Installing vApp 14.4 ends in error (IG is trying to create indexes before tables)

Products

• CA Identity Suite
• CA Identity Governance

Issue/Introduction

Installing a new environment from scratch, all services (IM,IP,IG) are getting problems getting up.

We found that the installation script is trying to create the INDEXES BEFORE the TABLES, from the oracle log side.

On the vApp, Reviewing the logs, wee found this (along with lots of other erros that can be ssen on the logs attached):

VDM2 and VDM3: IP/IM/IG

VDM4: PS/Userstore/CS

config@vdm3 VAPP-14.4.0 (<ip-address>):/opt/CA/VirtualAppliance/logs/IG_logs > cat eurekify.log | grep ERR
12:19:46,911 ERROR [org.springframework.jms.listener.DefaultMessageListenerContainer] (fixAlertsExecutorContainer-1) Listener exception overridden by rollback exception: javax.jms.IllegalStateException: Session is closed
12:19:47,030 ERROR [org.springframework.jms.listener.DefaultMessageListenerContainer] (tmsEventJMSClientContainer-1) Listener exception overridden by rollback exception: javax.jms.IllegalStateException: Session is closed
12:19:47,456 ERROR [org.quartz.core.ErrorLogger] (quartzScheduler_QuartzSchedulerThread) An error occured while releasing trigger 'CONTINUOUSUPDATES.liveNotificationsTrigger': org.quartz.JobPersistenceException: Failed to obtain DB connection from data source 'springNonTxDataSource.quartzScheduler': java.sql.SQLException: javax.resource.ResourceException: IJ000470: You are trying to use a connection factory that has been shut down: java:/jdbc/eurekifyDS [See nested exception: java.sql.SQLException: javax.resource.ResourceException: IJ000470: You are trying to use a connection factory that has been shut down: java:/jdbc/eurekifyDS]
12:35:09,584 ERROR [org.jboss.as.controller.management-operation] (ServerService Thread Pool -- 83) WFLYCTL0013: Operation ("add") failed - address: ([
12:35:14,748 ERROR [stderr] (MSC service thread 1-6) ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath. Using SimpleLogger to log to the console...
12:35:20,253 INFO  [stdout] (ServerService Thread Pool -- 93) 2022-03-25 12:35:20,253 [ServerService Thread Pool -- 93] ERROR com.workpoint.server.ConnectContext  - No dsn info found on close() for dsn='WPDS'. Cannot report connection issue for statistics processor.
12:35:20,254 INFO  [stdout] (ServerService Thread Pool -- 93) 2022-03-25 12:35:20,254 [ServerService Thread Pool -- 93] ERROR com.workpoint.server.ServerProperties  - Cannot get a handle for the Configuration Datasource 'WPDS' configured in the workpoint-server.properties. No data sources will be accessed from the configuration database.com.workpoint.common.exception.WpConnectionException: Could not get JDBC Connection; nested exception is java.sql.SQLException: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:/jdbc/WPDS

 

 

 

Oracle logs below:

Sessão

OS user cliente

Cliente

Instância

Conexão

Username

Tipo cliente

Timestamp

Tipo comando

Código de erro

Esquema

Objeto

SQL

3750874415

root

hostname

2

(TYPE=(DATABASE));(CLIENT ADDRESS=((ADDRESS=(PROTOCOL=tcp)(HOST=<IP-ADDRESS>)(PORT=35156))));(CLIENT ADDRESS=());

"ORACLE USER NAME HERE"

JDBC Thin Client

24/03/2022 11:47:53.505727000

CREATE TABLE

0

"SCHEMANAME"

I2_AUDIT_CARD_SHDW2

CREATE TABLE I2_AUDIT_CARD_SHDW2 AS SELECT * FROM I2_AUDIT_CARD WHERE CLIENT_ID=1

3253108959

root

hostname

2

(TYPE=(DATABASE));(CLIENT ADDRESS=((ADDRESS=(PROTOCOL=tcp)(HOST=<IP-ADDRESS>)(PORT=35152))));(CLIENT ADDRESS=());

"ORACLE USER NAME HERE"

JDBC Thin Client

24/03/2022 11:47:42.707934000

CREATE INDEX

942

"SCHEMANAME"

IX_I2_AUDIT_CARD_SHDW2

CREATE INDEX ix_I2_AUDIT_CARD_SHDW2 on I2_AUDIT_CARD_SHDW2 (CLIENT_ID, AUDIT_CARD_ID )

 

Tried to do the deploy 2 times on this environment.

The error seems to be the script execution order.

How can check it and make sure the tables were created BEFORE indexes on them?

 

 

 

Environment

Release : 14.4

Component :

Cause

The deployment of Vaap with several different components such as Identity Portal, Identity Manager , Identity Governance needs requirements that are available in the specific documentation of these components.

For this specific case, see in the Resolution field the first item was related to Identity Governance but the other points are requirements related to the Databases of the Identity Manager component

Resolution

1. Database character set needs to be AL32UTF8 verify -> "select * from nls_database_parameters where parameter like '%SET%';"

Answer: From this link here about SYMANTEC IDENTITY GOVERNANCE 14.4 Database Requirements: "Encoding — Identity Governance databases must use UTF-8 (AL32UTF8) encoding.". So that's correct about encondig of IG.

Also the same link confirms that yes, for IG needs DB Roles: CONNECT and RESOURCE The CONNECT role provides the create session permission. The RESOURCE role provides several create system privileges, and provides for previous Oracle database compatibility releases.

However the link also comments if you don't have empty DB schemas for IG needs DBA privilege instead of CONNECT and RESOURCE only. After the installation you can move CONNECT and RESOURCE in this case.

2. DB_BLOCK_SIZE for Identity Manager

-> The value of "Show parameter db_block_size" must be 8192.
-> The value of "Select BLOCK_SIZE from v$controlfile;" must be 16384.

Answer: Since this is a Oracle parameter we prefer points to Oracle doc here. 

3. The error ORA-01450 for Identity Manager

Answer: It is covered in the session in this link for Symantec Identity Manager : "Deploying Identity Manager Server Report Schema Can Fail on Oracle"

"Error in creating Report Snapshot database schema.java.sql.SQLException: ORA-01450: maximum key length (6398) exceeded. "

To ensure that the database can deploy the report schema, set the following three values within the Oracle database:
1. Database Character Set needs to be AL32UTF8

select * from nls_database_parameters where parameter like '%SET%';
2.Database Block Size.
Show parameter db_block_size – Value should be 8192
Select BLOCK_SIZE from v$controlfile; - Value should be 16384
3. NLS_LENGTH_SEMANTICS – This value must be BYTE for the DDL to work properly

4. Workpoint DB

In Identity Manager documentation session for "Separate Database Configuration (Optional)" available in this here in this link 

We have two links that redirect to IBM and Oracle related to requirement for the Oracle schema user to have specific permissions to use Oracle XA (for IBM and for Oracle)