Contents

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

1 What's New in the Oracle Application Server Release Notes?

2 Introduction

• 2.1 Latest Release Information
• 2.2 Purpose of this Document
• 2.3 Operating System Requirements
• 2.4 Multiple Versions of Identity Management in this Release
• 2.5 Certification Information
• 2.6 Licensing Information

3 Installation and Upgrade Issues

• 3.1 Installation Issues
  • 3.1.1 Workaround if HTTP Server Configuration Assistant Fails
  • 3.1.2 IPv6 Not Supported
  • 3.1.3 Unique Global Database Name Required During Installation
  • 3.1.4 Error Message During Deinstallation
  • 3.1.5 Do Not Use Turkish Locale During Installation
  • 3.1.6 Avoid Using Switzerland Locale During OracleAS Metadata Repository Installation
  • 3.1.7 Oracle Application Server Repository Creation Assistant Fails During Loading When the Database Uses Certain Chinese Character Sets
  • 3.1.8 OracleAS Cold Failover Cluster: Additional Configuration Steps for Oracle Delegated Administration Services
  • 3.1.9 Oracle Internet Directory SSL Connection Fail Intermittently
  • 3.1.10 Incorrect Location for Debug Message
  • 3.1.11 Illegible or Garbage Characters Output in a Russian Locale
  • 3.1.12 Application Server Control Console Link Not Operational in non-English Installations
  • 3.1.13 Set the NLS Parameter Before Installing
  • 3.1.14 Resource Bundle Key String Displayed on Oracle Universal Installer Screen
  • 3.1.15 Deconfiguration Assistant Fails from Command Window
  • 3.1.16 Excessive Privileges for OracleAS Metadata Repository Installations
  • 3.1.17 Incorrect Guidelines for Online Help
  • 3.1.18 OIDCA Fails Due to Misconfiguration in /etc/hosts
  • 3.1.19 DB Console of Infrastructure IM+MR Cannot be Started
• 3.2 Upgrade Issues
  • 3.2.1 Clarification of When to Run the Metadata Repository Upgrade Assistant
  • 3.2.2 Upgrade of Identity Management Installation to 10.1.4.0.1
  • 3.2.3 Additional Step Required When Upgrading OracleAS Metadata Repository Release 9.0.4.3 to 10.1.4.0.1
  • 3.2.4 Configuring Port Values for the Load Balancer and Oracle Internet Directory When Upgrading Oracle Application Server Cluster (Identity Management)
  • 3.2.5 Harmless Error Messages During OracleAS Metadata Repository Upgrade
  • 3.2.6 Metadata Repository Container Version
  • 3.2.7 Issues When Using the ldifwrite Command to Back Up the Oracle Internet Directory
  • 3.2.8 Upgrade of OracleAS Cold Failover Clusters Fails While Running Configuration Assistant
• 3.3 Documentation Errata
  • 3.3.1 Possible Error Message When Decommissioning a 10.1.4.0.1 Oracle Home After Upgrade
  • 3.3.2 Incorrect Line Breaks in MRUA Sample Output
  • 3.3.3 Incorrect Global Database Naming Standard

4 General Management and Security Issues

• 4.1 General Management Issues
  • 4.1.1 Modifying targets.xml After Enabling SSL for Oracle Identity Management 10g (10.1.4.0.1)
  • 4.1.2 Changing the IP Address of a Metadata Repository Created with Oracle Application Server Repository Creation Assistant
  • 4.1.3 Oracle Enterprise Manager Grid Control Does not Display all Integration Profiles
  • 4.1.4 Additional Information for Changing Hostname for Identity Management Installations
• 4.2 Documentation Errata
  • 4.2.1 References to OracleAS Web Cache and OracleAS Portal in the Application Server Control Console Online Help

5 High Availability

• 5.1 General Issues and Workarounds
  • 5.1.1 Upgrade to OracleAS Guard Release 10.1.2.2.1
  • 5.1.2 Problem Performing a Clone Instance or Clone Topology Operation
  • 5.1.3 OracleAS Guard Release 10.1.2.1.1 Cannot Be Used with Oracle RAC Databases
  • 5.1.4 OracleAS Guard Returned an Inappropriate Message When It Could Not Find the User Specified Database Identifier
• 5.2 Configuration Issues and Workarounds
  • 5.2.1 An OracleAS Guard asgctl verify Operation Does Not Check Temp Directories
  • 5.2.2 The asgctl shutdown topology Command Does Not Shut Down an MRCA Database That is Detected To Be of a repCa Type Database
  • 5.2.3 Database SIDs Must be the Same for Database Peers at Primary and Standby Sites
  • 5.2.4 Use All Uppercase Characters for Database Initialization Parameters to Avoid Instantiate and Sync Problems
  • 5.2.5 Use the Same Port for ASG on the Production and Standby Sites to Avoid clone instance Operation Problems
  • 5.2.6 Use Fully Qualified Path Names with the add instance Command
  • 5.2.7 ASG Cloning is Not Supported when the Number of Oracle Homes is Different at the Primary and Standby Hosts
  • 5.2.8 Workarounds on Windows Systems to Avoid Cloning Systems
  • 5.2.9 Entries in TNSNAMES.ORA File that Lack Domain Names Cause Disaster Recovery Problems
• 5.3 Documentation Errata and Omissions
  • 5.3.1 Availability of a Previously Undocumented asgctl Command: create standby database
  • 5.3.2 Connecting to an OracleAS Guard Server May Return an Authentication Error
  • 5.3.3 A Create Standby Database Operation Fails with an ASG_DGA-12500 Error Message on Windows
  • 5.3.4 All emagents Must Be Shut Down Before Performing OracleAS Guard Operations
  • 5.3.5 Procedure to Patch a 10.1.2.0.0 Disaster Recovery Setup with a 10.1.2.1.0 Patchset
  • 5.3.6 Running Instantiate Topology Across Nodes After Executing a Failover Operation Results in an ORA-01665 Error
  • 5.3.7 OracleAS Guard Is Unable to Shutdown the Database Because More Than One Instance of Oracle RAC is Running

6 Oracle Access Manager

• 6.1 Oracle Access Manager 10g (10.1.4.0.1) Patch Sets and Bundle Patches
  • 6.1.1 Obtaining the Latest Bundle Patch
  • 6.1.2 Obtaining the Latest Patch Set
• 6.2 General Issues
  • 6.2.1 New Location for the Platform Support Matrix
  • 6.2.2 Known Issue With JDK 1.1.7
  • 6.2.3 The Name "Query Builder" Is Not Always Translated
  • 6.2.4 Users Can Access Resources After Password Reset Without Logging In
  • 6.2.5 Time Management and Daylight Savings Time
  • 6.2.6 Caveat to Create a Password Policy with Change on Reset Enabled
• 6.3 Installation and Upgrade Issues and Workarounds
  • 6.3.1 Change the Transport Security Mode During Installation
  • 6.3.2 iPlanet Server Fails After Tuning
  • 6.3.3 Oracle Internet Directory Servers Require Tuning After Installation
  • 6.3.4 Support for DirX Has Been Deprecated
  • 6.3.5 "Enter Password" String Does Not Display Correctly During Installation
  • 6.3.6 Uninstalling a Language Pack With a "2" Designation Causes an Error
  • 6.3.7 Simple Mode Password File Not Converted During Upgrade
  • 6.3.8 Unnecessary Message Asks for SDK Migration Bundles During Upgrade
  • 6.3.9 Unable to Locate Bundles Needed for COREid 6.x Upgrades
  • 6.3.10 Problem with Automatic Directory Updates During Identity Server or Policy Manager Installation
  • 6.3.11 Challenge Parameter Rows Discarded During the Access Manager Upgrade
  • 6.3.12 No Translation Support for the SNMP Agent Installshield
  • 6.3.13 Installation of Identity Server 10.1.4.0.1 With Sun Java Directory Server 6.0
• 6.4 Removal and Rollback Issues and Workarounds
  • 6.4.1 Removing Language Packs
  • 6.4.2 Removing the Default Administrator Language
  • 6.4.3 Rollback Issues After Upgrading to Oracle Access Manager 10g (10.1.4.0.1)
    • 6.4.3.1 Halting On-the-fly User Data Migration Phase 1
    • 6.4.3.2 Halting On-the-fly Migration of User Data: Phase 2
    • 6.4.3.3 Restarting On-the-fly User Data Migration
• 6.5 Access System Issues and Workarounds
  • 6.5.1 Disabling the User Cache for the Access Server
  • 6.5.2 WebGate Diagnostics URL Incorrectly Report the Access Server Is Down
  • 6.5.3 WebGate Is Unable to Connect to Its Associated Access Server
  • 6.5.4 An Authentication Action for Form-Based Authentication Redirects to a Non-Secure Page
  • 6.5.5 Access Server Memory Usage Rises After Configuring a Directory Server Profile
  • 6.5.6 Unable to Select Users in the Access Manager Using Simplified Chinese
  • 6.5.7 The Passthrough Challenge Parameter Does Not Work on a Domino Web Server
  • 6.5.8 Queue Parameter Not Taking Effect on Microsoft Windows 2003
  • 6.5.9 Steps for Integrating the Access System with OracleAS Single Sign-On 10.1.2.0.2
  • 6.5.10 Return Type Parameters Are Case-Sensitive in This Release
  • 6.5.11 Single Sign-On with Oracle Identity Management Fails
  • 6.5.12 Policy Manager API Support Used Incorrectly in Help and Access System Console
• 6.6 Identity System Workarounds and Issues
  • 6.6.1 Identity System Deletes a User Entry When an RDN is Modified
  • 6.6.2 Auditing for the Identity System Ceases to Work
  • 6.6.3 Identity Server Crashes if It Cannot Find a Style Sheet
  • 6.6.4 WebPass Is Unable to Connect to Its Associated Identity Server
  • 6.6.5 Memory Usage Rises for an Identity Server After Configuring a Directory Server Profile
  • 6.6.6 Errors Are Found in the HTTP Logs After Setting Up the Identity System
  • 6.6.7 Reports With Non-ASCII Characters Are Not Imported Correctly in Excel
  • 6.6.8 Translation of Tab Names May be Incomplete
  • 6.6.9 Non-ASCII Values for Certain Display Types Are Corrupted in the Identity System Console
  • 6.6.10 Data Is Lost When Saving an Object Profile in Org. Manager
  • 6.6.11 Incorrect Path Provided to the UDDI Files
  • 6.6.12 Incorrect Path Setting for Running Sample WSDL Code
  • 6.6.13 User Creation Might Fail When You Have Multi-byte Characters in the Password
  • 6.6.14 Modifying Challenge and Response Phrases for Lost Password Management from a Panel
• 6.7 Third-Party Integration Issues
  • 6.7.1 Users Receive Errors When Accessing Weblogic Resources
  • 6.7.2 The Deploy Link on the WebLogic Console Does Not Respond to Users Without a Role
  • 6.7.3 No Error Is Displayed When You Create a WebLogic Group that Already Exists
  • 6.7.4 Double-Byte Language Packs Do Not Work with the WebLogic SSPI Connector
  • 6.7.5 Integrating with Oracle Application Server Single Sign-On
  • 6.7.6 File Needed for Registrytester Not Bundled with IBM WebSphere Application Server 6.1
• 6.8 Directory Issues
  • 6.8.1 Error "There Is No Profile Configured for this Kind of Object"
  • 6.8.2 Issues With the Display of Messages in Some Languages
  • 6.8.3 Support for eDirectory 8.7.3
• 6.9 Documentation Issues
  • 6.9.1 Reference to Oracle Internet Directory Is Needed in Installation Preparation Checklist
  • 6.9.2 Error in Environment Variable Setting for WebSphere Integration
  • 6.9.3 Help Mentions WebGateStatic.lst But No Such File Exists
  • 6.9.4 The obEnableCredentialCache Credential Mapping Parameter Is Misspelled
  • 6.9.5 Warning Regarding Retrieving Authorization Data From an External Source
  • 6.9.6 Active Directory MaxPageSize Parameter Stated as PageSize Parameter
  • 6.9.7 Missing Parameter in globalparams.xml Documentation
  • 6.9.8 Incorrect obver Attribute Value Stated in Documentation
  • 6.9.9 Changes in System Behavior for obVer Missing in Manuals
  • 6.9.10 Items Needed for WebLogic 9.2 Application Server Certification
  • 6.9.11 Corrected Default Path Names in Oracle Access Manager Installation Guide
  • 6.9.12 OIS and Access Server Service Start is Automatic by Default
  • 6.9.13 Certificate Utility Flags Incorrect for Oracle Virtual Directory SSL Listener
  • 6.9.14 Tuning Oracle Internet Directory for Oracle Access Manager
  • 6.9.15 Obtaining/Updating Sample Adapter and Mapping Templates for Oracle Virtual Directory
  • 6.9.16 Typographical Error in the Solution for "The Login Form Appears Repeatedly"
  • 6.9.17 Added Required Database User Privileges to Upload Schema in Oracle Access Manager Configuration Manager
  • 6.9.18 Added Audit File Renaming Steps to Oracle Access Manager Upgrade Guide
  • 6.9.19 Corrected Path Details for Oracle Virtual Directory Schema Files
  • 6.9.20 Corrected LDAPModify Syntax for Oracle Virtual Directory
  • 6.9.21 Added SSL Requirements When Upgrading Schema and Data with Master Access Manager
  • 6.9.22 Corrected Path Names for Schema Index Files in Oracle Access Manager Upgrade Guide
  • 6.9.23 Corrected Environment URL in Oracle Access Manager Configuration Manager Installation and Administration Guide
  • 6.9.24 Missing Challenge Parameter "realmunique:yes"
  • 6.9.25 Installation Guide Offers Misleading Instructions for COREid Web Component on SELinux
  • 6.9.26 Misleading Title for Enabling Client Cert on IIS in Oracle Access Manager Installation Guide
  • 6.9.27 oblixCoreidServerDown has the Same Description as oblixCoreidServerFailure
  • 6.9.28 Syntax Correction in Oracle Access Manager Customization Guide
  • 6.9.29 Clarification of unique_value_attrs in ldapreferentialintegrityparams.xml
  • 6.9.30 Clarification on Reconfiguring COREid Server and WebPass
  • 6.9.31 Updating Novell eDirectory Schema Details
  • 6.9.32 Clarification in WebLogic Chapter of Oracle Access Manager Integration Guide
  • 6.9.33 Policy Manager API Support Should Read Access Management Service
  • 6.9.34 Invalid URL Patterns in Policy

7 Oracle Application Server Single Sign-On

• 7.1 Installation, Installation and Upgrade Issues
  • 7.1.1 Directory Considerations During Installation
  • 7.1.2 Directory Considerations After Installation
  • 7.1.3 Identity Management Grid Control Considerations During Uninstallation
• 7.2 General Issues
  • 7.2.1 Oracle Directory Manager Is no Longer Supported
  • 7.2.2 Deleting and Recreating a User Causes an Error When Accessing an External Application
  • 7.2.3 You Must Change the Value for the ORCLDASURLBASE Attribute in Oracle Internet Directory After Enabling SSL
  • 7.2.4 Clarification Needed for Implementing the IPASAuthInterface.java Package
  • 7.2.5 Multiple Single Sign-On Servers Cannot Share a Global User Inactivity Timeout
  • 7.2.6 A "Host Unavailable" Entry Appears on Non-English Monitoring Pages
  • 7.2.7 Dynamic Global Logout Directives Must Pass the String "Oracle SSO"
  • 7.2.8 Multilevel Authentication Configuration May or May Not Require a Port Number
  • 7.2.9 Configuring mod_osso with Virtual Hosts on Windows
  • 7.2.10 Configuring the Single Sign-On Server for Multiple Realms on Windows
• 7.3 Documentation Errata
  • 7.3.1 Incomplete Information in "Developing Applications for Single Sign-On" Chapter of Oracle Identity Management Application Developer's Guide

8 Oracle Identity Federation

• 8.1 General Issues and Workarounds
  • 8.1.1 Credential Re-entry When Accessing a SiteMinder Protected Resource
  • 8.1.2 Reauthentication after Session Timeout with OracleAS Single Sign-On and SAML 1.x or WS-Federation
  • 8.1.3 Attribute Sharing with the Microsoft Internet Information Server
  • 8.1.4 Redirection Loops with Oracle Access Manager
  • 8.1.5 Truncated Text in Japanese Version of Oracle Universal Installer
  • 8.1.6 Unused Assertion Profile With Invalid Attribute Mapping Can Cause SSO Failure
  • 8.1.7 Signed SAML 1.0 Assertions Can Cause SSO Failures
  • 8.1.8 Encrypting Network Connections
  • 8.1.9 Spurious Certificate Verification Failure in Debug Log
  • 8.1.10 Forced Reauthentication Not Supported with OracleAS Single Sign-On
• 8.2 Configuration Issues and Workarounds
  • 8.2.1 Administration Console Is Not Accessible After Changing Transient Data Store
  • 8.2.2 Signing SAML Response with Assertion
  • 8.2.3 Assertions Using SAML 1.x POST Method Fail in Japanese Locale
  • 8.2.4 Using RDBMS as a User Data Store with a Login column ID of type CHAR
  • 8.2.5 Some Peer Providers Are Not Displayed in Administration Console
  • 8.2.6 SAML 2.0 Metadata AttributeRequesterDescriptor Not Supported
  • 8.2.7 Problems Disabling Protocol Profiles in Administration Console
  • 8.2.8 Metadata Service URLs With Query Parameters Not Supported
• 8.3 Documentation Errata
  • 8.3.1 Incorrect Header in Oracle Identity Federation Online Help
  • 8.3.2 Usage of Command-line Configuration Assistants
  • 8.3.3 Enhanced Description of Provider Configuration

9 Oracle Security Developer Tools

• 9.1 General Issues and Workarounds
  • 9.1.1 Oracle XML Security Does Not Handle the InclusiveNamespaces Tag

10 Oracle Internet Directory

• 10.1 General Issues and Workarounds
  • 10.1.1 Perform Full Database Backup After Administrative Changes to Oracle Internet Directory
  • 10.1.2 Comment Out ACL Attributes Not Defined in the Schema
  • 10.1.3 Specify DN of the DIT When Dumping Directory Entries for an Advanced Replication Agreement
  • 10.1.4 Bounce OIDMON if it Fails to Respond to OIDCTL
• 10.2 Configuration Issues and Workarounds
  • 10.2.1 Add Local Classes to $CLASSPATH When Using a Java Plug-In
  • 10.2.2 Set Computer Domain Name
  • 10.2.3 Set Language Before Using bulkload
• 10.3 Documentation Errata
  • 10.3.1 Bad Links in Online Help Pages
  • 10.3.2 Missing Line Break in sqlplus Command
  • 10.3.3 Errors in oracle.ldap.util.Subscriber.createUser() Documentation
  • 10.3.4 Missing Example: How to Decode a Mime-Encoded Header Set by mod_sso
  • 10.3.5 Error in Identity Management Grid Control Plug-in Context-Sensitive Help
  • 10.3.6 Missing Note: The labeledURI Attribute host:port is for Syntax Purposes Only
  • 10.3.7 Missing Example: Listing All the Attributes in the Directory by Using ldapsearch
  • 10.3.8 Incorrect Environment Variables in Plug-in Debugging Examples
  • 10.3.9 Figure Errors in Replication Concepts Chapter
  • 10.3.10 Bad ldifwrite Parameter in Backup Chapter
  • 10.3.11 Error in Sample Code for Java Plug-ins
  • 10.3.12 Obsolete Step in SSL Configuration Procedure
  • 10.3.13 Errors in Oracle Directory Manager Help and in Appendix A of the Oracle Internet Directory Administrator's Guide
  • 10.3.14 No Maximum Value Documented for pwdGraceLoginLimit
  • 10.3.15 Setting orcldataprivacymode to 1 Prevents OC4J_SECURITY from Starting

11 Oracle Virtual Directory

• 11.1 General Issues and Workarounds
• 11.2 Bug Fixes

12 Oracle Application Server Certificate Authority

• 12.1 Documentation Errata
  • 12.1.1 Java Classes for Custom Policy Plug-in Must Use JDK 1.4.2
  • 12.1.2 Incorrect Class Name in Custom Policy Example

13 Oracle Delegated Administration Services

• 13.1 General Issues and Workarounds
  • 13.1.1 Installation Process Does Not Enable SSL for Oracle Delegated Administration Services
  • 13.1.2 Using Single Wildcard Characters to Search for Entries Fails to Return Results
  • 13.1.3 Oracle Internet Directory Self-Service Console Link Does Not Work in Oracle Identity Manager Grid Control Plug-in
• 13.2 Administration Issues and Workarounds
  • 13.2.1 Disabling Password Change and Reset Functionality
  • 13.2.2 Resetting Oracle Application Server Single Sign-On Passwords Redirects Users to Oracle Delegated Administration Services Home Page
• 13.3 Online Help Issues and Workarounds
  • 13.3.1 No Help Topic When Managing Applications
  • 13.3.2 The ou Attribute is Not Allowed In User Entries
• 13.4 Documentation Issues
  • 13.4.1 Session Context is Not Clearly Documented
  • 13.4.2 Special Characters for User ID Needs Updating
  • 13.4.3 Clarification: Old_password Not Being Passed to Custom Pre_modify Password Policy Plugin

14 Oracle Directory Integration Platform

• 14.1 Configuration Issues and Workarounds
  • 14.1.1 Configuration Requirements for Synchronizations with Domain-Level Mappings
  • 14.1.2 Directory Integration Assistant Throws "LDAP: error code 2 - Decoding Error" When Uploading an Additional Configuration Information File
  • 14.1.3 Reconfiguring the Oracle Password Filter for Microsoft Active Directory Generates Errors
  • 14.1.4 In a High Availability Environment Using Multimaster Replication, Provisioning Events May not Be Propagated or May Be Duplicated
  • 14.1.5 Manual Step Required After Configuring Oracle Directory Integration Platform from Oracle Enterprise Manager
  • 14.1.6 Securing the Windows Registry Before Installing the Oracle Password Filter for Microsoft Active Directory
  • 14.1.7 DIP_GEN_CREATECHG_EXCEPTION Raised When Source Directory Contains More than 10 Attributes to be Synchronized
  • 14.1.8 Deletions Not Synchronized if a Domain Editing Rule Exists
  • 14.1.9 Synchronizing modrdn from Sun Java System Directory Throws a Stack Trace
  • 14.1.10 The SearchDeltaSize Parameter is Ignored During Synchronization
  • 14.1.11 Add Operations Not Synchronized and Synchronization Fails with an "objcls is NULL" Message in the Trace File
• 14.2 Administration Issues and Workarounds
  • 14.2.1 Default Mapping Rule Can Be Simplified in Single-Domain Microsoft Active Directory Deployments
  • 14.2.2 Oracle Directory Integration Platform Not Sending Provisioning Events Due to Purged Change Log Entries
  • 14.2.3 Oracle Internet Directory Field Unavailable in Oracle Identity Manager Grid Control Plug-in
  • 14.2.4 Synchronizion from Novell eDirectory or OpenLDAP Fails When the Oracle Internet Directory Container is Within the Default Realm