Sunday, October 26, 2008

Enable SSL with Oracle Applications 11i

Implementing SSL with Oracle Applications 11i

What is http?

Hypertext Transfer Protocol (HTTP) is a communications protocol for the transfer of information on the intranet and the World Wide Web. Its original purpose was to provide a way to publish and retrieve hypertext pages over the Internet.

What is Https?

Hypertext Transfer Protocol over Secure Socket Layer or HTTPS is a URI scheme used to indicate a secure HTTP connection. It is syntactically identical to the http:// scheme normally used for accessing resources using HTTP. Using an https: URL indicates that HTTP is to be used, but with a different default TCP port (443) and an additional encryption/authentication layer between the HTTP and TCP. This system was designed by Netscape Communications Corporation to provide authentication and encrypted communication and is widely used on the World Wide Web for security-sensitive communication such as payment transactions and corporate logons


Overview

This Document contains information for implementing SSL with Oracle E-Business Suite Release 11i. It implementation steps for configuring SSL with Oracle HTTP Server, Oracle Forms 6i server, and Oracle Database server.

Secure Sockets Layer (SSL) is an encrypted communication protocol that is designed to securely send messages across the Internet. It resides between Oracle HTTP Server on the application layer and the TCP/IP layer, transparently handling encryption and decryption when a secure connection is made by a client.

One common use of SSL is to secure Web HTTP communication between a browser and a Web server. This case does not preclude the use of non-secured HTTP. The secure version is simply HTTP over SSL (named HTTPS). The differences are that HTTPS uses the URL scheme https:// rather than http://, and its default communication port is 4443 on UNIX or 443 on Windows.


SSL Implementation with Oracle HTTP Server

The implementation of SSL for the Oracle HTTP server, is based on mod_ssl (http://www.modssl.org) and openssl (http://www.openssl. org) technology. The Oracle HTTP server installation under Oracle E-Business Suite Release 11i includes the mod_ssl and openssl components. Once openssl has been used to generate your digital certificate and the proper directives for Oracle HTTP server have been defined, the Oracle HTTP server is capable of starting and running in SSL mode.

1.How SSL works with Oracle HTTP ServerThe client sends a request to the server using HTTPS connection mode.
2.The server presents its certificate to the client. This certificate contains the server's identifying information.
3.The client checks its list of Trust points and compares the information in the certificate with the server's public key. If it matches, the server is authenticated as a trusted server.
4.The client sends the server a list of the encryption levels, or ciphers, that it can use.
5.The server receives the list and selects the strongest level of encryption that they have in common.
6.The client creates a session key which is used to encrypt the data and sends this session key to the server which can decrypt the data with its private key.


Step 1

SQL> select HOME_URL from icx_parameters;
HOME_URL
--------------------------------------------------
http://sys43.doyen.in:8000/oa_servlets/AppsLogin





In Apps node
cd $APPL_TOP/admin
cat VIS_sys43.xml grep login_page
http://sys43.doyen.in:8000/oa_servlets/AppsLogin



Step 2

Set ths following environment varibles
export SCRIPT_TOP=$COMMON_TOP/admin/scripts/sar_sys45
export APACHE_TOP=/oracle/app/apps/sarora/iAS/Apache
export OPENSSL_TOP=/oracle/app/apps/sarora/iAS/Apache/open_ssl
export OPENSSL_CONF=$OPENSSL_TOP/bin


Backup the context xml file in $APPL_TOP/admin
Edit the context xml file in $APPL_TOP/admin, change the SSL related variables to SSL values




Step 3

Using self signed certificate with Applications genereted by OpenSSL for WebSever

Certificate request file (.cer)
Actual certificate file (.crt)
Private Key file (.key)


OpenSSL is a cryptography toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) network protocols and related cryptography standards required by them. The openssl program is a command line tool for using the various cryptography functions of OpenSSL<80><99>s crypto library from the shell.

It can be used for

o Creation of RSA, DH and DSA key parameters
o Creation of X.509 certificates, CSRs and CRLs
o Calculation of Message Digests
o Encryption and Decryption with Ciphers
o SSL/TLS Client and Server Tests
o Handling of S/MIME signed or encrypted mail


$openssl req -x509 -newkey rsa:1024 -keyout cakey.pem -out cacert.pem -days 10000 -config openssl.cnf

Using configuration from openssl.cnf
Generating a 1024 bit RSA private key
.............................++++++
...........++++++
writing new private key to 'cakey.pem'
Enter PEM pass phrase:
Verifying password - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IN
State or Province Name (full name) [Some-State]:Tamil Nadu
Locality Name (eg, city) []:Chennai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Doyensys
Organizational Unit Name (eg, section) []:ERP
Common Name (eg, YOUR name) []:sys43.doyen.in
Email Address []:erp@doyensys.com


$openssl req -nodes -new -x509 -keyout apache.key -out apache_request.pem -days 3650 -config openssl.cnf

Using configuration from openssl.cnf
Generating a 1024 bit RSA private key
....++++++
.................................................................................................++++++
writing new private key to 'apache.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IN
State or Province Name (full name) [Some-State]:Tamil Nadu
Locality Name (eg, city) []:Chennai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Doyensys
Organizational Unit Name (eg, section) []:ERP
Common Name (eg, YOUR name) []:sys43.doyen.in
Email Address []:erp@doyensys.com

# Note : give common name your url name (for example sys43.doyen.in)


$openssl x509 -x509toreq -in apache_request.pem -signkey apache.key -out apache.csr
Getting request Private Key
Generating certificate request

$openssl x509 -req -days 3650 -in apache.csr -signkey apache.key -out apache.crt
Signature ok
subject=/C=IN/ST=Tamil Nadu/L=Chennai/O=Doyensys/OU=ERP/CN=sys43.doyen.in/Email=erp@doyensys.com
Getting Private key



cp -f apache.crt $APACHE_TOP/Apache/conf/ssl.crt/server.crt
cp -f apache.key $APACHE_TOP/Apache/conf/ssl.key/server.key
cp -f cacert.pem $APACHE_TOP/Apache/conf/ssl.crt/ca.crt



Step 4

Stop Apps services.

Run Autoconfig.

Check Apache status


Step 5

SQL> select HOME_URL from icx_parameters;
HOME_URL
--------------------------------------------------
https://sys43.doyen.in:4443/oa_servlets/AppsLogin

In Apps node

cd $APPL_TOP/admin
cat VIS_sys43.xml grep login_page
https://sys43.doyen.in:4443/oa_servlets/AppsLogin







Troubleshooting SSL Certificate

Use the following commands to check the validity of the certificate.

1. openssl x509 -subject -in server.crt
This command will give the content of the certificate.

2. openssl x509 -noout -text -in server.crt
This command will check the validity of the certificate which will list out validity period.

3. openssl s_client -connect host.domain:sslport
This command will check whether ssl configuration works fine through command prompt.

Troubleshooting common SSL errors

1. Check out the following error,
[Tue Mar 15 21:37:25 2005] [notice] FastCGI: process manager initialized (pid 8951)
[Tue Mar 15 21:37:26 2005] [notice] Oracle HTTP Server Powered by Apache/1.3.19 configured -- resuming normal operations
[Tue Mar 15 21:37:59 2005] [error] mod_ssl: SSL handshake interrupted by system [Hint: Stop button pressed in browser?!] (System error follows)
[Tue Mar 15 21:37:59 2005] [error] System: Connection reset by peer (errno: 104)
[Tue Mar 15 21:38:02 2005] [error] mod_ssl: SSL handshake interrupted by system [Hint: Stop button pressed in browser?!] (System error follows)
[Tue Mar 15 21:38:02 2005] [error] System: Connection reset by peer (errno: 104)
[Tue Mar 15 21:38:03 2005] [error] mod_ssl: SSL handshake interrupted by system [Hint: Stop button pressed in browser?!] (System error follows)
[Tue Mar 15 21:38:03 2005] [error] System: Connection reset by peer (errno: 104)

This is encountered when using browsers which are not compatable with the certificate file.

If this happens only with IE not with Netscape then the issue is with Certificate Chain file.
Comment SSLCertificateChainFile in httpd.conf.



2. Check the following error

RSA server certificate CommonName (CN) '' does NOT match server name!?
This error is usually found in ssl_engine_log. This occurs if a certificate obtained/created for one host is used for a different host.

This error can be ignored if there are no issues with applications.



Create Certificate and Configuring SSL in Oracle Apps 11i


OS : Redhat Linux 4.5
Apps : 11i(11.5.10.2)
Webserver : Apache

Set ths following environment varibles
export SCRIPT_TOP=$COMMON_TOP/admin/scripts/sar_sys45
export APACHE_TOP=/oracle/app/apps/sarora/iAS/Apache
export OPENSSL_TOP=/oracle/app/apps/sarora/iAS/Apache/open_ssl
export OPENSSL_CONF=$OPENSSL_TOP/bin

Edit in XML file ===> APPL_TOP/admin
set the %s_url_protocol variable to https
set the %s_local_url_protocol variable to https
set the %s_webentryurlprotocol variable to https
set the %s_frmConnectMode variable to https
set the %s_webssl_port variable to the Apache SSL port required
set the %s_active_webport variable to the same value as that for the %s_webssl_port variable
set the %s_webport variable to the same value as that for the %s_webssl_port variable
set the %s_web_ssl_directory variable to point to the full directory path of the directory that is to contain the .crt and .key files that you are using for Apache
eg <$COMMON_TOP>/admin/certs/apache
set %s_apps_portal_url variable to https

Stop Apps services

Run AutoConfig


mkdir sslcert
chmod 0700 sslcert
cd sslcert
mkdir certs private
echo '100001' >serial
touch certindex.txt


openssl req -x509 -newkey rsa:1024 -keyout private/cakey.pem -out cacert.pem -days 10000 -config openssl.cnf

ls -lrt
-rw-r--r-- 1 applmgr dba 963 Apr 17 20:24 cakey.pem
-rw-r--r-- 1 applmgr dba 1273 Apr 17 20:24 cacert.pem
openssl req -nodes -new -x509 -keyout apache.key -out apache_request.pem -days 3650 -config openssl.cnf
# Note : give common name your url name (for example sys43.doyen.in)
-rw-r--r-- 1 applmgr dba 1273 Apr 17 20:26 apache_request.pem
-rw-r--r-- 1 applmgr dba 891 Apr 17 20:26 apache.key
openssl x509 -x509toreq -in apache_request.pem -signkey apache.key -out apache.csr
-rw-r--r-- 1 applmgr dba 2180 Apr 17 20:26 apache.csr
openssl ca -config openssl.cnf -policy policy_anything -out apache.crt -infiles apache.csr
-rw-r--r-- 1 applmgr dba 920 Apr 18 14:36 apache.crt


cp -f apache.crt /oracle/app/apps/testora/iAS/Apache/Apache/conf/ssl.crt/server.crt
cp -f apache.key /oracle/app/apps/testora/iAS/Apache/Apache/conf/ssl.key/server.key
cp -f cacert.pem /oracle/app/apps/testora/iAS/Apache/Apache/conf/ca.crt

Start apps services

Run root user for appache start for https

sh $COMMON_TOP/admin/scripts/_/adapcctl.sh start

ex : sh /oracle/app/apps/testcomn/admin/scripts/TEST_sys43/adapcctl.sh start


----------------------------------------------------------------------------------------
openssl x509 -subject -in apache.crt
openssl x509 -noout -text -in apache.crt
openssl s_client -connect host.domain:sslport

Refer Metalink Doc
123718.1 ==> 11i: A Guide to Understanding and Implementing SSL for Oracle Applications
300969.1 ==> Troubleshooting SSL with Oracle Applications 11i

Thursday, October 23, 2008

Troubleshooting Login Problems in Oracle Applications 11i RDBMS Checks

eulapi -CONNECT EUL_US/EUL_US@upg -AUTO_UPGRADE
Database Error - ORA-02289: sequence does not exist


eulapi -CONNECT EUL_US/EUL_US@upg -AUTO_UPGRADE
-connect <**********>
-auto_upgrade
Database Error - ORA-02289: sequence does not exist


I recommend you to clean up the failed upgraded user because unnecessary object
s might remains.

Drop eul schema and import from your exported backup.

1) drop user eul_us cascade
2) Create eul_us again
3) Asign the access to eul_us (connect access, create table, etc)
4) Import the file you generated using imp command

imp EUL_US/EUL_US file=pre_10g_upgrade_eul_backup.dmp

Also, please consider the following:
Can you please make sure that EULowner in your new database has the following
privileges (before the import of the data from old database):

create procedure
create session
create table
create view
create sequence

grant create procedure, create session, create table, create view, create sequence to EUL_US;

Then run the -AUTPUPGRADE

bash-2.05b$ eulapi -CONNECT EUL_US/EUL_US@upg -AUTO_UPGRADE
-connect <**********>
-auto_upgrade
Command completed.
Posted by Ramesh Mani 0 comments Links to this post
Labels: Application Server 10g(10g AS)
Oracle Apps DBA: Discoverer 10g Installation and Migration Plan
Oracle Apps DBA: Discoverer 10g Installation and Migration Plan
Posted by Ramesh Mani 0 comments Links to this post
Labels: Application Server 10g(10g AS)
Troubleshooting Login Problems in Oracle Applications 11i RDBMS Checks
1. Check the GUEST user information.

a. Run following SQL:

select user_name, start_date, end_date
from fnd_user
where user_name = 'GUEST';

This should return one row, end_date should be NULL or in advance of today's date, and start_date should be before today's date.

b. Validate the GUEST username/password combinations from the DBC file.

Using the GUEST_USER_PWD value in the DBC file (see step 2) run the following sql:

select fnd_web_sec.validate_login('GUEST',' ') from dual ;

This should return Yes

If this returns N, then do:

select fnd_message.get from dual;

This should give a reason why the validation failed, or an error message.
If this fails with a database error, confirm the problem is not specific to the GUEST user.

Redo the SQL command with a different userid (like sysadmin)

select fnd_web_sec.validate_login('SYSADMIN','') from dual;

Again, this command should return 'Y' if it is working OK.

If not, you should reload the jar files to the database using adadmin.

2. Run the following script to ensure there are no invalid objects:

select owner, object_name, object_type
from all_objects
where status != 'VALID'
order by owner, object_type, object_name;

Ideally, this should return no rows, but some invalid objects may be acceptable, depending on what they are.

3. Check Tablespace free space:

Ensure that the database tablespaces have not run out of room. This can result in '-1' errors and/or 'Session expired' errors if the system cannot add data to the ICX tables. To test that rows can be succesfully inserted, you can run the script below:

REM Start of script
insert into icx_sessions (session_id, user_id, created_by, creation_date,last_updated_by,last_update_date)
values (-99999, -99, -1, sysdate, -1, sysdate)
/

insert into icx_failures (created_by, creation_date,last_updated_by, last_update_date) values (-1, sysdate, -1, sysdate)
/

rollback
/

REM - End of script

Note - ensure these two insert statements are rolled back - you do not want these dummy records saved.

4. Review your Alert.log.

Does the RDBMS alert log show any errors? What are they? Report them in a TAR.

5. Review any database trace files.

cd to the directory specified by user_dump_dest in the init.ora file.&nbttempt at login may create a .trc file

6. Validate the FND_NODES table:

Run the following sql:

select NODE_NAME, NODE_ID , SERVER_ID , SERVER_ADDRESS from FND_NODES;

Each SERVER_ID and NODE_ID should be unique.

The Node Name for all servers involved for the instance should appear here. We typically expect this to be e hostname or virtual hostname (alias), not the IP address. If the servers do not appear, use OAM to register them.

The SERVER_ADDRESS is optional, but if present should reflect the IP of the host. If necessary, update the IP using the system administrator responsibility.

For 11.5.2 – 11.5.9 this should return 56 rows.
For 11.5.10 this should return 131 rows.
(11.5.10+) Note: in 11.5.10 the required plsql patckages can be quickly enabled


using the script: $FND_TOP/patch/sql/txkDisableModPLSQL.sql Y


7. Validate the FND_ENABLED_PLSQL table Run the script in Appendix B. For 11.5.2 – 11.5.9 this should return 56 rows. For 11.5.10 this should return 131 rows. (11.5.10+)

Note: in 11.5.10 the required plsql packages can be quickly enabled using the script: $FND_TOP/patch/sql/txkDisableModPLSQL.sql Y :

8. Validate the 'ICX_SESSIONS_S' synonym

This should be shown as owned by ICX, if not, drop the synonym and run adadmin to regenerate grants and synonyms.

9. Ensure ICX module is showing as an "Installed" module.

Run "adutconf.sql" to check this, particularly important to check if migrating to 11i from previous release of Applications.

10. Validate the ICX_PARAMETERS table.

Run the following SQL:

select count(*) from icx_parameters;

This should only return one row.

11. Check for Bug 3275654

Run the following SQL:

SELECT c.function_id, nvl(b.prompt,c.user_function_name) prompt,c.TYPE,a.menu_id from
fnd_responsibility_vl a,
fnd_menu_entries_vl b,
fnd_form_functions_vl c
where a.responsibility_id=21584
and a.menu_id=b.menu_id
and b.function_id=c.function_id
and c.type in ('WWW','WWK','SERVLET','JSP','FORM','INTEROPJSP');

This should only return one row. If not, apply Patch 3275654

12. Oracle 8i ONLY do the following sql:

select fnd_crypto.SmallRandomNumber from dual;

If this errors with: ORA-28235: algorithm not available
Then make sure you have the file $ORACLE_HOME/lib/naeet.o (7112 bytes) in place.
If not, you need to get the file from a known good source (like another instance or from the CD). Again use the size of the file to validate.

Next relink the Oracle Executables:

cd $ORACLE_HOME/rdbms/lib

make -f ins_rdbms.mk install

$ORACLE_HOME/bin/genclntsh.sh


OA Framework Checks
These are only applicable to OA Framework 5.7 and above. (11.5.9+)

13. Disable all personalizations on the homepage

Run the following sql:

set serverout on;
exec jdr_utils.listcustomizations(‘/oracle/apps/fnd/framework/navigate/webui/HomePG’);

If this returns any rows then you have personalizations.
Disable your personalizations by logging into forms directly and setting the profile option:

Disable Self Service Personal = Yes.

Then retest the login.

If the homepage works, you need to remove your “bad” personalization.

See Note 304670.1

14. You can turn on OA Framework diagnostics logging in several ways Please refer to Note 139863.1, section 4 Profile Options Reference for more information, if required. Set the following profile options at USER level for one Applications user. It is important this is setup for one user only. You can launch Core Forms directly to gain access to the profile options, as you may not be able to login if you are reading this note!


Name Value
---------------------------------------------
FND: Debug Log Enabled Yes
FND: Debug Log Filename /tmp/OAF_Debug.txt
FND: Debug Log Module %
FND: Debug Log Level STATEMENT


Login to Applications using the Apps Username you specified above. Any error or problem you experiance will still occur, but the file /tmp/OAF_Debug.txt should be created with some diagnostics information. Please upload this file to Oracle Support for further analysis. After you have created this diagnostics file, you should disable logging by setting the USER level profile option listed below:


Name Value
---------------------------------------------
FND: Debug Log Enabled No

Detailed checks
==============

Note: It is recommended that you have a current backup your system and have no users on the system while performing these checks/tests.

15. Enable detailed logging in iAS

Follow the steps in Appendix C to enable detailed logging for iAS.
Review the logs for errors.

16.Temporarily enable iAS to use symbolic links.

Replace all occurrences of

'Option -FollowSymLinks'
for

'Option +FollowSymLinks'
in

$IAS_ORACLE_HOME/Apache/Apache/conf/httpd.conf
and

$IAS_ORACLE_HOME/Apache/Apache/conf/httpd_pls.conf

and bounce apache. If this is the issue, you should then go back and implement the changes via autoconfig. The value from this is controllable from your Apps Context, see s_options_symlinks .
17. Clear the iAS cache.

To clear the jsp & modplsql caches either rename or delete the sub-directories below following directories and restart apache. This will clear out the compiled JSP classes and cached modplsql modules causing them to be automatically recompiled next time they are accessed.

rm -Rf $OA_HTML/_pages/*
rm -Rf $COMMON_TOP/_pages/*
rm -Rf $IAS_ORACLE_HOME/Apache/modplsql/cache/*

Note: Depending on your configuration and patch level all directories may not exist.

18. Check the sqlnet.ora setup in the database Oracle Home.

Edit the

$ORACLE_HOME/network/admin/sqlnet.ora

Is tcp.validnode_checking enabled (i.e. = yes)? If so, make sure the parameter tcp.invited_nodes contains an entry for all the nodes involved in your configuration. This parameter, in conjunction with tcp.validnode_checking determines which clients can connect to the database.

Or you can temporarily disable node checking by removing the tcp.validnode_checking and retest. This is enabled for security reasons.

19. Modify AppsLocalLogin.jsp to trap exceptions.

If you get java error while using the login page like NoClassDefFound or NullPointerException, we need to trap the context of the message.

Backup and edit your:

$OA_HTML/AppsLocalLogin.jsp.

On the line that reads


} catch(Exception e) {}
Change to:

} catch(Exception e) {
} catch(Throwable t) {
System.err.println("OSS: Caught throwable in AppsLocalLogin.jsp : " +t.toString()); t.printStackTrace();
}

Then bounce Apache and reload the page and more detail should show up in the OACoreGroup.0.stderr file.


< dbc="


20. Check file permissions are not causing any problems.


Check file permissions are appropriate. In particular, the liboci806jdbc.so (.sl on HP, .DLL on NT) shared library should have read, write and execute permissions. It may be advisable to temporarily change all permissions in $JAVA_TOP to read, write and execute to see if it resolves the problem. On UNIX, you can use the command 'chmod -R 777 $JAVA_TOP', assuming $JAVA_TOP has been set correctly in your environment.


21. Regenerate JAVA_TOP:

Ensure you have a full backup of your system! To run this process, run adadmin and select Maintain Applications Files then Copy Files to Destinations.

22. Generate database trace and SQL*Net traces.

To set-up SQL*Net Trace on the Web Server set

TRACE_LEVEL_CLIENT = 16
in the

$TNS_ADMIN/SQLNET.ORA

file. This should be in the iAS file system and not in the 8.0.6. Oracle Home. By default the SQL*Net trace file will be called 'sqlnet.trc'.
Posted by Ramesh Mani 0 comments Links to this post
Labels: Trouble Shooting for Ebiz
Troubleshooting Login Problems IAS Checks
You can check your version by doing:

$IAS_ORACLE_HOME/Apache/Apache/bin/httpd –version

1. Validate TNS Connectivity

a. Make sure you can TNSPING and sqlplus the database alias used from the APPL_TOP (i.e. After running APPSORA.env). Do:

tnsping [sid]
sqlplus appsun/appspw
sqlplus appsun/appspw@[sid]

Also, validate that APPLSYSPUB/PUB can connect

b. Change to the $IAS_ORACLE_HOME, run the [sid]_[host].env file.

This will set the $ORACLE_HOME to be iAS.
Now check that you can TNSPING and sqlplus the database alias.

2. Determine the DBC file in use and make sure it is valid:

a. (11.5.9+) Run the profile option query provided in Appendix A when prompted for profile_option_name enter: APPS_DATABASE_ID.
If this returns a value, then this is the DBC file name that Apps is expecting to use.
Otherwise do:

select host_name'_'instance_name from v$instance;

b. Validate the OS location & permissions of the dbc file. Do:

ls –al $FND_SECURE/*.dbc (11.5.10+).

If $FND_SECURE is not set, then the dbc filebr> This should return the value from step 1ad.
The permissions on the file should be 644 and it should be owned my the “applmgr” user.


c. Verify the contents of the dbc file with the AdminAppServer utility. Do:

java oracle.apps.fnd.security.AdminAppServer appsun/appspw STATUS DBC=[path to dbc $FND_SECURE]/[dbc_name].dbc

This should return STATUS: VALID and the current status of AUTHENTICATION: [SECURE/ON/OFF/null] among other values.


d. Validate the autoconfig context file (11.5.8+) uses the correct dbc file.

Your context file is located in $APPL_TOP/admin and is typically named [SID]_[host].xml. Review the value for s_dbc_file_name, it should match the dbc just tested in 1c.

If any of this errors you should run autoconfig and/or $COMMON_TOP/admin/install/adgendbc.sh appsus appspw and retest (this will require iAS restart)


3. Is the web server running and able to render static html?

a. Are you able to access the page:

http:// :/aplogon.html

b. If not, then do:

ps –fu [applmgr] grep http
(or ps –fu [applmgr] grep http wc –l )

This should return at least 5 http processes running … otherwise you webserver may not be started…Make sure you are using the Oracle provided start script in:

$COMMON_TOP/admin/scripts/[SID]_[host]

If these tests fail you need to review your iAS installation and/or log a TAR.

4. (11.5.2-11.5.9) Check that the CGI environment and mod_plsql is functioning

a. Run the following URL:
http://:/pls//FND_WEB.PING

If you are unable to run the procedure below because of an 'internal error' or a 'cannot find host' or a similar error, then it could indicate that there is a problem with the PLSQL Configuration. Failures here may indicate problems with mod_plsql…Follow Note 116715.1 - How to Enable Logging for the PL/SQL Gateway. Redo the test and log a tar with the logs attached.

Or this may be a result of a RDBMS issue (For example - invalid packages, rdbms crashed)…See RDBMS section below.

b. Validate the APPS password used by the plsql gateway.

The password may be stored as clear text as a parameter (password= APPSpw) in
$IAS_ORACLE_HOME/Apache/modplsql/cfg/wdbsvr.app
If the password is encrypted in the file, update the parameter:

administrators = system
to be
administrators = all
Then navigate to:
http://:/pls//admin_/

Select the Gateway Database Access Descriptor Settings link
Select the Edit icon next to the Database Access Descriptor Name which matches your SID
Make sure the Oracle User Name = APPS
Enter the Apps user password in the Oracle Password field.
Make sure the Oracle Connect String is the SID for the instance.
If you made any changes here you will have to review your autoconfig context file to make sure the changes are permanent.

(11.5.10) After validating the above items, you may still get 'Forbidden - You don't have permission to access /pls//fnd_web.ping' on this server.” This may be by design for enhanced security. Please skip to the next test.

5. Ensure that JDK is installed correctly & is a certified version.

a. Get the value of wrapper.bin in:

$iAS_ORACLE_HOME/Apache/Jserv/etc
This will either point directly to the java executable in use or to $iAS_ORACLE_HOME/Apache/Apache/bin/java.sh.
If this points to the java.sh go to step 5b…otherwise skip to step 5c.

b.Open the java.sh File under $iAS_ORACLE_HOME/Apache/Apache/bin. In this file and you will find path to java executable in variable "JSERVJAVA"


c. Use the absolute path to the java executable and do:
/absolute/path/to/java –version

e. Check that the version returned is certified by using the certify website on Metalink.
Assuming this returns a supported version of JDK. Use the following notes to validate your JDK installation (i.e. that all required patches, autoconfig templates, etc have been completed):
Note 304099.1 => if using J2SE Version 5.0

Or

Note 246105.1 => if using J2SE 1.4

OR

Note 130091.1 => if using JDK 1.3

6. Use the following programs to verify the installation and check that the servlets are functioning.

a. http(s)://:/servlets/IsItWorking
(11.5.10) This may fail with:

Forbidden You don't have permission to access /servlets/IsItWorking on this server.
This is due to enhanced security delivered with the autoconfig templates.
Please try test 4b instead.


b.http(s)://:/servlets/Hello

If this one fails, this indicates an issue with your Jserv set-up. You then need to follow Note 230688.1 to drill down into this problem.


7. Validate that jsp work.

a. http(s)://:/OA_HTML/jsp/fnd/aoljtest.jsp

If this one fails to render, this indicates an issue with your Jserv set-up. You then need to follow Note 230688.1 to drill down into this problem.Otherwise you enter the values requested, and follow the link at the bottom of the first page to run through this set of diagnostic tests. Report all tests that fail in a TAR.

Note: The initial page of this test may show some "missing" files.
Depending on your configuration the following missing files are acceptable:

apps.zip (is normal to be missing since it has been exploded on $JAVA_TOP (ref : Note 220188.1 ))
iAS/mp/jlib/opreopi-rt.jar (Used for Oracle Personalization. Can be ignored if you are not using MP.)
iAS/mp/jlib/dmtutil.jar (Used for Data Mining)
iAS/dm/jlib/odmapi.jar (Used for Data Mining - If you are using Data Mining, and these are listed as missing, please see Note 281739.1 )
iAS/portal30/jpdk/lib/partnerApp.jar (If you are not using Portal, this can be ignored.)


8. Check the "session.topleveldomain" setting in the


$IAS_ORACLE_HOME/Apache/Jserv/etc/zone.properties
This should match the domain you are using as defined in the SESSION_COOKIE_DOMAIN column in ICX_PARAMETERS table.

From sqlplus do:

select SESSION_COOKIE_DOMAIN from ICX_PARAMETERS;


Notes: It is acceptable to have SESSION_COOKIE_DOMAIN set to null
You MUST have a valid domain that is composed of 2 or more components (see Bug 2510732). I.e: .oracle is an INVALID domain, but .oracle.com IS a valid domain.
Posted by Ramesh Mani 0 comments Links to this post
Labels: Trouble Shooting for Ebiz
adaimgr AutoUpgrade
After 8i to 9i Migration, The steps to be followed.

************* Start of AutoUpgrade session *************

AutoUpgrade version: 11.5.0
AutoUpgrade started at: Thu Apr 10 2008 09:53:09

APPL_TOP is set to /u01/11i/uat/applmgr/uatappl

NLS_LANG value from the environment is : American_America.WE8ISO8859P1
NLS_LANG value for this AD utility run is : AMERICAN_AMERICA.WE8ISO8859P1

It is critical that your Oracle Applications, RDBMS and related tools are
compatible and certified combinations. If you are uncertain whether a
combination is certified please contact Oracle Support Services.

Are you certain you are running a certified release combination [No] ? Yes

You can be notified by email if a failure occurs.
Do you wish to activate this feature [No] ? No

Please enter the batchsize [1000] : 1000


Please enter the name of the Oracle Applications System that this
APPL_TOP belongs to.

The Applications System name must be unique across all Oracle
Applications Systems at your site, must be from 1 to 30 characters
long, may only contain alphanumeric and underscore characters,
and must start with a letter.

Sample Applications System names are: "prod", "test", "demo" and
"Development_2".

Applications System Name [uat] : uat_zeus


NOTE: If you do not have or choose not to have certain types of files installed
in this APPL_TOP, you may not be able to perform certain tasks.

Example 1: If you don't have files used for installing or upgrading
the database installed in this area, you cannot install or upgrade
the database from this APPL_TOP.

Example 2: If you don't have forms files installed in this area, you cannot
generate them or run them from this APPL_TOP.

Example 3: If you don't have concurrent program files installed in this area,
you cannot relink concurrent programs or generate reports from this APPL_TOP.


Do you currently have or want to install files used for installing or upgrading
the database in this APPL_TOP [YES] ? YES


Do you currently have or want to install Java and HTML files for HTML-based
functionality in this APPL_TOP [YES] ? YES


Do you currently have or want to install Oracle Applications forms files
in this APPL_TOP [YES] ? YES


Do you currently have or want to install concurrent program files
in this APPL_TOP [YES] ? YES


Please enter the name Oracle Applications will use to identify this APPL_TOP.

The APPL_TOP name you select must be unique within an Oracle Applications
System, must be from 1 to 30 characters long, may only contain
alphanumeric and underscore characters, and must start with a letter.

Sample APPL_TOP Names are: "prod_all", "demo3_forms2", and "forms1".

APPL_TOP Name [zeus] : uat_zeus_appltop

You are about to install or upgrade Oracle Applications product tables
in your ORACLE database 'uat'
using ORACLE executables in '/u01/11i/uat/applmgr/uatora/8.0.6'.

Is this the correct database [Yes] ? Yes

AutoUpgrade needs the password for your 'SYSTEM' ORACLE schema
in order to determine your installation configuration.

Enter the password for your 'SYSTEM' ORACLE schema: *****


Connecting to SYSTEM......Connected successfully.

There exists one FND_PRODUCT_INSTALLATIONS table.
AutoUpgrade will upgrade the existing product group.

The ORACLE username specified below for Application Object Library
uniquely identifies your existing product group: APPLSYS

Enter the ORACLE password of Application Object Library [APPS] : *****

AutoUpgrade is verifying your username/password.
Connecting to APPLSYS......Connected successfully.

The status of various features in this run of AutoUpgrade is:

<-Feature version in->
Feature Active? APPLTOP Data model Flags
------------------------------ ------- -------- ----------- -----------
CHECKFILE No 1 -1 Y N N Y N N
PREREQ No 6 -1 Y N N Y N N
CONCURRENT_SESSIONS No 2 -1 Y Y N Y Y N
PATCH_TIMING No 2 -1 Y N N Y N N
PATCH_HIST_IN_DB No 6 -1 Y N N Y N N
SCHEMA_SWAP No 1 -1 Y N N Y Y N



Connecting to SYSTEM......Connected successfully.

Connecting to APPLSYS......Connected successfully.

Identifier for the current session is 1

Reading product information from file...

Reading language and territory information from file...

Reading language information from applUS.txt ...

Reading database to see what industry is currently installed.


Oracle Applications is currently installed for Commercial or for-profit use.

Do you wish to:
1) Continue to use Oracle Applications for Commercial or for-profit use.
2) Convert Oracle Applications to government, education or
not-for-profit use

Enter your choice [1] : 1


Reading FND_LANGUAGES to see what is currently installed.
Currently, the following languages are installed:

Code Language Status
---- --------------------------------------- ---------
US American English Base
ESA Latin American Spanish Install

Reading language information from applESA.txt ...

Your base language will be AMERICAN.

Your other languages to install are: LATIN AMERICAN SPANISH

Setting up module information.
Reading database for information about the modules.
Saving module information.
Reading database for information about the products.
Connecting to SYSTEM......Connected successfully.

Connecting to APPLSYS......Connected successfully.

Connecting to SYSTEM......Connected successfully.

Reading database for information about how products depend on each other.
Connecting to APPLSYS......Connected successfully.

Reading topfile.txt ...

Saving product information.
Connecting to SYSTEM......Connected successfully.

Connecting to APPLSYS......Connected successfully.

Connecting to APPS......Connected successfully.

Connecting to SYSTEM......Connected successfully.

Saving task information.

AutoUpgrade Main Menu
--------------------------------------------------

1. Choose database parameters

2. Choose overall tasks and their parameters

3. Run the selected tasks

4. Exit AutoUpgrade

* Please use License Manager to license additional
* products or modules after the upgrade is complete.


Enter your choice : 1

AutoUpgrade - Choose database parameters

- O - - S - --- M --- --- I --- --- D ---
Product Action ORACLE Sizing Main Index Default
# Name User ID Factor Tablespace Tablespace Tablespace
-- ---------------------- - ------- ------ ---------- ---------- ----------
1 Application Object Lib U APPLSYS 100 AOLD AOLX AOLD
2 Application Utilities U APPLSYS 0 AOLD AOLX AOLD
3 Applications DBA U APPLSYS 0 AOLD AOLX AOLD
4 Alert U APPLSYS 100 AOLD AOLX AOLD
5 Global Accounting Engi I AX 100 AXD AXX AXD
6 Common Modules-AK I AK 100 AKD AKX AKD
7 Subledger Accounting S XLA 100 XLAD XLAX XLAD
8 General Ledger U GL 100 GLD GLX GLD

There are 209 Oracle Applications. Enter U/D to scroll up/down.

Note: This will display all the tablespace

- To change a database parameter for a product;
INCLUDE the LETTER ABOVE the COLUMN you want to change
U / D / T / B - Press up/down/top/bottom to see other products
[Return] - To return to the AutoUpgrade Main Menu

Enter your choice (for example, 1M) :

AutoUpgrade error:

APPLSYSD
APPLSYSX

The above tablespaces do not exist in your database.
Please either create the missing tablespaces or change your
tablespace selection to exclude these tablespaces.

Review the messages above, then press [Return] to continue.

AutoUpgrade - Choose database parameters

- O - - S - --- M --- --- I --- --- D ---
Product Action ORACLE Sizing Main Index Default
# Name User ID Factor Tablespace Tablespace Tablespace
-- ---------------------- - ------- ------ ---------- ---------- ----------
39 Applications Shared Te S APPLSYS 100 APPLSYSD APPLSYSX AOLD
40 Enterprise Asset Manag EAM 100 EAMD EAMX EAMD
41 Transportation Executi FTE 100 FTED FTEX FTED
42 Public Sector Financia IGI 100 IGID IGIX IGID
43 Internet Procurement E ITG 100 ITGD ITGX ITGD
44 Inventory Optimization MSR 100 MSRD MSRX MSRD
45 Product Development IPD 100 IPDD IPDX IPDD
46 Product Development In ENI 100 ENID ENIX ENID

There are 209 Oracle Applications. Enter U/D to scroll up/down.


- To change a database parameter for a product;
INCLUDE the LETTER ABOVE the COLUMN you want to change
U / D / T / B - Press up/down/top/bottom to see other products
[Return] - To return to the AutoUpgrade Main Menu

Enter your choice (for example, 1M) : 39M

Enter the ORACLE tablespace name where you wish to store
Applications Shared Technology tables in ORACLE username APPLSYS [APPLSYSD] : AOLD

Connecting to APPLSYS......Connected successfully.

AutoUpgrade - Choose database parameters

- O - - S - --- M --- --- I --- --- D ---
Product Action ORACLE Sizing Main Index Default
# Name User ID Factor Tablespace Tablespace Tablespace
-- ---------------------- - ------- ------ ---------- ---------- ----------
33 Report Manager FRM 100 FRMD FRMX FRMD
34 Activity Based Managem ABM 100 ABMD ABMX ABMD
35 Balanced Scorecard BSC 100 BSCD BSCX BSCD
36 SEM Exchange EAA 100 EAAD EAAX EAAD
37 Value Based Management EVM 100 EVMD EVMX EVMD
38 Strategic Enterprise M FEM 100 FEMD FEMX FEMD
39 Applications Shared Te S APPLSYS 100 AOLD APPLSYSX AOLD
40 Enterprise Asset Manag EAM 100 EAMD EAMX EAMD

There are 209 Oracle Applications. Enter U/D to scroll up/down.


- To change a database parameter for a product;
INCLUDE the LETTER ABOVE the COLUMN you want to change
U / D / T / B - Press up/down/top/bottom to see other products
[Return] - To return to the AutoUpgrade Main Menu

Enter your choice (for example, 1M) : 39I

Enter the ORACLE tablespace name where you wish to store
Applications Shared Technology indexes in ORACLE username APPLSYS [APPLSYSX] : AOLX

Connecting to SYSTEM......Connected successfully.

Connecting to APPLSYS......Connected successfully.

AutoUpgrade - Choose database parameters

- O - - S - --- M --- --- I --- --- D ---
Product Action ORACLE Sizing Main Index Default
# Name User ID Factor Tablespace Tablespace Tablespace
-- ---------------------- - ------- ------ ---------- ---------- ----------
33 Report Manager FRM 100 FRMD FRMX FRMD
34 Activity Based Managem ABM 100 ABMD ABMX ABMD
35 Balanced Scorecard BSC 100 BSCD BSCX BSCD
36 SEM Exchange EAA 100 EAAD EAAX EAAD
37 Value Based Management EVM 100 EVMD EVMX EVMD
38 Strategic Enterprise M FEM 100 FEMD FEMX FEMD
39 Applications Shared Te S APPLSYS 100 AOLD AOLX AOLD
40 Enterprise Asset Manag EAM 100 EAMD EAMX EAMD

There are 209 Oracle Applications. Enter U/D to scroll up/down.


- To change a database parameter for a product;
INCLUDE the LETTER ABOVE the COLUMN you want to change
U / D / T / B - Press up/down/top/bottom to see other products
[Return] - To return to the AutoUpgrade Main Menu

Enter your choice (for example, 1M) :

Connecting to SYSTEM......Connected successfully.

Saving your choices...
Done.

Backing up restart files, if any......Done.


AutoUpgrade Main Menu
--------------------------------------------------

1. Choose database parameters

2. Choose overall tasks and their parameters

3. Run the selected tasks

4. Exit AutoUpgrade

* Please use License Manager to license additional
* products or modules after the upgrade is complete.


Enter your choice : 2

AutoUpgrade - Choose overall tasks and their parameters

# Task Do it? Parameters
-- ------------------------------------------ ------ --------------------
1 Verify files necessary for upgrade YES
2 Install or upgrade database objects YES


There are 2 tasks. Enter U/D to scroll up/down.

- To change YES to NO or NO to YES
(You cannot change a task marked with a *)
P - To change the parameters of a task
U / D - To page up/down to see other tasks
[Return] - To return to the AutoUpgrade Main Menu

Enter your choice (for example 2 or 2P) :

Saving your choices...
Done.

Backing up restart files, if any......Done.


AutoUpgrade Main Menu
--------------------------------------------------

1. Choose database parameters

2. Choose overall tasks and their parameters

3. Run the selected tasks

4. Exit AutoUpgrade

* Please use License Manager to license additional
* products or modules after the upgrade is complete.

Enter your choice : 3

Connecting to APPLSYS......Connected successfully.

Connecting to SYSTEM......Connected successfully.

Connecting to APPS......Connected successfully.


AD utilities can support a maximum of 999 workers. Your
current database configuration supports a maximum of 992 workers.
Oracle recommends that you use between 24 and 48 workers.


Enter the number of workers [24] : 24

Now process will start