Cannot log into OBIEE with correct username and password

You cannot log into OBIEE’s Web Interface with the WebLogic credentials.

Image(4)[4]

However, you can log into both Enterprise Manager (/em) and Console (/console) on the WebLogic server with the same login credentials that fail on OBIEE.

In addition to this, in Business Intelligence on Enterprise Manager, you notice a service component is down.

Image(5)[4]

The service component that does not come back is BIPublisher.

If these symptoms look familiar, you are most likely have an expired password for DEV_BIPUBLISHER for OBIEE.

Validate this error by going to the admin server at

_OBIEEINSTALL_\user_projects\domains\bifoundation_domain\servers\AdminServer\logs\AdminServer.log

and verifying exceptions like this:

####<DATESTAMP> <Warning> <JDBC> <SERVERNAME> <AdminServer> <DmsThread-2> <<WLS Kernel>> <> <0000JMlShBD5Ah_5xRG7yW1FI0nc000002> <1330230043844> <BEA-001129> <Received exception while creating connection for pool “EPMSystemRegistry”: ORA-28001: the password has expired>

####<DATESTAMP> <Info> <JDBC> <SERVERNAME> <AdminServer> <DmsThread-2> <<WLS Kernel>> <> <0000JMlShBD5Ah_5xRG7yW1FI0nc000002> <1330230043844> <BEA-001156> <Stack trace associated with message 001129 follows:

java.sql.SQLException: ORA-28001: the password has expired

at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:457)

at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:397)

at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:389)

at oracle.jdbc.driver.T4CTTIfun.processError(T4CTTIfun.java:662)

at oracle.jdbc.driver.T4CTTIoauthenticate.

processError(T4CTTIoauthenticate.java:438)

at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:476)

at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:204)

at oracle.jdbc.driver.T4CTTIoauthenticate.

doOAUTH(T4CTTIoauthenticate.java:370)

at oracle.jdbc.driver.T4CTTIoauthenticate.

doOAUTH(T4CTTIoauthenticate.java:817)

at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:376)

at oracle.jdbc.driver.PhysicalConnection.<init>(PhysicalConnection.java:670)

at oracle.jdbc.driver.T4CConnection.<init>(T4CConnection.java:230)

at oracle.jdbc.driver.T4CDriverExtension.

getConnection(T4CDriverExtension.java:34)

at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:567)

 

If you look at earlier log entries, you will find messages for failed BI Publisher component like this:

Invoking Start Up operation for application bipublisher on target AdminServer.

[Deployer:149193]Operation ‘start’ on application ‘bipublisher [Version=11.1.1]’ has failed on ‘AdminServer’

[Deployer:149034]An exception occurred for task [Deployer:149026]start application bipublisher [Version=11.1.1] on AdminServer.: MDS-01329: unable to load element “persistence-config”

MDS-01370: MetadataStore configuration for metadata-store-usage “MAR_TargetRepos” is invalid.

MDS-01376: Unable to get database connection from data source “mds-owsm” configured with JNDI name “jdbc/mds/owsm”.

weblogic.common.resourcepool.ResourceDeadException: 0:weblogic.common.ResourceException: Could not create pool connection. The DBMS driver exception was: ORA-28001: the password has expired

.

Operation Start Up on target bipublisher Failed. Please see error logs for details.

 

Both of these problems occur because the password for DEV_BIPLATFORM has expired.  Simply unlocking the database user at the database server alone will not fix this problem however.  This is because multiple unsuccessful login attempts will trigger WebLogic’s default user account lockout policy.

This is going to reflect in the log like this:

####<DATESTAMP> <Warning> <Deployer> <SERVERNAME> <AdminServer> <[ACTIVE] ExecuteThread: ‘6’ for queue: ‘weblogic.kernel.Default (self-tuning)’> <<WLS Kernel>> <> <2c9487c54460cae9:34d63673:135b1726afb:-8000-000000000000395b> <1330362796998> <BEA-149004> <Failures were detected while initiating start task for application ‘bipublisher [Version=11.1.1]’.>

####<DATESTAMP> <Warning> <Deployer> <SERVERNAME> <AdminServer> <[ACTIVE] ExecuteThread: ‘6’ for queue: ‘weblogic.kernel.Default (self-tuning)’> <<WLS Kernel>> <> <2c9487c54460cae9:34d63673:135b1726afb:-8000-000000000000395b> <1330362796998> <BEA-149078> <Stack trace for message 149004

oracle.mds.exception.MDSExceptionList: MDS-01329: unable to load element “persistence-config”

MDS-01370: MetadataStore configuration for metadata-store-usage “MAR_TargetRepos” is invalid.

MDS-01376: Unable to get database connection from data source “mds-owsm” configured with JNDI name “jdbc/mds/owsm”.

weblogic.common.resourcepool.ResourceDeadException: 0:weblogic.common.ResourceException: Could not create pool connection. The DBMS driver exception was: ORA-28001: the password has expired

at oracle.mds.config.PConfig.loadFromBean(PConfig.java:684)

at oracle.mds.config.PConfig.loadFromBean(PConfig.java:517)

at oracle.mds.config.PConfig.<init>(PConfig.java:341)

at oracle.mds.internal.lcm.

MDSLCMManager.getContentConfig(MDSLCMManager.java:2015)

at oracle.mds.internal.lcm.deploy.

DeployManager.deploy(DeployManager.java:505)

at oracle.mds.internal.lcm.deploy.DeployManager.

startDeployment(DeployManager.java:198)

at oracle.mds.internal.lcm.MDSLifecycleListenerImpl.start(MDSLifecycleListenerImpl.java:215)

at oracle.mds.lcm.weblogic.WLLifecycleListener.preStart(WLLifecycleListener.java:77)

at weblogic.application.internal.flow.

BaseLifecycleFlow$PreStartAction.run(BaseLifecycleFlow.java:282)

at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)

at weblogic.security.service.

SecurityManager.runAs(SecurityManager.java:120)

at weblogic.application.internal.flow.

BaseLifecycleFlow$LifecycleListenerAction.

invoke(BaseLifecycleFlow.java:199)

at weblogic.application.internal.flow

.BaseLifecycleFlow.preStart(BaseLifecycleFlow.java:62)

at weblogic.application.internal.flow.

HeadLifecycleFlow.prepare(HeadLifecycleFlow.java:283)

 

Then, policy lockout notices start showing up on log.

WSMAgentHook: An Exception is thrown: WSM-06162 The policy referenced by URI “oracle/wss_username_token_service_policy” could not be retrieved as connection to Policy Manager cannot be established at “t3://<SERVERNAME>:7001” due to invalid configuration or inactive state.

[nQSError: 43126] Authentication failed: invalid user/password.

Error Message From BI Security Service: WSM-06162 The policy referenced by URI “oracle/wss_username_token_service_policy” could not be retrieved as connection to Policy Manager cannot be established at “t3://<SERVERNAME>:7001” due to invalid configuration or inactive state.

 

Soon to be followed by repeated entries similar to this one:

[nQSError: 17014] Could not connect to Oracle database.

Supplemental Detail[nQSError: 17001] Oracle Error code: 28001, message: ORA-28001: the password has expired at OCI call OCISessionBegin.

 

The actual error for the service that is down looks like the following:

[68008] Scheduler Error:

Supplemental Detail Current Table: S_NQ_JOB.

[nQSError: 17001] Oracle Error code: 28001, message: ORA-28001: the password has expired at OCI call OCISessionBegin.

Current Table: S_NQ_JOB_PARAM.

[nQSError: 17001] Oracle Error code: 28001, message: ORA-28001: the password has expired at OCI call OCISessionBegin.

Current Table: S_NQ_INSTANCE.

[nQSError: 17001] Oracle Error code: 28001, message: ORA-28001: the password has expired at OCI call OCISessionBegin.

Current Table: S_NQ_ERR_MSG.

[nQSError: 17001] Oracle Error code: 28001, message: ORA-28001: the password has expired at OCI call OCISessionBegin.. Errors were encountered while initializing Scheduler’s backend database, check database configuration.

 

To solve this series of errors, we have to do few things

1. Go to database server and unlock user DEV_BIPLATFORM (and DEV_MDS user since these were created at the same time and would be locked as well.

2. On Enterprise Manager, go to JDBC Data Sources on WebLogic Domain for bifoundation_domain.

Image [6]

3. Click data source ‘mds-owsm’ (we know from log entry) to edit it.

Image [2]

4. Set password to match step 1 above.

Image [3]

5. Restart OBIEE from Enterprise Manager as usual.

You should be able to log into OBIEE now.

If you are on a development environment, you could just disable Weblogic’s lock-my-account policy to prevent this cascading set of events from locking your report developers out.

Simply go to ‘/console’ on server and disable account lockout policy.

1. Select ‘Security Realm’ from the left menu and then click ‘myrealm’ from main page.

Image [9]

2. On right pane, go to ‘User Lockout’, then uncheck ‘Lockout Enabled’ and save your work.

Image [10]

This will prevent multiple unsuccessful logins from locking user out of OBIEE.  Next time this happens, simply unlocking user at db server will suffice.  You many not want to do this in a server with a public IP.

Advertisements

19 thoughts on “Cannot log into OBIEE with correct username and password

  1. Good one Mario!

    I am facing one of the errrors in the one of the env. Any clue on this?

    WSMAgentHook: An Exception is thrown: WSM-06162 The policy referenced by URI “oracle/wss_username_token_service_policy” could not be retrieved as connection to Policy Manager cannot be established at “t3://:7001” due to invalid configuration or inactive state.

    [nQSError: 43126] Authentication failed: invalid user/password.

    …Error Message From BI Security Service: WSM-06162 The policy referenced by URI “oracle/wss_username_token_service_policy” could not be retrieved as connection to Policy Manager cannot be established at “t3://:7001” due to invalid configuration or inactive state.

    • Hey Bibin,

      I would first look into adminserver and nqserver logs to try and narrow down which account fails. Regardless which account, you end up in EM checking for security policy sets blocking you or some service you depend on. Good luck 😉

  2. Mario, thank you for your decision. It helps me a lot. But I want to say one little remark on step 5. The restarting OBIEE services through EM interface doesn’t help. I was forced to restart all services through Program Files menu i.e. “Stop BI Services” then “Start BI services”.

  3. Thanks,this is really helpfull. One question, the user DEV_BIPLATFORM password has expired, and I dont know it. So, once I change it, where do I have to update it? thanks again

  4. Hello Jorge,

    Sorry if I do not understand, please review step 3 above. This IS the steps were we update the password in Weblogic to match password updated in DB.

    Hope that helps,

  5. Mario, I had this same problem this was super helpful to me as I worked to resolve it. One extra thing I had to do was to make sure that I did step #1 (unlock the locked user accounts) again *after* I shut down the services, because the service shutdown would re-lock my user accounts!
    Thank you for writing this!

  6. Thanks a lot! It worked. I also had to stop bi services from ‘Start’ -> All Programs -> Oracle Business Intelligence, and then start bi services again.

  7. Hi Thanks for this awesome post. I had the same issue. I followed the all the steps. Now all my obiee services are up and running. 100%. But still i am not able to login to answer with weblogic credential. I can login to EM and console with the same credential. Please guide me.

    • Hello Sagarika, I am confused, you cannot log into ‘answer’? Do you mean OBIEE? Said user credentials work for all other apps right? I would narrow it down to the log for the failing app and follow that trails. Good luck

  8. Great on Mario! In my case it did not work out as i have an issue with wsm-pm(Deployments Application) not starting. I started that, changed the password in console of Security Realms(console) and also changed the same password for BI System User in Credentials –> System.User in the EM And then restarted all the OBIEE Processes from EM. Finally was able to get in! 🙂

  9. Omar Saad / Apr 26 2014 11:22 pm

    Please Note: Your comment is awaiting moderation.

    i have same problem and i try this solution but in the end step when i pres apply this msg appear

    Error occurred while updating the JDBC data source “mds-owsm”.
    The domain configuration has been locked by another administration tool or user. Retry after making sure that the lock is released. In most cases, you (or the other user) can unlock the domain configuration using the Change Center in the WebLogic Administration Console for this domain.

  10. Hello Omar Saad,

    It seems you have a database user locked error. You need to unlock this user before you can proceed. I am assuming you have SQL Developer. If not, go to Oracle for free download. As sys, go to manage the obiee repo users and unlock them (One of these names you give above as mds-owsm. I assume the other one is biplatform-owsm). These are the users created PRE-install with the rcu tool.
    Hope that helps, good luck.

    • i actually unlock the user from
      bifoundation_domain> Security> unlock user
      and write the both user
      and repeat steps again
      but unfortunately this not work and the same msg appear

  11. Hi Thanks for this awesome post. I had the same issue. I followed the all the steps. Now all my obiee services are up and running 100%. In my case I have unlock the user MDSYS.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s