The trustAnchors parameter must be non-empty -error

If you ever configured AD or some other LDAP authentication provider for you WebCenter, SOA or BPM Suite and decided to follow the best practice on securing the LDAP traffice with SSL you will most propably end up with problems connecting to LDAPS at some point.

You might see these errors in your log file:

Caused By: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

The problem is that even if you imported your LDAP or AD server root and intermediate CAs into either JKS (11G) or KSS (12c) you need to perform one additional step on creating keystore for libOVD and is used with identity provider virtualization (once you set up “virtualize=true” in the domain security provider setup.

To get the problem solved you need to perform two steps:

1. Run libovdconfig.sh that creates the adapters.jks for libOVD

2. Import the needed CA certificates into this adapters.jks

 

Detailed steps are described below.

For the step 1 (12c installation being here as a sample, the same applies with 11g but a bit different subdirectory names for Oracle Home and WL Home):

cd /u01/app/oracle/product/fmw12c/oracle_common/bin/

export ORACLE_HOME=/u01/app/oracle/product/fmw12c/soa
export WL_HOME=/u01/app/oracle/product/fmw12c/wlserver
export JAVA_HOME=/usr/java/latest

./libovdconfig.sh -host myhost.com -port 7001-userName weblogic -domainPath /u01/app/oracle/admin/BPMDEV_Domain/mserver/BPMDEV_Domain -createKeystore

Once the keystore is created, proceed to step 2:

cd /u01/app/oracle/admin/BPMDEV_Domain/mserver/BPMDEV_Domain/config/fmwconfig/ovd/default/keystores

/usr/java/latest/bin/keytool -import -file mycacertificate.der -keystore adapters.jks -trustcacerts -alias ldap.myhost.com

Enter keystore password: ********
Certificate already exists in system-wide CA keystore under alias <ldap.myhost.com>
Do you still want to add it to your own keystore? [no]:  yes
Certificate was added to keystore

After these steps restart the managed servers and you are good to go.

Connection to VirtualBox BPM 12c Project Access Manager (PAM) from Local JDeveloper

I attended Oracle BPM Suite 12c partner training in Finland and the labs had Oracle Virtual Box image that we used in the training.

Virtual Box had JDeveloper embedded but I wanted to use my local copy of BPM Quick Start JDeveloper running on my bare metal laptop.

When trying to set up Project Access Manager (PAM) and connect to the repository I would get errors like: Could not connect to repository endpoint: localhost:7323

The reason for this was that when the internal SVN server starts up it looks up the hostname (soabpm-vm in this case) and queries the IP address for this. In pre-built virtual box the /etc/hosts file looks like:

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
soabpm-vm soabpm-vm.site

When BPM Suite 12c is starting up all other components start listening for 0.0.0.0 address (all IP addresses) but SVN server starts listening for 127.0.0.1 address. This means we cannot access this SVN address outside the Virtual Box, even when using port forwarding.

I tried to find a way to configure the SVN server to listed for 0.0.0.0 addresses but I could not find that. That was somewhere deep inside the code that wasn’t easily discovered.

To workaround this issue it requires reconfiguring the network interfaces:

Step 1

Add second network interface to virtual machine that is attached to “Host-Only Adapter”.

This enables the connectivity to 192.168.56.0 network.

In my setup Host Only network details looks like this in the main Virtual Box preferences window:

As we can see the built-in DHCP server starts delivering the DHCP addresses starting from 192.168.56.101. It is safe to assign fixed addresses below 192.168.56.100, in this case I decided to assign my Virtual Box BPM 12c installation a fixed IP address of 192.168.56.50.

I still wanted to keep the NAT network interface in the virtual box because that enables me to use network resources outside the virtual box (like external YUM repositories etc).

Step 2

Configure the ethernet interface (either eth1 or eth2 depending on how you defined your virtual networks in VM settings):

cd /etc/sysconfig/network-scripts

ifcfg-eth2 or (ifcfg-eth1 if you changed the NAT’ed to Host-Only Adapter)
# Please read /usr/share/doc/initscripts-*/sysconfig.txt
# for the documentation of these parameters.
DEVICE=eth1
BOOTPROTO=static
TYPE=Ethernet
HWADDR=08:00:27:41:19:1a
NM_CONTROLLED=no
PEERDNS=yes
IPADDR=192.168.56.50
SUBNET=255.255.25.0

Remember to change the HWADDR to point to your virtual NIC Hardware address.

After changing the network adapter settings you can reset the network settings my issuing command “service network restart” as root.

Step 3

Changed the IP address in the /etc/hosts file like this:

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.56.50 soabpm-vm soabpm-vm.site

Step 4

After network settings has been changed restart the BPM Suite 12c installation. If running pre-build BPM 12c image, just bounce the AdminServer.

Step 5

Edit your workstartion hosts file to point to the fixed IP address. As Windows Administrator edit the file

C:\Windows\System32\drivers\etc\hosts

Add line:

192.168.56.50 soabpm-vm.site soabpm-vm

Step 6

Configure your BPM Studio PAM connection and test that it works:

Oracle BPM Suite 11.1.1.7.2 WebForms entryId is null

Ran into Oracle BPM Suite 11.1.1.7 Web Form issue after upgrading from 11.1.1.6 to 11.1.1.7. When trying to create web form in Oracle BPM composer, I get “entryId is null” error.

When looking at the log files I can see

[2014-02-06T13:54:03.233-08:00] [AdminServer] [ERROR] [] [com.frevvo.forms.web.ConfigurationResource] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: weblogic] [ecid: 11d1def534ea1be0:-4d925ede:14409288963:-8000-00000000000002a3,0] [APP: frevvo] Configuration error: Users database schema - ORA-00942: table or view does not exist[[]]

… 
[2014-02-06T13:54:03.245-08:00] [AdminServer] [WARNING] [] [com.frevvo.billing.database.UserDBUtil] [tid: [ACTIVE].ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: weblogic] [ecid: 11d1def534ea1be0:-4d925ede:14409288963:-8000-00000000000002a3,0] [APP: frevvo] Could not get user ids for tenant d[[
java.sql.SQLSyntaxErrorException: ORA-00942: table or view does not exist      

Solution

Even though I had executed psa against the SOA infrastructure, looks like still some tables were not upgraded properly. Might have been because I extended the domain with Frevvo extensions later on.

Solution is to execute psa (once more) for soainfra. This will upgrade soa-infra to 11.1.1.7. so that those Frevvo tables are created properly and you can design your Web forms.

BPM Editor and Python Extension Not Playing in Nicely in the Same Sandbox

I was playing with the latest FMW 11.1.1.5 BPM Feature Pack when I noticed immediate NPE when launching any BPM process editor in my JDeveloper.

The stack trace was:

java.lang.NullPointerException

        at oracle.bpm.ui.action.BaseAction$ActionFuegoAction.putValue(BaseAction.java:496)

        at oracle.bpm.ui.action.BaseAction.setMsg(BaseAction.java:312)

        at oracle.bpm.ui.action.BaseAction$ActionFuegoAction.<init>(BaseAction.java:476)

        at oracle.bpm.ui.action.BaseAction.valueOf(BaseAction.java:100)

        at oracle.bpm.designer.catalogdoc.DocumentationEditorPanel.createActions (DocumentationEditorPanel.java:521)

        at oracle.bpm.designer.catalogdoc.DocumentationEditorPanel.createEditorPanel(DocumentationEditorPanel.java:504)

        at oracle.bpm.designer.catalogdoc.DocumentationEditorPanel.init(DocumentationEditorPanel.java:472)

After debugging long enough I found out that this was a compatibility problem with JDeveloper Python Extension and BPM Editor.

Python Extension is something I ported from JDev 10.1.2 to 10.1.3 and latest rewrote some portions to get it working on JDeveloper 11g. Aparently there is something causing side effects in BPM Editor so the recommendation from me is to disable this Python Extension to get BPM Editor working without these NPE issues.

To disable any extension you can follow these menu options:

Tools –> Preferences –> Extensions (from the left hand panel) –> Uncheck the Checkbox from Python Extension