How To Change The Weblogic Server Administrator Password

Applies To:

Oracle WebLogic Server - Version 8.1 and later

IF YOU KNOW CURRENT PASSWORD:

Start the Admin Server and log into /console.
Go to page: Home > Summary of Security Realms > myrealm > Users and Groups > weblogic. and click on tab Passwords.
Enter the new Password.
Restart the server.
If you get a weblogic.security.SecurityInitializationException error, perform these additional steps on every Managed Server (or eventually the Admin Server, too):

Go to folder DOMAIN_HOME/servers/AdminServer/security
Edit the boot.properties file and change the password to the value already entered on the Admin Console. Do this for all the servers in the domain.
Start the Admin Server (Weblogic Server will encrypt the password for you).
Optionally, you can force a Managed Server to connect to the embedded LDAP server on the Administration Server, instead of connecting to the local replicated LDAP server. Follow these steps:

Go to page: Domain > Security > Embedded LDAP page on the Admin Console.
Enable MasterFirst.
Restart the server.


IF YOU DON'T KNOW CURRENT PASSWORD:

If you forget your administrative password and cannot boot the server, the following procedure works for the default authenticator using the embedded LDAP server and only if you have not modified the global Admin role, which by default is granted to the Administrators group. For our example, it is assumed that your server name is AdminServer.  Important: Using the weblogic.security.utils.AdminAccount tool creates a new admin user, but you may lose your existing LDAP data, which includes user, groups, and policy data, so backing up your LDAP folder is recommended before executing the steps.


To reset the password, follow these steps:

Make sure Weblogic Server instance is stopped.

Make a backup of the LDAP folder of the admin server as well as managed servers (you may rename those folders):

$WL_HOME/user_projects/domains/$DOMAIN_NAME/servers/$SERVER_NAME/data/ldap

Set your environment variables by running setDomainEnv.sh (UNIX) or setDomainEnv.cmd (Windows). For UNIX only environments do as follows:
. ./setDomainEnv.sh (Notice the space between the dots) located in $DOMAIN_HOME/<servername>/bin

Create a new initialization file for the default authenticator by running the following command that creates a new DefaultAuthenticatorInit.ldift file in the $DOMAIN_HOME/security subdirectory:
java weblogic.security.utils.AdminAccount <tempadmin> <temppassword> $DOMAIN_HOME/security

Remove the initialized status file DefaultAuthenticatormyrealmInit.initialized from the $DOMAIN_HOME/servers/AdminServer/data/ldap/ subdirectory:
cd WL_HOME/user_projects/domains/base_domain/servers/AdminServer/data/ldap
rm DefaultAuthenticatormyrealmInit.initialized

NOTE: In some cases, it has been necessary to delete ldap directory for this process to work.

Go to folder DOMAIN_HOME/servers/AdminServer/security

Edit the boot.properties file and change the password to the value already used on step 5. Do this for all the servers in the domain.

Start Weblogic Server (Weblogic Server will encrypt the password for you).

IMPORTANT:

Keep in mind that we are not just changing the password for the Admin Console, but we are rather changing it for the Admin User (which may connect in many different ways to Admin Server).

Remember to use the new password (once successfully changed), when when connecting to WLST, start the managed servers or using weblogic.Admin utility.


Reference metalink Doc ID 1082299.1

Should We Use The Smart Update (BSU) cache_dir For Downloaded Patches Or Is Another Directory OK? 

Installation Instructions
---------------------------
- unzip downloaded .zip to {MW_HOME}/utils/bsu/cache_dir or any local directory
However, after applying the patch, we see that it is not getting listed in bsu.sh -view status unless and until the patch ID jar and patch_catalog_xxx.xml files are copied to the cache_dir directory. So is it required to copy the patch files to cache_dir?

Solution:

In order to apply the patch, you do not need to use cache_dir. However, as you noted, bsu looks into its cache_dir for the list of patches which are applied, downloaded, etc. So if you don't use cache_dir, bsu isn't going to find the patch where it is expecting to.

So the best practice is to use cache_dir. It may not be absolutely required, but it definitely works best to use cache_dir.

By the way, please also note that the patch-catalog_xxx.xml and patch jars for ALL the patches applied should be in the same place so that bsu can determine which patch-catalog_xxx.xml file is the most current. For that reason as well, you should always use cache_dir. (Please never rename any of the patch-catalog_xxx.xml files -- bsu relies on these files being named correctly.)


NOTE: This article describes use of Smart Update (bsu), which is the patching utility used with WebLogic Server 9.x to 12.1.1. For WLS 12.1.2 and higher, Smart Update has been replaced by the Oracle-standard OPatch utility and you should use OPatch instead.

R12 E-Business Suite Users Report Responsibilities Are Missing From The EBS Home Page, After Login The Responsibility Page Is Blank 

Symptoms:

-Intermittently responsibilities are missing from the Personal Home Page, or after user login the responsibilities homepage is blank.
(or)
-Missing responsibilities for a user in the navigator page during logon.
-After upgrading and patching, the System Administrator responsibility no longer appears in the Navigator.
-Some users cannot see/receive their open notifications due to missing responsibilities.
-Some users get notification e-mails even though their responsibilities are end-dated
-If a user is end-dated, a user's responsibility creates duplicate row
-Newly added responsibility is not displayed until Apache is bounced
-Intermitent issue: After resetting user passwords using the "Login Assistance " > "Forgot Password" link, users do not see their responsibilities in home page and get the following message:
"There are no active responsibilities available for this user"
"System Administrator" responsibility missing

Cause:

Workflow Roles are out of sync.

Solution:

To resolve the issue test the following steps in a development instance and then migrate accordingly:

1. Run the sync responsibility data into the workflow tables concurrent request via the following steps:

a. Navigate -> System Administrator > Concurrent > Request: Submit a New Request
b. Select request "Sync responsibility role data into the WF table"

2. Retest the user login and confirm the responsibilities now appear as expected.

3. If the issue still occurs, test the following set of additional steps to see if the problem is resolved:

a. Run request -> "Compile Security" - For parameter Everything, select Yes
b. Run request -> "Workflow Directory Services User/Role Validation" with: 'Fix dangling user/roles', 'Add missing user/role assignments' and Update WHO columns in WF tables set to "yes"
c. Run request -> "Synchronize WF LOCAL tables"
d. Run request -> "Create FND_RESP WF ROLES"
e. Run request -> "Sync responsibility role data into the WF table."
f. Follow MOS Doc ID 759038.1 How To Clear The Cache Using Functional Administrator.

4. Retest the user login and confirm the responsibilities now appear.

Reference metalink Doc ID 2259375.1

Introduction To Oracle Access Manager (OAM), Oracle Identity Manager (OIM) And Oracle Internet Directory (OID)

Oracle Access Manager (OAM)

Oracle Access Manager is a J2EE application typically deployed on a dedicated managed server in a Weblogic (Application Server) clustered environment. An enterprise typically has many applications for different purposes. Each application typically has its own authentication and authorization functionality.

OAM provides a single point to control all resource grants in an enterprise where multiple applications exist on different platform.

OAM provides:

-Single Sign On (SSO)
-Authentication
-Authorization
-Real time session management
-Auditing
-Policy Administration
-Flaws in conventional security model.

Individual authentication/authorization for each independent application in the enterprise. .net, J2EE, SAP, WebCenter etc. All application have their own authentication and authorization mechanism.

-Effective Security
-Cost
-Inconsistence
-Security Complainces
-Ease for users (Single Sign On)
-Governance, Support and Management
-One of the web server will have OAM-Agent. Other web servers will be redirected to this OAM-Agent via a reverse proxy. Hence, we don't need OAM-Agent on each Web Server.

The request goes to the OAM agent which redirects the request to OAM which in turn challenges the user for user/pwd. Once user/pwd is provided the OAM goes to the LDAP (AD or OID) to authenticate the user. Once the user is authenticated the webgate opens the gate to the underlying corresponding web server.


Oracle Identity Manager (OIM)

An Oracle identity management (OIM) provides a mechanism for implementing the user management aspects of a corporate policy. It can also be a means to audit users and their access privileges. The OIM enables enterprises to manage the entire user life cycle across all enterprise resources both within and beyond a firewall.

OIM application is deployed on Weblogic Managed Server in domain and There is second managed server for SOA Infra on same domain. OIM utilizes this SOA to process User Provisioning for workflow based approval. In real world all User provisioning has approval chain.

OIM server is a J2EE application. User provisioning is done in OIM. The OIM integrates this with all the other applications.

OIM does life cycle management of an identity (generally a user, e.g employee).

Lets take an example of an employee joining an organizaiton. He/She needs access to various applications in the organization. The HR typically creates the employee in HRMS on the joining date. The manager raises various user ids creations for this new employee for email, timesheet app, crm, leave mgmt app etc. With OIM this provisionting can be done automatically or manually at single point.

OIM provides a unified access control for all the applications in the enterprize. Once the employee quits, the manager need only to log onto OIM and delete (soft/hard) the employee from various applications.

OIM integrates with other application using SOA suite with respective JCA adapters.


Oracle Internet Directory (OID)

This is a directory of objects. For e.g in case of employees in an organization, this directory will hold employees details like name, designation, enterprize roles, applicaiton specific roles, security credentials like password, password reminder questions etc. An online directory is a specialized database that stores and retrieves collections of information about objects. The information can represent any resources that require management

-This is typically a single source of truth for information about employees in an organization.

-Various applications access OID to authenticate and authorize users. Typically, OID is integrated with OAM.

-OID is Oracle's LDAP implementation. Active Directory or AD is similar implementation for the same solution from Microsoft.

-OID generally uses oracle database for storage of all the said information above.

-The information in the directory is available to different clients, such as single sign-on solutions, email clients, and database applications. Clients communicate with a directory server by means of the Lightweight Directory Access Protocol (LDAP). Oracle Internet Directory is an LDAP directory that uses an Oracle Database for storage.

ORA-20001: Invalid Column Name or Duplicate Columns/Column groups/expressions In method_opt

Symptoms:

Gather Schema Statistics" program reported following errors in request log files:

ORA-20001: invalid column name or duplicate columns/column groups/expressions in method_opt

Statistics Errors:
stats on table FND_CP_GSM_OPP_AQTBL is locked
Error #1: ERROR: While GATHER_TABLE_STATS:
object_name=GL.JE_BE_LINE_TYPE_MAP******
Error #2: ERROR: While GATHER_TABLE_STATS:
object_name=GL.JE_BE_LOGS***ORA-20001: invalid column name or duplicate columns/column
groups/expressions in method_opt***
Error #1: ERROR: While GATHER_TABLE_STATS:
object_name=GL.JE_BE_LINE_TYPE_MAP***ORA-20001: invalid column name or duplicate columns/column groups/expressions in method_opt***
Error #2: ERROR: While GATHER_TABLE_STATS:
object_name=GL.JE_BE_LOGS***ORA-20001: invalid column name or duplicate columns/column groups/expressions in method_opt***
Error #3: ERROR: While GATHER_TABLE_STATS:
object_name=GL.JE_BE_VAT_REP_RULES***ORA-20001: invalid column name or duplicate columns/column groups/expressions in method_opt***
Error #4: ERROR: While GATHER_TABLE_STATS:  object_name=FII.FII_FIN_ITEM_HIERARCHIES***ORA-20001: invalid column name or duplicate columns/column groups/expressions in method_opt***
groups/expressions in method_opt***

Cause:

1 ) There are duplicate rows on FND_HISTOGRAM_COLS table for JE_BE_LINE_TYPE_MAP table. Because of this problem, FND_STATS tries to gather histogram information using wrong command and it fails with ora-20001 errors.

The following SQL should return one row, not two:
SQL> show user
USER is "APPS"

SQL>select column_name, nvl(hsize,254) hsize from FND_HISTOGRAM_COLS where table_name = 'JE_BE_LINE_TYPE_MAP' order by column_name;

COLUMN_NAME HSIZE
------------------------------ ----------
SOURCE 254
SOURCE 254

SQL>
Since there are two rows in histograms table, FND_STATS creates following command to gather statistics on table 'JE_BE_LINE_TYPE_MAP' :


Solution:                                                                                                                                         

Find out all duplicates and/or obsolete rows in FND_HISTOGRAM_COLS and delete one of them logged in as the applsys user. Remember to take backup of the FND_HISTOGRAM_COLS table before deleting any data.

SQL> select table_name, column_name, count(*) from FND_HISTOGRAM_COLS group by table_name, column_name having count(*) > 1;

TABLE_NAME                     COLUMN_NAME                      COUNT(*)
------------------------------ ------------------------------ ----------
JE_BE_LOGS                     DECLARATION_TYPE_CODE                   2
JE_FR_DAS_010                  TYPE_ENREG                              2
JE_FR_DAS_010_NEW              TYPE_ENREG                              2
JE_BE_LINE_TYPE_MAP            SOURCE                                  2
JE_BE_VAT_REP_RULES            SOURCE                                  2
JE_BE_VAT_REP_RULES            LINE_TYPE                               2
JE_BE_VAT_REP_RULES            VAT_REPORT_BOX                          2
JG_ZZ_SYS_FORMATS_ALL_B        JGZZ_EFT_TYPE                           2

-- Use above results on the following SQL to delete duplicates

SQL> delete from FND_HISTOGRAM_COLS
where table_name = '&TABLE_NAME'
and  column_name = '&COLUMN_NAME'
and rownum=1;
Enter value for table_name: JE_BE_LOGS
old   2: where table_name = '&TABLE_NAME'
new   2: where table_name = 'JE_BE_LOGS'
Enter value for column_name: DECLARATION_TYPE_CODE
old   3: and  column_name = '&COLUMN_NAME'
new   3: and  column_name = 'DECLARATION_TYPE_CODE'

1 row deleted.

SQL> /
Enter value for table_name: JE_FR_DAS_010
old   2: where table_name = '&TABLE_NAME'
new   2: where table_name = 'JE_FR_DAS_010'
Enter value for column_name: TYPE_ENREG
old   3: and  column_name = '&COLUMN_NAME'
new   3: and  column_name = 'TYPE_ENREG'

1 row deleted.

SQL> /
Enter value for table_name: JE_FR_DAS_010_NEW
old   2: where table_name = '&TABLE_NAME'
new   2: where table_name = 'JE_FR_DAS_010_NEW'
Enter value for column_name: TYPE_ENREG
old   3: and  column_name = '&COLUMN_NAME'
new   3: and  column_name = 'TYPE_ENREG'

1 row deleted.

SQL> /

Repeat same till you delete all the duplicate rows and then commit.
SQL> select table_name, column_name, count(*)
from FND_HISTOGRAM_COLS
group by table_name, column_name
having count(*) > 1;

no rows selected
SQL>
SQL> select column_name, nvl(hsize,254) hsize
from FND_HISTOGRAM_COLS
where table_name = 'JE_BE_LINE_TYPE_MAP'
order by column_name;

COLUMN_NAME                         HSIZE
------------------------------ ----------
SOURCE                                254

SQL>
SQL> commit;

Commit complete.
SQL>

RC-40000: Unable To Startup The Database

Error:

RC-40000 will occur when you gave wrong password for adpreclone

[oracletest@jancln]$ adpreclone.pl dbTier

                     Copyright (c) 2002 Oracle Corporation
                        Redwood Shores, California, USA

                        Oracle Applications Rapid Clone

                                 Version 12.0.0

                      adpreclone Version 120.20.12010000.2

Enter the APPS User Password:*******
Running:
perl /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/bin/adclone.pl java=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/jre mode=stage stage=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/clone component=dbTier method=CUSTOM dbctx=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/PROD_ruh-erpdb01.xml showProgress
APPS Password :

Beginning database tier Stage - Sat Apr  8 10:05:53 2017

/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/jre/bin/java -Xmx600M -DCONTEXT_VALIDATED=false  -Doracle.installer.oui_loc=/u02/oracle/PROD/db/tech_st/11.1.0/oui -classpath /u02/oracle/PROD/db/tech_st/11.1.0/lib/xmlparserv2.jar:/u02/oracle/PROD/db/tech_st/11.1.0/jdbc/lib/ojdbc6.jar:/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/java:/u02/oracle/PROD/db/tech_st/11.1.0/oui/jlib/OraInstaller.jar:/u02/oracle/PROD/db/tech_st/11.1.0/oui/jlib/ewt3.jar:/u02/oracle/PROD/db/tech_st/11.1.0/oui/jlib/share.jar:/u02/oracle/PROD/db/tech_st/11.1.0/oui/jlib/srvm.jar:/u02/oracle/PROD/db/tech_st/11.1.0/jlib/ojmisc.jar   oracle.apps.ad.clone.StageDBTier -e /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/PROD_ruh-erpdb01.xml -stage /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/clone -tmp /tmp -method CUSTOM    -showProgress
APPS Password :
Log file located at /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/log/PROD_ruh-erpdb01/StageDBTier_04081005.log

AutoClone needs to start the database up to generate cloning information
  -     50% completed       RC-40000: Fatal: Unable to start up the database

ERROR while running Stage...
Sat Apr  8 10:06:19 2017

ERROR while running perl /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/bin/adclone.pl java=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/jre mode=stage stage=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/clone component=dbTier method=CUSTOM dbctx=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/PROD_ruh-erpdb01.xml showProgress ...
Sat Apr  8 10:06:19 2017
[oracletest@jancln]$


adpreclone logfile message:


    Connection could not be obtained; returning null

-------------------ADX Database Utility Finished---------------

RC-40000: Unable to start up the database
Raised by oracle.apps.ad.clone.StageDatabase
RC-40000: Unable to start up the database
Raised by oracle.apps.ad.clone.StageDatabase


Cause:

Because of wrong credentials, apps user account has locked. You cannot connect apps until you have unlocked apps user account.

[oracletest@jancln]$ sqlplus / as sysdba

SQL*Plus: Release 11.1.0.7.0 - Production on Sat Apr 8 10:14:50 2017

Copyright (c) 1982, 2008, Oracle.  All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition Release 11.1.0.7.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options

SQL> connect apps/apps
ERROR:
ORA-28000: the account is locked


Warning: You are no longer connected to ORACLE.
SQL> exit


Solution:


[oracletest@jancln]$ sqlplus / as sysdba

SQL*Plus: Release 11.1.0.7.0 - Production on Sat Apr 8 10:15:33 2017

Copyright (c) 1982, 2008, Oracle.  All rights reserved.


Connected to:
Oracle Database 11g Enterprise Edition Release 11.1.0.7.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options

SQL>
SQL> select username, account_status from dba_users where username like 'APPS';

USERNAME                       ACCOUNT_STATUS
------------------------------ --------------------------------
APPS                           LOCKED(TIMED)

SQL> alter user apps account unlock;

User altered.

SQL> select username, account_status from dba_users where username like 'APPS';

USERNAME                       ACCOUNT_STATUS
------------------------------ --------------------------------
APPS                           OPEN

SQL> exit

[oracletest@jancln]$ adpreclone.pl dbTier

                     Copyright (c) 2002 Oracle Corporation
                        Redwood Shores, California, USA

                        Oracle Applications Rapid Clone

                                 Version 12.0.0

                      adpreclone Version 120.20.12010000.2

Enter the APPS User Password:*******
Running:
perl /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/bin/adclone.pl java=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/jre mode=stage stage=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/clone component=dbTier method=CUSTOM dbctx=/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/PROD_ruh-erpdb01.xml showProgress
APPS Password :

Beginning database tier Stage - Sat Apr  8 10:21:14 2017

/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/jre/bin/java -Xmx600M -DCONTEXT_VALIDATED=false  -Doracle.installer.oui_loc=/u02/oracle/PROD/db/tech_st/11.1.0/oui -classpath /u02/oracle/PROD/db/tech_st/11.1.0/lib/xmlparserv2.jar:/u02/oracle/PROD/db/tech_st/11.1.0/jdbc/lib/ojdbc6.jar:/u02/oracle/PROD/db/tech_st/11.1.0/appsutil/java:/u02/oracle/PROD/db/tech_st/11.1.0/oui/jlib/OraInstaller.jar:/u02/oracle/PROD/db/tech_st/11.1.0/oui/jlib/ewt3.jar:/u02/oracle/PROD/db/tech_st/11.1.0/oui/jlib/share.jar:/u02/oracle/PROD/db/tech_st/11.1.0/oui/jlib/srvm.jar:/u02/oracle/PROD/db/tech_st/11.1.0/jlib/ojmisc.jar   oracle.apps.ad.clone.StageDBTier -e /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/PROD_ruh-erpdb01.xml -stage /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/clone -tmp /tmp -method CUSTOM    -showProgress
APPS Password :
Log file located at /u02/oracle/PROD/db/tech_st/11.1.0/appsutil/log/PROD_ruh-erpdb01/StageDBTier_04081021.log

  |      0% completed

Completed Stage...
Sat Apr  8 10:21:26 2017
[oracletest@jancln]$