26 Oracle Platform Security Services

26.1.1.1 Configuring Auditing for Oracle Access Manager

Although Oracle Access Manager appears as a component in Oracle Enterprise Manager Fusion Middleware Control, you cannot configure auditing for Oracle Access Manager using Fusion Middleware Control.

26.1.1.2 Audit Reports do not Display Translated Text in Certain Locales

The standard audit reports packaged with Oracle Business Intelligence Publisher support a number of languages for administrators. Oracle Business Intelligence Publisher can start in different locales; at start-up, the administrator can specify the language of choice by setting the preferred locale in Preferences.

Due to this bug, if Oracle Business Intelligence Publisher is started on any of these 3 locales:

• zh_CN (simplified chinese)

• zh_TW (traditional chinese)

• pt_BR (portuguese brazilian)

then users cannot see the report in that locale (the entire report including labels, headers, titles and so on appears in English), while the other locales display the translated text as expected. For example, when Oracle Business Intelligence Publisher is started in zh_CN, the text cannot be seen in zh_CN even though the preferred locale is set to zh_CN; information is displayed in English.

This issue will be fixed in a future release of Oracle Business Intelligence Publisher.

26.1.1.3 Audit Reports Always Display in English

The standard audit reports packaged with Oracle Business Intelligence Publisher support a number of languages.

Due to this bug, report titles and descriptions are displayed in English even when they have been translated.

This issue will be fixed in a future release of Oracle Business Intelligence Publisher.

26.1.1.4 Creating a New Audit Schema

When RCU is run for PS3 it completes the creation of the audit schema and gives the status of the creation as success. However, the STS table is not created because of a typographical issue in the STS.sql script which is invoked by RCU.

Information indicating that the table did not get created can be found only if the iau.log file is inspected or if you specifically look for the created tables.

Due to this issue, for a Release 11g PS3 full install, you must explicitly ensure the STS table is created if you have chosen to create the audit schema and are planning to use it.

You have two options to resolve the issue, depending on whether RCU has already been run for PS3.

Option 1

Use this option if RCU has not yet been run for PS3. The steps are:

1. Open the following file for editing:

   $RCU_HOME/rcu/integration/iau/scripts/STS.sql 
   

2. Remove the comma on line number 48 in STS.sql.

3. Save and close the file.

4. Open the following file for editing:

   $RCU_HOME/rcu/integration/iau/iau.xml
   

5. Search for string 11.1.1.3.0 and replace it with the string 11.1.1.4.0

6. Save and close the file.

7. Run RCU.

Option 2

Use this option if RCU has already been run for PS3. The steps are:

1. Open the following file for editing:

   $COMMON_COMPONENTS_HOME/modules/oracle.iau_11.1.1/sql/scripts/STS.sql 
   

2. Remove the comma on line number 48 in STS.sql.

3. Save and close the file.

4. Copy STS.sql to the location from where it is going to be run.

5. Connect as sysdba and run the following SQL commands:

   sqlplus> connect /as sysdba;
   sqlplus> alter session set current_schema=audit_schema_user;
   sqlplus> @@STS.sql audit_schema_user audit_schema_user_Append
   audit_schema_user_Viewer
   

   replacing audit_schema_user with the name of your audit schema user.

26.1.1.5 Upgrading the Audit Schema

This note describes a required workaround that applies in case (and only in case) you are upgrading your audit schema from PS1 or PS2 to PS3. The following workaround must be executed before running the Patch Set Assistant (PSA).

To implement the workaround, proceed as follows:

1. Copy

   $COMMON_COMPONENTS_HOME/modules/oracle.iau_11.1.1/sql/scripts/STS.sql
   

   to

   $COMMON_COMPONENTS_HOME/common/sql/iau/upgrade/STS.sql
   

2. Open the copied file for edit.

3. Remove the comma in line number 48.

4. Save and close the file.

5. Open the following files for edit:

   $COMMON_COMPONENTS_HOME/common/sql/iau/upgrade/ iau111134.sql
   $COMMON_COMPONENTS_HOME/common/sql/iau/upgrade/ iau11114.sql
   

6. In each of those files:

   • Remove the line ALTER TABLE OAM ADD IAU_ResourceTemplateName VARCHAR(100);

   • Just before the line ALTER TABLE OAM ADD IAU_AdditionalInfo CLOB, insert the following line before the line

     RENAME COLUMN IAU_AdditionalInfo TO IAU_AdditionalInfo_OLD;
     

7. Save and close both edited files.

8. At this point you can use PSA.

26.1.5.1 Addition to Section Propagating Identities over the HTTP Protocol

The following new information belongs in section 19.3.1.2:

The out of box configuration assumes that the token issuer name and the key alias is based on the WebLogic server name. Note that the key alias server name on WebSphere is set based on the WebSphere server root. For example, if the server root is $T_WORK/middleware/was_profiles/DefaultTopology/was_as/JrfServer then the server name is set to JrfServer. To change the default value, use the procedures explained in section 19.3.12.

26.1.5.2 Correction to Section Client Application Code Sample

The following sample illustrates a client application; note that the file jps-api.jar and OSDT jars osdt_ws_sx.jar, osdt_core.jar, osdt_xmlsec.jar, osdt_saml2.jar must be included the class path for the code sample to compile.

26.1.5.3 Correction to Section Keystore Service Configuration

Assuming that the WebLogic server name is jrfServer_admin, the following command illustrates the creation of the keystore, represented by the generated file default-keystore.jks.

26.1.5.4 Updating the Trust Service Configuration Parameters

The information in this section is new and it explains how to modify the trust service configuration parameters in the file jps-config.xml with a script.

Out-of-the-box the values of the parameters trust.aliasName and trust.issuerName are set to the WebLogic server name. To modify their values to deployment-specific values, use a script like the following:

import sys
 
wlsAdmin = 'weblogic'
wlsPwd ='password_value'
wlUrl='t3://localhost:7001'
issuer= 'issuer'
alias = 'alias'
 
print "OPSS Trust Service provider configuration management script.\n"
 
instance = 'trust.provider'
name = 'trust.provider.embedded'
cfgProps = HashMap()
cfgProps.put("trust.issuerName", issuer)
cfgProps.put("trust.aliasName", alias)
pm = PortableMap(cfgProps);
 
connect(wlsAdmin, wlsPwd, wlUrl)
domainRuntime()
 
params = [instance, name, pm.toCompositeData(None)]
sign = ["java.lang.String", "java.lang.String", "javax.management.openmbean.CompositeData"]
on = ObjectName("com.oracle.jps:type=JpsConfig")
mbs.invoke(on, "updateTrustServiceConfig", params, sign)
mbs.invoke(on, "persist", None, None)
 
print "Done.\n"