Enable support for SHA256 SSL Certificate in PeopleSoft using WebLogic Web server.

Note: This is applicable for mainly PeopleTools 8.53 and it may or may not work with lower PeopleTools (8.52 or lower) or higher PeopleTools 8.54. Also this pertains to WebLogic and may not be applicable for Web Sphere.

WebLogic version used is 10.36.0

Step 1: Update the WebLogic to latest Patch Set update. If you already have WebLogic patch set update installed, you will need to uninstall it including one off patches and reinstall the latest Patch Set update for e.g. 10.3.6.0_10 for WebLogic 10.3.6. In case of WebLogic 10.3.6.0_10 please also apply the below one off patches to avoid SSLEngine is closed errors.

Patch 19637463: SU Patch [12UV]: WLS PATCH SET UPDATE 10.3.6.0.10

Patch 20674162: SU Patch [9UB4] :10.3.6.0.10 Overlay: MERGE REQUEST ON TOP OF WLS PSU 10.3.6.0.10 FOR BUGS 13244304 13371700 13405083 13869852

Patch 16810786: SU Patch [SK1V]: MEMORY LEAK ON COM.CERTICOM.TLS.INTERFACEIMPL.CERTIFICATESUPPORT

Step 2 : Disable SSL3 support for WebLogic (This is optional but highly recommended step to avoid security issues).

Add -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 to JAVA_OPTIONS in setEnv.sh for appropriate OS you are using. For linux it is

JAVA_OPTIONS_LINUX="-server -Xms1024m -Xmx1024m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -XX:MaxPermSize=256m -Dtoplink.xml.platform=oracle.toplink.platform.xml.jaxp.JAXPPlatform -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

If you are using both Managed Server and Admin Server, search for below line

#Changed the java min and max heap values for admin server

and update the below

Linux|LINUX)

                    JAVA_OPTIONS="-server -Xms256m -Xmx256m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -XX:MaxPermSize=128m -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

Please note that once you do this any WebLogic utilities inclusing WLST (WebLogic Scripting tool), must add the below to Java command line invoking them

-Dweblogic.security.SSL.enableJSSE=true -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1

Otherwise you may see errors.

Also you will need to Go to WebLogic Console –> Servers –> PIA, WebLogicAdmin –> SSL Tab –> Advanced and select Enable JSSE checkbox.

Also you may want to upgrade to JRE or JDK 1.7.0_76 (or latest Oracle supported JRE / JDK for your weblogic server version).

Step 3: Remove the bouncy castle JAR file from CLASSPATH by moving it from lib folder for each webserver.

mv $PS_CFG_HOME/webserv/peoplesoft/applications/peoplesoft/lib/bcprov-jdk15-132.jar $HOME/tmp/

If you do not do this WebServer becomes unresponsive or takes longer to respond. Connection Reset errors will be seen in Chrome/FireFox/IE/Safari browsers when you will be using any ECDHE cipher suites.

Removing this Jar file, may impact some cryptographic functions though everything is working fine in our environment including webservice security. This is supposed to be part of wss4j-1.5.9.jar (Apache Web Services Security module) which is bundled with PeopleTools. This issue was observed in those web servers where we have enabled Integration broker gateway servers and use web services that involves security.

Restart the WebLogic after all the changes are complete and SSL certificate is imported in pskey using pskeymanager.sh

Also if there are any other applications are connecting to you using SSL or https, they will need to support SHA256 which in WebLogic 10.3.4 or higher is to enable JSSE support in WebLogic console or if your version is lower than 10.3.4 , use Sun HTTP Handler which automatically enables JSSE support.

How to Change Weblogic to Use the Sun SSL Implementation Rather Than Certicom
(Doc ID 1242974.1)

The SSL implementation and SSL Handler can be changed by setting the following flags on startup:
-Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol
-Dssl.SocketFactory.provider=com.sun.net.ssl.internal.SSLSocketFactoryImpl
-DUseSunHttpHandler=true
Also for Webservice clients, include:
-Dweblogic.wsee.client.ssl.usejdk=true

In the end Test! Test! Test! that all of this works correctly.

In summary supporting SHA256 support using WebLogic 10.3.6 or lower requires series of changes to make this work. Plan ahead and allocate enough resources to handle this migration. This will become important as major browsers will start flagging SHA1 certificates as insecure.

Useful resources : http://www.ssllabs.com and test your public website using their site scanner. Enable support for TLS 1.0, 1.1 and 1.2 and disable SSL 3.0 support in IE. For firefox/Chrome upgrade to latest version to automatically disable support for SSL 3.0.

If you encounter specific issues related to SHA256 implementation with WebLogic and PeopleSoft leave comments and I can try to provide help.

List of Bugs fixed in Patch Set Update - Doc ID 1942223.1

Some of the Error Messages I have encountered if settings are not correct are

javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received. (If JSSE is not enabled. Certicom SSL implementation does not support SHA256).

Enablig JSSE in WebLogic

<BEA-101104> <Servlet execution in servlet context "ServletContext@445892755[app:peoplesoft module:/ path: spec-version:2.5]" failed, java.io.IOException: SSLEngine is closed. at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:383)

<BEA-101083> <Connection failure java.io.IOException: SSLEngine is closed at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:385)

<BEA-000000> <weblogic.utils.net.SocketResetException: SSLEngine is closed>  at weblogic.socket.JSSEFilterImpl.checkCauseSSLEngineClosed(JSSEFilterImpl.java:431) only with Apple Safari Client when fetching CSS or Java Script using peoplesoft cs servlet.

java.lang.RuntimeException: Could not generate DH keypair

Caused By: java.security.InvalidAlgorithmParameterException: unknown curve name: 1.2.840.10045.3.1.7
    at org.bouncycastle.jce.provider.JDKKeyPairGenerator$EC.initialize(Unknown Source)
    at sun.security.ssl.ECDHCrypt.<init>(ECDHCrypt.java:63)

To Enable SSL Debug options

# JAVA SSL DEBUG (in setEnv.sh) to troubleshoot SSL handshake issues.

#JAVA_OPTIONS_LINUX="-server -Xms1024m -Xmx1024m -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1 -Dssl.debug=true -Dweblogic.StdoutDebugEnabled=true -Dweblogic.security.SSL.verbose=true -Djavax.net.debug=all -XX:MaxPermSize=256m -Dtoplink.xml.platform=oracle.toplink.platform.xml.jaxp.JAXPPlatform -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

Application Designer Compare Report Slow

Recently After upgrade to People Tools 8.53 from PT 8.50, We have noticed that for a large project (611 items) compare report is running really slow taking more than 1 hour. This was even more slow (3 hours) if the database is located in remote data center.

Since People Tools 8.51 , PeopleSoft added the ability to write compare reports to database tables which was really causing this slowness.

If you are not planning to use the database tables to review compare reports, please do the following to speed the compare report process.

Go to Compare and Report –> Options

Select Report Option Tab and Uncheck Generate Output to tables.

This fixed the issue. you can also truncate the below tables if you do not need to store the previous version of compare reports.

truncate table PSCOMPDEFN;
truncate table PSCOMPITEM;
truncate table PSCOMPITEMDATA;
truncate table PSCOMPSESSION;
truncate table PSCOMPOBJDIFF;
truncate table PSCOMPOBJLONG;

The first 3 tables are no longer used in PT 8.54

MOS (My Oracle Support Articles)

E-UPG PT8.51+: Are Tables Updated with Compare Report Data? (Doc ID 1290456.1)

E-COMP: Generate Output To Tables Option Not Writing Results To The Tables In 8.54 (Doc ID 1958074.1)

E-PUM: How to Improve Performance on Step "Comparing ADS MO Project From File" (Doc ID 1965298.1)

Also you can export the configuration manger config file and add the following under PSIDE section below after line : UpgXmlOutput=REG_DWORD=0

UpgTblOutput=REG_DWORD=0

You can then use this config file to install other workstations with same configuration.

Alternatively, you can add the below to a notepad and save as psidecompare.reg and ask user to run it manually to change the setting.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\PeopleSoft\PeopleTools\Release8.40\PSIDE]
"UpgTblOutput"=dword:00000000

IE9 Save As or Save Target As not working after applying update KB3008923 on Windows 7 SP1 64 Bit machine

Update : After applying the Latest Cumulative Security Update KB3032359 - MS15-018: Cumulative security update for Internet Explorer: March 10, 2015 Save As is working fine again. Also this resolves IE9 Freak Vulnerability as well. 

If you have applied the update KB3008923 , you may not be able to open any Microsoft office document (doc, docx, xls, xlsx, ppt, pptx) etc. Also If you try to download a software and try to use Save As option from the toolbar, it does not work. If you right click on a link and Select Save Target As that also does not work.

This issue is not mentioned on the Microsoft site http://support.microsoft.com/kb/3008923 

Though they recommend manually applying update KB3025945 (

http://support.microsoft.com/kb/3025945) to resolve IE9 Crash issue, it does not fix the issue.

To resolve the issue, I have to uninstall both KB3025945 and KB3008923 and once I did that everything started working normally. I would advise not to install this update till Microsoft come up with a replacement fix using windows update.

This will impact PeopleSoft Excel Query download functionality any word document download.

To uninstall the update, go to Control Panel and Search for “Installed updates” and Select View Installed Updates under Programs and Features

In the Search dialog at the top right type KB3025945 first and then KB3008923 and select uninstall  after right clicking on the selected update. You will need to restart the machine after each update is uninstalled.

(NET.334): Tuxedo cannot find the service RunAeAsync2. Make sure the application server advertising this service is booted.

If your users are calling and telling you that App engine processes are remaining in initiated status for longer time ( > 5 minute) and you observe the following message. (Assuming PSAESRV is configured)

in the $PS_CFG_HOME/appserv/prcs/<domain>/LOGS folder for SCHDLR_MMYY.LOG you will see the message

(NET.334): Tuxedo cannot find the service RunAeAsync2.  Make sure the application server advertising this service is booted.

To see all files that has this message

grep NET.334 SCHDLR*.LOG | cut -d : -f 1 | sort -u

Please note the number at the end of RunAeAsync. It could be 1 thru n depending on number of PSAESRV configured. What this message means that the PSAESRV and number at the RunAeSync is not running for e.g. in this case PSAESRV that provides service RunAeSync2 is not running.

You will also see in the same folder for TUXLOG.MMDDYY the following message

010135.abc.com!restartsrv.16887.414156544.-2: server AESRV/2: CMDTUX_CAT:1684: ERROR: Application initialization failure

010135.abc.com!restartsrv.16887.414156544.-2: server AESRV/2: CMDTUX_CAT:587: INFO: Cannot restart server, scheduling for cleanup

grep CMDTUX_CAT:1684 TUXLOG.*

Resolution

What this means is that for some reason PSAESRV has crashed and Tuxedo restart process is not able to restart PSAESRV process.

You have 2 option 2 fix the issue.

Option 1 : Shutdown and Restart the server

Option 2: Manually start the PSAERV process using command line without shutting down and restarting the server.

Option 2 is preferred, if you have other PSAESRV processes running in process monitor that will be killed if you try to stop the process scheduler.

Start PSADMIN (cd $PS_HOME/appserv; ./psadmin)

Select 2 for process Scheduler

Select 1 for Administer a domain

Select 1for appropriate Process Scheduler Domain

Select 5 for TUXEDO command line (tmadmin)

Type

boot -g AESRV -i 1

(Change -I 1 to appropriate number for PSAESRV process that crashed Determined from the number at the end of RunAeSync).

Observed this issue in PeopleTools : 8.53.12 and Linux : Red Hat 6.3 64 bit.

Unable to find a Routing Corresponding to the incoming Request Message (158,505)

When testing a WSDL or WADL you are getting the above message in the output Unable to find a Routing Corresponding to the incoming Request Message (158,505). for e.g. after publishing the WSDL for Soap or WADL for Rest, you try to view the WSDL or WADL and get the above message. 

1. Make sure that GETWADL and GETWSDL Service Operation which is part of IB_UTILITY Service is active and has any to local routing defined and active. Once you add the missing routing, Go to Routing Definition and Select Parameter Tab and make sure that External alias is exactly GetWADL for GETWADL and GetWSDL for GETWSDL. If it is anything other for e.g. GETWADL or GETWADL.V1 it will not work.

See following My Oracle Support Resolutions 1949257.1 and 1572531.1 for more information.

Sample URL to view WADL and WSDL are

WADL (REST)

http://piahostname.com/PSIGW/RESTListeningConnector/PSFT_PA/PTCS_SECURITY.1.wadl

WSDL (SOAP)
http://piahostname.com/PSIGW/PeopleSoftServiceListeningConnector/PSFT_PA/PTCS_SECURITY.1.wsdl

To find out which WSDL or WADL are published to  WSDL Repository, Do the following Select.

select * from PSIBWSDLDFN;

Note: This is tested in 8.53.09 and 8.53.12 but may be valid for other PeopleTools version as well.

Deleting Rows in ExcelToCI

Go to http://www.cedarhillsgroup.com/knowledge-base/kbarticles/deleting-rows-in-exceltoci to see How to modify delivered ExcelToCI template to delete rows which is not delivered by default. One of the use case is delete roles from user profiles in mass without using backend SQL . This uses delivered USER_PROFILE component interface. Tested in PT 8.53 and works fine. Make sure that you select Action as UPDATEDATA in Connect Information worksheet of ExcelToCI

In Summary, Go to Tools | Macros | Visual Basic Editor

Open StagingAndSubmission Module and Navigate to WriteCollectionHeader function do the following.

You will see a case statement “Select Case lScrollLevel”

Change the “Case 1” statement as PSROLEUSER is in level 1. If your target rows exist in other levels, you will need to modify that Case statement.

sXmlLine = sIndent & "<" & sXmlTag & ">"

To

sXmlLine = sIndent & “<” & sXmlTag & " CINodeAction=""DELETE"">"

Unable to Select or Edit a Field on a Page in Application Designer

On a very long page, we were not able to select the fields towards the bottom of this page. We found the following in PeopleBooks

Home -> PeopleSoft PeopleTools 8.53 -> PeopleSoft Application Designer Developer’s Guide -> Understanding Page Controls -> Data Entry Controls

Note: PeopleSoft Application Designer allows you add up to 405 fields on a page. When you reach this limit, typical system behavior includes being unable to select, move, or edit the page fields with an order number exceeding the 405-field limit. While this limit has no effect on the page at runtime, it has the potential to disrupt productivity during design time. If you find a page nearing the 405-field limit, you should use subpages to decrease the number of fields on a single page.

Below PeopleSoft resolution describes the same issue which is there since Version 8.2

E-AD Is there any limit on the number of fields on a Page Definition ( Doc ID 648823.1 )

Using Sub pages is the easiest way to resolve this issue. However this require changing the code.

The below query can be used to identify any such pages

select pnlname,count(*) from pspnlfield group by pnlname order by count(*) desc