Changing Environment Warning Color on WLS Console

 

One of the rare mistakes in system configuring is when you actually thought you were in development or testing environment, but the browser actually pointed to production. You might even have the same credentials between the environment (e.g. linked to AD or LDAP directory), making it difficult to recognize the fatal error until it’s too late.

When the consoles look alike there is nothing to differentiate from the other environments but you just have to be sharp to acknowledge were you are.

One of the easiest changes to prevent these errors happening could be to change the production (or some other) environment WLS console coloring so that it differs from other environments to alarm that this is not for testing or development.

How about if the WLS console looked like this:

This is easily done.

WebLogic 12c

cd $WLHOME/wlserver/server/lib/consoleapp/webapp/css

WebLogic 11g

cd $WLHOME/wlserver_10.3/server/lib/consoleapp/webapp/css

 

Make backup of the content.css.

Edit the toolbar background color:

/*
    Toolbar Area
*/
.toolbar {
    background-color: #D2E5F9;
    overflow: hidden;
    width: 100%;
    padding: 1px;
}

 

change it to something else, like orange/red:

/*
    Toolbar Area
*/
.toolbar {
    background-color: #FF6666;
    overflow: hidden;
    width: 100%;
    padding: 1px;
}

After this change the WLS console immediately shows “warning color” in the toolbar as a marker for a production environment.

You might need to make sure the change is redone after system upgrades if the default content.css is for some reason overridden.

Best Practice on Pointing to Latest JDK in FMW Installation

 

One of the best practices in Oracle Middleware installations is to point to logical “latest” JDK directory in the configuration files. When you install e.g. WebLogic server 11g on Linux you need to have the JDK installed before starting up the WebLogic installation.

You might have installed e.g. JDK 1.7. rpm which installs the JDK into /usr/java and by default has the best practice directories “default” that points to “latest” and “latest” symbolic link that points to the latest/wanted JDK installation.

/usr/java might look like this:

drwxr-xr-x. 8 root root 4096 Feb 28 08:09 jdk1.7.0_75
lrwxrwxrwx. 1 root root   21 Feb 28 08:09 latest -> /usr/java/jdk1.7.0_75
lrwxrwxrwx. 1 root root   16 Feb 28 08:09 default -> /usr/java/latest

If you didn’t have the “latest” symbolic link there, you might be running older versions like JRockit or JDK6.

Despite of having the /usr/java/latest symbolic link, you will get the full real path suggested in the installer:

Despite of pressing “Browse…” and choosing the /usr/java/latest, the JDK path will not change in the installer. You will get “Please select appropriate JDK” error.

There are two options to go:

1. Install the software pointing to the real path and then later change all shell scripts etc. pointing to the real path, to point to /usr/java/latest

or

2. Exit the installer and change the real JDK directory name temporarily to /usr/java/latest, restart the installer and the installer will find the JDK in the path /usr/java/latest, configure the environment variables. After the installer has finished, change the real JDK path back to what it was and point the /usr/java/latest to point to the wanted JKD version.

Here are the steps for the option 2)

cd /usr/java

mv latest latest.old

mv jdk1.7.0_75 latest

Install the Oracle FMW software. When installing e.g. Weblogic server you should point the JDK to /usr/java/latest.

After the installation has finished, reverse the changes:

mv latest jdk1.7.0_75

mv latest.old latest.

 

You can veriry that the shell scripts point to this logical directory by looking at:

$MW_HOME/wlserver_10.3/common/bin/commEnv.sh.

SOA Suite 11g installation – How to start BAM and SOA servers the first time

 

After installing SOA Suite 11g there has been a few questions asked why SOA or BAM servers are not started up. After you start the Admin server from $ORACLE_HOME/user_projects/domains/soadomain –using startWebLogic.cmd, you will get the Admin server up with the built-in Enterprise Manager. When you login to the enterprise manager using http://hostname:port/em, you will see the status of other servers, like this:

Indication is that BAM server or SOA server are not started. You can try starting these servers from GUI (click on server and mouse right-click) if you have your node manager up and running. If you don’t, here are my steps to do this form command line (replace the “C:\product\FMW11G” with your installation directory and “soadomain” with your domain name) :

C:\product\FMW11G\user_projects\domains\soadomain\bin>startManagedWebLogic.cmd soa_server1

Enter username to boot WebLogic server: weblogic

Enter password to boot WebLogic server:

 

After this, the SOA server starts up and SOA server runtime files gets created under C:\product\FMW11G\user_projects\domains\soadomain\servers –directory.

To automate the startup, not having to enter username and password, you need to create file called boot.properties and place this under security directory. In my example the directory would be C:\product\FMW11G\user_projects\domains\soadomain\servers\soa_server1\security. You need to create this directory manually if you don’t have it.

Editing the boot.properties is familiar if you have dealt with WebLogic server:

username=weblogic
password=mypassword

Next time server is started up, it reads the credentials from boot.properties, encrypts them in this file and continues with startup process.

Above instructions apply to BAM server as well.

This should be the end result:

“Start all” script for Windows

Here is a sample Windows script to start all servers that belong to SOA Suite (defaults to being on SOA domain directory):

start "SOA Admin Server" startWebLogic.cmd
start "SOA Server" bin\startManagedWeblogic.cmd soa_server1
start "BAM Server" bin\startManagedWeblogic.cmd bam_server1

File name too long – Error on WebLogic Portal domain removal

Sometimes you need to recreate domain or just remove the domain for good. On Windows you might end up with situation where simple recursive WebLogic domain folder delete will cause “File Name too Long” errors and one or two files out of the domain directory cannot be deleted.

The reason for this is that the complete path (including sub-directories) is longer than 256 characters. The workaround is to reduce the names of the subdirectories one-by-one until you are able to delete the whole domain directory tree. You can start with “rename AdminServer 1” etc. until you are able to remove.

Enforcing WebLogic 10.3 Admin Console to use Finnish HST Card Authentication

By default WebLogic admin console is deployed on the same port as other applications, non-encrypted HTTP traffic, and using username and password as authentication.

To give the highest level of security on the admin console here are some steps to take:

1. Change the admin console from the standard port to SSL secured admin port
2. Enable Two-Way Authentication so that only clients with valid digital certificate can access the admin console

In Finland, one of the easy ways to get official  client certificate is to use your HST smart card for authentication. To use that in your workstation, you need smart card reader and software for that. Software can be downloaded free from http://www.fineid.fi/ (Follow the link "Lataa kortinlukijaohjelmisto").

In this article I've tried to summarize steps to enable WebLogic 10.3 server two-way SSL setup with HST client certificate.

To summarize the steps:

1. Create self signed server certificate and store if into custom keystore file
2. Extract VRK's trusted CA certificates and import them to the custom keystore file
3. Setup custom keystores (for server identity and trust keystore) in WebLogic server
4. Create user that corresponds the HST card username. Assign Administrative group to the user.
5. Change management port
6. Change admin console authentication method from FORM to CLIENT-CERT
7. Test

Please note that at some point you will get a browser error stating that the server certificate is not valid. This is because of using self-signed server certificates. If you used "official" server certificates e.g. from Verisign you wouldn't get these errors. When using self signed certificates, you just need to accept the error and import the certificate on browser keystore. This error would only happen the first time(s) accessing the site protected with https (SSL).

Warning: These instructions are experimental and you should make full backup of your environment before trying anything in here. DO NOT TRY THIS IN PRODUCTION BEFORE MAKING SURE IT WORKS IN DEVELOPMENT AND TESTING FIRST.

 

Extracting the Trusted CA Certificates from HST Card

You will need the trusted CA (certificate authority) public certificates later in WebLogic key storage to verify the client HST card certificates. If you don't have those trusted VRK (Väestörekisterikeskus) certificates yet, here is one way to get them:

1. Open up the smart card application (here mPollux as an example):

Navigate to "Luotetut varmenteet" and first choose "VRK Gov. Root CA":

Double click on the certificate and you will get this window:

Press Details -tab.

Press "Copy to file..."

Press next.

Choose Base-64 encoded X.509 (.CER)

Press Next.

Enter the name of the certificate file and press Next.

Press Finish.

After successful export, you should have an OK window.

 

Repeat the same for the "VRK Gov. CA for Citizen Qualified Certificates".

 

After these two steps, you should have files with names e.g. vrk_root.cer and vrk_citizen.cer in your chosen folder. These are base64 encoded text files.

 

Creating a Self Signed Custom Keystore for Two-way SSL

Now we create a custom keystore to store the identity of the WebLogic server certificate and also to include the VRK public certificates so that WebLogic can verify the HST card client certificate against them.

Here is an example (server certificate for 10 years = 3600 days):

keytool -genkey -dname "cn=localhost, ou=Oracle Finland, o=Oracle, c=FI" -alias localhost -keypass mypassword
     -keystore D:\product\JDEV11\wlserver_10.3\server\lib\harri.jks -storepass mypassword -validity 3600

Above command (by the way, keytool is found from the Java binaries) creates a keystore file named "harri.jks". You can list the contents of the file with following command:

keytool -list -storepass mypassword -keystore harri.jks

 

Now, import the VRK trusted certificates next:

keytool -import -file D:\temp\vrk_root.cer -trustcacerts -alias VRK_ROOT -keystore harri.jks
keytool -import -file D:\temp\vrk_citizen.cer -trustcacerts -alias VRK_CITIZEN -keystore harri.jks

Now you should have the keystore ready for two-way authentication. Next step is to configure WebLogic server to use this keystore.

 

Setting up the custom keystores in WebLogic

Navigate to admin console: Home >Summary of Servers >DefaultServer

Choose Configuration tab and Keystores tab.

Choose "Custom Identity and Custom Trust" from the "Keystores" popup list.

Specify the exact path to the keystore you just created above, keystore type "jks" and enter the password for the keystore.

Press Save.

Press "SSL" tab.

Choose "Private Key Alias" as the same you used in earlier chapter "Creating a Self Signed Custom Keystore for Two-way SSL".

For example if you used:

keytool -genkey -dname "cn=localhost, ou=Oracle Finland, o=Oracle, c=FI" -alias localhost -keypass mypassword -keystore D:\product\JDEV11\wlserver_10.3\server\lib\harri.jks -storepass mypassword -validity 3600'

you should enter "localhost" as the alias here to mark the unique key to the server certificate.

 

Press the "Advanced" link.

Change "Two Way Client Cert Behaviour" to wanted value, like "Client Certs Requested But Not Enforced" or "Client Certs Requested And Enforced".

Press Save and reboot the WebLogic server.

 

What Is My HST Card Username?

To see your username in the Finnish Government ID card, you can do it e.g. by looking at the smart card reader application. In my example I am using mPollux software and I can launch the software by choosing the context menu from mPollux tray icon (yellow icon below):

Choose the first option to start the application.

From the "Lukijat ja kortit" -tab choose the card reader -> Käyttäjän varmenteet -> todentamis- ja salausvarmenne. Double-click on that item.

 

You will see following window, where the "Issued to:" field will show the username you should write down for later use.

Create User and Assign Admin Privileges

Navigate to Security Realms page on admin console.

Press "myrealm" (or whatever you have in your server) link.

Press "New" to enter new user.

Enter the username that is stored in your HST card on "Name" field. You can set whatever password you like, but this is not used when enforcing client certificates. If you don't know the value to put on "Name" -field, please follow the chapter "What Is My HST Card Username?".

Assign the needed Groups to the user:

You would need at least "Administrators" group to enter the admin console application.

 

Change management port

To ensure security, you should change the admin console to use administration port (9002 or whichever you choose). This is done from Home -> DefaultDomain -> Configuration -> General.

After the port change, the URL is moved to this admin port right away.

Change Console Authentication Method

By default WebLogic admin console uses form based authentication (username / password). To enforce using client certification from the Finnish HST card you need to change console application slightly.

In this example I use JDeveloper 11.1 and the WebLogic that is shipped with it. On this installation, console application is found under:

D:\product\JDEV11\wlserver_10.3\server\lib\consoleapp

web.xml file is here

D:\product\JDEV11\wlserver_10.3\server\lib\consoleapp\webapp\WEB-INF\web.xml

 

Edit web.xml as follows. Comment out the FORM based authentication method and replace it with CLIENT-CERT method, like this:

  <login-config>
<!-- Commented out
    <auth-method>FORM</auth-method>
    <form-login-config>
      <form-login-page>/login/LoginForm.jsp</form-login-page>
      <form-error-page>/login/LoginError.jsp</form-error-page>
    </form-login-config>
-->
        <auth-method>CLIENT-CERT</auth-method>
  </login-config>

You could also change the auth-method to value “CLIENT-CERT,FORM” to fall back to username / password authentication if client certificate authentication fails.

After the changes, restart WebLogic server.

 

FireFox / Mozilla Setup

If you used mPollux and FireFox or Mozilla, you need to setup the security device manually (this is done only once). You do this by choosing the Tools -> Options -> Advanced and pressing "Security Devices".

Press "Load" to choose to load a new security device.

Give it a name and choose file. With mPollux it looks something like:

If you needed to do this setup, just to make sure, exit the browser and startup again.

Test Run

Close all browser windows and remove the Finnish HST card from the card reader.

Enter the HST card into the smart card reader.

Open up a browser (IE, Mozilla, FireFox ...) and enter the console URL:

https://localhost:9002/console

 

You should now get the smart card PIN window. An example when using Fujitsu DigiSign software, is below:

When entering the PIN code, you are allowed to enter the console, if your username is assigned to Admin group: