EPM 11.1.2.2 Installation

For the last four years I have written a blog about the installation of each release of EPM 11 and this year there is going to be no exception as 11.1.2.2 has recently been released.

This release is more than just a bunch of fixes as it brings in new products, a multitude of product enhancements and changes to installation and configuration which I will be covering today.

This blog is going to be around highlighting where there are changes from the previous release and not a detailed installation guide as there are a number of documents now available that help cover that area.

I apologise if the blog contains any inaccuracies as a lot of it is new and I may have misunderstood a few details.

First I think it is worth going through a number of the new features and changes that I have picked out of the documentation.

“IBM WebSphere 7.0.0.19+ is now supported as an application server.” – I know deployment to WebSphere has been on the cards for a while and it is now supported, the deployment is not through the EPM configurator and there is a script available to deploy the web apps, the full process to follow is available here.

FireFox 10.x+ and Internet Explorer 9 are now supported Web browsers. – A big leap for the support of FireFox as 11.1.2.1 supported 3.5+, though still not supported for FDM.  IE9 is not supported on XP SP3.

I think the browser versions are going to play a big part if you are implementing Planning or HFM as they use new ADF interfaces which are optimised for IE9 and Firefox 10

Microsoft Office 2010 64 bit is now supported.

“After completing an EPM System deployment, you can generate a deployment report that provides information about configured Web applications, Web servers, databases, and data directories used by EPM System. This report can help you troubleshoot issues that might arise in your deployment.” – I have already seen a presentation of this feature and I will provide an example after I have gone through the configuration.

“The Oracle Enterprise Manager “Fusion Middleware Control” is now installed and deployed with EPM System. You can use this tool to manage the WebLogic domain and all Java Web applications in EPM System out of the box.”  - This was available in previous releases by extending the WebLogic domain which I blogged about here and now you don’t even have to worry as it is all configured automatically.

“The EPM System Media pack on Oracle Software Delivery Cloud has been simplified. Software downloads have been merged together.” – I will go through this shortly.

“Installation of Oracle HTTP Server is now optional. If you choose not to install Oracle HTTP Server, for example in a development environment, Oracle Hyperion Enterprise Performance Management System Installer installs an embedded WebLogic HTTP Server as part of Oracle Hyperion Foundation Services that acts as a proxy server. In a production environment, Oracle recommends that you install Oracle HTTP Server for use with Oracle WebLogic Server or IBM HTTP Server for use with WebSphere. You can also install and manually configure Apache HTTP Server with WebLogic Server.” – Interesting to see that there are number of additional options available instead of just OHS and IIS

“Microsoft Windows Installer (MSI) Client Installers are now provided for Oracle Essbase Client, Oracle Essbase Administration Services Console, Oracle Essbase Studio Console, and Oracle Hyperion Financial Management Client.” – It was possible to get EAS and Studio installers in a 11.1.2.1 patch but it looks like all the clients are finally available as standalone installers.

“Three new “rapid deployment” documents provide step-by-step instructions for building a typical Oracle Hyperion Planning, Financial Management, or Essbase development environment on a single server running Microsoft Windows.” – These documents were actually available in 11.1.2.1 but have now been updated for 11.1.2.2 and merged into the EPM documentation.

“A new Oracle Enterprise Performance Management System Standard Deployment Guide outlines the best-practice approach for deploying EPM System products. This approach is based on creating a base deployment of the products and then scaling out the services to handle the needed capacity.” – This was also available for 11.1.2.1 and has been brought up to date and merged into the standard documentation. Is there such thing as a standard deployment?

A new “ADF” Web application has been added for Financial Management. – Is this the start of FM moving away from being forced down the windows IIS route, once again I think the new ADF interface has been optimised for IE9 and Firefox 10 but I believe you are not forced to use it and can use the existing one.

FM Clusters are now managed centrally through the SS Registry  - “You can now manage Financial Management clusters from one machine. Cluster information is now stored in Oracle Hyperion Shared Services Registry rather than in the Windows registry.”

“The Oracle Hyperion Financial Reporting Print Server is now part of the Financial Reporting Web application. You no longer have to install the Print Server as part of the Financial Reporting Studio installation, and you no longer need Microsoft Office on the Print Server.” – All change again in this release but I believe it is a milestone as at last it looks like the print server is not windows only and there is no need to install a PDF renderer such as GhostScript.

“You can now deploy EPM System Web applications to a single managed server (compact server) in Development, Test, and Production environments. This reduces the overall memory requirement of EPM System and reduces startup time.” – Compact deployment was available in 11.1.2.1 and I blogged about it here but it was only supported for development and was a manual configuration. I will cover this new feature in more detail in a future blog.

There are additional important considerations if you are upgrading to 11.1.2.2 and using planning.

“Oracle Hyperion Calculation Manager has replaced Oracle Hyperion Business Rules as the mechanism for designing and managing business rules, therefore, Business Rules is no longer released with EPM System Release 11.1.2.2” – Business Rules have finally bit the dust so if you are currently using them and planning to upgrade then it is worth investing time getting up to speed with Calc Manager.  I will cover the migration in the near future.

The documentation also states that the server hosting planning must have at least 16GB ram, I am interested to understand if this new release of planning really does require that amount of memory and how does that fit into the world of compact deployment.

There is also reference to having to upgrade your client browser to use the new version of Planning –

“The new, improved Planning user interface requires efficient browsers to handle interactivity provided through Web 2.0 like functionality. In our testing, Internet Explorer 7, Internet Explorer 8, and Firefox 3.x are not sufficient to handle such interactivity, and the responsiveness in these versions of browsers is not as fast as the user interface in the previous releases of Planning. For this reason, we strongly recommend that you upgrade your browser to Internet Explorer 9 or Firefox 10 to get responsiveness similar to what you experienced in previous releases.”

It looks like it still possible to use the existing 11.1.2.1 user interface by setting the property ORACLE_ADF_UI in planning to false.

There have been a number of enhancements with Shared Services -

•    Allows you to rename the default admin account during the deployment process. 
•    After deploying Foundation Services, you can deactivate the default EPM System Administrator account after provisioning another user with the Shared Services Administrator role.

I know the ability to change or rename the admin account has been raised a number of times in the past and it is good to see that Oracle have taken note.

LCM has been given an overhaul with many new features and changes -

•    Simplified User Interface
•    Simplified Migration Definition File
•    Simplified Migration Status Report
•    Automatic Application Shell Creation for Classic Applications
•    Shared Disk Location defined in the configurator
•    Support for ERPi
•    Additional FR artifacts – Annotations, User POV, Batch jobs
•    New replace option for Reporting and Analysis where only artifacts that have a newer last modified timestamp will be imported.

So you can see this release does bring in quite a few additions and changes and that is before even getting into the detail of all the product enhancements.

Anyway on to the installation and the first step is to download the assembles from edelivery, I am going to be installing on a single Windows 2008 R2 x64 machine using Oracle 11g as the repository.

The installation prerequisites are available here and the support matrix here

Straight away you will notice there is a change from the previous releases and many of the files have now been combined.

Parts 1-4 contain the common components and WebLogic, OPMN, Installer plus the core products, 5-7 contains the rest of the product assemblies.

Oracle HTTP Server is a separate download.

The standalone clients are available in one download.

So hopefully this will cause less confusion like in the past with a prime example being the additional contents download.

There are also additional product download available that sit outside of the EPM installer such as DRM, EAL, ODI.

So how do you know which files you require well the easy option is just to download them all or

You can click the README button

This will open a report that breaks down each of the license components such as “Essbase Plus” and provides a list of the files to download.

 

If you expand the Part 6 download you can see that it contains all the essbase related product assemblies.

The clients download includes every standalone client installer which does stand in at 1.6GB in total

Once the files have been downloaded, extract them to the same base location then the process for installation is like in previous versions so the installer is started by running installTool.cmd/sh as an administrator

If you are installing on a distributed environment make sure you read the information here

When the installer starts up it will run through all the prerequisite checks, this screen is slightly different than in previous versions and you don’t have a command window running in the background which you used to have to check to see if any of the checks had failed for such things as UAC.

If any of the checks failed these will now be displayed in an error panel window.

Additional prerequisite checks will also be displayed indicating whether they have passed or failed, these checks look to be the same as previous 11.1.2 releases, though I don’t see the check against OHS anymore which is probably because it used to say that it had passed the check even if it hadn’t.

Select the location for EPM installation.

As this is a new installation only one option is available.

The option to install components by tier has now been removed probably because it was a bit of a waste of time as most of the time choose components individually was selected.

Oracle HTTP Server is not checked by default as it is optional so if you intend of using it then it will need to be selected.

Now that many of the installation files are combined then the likely hood is you are going to be given the option to be able to install lots more products than with previous versions.

All the product components were installed successfully so it is on to the configuration.

Before configuring make sure you have met all the configuration prerequisites outlined here

If you plan on using Web Services with products like APS, FM, PCM then make sure you follow the steps on creating the required schemas using the repository creation utility.

If you are configuring on a distributed environment then make sure you read here

This screen has changed a little in previous versions there the options to create a new instance or modify an instance.

The first step like in previous version is to define the connection information to the Shared Services and Registry database.

As previously the options are available to select to configure all the products at once or individually, if you are going to use a separate schema/database for each product then you will need to configure the products individually.

There are now two additional options for Reporting and Analysis, these are not new in terms of configuration all that happened is the options have been expanded to allow to configure Framework Services and FR RMI ports separately (Configure Database is required if configuring Framework Services)

Besides that the options are pretty much the same as previous 11.1.2 releases so I am not going to go through each of the products and the configuration as there is enough documentation out there to understand the process.

There is a new option to set the LCM Export Import Location which could be on a shared disk, previously the location was fixed unless changes were made to update the path in the Shared Services registry.

As this is the first configuration a new domain is created and the admin server port and admin user details set.

Please note this user is the admin user for WebLogic and nothing to do with Shared Services, in the past there have been a number of posts on the Oracle forums where there has been confusion between the two sets of admin users.

By default “Deploy the web application to a single managed server” is selected, this is known as compact mode which was available in the previous version.

Compact mode is useful is you want to combine a number web applications under one managed server which would be sharing the same JVM and running on one port, this helps reduce the overall memory consumption and start up time though it is worth understanding that if the JVM crashes for any reason then you take out all the products running under that managed server.

If you deselect the option then the web applications will each be deployed to their own managed server and port.

It also looks possible to have a number of web applications to run under one managed server and then have the rest deployed to their own managed server.

I am deploying each of the web applications to their own managed server and will be covering compact deployment and scaling out in a future blog.

If you are deploying FM then you will notice that there is the new ADF web application that is deployed to the same managed server as the Web Services.

 If you are combining all the products into one database then you have the option to use the Shared Services database or configured them to a new schema/database.

If you are configuring a database/schema per product then you would choose first-time configure of database.

Here is another change which I outlined earlier in that you can define the admin account name to be used instead of it being fixed to admin, I am going to be daring and test out the new functionality so I changed it to EPMADMIN.

 Once all the products have been configured then like previously the Configure Web Server should be run.

Configure Web Server component has two additional options, as highlighted earlier it is possible to use the Embedded WebLogic HTTP Server and there is also the option “Setup Registry for manual web server configuration” if you want to manually configure the HTTP server then the relevant config files will be generated in
<MIDDLEWARE_HOME>\user_projects\<instancename>\httpConfig\autogenerated

If you select the embedded WebLogic HTTP server you will see that it is deployed to the foundation port 28080.

I am assuming this means you can access workspace and all the web applications through that port which I am sure has the possibility to cause no end of confusion.

There have not been many changes to the windows services created.

If you deployed any of the web applications to a single managed server a new windows service will be created called "Hyperion EPM Server - Web Application"

Hyperion Financial Management - Web Services has been renamed to Hyperion Financial Management – Web Tier

The print server service is no more and the majority of the service names still start with HyS9

Another nice new feature is the ability to generate a deployment report that lists

•    All logical Web applications and all Web servers that are configured
•    The Web application URL and domain name for each Web application deployment on a machine
•    All databases configured for EPM System
•    The data directories used by EPM System products

To generate the report

Open a command line window and navigate to
<MIDDLEWARE_HOME>/user_projects/<instancename>/bin

Run the command epmsys_registry report deployment

 This by default will generate the report at
<MIDDLEWARE_HOME>\user_projects\<instancename>\diagnostics\reports\deployment_report.html

If you start up the WebLogic admin server and go to http://adminservername:7001/em then you should be able to log into Enterprise Manager with no additional configuration required.

I think I am going to leave it there for today as I need to test out all the products, I will update if I find any serious issues.

Next time I will be testing out applying the maintenance release to an existing 11.1.2.1 environment.

External authentication with Microsoft Active Directory in ODI 11g – Part 2

In the last part I went through the painful but easy when you know how process to set up ODI 11g Studio and repository to use external authentication through Microsoft Active Directory.

To be complete I thought I would cover setting up external authentication for the standalone agent which I go through today and then in the next part the J2EE agent and ODI console.

If you are considering setting up external authentication for a standalone agent then if you haven’t already make sure you read through the last part as there will be an assumption that you have configured the jps-config.xml file and generated the cwallet.sso file.

So let us see what the ODI documentation states about setting up the external authentication.

Standalone Agent

The configuration to connect and use the identity store is contained in an OPSS Configuration File called jps-config.xml file. Refer to the Oracle Fusion Middleware Application Security Guide for more information.

Copy this file in the ODI_HOME/agent/bin/ directory. The agent and the command line scripts will authenticate against the configured identity store.

So once again in its usual vagueness the documentation does not provide much detailed information but after already configuring the Studio you get the idea that you need to configure a jps-config.xml  and place it in the agent/bin

Before I go through the process I created a user in the AD to be used for the standalone agent called odi_agent, created the user in the Studio and then I configured the jps-config file and generated the cwallet.sso file based on the process in the last blog.

I generated the files in the <ODI_HOME>\oracledi\agent\bin directory.

The next step is to update the odiparams script to enter the connection information and agent user credentials.

The master repository encoded password was generated using the encode utility.

The ODI_SUPERVISOR variable was set to the AD user odi_agent.

The supervisor password was generated using the encode utility again.

If you look at the ODI_JAVA_OPTIONS variable you can see that there is a reference to the jps-config.xml file, the configuration assumes that the file is located in the same directory, if say you have the agent and the Studio on the same machine and want to use one instance of the file and wallet then you can update and add the full path to point to one location.

That’s pretty much all you need to do and you can start up the agent and all is good,well….

2012-04-03 20:40:44.920 ERROR odi.core.security.internal.ODIJpsHelper.createSubject Get exception. User:odi_agent. Execption msg is:oracle.security.jps.JpsRuntimeException: java.security.AccessControlException: access denied (oracle.security.jps.service.credstore.CredentialAccessPermission context=SYSTEM,mapName=JPS,keyName=msad.ldap.credentials read)        at oracle.security.jps.internal.jaas.module.idstore.IdStoreLoginModule.initializeLM(IdStoreLoginModule.java:663)

Unfortunately I was hit by the above error which didn’t fill me with joy.

I then added the additional parameters to the ODI_JAVA_OPTIONS variable in the odiparams script to turn on debugging.

"-Djps.auth.debug=true" "-Djps.auth.debug.verbose=true"

A large amount of errors were generated and it looks like the issue relates to java permissions on all the related packaged jars.

I decided to leave it there as there is the following bug on Oracle Support.

Bug 13255270: 'ACCESS DENIED...' ERROR WHEN STARING ODI STANDALONE AGENT WITH EXTERNAL AUTHENT

UPDATE : 25th April 2012

The bug in Oracle Support has been updated and I also got an anonymous comment on this blog entry from I assume the same person that has updated the bug.

I have removed my workaround as it was only temporary until a solution was available, hopefully the ODI documentation will be improved to reflect this.

First create a file called server.policy in the <ODI_HOME>\oracledi\agent\bin directory.

grant codeBase "file:${ODI_HOME}/../../-" {  
permission oracle.security.jps.service.credstore.CredentialAccessPermission "context=SYSTEM,mapName=*,keyName=*", "read";
};

paste the above grant statement into the file.

grant codeBase "file:${ODI_HOME}/../../-" {  
permission oracle.security.jps.service.credstore.CredentialAccessPermission "context=SYSTEM,mapName=JPS,keyName= msad.ldap.credentials", "read";
};

It is also possible to use the mapName and KeyName that are being used in the cwallet.sso file.

Edit odiparams.bat/sh and make sure ODI_HOME is set as an absolute path.

This could also be achieved by setting ODI_HOME as an environment variable instead of editing the file.

Also add the line

set ODI_ADDITIONAL_JAVA_OPTIONS=%ODI_ADDITIONAL_JAVA_OPTIONS% "-DODI_HOME=%ODI_HOME%"

The agent now starts up without any issues authenticating with the AD account.

Now if you want to take it one stage further and use OPMN to manage the agent and on windows create as a service then you could have a look at a previous blog I wrote on setting it up.

If you are going to use OPMN and go down the route outlined in the Oracle support document 1274484.1 or the equivalent Oracle by Example and install FMW 11g WebTier Utilities then

•    You don’t need to install WebTier Utilities 11.1.1.2 as 11.1.1.6 can be used and is available from here

•    When installing you don’t need to select Oracle Web Cache and can just select Oracle HTTP Server which will then install OPMN.

There are also a few things to watch out for when configuring OPMN to manage the agent with external authentication.

The configuration uses a template file in the agent\bin directory called odi_opmn_standaloneagent_template.xml

It is possible the usage of “./jps-config.xml” may be an issue when starting up the agent through OPMN as an error will be generated saying the file can’t be found, in this case the full path to jps-config.xml can be entered.

The configuration also defaults to a user name of SUPERVISOR so if you are using a different user for external authentication this will need to updated.

The changes can be made directly to the template file before adding the agent to OPMN or after adding the agent and updating opmn.xml which will be created in
<INSTANCE_HOME>\config\OPMN\opmn

Any changes to opmn.xml will require a full restart of OPMN.

Next time I will cover the steps to use external authentication with the J2EE agent and ODI console.

Planning 11.1.2.1 patch –Maintenance Mode utility

I just noticed a planning patch in Oracle support and thought I would share as I know the ability to change the maintenance mode in planning through a utility has been asked for so many times over the years on the planning forum, well it looks like Oracle have taken note of all the requests and finally come up with a utility to do this.

The patch details are - Release 11.1.2.1.101 Patch Set Exception (PSE): 13801144

Defect Number – 13798468

Details

A new utility is provided to set users’ log on level, which corresponds to Planning’s “Application Maintenance Mode” functionality by which administrators can grant and withdraw access to applications. 

If users are logged on to the application and administrators withdraw their access, users are forced off the system.

From the directory, enter this command at the Command Prompt, one space, and the parameters, each separated by a comma:

On Windows: MaintenanceMode.cmd
On UNIX: MaintenanceMode.sh

Options:
•    /A=app - Application name (required)
•    /U=user - Name of the administrator executing the utility (required)
•    /P=password - The administrator’s password (required)
•    /LL=loginLevel

[ALL_USERS|ADMINISTRATORS|OWNER] - Specify which users the utility affects (required):

o ALL_USERS - All users can log on or continue working with the application.

o ADMINISTRATORS - Only other administrators can log on. Other users are forced off and prevented from logging on until the parameter is reset to ALL_USERS.

o OWNER - Only the application owner can log on. All other users are prevented from logging on. If they are currently logged on, they are forced off the system until the option is reset to All_USERS or ADMINISTRATORS. Only the application owner can restrict other administrators from using the application.

•    /DEBUG=[true|false] - Specify whether to run the utility in debug mode. The default is false. (optional)
•    /HELP=Y - View the utility syntax online (optional)

For example, type:
MaintenanceMode.cmd /A=app1,/U=admin,/P=password,/LL=ADMINISTRATORS

I thought I would also install the patch and test it out so here are the steps to get up and running with it on windows.

The prerequisite to installing this patch is that you need to have patched planning to 11.1.2.1.101 – Patch 12666861

Please make sure you have carried out all your backup procedures before applying any patches.

If you have not yet applied patch 11.1.2.1.101 then download it from Oracle Support.

Also download the patch 13801144 which contains the new Maintenance Mode utility.

Stop all the EPM related services.

Extract the patches to /EPMSystem11R1/OPatch

OPatch is initiated from command line and the format for windows is

opatch.bat apply \EPMSystem11R1\Opatch\ -oh \EPMSystem11R1 -jre    \jdk160_21

Open a command prompt, change directory to the OPatch directory and run the above command (update to match the environment and

For example
E:
cd E:\Oracle\Middleware\EPMSystem11R1\OPatch
opatch.bat apply E:\Oracle\Middleware\EPMSystem11R1\OPatch\12666861 -oh E:\Oracle\Middleware\EPMSystem11R1 -jre E:\Oracle\Middleware\jdk160_21

Repeat for the utility patch e.g.

opatch.bat apply E:\Oracle\Middleware\EPMSystem11R1\OPatch\13801144 -oh E:\Oracle\Middleware\EPMSystem11R1 -jre E:\Oracle\Middleware\jdk160_21

To view which EPM patches have been applied on the server through OPatch you can use the following command.

opatch.bat lsinventory -oh   -jdk \jdk160_21

Next delete the temp directory on the planning server for the deployed planning web application - /user_projects/domains/EPMSystem/servers//tmp

e.g. E:\Oracle\Middleware\user_projects\domains\EPMSystem\servers\Planning0\tmp

This is so when the planning web application is started the ear file in the patch will be deployed and a new tmp directory created

The second patch will have deployed a file called MaintenanceMode.cmd.template to /EPMSystem11R1/products/Planning/bin   

Copy this file to /user_projects//Planning/planning1 and rename it to MaintenanceMode.cmd then edit the file

needs to be updated to the folder where the file has just been copied to.

Save and you are ready to go so start up the EPM services.

It is worth noting that the first patch that was applied updated a few CDFs so they will need to be refreshed by logging into each planning application and choosing
Administration > Application > Refresh Database > Update custom defined functions

Anyway let’s test the utility.

If you just run the Maintenance Mode utility without any parameters it will display the syntax required

The application is currently set just to be used by the Owner.

So let us change that to all users using the utility.

The change has been reflected in planning

How about changing it to Administrators while users are logged in.

Unfortunately nothing has changed there and it is not the nicest log out message but at least it does log the user out, if the user tries to log in the application again the standard application is in maintenance mode message is displayed.

I am sure this utility will be welcomed by many and it can easily be added into automated planning refresh scripts.