Oracle® OPSS Bundle Patch 12.2.1.3.210420 README 


Bundle Patch for Bug: 32397127


Date : 17-Apr-21

 Platform Patch for : Generic Platform

 Product Patched : Oracle Platform Security for Java

 Product Version : 12.2.1.3.0


This document describes how to install patch for bug # 32397127.


It includes the following sections:


     - Section 1: Zero Downtime Patching 


     - Section 2: Prerequisites 


     - Section 3: Pre-Installation Instructions 


     - Section 4: Installation Instructions 


     - Section 5: Post-Installation Instructions


     - Section 6: Deinstallation Instructions


     - Section 7: Post Deinstallation Instructions


     - Section 8: Bugs Fixed by This Patch 


Section 1: Zero Downtime Patching
------------------------------------------
 This patch has been marked as eligible for Zero Downtime Patching. 

 The type of Zero Downtime Patching supported by this patch is FMW_ROLLING_ORACLE_HOME.


With Zero Downtime Patching, a Patch can be applied to a system in a manner that does not incur any downtime.


This ensures that the system can remain available and functioning during the patching process.


Certain pre-requisites, however, must be met before the patch can be applied.


For more information, consult the My Oracle Support MOS Note: 1942159.1


https://support.oracle.com/epmos/faces/DocumentDisplay?id=1942159.1


Section 2: Prerequisites
------------------------------------


Ensure that you meet the following requirements before you install or deinstall the patch:


1. Before applying the non-mandatory patches, ensure that you have the exact symptoms described in the bug.


2. Oracle Fusion Middleware 12.2.1 products are installed with OPatch NextGen 13.3 to apply interim patches.

 The OPatch utility may be updated over time to resolve known issues.


You can check your version using the following command:


ORACLE_HOME/OPatch/opatch version


Versions 12.2.1.0-12.2.1.2 do not require an update. For version 12.2.1.3, OPatch 13.9.4 is required.


OPatch 13.9.4 is available as Patch 28186730:

 https://support.oracle.com/rs?type=patch&id=28186730


Review the following for more OPatch information: 


Doc ID 1587524.1 Using OUI NextGen OPatch 13 for Oracle Fusion Middleware 12c

 https://support.oracle.com/rs?type=doc&id=1587524.1


3. Verify the OUI Inventory


OPatch needs access to a valid OUI inventory to apply patches.


Note: This needs the ORACLE_HOME to be set(refer section "2. Pre-Installation Instructions")

 prior to run the below commands:


Validate the OUI inventory with the following commands:


$ opatch lsinventory -jre $ORACLE_HOME/oracle_common/jdk/jre


Note:

 Make sure the JDK version you use is the certified version for your product.


If the command errors out, contact Oracle Support and work to validate and verify the inventory setup before proceeding.


4. Create a location for storing the unzipped patch: 


This location will be referred to later in the document as PATCH_TOP.


NOTE: On WINDOWS, the preferred location is the drive root directory.

 For example, "C:\PATCH_TOP" and avoid choosing locations like,

 "C:\Documents and Settings\username\PATCH_TOP".

 This is necessary due to the 256 characters limitation on windows platform.


Section 3: Pre-Installation Instructions
------------------------------------------------


1. Set the ORACLE_HOME environment variable to the directory where you have installed ORACLE SECURITY SERVICE.


Section 4: Installation Instructions
---------------------------------------------


1. Unzip the patch zip file into the PATCH_TOP.


$ unzip -d PATCH_TOP p32397127_122130_Generic.zip


NOTE: On WINDOWS, the unzip command has a limitation of 256 characters in the path name.

 If you encounter this, please use an alternate ZIP utility like 7-Zip to unzip the patch.


For example: To unzip using 7-zip, run the command:

 "c:\Program Files\7-Zip\7z.exe" x p32397127_122130_Generic.zip


2. Set your current directory to the directory where the patch is located.


$ cd PATCH_TOP/32397127


3. Run OPatch to apply the patch.


$ opatch apply


Note:

 -----

 When OPatch starts, it validates the patch and makes sure that there are no conflicts with the


software already installed in the ORACLE_HOME.


In case of opatch conflict, you will see a warning message similar to the one mentioned below:


Interim Patch XXXX has Conflict with patch(es) [ YYYY ] in OH ...

 Conflict patches: YYYY

 Patch(es) YYYY conflict with the patch currently being installed (XXXX).

 If you continue, patch(es) YYYY will be rolled back and the new patch (XXXX) will be installed.


If a merge of the new patch (XXXX) and the conflicting patch(es) ( YYYY) is required, contact


Oracle Support Services and request a Merged patch.


Do you want to proceed? [y|n]

 n


You must stop the patch installation and the following should be reviewed:


Section Section 5: Post-Installation Instructions
------------------------------------------------------


NONE 


Section 6: Deinstallation Instructions
----------------------------------------------


If you experience any problems after installing this patch, remove the patch as follows:


1. Make sure to follow the same Prerequisites or pre-install steps (if any) when deinstalling a patch.


This includes setting up any environment variables like ORACLE_HOME and verifying the OUI inventory before deinstalling.


2. Change to the directory where the patch was unzipped.


$ cd PATCH_TOP/32397127


3. Run OPatch to deinstall the patch.


$ opatch rollback -id 32397127


Section 7: Post Deinstallation Instructions
--------------------------------------------------
 Restart all servers (AdminServer and all Managed server(s)).

 This is necessary to redeploy the original applications and bring the environment back to it's original state.


Section 8: Bugs Fixed by This Patch
--------------------------------------------
 Bug fixes in this patch are shown in the following list:



 Issues Resolved in OPSS Bundle Patch 12.2.1.3.210420
    32415964 : CVE-2021-2302
    31902620 : STRESS:FA:HDIU-DEV17/DEV3: JOB TAKING A VERY LONG TIME TO COMPLETE
    31895782 : PatchingException: JPS-07181: Metadata support is required on application obi when there is no baseline file
    28065910 : URL excluded in JpsAbsFilter not skip the normal filter
    27696859 : Get KeyStoreServiceException when creating keystore entry in cloud MT environmen
    27669335 : UnsupportedOperationException in OPSS policy store persist() method

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.201020
    31255705 : SCIMPlugin configuration error during IGF user profile lookup
    30986141 : The DB based policy store returns return different results
    30878920 : OPSS AUDIT: URGENT need for INITIATOR column in AUDIT tables for CredntialManagement events
    30756671 : US PSM 20.1.1 PATCHING TOOK 16+ HRS
    30348027 : OPSS Audit Stopped working for OIF
    30300758 : ASH-COM-AD1A-EJWK-DEV2-FADOMAIN-BI_SERVER1-DS-OVERLOAD
    29489845 : UPG-20190314:DOWNTIME:GSI:EGHJ:QUIESCINGANDSTARTINGNEWFATOPOLOGY STUCK ADMIN
    29286348 : OPSS allows null resource name for resource permission
    27138890 : PSR:PERF:OPSS OPSS shutds down admin server when DB down
    26132293 : Incorrect JpsAuth.hasPermission result -permission loaded frm different classldr

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.191015
    28302701 : New API for IDCS Integration

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.190917
    29897249 : Jan2019 OPSS BP causes IGF Find/Search Interaction to Use "BASE: CN=USERS,DC=OIMDB"
    29123315 : Preventive code to avoid audit attribute lost if undefined attribute exists
    29020063 : 19c: Cannot instantiate plugin : SCIMPlugin ValidationFailedException

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.190716
    29429675 : High heap space required when credential store has too many credential maps
    29411343 : OPSS context in memory is not removed with fix for 28145575
    27600494 : STRESS:ISCS JPA provider eclipse link retry count delay value default set tozero
    27528997 : ConcurrentModificationException when trying to log into APICS console

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.190416
    28996665 : Fix for Bug 28996665
    28858713 : IdentityStoreConfigurationUtil to support custom type
    28673952 : WebLogic 12.2.1.0 - component_event.xlf files filling up /tmp filesystem
    28369965 : OIC:L2: NPE error -Keystore load failure -KeyStoreDataManager
    28368179 : Fix for Bug 28368179
    27718379 : After upgrading the listpermissions query is not returning the correct result.
    26222099 : IDCSSSOServiceProvider logout redirect not working - Incorrect query parameter
    21615694 : CREATE DOMAIN WITH DIFFERENT USER THAN THE PRODUCT INSTALL USER, FAILS

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.190115
    28767126 : Issue with OpssIdcsClient as jersey client is created in each request and not closed
    28752652 : OPSS policystore cache refresh issue after explicitly clearing cache
    28722803 : [APICSMT18.3.5-75 deadlock]504 Gateway Time-out retrieving roles page in longrunpod0915
    28599855 : reassociateSecStore failed on OID and DB against ps3bp stage32
    28581465 : oracle.igf.ids.GroupManager&oracle.igf.ids.UserManager searchUser&searchGroup
    28581344 : oracle.igf.ids.User&oracle.igf.ids.Group GetName is consuming escape character
    28143529 : Failed to get security store version will cause functionality broken
    27519253 : IDCSAppRoleImpl.<init>(java.lang.String) class mistch
    26911368 : MS24:REL12:P2T[ECNF->ECNF-TEST] FAILED AT STEP GENERATE FINAL REPORT
    26910194 : While failing writing the log , it should tell which file has the issue
    26865074 : REL12: JPS audit logs consume 2.52TB space on SaaS pod HCDY of Customer Synnex
    26828760 : OAC: ROLLBACK FAILING FROM 1743-1057 TO 1723
    26785742 : OPSS  - PRINCIPALS FROM OTHER INSTANCES ARE ADDED BY IDCS PROVIDER
    26649669 : AUDITLOADER STOPS IF THERE IS A ATTR DATA TYPE MISMATCH IN A MALFORMED AUDIT REC
    26516383 : SCIM ID STORE IDCS APPROLE SUPPORT
    26481220 : Audit Events are not Logged in 11.1.1.9.170721OPSSBP

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.181016
    28389103 : Http status: 429  message: Too Many Requests
    28323499 : Need expansion of remedy for jps.service.policystore.info.BasicPrincipalEntry
    28156927 : AuditReportTemplates.jar shipped in OPSShas BIP report issues in some cases
    28145575 : Stale OPSS artifacts remaining after the tenant is forced deleted.
    28110732 : IDS API COMPLAINS WHEN IDCS GROUP NAME CONTAINS A COMMA.
    28105735 : non-part MT not work with idstore.ldap
    28098387 : OPSS Audit Stopped working with OAM
    27879104 : IDCS searchAppRoles/searchUser see Operation not implemented in clountmt env
    27215868 : SSL support for OPSS DB security store connection in JSE

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.180717
    28164323 : WRONG PRINCIPAL RETURNED WITH X-RESOURCE-SERVICE-INSTANCE-IDENTITY-AP
    27635321 : Readiness check failed for IAU schema at PRIVILEGES_TEST
    27618283 : FA Location based access control needs to cover JpsAuth.getAllGrantedAppRoles
    27511030 : getIdentityStore() calls getVirtualizationService in cloudmt env
    27487992 : WRONG PRINCIPAL RETURNED WITH X-RESOURCE-SERVICE-INSTANCE-IDENTITY-AP
    27001039 : STRESS: Thread issues observed in OPSS REST Permission-set testcases
    26560641 : FA needs ability to run applications from public internet/private intranet.
    25704454 : Provide Replacement for or Restore GenericIdentityStoreProvider

 Issues Resolved in OPSS Bundle Patch 12.2.1.3.180417
    27423897 : upgrade assistant readiness check report error  on PRIVILEGES_TEST
    27358915 : Tenant Authorization fails with exception when using OPSS MT
    27280891 : getAppPolicy failed by SuiteInstanceBroker access deny against proxy data source
    27277928 : access denied on JpsPermission ServiceContextManager.find
    27126795 : access denied on JpsPermission SuiteInstanceBroker
    27119368 : MT-related system properties should be set automatically with JRF Cloud template
    27111323 : CNFE TenantContextFactory on NM start in JRF Cloud domain
    27093628 : Support proxy datasource in OPSS runtime
    27056349 : JpsFilter is called twice: JPS-00215 Switching context not permitted
    27006419 : Update jps-config.xml/jps-config-jse.xml when provisioning a MT domain
    26739728 : oracle.security.jps.service.policystore APIs incorrectly marked as concealed
    26117238 : MCR-44 FMW API Export - Missing Exports or Remediation Comments
    25873942 : cloud domain credstore mbean config in jps_mbeans inconsistent with jps-config
    25841089 : Too many duplicated warning messages in DataSeparation domain




DISCLAIMER:


Oracle Corporation recommends to upgrade to the next production patchset, when available.

 Applying this patch could overwrite other interim patches applied since the last patch set.

 Customers need to make a request to Oracle Support for a patch that includes those fixes, as well

 as inform Oracle Support about all the patches installed when a Service Request is opened.

 Please download, test, and provide feedback as soon as possible to assist in the timely resolution


of this problem. Copyright © 2021, Oracle and/oritsaffiliates.Allrightsreserved.
