{"id":128,"date":"2018-02-02T09:53:41","date_gmt":"2018-02-02T08:53:41","guid":{"rendered":"http:\/\/my-tidbits.wpress.deschooneschooier.com\/?p=128"},"modified":"2018-02-02T09:53:41","modified_gmt":"2018-02-02T08:53:41","slug":"user-group-cannot-added-sbconsole-created-wls-console","status":"publish","type":"post","link":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/2018\/02\/02\/user-group-cannot-added-sbconsole-created-wls-console\/","title":{"rendered":"Fout: Error: User and Group cannot be added in sbconsole after created in WLS Console"},"content":{"rendered":"

<\/p>\n

Bug 22526026<\/h4>\n

For this bug, one of our developers found, We installed the patch on our OSB server 12.2.1.0. This made sure that our developer could go on developing his OSB service. We wanted to know if this bug is fixed in the next release of the Oracle SOA Suite 12.2.1.3.0, that was allready released. So I created a simple OSB service, with a lot of hassle as I blogged in this part<\/a>,<\/p>\n

I discovered that Oracle released an Virtualbox with that newer release so I downloaded this one. It was shipped with a complete Desktop and SOA QS 12.2.1.3.0 and the complete server install. This is really cewl, because some of the features are not available on the integrated SOA QS Server. Think about BAM and MFT and other nifty stuff you want to play around with.<\/p>\n

So for my test case I found out that after starting the Adminserver and the OSB Server, I also had to start the SOA Server for the OWSM policies.<\/p>\n

Recreating the situation<\/h4>\n

Login at the console<\/p>\n

\"\"<\/a>
console login screen<\/figcaption><\/figure>\n

Click on the Security Realms link on the left<\/p>\n

\"\"<\/a>
Security Realms<\/figcaption><\/figure>\n

Continue to click on the MyRealm link<\/p>\n

\"\"<\/a>
My Realm<\/figcaption><\/figure>\n

And select the tab “Users and Groups”<\/p>\n

\"\"<\/a>
Users and Groups tab<\/figcaption><\/figure>\n

Select the tab “Groups” and click on button “New” to go to the Group information screen<\/p>\n

\"\"<\/a>
New Group<\/figcaption><\/figure>\n

Some information to identity where this group is for and “OK” to create the group:<\/p>\n

\"\"<\/a>
Create Group<\/figcaption><\/figure>\n

After that select the tab “Users” and click on the “New” button to create a new user:<\/p>\n

\"\"<\/a>
New User<\/figcaption><\/figure>\n

Insert information about this user:<\/p>\n

\"\"<\/a>
Bug User<\/figcaption><\/figure>\n

After creating this user we have to make sure that the user is in the BugTest group:<\/p>\n

\"\"<\/a>
Click on the created user<\/figcaption><\/figure>\n

 <\/p>\n

\"\"<\/a>
Select tab groups and move the BugTest group to the right<\/figcaption><\/figure>\n

I allready created a simple HelloWorld Service that uses an extra service for the real greeting.<\/p>\n

So lets try to add a policy to the Proxy service and after that we add the group to the policy and see if the same error occurs.<\/p>\n

To get to this point we have to login at the sbconsole:<\/p>\n

\"\"<\/a>
SB Console login<\/figcaption><\/figure>\n

Go to the proxy you would like to add the policy to:<\/p>\n

\"\"<\/a>
Proxy<\/figcaption><\/figure>\n

Click on the “Edit” button in the upper left corner:<\/p>\n

\"\"<\/a>
edit<\/figcaption><\/figure>\n

Go to the Policies part:<\/p>\n

\"\"<\/a>
Policies<\/figcaption><\/figure>\n

 <\/p>\n

\"\"<\/a>
select OWSM<\/figcaption><\/figure>\n

Add the wss username policy by clicking the paperclip:<\/p>\n

 <\/p>\n

\"\"
click the Attach Policies Paperclip<\/figcaption><\/figure>\n

Now you have to search for the desired policy and while selected, click on the attach button:<\/p>\n

\"\"<\/a>
steps to attach the policy<\/figcaption><\/figure>\n

After clicking on OK, you can leave the default override screen and remember to click on the save button:<\/p>\n

\"\"<\/a>
save<\/figcaption><\/figure>\n

After that we have to add our desired security settings (our bug!):<\/p>\n

\"\"<\/a>
Security Settings<\/figcaption><\/figure>\n

Now in this screen we can add users or groups that have access.<\/p>\n

So normally the selected username wss policy grants all weblogic users to call the webservice.<\/p>\n

\"\"<\/a>
Message Level Security<\/figcaption><\/figure>\n

Now we want to override this default and make sure only selected users\/groups can call this webservice.<\/p>\n

To do this click on the Service name<\/strong> in the\u00a0Message Access Control<\/strong>\u00a0part<\/p>\n

\"\"<\/a><\/p>\n

select Groups in the dropdown box and click on\u00a0Next<\/strong><\/p>\n

\"\"<\/a>
Select the groups part<\/figcaption><\/figure>\n

You have to type the Group Name(that’s why you shouldn’t use this policy for autorisation..really!) and make no mistakes. This part will not check if the group or user exists!<\/p>\n

So in my example I have to add the Group:\u00a0BugTest<\/strong>.\"\"<\/a><\/p>\n

and Oh My, there is a bug:<\/strong><\/p>\n

\"\"<\/a><\/p>\n

Patch 22526026<\/h5>\n

So lets get patching. Reading the readme.txt and I saw some stuff that was different on my install: the $ORACLE_HOME is pointing to a DB install directory and not my FMW. Using a different Java Location, because there was no JDK\/JRE installed in my FMW home. The default: \/usr\/java\/default is used for this installation.<\/p>\n

So altered my ORACLE_HOME into:<\/p>\n

export ORACLE_HOME=\/u01\/app\/oracle\/fmw\/12.2<\/p><\/blockquote>\n

so lets check the OPatch lsinventory:<\/p>\n

$ opatch lsinventory<\/p><\/blockquote>\n

\"\"<\/a><\/p>\n

Now I know that this could lead to some problems, because there are a couple of One-off patches installed:<\/p>\n

26355633
\n26287183
\n26261906
\n26051289<\/p>\n

So lets try and install our patch. I didn’t stop my servers, just to see if this can work. It states in the Readme that it is a rolling patch. It will not work if you don’t have a FMW_ROLLING_ORACLE_HOME.<\/p>\n

For more information, consult the My Oracle Support MOS Note: 1942159.1<\/p>\n

opatch version number is:<\/p>\n

13.9<\/p>\n

go to the directory where the opatch is and apply opatch:<\/p>\n

\"\"<\/a><\/p>\n

The installer indeed states that the servers should be stopped.<\/p>","protected":false},"excerpt":{"rendered":"

Bug 22526026 For this bug, one of our developers found, We installed the patch on our OSB server 12.2.1.0. This made sure that our developer could go on developing his OSB service. We wanted to know if this bug is fixed in the next release of the Oracle SOA Suite 12.2.1.3.0, that was allready released. […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[9,13],"tags":[21,22,24],"_links":{"self":[{"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/posts\/128"}],"collection":[{"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/comments?post=128"}],"version-history":[{"count":0,"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/posts\/128\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/media?parent=128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/categories?post=128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.studiostuiterbal.com\/mytidbits\/en\/wp-json\/wp\/v2\/tags?post=128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}