Registry Edit from the workspace is messy

Since registry edit is a job to be done carefully I prefer using the epmsys_registry utility in my black&white command prompt rather than the fancy UI.
This morning I decided let's edit from the front end as it was only about updating one single property for each component.
All the updates looked fine at first glance until I found that using notepad and updating the property may lead to incorrect values either added or removed from the existing registry.


Here is one example, I exported the components.property for LWA Workspace and updated just the isSSL=false property and imported it back without making any other changes.
Booooom!
I not only see a new entry but I also see that the value for ExtraTokenKey is incorrect now.

After Edit:

This is because of the settings on the notepad editor. I have tried all the ways possible to upload back with correct values but it does not change.


Hence sticking to the command prompt is the best thing:
Here are the sample commands:


epmsys_registry updateproperty #591e3add208ffef174b3659b1578e982994S7cbe/@isSSL false

Read More

Break! Break! Being a Mommy.

The last few months I was handling much tougher project than I ever did in my life and that's being  a MOTHER.
Since I was on maternity leave and then followed by those colicky sleepless nights now I am slowing getting back to life. I am blessed with a beautiful girl, who is so chirpy, happy and active.
On the other hand we relocated to Dubai, UAE. There have been quite a few changes on personal and professional front.
      I definitely had to take a step back on my professional front due to some of the conditions I had put on myself like no formula feeding, no packaged food for baby. That is how I am, I need perfection everywhere. I certainly have a new found admiration for the SAHM but that's not my cup of tea. I would love to manage everything with sheer perfection so getting back to the world of Hyperion.

Read More

Security Hardening of Hyperion 11.1.2.4 Part 1

There have been a few recurring requests from various clients to make Hyperion Workspace URL, SmartView URL available on TLS 1.2 and then pass all the penetration tests conducted by various software. We setup OHS 11.1.1.9 (instead of the default OHS 11.1.1.7) to support TLS 1.1 onwards. On conducting penetration tests most of the tools pointed out similar defects. Here are a few fixes to it. 

1.   Limit the information the web server present, make the following changes in httpd.conf

REF: https://docs.oracle.com/cd/E57185_01/EPMIS/EPMIS.pdf

Note this entry does not work unless you specify as below:

Header always unset "X-Powered-By"

Header unset "X-Powered-By"

This hides the CGI related headers, refer image below 

2.       To ensure that all cookies coming from OHS are secure, the following can be configured in the httpd.conf file

Header edit Set-Cookie ^(.*)$ $1;HttpOnly;secure

Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

Ref screenshot below:

3.   Remove any .exe from the Workspace 

We just renamed the wspace folder.

E:\Oracle\Middleware\EPMSystem11R1\common\epmstatic\wspace folder was renamed. This will prevent end users from downloading any .exe like SmartView. I understand it defeats the purpose but in a controlled environment, most end users do not have Admin access to install it up anyway. They require Administrator to individually install it. 

4. Similarly, you can hide other contents as below

Header unset X-Content-Type-Options

5. Remove Server version 

The usual header setting as below does not work for this 

Header unset Server

Header always unset Server

So had to switch off the ServerTokens instead of keeping it on PROD which is expected to give out minimal information

   #ServerTokens Prod

ServerTokens None

This did the trick. 

These above settings enable to secure HTTP server further. I am still working on fixing allowing dangerous HTTP methods like OPTIONS, TRACE, DELETE etc. I have sent the link for the penetration test if it succeeds I will post it on the following blog.

Read More

Groups are not displayed after configuring SQL Authenticator with OBIEE 12C

On a newly installed OBIEE 12c server, we configured the SQL Authenticator but we were unable to list the Groups though there were no errors initially as the datasource was unable to connect to the database itself. Once we fixed below warning we got a few errors which showed that the tables were messed up.
Here is how we fixed the first warning.

Nov 16, 2017 3:45:21 PM oracle.bi.security.provider.wls.authentication.dbms.SQLGroupProviderDelegateImpl validateConfiguration
WARNING: Configuration validation connection exception
java.sql.SQLException: Connection pool not usable.
        at oracle.bi.security.provider.wls.authentication.dbms.SQLGroupProviderDelegateImpl.getConnection(SQLGroupProviderDelegateImpl.java:488)
        at oracle.bi.security.provider.wls.authentication.dbms.SQLGroupProviderDelegateImpl.validateConfiguration(SQLGroupProviderDelegateImpl.java:208)
        at oracle.bi.security.provider.wls.authentication.dbms.SQLGroupProviderDelegateImpl.<init>(SQLGroupProviderDelegateImpl.java:108)
        at oracle.bi.security.provider.wls.authentication.dbms.SQLGroupAuthenticationProvider.initialize(SQLGroupAuthenticationProvider.java:28)
        at com.bea.common.security.internal.legacy.service.SecurityProviderImpl.init(SecurityProviderImpl.java:60)
        at com.bea.common.engine.internal.ServiceEngineImpl.findOrStartService(ServiceEngineImpl.java:363)
        at com.bea.common.engine.internal.ServiceEngineImpl.findOrStartService(ServiceEngineImpl.java:315)
        at com.bea.common.engine.internal.ServiceEngineImpl.lookupService(ServiceEngineImpl.java:257)
        at com.bea.common.engine.internal.ServicesImpl.getService(ServicesImpl.java:72)
        at weblogic.security.service.internal.WLSIdentityServiceImpl.initialize(WLSIdentityServiceImpl.java:47)
        at weblogic.security.service.CSSWLSDelegateImpl.initializeServiceEngine(CSSWLSDelegateImpl.java:297)
        at weblogic.security.service.CSSWLSDelegateImpl.initialize(CSSWLSDelegateImpl.java:218)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.InitializeServiceEngine(CommonSecurityServiceManagerDelegateImpl.java:1965)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initializeRealm(CommonSecurityServiceManagerDelegateImpl.java:498)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.loadRealm(CommonSecurityServiceManagerDelegateImpl.java:845)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initializeRealms(CommonSecurityServiceManagerDelegateImpl.java:907)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.preInitialize(CommonSecurityServiceManagerDelegateImpl.java:1189)
        at weblogic.security.service.SecurityServiceManager.preInitialize(SecurityServiceManager.java:570)
        at weblogic.security.PreSecurityService.start(PreSecurityService.java:141)
        at weblogic.server.AbstractServerService.postConstruct(AbstractServerService.java:76)
        at sun.reflect.GeneratedMethodAccessor2.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.glassfish.hk2.utilities.reflection.ReflectionHelper.invoke(ReflectionHelper.java:1262)
        at org.jvnet.hk2.internal.ClazzCreator.postConstructMe(ClazzCreator.java:332)
        at org.jvnet.hk2.internal.ClazzCreator.create(ClazzCreator.java:374)
        at org.jvnet.hk2.internal.SystemDescriptor.create(SystemDescriptor.java:471)
Solution:
Documentation mentions to deploy the datasource on both ADMIN SERVER and the BI SERVER but for some reason the admin had missed deploying it to the ADMIN SERVER.
Once you choose ADMIN server as the target the warning disappears and in case there are underlying errors it will be displayed.

[REF] https://docs.oracle.com/middleware/1221/biee/BIESC/privileges.htm#BIESC534
Section 3.4.4.3.3 Configuring the Data Source Using Oracle WebLogic Server Administration Console

Read More

JDBC Version with EPM 11.1.2.4

Did you ever wonder which version of JDBC we use with Hyperion 11.1.2.4 ?


Here is how you find out.



1. Go to E:\Oracle\Middleware\jdk160_35\bin
2. java -jar E:\Oracle\Middleware\wlserver_10.3\server\lib\odbc6.jar -getversion
3. Hyperion 11.1.2.4 uses JDBC 4.0 version and ODBC 6.0

Read More