The trustAnchors parameter must be non-empty -error

If you ever configured AD or some other LDAP authentication provider for you WebCenter, SOA or BPM Suite and decided to follow the best practice on securing the LDAP traffice with SSL you will most propably end up with problems connecting to LDAPS at some point.

You might see these errors in your log file:

Caused By: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

The problem is that even if you imported your LDAP or AD server root and intermediate CAs into either JKS (11G) or KSS (12c) you need to perform one additional step on creating keystore for libOVD and is used with identity provider virtualization (once you set up “virtualize=true” in the domain security provider setup.

To get the problem solved you need to perform two steps:

1. Run libovdconfig.sh that creates the adapters.jks for libOVD

2. Import the needed CA certificates into this adapters.jks

 

Detailed steps are described below.

For the step 1 (12c installation being here as a sample, the same applies with 11g but a bit different subdirectory names for Oracle Home and WL Home):

cd /u01/app/oracle/product/fmw12c/oracle_common/bin/

export ORACLE_HOME=/u01/app/oracle/product/fmw12c/soa
export WL_HOME=/u01/app/oracle/product/fmw12c/wlserver
export JAVA_HOME=/usr/java/latest

./libovdconfig.sh -host myhost.com -port 7001-userName weblogic -domainPath /u01/app/oracle/admin/BPMDEV_Domain/mserver/BPMDEV_Domain -createKeystore

Once the keystore is created, proceed to step 2:

cd /u01/app/oracle/admin/BPMDEV_Domain/mserver/BPMDEV_Domain/config/fmwconfig/ovd/default/keystores

/usr/java/latest/bin/keytool -import -file mycacertificate.der -keystore adapters.jks -trustcacerts -alias ldap.myhost.com

Enter keystore password: ********
Certificate already exists in system-wide CA keystore under alias <ldap.myhost.com>
Do you still want to add it to your own keystore? [no]:  yes
Certificate was added to keystore

After these steps restart the managed servers and you are good to go.

Sample JSF 11g application that uses UCM search SOAP API and HTTP basic authentication

Here are some steps to create an application that uses UCM search API (SOAP based) and shows the results in the web page. In addition I will explain how to setup HTTP basic authentication to enable calling UCM web services.

Create an application

 

You start with creating an application

Give descriptive name for the default web project

Create JSF page

 

By default we start with the quick start layout:

Create web service data control based on UCM search WSDL

 

In this part I’ve already downloaded the UCM WSDL descriptions using another UCM instance. The SOAP API is still the same but WSDL points to another hostname as the endpoint. We will modify this later.

 

Choose “All Technologies” tab in the left hand side + Web Service Data Control” in the right hand side:

Browsing for the search API WSDL file:

I only choose one operation to be used:

Just click next(s):

Please note that at this point the end point that was derived from WSDL is still pointing to a wrong installation, and I will correct this error later in this guide.

Changing the end point URL for web service (optional)

 

Navigate to the DataControls.dcx file

Look into the bottom left hand side Structure pane:

Press mouse right click button to open context menu. Choose “Edit Web Service Connection…”

Let’s change the hostname. Leave username and password fields intact since they are not used as http basic authentication.

Adding input parameter field for search text

 

Next I will build up a very simple search form for UCM documents:

Select “Input Text” from component palette and drag’n’drop into the left hand pane:

 

You could change the field names and labels to something more descriptive:

Add search results table

 

Next I will drag’n’drop the search results control to the right hand side:

I will only choose some of the columns by deleting the unwanted columns.

Leave this dialog to be as-is, press OK.

Add search command button

 

Next I will create a command button that will actually execute the query (calls the web service API eventually).

Select the QuickSearch operation from data control and drag’n’drop it into the left pane:

Bind the parameter to the input field

 

Many cases JDeveloper will automatically bind the input parameters from UI to the web service parameters, but here I’ll show you one way to do it when web full automation is not possible.

Navigate to the web service “Parameters” folder and choose the “queryText” parameter. Drag’n’drop it to the input field in JSF page.

Bind the input text field:

Let the defaults be there and press Ok:

Binding from input field to the parameter is now done.

Add HTTP basic authentication policy

 

To enable HTTP basic authentication you need to define web service security settings. I start choosing DataControls.dcx which reveals me data control structure, where I select the wanted data control.

Press context menu and choose “Define Web Service Security…”:

Press “+” to add new security policy:

Choose “oracle/wss_http_token_client_policy”:

Press “Override Properties..:”

Press “New key…”

Enter username and password for the end point (actually these will be overriden in the later phase). Enter key name that will be used to find the username and password settings from at runtime.

Csf-key is important to remember since this will be used to store the username and password for the endpoint in domain keystore.

Create deployment profiles for project and application and deploy

 

You need to first create WAR deployment profile for the project.

Then you create EAR deployment profile for the application and define the dependency to the WAR deployment profile.

You should deploy the application (not WAR).

Define credentials key under oracle.wsm.security

 

Login to the Fusion Middleware Enterprise manager console. The URL is something like http://localhost:7001/em

Press “Create Key”. Key attribute here is the csf-key you defined earlier. In my example I used csf-key “demo-ucm-search”. These are the actual username and password that are used when initiating the connection to UCM.

Test and run

Deploy the application to the domain and you should be fine with the application based on UCM SOAP APIs.

UCM search API uses special search notation, so I wanted to search for UCM documents that had “visa” in the document title. I enter the query criteria dDocTitle <substring> `visa`.