# Oracle® OPSS Bundle Patch 12.2.1.3.210420 README

Bundle Patch for Bug: 32397127
Date : 17-Apr-21
Platform Patch for : Generic Platform
Product Patched : Oracle Platform Security for Java
Product Version : 12.2.1.3.0
This document describes how to install patch for bug # 32397127.
It includes the following sections:

- Section 1: Zero Downtime Patching

- Section 2: Prerequisites

- Section 3: Pre-Installation Instructions

- Section 4: Installation Instructions

- Section 5: Post-Installation Instructions

- Section 6: Deinstallation Instructions

- Section 7: Post Deinstallation Instructions

- Section 8: Bugs Fixed by This Patch

## Section 1: Zero Downtime Patching

This patch has been marked as eligible for Zero Downtime Patching.
The type of Zero Downtime Patching supported by this patch is FMW_ROLLING_ORACLE_HOME.
With Zero Downtime Patching, a Patch can be applied to a system in a manner that does not incur any downtime.
This ensures that the system can remain available and functioning during the patching process.
Certain pre-requisites, however, must be met before the patch can be applied.
For more information, consult the My Oracle Support MOS Note: 1942159.1
https://support.oracle.com/epmos/faces/DocumentDisplay?id=1942159.1

## Section 2: Prerequisites

Ensure that you meet the following requirements before you install or deinstall the patch:
1. Before applying the non-mandatory patches, ensure that you have the exact symptoms described in the bug.
2. Oracle Fusion Middleware 12.2.1 products are installed with OPatch NextGen 13.3 to apply interim patches.
The OPatch utility may be updated over time to resolve known issues.
You can check your version using the following command:
ORACLE_HOME/OPatch/opatch version
Versions 12.2.1.0-12.2.1.2 do not require an update. For version 12.2.1.3, OPatch 13.9.4 is required.
OPatch 13.9.4 is available as Patch 28186730:
https://support.oracle.com/rs?type=patch&id=28186730
Review the following for more OPatch information:
Doc ID 1587524.1 Using OUI NextGen OPatch 13 for Oracle Fusion Middleware 12c
https://support.oracle.com/rs?type=doc&id=1587524.1
3. Verify the OUI Inventory
OPatch needs access to a valid OUI inventory to apply patches.
Note: This needs the ORACLE_HOME to be set(refer section "2. Pre-Installation Instructions")
prior to run the below commands:
Validate the OUI inventory with the following commands:
$ opatch lsinventory -jre $ORACLE_HOME/oracle_common/jdk/jre
Note:
Make sure the JDK version you use is the certified version for your product.
If the command errors out, contact Oracle Support and work to validate and verify the inventory setup before proceeding.
4. Create a location for storing the unzipped patch:
This location will be referred to later in the document as PATCH_TOP.
NOTE: On WINDOWS, the preferred location is the drive root directory.
For example, "C:\PATCH_TOP" and avoid choosing locations like,
"C:\Documents and Settings\username\PATCH_TOP".
This is necessary due to the 256 characters limitation on windows platform.

## Section 3: Pre-Installation Instructions

1. Set the ORACLE_HOME environment variable to the directory where you have installed ORACLE SECURITY SERVICE.

## Section 4: Installation Instructions

1. Unzip the patch zip file into the PATCH_TOP.
$ unzip -d PATCH_TOP p32397127_122130_Generic.zip
NOTE: On WINDOWS, the unzip command has a limitation of 256 characters in the path name.
If you encounter this, please use an alternate ZIP utility like 7-Zip to unzip the patch.
For example: To unzip using 7-zip, run the command:
"c:\Program Files\7-Zip\7z.exe" x p32397127_122130_Generic.zip
2. Set your current directory to the directory where the patch is located.
$ cd PATCH_TOP/32397127
3. Run OPatch to apply the patch.
$ opatch apply
Note:
-----
When OPatch starts, it validates the patch and makes sure that there are no conflicts with the
software already installed in the ORACLE_HOME.
In case of opatch conflict, you will see a warning message similar to the one mentioned below:
Interim Patch XXXX has Conflict with patch(es) [ YYYY ] in OH ...
Conflict patches: YYYY
Patch(es) YYYY conflict with the patch currently being installed (XXXX).
If you continue, patch(es) YYYY will be rolled back and the new patch (XXXX) will be installed.
If a merge of the new patch (XXXX) and the conflicting patch(es) ( YYYY) is required, contact
Oracle Support Services and request a Merged patch.
Do you want to proceed? [y|n]
n
You must stop the patch installation and the following should be reviewed:

## Section Section 5: Post-Installation Instructions

NONE

## Section 6: Deinstallation Instructions

If you experience any problems after installing this patch, remove the patch as follows:
1. Make sure to follow the same Prerequisites or pre-install steps (if any) when deinstalling a patch.
This includes setting up any environment variables like ORACLE_HOME and verifying the OUI inventory before deinstalling.
2. Change to the directory where the patch was unzipped.
$ cd PATCH_TOP/32397127
3. Run OPatch to deinstall the patch.
$ opatch rollback -id 32397127

## Section 7: Post Deinstallation Instructions

Restart all servers (AdminServer and all Managed server(s)).
This is necessary to redeploy the original applications and bring the environment back to it's original state.

## Section 8: Bugs Fixed by This Patch

Bug fixes in this patch are shown in the following list:

- Issues Resolved in OPSS Bundle Patch 12.2.1.3.210420
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.201020
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.191015
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.190917
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.190716
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.190416
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.190115
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.181016
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.180717
- Issues Resolved in OPSS Bundle Patch 12.2.1.3.180417

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.210420

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.210420

Base Bug Number | Description of the Problem
--- | ---
32415964 | CVE-2021-2302
31902620 | STRESS:FA:HDIU-DEV17/DEV3: JOB TAKING A VERY LONG TIME TO COMPLETE
31895782 | PatchingException: JPS-07181: Metadata support is required on application obi when there is no baseline file
28065910 | URL excluded in JpsAbsFilter not skip the normal filter
27696859 | Get KeyStoreServiceException when creating keystore entry in cloud MT environmen
27669335 | UnsupportedOperationException in OPSS policy store persist() method

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.201020

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.201020

Base Bug Number | Description of the Problem
--- | ---
31255705 | SCIMPlugin configuration error during IGF user profile lookup
30986141 | The DB based policy store returns return different results
30878920 | OPSS AUDIT: URGENT need for INITIATOR column in AUDIT tables for CredntialManagement events
30756671 | US PSM 20.1.1 PATCHING TOOK 16+ HRS
30348027 | OPSS Audit Stopped working for OIF
30300758 | ASH-COM-AD1A-EJWK-DEV2-FADOMAIN-BI_SERVER1-DS-OVERLOAD
29489845 | UPG-20190314:DOWNTIME:GSI:EGHJ:QUIESCINGANDSTARTINGNEWFATOPOLOGY STUCK ADMIN
29286348 | OPSS allows null resource name for resource permission
27138890 | PSR:PERF:OPSS OPSS shutds down admin server when DB down
26132293 | Incorrect JpsAuth.hasPermission result -permission loaded frm different classldr

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.191015

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.191015

Base Bug Number | Description of the Problem
--- | ---
28302701 | New API for IDCS Integration

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.190917

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.190917

Base Bug Number | Description of the Problem
--- | ---
29897249 | Jan2019 OPSS BP causes IGF Find/Search Interaction to Use "BASE: CN=USERS,DC=OIMDB"
29123315 | Preventive code to avoid audit attribute lost if undefined attribute exists
29020063 | 19c: Cannot instantiate plugin : SCIMPlugin ValidationFailedException

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.190716

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.190716

Base Bug Number | Description of the Problem
--- | ---
29429675 | High heap space required when credential store has too many credential maps
29411343 | OPSS context in memory is not removed with fix for 28145575
27600494 | STRESS:ISCS JPA provider eclipse link retry count delay value default set tozero
27528997 | ConcurrentModificationException when trying to log into APICS console

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.190416

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.190416

Base Bug Number | Description of the Problem
--- | ---
28996665 | Fix for Bug 28996665
28858713 | IdentityStoreConfigurationUtil to support custom type
28673952 | WebLogic 12.2.1.0 - component_event.xlf files filling up /tmp filesystem
28369965 | OIC:L2: NPE error -Keystore load failure -KeyStoreDataManager
28368179 | Fix for Bug 28368179
27718379 | After upgrading the listpermissions query is not returning the correct result.
26222099 | IDCSSSOServiceProvider logout redirect not working - Incorrect query parameter
21615694 | CREATE DOMAIN WITH DIFFERENT USER THAN THE PRODUCT INSTALL USER, FAILS

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.190115

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.190115

Base Bug Number | Description of the Problem
--- | ---
28767126 | Issue with OpssIdcsClient as jersey client is created in each request and not closed
28752652 | OPSS policystore cache refresh issue after explicitly clearing cache
28722803 | [APICSMT18.3.5-75 deadlock]504 Gateway Time-out retrieving roles page in longrunpod0915
28599855 | reassociateSecStore failed on OID and DB against ps3bp stage32
28581465 | oracle.igf.ids.GroupManager&oracle.igf.ids.UserManager searchUser&searchGroup
28581344 | oracle.igf.ids.User&oracle.igf.ids.Group GetName is consuming escape character
28143529 | Failed to get security store version will cause functionality broken
27519253 | IDCSAppRoleImpl.<init>(java.lang.String) class mistch
26911368 | MS24:REL12:P2T[ECNF->ECNF-TEST] FAILED AT STEP GENERATE FINAL REPORT
26910194 | While failing writing the log , it should tell which file has the issue
26865074 | REL12: JPS audit logs consume 2.52TB space on SaaS pod HCDY of Customer Synnex
26828760 | OAC: ROLLBACK FAILING FROM 1743-1057 TO 1723
26785742 | OPSS - PRINCIPALS FROM OTHER INSTANCES ARE ADDED BY IDCS PROVIDER
26649669 | AUDITLOADER STOPS IF THERE IS A ATTR DATA TYPE MISMATCH IN A MALFORMED AUDIT REC
26516383 | SCIM ID STORE IDCS APPROLE SUPPORT
26481220 | Audit Events are not Logged in 11.1.1.9.170721OPSSBP

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.181016

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.181016

Base Bug Number | Description of the Problem
--- | ---
28389103 | Http status: 429 message: Too Many Requests
28323499 | Need expansion of remedy for jps.service.policystore.info.BasicPrincipalEntry
28156927 | AuditReportTemplates.jar shipped in OPSShas BIP report issues in some cases
28145575 | Stale OPSS artifacts remaining after the tenant is forced deleted.
28110732 | IDS API COMPLAINS WHEN IDCS GROUP NAME CONTAINS A COMMA.
28105735 | non-part MT not work with idstore.ldap
28098387 | OPSS Audit Stopped working with OAM
27879104 | IDCS searchAppRoles/searchUser see Operation not implemented in clountmt env
27215868 | SSL support for OPSS DB security store connection in JSE

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.180717

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.180717

Base Bug Number | Description of the Problem
--- | ---
28164323 | WRONG PRINCIPAL RETURNED WITH X-RESOURCE-SERVICE-INSTANCE-IDENTITY-AP
27635321 | Readiness check failed for IAU schema at PRIVILEGES_TEST
27618283 | FA Location based access control needs to cover JpsAuth.getAllGrantedAppRoles
27511030 | getIdentityStore() calls getVirtualizationService in cloudmt env
27487992 | WRONG PRINCIPAL RETURNED WITH X-RESOURCE-SERVICE-INSTANCE-IDENTITY-AP
27001039 | STRESS: Thread issues observed in OPSS REST Permission-set testcases
26560641 | FA needs ability to run applications from public internet/private intranet.
25704454 | Provide Replacement for or Restore GenericIdentityStoreProvider

## Issues Resolved in OPSS Bundle Patch 12.2.1.3.180417

Applying this bundle patch resolves the issues listed in the following table:

Issues Resolved in OPSS Bundle Patch 12.2.1.3.180417

Base Bug Number | Description of the Problem
--- | ---
27423897 | upgrade assistant readiness check report error on PRIVILEGES_TEST
27358915 | Tenant Authorization fails with exception when using OPSS MT
27280891 | getAppPolicy failed by SuiteInstanceBroker access deny against proxy data source
27277928 | access denied on JpsPermission ServiceContextManager.find
27126795 | access denied on JpsPermission SuiteInstanceBroker
27119368 | MT-related system properties should be set automatically with JRF Cloud template
27111323 | CNFE TenantContextFactory on NM start in JRF Cloud domain
27093628 | Support proxy datasource in OPSS runtime
27056349 | JpsFilter is called twice: JPS-00215 Switching context not permitted
27006419 | Update jps-config.xml/jps-config-jse.xml when provisioning a MT domain
26739728 | oracle.security.jps.service.policystore APIs incorrectly marked as concealed
26117238 | MCR-44 FMW API Export - Missing Exports or Remediation Comments
25873942 | cloud domain credstore mbean config in jps_mbeans inconsistent with jps-config
25841089 | Too many duplicated warning messages in DataSeparation domain

DISCLAIMER:
Oracle Corporation recommends to upgrade to the next production patchset, when available.
Applying this patch could overwrite other interim patches applied since the last patch set.
Customers need to make a request to Oracle Support for a patch that includes those fixes, as well
as inform Oracle Support about all the patches installed when a Service Request is opened.
Please download, test, and provide feedback as soon as possible to assist in the timely resolution

of this problem. Copyright © 2021, Oracle and/oritsaffiliates.Allrightsreserved.