 |
 |
**************************************************************
* Description: FMW installation with OID 12.2.1.3.0 migration
* Date: 05:32 PM EST, 05/06/2019
**************************************************************
<1> Project Instruction:
|
|__ o. The project includes building new 12c environment on 3 AWS EC2 instances as below, and migrates data from old 11g infrastructure.
<2> Basic Knowledge:
|
|__ o. WebLogic Domain: is a logically related group of Java components. A domain includes a special Oracle WebLogic Server instance called the Administration Server,
| which is the central point from at which configuration and management of all resources in the domain occur.
|
|__ o. Administration Server: operates as the central control entity for the configuration of the entire domain.
| It maintains the domain's configuration documents and distributes changes in the configuration documents to Managed Servers.
| The Administration Server serves as a central location from which to monitor all resources in a domain.
| Each domain must have one server instance that acts as the Administration Server.
| [ https://docs.oracle.com/cd/E21764_01/core.1111/e10103/terminology.htm#ASCON125 ]
|
|__ o. Managed Server: are Java Virtual Machine (JVM) processes, hosting business applications, application components, Web services, and their associated resources.
| To optimize performance, Managed Servers maintain a read-only copy of the domain's configuration document.
| When a Managed Server starts up, it connects to the domain's Administration Server to synchronize its configuration document with the Admin Server maintains.
|
|__ o. Node Manager: is a Java utility that runs as a separate process from Oracle WebLogic Server,
| and enables you to perform common operations for a Managed Server, regardless of its location with respect to its Administration Server.
| if you run Node Manager on a computer that hosts Managed Servers, you can start/stop Managed Servers remotely using the FMW Control Console or the command line.
| Node Manager can also automatically restart a Managed Server after an unexpected failure.
|
|__ o. MIDDLEWARE_HOME, ORACLE_HOME, ORACLE_COMMON_HOME, DOMAIN_HOME.
|
|__ o. Basic Concepts Reference - https://docs.oracle.com/cd/E15586_01/core.1111/e10105/concepts.htm
<3> Steps of building "APP server":
|
|__ o. Pre-work for Fursion Middeware Infrastructure 12.2.1.3.0 installation.
|
|__ o. Fursion Middeware Infrastructure 12.2.1.3.0 installation.
|
|__ o. Oracle Forms & Reports 12.2.1.3.0 installation.
|
|__ o. Install DB software on database server, and then create Repository.
|
|__ o. Config Forms & Reports, such as creating domain.
<4> Steps of building "Database server":
|
|__ o. Pre-work for Database 12.2.0.1 RDBMS software installation.
|
|__ o. Creating databases and listener.
<5> Steps of building "OID server":
|
|__ o. Pre-work for Fursion Middeware Infrastructure 12.2.1.3.0 installation.
|
|__ o. Fursion Middeware Infrastructure 12.2.1.3.0 installation.
|
|__ o. Oracle Internet Directory 12.2.1.3.0 installation.
|
|__ o. Config Internet Directory.
<6> Best practice of MIDDLEWARE_HOME, ORACLE_HOME, DOMAIN_HOME, APPLICATION_HOME directory structure for installation:
|
|__ o. DOMAIN_HOME: contains domain-related data, including the scripts to start and stop Node Manager, the Administration Server, and Managed Servers.
|
|__ o. APPLICATION_HOME: contains your custom application data.
|
|__ o. ORACLE_HOME: contains all software binary and libraries.
|
|__ o. Best practice is installing above three folders splitely, so in the future, during upgrade/patching, only ORACLE_HOME will be impacted, while keep user configuration same.
|
|__ o. For example, during installation, create directory structure as below on installation wizard:
|
|__ o. ORACLE_HOME ....... /u01/app/oracle/middleware/products/oracle_home
|
|__ o. DOMAIN_HOME ....... /u01/app/oracle/middleware/config/user_projects/domains/emeralit [Installation wizard will treate "emeralit" in the last slash section as domain name]
|
|__ o. APPLICATION_HOME .. /u01/app/oracle/middleware/config/user_projects/applications/emeralit
|
|__ o. APPLICATION_HOME = APPLICATION_LOCATION + DOMAIN_NAME
| DOMAIN_HOME = DOMAIN_LOCATION + DOMAIN_NAME
|
|__ o. CAUTION: FMW Infrastructure binary + Oracle Forms & Reports have to be installed within same ORACLE_HOME, otherwise wizard would throw error "No dependency feature set".
|
|__ o. Folder structure:
|
|__ /u01
|
|__ software
|
|__ app
|
|__ oracle
|
|__ middleware
|
|__ products
| |
| |__ oracle_home [ Fusion Middeware Infrastructure binary + Oracle Forms & Reports binary]
| |
| |__ oracle_common [ contains binary/library files required for WebLogic Server, Enterprise Manager FMW Control and Java Required Files (JRF) ]
| | |
| | |__ bin [ rcu ==> creating repository || config.sh ==> config domain and Forms & Reports ]
| |
| |__ wlserver
| |
| |__ OPatch
| |
| |__ ...
|
|__ config
|
|__ user_projects
|
|__ domains
| |
| |__ emeralit [ contains domain-related data, such as scripts to start and stop Node Manager/Administration Server/Managed Servers.]
|
|__ applications
|
|__ emeralit [ contains your custom application data ]
==============================================================================
<7> Pre-work on all 3 servers:
|
|__ o. Adding swap space [File for this case instead of disk]:
|
| $ dd if=/dev/xvdb1 of=/u01/swapfile bs=1024 count=5242880
| $ mkswap /u01/swapfile
| $ swapon /u01/swapfile
| $ vi /etc/fstab - /u01/swapfile swap swap defaults 0 0
|
|
|__ o. Install JAVA [ Down JDK 8U201R to /usr/java ]:
|
| $ rpm -ivh jdk-8u201-linux-x64.rpm
|
|
|__ o. Modify following parameter to enable X server:
|
| $ vi /etc/ssh/ssh_config ==> Switch the value as such “X11Forward yes”
|
|
|__ o. Create user and group:
|
| $ groupadd -g 54321 oinstall
| $ groupadd -g 54322 dba
| $ groupadd -g 54323 oper
| $ useradd -u 54321 -g oinstall -G dba,oper oracle
| $ passwd oracle
| $ chown -R oracle:oinstall /u01
| $ chown -R oracle:oinstall /u02
| $ chown -R oracle:oinstall /u03
| $ chmod -R 775 /u01
| $ chmod -R 775 /u02
| $ chmod -R 775 /u03
|
|
|__ o. Configure system kernel:
|
| $ vi /etc/sysctl.conf
|
| fs.file-max = 6815744
| kernel.sem = 250 32000 100 128
| kernel.shmmni = 4096
| kernel.shmall = 1073741824
| kernel.shmmax = 4398046511104
| kernel.panic_on_oops = 1
| net.core.rmem_default = 262144
| net.core.rmem_max = 4194304
| net.core.wmem_default = 262144
| net.core.wmem_max = 1048576
| net.ipv4.conf.all.rp_filter = 2
| net.ipv4.conf.default.rp_filter = 2
| fs.aio-max-nr = 1048576
| net.ipv4.ip_local_port_range = 9000 65500
|
| $ /sbin/sysctl -p [Active the parameter]
|
|
|__ o. USe Xming for GUI wizard on AWS instance:
|
| >> /etc/ssh/ssh_config => X11Forward yes
| >> Putty: X11, X display location ":0.0"
| >> Login as "ec2-user"
| >> export DISPLAY=localhost:10.0
| >> cp /home/ec2-user/.Xauthy /home/oracle [needs to be copied by root due to permission issue]
| >> Start the GUI by "oracle" user
| >> .Xauthy file contains the key for Xming/Xserver, as long as that file got created under /home/user manually, it will be updated with the key when user logon.
|
|
|__ o. Unzip the Oracle Forms and Reports installation package:
|
| >> unzip folder name: unzip intall_package_1, unzip install_package_2, unzip install_package_2_sub in the same folder
| >> After unzipping v886454-01_2of2.zip, a zip file named fmw_12.2.1.3.0_fr_linux64-2.zip shows up. Please continue unzipping this file.
|
|
|__ o. Enable Repository and Install Packages:
yum-config-manager --enable rhui-REGION-rhel-server-extras rhui-REGION-rhel-server-optional
yum install -y binutils
yum install -y compat-libstdc++-33
yum install -y compat-libstdc++-33.i686
yum install -y gcc
yum install -y gcc-c++
yum install -y glibc
yum install -y glibc.i686
yum install -y glibc-devel
yum install -y glibc-devel.i686
yum install -y ksh
yum install -y libgcc
yum install -y libgcc.i686
yum install -y libstdc++
yum install -y libstdc++.i686
yum install -y libstdc++-devel
yum install -y libstdc++-devel.i686
yum install -y libaio
yum install -y libaio.i686
yum install -y libaio-devel
yum install -y libaio-devel.i686
yum install -y libXext
yum install -y libXext.i686
yum install -y libXtst
yum install -y libXtst.i686
yum install -y libX11
yum install -y libX11.i686
yum install -y libXau
yum install -y libXau.i686
yum install -y libxcb
yum install -y libxcb.i686
yum install -y libXi
yum install -y libXi.i686
yum install -y make
yum install -y sysstat
yum install -y unixODBC
yum install -y unixODBC-devel
yum install -y zlib-devel
yum install -y zlib-devel.i686
yum install -y compat-libcap1-1.10
yum install -y smartmontools
yum install -y ocfs2-tools
yum install -y motif
yum install -y motif-devel
yum install -y numactl
yum install -y numactl-devel
yum install -y xorg-x11-apps
yum install -y xorg-x11-xauth
yum install -y zip
yum install -y unzip
yum install -y psmisc
<8> Installing Fusion Middeware Infrastructure on Both App and OID Server:
|
|__ o. After unzipping the installer package, launch the wizard by following command.
<9> Installing Oracle Forms and Reports on App Server:
<10> Installing Oracle Internet Directory on OID Server:
o. If you do not require Oracle Fusion Middleware (FMW) Infrastructure and just wish to install Oracle Internet Directory, then it is referred as Standalone Mode.
o. If your require Oracle Fusion Middleware Infrastructure and Oracle Internet Directory, then it is referred as Collocated Mode.
o. Reference: Doc ID 2304169.1 - What Does OID 12c Standalone Mode Installation and Collocated Mode Installation Mean?
<11> Configure Repository for Oracle Forms & Reports, and Oracle Internet Directory:
|
|__ o. Assume you already installed Oracle 12.2.0.1 database, and create one database ready for connection.
<12-1> Create Domain for Oracle Forms & Reports:
<12-2> Create Domain for Oracle Forms & Reports - Machine Provision for Reports:
|
|__ o. After domain creation completed, as different from Oracle Forms, Oracle Reports Service needs to be provisioned accoringly.
|
|__ o. Following are the commands to create Report Tool needed physical files and Report Server instance:
|
| connect("weblogic","welcome1", "localhost:7001")
| createReportsToolsInstance(instanceName='ReportsTools', machine='AdminServerMachine')
| createReportsServerInstance(instanceName='ReportServer', machine='AdminServerMachine')
|
|__ o. Reports Service includes: Report Servlet and Report Server.
|
|__ o. Reports Servlet(rwservlet): a component of Reports Services that runs inside Web server's servlet engine, translates/delivers infor between HTTP and Reports Server.
|
|__ o. Reporst Server(rwserver): which processes client requests, including ushering them through its various services.
| A common error is that REP-51002 shows up each time after environment up, means Report Servlet was up automatically since it is embedded within Sunflower Managed Server.
| But when Reports Servlet received HTTP request to run a report, and tries to hand the request over to Reports Server, it found no Report Server running.
| On Enterprise Manager, if you click on Sunflower, will see "reports(12.2.1)" is listed as 1 of 8 "Deployments", marked as "Enterprise Application".
| It is rwservlet, not rwserver.
|
|__ o. Report Servlet would be started automatically along with Managed Server [WebLogic].
Report Server, however, has to be started individually by Web Access Command by URL or by Node Manager.
$ $DOMAIN_HOME/bin/startComponent.sh rep_snflwr_05000000_pmisn
$ $DOMAIN_HOME/bin/stopComponent.sh rep_snflwr_05000000_pmisn
<13> Create Domain for Oracle Internet Directory:
|
|__ o. Since majority steps of domain creation is samiliar between OFR and OID, so only different steps are being attached:
o. If any change that needs to be applied on the existing domain, this same GUI can be used to revise current configuration.
<14> Setup Environment Variable on OFR and OID servers:
|
|__ o. Within /home/oracle/.bash_profile, added following variables:
#=== Config middleware and database base, in case of both softwares are installed on same server ===#
export ORACLE_BASE=/u01/app/oracle
export ORAFMW_BASE=/u01/app/oracle/middleware
export ORARDB_BASE=/u01/app/oracle/database
#=== Config middleware and database home, in case of both softwares are installed on same server ===#
export ORAFMW_HOME=/u01/app/oracle/middleware/products/oracle_home
export ORARDB_HOME=/u01/app/oracle/database/products/db_home1
export ORACLE_HOME=/u01/app/oracle/database/products/db_home1
export DOMAIN_HOME=/u01/app/oracle/middleware/config/usr_projects/domains/emeralit
export JAVA_HOME=/usr/java/jdk1.8.0_201-amd64
export LD_LIBRARY_PATH=/usr/lib;$ORAFMW_HOME/lib
export CLASSPATH=$ORAFMW_HOME/jlib
#=== For the case OFR/OID and Oracle RDBMS are installed on same server, ORACLE_HOME should be assigned to RDBMS home, and addressed in prior to ORAFMW_HOME ===#
#=== Becase of OFM also contains sqlplus utility, so when issuing the command may come across connection error ===#
export PATH=$ORACLE_HOME/bin:$ORAFMW_HOME/bin:$DOMAIN_HOME/bin:$JAVA_HOME/bin:$PATH
<15> Store and Encrypt Credential to Start WebLogic Domain without Password:
|
|__ o. When starting domain by script, the command had to be executed with nohup to run in background.
| Otherwise when OS/PuTTY session got terminated, domain Java process will be stopped simultineously.
| But, when bringing up WebLogic domain, admin password needs to be typed in. So, it will gves problem with nohup.
|
|__ o. Follow steps of storing and encrypting credential within boot.properties file to avoid typing password everytime:
|
|__ $ cd $DOMAIN_HOME/servers/AdminServer
|
|__ $ mkdir security
|
|__ $ cd security
|
|__ $ vi boot.properties
|
|__ o. Copy and revise follow username/password info accordingly into boot.properties.
Next time, when Domain starts, process will read and encryt these info automatically:
username=weblogic_admin
password=passwd123
<16> Starting WebLogic Domain and Servers:
|
|__ $ nohup $DOMAIN_HOME/bin/startNodeManager.sh > $DOMAIN_HOME/bin/startNodeManager.log &
|
|__ $ nohup $DOMAIN_HOME/bin/startWebLogic.sh > $DOMAIN_HOME/bin/startWebLogic.log &
|
|__ o. When WebLogic & Domain up, OEM and WebLogic console will be accessible by following URL:
|
|__ o. OEM ..................... http://emeralit.com:7001/em, https://emeralit.com:7002/em
|
|__ o. WebLogic Console ........ http://emeralit.com:7001/console, https://emeralit.com:7002/console
<17> If Repo Database Server IP Got Changed, Following Files Needs to be Re-configured:
|
|__ o. $DOMAIN_HOME/config/fmwconfig/jps-config-jse.xml:
| |
| |__ o. <property name="jdbc.url" value="jdbc:oracle:thin:@//154.82.212.153:1521/EMERALIT"/>
| <property name="audit.loader.jdbc.string" value="jdbc:oracle:thin:@//154.82.212.153:1521/EMERALIT"/>
|
|
|__ o. $DOMAIN_HOME/config/fmwconfig/jps-config.xml:
| |
| |__ o. <property name="jdbc.url" value="jdbc:oracle:thin:@//154.82.212.153:1521/EMERALIT"/>
|
|
|__ o. $DOMAIN_HOME/config/jdbc/WLSSchemaDataSource-jdbc.xml
$DOMAIN_HOME/config/jdbc/LocalSvcTblDataSource-jdbc.xml
$DOMAIN_HOME/config/jdbc/opss-datasource-jdbc.xml
$DOMAIN_HOME/config/jdbc/opss-auditview-jdbc.xml
$DOMAIN_HOME/config/jdbc/opss-audit-jdbc.xml
<18> Start Report Builder Wizard:
|
|__ o. Since Fusion Middeware 12c, Report Builder will be integrated with FMW software, instead of individual package needs to be installed:
|
|__ Wizard started by: $DOMAIN_HOME/reports/bin/rwbuilder.sh
<19> Setup Oracle Internet Directory Instance:
|
|__ o. OID instance initial setup:
[oracle@emeralit ~] $OID_HOME/oracle_common/common/bin/wlst.sh
Initializing WebLogic Scripting Tool (WLST) ...
Welcome to WebLogic Server Administration Scripting Shell
Type help() for help on available commands
wls:/offline> connect('weblogic_admin', 'weblogic_password', 't3://localhost:7001')
Connecting to t3://localhost:7001 with userid weblogic_fr ...
Successfully connected to Admin Server "AdminServer" that belongs to domain "emeralitp".
Warning: An insecure protocol was used to connect to the server.
To ensure on-the-wire security, the SSL port or Admin port should be used instead.
wls:/emeralitp/serverConfig/> oid_setup(orcladminPassword='wls_pwd', odsPassword='STB_PWD', realmDN='dc=emeralit,dc=com', host='emeralit.com', port=5901, sslPort=5902)
Location changed to edit custom tree. This is a writable tree with No root.
For more help, use help('editCustom')
Starting an edit session ...
Started edit session, be sure to save and activate your changes once you are done.
Saving all your changes ...
Saved all your changes successfully.
Activating all your changes, this may take a while ...
The edit lock associated with this edit session is released once the activation is completed.
Activation completed
Starting an edit session ...
Started edit session, be sure to save and activate your changes once you are done.
Saving all your changes ...
Saved all your changes successfully.
Activating all your changes, this may take a while ...
The edit lock associated with this edit session is released once the activation is completed.
Activation completed
Location changed to edit tree.
This is a writable tree with DomainMBean as the root.
To make changes you will need to start an edit session via startEdit().
For more help, use help('edit').
Starting an edit session ...
Started edit session, be sure to save and activate your changes once you are done.
[MBeanServerInvocationHandler]com.bea:Name=oidds,Type=JDBCSystemResource
Saving all your changes ...
Saved all your changes successfully.
Activating all your changes, this may take a while ...
The edit lock associated with this edit session is released once the activation is completed.
Activation completed
OID setup was successful.
odsPassword='STB_PWD', is used to connect to repository database, so the value of the password should be same as ODS user when domain was created on installation wizard.
Otherwise, error will come up - WLSTException: Error occured while performing invoke: OID setup failed. Error: "Incorrect DB password".
<20> Connect OID Instance via Directory Service Manager:
|
|__ o. Go to ODSM via URL http://emeralit.com:7001/odsm/faces/odsm.jspx
<21> Export Current OID Directory into .ldif Format, and Import into New OID:
|
|__ o. Bind OID server first to ensure connection can be initiated successful. Connection can be sent from remote server, not even on the same host with OID:
| |
| |__ $ ldapbind -h 10.104.7.21 -p 5901 -D "cn=orcladmin" -w admin_password
|
| Bind successful
|
|
|__ o. Export OID directory into .ldif file:
| |
| |__ $ ldapsearch -x -h oid.hostname.com -p 3060 -D "cn=orcladmin" -w orcl_password -b "cn=snflwr, cn=users, dc=hhs, dc=gov" "(objectclass=*)" "*" > /u01/export.ldif
|
|
|__ o. Import into .ldif file new directory:
| |
| |__ $ ldapadd -h oid.hostname.com -p 5901 -D "cn=orcladmin" -w orcl_password -f /u01/export.ldif
|
|
|__ o. Delete entry from directory:
|
|__ $ ladpdelete -h oid.hostname.com -p 5901 -D "cn=orcladmin" -w orcl_password "cn=username, cn=snflwr, cn=user, dc=gov"
<22-1> Issue During .ldif Import:
|
|__ o. Error "ladp_add: additional info: Parent entry not found in the directory":
|
|__ Solution: Create one CN on browser first before importing that CN node.
<22-2> Issue During .ldif Export:
|
|__ o. Error comes up when give "ldapsearch -h <hostname> -p 3060 -D "cn=orcladmin" -w <pwd> -b "dc=gov" "(objectclass=*)" "*" > /u01/export.ldif
|
| >> ladp_sasal_interactive_bind_s: Unknown authentication method (-6):
| >> additional info: SASL(-4): no mechanism available: No worthy mechs found
|
|
|__ o. Solution: ldapsearch -x -h <hostname> -p 3060 -D "cn=orcladmin" -w <pwd> -b "dc=gov" "(objectclass=*)" "*" > /u01/export.ldif
|
|
|__ o. Cause: This error message is commonly found when using the OpenLDAP ldapsearch, ldapmodify, ldapadd or other ldap command line utilities against non-OpenLDAP servers.
| OpenLDAP uses SASL (Simple Authentication and Security Layer) by default, while most other LDAP servers do not.
| LDAPSearch is based upon the OpenLDAP product, which defaults to using an authentication mechanism called Simple Authentication and Security Layer (SASL).
| Therefore, the LDAPSearch command was expecting to find a SASL-enabled server at the other end.
| If you are not interested in enabling SASL on the target LDAP server, you can use simple authentication by adding the -x command line option to the ldap commands.
|
|
|__ o. Reference:
|
|__ o. https://www.tech-recipes.com/rx/418/solving-ldap_sasl_interactive_bind_s-error-with-ldapsearch-or-ldapmodify/
|
|__ o. https://portal2portal.blogspot.com/2009/08/error-ldapsaslinteractivebinds-unknown.html
<22-3> Issue During OID Entry Creation:
|
|__ o. Error "An unresolvable error has occured. Please contact your administrator for more information" after browsing & choosing the "Parent of the entry":
|
|__ o. Solution: Type in the path manually as a work around to avoid this bug on OID 12c Enterprise Manager.
<22-4> Issue During OID Bind:
|
|__ o. Error "error while loading shared libraries: libnnz12.so: cannot open shared object file: No such file or directory"
|
|__ o. Solution: library location was not configured properly within PATH environment variable.
|
|__ $ export LD_LIBRARY_PATH=$ORACLE_DB_HOME/lib
export PATH=$LD_LIBRARY_PATH:$PATH
<22-5> Issue of Missing Schema's Attribute and ObjectClass during LDAP Importing:
|
|__ o. Error "ldap_add: Constraint Violation. Admin domain does not contain schema information for objectclass and attribute"
| "ldap_add: Attribute sfidentifier is not supported in schema"
|
|__ o. Solution: In Directory Service Manager console, go to schema, and add objectclass and attribute accordingly based on source setting, in prior of importing LDIF file.
<22-6> Issue of LDIF File Contains Authpasswords during LDAP Importing:
|
|__ o. Error "ldap_add: DSA is unwilling to perform. You cannot add entries containing authpasswords"
|
|__ o. Solution: open Notepad++ => highlight "authpasswords" => control+F to "Mark" tab to "mark all" => "Search" to "Bookmark" => "Remove markbooked lines".
<22-7> Issue of Object Existing" during LDAP Importing:
|
|__ o. Error "ldap_add: Object Existing"
|
|__ o. Solution: sometimes LDIF file contains top or higher level object definiation. So, the entry needs to be deleted from LDIF file first, such as the entry below.
cn=emeralit,cn=users,dc=fda,dc=gov
objectclass=top
objectclass=orclContainer
cn=emeralit
<22-8> Issue of OrclAdmin Account Locked:
|
|__ o. Error "OID orcladmin account got locked" due to login multiple times with incorrect password.
|
|__ o. Solution: Unlock the account by following command. "oiddb" is the default TNS name connecting to repository, and password would be the one of "orcladmin".
$ $DOMAIN_HOME/ldap/bin/oidpasswd connect=oiddb unlock_su_acct=true
OID DB user password:
OID super user account unlocked successfully.
<23> OHS Component Deployment and Instance Creation:
|
|__ o. Execute config.sh to start domain creation wizard, and confirm that "Oracle HTTP Server (Collocated)" selected.
|
|
|__ o. Use OEM to create OHS instance via "WebLogic Domain" => "Adminstration" => "OHS Instances" => "Create". But, needs to "Unlock & Edit" on WebLogic Console first:
| |
| |__ o. $OHS_INSTANCE_HOME=$DOMAIN_HOME/config/fmconfig/components/OHS/instances/ohs_snflwr
|
|
|__ o. Use WLST to create OHS instance, and verify on Enterprise Manager via "WebLogic Domain" => "Adminstration" => "OHS Instances":
|
|__ $ $ORACLE_HOME/oracle_common/common/bin/wlst.sh
Initializing WebLogic Scripting Tool (WLST) ...
Welcome to WebLogic Server Administration Scripting Shell
Type help() for help on available commands
wls:/offline> connect('weblogic', 'password', 't3://ofr.emeralit.com:7001')
Connecting to t3://fmwrepo.hhs.gov:7001 with userid weblogic_fr ...
Successfully connected to Admin Server "AdminServer" that belongs to domain "emeralitp".
Warning: An insecure protocol was used to connect to the server.
To ensure on-the-wire security, the SSL port or Admin port should be used instead.
wls:/emeralitp/serverConfig/> ohs_createInstance(instanceName='ohs', machine='AdminServerMachine')
Location changed to edit custom tree. This is a writable tree with No root.
For more help, use help('editCustom')
Starting an edit session ...
Started edit session, be sure to save and activate your changes once you are done.
Saving all your changes ...
Saved all your changes successfully.
Activating all your changes, this may take a while ...
The edit lock associated with this edit session is released once the activation is completed.
Activation completed
OHS instance "ohs" was successfully created.
wls:/emeralitp/serverConfig/> ohs_deleteInstance(instanceName='ohs_instance_name')
<24> Hiding Port Number from Application URL by OHS Configuration:
|
|__ o. Since Oracle Forms & Reports Managed Server was created with listening port 9010, after application deployment, the Forms & Reports will use that port in application URL.
Usually, as security consideration, the port could be hidden by configuring OHS/Apache file - $OHS_INSTANCE_HOME/mod_wl_ohs.conf
<Location /emeralit_llc>
SetHandler weblogic-handler
WebLogicCluster 10.108.10.24:9010
</Location>
<Location /emeralit_proxy_llc>
SetHandler weblogic-handler
WebLogicCluster 10.108.10.24:9010
</Location>
<25> Port Forwarding by Setting RHEL Firewall Rule:
|
|__ o. For certain case, physical application host only open port 443 to receive HTTPS request, but Oracle Forms & Reports Managed Server is listening port 4444 instead.
Following command will forward HTTPS request, which was received by port 443 to 4444 on RHEL OS firewall level.
$ firewall-cmd --add-forward-port=port=443:proto=tcp:toport=4444
$ firewall-cmd --list-all |grep forward
forward-ports: port=443:proto=tcp:toport=4444:toaddr=
<26-1> Oracle ORDS Functioning Replacement with Oracle PL/SQL Gateway:
|
|__ o. PL/SQL Gateway provides support for building PL/SQL-based applications on the Web.
| PL/SQL stored procedures can retrieve data from a database and generate HTTP responses containing data and code to display in a Web browser.
| PL/SQL Gateway has two versions. The first involves mod_plsql, which is an Apache plug-in used to communicate with the database.
| It maps browser requests into database stored procedure calls over a SQL*Net connection. It is generally indicated by a /pls virtual path.
| The second version involves the use of mod_ose. There is an embedded PL/SQL Gateway that is shipped with mod_ose
|
|__ o. Reference: https://docs.oracle.com/cd/A97335_02/apps.102/a90099/feature.htm
|
|__ o. Following infrastructure explains how Oracle PL/SQL Gateway works on Emeralit application logon page:
<26-2> Deploy ORDS via Command-Line Prompt:
|
|__ o. Oracle RESTful Data Services 19.1 is the functioning replacement of PL/SQL Gateway. Following is the reference for download and instsallation:
| |
| |__ o. URL - https://docs.oracle.com/en/database/oracle/oracle-rest-data-services/19.1/aelig/installing-REST-data-services.html#GUID-6F7B4E61-B730-4E73-80B8-F53299123730
|
|
|__ o. Download installer ords-19.1.0.0921545.zip. After unzipping the package, the core WAR file is ords.war
|
|
|__ o. Error "SEVERE: Could not start Standalone Mode because an error occurred: Failed to bind to 0.0.0.0/0.0.0.0:7778":
| |
| |__ o. Above error is due to port 7778 conflict with OHS port, when starting ORDS with port 5915, the issue got resolved.
|
|
|__ $ java -jar /u01/software/ords/ords.war install advanced
Verify ORDS schema in Database Configuration apex with connection host: userdb.emeralit.com port: 5920 service name: userdb
Requires to login with administrator privileges to verify Oracle REST Data Services schema.
Enter the administrator username:sys
Enter the database password for SYS AS SYSDBA:
Confirm password:
Retrieving information.
Enter the location to store configuration data:/u01/app/oracle/middleware/products/ords_home
Enter the name of the database server [localhost]: userdb.emeralit.com
Enter the database listen port [1521]:5920
Enter 1 to specify the database service name, or 2 to specify the database SID [1]:
Enter the database service name:userdb
Enter 1 if you want to verify/install Oracle REST Data Services schema or 2 to skip this step [1]:
Enter the database password for ORDS_PUBLIC_USER:
Confirm password:
Enter the default tablespace for ORDS_METADATA [SYSAUX]:
Enter the temporary tablespace for ORDS_METADATA [TEMP]:
Enter the default tablespace for ORDS_PUBLIC_USER [USERS]:
Enter the temporary tablespace for ORDS_PUBLIC_USER [TEMP]:
Installing Oracle REST Data Services version 19.1.0.r0921545
... Log file written to /home/oracle/ords_install_core_2019-09-12_170521_00100.log
... Verified database prerequisites
... Created Oracle REST Data Services proxy user
... Created Oracle REST Data Services schema
... Granted privileges to Oracle REST Data Services
... Created Oracle REST Data Services database objects
... Log file written to /home/oracle/ords_install_datamodel_2019-09-12_170529_00209.log
... Log file written to /home/oracle/ords_install_apex_2019-09-12_170530_00804.log
Completed installation for Oracle REST Data Services version 19.1.0.r0921545. Elapsed time: 00:00:11.383
Enter 1 if you wish to start in standalone mode or 2 to exit [1]:1
Enter 1 if using HTTP or 2 if using HTTPS [1]:1
Enter the HTTP port [8080]:7778
2019-09-12 17:08:16.866:INFO::main: Logging initialized @262429ms to org.eclipse.jetty.util.log.StdErrLog
Sep 12, 2019 5:08:16 PM
INFO: HTTP and HTTP/2 cleartext listening on port: 7778
Sep 12, 2019 5:08:16 PM
INFO: Disabling document root because the specified folder does not exist: /u01/app/oracle/middleware/products/ords_home/ords/standalone/doc_root
2019-09-12 17:08:17.438:INFO:oejs.Server:main: jetty-9.4.z-SNAPSHOT; built: 2019-02-20T15:50:58.683Z; git: 3285c4dd4bb00caddcded77f8e44e72c61b9ab72; jvm 1.8.0_201-b09
2019-09-12 17:08:17.601:INFO:oejs.session:main: DefaultSessionIdManager workerName=node0
2019-09-12 17:08:17.602:INFO:oejs.session:main: No SessionScavenger set, using defaults
2019-09-12 17:08:17.602:INFO:oejs.session:main: node0 Scavenging every 660000ms
Sep 12, 2019 5:08:17 PM
INFO: Configuration properties for: |apex|pu|
db.hostname=userdb.emeralit.com
db.password=******
db.port=5920
db.servicename=userdb
db.username=ORDS_PUBLIC_USER
resource.templates.enabled=true
Sep 12, 2019 5:08:17 PM
WARNING: *** jdbc.MaxLimit in configuration |apex|pu| is using a value of 10, this setting may not be sized adequately for a production environment ***
Sep 12, 2019 5:08:17 PM
WARNING: *** jdbc.InitialLimit in configuration |apex|pu| is using a value of 3, this setting may not be sized adequately for a production environment ***
Sep 12, 2019 5:08:18 PM
INFO: Configuration properties for: |apex||
db.hostname=userdb.emeralit.com
db.password=******
db.port=5920
db.servicename=userdb
db.username=emeralit_proxy
resource.templates.enabled=true
Sep 12, 2019 5:08:18 PM
WARNING: *** jdbc.MaxLimit in configuration |apex|| is using a value of 10, this setting may not be sized adequately for a production environment ***
Sep 12, 2019 5:08:18 PM
WARNING: *** jdbc.InitialLimit in configuration |apex|| is using a value of 3, this setting may not be sized adequately for a production environment ***
Sep 12, 2019 5:08:18 PM
INFO: Oracle REST Data Services initialized
Oracle REST Data Services version : 19.1.0.r0921545
Oracle REST Data Services server info: jetty/9.4.z-SNAPSHOT
<26-3> Starting ORDS in Standalone Mode:
|
|__ $ java -jar ords.war standalone
2019-09-12 17:17:34.852:INFO::main: Logging initialized @1367ms to org.eclipse.jetty.util.log.StdErrLog
Sep 12, 2019 5:17:34 PM
INFO: HTTP and HTTP/2 cleartext listening on port: 5915
Sep 12, 2019 5:17:34 PM
INFO: Disabling document root because the specified folder does not exist: /u01/app/oracle/middleware/products/ords_home/ords/standalone/doc_root
2019-09-12 17:17:35.523:INFO:oejs.Server:main: jetty-9.4.z-SNAPSHOT; built: 2019-02-20T15:50:58.683Z; git: 3285c4dd4bb00caddcded77f8e44e72c61b9ab72; jvm 1.8.0_201-b09
2019-09-12 17:17:35.564:INFO:oejs.session:main: DefaultSessionIdManager workerName=node0
2019-09-12 17:17:35.564:INFO:oejs.session:main: No SessionScavenger set, using defaults
2019-09-12 17:17:35.565:INFO:oejs.session:main: node0 Scavenging every 600000ms
Sep 12, 2019 5:17:36 PM
INFO: Configuration properties for: |apex|pu|
db.hostname=userdb.emeralit.com
db.password=******
db.port=5920
db.servicename=userdb
db.username=ORDS_PUBLIC_USER
resource.templates.enabled=true
Sep 12, 2019 5:17:36 PM
WARNING: *** jdbc.MaxLimit in configuration |apex|pu| is using a value of 10, this setting may not be sized adequately for a production environment ***
Sep 12, 2019 5:17:36 PM
WARNING: *** jdbc.InitialLimit in configuration |apex|pu| is using a value of 3, this setting may not be sized adequately for a production environment ***
Sep 12, 2019 5:17:36 PM
INFO: Configuration properties for: |apex||
db.hostname=fmwrepo.emeralit.com
db.password=******
db.port=5920
db.servicename=userdb
db.username=emeralit_proxy
resource.templates.enabled=true
Sep 12, 2019 5:17:36 PM
WARNING: *** jdbc.MaxLimit in configuration |apex|| is using a value of 10, this setting may not be sized adequately for a production environment ***
Sep 12, 2019 5:17:36 PM
WARNING: *** jdbc.InitialLimit in configuration |apex|| is using a value of 3, this setting may not be sized adequately for a production environment ***
Sep 12, 2019 5:17:37 PM
INFO: Oracle REST Data Services initialized
Oracle REST Data Services version : 19.1.0.r0921545
Oracle REST Data Services server info: jetty/9.4.z-SNAPSHOT
2019-09-12 17:17:37.060:INFO:oejsh.ContextHandler:main: Started o.e.j.s.ServletContextHandler@5e3a8624{/ords,null,AVAILABLE}
2019-09-12 17:17:37.069:INFO:oejs.AbstractConnector:main: Started ServerConnector@59309333{HTTP/1.1,[http/1.1, h2c]}{0.0.0.0:5915}
2019-09-12 17:17:37.069:INFO:oejs.Server:main: Started @3585ms
<26-4> Deploy ORDS with WebLogic via AdminServerMachine Console:
|
|__ o. On WebLogic Adminstration Console, click "Lock & Edit" in "Change Center" section, then go to "Deployments" in "Domain Structure" section to click "Install".
|
|__ o. Follow the below steps to deploy ords.war file. After deployment successed, in Domain Strucutre => Deployments, ords would show up.
To start it goes to "Control" tab => "Start":
<27> Certificate Signing Request [CSR] Creation:
|
|__ o. On Enterprise Manager, go to "WebLogic Domain" => "Security" => "Keystore".
|
|__ o. All the certificates needs to be placed in "Keystore", and each Keystore should be within a namespace called "Stripe".
|
|__ o. Therefore, "Create Stripe" first, and then "Create Keystore". Each Keystore can be protected by a password.
|
|__ o. After Keystore creation completed, highlight the name, and click "Manage" to create Keypair and CSR.
|
|__ o. Enter the Keystore, and click on "Generate Keypair" first, and "Generate CSR". Button "Export" will allow you to download the CSR.
<28-1> Importing SSL Certificate - Migrating Keystore:
|
|__ o. SSL certificates should be imported into the same keystore where the CSR was created.
|
|__ o. OHS instance was created after the Domain, so CSR was genenated from keystore which locates under WebLogic Domain, instead of OHS.
| If "User Certificate [Cert for weblogic server]" gets imported under Domain's keystore, the traffic between outside internet and HTTP would not be protected.
| In short, "User Cert" needs to be imported into the keystore under OHS for outside inbound HTTPS traffic.
|
|__ o. As a solution, the keystore under Domain needs to be exported first, and then importing the keystore under OHS.
|
|__ o. Following is the step of migrating the keystore:
wls:/offline> connect ('weblogic','admin_password','t3://app.emeralit.com:7001')
wls:/pmisp/serverConfig/> svc = getOpssService(name='KeyStoreService')
#=== List keystore ===#
svc.listKeyStoreAliases(appStripe='Emeralit',name='emeralit',password='Emeralit2019', type='*')
#=== Export keystore, command in one line ===#
svc.exportKeyStore( appStripe='Emeralit', name='emeralit', password='Emeralit2019', aliases='app.emeralit.com',
keypasswords='Emeralit2019', type='JKS', filepath='/tmp/myfile.jks')
#=== Import keystore, command in one line ===#
svc.importKeyStore( appStripe='OHS', name='ohs_emeralit', password='Emeralit2019', aliases='app.emeralit.com',
keypasswords='Emeralit2019', type='JKS', permission=true, filepath='/tmp/myfile.jks')
<28-2> Importing SSL Certificate - Root/Intermediate/User Certificate:
|
|__ o. After CSR submitted, CA will return a package includes Root, Intermediate, and User Certificate.
| Root/Intermediate are for certificating the CA, and User Cert is to certificate this OHS server and Managed WebLogic server can be trusted.
|
|__ o. The importing sequence is Root => Intermediate => User Certificate
|
|__ o. After migrating keystore "emeralit" from stripe "Managed" to "OHS", navigate via following hints to import the certificates:
|
| "WebLogic Domain" => Administration => "OHS Instance" => "ohs_emeralit" => "Oracle HTTP Server" => Security => Keystore => ohs_emeralit => Manage => Import
|
|__ o. For "Root & Intermediate", the Certificate Type should be "Trusted Certificate", and User Cert is "Certificate". Alias is just an unique name labelling under certain Stripe.
|
|__ o. Afterwards, under Weblogic Domain "Keystore" => Stripe "system" => trust => Manage, 2 imported certificates will show up.
|
|__ o. Finally, import User Certificate for OHS instance "ohs_emeralit".
|
|__ o. Reference: MOS DOC 2124504.1 - How to Create a Wallet and Enable SSL for OHS via Fusion Middleware Control in FMW 12.2.1
<28-3> Importing SSL Certificate - Generate Wallet File to Enable SSL:
|
|__ o. When above steps completed means new SSL Certificate got imported, now back to OHS Keystore to export cert key pairs into a wallet.
|
|__ o. First unlock the configuration by clicking on the "LOCK" icon on right above corner.
|
|__ o. Then go to "ohs_emeralit" keystore, and click on "Export Keystore to Wallet".
|
|__ o. Afterwards, a wallet file named "$OHS_INSTANCE_HOME/keystores/emeralit/cwallet.sso" will be created.
|
|__ o. Edit $OHS_INSTANCE_HOME/ssl.conf file, and revise path points to above file cwallet.sso, such as SSLWalllet "**********/keystores/emeralit"
|
|__ o. Restart OHS to enable imported SSL certificate.
|
|__ o. Since the certs were saved under the keystore, which got migrated. That is the reason why cwallet.sso file within folder by source name "emeralit", instead of "ohs_emeralit"
|
|__ o. Keystore acts like a "Logic Container" contains all keypairs for CSR and certificates.
|
|__ o. But, these logical strings in keystore needs to be exported into a physical and touchable file for network identifing purpose.
So, wallet is a physical file contains all the keys within the certificates.
It sorts of going to Home Depot Key Section, and get a new key of your house. The seller puts the key into a wallet handing over to you.
Everytime, reaching home, you hold and open the wallet, take the key out to open the house door.
In this case, Home Depot is a logical place stores all the keys, but the physical key in the wallet is touchable and owned by you to open the door.
Reference:
|
|__ o. Download - Oracle Fusion Middleware Infrastructure 12.2.1.3.0 – https://www.oracle.com/technetwork/middleware/fusion-middleware/downloads/index.html
|
|__ o. Download - Oracle Forms & Reports 12.2.1.3.0 - https://www.oracle.com/middleware/technologies/forms/downloads.html#
|
|__ o. Download - Oracle Database 12.2.0.1 - https://www.oracle.com/technetwork/database/enterprise-edition/downloads/index.html
|
|__ o. Download - Oracle Internet Directory 12.2.1.3.0 - https://www.oracle.com/technetwork/middleware/id-mgmt/downloads/oid-11gr2-2104316.html
|
|__ o. Download - Oracle Internet Directory 12.2.1.3.0 - https://www.oracle.com/middleware/technologies/identity-management/downloads.html
|
|__ o. Download - Oracle Java SE 8 Archive Downloads - https://www.oracle.com/technetwork/java/javase/downloads/java-archive-javase8-2177648.html?printOnly=1
|
|__ o. Installation - [Official] Oracle Forms and Reports Installation and Configuration - https://docs.oracle.com/middleware/1221/formsandreports/install-fnr/install.htm#CIHGBBEH
|
|__ o. Installation - [Official] Oracle Fusion Middeware Infrastructure 12.2.1.3.0 - https://docs.oracle.com/cd/E23104_01/download_readme_12213/download_readme_12213.htm
|
|__ o. Installation - [Official] Oracle Fusion Middeware Infrastructure 12.1.2.0.0 - https://docs.oracle.com/middleware/1212/core/INFIN/postins.htm#INFIN365
|
|__ o. Installation - Oracle Forms and Reports Installation Example - https://oracle-base.com/articles/12c/oracle-forms-and-reports-12c-installation-on-oracle-linux-6-and-7
|
|__ o. Installation - Oracle 12c Database Installation Example - https://oracle-base.com/articles/12c/oracle-db-12cr1-installation-on-oracle-linux-7
|
|__ o. Knowledge - No Reports Builder for 12c as 11g - Suresh-Sangaran-Oracle - https://community.oracle.com/thread/3893673?start=15&tstart=0
|
|__ o. Knowledge - Running the Installation Program in Graphical Mode - https://docs.oracle.com/cd/E29542_01/doc.1111/e14142/guimode.htm#WLSIG125
|
|__ o. Knowledge - Oracle 12c Forms and Reports Post Installation - https://blogs.oracle.com/fusionmiddlewaresupport/creating-and-starting-a-standalone-reports-server-in-12c-v2
|
|__ o. Knowledge - Oracle Fursion Middeware Basic Concepts - https://docs.oracle.com/cd/E21764_01/core.1111/e10103/intro.htm#ASCON109
|
|__ o. Knowledge - Unable To Find Dependent Featuresets For The Selected Installation Type "Forms and Reports Deployment" (Doc ID 2163971.1).
|
|__ o. Knowledge - FMW Infrastructure directory structure- https://docs.oracle.com/middleware/1212/core/INFIN/infra_dir_structure.htm#INFIN351
Your Comments