Creating your first OAM 11g R2 domain

So you downloaded the Identity Management R2 release bits, spun up your little test environment and created a WebLogic domain. But the first time you sign in you get the error message "The policy store is not available; please see the log file for more details." in a pop up.

like this:

The logs aren't particularly helpful:

####<Sep 13, 2012 6:19:42 PM EDT> <Error> <oracle.oam.engine.policy> <iamr2.oracleateam.com> <AdminServer> <[ACTIVE] ExecuteThread: '7' for queue: 'weblogic.kernel.Default (self-tuning)'> <weblogic> <> <e3b75e49ebb52881:-4d179e40:139c1939ab6:-8000-00000000000005a3> <1347574782661> <BEA-000000> <The policy store is not available; please see the log file for more details.
oracle.security.am.common.policy.admin.store.PolicyStoreException: OAMSSA-06252: The policy store is not available; please see the log file for more details.
        at oracle.security.am.common.policy.util.OESUtils.checkAndThrowException(OESUtils.java:630)
        at oracle.security.am.common.policy.util.ResourceTypeHelper.setupHostIdentifierResourceType(ResourceTypeHelper.java:438)
        at oracle.security.am.common.policy.admin.provider.oes.DefaultApplicationDomain.createHostIdentifierPolicy(DefaultApplicationDomain.java:118)
        at oracle.security.am.common.policy.admin.provider.oes.DefaultApplicationDomain.<init>(DefaultApplicationDomain.java:93)
        at oracle.security.am.common.policy.admin.provider.oes.DefaultApplicationDomain.getGlobalDefault(DefaultApplicationDomain.java:461)
        at oracle.security.am.common.policy.admin.provider.oes.ApplicationManager.setupGlobalDefaultAppDomain(ApplicationManager.java:112)
        at oracle.security.am.common.policy.admin.provider.oes.ApplicationManager.<init>(ApplicationManager.java:61)
        at oracle.security.am.common.policy.admin.provider.oes.ApplicationManager.getApplicationManager(ApplicationManager.java:125)
        at oracle.security.am.common.policy.util.OESSetupHelper.loadOAMApplicationManager(OESSetupHelper.java:340)
        at oracle.security.am.common.policy.util.OESSetupHelper.loadOAMApplicationPolicies(OESSetupHelper.java:166)
        at oracle.security.am.common.policy.util.OESSetupHelper.loadApplicationPolicies(OESSetupHelper.java:154)
        at oracle.security.am.common.policy.admin.provider.oes.proxy.OESAdminProxy.init(OESAdminProxy.java:84)
        at oracle.security.am.common.policy.admin.provider.oes.OESPolicyAdminProvider.init(OESPolicyAdminProvider.java:130)
        at oracle.security.am.common.policy.admin.PolicyAdminFactory.getProvider(PolicyAdminFactory.java:241)
        at oracle.security.am.common.policy.admin.PolicyAdminFactory.init(PolicyAdminFactory.java:166)
        at oracle.security.am.common.policy.admin.PolicyAdminFactory.getPolicyAdmin(PolicyAdminFactory.java:334)
...

And in the -diagnostic log:

[2012-09-13T18:19:42.364-04:00] [AdminServer] [NOTIFICATION] [] [oracle.adfdt.model.mds.MDSApplicationService] [tid: [ACTIVE].ExecuteThread: '7' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: weblogic] [ecid: e3b75e49ebb52881:-4d179e40:139c1939ab6:-8000-00000000000005a3,0] [APP: oam_admin#11.1.2.0.0] [[
oracle.mds.exception.ReadOnlyStoreException: MDS-01273: The operation on the resource /oracle/oam/ui/adfm/DataBindings.cpx failed because source metadata store mapped to the namespace / DEFAULT is read only.
        at oracle.mds.core.MDSSession.checkAndSetWriteStoreInUse(MDSSession.java:2495)
        at oracle.mds.core.MDSSession.checkAndSetWriteStoreInUse(MDSSession.java:2548)
        at oracle.mds.core.MDSSession.getMutableMO(MDSSession.java:3493)
        at oracle.mds.core.MDSSession.getMutableMO(MDSSession.java:1660)
        at oracle.mds.core.MDSSession.getMutableMO(MDSSession.java:1546)
        at oracle.adfdt.model.mds.MDSApplicationService.findApplication(MDSApplicationService.java:57)
        at oracle.adfdt.model.mds.MDSModelDesignTimeContext.initServices(MDSModelDesignTimeContext.java:232)
        at oracle.adfdt.model.mds.MDSModelDesignTimeContext.<init>(MDSModelDesignTimeContext.java:82)
        at oracle.adfdt.mds.MDSDesignTimeContext.<init>(MDSDesignTimeContext.java:66)
        at oracle.adfinternal.view.page.editor.Page.getDesignTimeBindingContainer(Page.java:596)
        at oracle.adfinternal.view.page.editor.contextual.event.ContextualModelManager.getBindingContainerForView(ContextualModelManager.java:209)
        at oracle.adfinternal.view.page.editor.contextual.event.ContextualModelManager.getCurrentContextualResolver(ContextualModelManager.java:131)
        at oracle.adfinternal.view.page.editor.bean.ContextualWiringBean.getResolver(ContextualWiringBean.java:625)
        at oracle.adfinternal.view.page.editor.bean.ContextualWiringBean.clearSelection(ContextualWiringBean.java:594)
        at oracle.adfinternal.view.page.editor.bean.ContextualWiringBean.handlePageNavigation(ContextualWiringBean.java:130)
        at oracle.adfinternal.view.page.editor.contextual.event.EventHandler.processNavigation(EventHandler.java:92)
...

What did you do wrong?!

Starting and stopping WebLogic automatically using Upstart

I've been using Unix and Linux a while. Like a while while. So long ago that the first time I installed Linux it was by floppy disk. I'm not telling you that to brag, or imply that I'm old. I say that to give you a sense of how exciting this change is for and old hat.

In the olden days when you wanted to start a program when the machine booted there were a bunch of options. You could put it in /etc/inittab and let init handle it for you; but there were a bunch of problems with that. In recent vintages of Linux we have Sys-V (pronounced System Five) style init scripts where you'd write a shell script that took a command line option "start" or "stop" and started or stopped the service, then put that script in /etc/rc3.d with a name like S99myservice. Or better yet you'd tuck it into /etc/init.d and then symlink it to the right name in /etc/rc3.d (for example). If you were reasonably smart you'd put a "chkconfig" stanza at the top and let chkconfig do the symlinking for you. You still needed to write that script which basically meant a bunch of copy/pasting the same thing over and over. And you needed to make sure the process ran "in the background" which lead to lots of people using the "&" in really awful ways that made me feel dirty to see.

But I'm here to tell you that while that's all well and good, and you can still do that if you want under Oracle or RedHat Linux 6 you no longer have to.

In Ubuntu, RedHat and Oracle Linux there's a new flavor of init called Upstart that all the kids are using and it's the new hotness when it comes to making programs into daemons and wiring them to start and stop at appropriate times.

After using it for a little bit I think I might be in love. It is a pleasure to use compared to the (now) old way.

Say you want to start Node Manager every time the machine boots. To do that you just create a file named /etc/init/nodemanager.conf and put this in it the /etc/init directory.

start on runlevel [345]
exec /bin/su - oracle -- /home/oracle/Oracle/Middleware/wlserver_10.3/server/bin/startNodeManager.sh

Substitute oracle for whichever user you run the stuff as and adjust the path as needed for your particular environment.

Want to start the OAM Admin and Managed servers on boot?



Create a file named /etc/init/oamadminserver.conf:

start on runlevel [345]
exec /bin/su - oracle -- /home/oracle/Oracle/Middleware/user_projects/domains/OAMDomain/bin/startWebLogic.sh

And /etc/init/oamserver1.conf:

start on runlevel [345]
exec /bin/su - oracle -- /home/oracle/Oracle/Middleware/user_projects/domains/OAMDomain/bin/startManagedWebLogic.sh oam_server1

Reboot the machine and the OAM AdminServer and the Managed Server will come up automatically.

If you want to start, check the status of, or stop the service? It's super simple:

[root@r2d2 init]# start oamserver1
oamserver1 start/running, process 5573
[root@r2d2 init]# status oamserver1
oamserver1 start/running, process 5573
[root@r2d2 init]# stop oamserver1
oamserver1 stop/waiting

And this is just scratching the surface of what you can do with Upstart.

You've got to try it out!

Oracle IAM 11g R2 docs are now available

The docs for the OAM 11g R2 release are now up and available either online at http://docs.oracle.com/cd/E27559_01/index.htm or as a download on via eDelivery.

To get your very own copy from eDelivery:

1. go to http://edelivery.oracle.com/
   
2. Sign in
   
3. Pick "Oracle Fusion Middleware" as the Product Pack
   
4. Pick Linux x86-64 as the Platform (or pick Windows if that's your thing!)
   
5. hit Go
   

You should get a list that includes "Oracle Fusion Middleware Identity Management 11g R2 Media Pack":

Click that and scroll down to the bottom and you'll see the doc set:

One of the great things about the new doc set is the inclusion of ePub files. This means that if you have an iPad you can load up the doc library onto that and read the docs on the couch. On on a plane.
Or on the throne!
(just don't lend me your iPad afterwards please!)

You can pull the ePubs out of the zip directly or you can get them by opening the library's index, picking one of the docs inside and then looking in the upper right hand corner:

ENJOY!

OIM 11g R2 Catalog

The Catalog is one of most commented new features in OIM 11g. It introduces a new way to search items and to create access requests and it also introduces the ‘shopping cart’ experience.

The request process was drastically simplified with the Catalog. Whereas in OIM 11g R1 users have to go through a multiple step wizard to create a request, in OIM 11g R2 the work is done in two pages: the catalog search and the shopping cart summary.

Identity and Access Management at Oracle Open World 2012

Oracle Open World 2012 is fast approaching. This year Open World will run September 30 – October 4th.

As usual, there will be lots of great Identity and Access Management events and activities to participate in.

There is a dynamically updated document entitled Focus On: Identity Management which highlights all the Identity Management related sessions, events, and activities.

That being said, there are three events that I’d like to highlight.

1) It almost goes without saying that the highlight of Open World (yes even more than Larry’s key note or all the cool concerts that they are throwing) will be the hands-on lab run by our very own Chris Johnson on Complete Access Management. The schedule says that Chris’s lab will be on Monday Oct 1, 1:45 @ Marriot Marquis. There are people who would give their right arms for a chance to interact in person with Chris on the latest trends and best practices in Access Management. So, do not miss out on this opportunity.

2) Amit Jasuja, Senior Vice President, Oracle Identity Management and Security will be giving a session entitled Trends in Identity Management. This session focuses on how the latest release of Oracle Identity Management addresses emerging identity management requirements for mobile, social, and cloud computing and reduces TCO for organizations. Amit is a great guy, a great speaker, and a visionary in IDM and middleware security in general. So, I recommend that you definitely attend this event. Amit’s session will be on Monday Oct 1, 10:45AM @ Moscone West L3, Room 3003.

3) There is another hands-on lab led by Javed Beg on Integrated Identity Governance. The schedule says that this lab will be on Thursday, Oct 4, 12:45 @ Marriot Marquis. These hands-on IDM labs should be some of the most instructive and informative events at OOW and Javed is a seasoned expert in the space. So, I encourage you to attend.