/SSO Instance.

–User Creation/Management/Updates : From OID to Apps, Apps to OID or bidirectional

– Attributes to synch during ongoing Updates
* All user attribute sync can’t be updated between OID & E-Business Suite. Check provisioning profile used for synch between Apps & OID
* Check if TCA tables are updated as required with User Updates in OID

– Decide on how Users will be loaded Initially :
—-From OID to E-Business (Users are already in OID but E-Business Suite is new implementation)
—- E-Business Suite to OID (Users are already in E-Business Suite but OID is new implementation)
—- In both E-Business Suite & OID (OID and E-Business both has user base but not in sync) You can reconcile user base in Apps & OID

– E-Business Suite Home Page (Portal or Framework)

– Is Password Policy in E-Business Suite different from Password policy in SSO ? Things like
—-User should change password on first time login
—-Password Strength, minimum number of characters & at least few some number
—-Password will expire after n number of days

–Idle Session Time out for SSO
* By default there is no Idle Session timeout in Oracle SSO Server (There is default Global Session Time Out set at SSO with value 8 hours) but E-Business Suite is configured with Idle Session time out of 30 minutes. To set Idle Session time out value to desired value in SSO Server check Oracle SSO Admin Guide

More on 10g Application Server (OID/SSO) integration with E-Business Suite coming soon..

——–User creation/update/synch flow in OID-Apps(E-Business Suite) Integrated instances and troubleshooting user creation/update issues ?

——-User login flow in OID-Apps(E-Business Suite) Integrated Instances and troubleshooting login issues ?

——-Common tasks for which Apps DBA’s should take extra care in Apps/OID/SSO integrated instances (Cloning, changing apps password, patching…)