Applying OES 11.1.2.1.1 - Patch 18629535 included in Patch 19157616: ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.1.5

Applying OES 11.1.2.1.1 - Patch 18629535 included in Patch 19157616: ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.1.5


Pre-requisite patches:

Apply OPSS Bundle Patch 11.1.1.6.3 and the Identity Governance Framework (IGF) Patch 14603262 prior to installing this bundle patch. The OPSS Bundle Patch is a prerequisite for the IGF Patch.


- Download Patch 19157616: ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.1.5 (p19157616_111210_Generic.zip)

- Patch 19157616 (p19157616_111210_Generic.zip) includes patches for components:

- OES 11.1.2.1.1

- OPSS 11.1.1.6.3

- OAM 11.1.2.1.4

- OAAM 11.1.2.1.3

- Copy and unzip p19157616_111210_Generic.zip onto the server staging area say PATCH_TOP with appropriate permissions.

- Download the latest version of OPatch (11.1.0.9.0 or higher) via Patch 6880880 (p6880880_111000_PLATFORM.zip)

- Unzip the patch file into the PATCH_TOP directory.

$ unzip -d $PATCH_TOP p19157616_111210_Generic.zip

- Change to the directory where the patch is located. 

$ cd /PATCH_TOP/19157616/OES/18629535


Apply patch 18629535


- Stop all servers including the Admin Server and all Managed server(s).

Run OPatch to apply the patch.

Proceed as below:

Set the ORACLE_HOME environment variable to the MW_HOME/Oracle_oesclient directory. (OES Client (Security Module) Home)

Run the following command:

- opatch apply
Set the ORACLE_HOME environment variable to the MW_HOME/Oracle_IDM1 directory. (OES or IDM Home)

Run the following command:

- opatch apply

(For 64-bit, opatch apply -jre Path_to_ORACLE_HOME/jdk/jre)

Post Installation Instructions:

- If any Security Module instances have been created, manually replace the following instance files:

oesclient/oes_sm_instances/instances/bin/oesPassword.* (sh/bat) by copying oesclient/oessm/enroll/bin/oesPassword.* (sh/bat)

oesclient/oes_sm_instances/instances/bin/setOesEnv.bat (Windows platform only) by copying oesclient/oessm/enroll/bin/setOesEnv.bat and replacing the @instance.home@ and @OES_CLIENT_HOME@ tokens.

- There have been domain level template changes. If adapting the new template changes, backup the existing domain and create a new domain using the updated template. This is not mandatory for existing functional domains.

- Start all servers including the Admin Server and all Managed server(s).

Patch Rollback instructions

- cd PATCH_TOP/18663203/OES/18629535

- Run OPatch to uninstall the patch.

i) Set the ORACLE_HOME environment variable to the Oracle_oesclient directory.


- opatch rollback -id 18629535 (For 64-bit, opatch rollback -id Patch_ID -jre Path_to_ORACLE_HOME/jdk/jre )

ii) Set the ORACLE_HOME environment variable to the Oracle_IDM1 directory.

Run the following command:

- opatch rollback -id 18629535 (For 64-bit, opatch rollback -id Patch_ID -jre Path_to_ORACLE_HOME/jdk/jre )

- Start all servers including the Admin Server and all Managed server(s).

FMW 11.1.1.6.0 - Oracle Platform Security for Java - Applying Patch 15894053: TRACKING BUG FOR OPATCH DELIVERY OF ENTSEC_11.1.1.6.0-IDM11.1.2.1.0_GENERIC

FMW 11.1.1.6.2 JPS for IAM 11.1.2 - Oracle Virtual Directory Patch 14603262: IDS USER/GROUP NAME ATTR NOT MAPPED CORRECTLY TO CONFIGURED VALUES IN OPCONFIG

Applying OPSS 11.1.1.6.3 Patch 18629534 included in Patch 19157616: ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.1.5

Applying OAM 11.1.2.1.4 - Patch 19162892 included in Patch 19157616: ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.1.5

Applying OAAM 11.1.2.1.3 - Patch 19162894 included in Patch 19157616: ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.1.5

OAAM 11.1.2.1.3 - Redeploying OAAM applications in Oracle WebLogic Server after applying Patch 19162894

OAAM 11.1.2.1.3 - Redeploying the OAAM Shared Library in Oracle WebLogic after applying Patch 19162894

WebCenter Capture 11.1.1.8.0 - reassociateSecurityStore(domain="your_domain", servertype="DB_ORACLE",datasourcename="jdbc/opss-ds", jpsroot="cn=jpsTestNode", join="false") fails with error JPS-00027: There was an internal error: java.sql.BatchUpdateException: ORA-00904: "ATTRKIND": invalid identifier

WebCenter Capture 11.1.1.8.0 - reassociateSecurityStore(domain="your_domain", servertype="DB_ORACLE",datasourcename="jdbc/opss-ds", jpsroot="cn=jpsTestNode", join="false") fails with error JPS-00027: There was an internal error: java.sql.BatchUpdateException: ORA-00904: "ATTRKIND": invalid identifier

If you are trying to execute reassociateSecurityStore command on one of the cluster nodes of WebCenter Capture 11.1.1.8.0 to resolve the issue detailed in this post, you may run into errors as below.

JPS-00027: There was an internal error: java.sql.BatchUpdateException: ORA-00904: "ATTRKIND": invalid identifier

wls:/your_domain/serverConfig> reassociateSecurityStore(domain="your_domain", servertype="DB_ORACLE",datasourcename="jdbc/opss-ds", jpsroot="cn=jpsTestNode", join="false")


Location changed to domainRuntime tree. This is a read-only tree with DomainMBean as the root.
For more help, use help(domainRuntime)

Command FAILED, Reason: JPS-00027: There was an internal error: java.sql.BatchUpdateException: ORA-00904: "ATTRKIND": invalid identifier


Traceback (innermost last):
 File "<console>", line 1, in ?
 File "MW_HOME\fmw\product\111\ORACLE~1\common\wlst\jpsWlstCmd.py", line 1343, in reassociateSecurityStore
 File "MW_HOME\fmw\product\111\ORACLE~1\common\wlst\jpsWlstCmd.py", line 1314, in reassociateSecurityStoreImpl

       at weblogic.rjvm.ResponseImpl.unmarshalReturn(ResponseImpl.java:237)
       at weblogic.rmi.internal.BasicRemoteRef.invoke(BasicRemoteRef.java:223)
       at javax.management.remote.rmi.RMIConnectionImpl_1036_WLStub.invoke(Unknown Source)
       at weblogic.management.remote.common.RMIConnectionWrapper$16.run(ClientProviderBase.java:960)
       at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
       at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146)
       at weblogic.security.Security.runAs(Security.java:61)
       at weblogic.management.remote.common.RMIConnectionWrapper.invoke(ClientProviderBase.java:958)
       at javax.management.remote.rmi.RMIConnector$RemoteMBeanServerConnection.invoke(RMIConnector.java:1029)
       at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
       at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
       at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
       at java.lang.reflect.Method.invoke(Method.java:606)


javax.management.MBeanException: javax.management.MBeanException: JPS-00027: There was an internal error: java.sql.BatchUpdateException: ORA-00904: "ATTRKIND": invalid identifier



You may hit these errors because OPSS schema may not have been upgraded and hence is not at version 11.1.1.8.0.

Verify OPSS schema version by running below SELECT query.

SQL> SELECT OWNER, VERSION, STATUS, UPGRADED FROM SCHEMA_VERSION_REGISTRY;

If OPSS schema version is not 11.1.1.8.0 (let's say eg: OPSS version is 11.1.1.7.0 with U flat set to N), then run ./psa and upgrade OPSS schema to 11.1.1.8.0

Once OPSS is upgraded to 11.1.1.8.0, run reassociateSecurityStore again.

reassociateSecurityStore(domain="your_domain", servertype="DB_ORACLE",datasourcename="jdbc/opss-ds", jpsroot="cn=jpsTestNode", join="false") 

This time it should execute without errors as below:

Re-associate to OPSS Security Store

cd ORACLE_COMMON_HOME\common\bin
./wlst.sh
connect("Admin_User","Admin_User_Password","t3://hostname:port")

wls:/your_domain/serverConfig> reassociateSecurityStore(domain="your_domain", servertype="DB_ORACLE",datasourcename="jdbc/opss-ds", jpsroot="cn=jpsTestNode", join="false")
Already in Domain Runtime Tree

Starting policy store reassociation.
The store and ServiceConfigurator setup done.
Schema is seeded into the store
Data is migrated to the store. Check logs for any failures or warnings during migration.
Data in the store after migration has been tested to be available
Update of in-memory jps configuration is done
Policy store reassociation done.
Starting credential store reassociation
The store and ServiceConfigurator setup done.
Schema is seeded into the store
Data is migrated to the store. Check logs for any failures or warnings during migration.
Data in the store after migration has been tested to be available
Update of in-memory jps configuration is done
Credential store reassociation done
Starting Keystore reassociation
The store and ServiceConfigurator setup done.
Schema is seeded into the store
Data is migrated to the store. Check logs for any failures or warnings during migration.
Data in the store after migration has been tested to be available
Update of in-memory jps configuration is done
Keystore reassociation done
Starting audit store reassociation
The store and ServiceConfigurator setup done.
Schema is seeded into the store
Data is migrated to the store. Check logs for any failures or warnings during migration.
Data in the store after migration has been tested to be available
Update of in-memory jps configuration is done
Audit store reassociation done
Jps Configuration has been changed. Please restart the application server.

wls:/your_domain/serverConfig>

Related Posts:

WebCenter Capture 11.1.1.8 Cluster - Workspace created or imported on one node is not visible on the other node and workspace gets deleted on restart of cluster node

WebCenter Capture 11.1.1.8 Cluster - Using Database Based Security Store

WebCenter Capture 11.1.1.8 Cluster - Using OID Based Policy Store

WebCenter Capture 11.1.1.8 Cluster - Creating OPSS schema for using Database Based Security Store

WebCenter Capture 11.1.1.8 Cluster - Creating OPSS schema for using Database Based Security Store

WebCenter Capture 11.1.1.8 Cluster - Creating OPSS schema for using Database Based Security Store

When using Database Based Security Store, follow steps below for OPSS schema creation.

- Download 11.1.1.8 RCU Patch 17068284
- Invoke RCU from /SID/fmw/product/111/oracle_common/bin ) and create OPSS schema

OPSS schema creation

i) Select Create

ii) DB connection Details:
- Host:
- Port:
- Service type:
- Username: system
- PASS: system_password
- Role: SYSDBA.

iii) On Select Components:


- Select "Select an existing Prefix" and verify SID is selected.
- Components:
Open "As Common Schemas" and select "Oracle Platform Security Services"


iv) On Schema Password, select "Use same passwords for all schemas" and enter password of "SID_MDS" schema

v)  Proceed further till OPSS schema gets created.

Related Posts:

WebCenter Capture 11.1.1.8 Cluster - Using Database Based Security Store

WebCenter Capture 11.1.1.8 Cluster - Workspace created or imported on one node is not visible on the other node and workspace gets deleted on restart of cluster node

WebCenter Capture 11.1.1.8 Cluster - Using OID Based Policy Store

WebCenter Capture 11.1.1.8.0 - reassociateSecurityStore(domain="your_domain", servertype="DB_ORACLE",datasourcename="jdbc/opss-ds", jpsroot="cn=jpsTestNode", join="false") fails with error JPS-00027: There was an internal error: java.sql.BatchUpdateException: ORA-00904: "ATTRKIND": invalid identifier

WebCenter Capture 11.1.1.8 Cluster - Workspace created or imported on one node is not visible on the other node and workspace gets deleted on restart of cluster node

WebCenter Capture 11.1.1.8 Cluster - Workspace created or imported on one node is not visible on the other node and workspace gets deleted on restart of cluster node

This issue is seen if the cluster configuration is still based on a file security store. The security information in this case will be stored in a file "system-jazn-data.xml" local to the Weblogic server. 

Example: If you create workspace on Node 1 of cluster, it will save the security information in "system-jazn-data.xml" file on Node 1. "system-jazn-data.xml" on Node2 will not have the updates made to the file on Node 1.


To resolve this issue, use either of the relevant options below:

1) Use OID Based Policy Store (select this if using OID / LDAP)



2) Use Database Based Security Store (OPSS schema)

In either of the options you need to run reassociateSecurityStore and restart the complete domain for workspace created or imported to reflect on both the cluster nodes. 

Related Posts:

WebCenter Capture 11.1.1.8 Cluster - Using Database Based Security Store

WebCenter Capture 11.1.1.8 Cluster - Using OID Based Policy Store

WebCenter Capture 11.1.1.8 Cluster - Creating OPSS schema for using Database Based Security Store

WebCenter Capture 11.1.1.8.0 - reassociateSecurityStore(domain="your_domain", servertype="DB_ORACLE",datasourcename="jdbc/opss-ds", jpsroot="cn=jpsTestNode", join="false") fails with error JPS-00027: There was an internal error: java.sql.BatchUpdateException: ORA-00904: "ATTRKIND": invalid identifier