LDAP authentication with OWSM

OWSM policies works seamlessly with integrated LDAP provided by weblogic. However sometimes the requirement is to integrate the OWSM policies like user name token policy to work with external LDAP.

Here are the steps that I recently followed to secure my Proxy services using OWSM and user token authenticated using LDAP server.


Part I: Create an external LDAP provider in weblogic

1. Add LDAP Provider : Login to Weblogic console
Home >Summary of Servers >Summary of Security Realms >myrealm >Providers
Create a new provider : MyLdapProvider
Type :  Active Directory Authentication provider



2) Set Control Flag : Sufficient
This step is important as this will make sure that if the user is not validated using this provider the validation will go to next provider. As the document says:
A SUFFICIENT value specifies this LoginModule need not succeed. If it does succeed, control is returned to the application. If it fails and other Authentication providers are configured, authentication proceeds down the LoginModule list




3. Set the Provider Specific configuration this is very important to get connected to LDAP server.

Host : mycompanycatalog.com
Port : 389
Principal  : CN=LdapAdmin,OU=WLUsers,DC=Myorg,DC=com
Credential : password

User Base DN: OU=WLUsers,DC=Myorg,DC=com , add filter for particular user if you want to restrict the access to only one user. like CN=Sam001, OU=WLUsers,DC=Myorg,DC=com

Group Base DN :OU=MyorgUsers, DC=Myorg,DC=com

4. Reorder Providers to make MyLdapProvider as first provider

5. Restart the servers

6. Verify if the LDAP settings are good .

My Realms -> Users and Groups

You should see the user fetched from Ldap Provider MyLdapProvider

Part II : Securing the OSB proxy with OWSM

1) Attach the policy to Proxy service

oracle/wss_username_token_service_policy

2) Pass security header with LDAP user credentials :

  <wsse:Security soapenv:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">

         <wsse:UsernameToken wsu:Id="UsernameToken-4" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">

            <wsse:Username>Sam001</wsse:Username>

            <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">PassWord3241</wsse:Password>

         </wsse:UsernameToken>

  </wsse:Security> 

This works !!

Creating REST Services in OSB

In my previous post Rest Support from OSB I have explained on how to consume the HTTP post multi mime REST service in OSB . This post describes on how to create REST services in OSB for basic native HTTP methods GET & POST .


Part I : Creating a proxy service for Native HTTP methods (GET/ POST) and Testing :
1) Decide on how the query parameters will be passed to the GET service , there are two approaches first using relative URL parameters or using the Query string. I prefer the query string approach where you can pass multiple query parameters , like :
http://localhost:7001/LoanRestServices/Proxy/GetLoanService?BorrId=101&LoanId=9001

The value of these parameters can be fetched inside the proxy flow using xpath :
$inbound/ctx:transport/ctx:request/http:query-parameters/http:parameter[@name="BorrId"]/@value
$inbound/ctx:transport/ctx:request/http:query-parameters/http:parameter[@name="LoanId"]/@value


2) Create a Proxy Service : GetLoanService
Type : Any XML Service

3) Implement message flow

3.1 you can create separate services for each type of operation or can use conditional Branch, here is how the flow should look like using the conditional branch:




The conditional branch will be based on inbound variable value :
./ctx:transport/ctx:request/http:http-method/text() = 'GET' or 'POST'

3.3 For GET flow fetch the value from query parameters  and use them to invoke other downstream services or just create a static response.

3.4 For POST flow fetch the input parameters  value using simple Xpath like : $body//LoanId/text() and use them to invoke other downstream services or just create a static response.

4) Testing the GET and POST service , execute the proxy from service bus console .

4.1 For GET
In Transport section populate below values :
http-method: GET
query-parameters:
<tp:query-parameters xmlns:tp="http://www.bea.com/wli/sb/transports/http">
<tp:parameter name="LoanId" value="9001"/>
<tp:parameter name="BorrId" value="101"/>
</tp:query-parameters>

4.2 For POST

In Transport section :  http-method: POST
In payload pass :
<Loan>
<LoanId>8001</LoanId>
<BorrId>10233</BorrId>
</Loan>

Execute. This runs perfectly fine.

 Part II : Creating a Test service to test the Rest service created in previous step to do testing without using a test console and see how other services can consume the REST service.

1) Create Two Proxy services :
InvokeLoanService
InvokeLoanServicePOST for invoking GET and POST operation respectively.
Type : Any XML service

2) Implement the Proxy Flow :

2.1 ) Fetch the input values using  simple Xpath : $body//LoanId/text()

2.2) Add a Route Node to invoke the service created in Step I.
- Add Insert for adding the Method Type for invoking the service :
Insert <http:http-method>GET</http:http-method> for Xpath ./ctx:transport/ctx:request in Outbound

- Add Insert for adding the Query parameters like :

Insert <http:query-parameters/> for Xpath ./ctx:transport/ctx:request in Outbound
Insert <http:parameter name="LoanId" value="{$LoanId}"/> for Xpath ./ctx:transport/ctx:request/http:query-parameters in Outbound
Insert <http:parameter name="BorrId" value="{$BorrId}"/> for Xpath ./ctx:transport/ctx:request/http:query-parameters in Outbound

2.3 ) For Post service , We just need to have one insert for the method type , like :
Insert <http:http-method>POST</http:http-method> for Xpath ./ctx:transport/ctx:request in Outbound
2.4 ) For Post service replace the body in route to pass required values like:
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Header>
    </soap:Header>
    <soap:Body>
<LoanId>{$LoanId}</LoanId>
<BorrId>{$BorrId}</BorrId>
</soap:Body>
</soap:Envelope>

  The Route will look like :



 You can simply test these services using payload, no need to set the query parameters and HTTP method as that is handled internally by the services.
<Loan>
<LoanId>102</LoanId>
<BorrId>2345</BorrId>
</Loan>

Cheers !!

1Z0-543 - Oracle Application Integration Architecture 11g Certified Implementation Specialist

Here are few tips for AIA foundation pack certification preparation. Since this exam is expensive than other middleware exams it makes more sense to give that extra effort while preparing for this.

Recommended books :

1. Oracle student guide for AIA foundation pack , you get this if you have attended Oracle training.
2. Oracle Application Integration Architecture (AIA) Foundation Pack 11gR1: Essentials PackT publishing
3. Oracle documentation for AIA FP

Try to focus on basics of AIA : EBO/EBM/ABCS/EBF/CBP/EBS .

The exam consists of 70 questions and mainly from below areas :

- ABCS, EBO , EBM , EBF , CBP , EBS , extending EBO/ABCS
-  Harvesting AIA artifacts
- AIAConfigurationProperties
- AIA tools like XMAN, PIP auditor
-  AIA deployment process , password management , BOM , deployment plan
- PLW , service solution components , CAVS
- AIA guaranteed message delivery MEP patterns
- AIA error handling framework
- Jdeveloper service constructor
- AIA annotations

Hope this helps.

Good luck !!

NodeManager : FATAL ERROR in native method: JDWP No transports initialized, jvmtiError=AGENT_ERROR_TRANSPORT_INIT

Recently I extended my BPM domain for OSB , things were good till the time I used Node Manager.

When i tried to start SOA server using node manager , I got below error :

Dweblogic.ext.dirs=D:\Oracle\MIDDLE~1\patch_wls1036\profiles\default\sysext_manifest_classpath;D:\Oracle\MIDDLE~1\patch_oepe180\profiles\default\sysext_manifest_classpath;D:\Oracle\MIDDLE~1\patch_ocp371\profiles\default\sysext_manifest_classpath;D:\Oracle\MIDDLE~1\patch_adfr1111\profiles\default\sysext_manifest_classpath  weblogic.Server
FATAL ERROR in native method: JDWP No transports initialized, jvmtiError=AGENT_ERROR_TRANSPORT_INIT(197)
ERROR: transport error 202: bind failed: Address already in use
ERROR: JDWP Transport dt_socket failed to initialize, TRANSPORT_INIT(510)
JDWP exit error AGENT_ERROR_TRANSPORT_INIT(197): No transports initialized [../../../src/share/back/debugInit.c:690]
<Jul 3, 2013 5:11:03 PM> <FINEST> <NodeManager> <Waiting for the process to die: 6264>

The reason is the debug mode is defaulted to "true" when i extended my domain , It was a simple fix though :

In setDomainEnv.sh set debugFlag=false or you can just remove it.

NodeManager is a charm after that.

Cheers !!

1Z0-560 - Oracle Unified Business Process Management 11g Certified Implementation Specialist

I recently gave the BPM 11g specialist exam , Here are few tips if you are planning to appear for this exam :

Cover all the topics mentioned at the Topics page of 1Z0-560 Oracle exam , here is the Link

There were 77 Questions needs to be completed in 120 minutes.

Questions were mainly from these broad areas :

1. BPM
   - BPM adoption in organization
   - Activities and process interactions
   - project/process data objects
   - BPM monitoring
   - Custom Dash boards/ process analytic / KPI /business indicators / process simulation
   - Role/ Approval groups / organization
   - Business rules
   - Human workflow

2. ADF
  - Basic Architecture
  - Task flows creation

3. BAM
 - BAM basics
 - Integration with BPM


If you have been working in SOA + BPM environment for couple of years (2-3) , this would  not be a difficult task.

Hope this helps.

Cheers !!

Error: Connecting to B2B from Jdeveloper

If you see below error while trying to connect to B2B server from Jdeveloper, you have encountered the cluster address issue:

" An error occurred while initializing the connection. Verify that the connection is valid "

Check:

1. Your server connection is valid and server is up and running

2. If you are working in clustered environment , set the cluster address in console.
Login to Console -> MySoaDomain ->Clusters->Cluster Address: [Specify value here]
like : http://localhost:7001  ie http://[host]:[admin server port]


3. Restart the servers.

Thats it , you are good to go.

Cheers !!

Identify cluster node for the soa instance

Sometimes we see issue with one of the instance/server running in cluster. To identify which instance/server the soa call went through , run below query in SOAINFRA database

SELECT cikey,status,component_name, create_cluster_node_id ,cmpst_id from
SOAINFRA.cube_instance

Cheers !!