Home » RDBMS Server » Networking and Gateways » Oracle LDAP connection fails over SSL with wallet (Oracle 12c SE1, Red Hat 6.5)
Oracle LDAP connection fails over SSL with wallet [message #642286] Sun, 06 September 2015 13:24 Go to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
When using an Oracle wallet (ewallet.p12) that is created with openSSL (not Oracle Wallet Manager), all works fine with wallet and Oracle XE 11.2.
However, when using same wallet, or creating a new wallet, with openSSL and using with Oracle SE1 12c (12.1.0.1), the issue reported previously occurs -- connection times out or gets disconnected.
Also will get ""unable to open wallet" errors with new wallet.

We are trying to do a LDAP call over SSL. A LDAP call using the non-SSL port works fine.
The call that is failing is DBMS_LDAP.open_ssl(session,wallet_dir,'XXXX',2);
Re: Oracle LDAP connection fails over SSL with wallet [message #642300 is a reply to message #642286] Mon, 07 September 2015 03:39 Go to previous messageGo to next message
John Watson
Messages: 8922
Registered: January 2010
Location: Global Village
Senior Member
Welcome to the forum. Please read our OraFAQ Forum Guide and How to use [code] tags and make your code easier to read

Can you show your code, and the error? Better show the whole lot, starting with your dbms_ldap.ldap_init call. Use copy/paste from a SQL*Plus session, and please remember to enclose te test in [code] tags.
Re: Oracle LDAP connection fails over SSL with wallet [message #642309 is a reply to message #642300] Mon, 07 September 2015 12:44 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
I can give you the following code, keeping in mind that the same code works in another environment with the only difference being the version and edition of Oracle -- XE 11.2g:


  DBMS_LDAP.use_exception := TRUE;
  
  -- Connect to the LDAP server.
  session := DBMS_LDAP.init(hostname => ldap_host, portnum => ldap_port);
  
  -- open ssl connection for secure communications   
  ret := DBMS_LDAP.open_ssl(ld => session, sslwrl => wallet_dir, sslwalletpasswd => 'XXXXXX', sslauth => 2);

  -- bind the service account
  ret := DBMS_LDAP.simple_bind_s(ld => session, dn => name, passwd => pw);



--Moderator edit: corrected the closing code tag, it was missing the /

[Updated on: Mon, 07 September 2015 12:54] by Moderator

Report message to a moderator

Re: Oracle LDAP connection fails over SSL with wallet [message #642310 is a reply to message #642309] Mon, 07 September 2015 12:56 Go to previous messageGo to next message
John Watson
Messages: 8922
Registered: January 2010
Location: Global Village
Senior Member
Come on, man! You need to run the code, in SQL*Plus, and copy/paste the whole lot. So far you have not even shown the error.
Re: Oracle LDAP connection fails over SSL with wallet [message #642314 is a reply to message #642310] Mon, 07 September 2015 17:30 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
Here is as much code as I can provide that is secure. Works fine on non-SSL port.

declare
  username      VARCHAR2(156) := 'bugs.bunny@yahoo.com';
  ldap_host     VARCHAR2(156) := 'myhost.org';
  ldap_port     NUMBER        := 1234;
  ldap_base     VARCHAR2(156);
  retval        PLS_INTEGER;
  attrs         DBMS_LDAP.string_collection;
  message       DBMS_LDAP.message;
  session       DBMS_LDAP.session;
  sa_name       VARCHAR2(156) := 'CN=ADBind,CN=Accounts,DC=yahoo,DC=users,DC=com';
  sa_pw         VARCHAR2(156) := 'carrot';
  wallet_dir    VARCHAR2(156) := 'file:/u01/app/oracle/product/12.1/wallet';
  
BEGIN
  
  DBMS_LDAP.use_exception := TRUE;
  
  session  := DBMS_LDAP.init(hostname => ldap_host, portnum => ldap_port);
    
  retval   := DBMS_LDAP.open_ssl(ld => session, sslwrl => wallet_dir, sslwalletpasswd => 'XXXXXX', sslauth => 2);

  retval   := DBMS_LDAP.simple_bind_s(ld => session, dn => sa_name, passwd => sa_pw);
   
  attrs(1) := 'DistinguishedName'; 

  retval   := DBMS_LDAP.search_s(ld => session, base => ldap_base, scope => DBMS_LDAP.SCOPE_SUBTREE, filter => 'mail='||username, attrs => attrs, attronly => 0, res => message);

  end;
 /


Here is the error from SQL *Plus (check.sql has code from above):

SQL> @check.sql
declare
*
ERROR at line 1:
ORA-03113: end-of-file on communication channel
Process ID: 17413
Session ID: 264 Serial number: 183


SQL>

[Updated on: Mon, 07 September 2015 17:44]

Report message to a moderator

Re: Oracle LDAP connection fails over SSL with wallet [message #642315 is a reply to message #642314] Mon, 07 September 2015 17:43 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
>ORA-03113: end-of-file on communication channel
additional clues may exist in alert_SID.log file

I suspect you will need to submit a Bug Report.
Re: Oracle LDAP connection fails over SSL with wallet [message #642316 is a reply to message #642315] Mon, 07 September 2015 17:45 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
Yes, indeed. I already have done so as a matter of fact.
Thank you for your time.
Re: Oracle LDAP connection fails over SSL with wallet [message #642321 is a reply to message #642316] Tue, 08 September 2015 02:03 Go to previous messageGo to next message
John Watson
Messages: 8922
Registered: January 2010
Location: Global Village
Senior Member
Your code compiles OK, but for me it fails (naturally) on the ldap_init on line 18:
orclz> declare
  2    username      VARCHAR2(156) := 'bugs.bunny@yahoo.com';
  3    ldap_host     VARCHAR2(156) := 'myhost.org';
  4    ldap_port     NUMBER        := 1234;
  5    ldap_base     VARCHAR2(156);
  6    retval        PLS_INTEGER;
  7    attrs         DBMS_LDAP.string_collection;
  8    message       DBMS_LDAP.message;
  9    session       DBMS_LDAP.session;
 10    sa_name       VARCHAR2(156) := 'CN=ADBind,CN=Accounts,DC=yahoo,DC=users,DC=com';
 11    sa_pw         VARCHAR2(156) := 'carrot';
 12    wallet_dir    VARCHAR2(156) := 'file:/u01/app/oracle/product/12.1/wallet';
 13
 14  BEGIN
 15
 16    DBMS_LDAP.use_exception := TRUE;
 17
 18    session  := DBMS_LDAP.init(hostname => ldap_host, portnum => ldap_port);
 19
 20    retval   := DBMS_LDAP.open_ssl(ld => session, sslwrl => wallet_dir, sslwalletpasswd => 'XXXXXX', sslauth => 2);
 21
 22    retval   := DBMS_LDAP.simple_bind_s(ld => session, dn => sa_name, passwd => sa_pw);
 23
 24    attrs(1) := 'DistinguishedName';
 25
 26    retval   := DBMS_LDAP.search_s(ld => session, base => ldap_base, scope => DBMS_LDAP.SCOPE_SUBTREE, filter => 'mail='||username, attrs => attrs, attronly => 0, res => message);
 27
 28    end;
 29   /
declare
*
ERROR at line 1:
ORA-31203: DBMS_LDAP: PL/SQL - Init Failed.
ORA-06512: at "SYS.DBMS_SYS_ERROR", line 79
ORA-06512: at "SYS.DBMS_LDAP", line 50
ORA-06512: at line 18


orclz>

What line does yours fail on?
Re: Oracle LDAP connection fails over SSL with wallet [message #642352 is a reply to message #642321] Tue, 08 September 2015 08:56 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
Line 20 is where the failure occurs. To reproduce you'll have to have a LDAP server to test against.
Re: Oracle LDAP connection fails over SSL with wallet [message #642353 is a reply to message #642352] Tue, 08 September 2015 09:01 Go to previous messageGo to next message
John Watson
Messages: 8922
Registered: January 2010
Location: Global Village
Senior Member
I'm sorry, Frank, but no-one can assist if you keep hiding information. You say that you getting an ORA-3113 on line 20, but you don't present any evidence for this.
Re: Oracle LDAP connection fails over SSL with wallet [message #642354 is a reply to message #642353] Tue, 08 September 2015 09:02 Go to previous messageGo to next message
Michel Cadot
Messages: 68625
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator

Also check alert.log and trace file and post the lines and file associated to your error.

Re: Oracle LDAP connection fails over SSL with wallet [message #642355 is a reply to message #642353] Tue, 08 September 2015 09:03 Go to previous messageGo to next message
Michel Cadot
Messages: 68625
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator

Quote:
I'm sorry, Frank


From his profile, Frank is Tony. Wink

Re: Oracle LDAP connection fails over SSL with wallet [message #642356 is a reply to message #642355] Tue, 08 September 2015 09:21 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
I've opened a SR with Oracle Support providing the alert log and trace file. Here is their response:

LOG FILE
-----------------------
Filename =incdir_41218/HDSTQA_ora_27959_i41218.trc
See the following error:
ORA-07445: exception encountered: core dump [gsignal()+53] [SIGIOT] [ADDR:0x200006D37] [PC:0x3337A32625] [unknown code] []

Oracle Support - Friday [ODM Issue Clarification]

On : 12.1.0.1 version, Internals Errors (ORA-600 & ORA-7445)

When attempting to run the following:

begin declare
begin
wwv_flow.g_boolean := pkg_sv_security.ldap_auth(
p_username => :p_username,
p_password => :p_password );
end;
end;

The following error occurs.

ERROR
-----------------------
ORA-07445: exception encountered: core dump [gsignal()+53] [SIGIOT] [ADDR:0x200006D37] [PC:0x3337A32625] [unknown code] []

================
Keep in mind that the Oracle XE 11g system (where this works) and the Oracle SE1 12c system (where the failure occurs) are identical systems (the latter is a VM image of the former, which is also a VM). The only difference is in the Oracle version and edition.
Also the PL/SQL call

pkg_sv_security.ldap_auth(
p_username => :p_username,
p_password => :p_password );

contains the code I gave previously.

[Updated on: Tue, 08 September 2015 09:29]

Report message to a moderator

Re: Oracle LDAP connection fails over SSL with wallet [message #642357 is a reply to message #642356] Tue, 08 September 2015 09:52 Go to previous messageGo to next message
John Watson
Messages: 8922
Registered: January 2010
Location: Global Village
Senior Member
Tony (Frank) please! You keep changing the error:

Starting with "unable to open wallet" then ORA-03113 and now it is an ORA-600 & ORA-7445. And you still have not shown what actually happens when you run that code. Can you just do that, in the same way that I did, from SQL*Plus? Of course you can change sensitive values after pasting.
Re: Oracle LDAP connection fails over SSL with wallet [message #642359 is a reply to message #642357] Tue, 08 September 2015 10:09 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
John (John),
The "Also will get ""unable to open wallet" errors with new wallet." issue I forgot to clarify on this post -- that was due to an invalid password that was being used during early testing. Please ignore that error as it has been resolved and I apologize for the confusion.

The file wallet_check.sql contains the SQL provided previously. Below is a SQL*Plus session:
=============================================================================================

[oracle@xxxxxxxx sql]$ sqlplus XXXXXXX/XXXXXXXX < wallet_check.sql

SQL*Plus: Release 12.1.0.1.0 Production on Tue Sep 8 10:01:29 2015

Copyright (c) 1982, 2013, Oracle. All rights reserved.

Last Successful login time: Tue Sep 08 2015 09:57:38 -05:00

Connected to:
Oracle Database 12c Release 12.1.0.1.0 - 64bit Production

SQL> SQL> SQL> SQL> SQL> SQL> SQL> 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 declare
*
ERROR at line 1:
ORA-03113: end-of-file on communication channel
Process ID: 2442
Session ID: 237 Serial number: 2823


SQL> Disconnected from Oracle Database 12c Release 12.1.0.1.0 - 64bit Production
[oracle@xxxxxxxx sql]$

And here is the trace file error:

Dump continued from file: /u01/app/oracle/diag/rdbms/hdstqa/HDSTQA/trace/HDSTQA_ora_2442.trc
ORA-07445: exception encountered: core dump [gsignal()+53] [SIGIOT] [ADDR:0x20000098A] [PC:0x3337A32625] [unknown code] []

I am assuming you don't want the entire dump....
Re: Oracle LDAP connection fails over SSL with wallet [message #642360 is a reply to message #642359] Tue, 08 September 2015 10:14 Go to previous messageGo to next message
John Watson
Messages: 8922
Registered: January 2010
Location: Global Village
Senior Member
Sorry, man, but I'm going to give up. All I asked for was that you copy/paste the SQL into a SQL*Plus prompt, just as I did, so that I can see what is happening.
Perhaps someone else can assist.
Re: Oracle LDAP connection fails over SSL with wallet [message #642361 is a reply to message #642359] Tue, 08 September 2015 10:19 Go to previous messageGo to next message
Michel Cadot
Messages: 68625
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator

ORA-00600/ORA-07445/ORA-03113 = Oracle bug => search on Metalink/MOS and/or call Oracle support
Have a look at alert.log and trace files.
You can also read this article: Troubleshooting Internal Errors.

Re: Oracle LDAP connection fails over SSL with wallet [message #642362 is a reply to message #642360] Tue, 08 September 2015 10:54 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
Here you go, John.
Connected to Oracle Database 12c Release 12.1.0.1.0 
Connected as XXXX

SQL> 
SQL> declare
  2  
  3     username      VARCHAR2(156) := 'X';
  4     ldap_host     VARCHAR2(156) := 'X';
  5     ldap_port     NUMBER        := 1234;
  6     ldap_base     VARCHAR2(156);
  7     retval        PLS_INTEGER;
  8     attrs         DBMS_LDAP.string_collection;
  9     message       DBMS_LDAP.message;
 10     session       DBMS_LDAP.session;
 11     sa_name       VARCHAR2(156) := 'CN=X,CN=X,DC=X,DC=X,DC=X';
 12     sa_pw         VARCHAR2(256) := 'X';
 13     wallet_dir    VARCHAR2(256) := 'file:/u01/app/oracle/product/12.1/wallet'; 
 14  
 15    begin
 16  
 17     DBMS_LDAP.use_exception := TRUE;
 18  
 19     session  := DBMS_LDAP.init(hostname => ldap_host, portnum => ldap_port);
 20  
 21     retval   := DBMS_LDAP.open_ssl(ld => session, sslwrl => wallet_dir, sslwalletpasswd => 'X', sslauth => 2);
 22  
 23     retval   := DBMS_LDAP.simple_bind_s(ld => session, dn => sa_name, passwd => sa_pw);
 24  
 25     attrs(1) := 'DistinguishedName';
 26  
 27     retval   := DBMS_LDAP.search_s(ld => session, base => ldap_base, scope => DBMS_LDAP.SCOPE_SUBTREE, filter => 'mail='||username, attrs => attrs, attronly => 0, res => message);
 28  
 29    end;
 30  /

ORA-03113: end-of-file on communication channel
Process ID: 3450
Session ID: 237 Serial number: 2979

SQL> 

Security is tight here ... Embarassed

[Updated on: Tue, 08 September 2015 11:58] by Moderator

Report message to a moderator

Re: Oracle LDAP connection fails over SSL with wallet [message #642363 is a reply to message #642361] Tue, 08 September 2015 10:56 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
Merci beaucoup Michel..
Re: Oracle LDAP connection fails over SSL with wallet [message #642364 is a reply to message #642363] Tue, 08 September 2015 11:07 Go to previous messageGo to next message
frankntx
Messages: 11
Registered: September 2015
Junior Member
Just got this from Oracle My Support:

This is Bug 18818847 - IO to cell timeouts after 5 minutes / dump on gsignal after cell restart/dump on skgxpdordmaqry

There is not a one-off patch for this on My Oracle Support for your release. Your release is the base release and the current supported release is 12.1.0.2

The solution is to:

- Migrate to 12.1.0.2 that has the fix for this issue and many others.

!! NOTE:
This upgrade is only available for Oracle EE 12c.
Oracle SE1 has no version 12.1.0.2. Beginning with the release of Oracle Database 12.1.0.2, Oracle Database Standard Edition (SE) and Oracle Database Standard Edition One (SE1) are no longer being released. 12.1.0.1 was the final edition for SE and SE1. Which means we will have to upgrade to SE2.

Thanks for everyone's help and I hope the NOTE I mentioned above helps others.

[Updated on: Tue, 08 September 2015 12:07]

Report message to a moderator

Re: Oracle LDAP connection fails over SSL with wallet [message #642365 is a reply to message #642364] Tue, 08 September 2015 12:04 Go to previous messageGo to next message
John Watson
Messages: 8922
Registered: January 2010
Location: Global Village
Senior Member
Thanks (I've added [code] tags Smile ) it doesn't help, does it?

If Oracle Support were right, you would have a big problem. You are using SE1, and 12.1.0.2 SE1 does not, and will not, exist for 12.1.0.2. So in effect, they are telling you to spend a lot more money on upgrading to SE2.

However, they have told you nonsense. You are using SE1, and that bug refers to Exadata. Better get back to them, and tell them that bug does not apply.
Re: Oracle LDAP connection fails over SSL with wallet [message #642366 is a reply to message #642365] Tue, 08 September 2015 12:08 Go to previous message
frankntx
Messages: 11
Registered: September 2015
Junior Member
Thanks John. Just found this out myself -- I think our emails just crossed over each other. I edited / updated my previous response that came from Oracle with a NOTE mentioning what you said.
Thanks again for your help.

[Updated on: Tue, 08 September 2015 12:09]

Report message to a moderator

Previous Topic: TNS adapter error
Next Topic: 12.1 to 9.2 database link
Goto Forum:
  


Current Time: Thu Mar 28 12:14:30 CDT 2024