How to configure SSL for Admin server when configured multiple authenticators

Symptoms:

We are getting following errors when we enabled SSL port and disabled non-SSL port for Admin server and try to check-in document in WCC:-

<oracle.ods.virtualization.engine.backend.jndi.DefaultAuthenticator.BackendJNDI> <LIBOVD-60143> <[#DefaultAuthenticator]  Unable to create connection to ldap://[localhost]:7002 as null.

javax.naming.CommunicationException: simple bind failed: localhost:7002 [Root exception is javax.net.ssl.SSLException: java.lang.RuntimeException:

Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]

        at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:218)

         at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740)

Cause: 

When we configure Admin Server to communicate over SSL then defaultLDAP automatically configure to communicate over SSL protocol (LDAPS). In case of multiple authenticators, and one of them is configure to communicate over SSL, we need to put the corresponding LDAP server's root certificate in an additional keystore used by the virtualisation (LibOVD) functionality otherwise application is unable to establish connection with defaultLDAP (ldaps://localhost:7002).

Solution:
Pre-requisites: Before completing this task, make sure the following configurations:-

• Configure the custom property called virtualize, and set its value to true.
• Admin Server SSL port is not enabled. (*) 
• Managed servers are down 

Steps:

1. Create the keystore:

a.      Set environment variables ORACLE_HOME, WL_HOME and JAVA_HOME.

export ORACLE_HOME=/u01/app/oracle/product/middleware/WC1

export WL_HOME=/u01/app/oracle/product/middleware/wlserver_10.3

export JAVA_HOME=/u01/app/jdk1.7.0_65/

b.      Setup the keystore by running libovdconfig.sh using -createKeystore option.

Open a shell prompt and change the directory to <MW_HOME>/oracle_common/bin. Then, run the following command:

./libovdconfig.sh -host <AdminServerHostName -port 7001 -userName weblogic -domainPath  <DomainPath> –createKeystore

      Enter AdminServer password:[Enter weblogic password]
Enter OVD Keystore password:[Enter a new password to secure a Keystore file]

Once this command runs, we see two new credentials in the Credential Store and a new Keystore file called adapters.jks under <DOMAIN_HOME>\config\fmwconfig\ovd\default\keystores.

2. Export the root certificate from the Admin Server SSL certificate or LDAP directory.
3. Import the root certificate to the libOVD keystore using the keytool command:

$JAVA_Home/bin/keytool -import -keystore adapters.jks -storepass <KeyStore password> -alias <alias of your choice> -file <Admin Server Certificate filename>

4. Enable SSL port and disabled non-SSL port of Admin server. (*)
5. Restart Admin Server and start all the managed servers.

* No need for this step if we are just configuring multiple authenticators with non-defaultLDAP (AD/OID) is communicating over SSL

Reference : Above steps are documented in Oracle BI security Guide: http://docs.oracle.com/cd/E21764_01/bi.1111/e10543/ssl.htm#BIESC6078

How to change HTTP Session Timeout for WebCenter Spaces?

 If you see WebCenter Spaces application (webcenter.ear) session-timout from the Weblogic Console, this session Timeout (3600 Seconds) is misleading and not applicable in case of WebCenter Spaces application. If you update this value from the console, it will not impact session-timeout of the WebCenter Spaces application.

 

Then question is how can I change session-timeout for WebCenter Spaces application? By default session-timeout set in web.xml is 45 minutes. There are following two ways to change the session-timeout:-

  

        1. Deployment Descriptors(web.xml and weblogic.xml)

       2. Customizing the Session Timeout sample project of SampleWebCenterSpacesExtensions (Supported solution till PS4)

Here, we will not discuss solution-2 as this project is excluded from PS5 documentation and sample project. If you are running WC Spaces PS3 or PS4, you can implement it as well.

You can update the session timeout in web.xml as well as weblogic.xml but if web.xml takes precedence over the weblogic.xml. Here, we will configure the session timeout in web.xml as recommended by Oracle in following documentation as well:-

http://docs.oracle.com/cd/E17904_01/webcenter.1111/e12405/wcadm_app_config_files.htm#BABIEBEB

Following are the steps to modify the web.xml for session timeout value:-

1.       Go to <WEBCENTER-HOME> /archives/applications directory and you will find webcenter.ear file there. In my case the complete path is C:\Oracle\Middleware\Oracle_WC1\archives\applications.

2.       Backed up webcenter.ear in <WEBCENTER-HOME> /archives/applications as webcenter.ear.bak

3.       Open the webcenter.ear file using winrar or 7zip or any other tool

4.       Now, go to spaces.war >> WEB-INF folder and open the web.xml file in editor

 

     

5.       Add following entry in it:-

<session-config>

                                         <session-timeout>15</session-timeout>

                         </session-config>

Pls note that session-timeout value in web.xml is in minutes whereas in weblogic.xml it is in seconds.

6.       Once done, save it and close it.

7.       Make sure that webcenter.ear contain an updated web.xml.

8.       Restart WC_Spaces servers. At startup, this automatically deploys the newer application with the modified web.xml.

Note: Once application is deployed, revised spaces.war is available at <DOMAIN-HOME> /servers\WC_Spaces\tmp\_WL_user\webcenter_11.1.1.4.0\<Randon-Folder-Name>. You can verify the web.xml changes as well.


Note:- From PS5 onward, there is one more way to change the session timeout, see the following documentation:-
http://docs.oracle.com/cd/E23943_01/webcenter.1111/e12405/wcadm_gen_prop.htm#BCEHFHCH

References:-

http://docs.oracle.com/cd/E17904_01/core.1111/e10108/webcenter.htm#BABEJEJG

http://docs.oracle.com/cd/E17904_01/webcenter.1111/e12405/wcadm_app_config_files.htm#CHDJCCBI