K Troubleshooting Oracle Internet Directory

K.1 Installation Errors

During installation and configuration of the Oracle Database, Oracle recommends that you select the character set UTF-8 to avoid possible problems with multibyte characters.

K.2 Directory Server Error Messages and Causes

This section contains a list of all the Oracle directory server error messages that you can encounter. Each message is followed by its most probable causes.

This section contains these topics:

• Oracle Database Server Error Due to Schema Modifications

• Standard Error Messages Returned from Oracle Directory Server

• Additional Directory Server Error Messages

K.3 Troubleshooting Password Policies

This section contains these topics:

• Password Policy Error Messages

• Possible Password Policy Problems

K.4 Troubleshooting Directory Performance

This section gives some quick pointers for common performance-related problems.

If LDAP search performance is poor, make sure that:

• Schema associated with the ODS user is ANALYZED

• For searches involving multiple filter operands, make sure that the order in which they are given goes from the most specific to the least specific. For example, &(uid=john.doe)(objectclass=person) is better than &(objectclass=person)(uid=john.doe).

If LDAP add or modify performance is poor, make sure that:

• There are enough redo log files in the database

• The undo tablespace in the database is large enough

• The schema associated with the ODS user is ANALYZED

When estimating the statistics, you can use the OID Database Statistics Collection tool to analyze the various database ODS schema objects.

Both the tracing functionality described in "Using Debug Logging" and the database tracing event 10046 can assist you in diagnosing performance issues.

K.5 Troubleshooting Starting, Stopping, and Restarting of the Directory Server

To troubleshoot starting and stopping the directory server, you must know the purpose of each tool involved, how all the tools work together, and the overall process for starting and stopping the server.

About the Tools for Starting, Stopping, and Restarting the Directory Server

There are two tools used to start, stop, and restart directory server instances: OID Control Utility (OIDCTL) and OID Monitor (OIDMON).

OIDCTL

 When OIDCTL is executed, it connects to the database as user ODS. Depending on the options used in the command, it either inserts or updates rows into a table named ODS.ODS_PROCESS. If the START option is used, then a row is inserted. If either the STOP or RESTART option is used, then a row is updated.

The ODS.ODS_PROCESS table includes the following information:

• instance—The unique number of the instance, any value between 0 and 1000

• pid—Process identifier, which will be updated by OIDMON when the process is started

• state—The type of operation requested

  The possible values for state are:

  • 0=stop

  • 1=start

  • 2=running

  • 3=restart

  • 4=shutdown

  • 5=failedover

OIDMON

 To start, stop, or restart a directory server instance, OIDMON must be running. At specified intervals, this daemon checks the value of the state column in the ODS.ODS_PROCESS table.

If it finds a row with state=0, then it reads the pid and stops the process.

If it finds one with state=1 or state=4, then it starts a new process and updates the pid column with a new process identifier.

If it finds one with state=2, then it reads the pid and verifies that the process with that pid is running. If it is not running, then OIDMON starts a new process and updates the pid column with a new process identifier.

If it finds a row with state=3, then OIDMON reads the pid, stops the process, starts a new one, and updates the pid accordingly.

If OIDMON cannot start the server for some reason, it retries. If it is not running on a node in a RAC or rack configuration, and it is still unsuccessful after 10 retries, it deletes the row from the ODS.ODS_PROCESS table. If OIDMON is running on a node in a RAC or rack configuration, it retries 100 times.

If it is still unsuccessful, it pushes the request to another node.

In short, OIDCTL inserts and updates state information in the rows in the ODS.ODS_PROCESS table. OIDMON then reads that information and performs the specified task.

About the Processes Involved in Starting, Stopping, and Restarting the Directory Server

Starting, stopping and restarting the directory server involves a number of processes. OIDMON is one process. On Unix, it is called oidmon. In a Microsoft Windows environment, it is called oidmon.exe.

To start an instance, OIDMON checks the unique number in the instance column mentioned in the previous section. It then starts another process, namely, the listener/dispatcher, which is different from the Oracle Net Services listener process. It stores the process identifier for that new process in the pid column.

The listener/dispatcher, in turn, starts a number of server processes as defined in the configuration set entry. Note that these server processes are controlled by the listener/dispatcher and not by OIDMON. If one of these processes fails, then it is automatically restarted by the listener/dispatcher.

Together, the listener/dispatcher and the server processes constitute a directory server instance. On UNIX, this directory server instance is called oidldapd. On Microsoft Windows, they are called oidldapd.exe.

In short, there are at least three processes: one for OIDMON and at least two for the directory server itself. When all processes are running, you should see something like the following on UNIX computers:

% ps -ef|grep oid
root 12387 12381 0 Mar 28 ? 0:05 oidldapd -i 1 -conf 0 key=811436710
root 12381 1 0 Mar 28 ? 0:10 oidmon start
root 13297 1 0 Mar 28 ? 0:14 oidldapd

Another way to obtain server information is by running ldapcheck. When you do this, you may see something like this:

Checking Oracle Internet Directory Processes ...
Process oidmon is Alive as PID 12381
Process oidldapd is Alive as PID 12387 
Process oidldapd is Alive as PID 13297
Not Running ---- Process oidrepld

Possible Problems when Starting, Stopping, or Restarting the Directory Server

K.6 Troubleshooting Directory Replication

This section discusses directory replication problems.

Whenever you investigate a replication problem, be sure to consult the log files $ORACLE_HOME/ldap/oidrepld00.log and oidldapdxx.log for information. The replication server supports multiple debugging levels. To turn on replication debugging, specify the -d decimal_debug_level flag when you start the server. For example:

oidctl server=oidrepld connect=connect_string instance=instance_number \
       flags="-h host -p port -d decimal_debug_level"

If you are debugging LDAP replication, you should become familiar with the LDAP replica states. If LDAP-based replication is configured, when the replication server starts, it reads the replica state from the local replica. The replication server behaves differently, depending upon the local replica state. LDAP replication errors appear in oidldapdxx.log

K.7 Troubleshooting SSL Setup

This section discusses possible problems when configuring SSL

K.8 Troubleshooting Change Log Garbage Collection

This section discusses possible problems you might encounter with change log garbage collection.

K.9 Troubleshooting Dynamic Password Verifiers

Table K-4 lists and describes the error messages for dynamic password verifiers.

If the directory is able to compare verifiers, and the comparison evaluates as false, the directory sends the standard error LDAP_COMPARE_FALSE to the client. Similarly, if the user being authenticated lacks a directory entry, the directory sends the standard error LDAP_NO_SUCH_OBJECT.

K.10 Troubleshooting Oracle Internet Directory Password Wallets

The Oracle Internet Directory Server has two password wallets: oidpwdlldap1 and oidpwdrSID.

The oidpwdlldap1 file contains the DN and password of an ODS user in encrypted format. The Oracle Internet Directory server uses the credential to connect to the backend database at startup time.

The oidpwdrSID file contains the DN and password of a replica DN in an encrypted format. The Oracle Internet Directory replication server uses the credential to connect to the Oracle Internet Directory server at startup time.

This is an example of a replication password wallet, oidpwdrSID:

/------BEGIN REPL CREDENTIAL:cn=replication dn,orclreplicaid=qdinh-sun_adeldap,cn=replication configuration----- ezNkZXMtY2JjLXBrY3M1cGFkfQUnaz0TsfzcP0nM1HcHAXchf5mJw+sb4y0bLvvw3RvSg7HS7/WsKJB02fdSGRlmfWAV+6llkRQ26g==
-----END REPL CREDENTIAL:cn=replication dn,orclreplicaid=qdinh-sun_adeldap,cn=replication configuration-----/

K.11 Need More Help?

You can find more solutions on Oracle MetaLink, http://metalink.oracle.com. If you do not find a solution for your problem, log a service request.