Peopletools 8.62 Planned feature and enhncements

 Review the Planned Features and Enhancements (PFE) to see which new features are planned within the next 12 to 18 months.

https://support.oracle.com/epmos/faces/DocumentDisplay?id=1966243.2#PeopleToolsPFE

I specifically liked the below. Hope they can backport it to 8.61

• Administrators can now prioritize IB queues to organize which messages are processed before others.
• A new Endpoint Base URL can be set for REST consumer services to easily change the URL between environments in one place instead of updating multiple service operations.
• A new integration gateway property to change the default of using an IP address to establish the connection to the domain name. When the property is set to TRUE, the gateway will use the domain name for any HTTP request.
• Certification of Microsoft Windows Server 2025 is planned for PeopleTools 8.62 for all tiers (database, application, and web servers). The exact timing will be dependent on certification with required third parties such as (but not limited to) Fusion Middleware and Visual COBOL.
• A new run control page will allow administrators and developers to schedule Cross Reference (XREF) Reports for Event Mapping, Drop Zones, App Engine Plugins, and Configurable Search. The XREF Reports can be run across the full database or a specific project, and the output can be generated to a file, table, or both.
• Improved support for enabling Real Time Indexing (RTI) processes on two or more domains, avoiding duplicate processing and allowing for horizontal scaling.

Fail to Apply WebLogic July 2023 CPU Patch using Opatch 13.9.4.2.13

 Oracle just released WebLogic CPU Patch on July 18th. More info below. 

Critical Patch Update (CPU) Patch Advisor for Oracle Fusion Middleware - Updated for July 2023 (Doc ID 2806740.2)

https://blogs.oracle.com/blogbypuneeth/post/oracle-weblogic-server-critical-patch-update-july-2023

The Patch requires newer version of Opatch 13.9.4.2.13. When trying to apply the 35601596 - WLS STACK PATCH BUNDLE 14.1.1.0.230713 (SPB)

or

35560771 - WLS PATCH SET UPDATE 14.1.1.0.230703

using 28186730 - OPatch 13.9.4.2.13

it fails with below error

[Jul 20, 2023 1:37:28 PM] [SEVERE]  Nextget could not process patch 35560771

[Jul 20, 2023 1:37:28 PM] [SEVERE]  oracle.glcm.opatch.common.api.install.HomeOperationsException: A failure occurred while processing patch: 35560771

                                    at com.oracle.cie.gdr.patch.HomeOperationsImpl.processPatch(HomeOperationsImpl.java:790)

                                    Caused by: com.oracle.cie.gdr.utils.LocalizedGdrException: GDR-70005: Failed to apply inventory patching to home.

                                    GDR-70005: A failure occurred while attempting to apply inventory patches to the home /opt/fedex/cdas/cporapp/wls

                                    GDR-70005: Contact customer support.

                                    at com.oracle.cie.gdr.patch.PatchHandlerImpl.processUpdatePatch(PatchHandlerImpl.java:1440)

                                    at com.oracle.cie.gdr.patch.PatchHandlerImpl.processUpdatePatch(PatchHandlerImpl.java:1345)

                                    at com.oracle.cie.gdr.patch.PatchHandlerImpl.processPatchUsingPaths(PatchHandlerImpl.java:771)

                                    at com.oracle.cie.gdr.patch.HomeOperationsImpl.processPatch(HomeOperationsImpl.java:786)

                                    ... 19 more

                                    Caused by: java.lang.NullPointerException

                                    at com.oracle.cie.gdr.patch.ComponentMetaDataPatchHandler.isPatchMetadataSuperseded(ComponentMetaDataPatchHandler.java:696)

                                    at com.oracle.cie.gdr.patch.ComponentMetaDataPatchHandler.processComponentUpdatePatches(ComponentMetaDataPatchHandler.java:581)

                                    at com.oracle.cie.gdr.patch.PatchHandlerImpl.processUpdatePatch(PatchHandlerImpl.java:1430)

Below MOS document mentions this issue.

July 2023 CPU: Oracle WebLogic Server 12.2.1.4 and 14.1.1 PSU/SPB Fail to Apply with "GDR-70005: Failed to apply inventory patching to home."(Doc ID 2962593.1)

The cause is currently under investigation. Bug 35619659 was filed with deveolopment.

Last updated: July 20, 2023 1:30pm CDT

At this time there is no confirmed solution. Please check back for further information.

Please do not apply this patch, till Oracle publishes the fix. 

Error executing pagelet.

The below error message appears when you try to enable an existing pagelet for a new Role or Permission List.

Error executing pagelet.

Detailed error description:

The current user has insufficient privileges to complete this operation.

This happens, when you are modifying an existing pagelet that is generated using Pagelet Wizard in Portal Interaction hub (aka Enterprise Portal 9.1) and added a new permission List or Role using Structure and Content.

The issue is Pagelet Wizard has its own security that is stored in the below table.

select * from PS_PTPPB_SECURITY where ptppb_pagelet_id = 'YOUR_PAGELET_ID';

You can add the new permission List, by Going thru Pagelet Wizard steps again.

Menu Navigation : Portal Administration -> Pagelet -> Pagelet Wizard

Once you add the permission List or Role using the Pagelet wizard, this error will go away.

I encountered this issue for a Pagelet based on Navigation Collection. This is not properly documented and is difficult to troubleshoot. 

Base64 encoding in PeopleSoft

 There is a sample peoplecode delivered in App engine program used by Search engine indexing. It is PTSF_GENFEED -> Setup -> Step04 – PeopleCode

   

Local JavaObject &header = CreateJavaObject("java.lang.String", &esuser | ":" | Decrypt("", &espass));

   Local JavaObject &oEncoder = CreateJavaObject("com.peoplesoft.tools.util.Base64");

   &auth = &oEncoder.encode(&header.getBytes());

   &auth = "Authorization: Basic " | &auth;

You can also find references of delivered peoplecode using base64 using below SQL

select * from pspcmtxt where upper(PCTEXT) like '%BASE64%';

Calling SSL or https Web Service using WebLogic : javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

When trying to call an external web service Using PeopleSoft Integration broker, it is giving the following message

<Jul 23, 2019 6:47:30 PM EDT> <Notice> <Stdout> <BEA-000000> <[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', RECV TLSv1.2 ALERT:  fatal, bad_certificate>

in Integration Broker Gateway Server, You will see

HttpTargetConnector:ExternalSystemContactException Received fatal alert: bad_certificate
Message Set : 158, Message ID : 10721 IOException: The host couldn't be resolved.
To further debug, use the following options in setEnv,sh

JAVA_OPTIONS_LINUX="-server -Xms1024m -Xmx1024m -Dtuxedo.jolt.LLEDeprecationWarnLevel=NONE -Djavax.net.debug=all -XX:MaxPermSize=256m -Dtoplink.xml.platform=oracle.toplink.platform.xml.jaxp.JAXPPlatform -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

or
-Djavax.net.debug=ssl:handshake:verbose

Review this document

[Java SE] Training - How to Process javax.net.debug Diagnostic Output (Doc ID 2170565.1)

egrep -i "\* ClientHello|\* ServerHello|\* Certificate chain|\* CertificateRequest|\* ServerHelloDone|\* ClientKeyExchange|\* ServerKeyExchange|\* CertificateVerify|Change Cipher Spec|\* Finished|fatal|exception"  outputfile
egrep -v "^[0-9A-Z][0-9A-Z][0-9A-Z][0-9A-Z]:" outputfile
Resolution
This issue is caused by an expired SSL Certificate (PrivateKeyEntry) entry in pskey keystore located at

$PS_CFG_HOME/webserv/peoplesoft/piaconfig/keystore

To list the entries

cd $PS_CFG_HOME/webserv/peoplesoft/piaconfig/keystore
ls -lrt
keytool -list -keystore pskey -storepass xxx -alias xxx -v
or to list every thing
keytool -list -keystore pskey -storepass xxx -v > output.txt

Review the output for expired entry.

This can also happen, if you have a PrivateKeyEntry that is signed by a Root CA which is not present in the target Web Service Provider keystore.

Solution: Delete the expired or invalid PrivateKeyentry and restart the webserver

keytool -delete -keystore pskey -storepass xxx -alias xxx

This has resolved the issue.

Other issue is that if you do not have RootCA of the target Web Service provider SSL Certificate in your keystore then you will need to import it in your keystore.

errorLog

javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
 at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
 at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
 at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1972)
 at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1089)
 at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1325)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1352)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1336)
 at psft.pt8.pshttp.https.HttpsClient.doConnect(HttpsClient.java:246)
 at sun.net.NetworkClient.openServer(NetworkClient.java:136)
 at psft.pt8.pshttp.https.HttpClient.openServer(HttpClient.java:543)
 at psft.pt8.pshttp.https.HttpClient.<init>(HttpClient.java:364)
 at psft.pt8.pshttp.https.HttpsClient.<init>(HttpsClient.java:76)
 at psft.pt8.pshttp.https.HttpsClient.newClient(HttpsClient.java:132)
 at psft.pt8.pshttp.https.HttpsClient.newClient(HttpsClient.java:100)
 at psft.pt8.pshttp.https.HttpsURLConnection.connect(HttpsURLConnection.java:468)
 at psft.pt8.pshttp.PSHttp.getResponseCode(PSHttp.java:423)
 at com.peoplesoft.pt.integrationgateway.targetconnector.HttpTargetConnector.send(HttpTargetConnector.java:858)
 at com.peoplesoft.pt.integrationgateway.service.BasicConnectorInvocator.execute(BasicConnectorInvocator.java:131)
 at com.peoplesoft.pt.integrationgateway.framework.GatewayManager.invokeService(GatewayManager.java:148)
 at com.peoplesoft.pt.integrationgateway.framework.GatewayManager.connect(GatewayManager.java:192)
 at com.peoplesoft.pt.integrationgateway.listeningconnector.PeopleSoftListeningConnector.doPost(PeopleSoftListeningConnector.java:186)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:751)
 at com.peoplesoft.pt.integrationgateway.listeningconnector.PeopleSoftListeningConnector.service(PeopleSoftListeningConnector.java:87)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:844)
 at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:280)
 at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:254)
 at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:136)
 at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:346)
 at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:25)
 at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:79)
 at com.peoplesoft.pt.integrationgateway.common.IBFilter.doFilter(IBFilter.java:84)
 at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:79)
 at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3456)
 at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3422)
 at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:323)
 at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
 at weblogic.servlet.provider.WlsSubjectHandle.run(WlsSubjectHandle.java:57)
 at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2280)
 at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2196)
 at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2174)
 at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1632)
 at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:256)
 at weblogic.work.ExecuteThread.execute(ExecuteThread.java:311)
 at weblogic.work.ExecuteThread.run(ExecuteThread.java:263)


PIA_stderr

com.peoplesoft.pt.integrationgateway.common.ExternalSystemContactException: HttpTargetConnector:ExternalSystemContactException Received fatal alert: bad_certificate
 at com.peoplesoft.pt.integrationgateway.targetconnector.HttpTargetConnector.send(HttpTargetConnector.java:1296)
 at com.peoplesoft.pt.integrationgateway.service.BasicConnectorInvocator.execute(BasicConnectorInvocator.java:131)
 at com.peoplesoft.pt.integrationgateway.framework.GatewayManager.invokeService(GatewayManager.java:148)
 at com.peoplesoft.pt.integrationgateway.framework.GatewayManager.connect(GatewayManager.java:192)
 at com.peoplesoft.pt.integrationgateway.listeningconnector.PeopleSoftListeningConnector.doPost(PeopleSoftListeningConnector.java:186)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:751)
 at com.peoplesoft.pt.integrationgateway.listeningconnector.PeopleSoftListeningConnector.service(PeopleSoftListeningConnector.java:87)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:844)
 at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:280)
 at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:254)
 at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:136)
 at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:346)
 at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:25)
 at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:79)
 at com.peoplesoft.pt.integrationgateway.common.IBFilter.doFilter(IBFilter.java:84)
 at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:79)
 at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3456)
 at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3422)
 at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:323)
 at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
 at weblogic.servlet.provider.WlsSubjectHandle.run(WlsSubjectHandle.java:57)
 at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2280)
 at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2196)
 at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2174)
 at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1632)
 at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:256)
 at weblogic.work.ExecuteThread.execute(ExecuteThread.java:311)
 at weblogic.work.ExecuteThread.run(ExecuteThread.java:263)

Automate download of patches from Oracle Support

If you need to download the patches or software from My Oracle Support, you can use the below utility available at Github

getMOSPatch

The Github site has instructions on how to use this utility.

I have found some additional challenges when using this utility if you are behind a proxy.

• The way patch download process works is that you connect to MOS (support.oracle.com) using HTTPS for authentication and use http for actual file download. This requires you use the below command line argument to support for both http and https. The Github site readme only specifies using https, which works for authentication but fails to download the file.

java -Dhttp.proxyHost=aaa.com -Dhttp.proxyPort=80 -Dhttps.proxyHost=aaa.com -Dhttps.proxyPort=80 -jar getMOSPatch.jar MOSUser=aaa@aaa.com MOSPass=aaa platform=226P download=all patch=26557153

• I have also found that the code uses (Line 144) conn.setReadTimeout(60000); which is 1 minute. I have found that this may not be sufficient for the busy sites and it fails with the following message.  To avoid this issue, I simply changed it to conn.setReadTimeout(6000000); – 100 minutes and used the below to recompile the jar file.

Unzip the current jar to extract META-INF\MANIFEST.MF file to the folder where you store the java file. Also change the path to java. The below path are for Windows 8 and JDK 8.

"C:\Program Files\Java\jdk8\bin\javac.exe" -bootclasspath "C:\Program Files\Java\jdk8\jre\lib\rt.jar" -source 1.6 -target 1.6 getMOSPatch.java

"C:\Program Files\Java\jdk8\bin\jar.exe" cvmf META-INF/MANIFEST.MF getMOSPatch.jar getMOSPatch*.class

del *.class

Error Message if we do not change the setReadTimeout

Processing patch 26557153 for Linux x86-64 and applying regexp .* to the filenames:
  1 - p26557153_170151_Linux-x86-64.zip
  Enter Comma separated files to download: all
  All files will be downloadad because download=all was specified.

Downloading all selected files:
  java.net.SocketTimeoutException: Read timed out
        at java.net.SocketInputStream.socketRead0(Native Method)
        at java.net.SocketInputStream.socketRead(Unknown Source)
        at java.net.SocketInputStream.read(Unknown Source)
        at java.net.SocketInputStream.read(Unknown Source)
        at java.io.BufferedInputStream.fill(Unknown Source)
        at java.io.BufferedInputStream.read1(Unknown Source)
        at java.io.BufferedInputStream.read(Unknown Source)
        at sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
        at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
        at java.net.HttpURLConnection.getResponseCode(Unknown Source)
        at getMOSPatch.getHttpInputStream(getMOSPatch.java:146)
        at getMOSPatch.DownloadFile(getMOSPatch.java:171)
        at getMOSPatch.DownloadAllFIles(getMOSPatch.java:498)
        at getMOSPatch.main(getMOSPatch.java:540)

Applying latest Oracle Patch 22502456 Database Patch Set Update : 11.2.0.4.160419 for Oracle Run Time Client errors out

When trying to apply patch 22502456 to Oracle Runtime client using latest OPatch version 11.2.0.3.12
it fails with the following error. This patch is also included in combo patch : 22738777 - COMBO OF OJVM COMPONENT 11.2.0.4.160419 DB PSU + DB PSU 11.2.0.4.1604 (APR2016)


Verifying environment and performing prerequisite checks...
Skip patch 20760982 from list of patches to apply: This patch is not needed.
UtilSession failed: null
Log file location:
OPatch failed with error code 73
Log file error shows this.
[May 9, 2016 3:46:33 PM]     OUI-67073:UtilSession failed: null
[May 9, 2016 3:46:33 PM]     Finishing UtilSession at Mon May 09 15:46:33 EDT 2016
[May 9, 2016 3:46:33 PM]     Log file location: /opt/oracle/product/11.2.0.4/cfgtoollogs/opatch/opatch2016-05-09_15-46-25PM_1.log
[May 9, 2016 3:46:33 PM]     Stack Description: java.lang.NullPointerException
[May 9, 2016 3:46:33 PM]     StackTrace: java.lang.StringBuffer.<init>(StringBuffer.java:104)
[May 9, 2016 3:46:33 PM]     StackTrace: oracle.opatch.UtilSession.process(UtilSession.java:337)
[May 9, 2016 3:46:33 PM]     StackTrace: oracle.opatch.OPatchSession.main(OPatchSession.java:2580)
[May 9, 2016 3:46:33 PM]     StackTrace: oracle.opatch.OPatch.main(OPatch.java:634)


Oracle support is able to reproduce this issue however currently no workaround is provided.
They have internally 2 bugs opened to address this issue.


Bug 22932939 -- OPATCH FAILS TO PATCH RUNTIME CLIENT ENVIRONMENTS
Bug 22740194 - INSTALLATION OF 11.2.0.4.7 AND LATER PSU FAILS IN RUNTIME CLIENT ENVIRONMENT

Portal Home Page Displays Error : Error getting content for remote pagelet.

When you are logging on to a Portal Home Page which displays Remote pagelets, You get this error randomly.

Error Message: Error getting content

When you click on "Detailed Error Description", You will get this

Unable to get document

Error occurred while accessing target page.

To see the further details, Please log in to your webserver and open the following log files. If you have more than 1 web server you may have to go to each web server to see the content.


Log File Location : $PS_CFG_HOME/webserv/peoplesoft/servers/PIA/logs (This is for PeopleTools 8.53 and higher).
Log File Names are below
PIA_servlets0.log.0
PIA_servlets1.log.0
PIA_servlets2.log.0


If you open any one of these log file, You will see the following


2000-01-07T11:47:21.185         9259 163517125      unknown SEVERE psft.pt8.psp logError Error for User: abc Error Message: Unable to get document:  Requested URL: https://abc.com Target URL:  Error reading from server


Resolution:
If you do not have security issue or single signon issue, Please check the default HTTP Header size allowed by your Load balancer that you use for multiple webservers.  In Case of Cisco ACE Loadbalancer default is : 4096 bytes. Increasing it to 32768 helps in resolving this issue.


For Cisco Ace this parameter is :

set header-maxparse-length 32768

If you use a different Load balancer for e.g. F5 LTM then I believe the default is already 32768.  You can contact your Load balancer vendor to determine the default HTTP Header size.

Upload image to Image Catalog

In PeopleTools 8.53 PeopleSoft has provided an online PIA page to upload the images or modify an existing images without using App designer. This is really helpful if you want to change an image, but do not want to migrate application project just for updating the image.
Page name : Layout Image Upload

Navigation : Main Menu>PeopleTools>Mobile Application Platform>MAP Utilities>Layout Image Upload

For some reason, Mobile Application Platform is hidden in Portal structure and contents, but you can still access the Layout Image Upload page by searching.

PeopleSoft Support of TLS 1.2 when connecting to LDAP/HTTP servers using LDAPS/HTTPS URLs

Currently all PeopleSoft PeopleTools releases including 8.55 only supports Java 1.7 for the Appserver. Java 1.7 by default only enables support for SSL 3.0 and TLS 1, though it supports both TLS 1.1. and TLS 1.2. They are not enabled by default. This is easy to fix for HTTPS connections by modifying JavaVM options the following parameter to Appserver (psappsrv.cfg) and Batch server (psprcs.cfg) config files

JavaVM Options=-Dxdo.ConfigFile=%PS_HOME%/appserv/xdo.cfg -Xms32m -Xmx128m -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2

Once you modify the Parameter, simply restart the Appserver or batch server and it will take effect. There is no need to reconfigure the appserver or batch server.

Please note this only work for HTTPS connections for e.g. when connecting to Integration Gateway Web server which only accepts TLS 1.1 or TLS 1.2 connections.

To make this also work for LDAP or Directory server that is configured to accept only TLS 1.2 connections for compliance with PCI DSS v3.1 (mandatory after June 30 2016), a code change to $PS_HOME/appserv/classes/psft/pt8/pshttp/PSLdapSSLSocketFactory.class is required so that it uses TLSv1.2 instead of SSL for the below code line.

SSLContext sslcontext = SSLContext.getInstance("SSL");

needs to be changed to

SSLContext sslcontext = SSLContext.getInstance("TLSv1.2");

Currently there are no configuration parameters to fix this issue. Please open a support case with Oracle and reference the below bug number if you need the fix for this issue.

There is an open PeopleSoft bug to address this issue.

22323376 - LDAP FAILS TO CONNECT TO LDAP SERVER USING TLS 1.2 to address this issue.

This will impact any PeopleSoft applications that are considered as PCI In scope applications and uses TLS 1.2 for Autnetication with LDAP Directory server using LDAPS protocol.

You will see the following error in the Appserver when connecting to LDAP server using delivered Page.

[Root exception is javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake]

Please note PeopleSoft uses JNDI to connect to LDAP Directory server via delivered Directory Interface Business interlink.

Global Database Link feature in Oracle 11G can result in Peoplesoft Signon Failure

If you use Oracle Internet Directory (OID) to resolve database names, then you have this feature enabled by default. With Global database link feature, users can access tables/view in other database using @dbname syntax even when there is no explicit database link is created. For e.g User A logged in to Database A using his personal id : XXXX can run the below query to access table in database b. Only thing that is needed to make this work is that password for the user A must be same in both database A and B.

select * from ps_job@databaseb

This may create a potential locking situation,if password in database are not synced up and there is an account lock policy implemented to lock account after x invalid attempts. As soon as user runs more than x sql statements using global database link feature, it will lock the account in database b. When you look at dba audit trail, you will see the connection attempt was made by oracle user and machine name will be of database server machine name. This makes it confusing to determine how this account got locked up.

This is even more dangerous, if some one runs a SQR or Application engine program using peoplesoft process scheduler with a remotedbname sysntax for sql for e.g. ps_job@databaseb

This is because, PeopleSoft process scheduler runs the sql using database access id in database A, which inurn access the database b using the access id password in Database A. Most likely you would keep the database access id password (default : SYSADM) different for different databases and this can potentially lock the sysadm password in database B due to account lock out policy. If this happens, users will see when trying to access the application

“Bea.jolt.serviceexception: TPENOENT – No entry”

You can find more information on this at My Oracle Support

What are Global Database Link and How do you Disable them? (Doc ID 1632329.1)

http://docs.oracle.com/cd/E11882_01/server.112/e25494/ds_concepts.htm#ADMIN02801

If this happens in your environment, Please check if database access id is locked out. If yes, unlock the database access id and restart all your app and batch servers.

ios9 Safari PeopleSoft Pages appear zoomed

After the recent upgrade to iOS9 from iOS 8.4.1 on iPAd Air and iPhone 6, PeopleSoft pages appears zoomed and entire UI looks messed up using safari. Our PeopleTools environment is 8.53.12 and this is reproducible in multiple demo environments including HR and Portal 9.1.

Stpes to reproduce the issue

1. Login to HRMS 9.1/Portal 9.1 Demo instance using iPad or iPhone running iOS9 using Safari

2. Open System Profile page

Screenshot of the zoomed page.

Update from Oracle Support

This is a known issue tracked by

Bug 21626379 - IOS 9 BETA 5: CLASSIC PAGES ARE NOT RENDERING PROPERLY.

Apple Development is currently working on the issue

Updates : Issue is not resolved even with release of 9.1 and according to apple support they are still investigating the issue and it will be fixed in some unknown future release. Meanwhile Oracle has provided the workaround. Please test carefully before applying the workaround.

Please refer to following E-PIA Peoplesoft Classic Pages Are Not Rendering Correctly In IOS 9 (Doc ID 2057957.1)

for the workaround. It is different for 8.53 and below and 8.54 and above. 

You are not authorized to access this component. (40 20)

You may see this error message, even if you have granted correct security. To resolve this please run the below sql. Open the role and delete the orphan permission list or remove the role from the user and issue will be fixed.

This was happening as user has a role that had a permission list that did not existed in the database. This happens when the project is migrated to target database but does not include the permission list.

non-existing permission list assigned to the role.

Select R.rolename
, RC.classid
From psroleuser R
, psroleclass RC
Where RC.Rolename = R.Rolename
And not exists
(Select 'X' from psclassdefn C
Where C.classid = RC.classid)
And R.roleuser = '[--OPRID—]'

Original Post appeared in :

http://eliandokp.blogspot.com/2010/02/component-error-you-are-not-authorized.html

Running a BI Publisher Report from an online page logs user out of PIA

When user runs a BI Publisher Report from an online PIA page by clicking a button and this report is based on a Query, user sees the below message.

An error has occurred. You may attempt to sign in again. If your attempt fails, please contract your System Administrator.
Please make sure Webserver and Appserver are up. null

In the Appserver Log, we see the error

PSPAL: Abort: Unexpected signal received
PSPAL: Abort: Location: /vob/peopletools/src/pspal/exception_sigaction.cpp:494: RecoverableSignalHandler
PSPAL: Abort: Generating process state report to /opt/test/psft/pt/8.53/appserv/prd/LOGS/PSAPPSRV.10742/process_state.txt

Inside the process_state.txt, we see that RuntoFile is actually generating the exception and killing the appserver thread.

#2  0x00007f7012a8f224 in PSPAL::DumpProcessState::GenerateAbortDiagnostics(char const*, PSPAL::ExceptionContext*) () from /opt/test/tools/bin/libpspal64.so    #3  0x00007f7012a8386b in PSPAL::Abort(char const*, char const*, int, char const*, PSPAL::ExceptionContext*) () from /opt/test/tools/bin/libpspal64.so
   #4  0x00007f7012a89191 in PSPAL::SigactionSignalHandler::RecoverableSignalHandler(int, siginfo*, void*) () from /opt/test/tools/bin/libpspal64.so
   #5  0x00007f7012a89a65 in PSPAL::SigactionSignalHandler::SignalHandler(int, siginfo*, void*) () from /opt/test/tools/bin/libpspal64.so
   #6  0x00007f6ff6e15f12 in os::Linux::chained_handler(int, siginfo*, void*) () from /opt/test/tools/jre/lib/amd64/server/libjvm.so
   #7  0x00007f6ff6e1bbf6 in JVM_handle_linux_signal () from /opt/test/tools/jre/lib/amd64/server/libjvm.so
   #8  <signal handler called>
   #9  0x00007f700f03619f in QpmEnd () from /opt/test/tools/bin/libpssys.so
   #10 0x00007f70088b7815 in CPSQuery::CleanupQueryExecution(void*, void*) () from /opt/test/tools/bin/libpsoftapi.so
   #11 0x00007f70088fa777 in CPSQuery::RunToFile(IPSRecBuf*, wchar_t const*, int, int) () from /opt/test/tools/bin/libpsoftapi.so
   #12 0x00007f70088c28fc in _IPSQuery::InvokeMethod(wchar_t const*, IPSApiVariant*, IPSApiVariant**, int) () from /opt/test/tools/bin/libpsoftapi.so

Resolution: Please determine the Records used in PeopleSoft query that is used in BI Publisher Report definition. Please make sure that this record is added to permission list that belongs to the user running this report using Query tab in permission list component and accessing the Access group link. Once the permission list is modified add the permission list to the Role that is assigned to user if not already added. This resolves the issue. Noted this in PT 8.53.12.

Enable support for SHA256 SSL Certificate in PeopleSoft using WebLogic Web server.

Note: This is applicable for mainly PeopleTools 8.53 and it may or may not work with lower PeopleTools (8.52 or lower) or higher PeopleTools 8.54. Also this pertains to WebLogic and may not be applicable for Web Sphere.

WebLogic version used is 10.36.0

Step 1: Update the WebLogic to latest Patch Set update. If you already have WebLogic patch set update installed, you will need to uninstall it including one off patches and reinstall the latest Patch Set update for e.g. 10.3.6.0_10 for WebLogic 10.3.6. In case of WebLogic 10.3.6.0_10 please also apply the below one off patches to avoid SSLEngine is closed errors.

Patch 19637463: SU Patch [12UV]: WLS PATCH SET UPDATE 10.3.6.0.10

Patch 20674162: SU Patch [9UB4] :10.3.6.0.10 Overlay: MERGE REQUEST ON TOP OF WLS PSU 10.3.6.0.10 FOR BUGS 13244304 13371700 13405083 13869852

Patch 16810786: SU Patch [SK1V]: MEMORY LEAK ON COM.CERTICOM.TLS.INTERFACEIMPL.CERTIFICATESUPPORT

Step 2 : Disable SSL3 support for WebLogic (This is optional but highly recommended step to avoid security issues).

Add -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 to JAVA_OPTIONS in setEnv.sh for appropriate OS you are using. For linux it is

JAVA_OPTIONS_LINUX="-server -Xms1024m -Xmx1024m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -XX:MaxPermSize=256m -Dtoplink.xml.platform=oracle.toplink.platform.xml.jaxp.JAXPPlatform -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

If you are using both Managed Server and Admin Server, search for below line

#Changed the java min and max heap values for admin server

and update the below

Linux|LINUX)

                    JAVA_OPTIONS="-server -Xms256m -Xmx256m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -XX:MaxPermSize=128m -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

Please note that once you do this any WebLogic utilities inclusing WLST (WebLogic Scripting tool), must add the below to Java command line invoking them

-Dweblogic.security.SSL.enableJSSE=true -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1

Otherwise you may see errors.

Also you will need to Go to WebLogic Console –> Servers –> PIA, WebLogicAdmin –> SSL Tab –> Advanced and select Enable JSSE checkbox.

Also you may want to upgrade to JRE or JDK 1.7.0_76 (or latest Oracle supported JRE / JDK for your weblogic server version).

Step 3: Remove the bouncy castle JAR file from CLASSPATH by moving it from lib folder for each webserver.

mv $PS_CFG_HOME/webserv/peoplesoft/applications/peoplesoft/lib/bcprov-jdk15-132.jar $HOME/tmp/

If you do not do this WebServer becomes unresponsive or takes longer to respond. Connection Reset errors will be seen in Chrome/FireFox/IE/Safari browsers when you will be using any ECDHE cipher suites.

Removing this Jar file, may impact some cryptographic functions though everything is working fine in our environment including webservice security. This is supposed to be part of wss4j-1.5.9.jar (Apache Web Services Security module) which is bundled with PeopleTools. This issue was observed in those web servers where we have enabled Integration broker gateway servers and use web services that involves security.

Restart the WebLogic after all the changes are complete and SSL certificate is imported in pskey using pskeymanager.sh

Also if there are any other applications are connecting to you using SSL or https, they will need to support SHA256 which in WebLogic 10.3.4 or higher is to enable JSSE support in WebLogic console or if your version is lower than 10.3.4 , use Sun HTTP Handler which automatically enables JSSE support.

How to Change Weblogic to Use the Sun SSL Implementation Rather Than Certicom
(Doc ID 1242974.1)

The SSL implementation and SSL Handler can be changed by setting the following flags on startup:
-Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol
-Dssl.SocketFactory.provider=com.sun.net.ssl.internal.SSLSocketFactoryImpl
-DUseSunHttpHandler=true
Also for Webservice clients, include:
-Dweblogic.wsee.client.ssl.usejdk=true

In the end Test! Test! Test! that all of this works correctly.

In summary supporting SHA256 support using WebLogic 10.3.6 or lower requires series of changes to make this work. Plan ahead and allocate enough resources to handle this migration. This will become important as major browsers will start flagging SHA1 certificates as insecure.

Useful resources : http://www.ssllabs.com and test your public website using their site scanner. Enable support for TLS 1.0, 1.1 and 1.2 and disable SSL 3.0 support in IE. For firefox/Chrome upgrade to latest version to automatically disable support for SSL 3.0.

If you encounter specific issues related to SHA256 implementation with WebLogic and PeopleSoft leave comments and I can try to provide help.

List of Bugs fixed in Patch Set Update - Doc ID 1942223.1

Some of the Error Messages I have encountered if settings are not correct are

javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received. (If JSSE is not enabled. Certicom SSL implementation does not support SHA256).

Enablig JSSE in WebLogic

<BEA-101104> <Servlet execution in servlet context "ServletContext@445892755[app:peoplesoft module:/ path: spec-version:2.5]" failed, java.io.IOException: SSLEngine is closed. at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:383)

<BEA-101083> <Connection failure java.io.IOException: SSLEngine is closed at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:385)

<BEA-000000> <weblogic.utils.net.SocketResetException: SSLEngine is closed>  at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:431) only with Apple Safari Client when fetching CSS or Java Script using peoplesoft cs servlet.

java.lang.RuntimeException: Could not generate DH keypair

Caused By: java.security.InvalidAlgorithmParameterException: unknown curve name: 1.2.840.10045.3.1.7
    at org.bouncycastle.jce.provider.JDKKeyPairGenerator$EC.initialize(Unknown Source)
    at sun.security.ssl.ECDHCrypt.<init>(ECDHCrypt.java:63)

To Enable SSL Debug options

# JAVA SSL DEBUG (in setEnv.sh) to troubleshoot SSL handshake issues.

#JAVA_OPTIONS_LINUX="-server -Xms1024m -Xmx1024m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -Dssl.debug=true -Dweblogic.StdoutDebugEnabled=true -Dweblogic.security.SSL.verbose=true -Djavax.net.debug=all -XX:MaxPermSize=256m -Dtoplink.xml.platform=oracle.toplink.platform.xml.jaxp.JAXPPlatform -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

Application Designer Compare Report Slow

Recently After upgrade to People Tools 8.53 from PT 8.50, We have noticed that for a large project (611 items) compare report is running really slow taking more than 1 hour. This was even more slow (3 hours) if the database is located in remote data center.

Since People Tools 8.51 , PeopleSoft added the ability to write compare reports to database tables which was really causing this slowness.

If you are not planning to use the database tables to review compare reports, please do the following to speed the compare report process.

Go to Compare and Report –> Options

Select Report Option Tab and Uncheck Generate Output to tables.

This fixed the issue. you can also truncate the below tables if you do not need to store the previous version of compare reports.

truncate table PSCOMPDEFN;
truncate table PSCOMPITEM;
truncate table PSCOMPITEMDATA;
truncate table PSCOMPSESSION;
truncate table PSCOMPOBJDIFF;
truncate table PSCOMPOBJLONG;

The first 3 tables are no longer used in PT 8.54

MOS (My Oracle Support Articles)

E-UPG PT8.51+: Are Tables Updated with Compare Report Data? (Doc ID 1290456.1)

E-COMP: Generate Output To Tables Option Not Writing Results To The Tables In 8.54 (Doc ID 1958074.1)

E-PUM: How to Improve Performance on Step "Comparing ADS MO Project From File" (Doc ID 1965298.1)

Also you can export the configuration manger config file and add the following under PSIDE section below after line : UpgXmlOutput=REG_DWORD=0

UpgTblOutput=REG_DWORD=0

You can then use this config file to install other workstations with same configuration.

Alternatively, you can add the below to a notepad and save as psidecompare.reg and ask user to run it manually to change the setting.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\PeopleSoft\PeopleTools\Release8.40\PSIDE]
"UpgTblOutput"=dword:00000000

IE9 Save As or Save Target As not working after applying update KB3008923 on Windows 7 SP1 64 Bit machine

Update : After applying the Latest Cumulative Security Update KB3032359 - MS15-018: Cumulative security update for Internet Explorer: March 10, 2015 Save As is working fine again. Also this resolves IE9 Freak Vulnerability as well. 

If you have applied the update KB3008923 , you may not be able to open any Microsoft office document (doc, docx, xls, xlsx, ppt, pptx) etc. Also If you try to download a software and try to use Save As option from the toolbar, it does not work. If you right click on a link and Select Save Target As that also does not work.

This issue is not mentioned on the Microsoft site http://support.microsoft.com/kb/3008923 

Though they recommend manually applying update KB3025945 (

http://support.microsoft.com/kb/3025945) to resolve IE9 Crash issue, it does not fix the issue.

To resolve the issue, I have to uninstall both KB3025945 and KB3008923 and once I did that everything started working normally. I would advise not to install this update till Microsoft come up with a replacement fix using windows update.

This will impact PeopleSoft Excel Query download functionality any word document download.

To uninstall the update, go to Control Panel and Search for “Installed updates” and Select View Installed Updates under Programs and Features

In the Search dialog at the top right type KB3025945 first and then KB3008923 and select uninstall  after right clicking on the selected update. You will need to restart the machine after each update is uninstalled.

(NET.334): Tuxedo cannot find the service RunAeAsync2. Make sure the application server advertising this service is booted.

If your users are calling and telling you that App engine processes are remaining in initiated status for longer time ( > 5 minute) and you observe the following message. (Assuming PSAESRV is configured)

in the $PS_CFG_HOME/appserv/prcs/<domain>/LOGS folder for SCHDLR_MMYY.LOG you will see the message

(NET.334): Tuxedo cannot find the service RunAeAsync2.  Make sure the application server advertising this service is booted.

To see all files that has this message

grep NET.334 SCHDLR*.LOG | cut -d : -f 1 | sort -u

Please note the number at the end of RunAeAsync. It could be 1 thru n depending on number of PSAESRV configured. What this message means that the PSAESRV and number at the RunAeSync is not running for e.g. in this case PSAESRV that provides service RunAeSync2 is not running.

You will also see in the same folder for TUXLOG.MMDDYY the following message

010135.abc.com!restartsrv.16887.414156544.-2: server AESRV/2: CMDTUX_CAT:1684: ERROR: Application initialization failure

010135.abc.com!restartsrv.16887.414156544.-2: server AESRV/2: CMDTUX_CAT:587: INFO: Cannot restart server, scheduling for cleanup

grep CMDTUX_CAT:1684 TUXLOG.*

Resolution

What this means is that for some reason PSAESRV has crashed and Tuxedo restart process is not able to restart PSAESRV process.

You have 2 option 2 fix the issue.

Option 1 : Shutdown and Restart the server

Option 2: Manually start the PSAERV process using command line without shutting down and restarting the server.

Option 2 is preferred, if you have other PSAESRV processes running in process monitor that will be killed if you try to stop the process scheduler.

Start PSADMIN (cd $PS_HOME/appserv; ./psadmin)

Select 2 for process Scheduler

Select 1 for Administer a domain

Select 1for appropriate Process Scheduler Domain

Select 5 for TUXEDO command line (tmadmin)

Type

boot -g AESRV -i 1

(Change -I 1 to appropriate number for PSAESRV process that crashed Determined from the number at the end of RunAeSync).

Observed this issue in PeopleTools : 8.53.12 and Linux : Red Hat 6.3 64 bit.

Unable to find a Routing Corresponding to the incoming Request Message (158,505)

When testing a WSDL or WADL you are getting the above message in the output Unable to find a Routing Corresponding to the incoming Request Message (158,505). for e.g. after publishing the WSDL for Soap or WADL for Rest, you try to view the WSDL or WADL and get the above message. 

1. Make sure that GETWADL and GETWSDL Service Operation which is part of IB_UTILITY Service is active and has any to local routing defined and active. Once you add the missing routing, Go to Routing Definition and Select Parameter Tab and make sure that External alias is exactly GetWADL for GETWADL and GetWSDL for GETWSDL. If it is anything other for e.g. GETWADL or GETWADL.V1 it will not work.

See following My Oracle Support Resolutions 1949257.1 and 1572531.1 for more information.

Sample URL to view WADL and WSDL are

WADL (REST)

http://piahostname.com/PSIGW/RESTListeningConnector/PSFT_PA/PTCS_SECURITY.1.wadl

WSDL (SOAP)
http://piahostname.com/PSIGW/PeopleSoftServiceListeningConnector/PSFT_PA/PTCS_SECURITY.1.wsdl

To find out which WSDL or WADL are published to  WSDL Repository, Do the following Select.

select * from PSIBWSDLDFN;

Note: This is tested in 8.53.09 and 8.53.12 but may be valid for other PeopleTools version as well.

Deleting Rows in ExcelToCI

Go to http://www.cedarhillsgroup.com/knowledge-base/kbarticles/deleting-rows-in-exceltoci to see How to modify delivered ExcelToCI template to delete rows which is not delivered by default. One of the use case is delete roles from user profiles in mass without using backend SQL . This uses delivered USER_PROFILE component interface. Tested in PT 8.53 and works fine. Make sure that you select Action as UPDATEDATA in Connect Information worksheet of ExcelToCI

In Summary, Go to Tools | Macros | Visual Basic Editor

Open StagingAndSubmission Module and Navigate to WriteCollectionHeader function do the following.

You will see a case statement “Select Case lScrollLevel”

Change the “Case 1” statement as PSROLEUSER is in level 1. If your target rows exist in other levels, you will need to modify that Case statement.

sXmlLine = sIndent & "<" & sXmlTag & ">"

To

sXmlLine = sIndent & “<” & sXmlTag & " CINodeAction=""DELETE"">"