Author: gsb

  • Oracle eBusiness Submit Job – Command line

    The below code is the simplest way of doing a job submission for a concurrent program in eBusiness Suite:

    CONCSUB <db user>/<db password> <user> <role> <application group> WAIT=<Y|N> CONCURRENT <application> <application short name> PROGRAM_NAME="<long name>"

    So, as an example take the following command:

    CONCSUB apps/<password> SYSADMIN "System Administrator" SYSADMIN WAIT=N CONCURRENT FND FNDSCURS PROGRAM_NAME='"Active Users"'

    What this command means is:

    1. to run a job as the user “SYSADMIN”,
    2. using the “System Administrator” responsibility
    3. from the “SYSADMIN” application group,
    4. without waiting for it to complete.
    5. it should submit a concurrent program
    6. from the application “FND”
    7. which has the short name of “FNDSCURS”
    8. and the program name of “Active Users”

    This approach is going to be good for shell scripts that need to schedule things easily. However, if some more complex is going on (e.g. database information needs to be merged into the parameter) then it’s not going to help much. In this case, it is much easier to do that totally using PL/SQL.

  • User Certificates in Oracle Wallet

    Since I spent an age getting Oracle Wallet working with User Certificates, so I decided to blog about it, collecting all that I needed into one place.

    Why do you need user certificates in an Oracle Wallet?

    We have several Oracle ApEx applications at work. A new one that is being proposed will need to access a web service on a remote server. To control access to the server, the vendor has decided to use client certificates. So this means that I need to get a client certificate into a place were the Oracle database can make use of it when the PL/SQL ApEx will use tries to make connection to the remote server.

    Solution Components

    The first problem is that client certificates aren’t supported until Oracle 11g, so we will have to do an Oracle database upgrade. For what it’s worth, 11.1.0.6 will support client certificates without further patching. 11.1.0.7 does support certificates, but will also need an additional patch to re-enable it. Please note, the patch required isn’t released for Microsoft platform at time of writing so if you plan on doing this on a Window based database instance you are restricted to 11.1.0.6

    You will also need an Oracle iAS installation for one of the commands that are used below. Version doesn’t seem to matter. In this case I am using the Linux version of iAS and it’s command line. There will be a slightly different command needed if Windows is used.

    You will also need openssl installed, as we need to rip the supplied wallet apart.

    We requested the user certificate, and the vendor supplied it (as a .pfx wallet file) along with the chain of authentication. I then used the wallet to connect to the server we would use in the end, and downloaded the certificate chain for the server as well. N.B. There is generally a password associated with the wallet. We will need this if there is one.

    Creating the new Oracle Wallet.

    I binary transferred the wallet file and both required certificate chains to the ApEx server (meaning the chain for User Certificate, and chain for web site). Then login to the ApEx server.

    We need to extract the private key:

    openssl pkcs12 -in [pfx file name] -nocerts -out private.key
    Enter Import Password: [password for end user]
    MAC verified OK
    Enter PEM pass phrase: [new key password]
    Verifying - Enter PEM pass phrase: [new key password]

    And then extract the certificate:

    openssl pkcs12 -in [pfx file name] -clcerts -nokeys -out user_certificate.crt
    Enter Import Password: [password for end user]
    MAC verified OK

    Now set the Oracle home to be an iAS home and create the wallet using (need to make directory first):

    mkdir –p /etc/ORACLE/WALLETS/[user]
    $ORACLE_HOME/Apache/Apache/bin/ssl2ossl -cert user_certificate.crt -key private.key -chain [user certificate chain file] –wallet /etc/ORACLE/WALLETS/[user] -ssowallet yes
    Enter PEM pass phrase:[new key password]
    Enter wallet password:[new wallet password]
    Verifying password - Enter wallet password:[new wallet password]
    SUCCESS

    Keep a note of the new wallet password, you will need this now and forever more!
    Don’t delete the files created using openssl. We will need one again shortly.

    Open the new Oracle wallet using iAS Wallet Manager:

    $ORACLE_HOME/bin/owm

    Make sure it looks correct (mainly that the certificate is there and is ready, and that the user certificate chain is there).

    Then save it and exit. The wallet has been created, and is useable. However, we will probably use the 11g Wallet Manager associated with the database in the future and that means we need to do some extra work.

    Convert Oracle Wallet to an Oracle 11g Wallet

    Set Oracle home to DB home and start the database Wallet Manager:

    $ORACLE_HOME/bin/owm

    You will notice that thinks don’t look correct anymore. The steps to resolve this are:

    1. Re-import user certificate.
    2. Save.
    3. Remove user certificate
      Just the certificate, not the request for it.
    4. Save
      You should see that the ensure the blank trusted certificate entry has gone and the user certificate is back to requested.
    5. Re-import user certificate.

    The wallet will now look correct again (user certificate is ready, trusted certificates are the ones in the chain to the user certificate.

    Now import trust chain for server as normal (either one at a time, or as a single combined file).

    Finally, save wallet. It should now contain all the certificates that are needed.

    Testing the Oracle Wallet holding the User Certificate

    Please remember, depending on who the database is actually running as, you may need to change the files in the wallet directory to open to the group, rather than just the user (i.e. this is the case if you use a shared software installation).

    Test by running this as sys (to avoid ACL issues):

    select utl_http.request('[secure url]'
    ,null
    ,'file:[path to wallet directory]'
    ,'[password for wallet]') a
    from dual
    /

    If it works, you won’t get any errors and you’ll see the http code that is returned by the secure web page.

    Troubleshooting

    All I can really suggest for this is some things I have seen.

    1. Check the certificate chain for the server is really correct
    2. Check the permissions of the wallet files
    3. 11g Database ACLs (Oracle have embedded a firewall in the database… if you don’t open it for the right user, you’ll see nothing).
    4. Obviously, that you are using the correct password.
  • Configure BIEE BI Publisher Scheduler with MySQL

    I was keen to use the BI Publisher Scheduler and configure it to use a MySQL database. The instructions for this imply that you need to hunt around and find out how to register the JDBC library for MySQL. The reality with the Oracle Application Server or standalone OC4J is much simpler than that.

    1. Put the JDBC driver file in this directory: \j2ee\home\applib
    2. Restart the OC4J or Oracle iAS instance.
    3. When logged in now, you should be able to test a MySQL connection and find that it works properly (as show below):
      BIEE settings
    4. You can now create the schema, by clicking the install schema button, and finally click the apply button to make the scheduler start working.
    5. Restart the Oracle OC4J or iAS.

    This time messages will appear in the log that indicate that the Publisher Scheduler has started up:

     - Job execution threads will use class loader of thread: OC4J Launcher
     - Quartz Scheduler v.1.5.1 created.
     - Using thread monitor-based data access locking (synchronization).
     - Removed 0 Volatile Trigger(s).
     - Removed 0 Volatile Job(s).
     - JobStoreTX initialized.
     - Quartz scheduler 'BIPublisherScheduler' initialized from the specified file : 'C:\OracleBI\oc4j_bi\j2ee\home\applications\xmlpserver\xmlpserver\xdo\cache\xmlp42298771.tmp'
     - Quartz scheduler version: 1.5.1
     - Freed 0 triggers from 'acquired' / 'blocked' state.
     - Recovering 0 jobs that were in-progress at the time of the last shut-down.
     - Recovery complete.
     - Removed 0 'complete' triggers.
     - Removed 0 stale fired job entries.
     - Scheduler BIPublisherScheduler_$_NON_CLUSTERED started.

    And that’s it.

    BI Publisher’s Scheduler should now be configured against MySQL and will now work. This means that jobs should now be able to be created and will run.

  • Configure BIEE Scheduler with MySQL

    I am using a Windows PC to do this, so the instructions may not directly translate to UNIX/Linux.

    1. Create a database for BIEE to use.
      Create the objects required using this script (this is a tweaked version of the standard SAJOBS.DB2.sql script):
      CREATE TABLE S_NQ_JOB (
          JOB_ID decimal(10,0) NOT Null,
          NAME varchar (50)  ,
          DESC_TEXT varchar (255)  ,
          SCRIPT_TYPE varchar (20)  ,
          SCRIPT varchar (255)  ,
          MAX_RUNTIME_MS decimal(10,0)  ,
          USER_ID varchar (128)  ,
          NEXT_RUNTIME_TS timestamp,
          LAST_RUNTIME_TS timestamp,
          MAX_CNCURRENT_INST decimal(10,0)  ,
          BEGIN_YEAR decimal(10,0)  ,
          BEGIN_MONTH decimal(10,0)  ,
          BEGIN_DAY decimal(10,0)  ,
          END_YEAR decimal(10,0)  ,
          END_MONTH decimal(10,0)  ,
          END_DAY decimal(10,0)  ,
          START_HOUR decimal(10,0)  ,
          START_MINUTE decimal(10,0)  ,
          END_HOUR decimal(10,0)  ,
          END_MINUTE decimal(10,0)  ,
          INTERVAL_MINUTE decimal(10,0)  ,
          TRIGGER_TYPE decimal(10,0)  ,
          TRIGGER_DAY_INT decimal(10,0)  ,
          TRIGGER_WEEK_INT decimal(10,0)  ,
          TRIGGER_RANGE_DOW decimal(10,0)  ,
          TRIGGER_RANGE_DOM decimal(10,0)  ,
          TRIGGER_RANGE_MTH decimal(10,0)  ,
          TRIG_RANGE_DAY_OCC decimal(10,0)  ,
          DELETE_DONE_FLG decimal(10,0) NOT Null,
          DISABLE_FLG decimal(10,0) NOT Null,
          HAS_END_DT_FLG decimal(10,0) NOT Null,
          EXEC_WHEN_MISS_FLG decimal(10,0) NOT Null,
          DEL_SCPT_DONE_FLG decimal(10,0) NOT Null,
          PATH_IN_SCPT_FLG decimal(10,0) NOT Null,
          ISUSER_SCPT_FLG decimal(10,0) NOT Null,
          DELETE_FLG decimal(10,0) NOT Null,
          TZ_NAME varchar(100)
      );
      CREATE INDEX S_NQ_JOB_M1 ON S_NQ_JOB (NEXT_RUNTIME_TS) ;
      CREATE INDEX S_NQ_JOB_M2 ON S_NQ_JOB (USER_ID);
      CREATE UNIQUE INDEX S_NQ_JOB_P1 ON S_NQ_JOB (JOB_ID);CREATE TABLE S_NQ_JOB_PARAM (
          JOB_ID decimal(10,0) NOT NULL,
          RELATIVE_ORDER decimal(10,0) NOT NULL ,
          JOB_PARAM varchar (255),
          DELETE_FLG decimal(10,0) NOT NULL
      );

      CREATE TABLE S_NQ_INSTANCE (
          JOB_ID decimal(10,0) NOT NULL,
          INSTANCE_ID decimal(20,0) NOT NULL,
          STATUS decimal(10,0),
          BEGIN_TS timestamp,
          END_TS timestamp,
          EXIT_CODE decimal(10,0) ,
          DELETE_FLG decimal(10,0) NOT NULL,
          ERROR_MSG_FLG decimal(10,0) NOT NULL
      );

      CREATE UNIQUE INDEX S_NQ_INSTANCE_U1 ON S_NQ_INSTANCE (JOB_ID, INSTANCE_ID);
      CREATE INDEX S_NQ_INSTANCE_M1 ON S_NQ_INSTANCE (END_TS, STATUS, INSTANCE_ID ASC) ;
      CREATE INDEX S_NQ_INSTANCE_M2 ON S_NQ_INSTANCE (BEGIN_TS, STATUS, INSTANCE_ID ASC) ;
      CREATE INDEX S_NQ_INSTANCE_M3 ON S_NQ_INSTANCE (INSTANCE_ID ASC, DELETE_FLG ASC) ;
      CREATE INDEX S_NQ_INSTANCE_M4 ON S_NQ_INSTANCE (JOB_ID, INSTANCE_ID, STATUS, DELETE_FLG) ;
      CREATE INDEX S_NQ_INSTANCE_M5 ON S_NQ_INSTANCE (STATUS ASC, DELETE_FLG ASC) ;

      CREATE TABLE S_NQ_ERR_MSG (
          JOB_ID decimal(10,0) NOT NULL,
          INSTANCE_ID decimal(20,0) NOT NULL,
          RELATIVE_ORDER decimal(10,0) NOT NULL,
          ERROR_MSG_TEXT varchar (255),
          DELETE_FLG decimal(10,0) NOT NULL
      );

      CREATE UNIQUE INDEX S_NQ_ERR_MSG_U1 ON S_NQ_ERR_MSG (JOB_ID, INSTANCE_ID, RELATIVE_ORDER);
      CREATE INDEX S_NQ_ERR_MSG_F1 ON S_NQ_ERR_MSG (INSTANCE_ID ASC)  ;
    2. Create a user, and grant it access to the tables.
    3. Create an ODBC Connection to the MySQL Database, and check it works.
    4. Now start the scheduler configuration tool.
      Tell it that the connection type is ODBC and let it use the default Call Interface. Then enter details of the Data source created in step three, and include the user name and password.
      So, using the Windows OS, I have set it as follows:
      BIEE Scheduler Connection Settings
      Can also do this in the schconfig command line based tool, so I would expect this to work the same way under Linux.
    5. Then start the Scheduler service.
    6. On windows navigate to this directory:
      c:\OracleBIData\web\config
    7. Then run the following:
      \OracleBI\web\bin\cryptotools.exe credstore -add -infile credentialstore.xml
      and input the following bold values:
      >Credential Alias: admin
      >Username: Administrator
      >Password: *************
      >Do you want to encrypt the password? y/n (y): n
      >File "credentialstore.xml" exists. Do you want to overwrite it? y/n (y): y
    8. Now must edit instanceconfig.xml file, as modification by MBean didn’t work correctly.
      edit instanceconfig.xml
      Now, look for </ServerInstance> entry at the end of the file, and immediately before it, insert the following (path needs to be adapted appropriately for installation directory.
      <CredentialStore>
      <CredentialStorage type="file" path="c:/OracleBIData/web/config/credentialstore.xml"/>
      </CredentialStore>

      Save the file. Credentials have now been saved correctly and will be used by Presentation Server.
    9. Restart the presentation server service.
    10. You should now be able to save a iBot and not get a error reported by the application server.
  • Installing Oracle InstantClient on Linux

    This was very quick and easy to to actually!

    I transferred the 11i client (basic and the SQL*Plus bit) to my central server, and extracted out the software.
    Then I copied the executables to my bin directory, and the libraries to the lib directory.
    Finally, I moved glogin.sql to my sql directory.
    All I then had to do was amend the profile to set an LD_LIBRARY_PATH variable.

    The only thing left was to ensure SQLPATH was set, and then set TNS_ADMIN variable to where I am housing the tnsadmin.ora file.

    Hey presto! an 11i client install which can connect everywhere I tell it that it can get to.

  • Running WinHlp32.exe on Vista

    OK, we have an application at work who’s help wasn’t working under Vista SP1.
    Had a hunt, found this on the Microsoft web site.

    In short, download a patch from here to install the executable.
    There are 32bit and 64bit installation packages.

    You now need to create the following entries in the registry.

    1. Create the folder:
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WinHelp
    2. Next create the following DWORD (32-bit) values in the above created folder:
      AllowProgrammaticMacros with hex value of 1
      AllowIntranetAccess with hex value of 1

    At this point the PC should be bounced. On starting back up, the old help files should now work fine.

  • First batch is in.

    Quite relieved to have the first chunk out of the way.

    I really must go back over some of them, and see how relevant they still are…

    You never know, someone else might be looking for a “What a DBA should really know about 10gAS R3!” document.
    I can also put in my warnings about Oracle Portal 🙂

    Off to Legoland tomorrow…. Should be fun if the weather holds. Might be touch on the chilly side though.

    Hope TomTom wants to play properly with the route…
    I’m a bit worried the BlueTooth GPS Receiver doesn’t want to charge up again…
    That would be really annoying… Not sure I can get a replacement under guarantee this time…

    Ho humm, off to bed!

    Night all.

    Gavin

  • Getting there….

    … but it is taking a while though.

    I think I will try to focus on the performance based notes first.

    All that being said, I have transcribed my notes on my first installation of the Oracle eBusiness Suite and psychologically it feels good to get it all typed in!

    Gavin

  • Uggghhhh… first post.

    As part of my continuing attempts to use this site I’ve made properly, I’ve decided to sort out my study. So, today I’ve mostly been reading old UKOUG notes… I seem to have several dozen pages worth of notes for when I’ve been to UKOUG Conferences over the last few years… I’m going to transfer them up to this site… mainly so I can throw the stupid bits of paper away! I have a horrible feeling that they may be totally useless to everyone, but I just want to get rid of the paper!