Apache Bridge Failure: Timed Out

Configuring Single Sign-On Using Oracle Access Manager 10g 16-75

16.8.13 Login Form is Shown Repeatedly Upon Credential Submission: No Error

This issue typically points to an incorrect user name or password. No error is shown. Ensure that you are supplying the correct user name and password. The user login name must be the value of the attribute that is configured in the Form Login authentication scheme. For example, Challenge Parameter creds: userid.

16.8.14 Logout and Session Time Out Issues

When a user logs out, or a user session times out, the user should be challenged for reauthentication. However, the following might occur instead: ■ Logout: After logging out, if the user attempts to access the application in the same browser window the application is still accessible without reauthenticating. ■ Session Time Out: After a user session time out, the user is challenged to reauthenticate. However, if the user gives a different user ID he is granted the same privileges as the previous user. The ObSSOCookie is still present. Some configuration must be done at the application level to kill the ObSSOCookie. For proper behavior, WebLogic application session time out values should be the same as WebGate session time out values. If setting up an Identity Asserter in the WebLogic Application Console, the Web application using the Identity Asserter must have its auth-method set to CLIENT-CERT. For more information, see Configuring OAM Identity Assertion for SSO with Oracle Access Manager 10g on page 16-34.

16.8.15 Not Found: The requested URL or Resource Was Not Found

If you receive a message stating that the requested URL or resource was not found on this server, the reverse proxy Web server might not be forwarding requests to the Oracle WebLogic Server. To ensure that the reverse proxy is forwarding requests to Oracle WebLogic Server

1. Locate the httpd.conf file on the reverse proxy WebGate Web server. For example:

ORACLE_INSTANCEconfigOHSohs_namehttpd.conf 2. Confirm the correct settings to forward requests to the correct host and port of the Oracle WebLogic Server: httpd.conf IfModule mod_weblogic.c WebLogicHost host WebLogicPort yourWlsPortNumber IfModule Location request-uri-pattern SetHandler weblogic-handler Location

16.8.16 Oracle WebLogic Server Fails to Start

If the Oracle WebLogic Server fails to start, you can take the following actions. 16-76 Oracle Fusion Middleware Application Security Guide 1. Determine whether the Oracle Access Manager Authentication Provider is the only provider configured in the Oracle WebLogic Server realm. If it is, continue with Step 2. 2. Confirm whether the Oracle Access Manager Authentication Provider is configured correctly and make any changes needed. 3. Determine whether the Oracle Access Manager Authentication Provider control flag is set to REQUIRED. In this case, perform the following steps: a. Create an Administrators group in the directory server, if one does not already exist or any other group for which you want boot access. b. Confirm that the LDAP user who boots Oracle WebLogic Server is included in the Administrators or other group. c. From the WebLogic Administration Console, go to Security Realms, Your Realm, Roles and Policies, Global Roles. d. Select View Conditions for the Administrators or other role. e. Add the group and click Save.

16.8.17 Oracle ADF Integration and Cert Mode

Problem WebGate configuration of cache directives might not be compatible with certain browser versions specifically Internet Explorer v7 when accessing certain URLs that allow you to download Microsoft Office documents .xls, .doc, and so on. For example, suppose that you have an Excel workbook deployed along with an Oracle ADF application in an Oracle Access Manager Cert-based environment. If the ADFDi component is trying to access two URLs, and trying the second URL first, a failure occurs regardless of the ADFDi client side code. It is not able to handle the redirect from Oracle Access Manager WebGate to the SSL enabled endpoint and fails with the following stack trace: WebException: The request was aborted: Could not create SSLTLS secure channel If you attempt to access the workbook, and the following message appears: Microsoft Office Excel cannot access the file The cause could be any of the following: ■ The file name or path does not exist. ■ The file is being used by another program. ■ The workbook you are trying to save has the same name as a currently open workbook. However, if the message appears when the URL to workbook is explicitly pasted to Internet Explorer v7 address bar it might be due to WebGate default Cache Directives. Note: To provide access to any other group, you must create that group in the directory server and add the user who boots WebLogic Server in that group.