Global Database Link feature in Oracle 11G can result in Peoplesoft Signon Failure

If you use Oracle Internet Directory (OID) to resolve database names, then you have this feature enabled by default. With Global database link feature, users can access tables/view in other database using @dbname syntax even when there is no explicit database link is created. For e.g User A logged in to Database A using his personal id : XXXX can run the below query to access table in database b. Only thing that is needed to make this work is that password for the user A must be same in both database A and B.

select * from ps_job@databaseb

This may create a potential locking situation,if password in database are not synced up and there is an account lock policy implemented to lock account after x invalid attempts. As soon as user runs more than x sql statements using global database link feature, it will lock the account in database b. When you look at dba audit trail, you will see the connection attempt was made by oracle user and machine name will be of database server machine name. This makes it confusing to determine how this account got locked up.

This is even more dangerous, if some one runs a SQR or Application engine program using peoplesoft process scheduler with a remotedbname sysntax for sql for e.g. ps_job@databaseb

This is because, PeopleSoft process scheduler runs the sql using database access id in database A, which inurn access the database b using the access id password in Database A. Most likely you would keep the database access id password (default : SYSADM) different for different databases and this can potentially lock the sysadm password in database B due to account lock out policy. If this happens, users will see when trying to access the application

“Bea.jolt.serviceexception: TPENOENT – No entry”

You can find more information on this at My Oracle Support

What are Global Database Link and How do you Disable them? (Doc ID 1632329.1)

http://docs.oracle.com/cd/E11882_01/server.112/e25494/ds_concepts.htm#ADMIN02801

If this happens in your environment, Please check if database access id is locked out. If yes, unlock the database access id and restart all your app and batch servers.

Enable support for SHA256 SSL Certificate in PeopleSoft using WebLogic Web server.

Note: This is applicable for mainly PeopleTools 8.53 and it may or may not work with lower PeopleTools (8.52 or lower) or higher PeopleTools 8.54. Also this pertains to WebLogic and may not be applicable for Web Sphere.

WebLogic version used is 10.36.0

Step 1: Update the WebLogic to latest Patch Set update. If you already have WebLogic patch set update installed, you will need to uninstall it including one off patches and reinstall the latest Patch Set update for e.g. 10.3.6.0_10 for WebLogic 10.3.6. In case of WebLogic 10.3.6.0_10 please also apply the below one off patches to avoid SSLEngine is closed errors.

Patch 19637463: SU Patch [12UV]: WLS PATCH SET UPDATE 10.3.6.0.10

Patch 20674162: SU Patch [9UB4] :10.3.6.0.10 Overlay: MERGE REQUEST ON TOP OF WLS PSU 10.3.6.0.10 FOR BUGS 13244304 13371700 13405083 13869852

Patch 16810786: SU Patch [SK1V]: MEMORY LEAK ON COM.CERTICOM.TLS.INTERFACEIMPL.CERTIFICATESUPPORT

Step 2 : Disable SSL3 support for WebLogic (This is optional but highly recommended step to avoid security issues).

Add -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 to JAVA_OPTIONS in setEnv.sh for appropriate OS you are using. For linux it is

JAVA_OPTIONS_LINUX="-server -Xms1024m -Xmx1024m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -XX:MaxPermSize=256m -Dtoplink.xml.platform=oracle.toplink.platform.xml.jaxp.JAXPPlatform -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

If you are using both Managed Server and Admin Server, search for below line

#Changed the java min and max heap values for admin server

and update the below

Linux|LINUX)

                    JAVA_OPTIONS="-server -Xms256m -Xmx256m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -XX:MaxPermSize=128m -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

Please note that once you do this any WebLogic utilities inclusing WLST (WebLogic Scripting tool), must add the below to Java command line invoking them

-Dweblogic.security.SSL.enableJSSE=true -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1

Otherwise you may see errors.

Also you will need to Go to WebLogic Console –> Servers –> PIA, WebLogicAdmin –> SSL Tab –> Advanced and select Enable JSSE checkbox.

Also you may want to upgrade to JRE or JDK 1.7.0_76 (or latest Oracle supported JRE / JDK for your weblogic server version).

Step 3: Remove the bouncy castle JAR file from CLASSPATH by moving it from lib folder for each webserver.

mv $PS_CFG_HOME/webserv/peoplesoft/applications/peoplesoft/lib/bcprov-jdk15-132.jar $HOME/tmp/

If you do not do this WebServer becomes unresponsive or takes longer to respond. Connection Reset errors will be seen in Chrome/FireFox/IE/Safari browsers when you will be using any ECDHE cipher suites.

Removing this Jar file, may impact some cryptographic functions though everything is working fine in our environment including webservice security. This is supposed to be part of wss4j-1.5.9.jar (Apache Web Services Security module) which is bundled with PeopleTools. This issue was observed in those web servers where we have enabled Integration broker gateway servers and use web services that involves security.

Restart the WebLogic after all the changes are complete and SSL certificate is imported in pskey using pskeymanager.sh

Also if there are any other applications are connecting to you using SSL or https, they will need to support SHA256 which in WebLogic 10.3.4 or higher is to enable JSSE support in WebLogic console or if your version is lower than 10.3.4 , use Sun HTTP Handler which automatically enables JSSE support.

How to Change Weblogic to Use the Sun SSL Implementation Rather Than Certicom
(Doc ID 1242974.1)

The SSL implementation and SSL Handler can be changed by setting the following flags on startup:
-Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol
-Dssl.SocketFactory.provider=com.sun.net.ssl.internal.SSLSocketFactoryImpl
-DUseSunHttpHandler=true
Also for Webservice clients, include:
-Dweblogic.wsee.client.ssl.usejdk=true

In the end Test! Test! Test! that all of this works correctly.

In summary supporting SHA256 support using WebLogic 10.3.6 or lower requires series of changes to make this work. Plan ahead and allocate enough resources to handle this migration. This will become important as major browsers will start flagging SHA1 certificates as insecure.

Useful resources : http://www.ssllabs.com and test your public website using their site scanner. Enable support for TLS 1.0, 1.1 and 1.2 and disable SSL 3.0 support in IE. For firefox/Chrome upgrade to latest version to automatically disable support for SSL 3.0.

If you encounter specific issues related to SHA256 implementation with WebLogic and PeopleSoft leave comments and I can try to provide help.

List of Bugs fixed in Patch Set Update - Doc ID 1942223.1

Some of the Error Messages I have encountered if settings are not correct are

javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received. (If JSSE is not enabled. Certicom SSL implementation does not support SHA256).

Enablig JSSE in WebLogic

<BEA-101104> <Servlet execution in servlet context "ServletContext@445892755[app:peoplesoft module:/ path: spec-version:2.5]" failed, java.io.IOException: SSLEngine is closed. at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:383)

<BEA-101083> <Connection failure java.io.IOException: SSLEngine is closed at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:385)

<BEA-000000> <weblogic.utils.net.SocketResetException: SSLEngine is closed>  at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:431) only with Apple Safari Client when fetching CSS or Java Script using peoplesoft cs servlet.

java.lang.RuntimeException: Could not generate DH keypair

Caused By: java.security.InvalidAlgorithmParameterException: unknown curve name: 1.2.840.10045.3.1.7
    at org.bouncycastle.jce.provider.JDKKeyPairGenerator$EC.initialize(Unknown Source)
    at sun.security.ssl.ECDHCrypt.<init>(ECDHCrypt.java:63)

To Enable SSL Debug options

# JAVA SSL DEBUG (in setEnv.sh) to troubleshoot SSL handshake issues.

#JAVA_OPTIONS_LINUX="-server -Xms1024m -Xmx1024m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -Dssl.debug=true -Dweblogic.StdoutDebugEnabled=true -Dweblogic.security.SSL.verbose=true -Djavax.net.debug=all -XX:MaxPermSize=256m -Dtoplink.xml.platform=oracle.toplink.platform.xml.jaxp.JAXPPlatform -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

IE9 Save As or Save Target As not working after applying update KB3008923 on Windows 7 SP1 64 Bit machine

Update : After applying the Latest Cumulative Security Update KB3032359 - MS15-018: Cumulative security update for Internet Explorer: March 10, 2015 Save As is working fine again. Also this resolves IE9 Freak Vulnerability as well. 

If you have applied the update KB3008923 , you may not be able to open any Microsoft office document (doc, docx, xls, xlsx, ppt, pptx) etc. Also If you try to download a software and try to use Save As option from the toolbar, it does not work. If you right click on a link and Select Save Target As that also does not work.

This issue is not mentioned on the Microsoft site http://support.microsoft.com/kb/3008923 

Though they recommend manually applying update KB3025945 (

http://support.microsoft.com/kb/3025945) to resolve IE9 Crash issue, it does not fix the issue.

To resolve the issue, I have to uninstall both KB3025945 and KB3008923 and once I did that everything started working normally. I would advise not to install this update till Microsoft come up with a replacement fix using windows update.

This will impact PeopleSoft Excel Query download functionality any word document download.

To uninstall the update, go to Control Panel and Search for “Installed updates” and Select View Installed Updates under Programs and Features

In the Search dialog at the top right type KB3025945 first and then KB3008923 and select uninstall  after right clicking on the selected update. You will need to restart the machine after each update is uninstalled.