Confusing Oracle/Sun Solaris OS Versioning

I'm always confused when I want to find out the exact release of the Solaris OS which I am working on.
If you do a "$ more /etc/release", you get something like below:

It's still very hard to relate 9/10 belongs to which release. I can relate more to U1, U2, etc... It's easier to track, at least for me.

Luckily, Wikipedia tracks it here.

• Solaris 10 1/06 ("U1")
• Solaris 10 6/06 ("U2")
• Solaris 10 11/06 ("U3")
• Solaris 10 8/07 ("U4")
• Solaris 10 5/08 ("U5")
• Solaris 10 10/08 ("U6")
• Solaris 10 5/09 ("U7")
• Solaris 10 10/09 ("U8")
• Solaris 10 9/10 ("U9")

.

OpenSSO - Installing Policy Agent on Oracle/Sun Web Server 7

I'm deploying a large-scale Single Sign-On infrastructure using OpenSSO for the local education ministry. 

There is a Sun Web Server 7 performing a Reverse Proxy to a backend application, and we intend to deploy the OpenSSO Policy Agent on the web server.

There is a certain sequence to follow to ensure the Policy Agent works:

1. Install Sun Web Server 7

2. Install OpenSSO Policy Agent for Sun Web Server 7

3. Configure Reverse Policy to backend application

If you swap 2 with 3, the Policy Agent will not be able to intercept user access via the reverse proxy, thus render the Policy Agent useless.

Why?

Take a look at the object configuration file in the Web Server config directory.
(Note: Not obj.conf, but -obj.conf)

The /UpdateAgentCacheServlet and /dummypost/sunpostpreserve must precede reverse-proxy-/.

If you swap 2 with 3, you'll find that 

reverse-proxy-/ precedes /UpdateAgentCacheServlet and /dummypost/sunpostpreserve.

If you to manually swap the sequence to make Policy Agent to work.


.

OpenSSO - Weird Policy Agent Naming Convention

I have been playing around with OpenSSO Policy Agent for a few weeks - installing and uninstalling many times.

Policy Agent installer uses the convention Agent_nnn as the Agent instance name. The 1st instance will be named Agent_001; 2nd instance will be named Agent_002.

The weird behavior happens when you uninstall the 2nd instance and then you install again. Logically, one would want this re-installed instance to be named as Agent_002 again. (since this is really the 2nd instance on the same server) 

Logical, no?

Sadly enough, the Policy Agent installer will skip Agent_002. It will rename this new instance as Agent_003, which is not acceptable to me!

What's the trick then?

Look for this hidden file in /sjsws_agent/data/.amAgentLookup

Before uninstall,

# Product Instances Translation Lookup File
Product_Instance_Count= 2
/opt/webserver7/https-ams.sso.mo.sg-1/config|= Agent_001
/opt/webserver7/https-ams.sso.mo.sg-2/config|= Agent_002

After uninstall,

# Product Instances Translation Lookup File
Product_Instance_Count= 2
/opt/webserver7/https-ams.sso.mo.sg-1/config|= Agent_001


The Policy Agent installer program was able to remove the line ending with "Agent_002", but was just to lazy to decrement the Product_Instance_Count from 2 to 1. I feel like kicking the developer who wrote this piece of code.

Nevertheless, to resolve the issue, manually set the value to 1 prior to re-install again.

.

OpenAM from ForgeRock

I have been wanting to install OpenAM for a while, but didn't have the time to do so until now.

Nothing much have changed except the color scheme. It's now orange, instead of the blue which we are used to for a while. :)

A slight difference in one of the OpenAM Configurator steps - User Data Store Settings. 

There are now 6 types of supportable User Data Store Types to choose from. 

Once configuration is done, we are redirected to the Login Page as usual.

It's a nicer page! Welcome to OpenAM!

.

MySQL Latest Price List

Oracle is giving you more support options, thus they need to collect more $ from you.

It's for your own good, my friend. 

Oracle knows better than you.

.

Algorithm DES/ECB is not available from provider Cryptix

I was tasked to port a very old Web Services application to Sun Glassfish Enterprise Server 2.1.1. This application uses a cryptography library from Cryptix. (Cryptix has been dead since 2005.)

 

On my development environment on MacBook, everything runs fine on Glassfish with JDK 1.6.0_16. However, when I ported to the production environment on Solaris 10, I kept getting the following error:


java.security.NoSuchAlgorithmException: algorithm DES/ECB is not available from provider Cryptix
at xjava.security.IJCE.getClassCandidate(IJCE.java:457)
at xjava.security.IJCE.getImplementationClass(IJCE.java:410)
at xjava.security.IJCE.getImplementation(IJCE.java:367)
at xjava.security.Cipher.getInstance(Cipher.java:489)
at xjava.security.Cipher.getInstance(Cipher.java:452)
at com.sun.moe.security.DESEncryptor.decrypt(DESEncryptor.java:133)
at com.sun.moe.login.AppLogin.main(AppLogin.java:80)


Very strange! After a long debugging session, I found the issue was with the JDK 1.6.x version.

I downgraded the JDK to 1.5.0_20 that shipped default with Solaris 10. It works!


I believe there must be some "tightening" done in this file in JRE, but I just cannot figure how to resolve it.

-bash-3.00$ cat /jdk/jdk1.6.0_16/jre/lib/security/sunpkcs11-solaris.cfg


#
# Configuration file to allow the SunPKCS11 provider to utilize
# the Solaris Cryptographic Framework, if it is available
#


name = Solaris


description = SunPKCS11 accessing Solaris Cryptographic Framework


library = /usr/lib/$ISA/libpkcs11.so


handleStartupErrors = ignoreAll


attributes = compatibility


disabledMechanisms = {
CKM_MD2
CKM_MD5
CKM_SHA_1
CKM_SHA256
CKM_SHA384
CKM_SHA512
CKM_DSA_KEY_PAIR_GEN
# KEY_AND_MAC_DERIVE disabled due to Solaris bug 6306708
CKM_SSL3_KEY_AND_MAC_DERIVE
CKM_TLS_KEY_AND_MAC_DERIVE
# the following mechanisms are disabled due to performance issues (Solaris bug 6337157)
CKM_DSA_SHA1
CKM_MD5_RSA_PKCS
CKM_SHA1_RSA_PKCS
CKM_SHA256_RSA_PKCS
CKM_SHA384_RSA_PKCS
CKM_SHA512_RSA_PKCS
# the following mechanisms are disabled to ensure backward compatibility (Solaris bug 6545046)
CKM_DES_CBC_PAD
CKM_DES3_CBC_PAD
CKM_AES_CBC_PAD
}


Anyone has an idea?

.

OpenSSO - High-Available Data Stores

In a highly available setup, the OpenSSO Enterprise Server should connect to at least a pair of Data Stores.

When a failover kicks in, the following will be captured in IdRepo log file:

IdCachedServicesImpl.getAttributes(): null found all attributes in Cache.
LDAPv3EventService:11/10/2010 02:50:10:642 PM SGT: Thread[LDAPv3EventService,5,main]
WARNING: LDAPv3EventService.run() LDAPException received: randomID=1490605490
com.sun.identity.shared.ldap.LDAPException: Server or network error (81)
at com.sun.identity.shared.ldap.LDAPConnThread.networkError(LDAPConnThread.java:782)
at com.sun.identity.shared.ldap.LDAPConnThread.run(LDAPConnThread.java:567)
at java.lang.Thread.run(Thread.java:619)


LDAPv3EventService:11/10/2010 02:50:10:651 PM SGT: Thread[LDAPv3EventService,5,main]
LDAPv3EventService.dispatchAllEntriesChangedEvent() psIdKey=ds2.sso.mo.sg:1389 ds1.sso.mo.sg:1389o=Edu,c=SGo=Edu,c=SG(objectclass=*)
LDAPv3Repo:11/10/2010 02:50:10:651 PM SGT: Thread[LDAPv3EventService,5,main]
LDAPv3Repo.objectChanged: dn=null; changeType4; psIdKey=ds2.sso.mo.sg:1389 ds1.sso.mo.sg:1389o=Edu,c=SGo=Edu,c=SG(objectclass=*); allObjChanged=true; clearCache=true
idrepoListener:11/10/2010 02:50:10:652 PM SGT: Thread[LDAPv3EventService,5,main]
**********************************************
idrepoListener:11/10/2010 02:50:10:652 PM SGT: Thread[LDAPv3EventService,5,main]
IdRepoListener: allObjectsChanged Called!
amIdmJAXRPCServer:11/10/2010 02:50:10:679 PM SGT: Thread[LDAPv3EventService,5,main]
**********************************************




The failover works! Cool!


However, when the primary Data Store is up again, the OpenSSO Enterprise Server does not switch back from the secondary Data Store.

.

OpenSSO - Policy Agent Issue with Time Sync

I was debugging a OpenSSO Policy Agent issue for a customer. He has deployed the Policy Agent for Sun Java Systems Web Server 7.

The application which resides on the Web Server 7 gets protected Policy Agent and redirected to the OpenSSO Login Page. However, when he keyed in valid username and password, the browser kept hanging on the OpenSSO Login Page.

From the Policy log in OpenSSO Enterprise Server, I noticed that there was lot of communications between the agent and the server (even though the browser looks "hang" on the Login Page). The following segment keeps repeating.

From the amAgent log, I noticed the following:

2010-11-09 14:41:47.618 Warning 25919:815c858 ServiceEngine: Service::getPolicyResult():Result size is 0,tree not present for http://ok.sso.mo.sg:8080/index.html

2010-11-09 14:41:47.618MaxDebug 25919:815c858 AM_POLICY_SERVICE: am_policy_compare_urls(): compare usePatterns=true returned 0
2010-11-09 14:41:47.618MaxDebug 25919:815c858 AM_POLICY_SERVICE: am_policy_compare_urls(): compare usePatterns=true returned 4
2010-11-09 14:41:47.618 Debug 25919:815c858 all: Policy time stamp for resource http://ok.sso.mo.sg:8080/* is (1289284876056000)2010-11-09 14:41:16.056.
2010-11-09 14:41:47.618 Info 25919:815c858 all: Policy node http://ok.sso.mo.sg:8080/* marked stale due to time out.


Something is fishy. This has something to do with time sync.

I checked and confirmed that the 2 servers (OpenSSO Enterprise Server and the Web Server) were in different time zone. I tweaked with NTP and made them sync with the same clock.

Re-run and the policy agent works like a charm!

.

Sun Access Manager 7.1 - Password Retries Exceeded Issue

I have a customer in Thailand asking me for help with regard to a weird error message when he tries to login after his password retries have exceeded.


He was warned of account lockout prior to his max password retries count. This is what he expected. Good. 

However, "Authentication failed" error message is shown when he really exceeded his max password retries count. He was expecting "Password retry limit exceeded". No Good.

I did a search in amAuthLDAP.properties:

#ExceedRetryLimit=Exceed password retry limit. Please try later.
ExceedRetryLimit=Authentication failed.


That explains why. This is more for security/auditing purpose. These days, auditors advise customers not to reveal too much to end-users when they encounter login failure.

.

OpenSSO - WebtopNaming Error

I was trying to configure a Site for my 2 OpenSSO Enterprise Servers and I hit the famous WebtopNaming error as shown below:

Servlet /opensso threw load() exception
java.lang.StackOverflowError
:
at java.util.concurrent.locks.ReentrantReadWriteLock$ReadLock.lock(ReentrantReadWriteLock.java:594)
at com.iplanet.am.util.SystemProperties.get(SystemProperties.java:252)
at com.iplanet.am.util.SystemProperties.get(SystemProperties.java:329)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:620)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:594)
at com.iplanet.services.naming.WebtopNaming.updatePlatformServerIDs(WebtopNaming.java:1186)
at com.iplanet.services.naming.WebtopNaming.updateNamingTable(WebtopNaming.java:1111)
at com.iplanet.services.naming.WebtopNaming.getNamingProfile(WebtopNaming.java:995)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:658)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:594)

There could be many scenarios that can cause this problem. Mine is kind of stupid today.

I was careless in appending an additional "/" to "/opensso". Be careful! 

.

OpenSSO - Manual configuration

I was trying to configure OpenSSO Enterprise Server manually without using the GUI Configurator.

The following error was encountered:

-bash-3.00$ java -jar /dist/osso/tools/config/configurator.jar -f /dist/osso/tools/config/osso1-config

Not Found

Configuration failed!

What an unfriendly error message! What is "Not Found"?

It was only after a while then I realized I have forgotten to deploy the opensso.war into my Glassfish container. How careless I was!

So here we go again:

-bash-3.00$ opt/gf211/bin/asadmin deploy --user admin --port 7878 --secure /dist/osso/opensso.war
Command deploy executed successfully.


-bash-3.00$ java -jar /dist/osso/tools/config/configurator.jar -f /dist/osso/tools/config/osso1-config
Checking configuration directory /sso/var/opensso....Success.
Installing OpenSSO configuration store...Success RSA/ECB/OAEPWithSHA1AndMGF1Padding.
Installing OpenSSO configuration store in /sso/var/opensso/opends...Success.
Creating OpenSSO suffix...Success.
Tag swapping schema files....Success.
Loading Schema am_sm_ds_schema.ldif...Success.
Loading Schema am_remote_opends_schema.ldif...Success.
Loading Schema fam_sds_schema.ldif...Success.
Reinitializing system properties....Done
Registering service amEntrySpecific.xml...Success.
:
:
Configuring system....Done
Configuring server instance....Done
Creating Web Service Security Agents....Done
Setting up registration files....Done
Configuration complete!

Nevertheless, I still think that we can do better with a friendlier error message.

.

How to import SSL certificates into JVM trust store?

I was trying to set up OpenSSO Distributed Authentication UI (DAUI) server on Sun Web Server 7 (aka Oracle iPlanet Server) to communicate with my backend OpenSSO Enterprise Server. The OpenSSO Enterprise Server is SSL-enabled for security reason.

In our development environment, we install self-signed certificate onto the Glassfish Application Server that hosts the OpenSSO Enterprise Server.

In order for DAUI to communicate securely with the OpenSSO Enterprise Server, we need to import the self-signed CA certificate into the Sun Web Server JVM.

The task can be daunting for people who do not play with SSL day-in-day-out.

Luckily, I found a very useful blog. Amazing! Wrote in 2006, still works like a charm in 2010!

Thank you, Andreas!

Alternative SyncML Client

Besides Synchronica and NotifyLink, there is now another SyncML client alternative from Synthesis AG.

Synthesis SyncML Clients for mobile devices (PDA) bring SyncML compatibility to widespread mobile OS platforms like iOS (iPhone, iPad, iPod touch), Android, PalmOS and Windows Mobile.

This allows mobile over-the-air (OTA) synchronisation with any compliant SyncML server (such as GooSync.com, SyncWise, Oracle Calendar and Beehive, eGroupware, Horde, WinFonie, SyncEvolution, MDaemon, OpenXchange, DeskNow, ScheduleWorld.com, O-Sync and many many more)


It offers free evaluation copy. I have not personally tried it yet, but will do so when I have the bandwidth.
Anyone has any review on this product? I would like to hear from you.


.

Gmail Priority Inbox

When Gmail launched Priority Inbox, I was initially not interested. That's why I did not enable the feature until today.

To know more about how Priority Inbox works, read here.

I just enabled it while having a lengthly meeting in a customer's site. I'm just impressed!

With Priority Inbox, there is this little section right at the top of your inbox (highlighted in RED). To me, it looks like a simple Executive Summary. So simple, so convenient. 

.

Blackberry Email & Calendar Sync with Sun Communications Suite

I just finished installing Sun Calendar Server to a customer's existing Sun Messaging Server infrastructure over the weekend in the Philippines.

Some of their directors use Blackberry. With the newly installed Calendar Server, they hope to sync their Blackberry devices.

I told them there are 2 approaches.


Approach 1: Blackberry sync with Outlook via USB

a. Install Sun Java System Connector for Microsoft Outlook
b. Sync Mail & Calendar from Sun Comms Suite 6u2 (Mail & Calendar) with Outlook
c. Sync Blackberry with Outlook via USB

Supported OS
Runs on Microsoft Windows 2000 (SP3 or higher), Windows XP (SP1 or higher), Windows 2003 Terminal Server, and Windows Vista

Supported Outlook
Supports Microsoft Outlook 2003 and 2007

Read here.



Approach 2: Blackberry sync over-the-air

a. Purchase NotifyLink Enterprise Server
b. Install and Configure to connect to Sun Comms Suite 6u2 (Mail & Calendar)
c. Blackberry sync with NotifyLink over-the-air

Read here.


Note: If users only want to "sync" email with Sun Messaging Server with Outlook, no connector is required. It works out-of-the-box via POP or IMAP protocol.

.

OpenSSO Identity Services

Besides Policy Agent that performs authentication and authorization, OpenSSO offers Identity Services to helps authenticate users who access protected applications.

The Identity Services are accessible via SOAP/WSDL and REST.

Basically, no difference from those offered by Policy Agent:

• Authentication and Single Sign-on — Verification of user credentials
• Authorization — Permission for authenticated users to access secured resources
• Provisioning — Creation, deletion, search, and editing
• Log — Ability to audit and record operations

The only difference is developers have to code by themselves to achieve the above 4 functionalities.
More flexibility if you look at it positively. Of course, more effort required.

.

OpenSSO Data Stores

There are a few data stores which we need to configure in OpenSSO.

1. Authentication Data Store assists in users' authentication

2. Identity Data Store holds the users' profiles

• Usually, there is a 1-to-1 mapping between a user in the authentication data store and a user in the identity data store
• Authentication data can also be stored together with Identity Data Store
• i.e. The Sun LDAP is used for both Authentication and Identity
• The reserve is also true: Active Directory can be configured for both purposes

3. Configuration Data Store is used for storing service configuration data and other information pertinent to the server's operation. Policies are also stored here. 

• We used to store Configuration data in Sun LDAP as well
• However, since version Access Manager 8.x (aka OpenSSO 8.x), these data is now stored in the embedded OpenDS.  
• This embedded OpenDS makes configuration for high-availability easier - less work to do

.

Difference between Web and J2EE Policy Agents

In OpenSSO, there are 2 types of Policy Agent to choose. Customers always get confused on which type and on which tier to deploy in their environment. 

The following diagrams illustrates clearly. Based on the Selection Criteria, Web Policy Agent will be deployed on the Web tier. 

J2EE Policy Agent will be deployed on the Application tier.

PS: If J2EE Policy Agent is deployed on the Application tier, there is no need for Web Policy Agent to be deployed on the Web tier. Simply allow the pass-through on the web server and let the Policy Evaluation be carried out on the Application tier.



.

OpenSSO and Enterprise SSO Selection Criteria

I have been busy involving in the design of a Single Sign-On (SSO) and Enterprise Single Sign-On (ESSO) solution for a local ministry.

They have a few hundreds applications (web-based and non web-based). Thus we need to have a concise selection criteria for them.

There are 2 types of policy agents available from OpenSSO:

1. Web Policy Agent

2. J2EE Policy Agent

In order to integrate applications for Single Sign-On with OpenSSO, they must be:

1. web-based

2. authenticate with a common authentication repository

3. supported by available policy agents from OpenSSO

If applications are customizable, Web Policy Agent will be chosen. Otherwise, if applications are pure J2EE-based that utilize the Java Authentication and Authorization Service (JAAS), then J2EE Policy Agent will be chosen.

If the above 2 criteria cannot be met, then ESSO will be chosen.

.

Automatic spam detection for comments

Salute to Blogger! There is now a feature to automatically detect spam for comments ...

I love this feature since I have been spending time manually removing spammed comments for the past months.

.