Clarity

 View Only
Expand all | Collapse all

Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

  • 1.  Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 15, 2020 12:34 PM
    Hello,
    does anybody know how to configure CA PPM to connect with Oracle 12.2 when the connection encryption (Oracle Advanced Security) is enabled? There is no problem connecting to the DB using sqlplus client, Jasper server is also able to connect without any problem, but when I try to configure the DB connection for PPM, it never works and the app always fails with "SQLException: Connection unavailable". I tried almost every configuration (using NSA, manually through editing properies.xml, tried setting up the connection string manually with reference to the official documentation for encrypted Oracle, tried connecting through service name and service id etc. etc.), but the result is always the same. DB security configuration is following:

    SQLNET.ALLOWED_LOGON_VERSION_CLIENT = 11

    SQLNET.ALLOWED_LOGON_VERSION_SERVER = 11

     

    SQLNET.CRYPTO_CHECKSUM_CLIENT = requested

    SQLNET.CRYPTO_CHECKSUM_SERVER = required

    SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA1, SHA256, SHA384, SHA512)

    SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA1, SHA256, SHA384, SHA512)

     

    SQLNET.ENCRYPTION_CLIENT = requested

    SQLNET.ENCRYPTION_SERVER = required

    SQLNET.ENCRYPTION_TYPES_CLIENT = (aes128, aes192, aes256)

    SQLNET.ENCRYPTION_TYPES_SERVER = (aes128, aes192, aes256)

    Typical error in application logs looks like this:

    2020/01/14 16:29:27.775 | SEVERE: Servlet [Clarity Web Control] in web application [/niku] threw load() exception2020/01/14 16:29:27.775 | SEVERE: Servlet [Clarity Web Control] in web application [/niku] threw load() exception2020/01/14 16:29:27.775 | com.niku.union.config.ConfigurationException: The application failed to start because of a database configuration problem.  Please review the application log for specific error information.2020/01/14 16:29:27.775 | at com.niku.union.config.ConfigurationManager.initAppServerType(ConfigurationManager.java:4117)2020/01/14 16:29:27.775 | at com.niku.union.config.ConfigurationManager.initAppServerIntern(ConfigurationManager.java:4050)2020/01/14 16:29:27.775 | at com.niku.union.config.ConfigurationManager.initAppServer(ConfigurationManager.java:4029)2020/01/14 16:29:27.775 | at com.niku.union.web.WebControlServlet.init(WebControlServlet.java:154)2020/01/14 16:29:27.775 | at javax.servlet.GenericServlet.init(GenericServlet.java:158)2020/01/14 16:29:27.775 | at org.apache.catalina.core.StandardWrapper.initServlet(StandardWrapper.java:1144)2020/01/14 16:29:27.775 | at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1091)2020/01/14 16:29:27.775 | at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:985)2020/01/14 16:29:27.775 | at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:4885)2020/01/14 16:29:27.775 | at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5199)2020/01/14 16:29:27.775 | at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)2020/01/14 16:29:27.775 | at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1412)2020/01/14 16:29:27.775 | at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1402)2020/01/14 16:29:27.775 | at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)2020/01/14 16:29:27.775 | at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)2020/01/14 16:29:27.775 | at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)2020/01/14 16:29:27.775 | at java.base/java.lang.Thread.run(Thread.java:834)2020/01/14 16:29:27.775 | 

    NSA log is a bit more helpful, but also not much:

    ERROR 2020-01-14 17:12:31,840 [http-nio-8090-exec-3] niku.xql2 (clarity:sa:Ei0R76jR8RB7b4K1jDl8nDgbfStZXvMB4J1hevBwNHA0:nsa.properties.database.save) PropertiesHandler errorERROR 2020-01-14 17:12:31,840 [http-nio-8090-exec-3] niku.xql2 (clarity:sa:Ei0R76jR8RB7b4K1jDl8nDgbfStZXvMB4J1hevBwNHA0:nsa.properties.database.save) PropertiesHandler errorjava.lang.Exception: Unable to persist configuration properties to database. Likely cause is database properties are not yet set or misconfigured. at com.niku.nsa.xbl.handlers.ConfigUpdateHandler.postProcess(ConfigUpdateHandler.java:180) at com.niku.xql2.handlers.InvokeHandler.postProcess(InvokeHandler.java:53) at com.niku.xql2.XQLVisitor.postProcess(XQLVisitor.java:1419) at com.niku.union.xml.dom.DOMWalker.postProcess(DOMWalker.java:210) at com.niku.union.xml.dom.DOMWalker.traverseIntern(DOMWalker.java:94) at com.niku.union.xml.dom.DOMWalker.traverseIntern(DOMWalker.java:92) at com.niku.union.xml.dom.DOMWalker.traverseIntern(DOMWalker.java:92) at com.niku.union.xml.dom.DOMWalker.traverse(DOMWalker.java:36) at com.niku.xql2.XQLProcessor.process(XQLProcessor.java:257) at com.niku.xql2.XQLProcessor.process(XQLProcessor.java:283) at com.niku.xql2.binding.ServiceControlBindingXql.processFile(ServiceControlBindingXql.java:390) at com.niku.xql2.binding.ServiceControlBindingXql.getDocument(ServiceControlBindingXql.java:273) at com.niku.xql2.binding.ServiceControlBindingXql.processRequest(ServiceControlBindingXql.java:157) at com.niku.union.service.ServiceControlImpl.processRequest(ServiceControlImpl.java:914) at com.niku.union.service.ServiceControlImpl.processRequest(ServiceControlImpl.java:212) at com.niku.union.web.WebServiceAdapter.processRequest(WebServiceAdapter.java:219) at com.niku.union.web.PortletController.processServiceRequest(PortletController.java:1431) at com.niku.union.web.PortletController.processProcessActionRequest(PortletController.java:235) at com.niku.union.web.PortletController.processRequest(PortletController.java:162) at com.niku.union.web.WebActionController.processAction(WebActionController.java:1464) at com.niku.union.web.WebActionController.processRequest(WebActionController.java:192) at com.niku.union.web.WebControlServlet.service(WebControlServlet.java:356) at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.niku.union.web.filter.ResponseHeaders.doFilter(ResponseHeaders.java:73) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.niku.union.web.filter.ResponseSecurityHeaders.doFilter(ResponseSecurityHeaders.java:158) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.niku.union.web.filter.ClarityContentFilter.doFilter(ClarityContentFilter.java:153) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.niku.union.web.filter.XSSFilter.doFilter(XSSFilter.java:129) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.niku.union.web.filter.SAMLFilter.doFilter(SAMLFilter.java:78) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.niku.union.web.filter.GZIPResponseFilter.doFilter(GZIPResponseFilter.java:138) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.niku.union.web.filter.TenantSetupFilter.doFilter(TenantSetupFilter.java:55) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at com.niku.union.web.filter.CharsetFilter.doFilter(CharsetFilter.java:45) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.filters.AddDefaultCharsetFilter.doFilter(AddDefaultCharsetFilter.java:89) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:528) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) at com.niku.union.web.valves.ErrorPageRedirectValve.invoke(ErrorPageRedirectValve.java:63) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:798) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:810) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1498) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.base/java.lang.Thread.run(Thread.java:834)Caused by: com.niku.union.config.ConfigurationException: Error persisting config: properties.xml at com.niku.union.config.ConfigurationManager.persistConfigFileToDatabase(ConfigurationManager.java:6057) at com.niku.nsa.xbl.handlers.ConfigUpdateHandler.postProcess(ConfigUpdateHandler.java:173) ... 71 moreCaused by: com.niku.union.persistence.PersistenceException: Error getting a DB connection at com.niku.union.persistence.PersistenceController.doProcessRequest(PersistenceController.java:620) at com.niku.union.persistence.PersistenceController.processRequest(PersistenceController.java:311) at com.niku.union.config.ConfigurationManager.persistConfigFileToDatabase(ConfigurationManager.java:6053) ... 72 moreCaused by: java.sql.SQLException: Connection unavailable at com.niku.union.persistence.connection.ApacheContext.getConnection(ApacheContext.java:213) at com.niku.union.persistence.PersistenceController.createLocalContext(PersistenceController.java:461) at com.niku.union.persistence.PersistenceController.doProcessRequest(PersistenceController.java:569) ... 74 more

    Any help would be highly appreciated. Thanks in advance.

    Best regards,

    Petr Zak



  • 2.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 15, 2020 03:07 PM
    Hi Petr,

    These errors are generic errors that the database connection is not happening, looks like something with the configuration is off. 

    Have you disabled the SSL_CLIENT_AUTHENTICATION? Check out this KB:
    https://ca-broadcom.wolkenservicedesk.com/external/article?articleId=130284



  • 3.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 15, 2020 03:52 PM
    Hello,
    thanks for the reply. That's the exact problem, the errors are too generic to get any useful information from them. I managed to pinpoint the problem by moving the DB between node which uses encrypted connection and node which doesn't; with the exact same configuration, application works on DB without encrypted connection and doesn't work on DB with encrypted connection. SSL is disabled, only the Oracle encryption (Advanced Security) is enabled. Unfortunately, I need to make it work when it's enabled, since it's customer policy.

    Thanks again,

    Petr


  • 4.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 15, 2020 05:31 PM
    Hi Petr

    I would check between the KB I provided and the documentation here to see if anything is missing or not set up correctly:
    https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/business-management/clarity-project-and-portfolio-management-ppm-on-premise/15-7/installing-and-upgrading/configure-clarity-ppm-with-oracle-database-encryption.html

    If you're not able to find out anything different from what's recommended, please open a Support case with us to take a deeper look. Thank you! -Nika


  • 5.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 16, 2020 01:48 AM
    Hello,
    I made sure that SSL is not used, so it's not the case described in KB. The documentation you linked is exactly what I used when I was trying to set it up, but I didn't manage to make it work. Either it's not the correct way or I got the parameters wrong, I tried a few combinations/possibilities, but with no luck. I opened support case two days ago (20258185), but I received no response yet. Thanks very much for your help.

    Best regards,

    Petr


  • 6.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 16, 2020 08:08 AM
    Hi Petr

    What is the JDBC URL you have used?

    ------------------------------
    Thanks & Regards
    Suman Pramanik
    Sr. Principal Support Engineer | Customer Success & Support, Enterprise Software Division
    Broadcom
    ------------------------------



  • 7.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 16, 2020 08:22 AM
    Hello, I've tried many different ones; I modified the default one to use ServiceName and tried, to use SID and tried, I tried to connect to both standalone and RAC cluster (using Oracle RAC scan and the link you posted here: https://community.broadcom.com/communities/community-home/digestviewer/viewthread?MID=714915), I tried adding different encryption/data integrity parameters as found here: https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/business-management/clarity-project-and-portfolio-management-ppm-on-premise/15-7/installing-and-upgrading/configure-clarity-ppm-with-oracle-database-encryption.html and a few other options. Every time, the result was the same error. Thanks for your help.

    Petr


  • 8.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 16, 2020 08:50 AM
    I want to understand why you have used SID or even RAC. Do you know what is your oracle Set up. Is it RAC or nornal setup . Can you get the clarity working without encryption. Has the encryption being enabled at database side. Can you share the properties.xml as well as SQLnet.ora file by masking the sensative details

    ------------------------------
    Thanks & Regards
    Suman Pramanik
    Sr. Principal Support Engineer | Customer Success & Support, Enterprise Software Division
    Broadcom
    ------------------------------



  • 9.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 16, 2020 10:44 AM

    Hello,
    we tried different setups based on what DB setups were available:
    * Connection to standard standalone Oracle DB with connection encryption enabled: NOT WORKING
    * Connection to Oracle RAC with database on node with connection encryption enabled: NOT WORKING
    * Connection to Oracle RAC with database on node without connection encryption: WORKING

    This is how we pinpointed that the problem is related to connection encryption in the first place. Unfortunately, I'm unable to attach whole files right now, but the working setup uses connection string like this: jdbc:clarity:oracle://oracscan:1521;ServiceName=serviceTNS;BatchPerformanceWorkaround=true;InsensitiveResultSetBufferSize=0;ServerType=dedicated;supportLinks=true;AlternateServers=(oracscan:1521);FailoverMode=Select;ConnectionRetryCount=20;ConnectionRetryDelay=15;LoadBalancing=true"

    And the encryption setup on the DB side is this:

    SQLNET.ALLOWED_LOGON_VERSION_CLIENT = 11

    SQLNET.ALLOWED_LOGON_VERSION_SERVER = 11

     

    SQLNET.CRYPTO_CHECKSUM_CLIENT = requested

    SQLNET.CRYPTO_CHECKSUM_SERVER = required

    SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (SHA1, SHA256, SHA384, SHA512)

    SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA1, SHA256, SHA384, SHA512)

     

    SQLNET.ENCRYPTION_CLIENT = requested

    SQLNET.ENCRYPTION_SERVER = required

    SQLNET.ENCRYPTION_TYPES_CLIENT = (aes128, aes192, aes256)

    SQLNET.ENCRYPTION_TYPES_SERVER = (aes128, aes192, aes256)

    If it would be helpful, I can get whole properties.xml (for the working case, for the faulty ones we tried many different settings and I don't have backups of them) and I can try to ask the DB administrator for the SQLnet.ora file.

    Thanks very much for all your help.

    Petr

     




  • 10.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 16, 2020 03:15 PM
    Hi Petr

    Can you ensure you have the oracle encrytion set up correctly , you can use this as reference https://docs.oracle.com/cd/E11882_01/network.112/e40393/asoconfg.htm#ASOAG9593

    Also in the SQLNET.ora can you set the below and also the sample JDBC URL is provided 

    SQLNET.ENCRYPTION_CLIENT=accepted
    SQLNET.ENCRYPTION_SERVER=required
    SQLNET.ENCRYPTION_TYPES_SERVER=AES256

    url="jdbc:clarity:oracle://databaseserver1.ca.com:1521;ServiceName=clrtydev;BatchPerformanceWorkaround=true;InsensitiveResultSetBufferSize=0;ServerType=dedicated; supportLinks=true;EncryptionLevel=requested;EncryptionTypes=AES256"

    ------------------------------
    Thanks & Regards
    Suman Pramanik
    Sr. Principal Support Engineer | Customer Success & Support, Enterprise Software Division
    Broadcom
    ------------------------------



  • 11.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 17, 2020 09:48 AM
    Hello,
    yes, configuration of the database side was checked by db admins, also multiple other applications (including Jaspersoft Reporting server) work flawlessly with the same setup.

    Setting the URL like this is exactly one of the options I tried; I tried setting EncryptionLevel to both requested and required, I tried setting EncryptionTypes to the ones stated in sql configuration, I tried to set only EncryptionLevel and not EncryptionTypes etc. None of the options I considered reasonable worked.

    Petr


  • 12.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 17, 2020 10:11 AM
    Hi Petr

    We did have this configuration working and what I can do is test this in house also to see if the encryption working in 15.7.1 also. However can you share me the sqlnet.ora and properties.xml and use the JDBC url and connect from oracle sql developer to see if that works

    ------------------------------
    Thanks & Regards
    Suman Pramanik
    Sr. Principal Support Engineer | Customer Success & Support, Enterprise Software Division
    Broadcom
    ------------------------------



  • 13.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 17, 2020 10:26 AM
    Hello,
    thank you very much. I will acquire both files and get back to you ASAP.

    Best regards,

    Petr Zak


  • 14.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 20, 2020 10:35 AM
    Hello,
    please find both files attached, properties.xml is anonymized. Thanks for all your help.

    Petr

    Attachment(s)

    xml
    properties.xml   8 KB 1 version
    txt
    sqlnet.ora.txt   495 B 1 version


  • 15.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 23, 2020 10:27 AM
      |   view attached
    Hello Suman,
    we did some more tests and I managed to create a backup of all the jdbc links we tried and none of them worked. Please find the anonymized file attached. I really hope you will find some time to look into this and I'm really sorry to bother you, but this issue is really business-critical now, we are not able to find a way to solve it and after a week of waiting, trying and even raising concerns, support closed my ticket (#20258185) without providing a solution. Thanks very much for all your help.

    Best regards,

    Petr Zak

    Attachment(s)



  • 16.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 23, 2020 10:41 AM
    I see your encryption level is EncryptionLevel=requested; can you change that to required 

    Did you follow the instruction on our guide https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/business-management/clarity-project-and-portfolio-management-ppm-on-premise/15-7-1/installing-and-upgrading/configure-clarity-ppm-with-oracle-database-encryption.html

    jdbc:clarity:oracle://server:1521;ServiceName=serviceTNS;BatchPerformanceWorkaround=true; InsensitiveResultSetBufferSize=0;ServerType=dedicated;supportLinks=true;DataIntegrityLevel=required; EncryptionLevel=required;EncryptionTypes=(RC4_256,AES192,3DES112);


    ------------------------------
    Thanks & Regards
    Suman Pramanik
    Sr. Principal Support Engineer | Customer Success & Support, Enterprise Software Division
    Broadcom
    ------------------------------



  • 17.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 23, 2020 10:42 AM
    even your sqlnet.ora is incorrect. Please follow the exact steps documented and it must work

    ------------------------------
    Thanks & Regards
    Suman Pramanik
    Sr. Principal Support Engineer | Customer Success & Support, Enterprise Software Division
    Broadcom
    ------------------------------



  • 18.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 23, 2020 11:19 AM
    Hello,
    thanks for your reply.
    * Yes, I followed the document. The file was just an example, I also tried setting it to required on the PPM side with same result, but I can retry and provide you with similar list of tried links.
    * What do you mean by sqlnet.ora being incorrect? I didn't set up or configure the DB, it is customer DB and the configuration was done by customer DB admins according to their policies. But I can ask the customer to do some changes, at least temporarily for testing purposes...what do you thing is wrong and should be changed?

    Thanks very much,

    Petr


  • 19.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)
    Best Answer

    Posted Jan 28, 2020 10:29 AM
    Hello,
    I finally managed to resolve the problem. Indeed, the problem was in the connection string, I managed to find the correct one by trial and error method:

    jdbc:clarity:oracle://kkora01.customer.xx:1521;ServiceName=ppmtstdb.customer.xx;BatchPerformanceWorkaround=true;InsensitiveResultSetBufferSize=0;ServerType=dedicated;supportLinks=true;DataIntegrityLevel=required;EncryptionLevel=required;EncryptionTypes=(AES128,AES192,AES256);

    No change had to be done in the sqlnet.ora configuration.

    Too bad this is not documented more thoroughly in the installation guide. Also note that even with correct string, NSA was still showing the error, I had to try to start application to see if it is working.

    Thanks everybody for help, especially Suman for pointing me in the correct direction.

    Best regards,

    Petr


  • 20.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Broadcom Employee
    Posted Jan 29, 2020 04:00 AM
    Thanks Petr, glad to hear you got it working. in terms of documentation what you would like to see as improvement let us know we will try to incorporate that.

    ------------------------------
    Thanks & Regards
    Suman Pramanik
    Sr. Principal Support Engineer | Customer Success & Support, Enterprise Software Division
    Broadcom
    ------------------------------



  • 21.  RE: Connection of CA PPM 15.7.1 to Oracle 12.2 DB with encrypted connection (Advanced Security)

    Posted Jan 29, 2020 04:43 AM

    Hello,
    what would have been really helpful for me is some table, showing possible settings like this:

    sqlnet.ora parameter | CA PPM connection string parameter
    SQLNET.CRYPTO_CHECKSUM_SERVER = required | DataIntegrityLevel=required
    SQLNET.CRYPTO_CHECKSUM_SERVER = requested | DataIntegrityLevel=requested
    .
    .
    .
    SQLNET.ENCRYPTION_SERVER = required | EncryptionLevel=required
    SQLNET.ENCRYPTION_SERVER = requested | EncryptionLevel=requested
    .
    .
    .
    SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (type1, type2, type3) | no parameter needed
    SQLNET.ENCRYPTION_TYPES_SERVER = (type1, type2, type3) | EncryptionTypes=(type1,type2,type3)

    It may seem obvious, but it took us a lot of time and work to find out correct combination of the parameters. 

    Thanks again a lot for all your help and have a nice day!

    Petr