Unloading SSL OHS

Similar Questions

• OHS SSL CRL configuration

  Hello

  I have documents of murky conclusion which describes the process of "integer" necessary for configuring SSL CRL on a level OHS 11 g web install.  I have a dev site configured for SSL and check customer on and works well. When I configure ESS to use LCR, it is unusable at the start of the slow a user logs on for the first time.  Before I start looking for bottlenecks, I want to be sure I have properly configured the server.

  So far, I took the following steps to configure the Revocation list:

  (1) on the audit

  SSLCRLCheck on

  (2) set the path of the CRL file

  SSLCARevocationPath ' ${ORACLE_INSTANCE} / config/folder.

  (3) copied the .crl file required in the folder

  (4) orapki used to chop the .crl file

  (5) restarted the server

  I have restored a few Setup SSL OHS documents.  Here are the key steps?  I'd feel better if I had one complete source for the configuration of SSL CRL OHS 11 g web level only.

  Thank you

  -Scott

  Hi Scott,.

  He is the doc you can check for the Revocation configuration.

  How to configure CRL checking in Oracle HTTP Server in FMW 11 g (11.1.1.X) (Doc ID 1269633.1)

  You may or may not be able to check this doc due to the limitation. You can contact support for assistance.

  Thank you

  Sharmela

• Error 11 GR 2 OAM: plug The WebGate is unable to communicate with servers of access.

  Hi all

  I get the above error, but it is interesting, in the following scenario-

  (1) everything works fine OHS host & Port (where obviously Webgate is deployed and OAM all related configurations are doing)

  (2) but after I configure OAm and mod_wl_ohs to use a F5, the above error surfaces load balancer VIP.

  Before suggest you that I tried the standard debugging steps mentioned here-

  Hello and welcome to the Blog of identity management: plugin WebGate is unable to contact a server access

  There is no firewall between the SST and gateway, all OAM servers, the Web servers are running. The Web server and access server are on the same time zone.

  Please let me know if you need additional information.

  Finally able to resolve this error-

  There was a parameter related to unloading SSL that was missing in the configuration of OSH. So after a series of events related to the removal of the VIPs, configuring back and put in this setting (called WLProxyPassThrough)

  I was able to go beyond this issue.

  I don't know why this occurred suddenly and how & why it was working fine before without this parameter

• Cannot access the admin of VIP

  I can't access the admin page when using the VIP. I get the result below:

  

  Error: Not found

  The page you requested (https://xyz-vip.com/admin#) is not available.

  Error code: 404

  I can access the admin page, by going directly to a login server address (and of course locally on the login server), but I get a certificate error (what I think). I get a page of VMware Horizon when you browse the VIP, makes me believe the VIP is OK, but the connection servers are not configured to redirect the page admin, as they are with desktop computers.

  Is it possible to access the admin by the VIP display pages?

  We are running:

  View of the horizon 6.1

  4 connection (2 internal, 2 external) servers

  Discharged the A10 with SSL load balancer.

  Try using SSL_BRIDGE instead of UNLOADING SSL
  If it's a problem of configuration of LB, this will probably solve your problem.

• Balancer load balancing vCloud weigh with POSSIBLE.

  Hello

  I try to get 2 vCloud Director of cells of load balanced through a vSheild edge load balancer. I'm running vCloud Director 5.1.0.810718 and vshield Manager 5.1.2 - 943471. The two cells are synchronized time, two cells have the same certificate and the two are running on vCloud Director. the vShield edge device is configured as high availability and 2 external interfaces and internal 1 interface. I have 2 pools server implemented in load balancing, 1 pool for the HTTP and the second basin of the consoleproxy. Virtual servers are also implemented, I created 2 virtual servers by using external links to http and consoleproxy. the instructions I used to set up cells and the edge device are shown in the vCloud Director vCloud 5.1 zero Part4 network load balancing. After reading the reading part in vCAT page 311 thru page 314 balancing, it indicates that I need to copy the SSL certificate to the for the public URL of http load balancer. My question is, how do copy you the SSL certificate in the load balancer? any help would be greatly appreciated.

  Thank you

  J

  J

  The method of the copy of the certificate in load balancing is different for each load balancing.  I find that it is only necessary if you're trying to unload SSL for HTTPS connection.  If you do not have SSL offloading, I don't worry about this.

  Look at what vCAT doc?  vCAT is a series of documents, and there are several versions.  I want to just make sure I'm looking at the same thing before commenting.

• OAM - OHS & OIM 11 g: SSL performs a redirect to a Non - SSL page

  Scenario:

  1. the user is trying to access the identity of IOM console SSL page by browser.

  2. the user sees a page of connection OAM and provide valid credentials.

  3 a user is redirected to a non - SSL page (this page is empty). When the user adds to the URL, https://

  the user will see the console identity homepage.

  The question is in step 3. I expect to be redirected to a SSL page.

  Also, I see the following error in the logs of OSH:

  [2014 03-11 T 15: 49:50.5711 - 04:00] [OHS] [ERROR: 32] [] [core.c] [host_id: *] [host_addr: *] [pid: 10936] [tid: 140161346115328] [user: *] [VirtualHost: *] nzos of handshake error, returned nzos_Handshake 29049 (server *: * customer, *)

  [2014 03-11 T 15: 49:50.5711 - 04:00] [OHS] [ERROR: 32] [] [core.c] [host_id: *] [host_addr: *] [pid: 10936] [tid: 140161409054464] [user: *] [VirtualHost: *: *] NZ Library Error: SSL protocol error [index: probably the client speaks HTTPS via HTTP protocol]

  Should what configuration I look to fix this?

  I fixed this problem with the following steps:

  1. connect to the WebLogic Administration console.

  2. navigate to servers-> [name of the managed server]

  3. on the Configuration: general section, enable "WebLogic plug-in enabled" in the advanced option to each instance of the WebLogic Server.

• SSL unloaded to the SST led to smartview RAF have not all reports

  I set up install ssl at the level of the SST for a distributed 11.1.2.3 and the smartview connects fine to the RAF. But display not all reports under him. However, he displayed on the link 19000. Doc ID 1373601.1 and ( Doc ID 1364770.1 ) parameters are already present.

  All the world is facing this problem? Please throw a few thoughts.

  For anyone interested, this is the solution

  epmsys_registry system9/@enable_ssl_offloading true addproperty

  addproperty (SSL_off_loader_host_name) system9/@external_url_host epmsys_registry

  epmsys_registry addproperty system9/@external_url_port 443 (SSL_off_loader_port)

• HTTP server shipped in weblogic vs. OHS

  Hello

  I installed EMP. With her, weblogic is installed. I forgot to install ESS so weblogic uses its own HTTP server.

  I have a few questions related to the embedded server vs OHS.

  1 - HTTP Server integrated will work as well on OSH?

  2. is there a difference in speed between 2 servers?

  3. I'm having a lot of unusual problems, would it be because of embedded HTTP Server?

  Concerning

  Hi there are JanGLi,

  your question is rather architectural and technical.

  The use of OSH should be dictated by the topology of your environment.

  1 - HTTP Server integrated will work as well on OSH?

  Sure. WLS is designed and can operate as a stand-alone, i.e. without

  OSH at the front.

  2. is there a difference in speed between 2 servers?

  Although I did NOT stress tests compare OHS vs WLS in the portion

  Happy, I expect the OHS to serve static content, i.e. the images,.

  JS, css, etc.

  I would say that OHS is required when you run the web-based

  applications distributed among several DMZ where OSH should be in your

  Internet zone and WLS in the application server box. You can also

  WLS of SSL of unloading, for example, you can configure ESS to manage SSL

  communication and let the WLS to do its job - execution of components JEE.

  3. I'm having a lot of unusual problems, could it be due to integrated

  HTTP Server?

  In your case, I doubt that the problems you are having with EPM are

  due to lack of OSH at the front. If you are more specific in the questions

  you are facing I (or someone else in the community) might be able to

  help you.

  Hope this helps,

  A.

• OHS does not start in a new installation

  We just did a new install of 11.1.2.4. After you configure the protocol SSL, the services start, all is well

  EAS = https://servername:10083/easconsole/console.html seems to work very well.

  but,

  Workspace = https://servername/workspace/index.jsp (port 443)

  I tried to reconfigure the Web server, but it doesn't seem to help. On the resource monitor, it shows me the web server gets up but then stops working immediately.

  OHS starts if you comment out the comprennent.conf to try to identify where the question is, if it starts then, it seems like it might be aux.conf changes

  See you soon

  John

• Reconfigure the EMP for SSL

  So after a change in policy, society has imposed a requirement to activate ssl for hyperion environment.

  There are a few methods that we did research

  1 reconfiguration Weblogic using Keytool.

  User - https - > WebLogic

  
  

  2. activation of SSL in OSH. Who has three scenarios

  a. the user -> httpsESS- http - >weblogic

  b. the user http->OSH- https - >weblogic

  c. the user -> httpsESS- https - >weblogic (which is rare)

  
  

  3. termination of SSL to the SST and put in place of a firewall,

  User --- > Firewall - https (all other ports will be blocked, with the exception of the RDP, OSH (19000) and Essbase (1423 & the range 32 k - 33 k)->OHS toweblogic )

  
  

  Now this gets confusing that all of these methods require that redeploy us the application and is not what we want. The simplest method I could think is configure the EPM again using config.bat file and run the Setup to activate the SSL protocol.

  
  

  Can someone give me some suggestion please?
  

  Make your choice amongst

  Easy steps for Configuration complete SSL in Enterprise Performance Management 11.1.2.x - distributed on two servers (Doc ID 1391487.1) installation

  Easy steps to set up complete SSL on a non distributed Installation (single Server Installation) - EPM 11.1.2.2.xxx (Doc ID 1532416.1)

  Some EASY STEPS to set UP OFFLOADING SSL WITH OSH Web SERVER of EMP 11.1.2.x (Doc ID 1530169.1)

  The simplest option would be the SSL offloading on layer of network load balancing or terminate SSL at the SST.

  See you soon

  John

• Issue of SSL - EAS

  Hello

  I implemented SSL to web destination layer (OHS). I was able to validate everything, including the workspace, smartview and studio FR. But unfortunately, at the launch of the Regional of the web service, I get this error when connecting.

  

  I imported the intermediate certificates signed OHS, the root and in Java keystore on environmental assessments and Essbase servers. I don't see any errors in the web console EAS. Not sure where it goes wrong.

  I do not see errors if any easserver.log except for something like that.

  [2015 12-24 T 13: 09:37.256 - 07:00] [EssbaseAdminServices0] [WARNING] [ESSEAS-00100] [oracle.epm.essbase.eas] [tid: 32] [username: < anonymous >] [ecid: 0000L7Lb6mpBp2WjLxvH8A1MV3qE00002T, 0] [APP: SAE #11.1.2.0] unknown error has occurred. See the for more details [] stack trace below

  java.text.ParseException: date of: "0110".

  Kind regards

  RR.

  Just to add if you are not happy with the help of the url to directly access the jnlp then another option is:

  If windows open the registry on the computer of the EAS Editor, go to HKEY_LOCAL_MACHINE\SOFTWARE\Hyperion Solutions\EssbaseAdminServices0\HyS9eas_epmsystem1

  Add a new JVM option for example JVMOption50 with the value

  -DEAS_FE_URL =https://: 443

  Increment JVMOptionCount 1 and restart the windows EAS service.

  If on * nix then edit setCustomParamsEssbaseAdminServices.sh and add the parameter above.

  Which is pretty solutions, if all goes well, we'll be pretty good.

  See you soon

  John

• OHS start fails after the update of the portfolio

  Hello

  We try to change the SSL configuration for a standalone OHS 12.1.3 install on Windows 2008 R2.  This configuration change in question create a new portfolio and the case of confidence add appropriate using orapki then the parametres.conf update.  Attempt to restart the component of fails with the error:

  [OHS] [ERROR: 32] [SST-2054] [MOD_SSL. C] ... Init: () a full restart is necessary when wallet filechanged on-the-fly!

  We thought that this meant the server should be restarted, but it does not solve this error.    Someone else has encountered this error and how to solve?

  This brings me to another question: should use us a provided Oracle administration tool to update the settings ssl instead of manually update the fichier.conf?  If Yes, what is the appropriate tool to use when the SST is installed as independent?

  Thank you-

  Scott

  It is due to missing libraries in windows OS that prevents OSH to start in FIPS mode as below bugs

  bug 18895629
  bug 18875548

• OHS &amp; APEX - office/Mobile NO alternative standard connection to consume the apex and on request

  Hi all

  I have quite the problem and I do not see a solution and I hope someone might be able to provide advice how to on this subject.

  Here is my scenario:

  ===============

  I have 2 APEX applicationa, both with its own set of processes on demand (about 300), authentication schemes, page elements. Each application is only 2 pages (login, home).

  I've got 2 software applications, running on the Office of the AIR and the other a mobile application.

  Problem

  =====

  Connection for APEX WITHOUT ever going to the login page of the application in a web browser. In short, think of it as if I had BROWSER WEB No..

  I need to identify, authenticate and retrieve session information so I can call and then process on request through some Ajax calls in my applications, using post/get and pass the base APP_ID, PAGE_ID, SESSION_ID.

  Security must stay tight, which means that all calls are made via https/SSL.

  Currently, I can come out with a solution dirty air, which is to pass the user name, password the URL to the login page.

  Connection direct yo the database is not an option.

  Is where I'm stuck, how can I do this correctly.

  I recently worked around a violation of the page, passing the name of user and password in the URL, but the mobile app gets Bad request.

  I even started looking at REST, to provide the login? But how to replace this APEX for session state, session valid etc..

  But what would be the entire installation, that's what troubles me. ? Is there an api I do not know of. Whaty I am missing. I've worked with Oracle 8 years and cannot imagine not being able to connect to APEX without going to a web page.

  Maybe there is a way to expose some PL/SQL for the internet in a safe way? According toher, rewriting authentication custom apex coding style (htp.init, get_cookie, set cookie, apex_application_custom_auth, etc.)?

  Platform

  =======

  Oracle 11.2.0.4

  Apex 4.2.4

  OHS 11 g

  --> Possible APEX reverse listener with proxy?

  Thank you

  Jan S.

  Hi Jan,

  No worries :-) I'm used to this lack of hits, especially since we also have a Christina in the team of the APEX.

  Just issue the cookie 1:1 with htp.p line, as read you. After owa_util.mime_header is a good place to do that, Yes. Your code may look like the example below, but of course it must issue the cookie that he just read, not sample one of your previous post.

  owa_util.mime_header('text/html', FALSE );
  htp.p('Set-Cookie: ORA_WWV_APP_70070037001=ORA_WWV-Ic4nT76UhbDoIP5tGBweGWxW; HttpOnly');
  htp.p('Cache-Control: no-cache');
  htp.p('Pragma: no-cache');
  owa_util.http_header_close;
  

  Kind regards

  Christian

• OEDQ integration with Active Directory - disable SSL

  Hi mates,

  I just installed OEDQ (latest version) on a Unix machine (deployed on WebLogic Server 10.3.6) but I have a few concerns:

  • SSL communications -> is mandatory? I mean, I tried to expose dndirector via a Server Web Apache OHS admin page. I am able to access the page from admin in raw mode, but every time I try to access a specific feature (dashboard, user management, server configuration, etc.) I am redirected to https://< web-server-hostname >: < wls-server-ssl-port > / dndirector, if this is not what I expect. What's wrong? Moreover, if SSL is required, is there a way to expose the console via apache (avoiding any redirect)?
  • OEDQ with Active Directory -> documentation- OEDQ integration with Active Directory - covers just Single Sign-on configuration (on the two Windows/Unix os). What about a simple configuration pointing to an external ldap? The documentation States the following statement:

  It is also possible to configure OEDQ to work with servers of different directory for authentication of users and the identification of the user. For more information on the alternative configurations, "see"contact us" "

  So, how can I achieve this?

  Pointers?

  Thanks in advance,

  Marco

  Marco

  Here is an example configuration that can be used to integrate with AD.  Create a folder called Security in your Disqualification configuration directory, and save the file in this folder as login.properties.  There are a few supporinting of documentation online this process in aid of the Disqualification.

  Here is the file, I'll add a few notes below:

  realms                        = internal, adgss                           = false
  
  ad.realm                      = EXAMPLE.COMad.auth                       = ldapad.auth.bindmethod            = digest-md5ad.auth.binddn                = search: sAMAccountNamead.ldap.server                = dc.example.comad.ldap.auth                  = simplead.ldap.user                  = [email protected]                    = testad.ldap.profile               = adsldapad.ldap.prof.defaultusergroup = testgroupad.ldap.prof.useprimarygroup  = false
  

  The kingdoms line indicates that the 'internal' (Disqualification internal users such as dnadmin) Kingdom and the Kingdom of AD should be used.  Once you are satisfied with the integration of ads you can remove the internal domain and use AD exclusively.  The domain property sets the name of the field AD - here I used EXAMPLE.COM.

  The server property sets the DNS name of the AD server.  If omitted, it is looked up in the DNS.

  The lines of the user and pw are used to connect to AD Disqualification.

  The defaultusergroup line is the name of a LDAP group that contains all users who will use the Disqualification.  The default value for this is domain users that contains usually much too many users.

  Once it is setup and working, you can go to Setup user Disqualification and see a link to external groups that attach ad with Disqualification groups groups to assign permissions to users.

  I hope this helps.

  Richard

• Port SSL messages to jabber/gtalk does not stick

  Hi-

  It is not purely associated with Sierra, as happening on El Cap.  The port default to Google talk is 5223, which is blocked in my company.  I had previously configured messages to use 443, which is not blocked (and supports gtalk).  But at some point during the last couple months, gtalk stopped linking to work.  When I looked at it, she returned to 5223.  When I try to set it to 443 (disable the account, change the port, re - enable the account) everything looks good, but at the time when I try to connect, it turns to 5223.  I tried to delete the account completely re - create, both as a right has Jabber (port 443 from the beginning of setting) or as a gmail e-mail account and then change the port later.  Nothing does.

  Thinking perhaps it was corrupted prefs, I deleted all the * prefs to iChat and everything that seemed related to google or jabber.  No change in behavior.

  Anyone seen this before?  Help to solve if possible of love.

  Thank you!

  Hello

  Currently I use port 5222 and without SSL and my account settings Google is for applications that are less secure.

  I can't use 5223 or even443 with SSL on.

  

  21:01 Tuesday; October 4, 2016

   iMac 2.5 Ghz i5 2011 (El Capitan)
   G4/1GhzDual MDD (Leopard 10.5.8)
   MacBookPro (Snow Leopard 10.6.8) 2 GB
   Mac OS X (10.6.8).
   iPhone and iPad (2)