Oracle Access Management 12.2.1.4.241009 BP includes the following new features and enhancements:

• Setting the GCM API Key

  Google is deprecating legacy FCM APIs and migrating to HTTP v1 APIs. For all new configurations, it is recommended to use HTTP v1 APIs. For the steps to migrate to HTTP v1 APIs, see Migrating to service account JSON for Android Push Notifications.

• Automating SAML Certificate or Key or Metadata Rotation

  You can schedule the retrieval of new partner certificates and metadata via a REST endpoint and seamlessly rotate the updated credentials across all dependent systems and applications without any downtime. For more details, see Automating SAML Certificate or Key or Metadata Rotation.

• Ability to Load the Fusion Page in Visual Builder (VB)

  In the Chrome browser, some OAM cookies were blocking the Fusion page from loading in the Visual Builder (VB) after the third-party cookies were deprecated. With this release, Cookies Having Independent Partitioned State (CHIPS) support is added for OAM/Webgate cookies to overcome this issue. For more details, see OAM Cookies Block the Fusion Page from Loading in VB after the 3rd Party Cookies are Deprecated.

• Ability to Retrieve an ID Token Through an Authorization Code

  You can retrieve both access and ID tokens when using the refresh token in the authorization code. For more details, see Getting IDtoken via a Refresh Token Request.

• Best Practices for Oracle Access Manager (OAM) OAuth Security

  Added best practices for OAM OAuth security that highlight the possible threats and strategies to mitigate those risks. For more details, see Best Practices for Oracle Access Manager (OAM) OAuth Security.

• OAA Error Handling Plugins

  Added new plugins to support MFA on the User Preferences page. For more details, see OAA Error Handling Plugins.

• Ability to Add Partner Signing and Encryption Keys

  A new Key Configuration section was added to the OAM Console allowing you to select the partners signing and encryption keys when creating a new Identity Provider (IdP) or Service Provider (SP). For more details, see Use Oracle Access Manager to sign on to Oracle Private Cloud Appliance.

• Ability to Configure Reuse Detection for Refresh Tokens

  Added a new property to detect the reuse of the Refresh Tokens. For more details, see Configuring reuse detection for Refresh Tokens.

Oracle Access Management 12.2.1.4.240701 BP includes the following new features and enhancements:

• Connecting with Messaging Server

  If you configured push notifications for Android then you should migrate to HTTP v1 API's by following the steps mentioned in Migrating to service account json for Android Push Notification.

• Enhanced OAM 12c OAuth to Support RS512 in Addition to RS256 (Default) as the Crypto Algorithm for Signing the OAuth Token

  • Introduced an OAuth system property (-DoauthRS512Enabled=true) to enforce RS512 crypto algorithm when enabled across all OAuth Identity Domains (Default - RS256). Add the system property to setDomainEnv.sh to enable this feature.

  • Introduced an OAuth custom attribute (oauthRS512Enabled=true) to enforce RS512 crypto algorithm when enabled on specific OAuth Identity Domains (Default - RS256).

  Note:

  When both are set the system property overrides the OAuth Identity Domain custom attribute in enforcing the RS512 crypto algorithm.

Oracle Access Management 12.2.1.4.240328 BP includes the following new features and enhancements:

• User Password Change Validation

  Setting the userPasswordChangeCheckEnabled=true property in oam-config.xml validates the tokens generated before the user password update. If the user updates or changes the password after retrieving the access tokens then those access tokens generated before the password update will be invalid. The user will need to regenerate the access tokens after the password is updated. For details, see Enabling User Password Change Validation.

  Note:

  Perform a GET operation on the /DeployedComponent/Server/NGAMServer/Profile/ssoengine/OAuthConfig endpoint and a PUT operation on the same endpoint to enable User Password Change Validation feature. It ensures that the configuration that has already been applied continues to be effective.

• Ability to Customize Issuer Discovery Identifier and Iss Token Claim

  With the implementation of this enhancement, you can mask or omit the port from the issuer and customize the path component in the OpenID configurations. For details, see Custom Issuer Support.

  Note:

  Perform a GET operation on the /DeployedComponent/Server/NGAMServer/Profile/ssoengine/OAuthConfig endpoint and a PUT operation on the same endpoint to enable Custom Issuer Support feature. It ensures that the configuration that has already been applied continues to be effective.

• Ability to Change Default Consent Acknowledgment Expiry Time

  A new custom attribute consentAcknowledgeExpiryTimeInSeconds allows you to change the default expiry time to acknowledge the consent approval. For details, see Changing Default Consent Acknowledgment Expiry Time.

• Ability to Set the Expiry Time for ID_TOKEN

  You can set a token validity/expiry time for ID_TOKEN instead of using the validity/expiry time in the ACCESS_TOKEN settings. For details, see Creating an Identity Domain.

• Client Secret Expiration and Rotation

  By using the custom attribute oldSecretRetentionTimeInDays, you can configure the time for which the old client secret will continue to work. This custom attribute can be defined both at the domain-level and at the client-level. However, the value defined at the client-level takes precedence. For details, see Creating an Identity Domain.

• Added New Field to View API Key

  With this release a new field API Key is added in the partner details screen. This field allows administrators to share the key details with the relevant partners for secure updates. For details, see Configuring the Signing and Encryption Key.

• Ability to Check Authentication Context When OAM is Acting as a Service Provider (SP)

  If OAM is acting as a SP, it identifies the Authentication Context of any external SAML Identity Provider (IdP) and proceeds with the SAML authentication based on the authnassurancelevel property. For details, see Checking Authentication Context when OAM is acting as SP.

• Ability to Mask SAML Response Attributes in OAM Log Messages

  With this release, Oracle Access Management masks SAML Response attributes in OAM log messages. For details, see Masking SAML Attributes in Log Records.

Oracle Access Management 12.2.1.4.240109 BP includes the following new features and enhancements:

• Propagating an Error Code from OAA Application to the OAM Login Page

  This enhancement propagates an error code from Oracle Advanced Authentication (OAA) application to OAM login page. The login page can be customized to show the error message propagated from OAA.

  The following error codes are supported:

  • Error code: OAA-00001

    Reason: User Registration was incomplete.

    Cause: No factors registered.

  • Error code: OAA-00002

    Reason: User did not have any usable factors.

    Cause: Maxed out of allowed authentication attempts. Matching factor(s) are disabled. No required factor(s) available for matching Policy.

  • Error code: OAA-00003

    Reason: User authentication failure.

    Cause: User did not submit valid authentication data.

  • Error code: OAA-00004

    Reason: System temporarily unavailable.

    Cause: Unexpected failure in Service during login. For example, Failure to send a challenge (Push, Email, SMS), Database outage.

• Enhancing OAM Session Management Endpoints

  Introduced a mechanism to authorize OAM endpoints using TAP Tokens.

• Added Null Checks for Programmatic Authn REST Interfaces
  The following fixes are made as a part of this enhancement:

  • Resolved the Null Pointer Exception that occurs when No Auth is selected as the authentication method.
  • In the session validation API, Null Pointer throws an exception when a random string is supplied as an OAM_RM token.
• Added PublicClientRefreshTokenEnabled Client Custom Attribute to Obtain a Refresh Token with a Public Client
  By default it is not possible to obtain a refresh token with a public client. The PublicClientRefreshTokenEnabled client custom attribute allows you to change this behavior. To enable the feature set the attribute value to true. For example, create the oauth public client with the following command:

  curl -X POST http://<AdminServerHost:Port>/oam/services/rest/ssa/api/v1/oauthpolicyadmin/client -H 'Authorization:Basic d2VibG9naWM6d2VsY29tZTE=' -H 'Content-Type: application/json' -d '{"id":"PublicClientId","name":"PublicClient","scopes":["ResServer1.scope1"],"clientType":"PUBLIC_CLIENT","secret":"welcome1","idDomain":"TestDomain1","description":"Client Description","grantTypes":["PASSWORD","CLIENT_CREDENTIALS","JWT_BEARER","REFRESH_TOKEN","AUTHORIZATION_CODE"],"defaultScope":"ResourceServerOud1.scope1","redirectURIs":[{"url":http://localhost:8080/Sample.jsp,"isHttps":true}], "attributes":[{"attrName":"PublicClientRefreshTokenEnabled","attrValue":"true","attrType":"static"}]}'

• Added GrantTypeRefreshTokenEnabled Client Custom Attribute to Return a Refresh Token Along with a New Access Token
  By default, when the grant type is refresh_token, only a new access token is returned. The GrantTypeRefreshTokenEnabled client custom attribute allows you to have a refresh token returned as well. To enable the feature set the attribute value to true. For example, create the oauth confidential client with the following command:

  curl -X POST http://<AdminServerHost:Port>/oam/services/rest/ssa/api/v1/oauthpolicyadmin/client -H 'Authorization:Basic d2VibG9naWM6d2VsY29tZTE=' -H 'Content-Type: application/json' -d '{"id":"TestClientId","name":"TestClient","scopes":["ResServer1.scope1"],"clientType":"CONFIDENTIAL_CLIENT","secret":"welcome1","idDomain":"TestDomain1","description":"Client Description","grantTypes":["PASSWORD","CLIENT_CREDENTIALS","JWT_BEARER","REFRESH_TOKEN","AUTHORIZATION_CODE"],"defaultScope":"ResServer1.scope1","redirectURIs":[{"url":http://localhost:8080/Sample.jsp,"isHttps":true}], "attributes":[{"attrName":"GrantTypeRefreshTokenEnabled","attrValue":"true","attrType":"static"}]}'

  Note:

  To revoke the old refresh_token while invoking the refresh_token grant type set the system property -Doauth.auto.revoke.enabled=true. The default value of this system property is false.
• Support for Response_mode in the Authorization Code Grant Flow

  This enhancement allows 3-legged OAM OAuth 2.0 workflow API (/oauth2/rest/authorize) to respond in different modes like fragment , query or form_post by specifying response_mode as a query parameter.

• Support for 3-legged OAuth 2.0 Workflow to Return the Appropriate Response Mode

  This enhancement ensures that 3-legged OAM OAuth 2.0 workflow API (/oauth2/rest/authorize) returns the appropriate response mode response_mode=form_post if the consent expiry time has been set.

• Support for Limiting PIN Generation During the Second Factor Authentication

  New properties MaxSendAttempts and MaxSendAttemptsLockoutEnabled are added to the Adaptive Authentication Plugin to limit the PIN generation during the Second Factor Authentication. For details, see Limiting PIN Generation During the Second Factor Authentication.

Oracle Access Management 12.2.1.4.231005 BP includes the following new features and enhancements:

• New Parameter to Fetch the Authorization Grant Details

  Added a new parameter response_mode to fetch the authorization grants to redirect_uri. For details, see Table 39-7 Parameter Values for response_mode.

• Support for Authentication in Multiple Browser Tabs

  OAM supports multi-tab feature when serverRequestCacheType parameter is set to COOKIE. For details, see Supporting Authentication in Multiple Browser Tabs.

• OAM OAuth2 Runtime Endpoint to Support Domain as a Query Parameter
  A new query parameter identityDomain is added to the oauth2 runtime endpoint instead of the header parameter X-OAUTH-IDENTITY-DOMAIN-NAME. The header parameter X-OAUTH-IDENTITY-DOMAIN-NAME is not required when identityDomain is provided. If both parameters are used, X-OAUTH-IDENTITY-DOMAIN-NAME will take precedence over identityDomain. For details, see:

  • Create Access Token Flow
  • Introspect OAuth tokens
  • Revoke given access/refresh token
  • UserInfo details for OIDC flows
• OAM OAuth2 Token Validation URL Supports Passing access_token both as a Header and as a Query Parameter

  The access_token can be passed either as a header parameter or as a query parameter in the token validation URL. New syntax to initiate access_token as a header and as a query parameter are included in the REST API for OAuth. For details, see Validate Access Token Flow.

Oracle Access Management 12.2.1.4.230628 BP includes the following new features and enhancements:

• Support for Administering a Secret Key

  OAM supports administering a secret key using an access token with the BEARER authorization header by enabling the Secret Key Lifecycle feature.

  For more information, see Administering a Secret Key.

• Access Token Exchange Support in OAM

  Support for token exchange is made available in this release.

  For more information, see Token Exchange Support in OAM.

• OpenIdConnectPlugin plugin to Set Tokens as Session Responses
  OIDC token values can be retrieved using policy authorization responses (header or cookie) using the following expressions:

  • For the access token: $session.attr.oidc.token.access
  • For the refresh token: $session.attr.oidc.token.refresh
  • For the ID token: $session.attr.oidc.token.id
  In a custom plugin, the following authentication context parameters can be used to obtain access token information:

  • token_response: full response from the token endpoint
  • access_token: access token value
  • refresh_token: refresh token value
  • idtoken: id token value
• Functionality to Allow Cache Controlled by Request URL
  Introduce an exception list to avoid caching of authorization policy results on Webgate specific resources. The following WLST commands are available for managing the exception list:

  configureWGAuthzCachingExceptionListUrls(noCacheURL, action)

  Example: configureWGAuthzCachingExceptionListUrls("exceptionUrl", "add/remove")

  • This WLST command can be used to add or remove URLs from the Webgate Authorization Caching Exception List on OAM Server.
  • 'action' can be specified as 'add' or 'remove' to operate accordingly on ExceptionList

  configureWGAuthzCachingExceptionList(enabled, matchCriteria = "exactMatch", withQuery = "false")

  Example: configureWGAuthzCachingExceptionList("true/false", matchCriteria = "exactMatch/startsWith", withQuery = "true/false")

  • This WLST command can be used to enable or disable the Webgate Authorization Caching Exception List on OAM Server.
  • 'matchCriteria' can be specified as 'exactMatch' or 'startsWith', with default being 'exactMatch'
  • 'withQuery' can be specified as 'true' or 'false', with 'false' being the default meaning query-string from URL in Webgate authorization request will be ignored.

Oracle Access Management 12.2.1.4.220906 BP includes the following new features and enhancements:

• Federation Partners Support Certificates Using RSASSA-PSS Signature Algorithms
  OAM 12.2.1.4.220906 BP includes support for the Signature Algorithm SHA256-RSA-MGF1.

  Note:

  This update is dependent on OWSM patch 34839859.

  For details, see Configuring RSA OAEP Key Transport Digest and MGF Digest.

• The OAuth Client GET REST API is Enhanced to Retrieve the Client Secret

  For use cases that require the administrators to display the client secret for registered clients in their admin portals. This feature needs to be enabled after applying the patch for the new behavior to take effect, so the secret for the clients that get registered after enabling this feature can be retrieved using the API. For existing clients that were registered before enabling the feature, the previous behavior of returning hashed secrets will continue.

  For details, see Manage OAuth Client Secret Retrieval.

Oracle Access Management 12.2.1.4.220404 BP includes the following new features and enhancements:

• Make the OAM_ID Cookie Domain Scoped, Instead of Host Scoped

  Support has been added to add a cookie domain for the OAM_ID cookie. This can be enabled by setting the configuration parameter SSOCookieDomainEnabled to true. The cookie domain for the cookie must be set through the configuration property SSOCookieDomain. These updates must be done in the oam-config.xml file using the import utility. A server restart is required after the import.

  For details, see bug 33291908 in Table 1-12.

Oracle Access Management 12.2.1.4.220113 BP includes the following new features and enhancements:

• Support for OAuth Custom Claims Plugin

  For details, see the note Oracle Access Manager (OAM) Federation Protocol OAUth - Elaborated Steps For <Patch:28228295> (Doc ID 2817030.1) at https://support.oracle.com

Oracle Access Management 12.2.1.4.210920 BP includes the following new features and enhancements:

• OAM SAML 2.0 Supported Encryption Algorithms

  OAM supports AES-GCM encryption modes.

  For details, see OAM SAML 2.0 Supported Encryption Algorithms and Changing Default Encryption Algorithm.

• Two-way SSL for OAP over REST Communication.

  You can enable mutual authentication for OAP over REST between WebGate and OAM Server, therefore ensuring that the Server communicates with authentic clients.

  For details, see Enabling two-way SSL for OAP over REST.

• TOTP-based Multi Factor Authentication in OAM

  You can configure MFA using the configureMFA command with config-utility.jar.

  For details, see Configuring TOTP-based Multi Factor Authentication in OAM.

• Token Signing Using Third-Party Certificates

  Access tokens can be signed using a self-signed key pair generated out-of-the-box. In this release, OAM extends the support to allow signing of access tokens using third-party key pairs.

  For details, see Token Signing Using Third-Party Certificates.

• Mutual-TLS (mTLS) Client Authentication in OAM

  In TLS authentication, the server confirms its identity by producing a certificate (public key), which is then verified by the TLS verification process. In mTLS (mutual-TLS), along with the server, the client's identity is also verified. The TLS handshake is utilized to validate the client's possession of the private key corresponding to the public key in the certificate and to validate the corresponding certificate chain.

  For details, see Configuring Client Authentication and Configuring mTLS Client Authentication.

• Custom Claims

  OAM extends the ability to define custom claims using templates that can be configured at the client or domain level. The custom claims can be included in all access tokens, ID tokens and userinfo output. You can perform value transformations as well as value filtering of the custom claim.

  For details, see Custom Claims.

• OAuth Access Token Maximum Size

  Default OAuth access token length limit has been increased to 7500. This value can be overridden using the OAuth Identity domain custom parameter accessTokenMaxLength.

• OAuth Client Update - Support for PATCH Request

  Introduces support for PATCH request during modification of OAuth clients. With PATCH operation, OAM appends existing scopes with values from the request. Similar behavior is provided for redirect_uris, grant types, and custom attributes. The existing PUT operation replaces the contents of OAuth client parameters with the values from the request.

Oracle Access Management 12.2.1.4.210408 BP includes the following new features and enhancements:

• Session Management Optimizations

  Session Management Engine has been optimized and tuned to provide improved system performance under load.

  See also Database Tuning for Oracle Access Management in the Tuning Performance Guide.

• OAuth Refresh Token Management

  OAuth Token Management capabilities have been enhanced with the ability to invalidate Refresh Tokens.

  For details, see Revoking OAuth Tokens in Administering Oracle Access Management.

• 12c WebGates for Apache and IIS Web Servers

  WebGates for IIS and Apache Web Servers are made available in this release.

  For details, see Installing and Configuring IIS 12c WebGate for OAM in Installing WebGates for Oracle Access Manager.

• Support for TLS 1.3 & FIPS 140-2

  This release is compliant with the latest FIPS and TLS standards and versions.

  For details, see Enabling FIPS Mode on Oracle Access Management and TLS 1.3 and TLS 1.2 Support in Oracle Access Management in Administering Oracle Access Management.

Oracle Access Management 12.2.1.4.201201 BP includes the following new features and enhancements:

• Proof Key for Code Exchange (PKCE) Support in OAM

  Introduces PKCE support in the existing OAM OAuth Authorization Code Grant Flow. It can be used to enhance the security of the existing 3-legged OAuth, mitigating possible authorization code interception attacks. You can enable PKCE at the domain level or just for a specific client.

  For details, see Proof Key for Code Exchange (PKCE) Support in OAM in Administering Oracle Access Management.

• Keep the OAUTH_TOKEN Response Unset

  OAM provides an option to not set the OAUTH_TOKEN cookie or header when SSO Session Linking is enabled. You must set the challenge parameter IS_OAUTH_TOKEN_RESPONSE_SET to false.

  Note:

  If IS_OAUTH_TOKEN_RESPONSE_SET is not configured, or set to true then the OAUTH_TOKEN cookie/header is set.

Oracle Access Management 12.2.1.4.200909 BP includes the following new features and enhancements:

• Support for AWS Role Mapping Attribute in SAML Response

  Introduces a new function that can be configured in SP Attribute Profile for supporting the AWS role mapping attribute in SAML response.

  For details, see AWS Role Mapping Attribute in SAML Response in Administering Oracle Access Management.

• Support for Attribute Value Mapping and Filters in OAM Federation

  OAM federation supported Attribute Name Mapping. It extends the support for Attribute Value Mapping and Attribute Filtering features.

  For details, see Using Attribute Value Mapping and Filtering in Administering Oracle Access Management.

Oracle Access Management 12.2.1.4.200629 BP includes the following new features and enhancements:

• Support for SameSite=None Attribute in OAM Cookies

  OAM adds SameSite=None attribute to all the cookies set by WebGate and OAM Server.

  Note:

  • You must also download and upgrade to the latest WebGate Patch for this feature to work. For details, see the note Support for SameSite Attribute in Webgate (Doc ID 2687940.1) at https://support.oracle.com.
  • See also the note Oracle Access Manager (OAM): Impact Of SameSite Attribute Semantics (Doc ID 2634852.1) at https://support.oracle.com.

  Optional Configurations on OAM Server

  • If SSL/TLS is terminated on Load Balancer (LBR) and OAM server is not running in SSL/TLS mode, set the following system property in setDomainEnv.sh: -Doam.samesite.flag.value=None;secure

    Alternatively, you can propagate the SSL/TLS context from the LBR or Web Tier to OAM Server. For details, see Doc ID 1569732.1 at https://support.oracle.com.

  • To disable the inclusion of SameSite=None by OAM Server, set the following system property in setDomainEnv.sh: -Doam.samesite.flag.enable=false
  • To set SameSite=None for non-SSL/TLS HTTP connections, set the following system property in setDomainEnv.sh: -Doam.samesite.flag.enableNoneWithoutSecure=true
  Example: To add the system properties to setDomainEnv.sh:

  1. Stop all the Administration and Managed Servers.
  2. Edit $OAM_DOMAIN_HOME/bin/setDomainEnv.sh and add the properties as shown below:

     EXTRA_JAVA_PROPERTIES="-Doam.samesite.flag.enable=false ${EXTRA_JAVA_PROPERTIES}"
     export EXTRA_JAVA_PROPERTIES

  3. Start the Administration and Managed Servers.

  Optional Configurations for WebGate

  • If SSL/TLS is terminated on LBR and OAM Webgate WebServer is not running in SSL/TLS mode, set the ProxySSLHeaderVar in the User Defined Parameters configuration to ensure that WebGate treats the requests as SSL/TLS. For details, see User-Defined WebGate Parameters.
  • To disable inclusion of SameSite=None by OAM WebGate, set SameSite=disabled in the User Defined Parameters configuration on the console. This is a per-agent configuration.
  • To set SameSite=None for non-SSL HTTP connections, set EnableSameSiteNoneWithoutSecure=true in the User Defined Parameters configuration on the console. This is a per-agent configuration.

  Note:

  In deployments using mixed SSL/TLS and non-SSL/TLS components: For non-SSL/TLS access, OAM Server and Webgate do not set SameSite=None on cookies. Some browsers (for example, Google Chrome) do not allow SameSite=None setting on non-secure (non-SSL/TLS access) cookies, and therefore may not set cookies if a mismatch is found.

  Therefore, it is recommended that such mixed SSL/TLS and non-SSL/TLS deployments are moved to SSL/TLS only deployments to strengthen the overall security.

• X.509 Authentication with Extended Key Usage (EKU)

  In X.509 authentication flows, Extended Key Usage (EKU) certification extension check can be added optionally to ensure that the usage of the certificate is allowed.

  For details, see X.509 Authentication Using Extended Key Usage (EKU) in Administering Oracle Access Management.

Oracle Access Management 12.2.1.4.200327 BP includes the following new features and enhancements:

• OAuth Consent Management

  Provides the capability to manage and persist user consents while providing a mechanism to revoke them across Data Centers. The consent revocation capability is provided for both Administrators as well as individual users.

  For details, see Enabling Consent Management and Enabling Consent Management on MDC in Administering Oracle Access Management.

• OAuth Just-In-Time (JIT) User Linking and Creation

  Provides the capability to provision users automatically. The ID Token as received from the Identity Provider (IdP) has user attributes. These user attributes can have values like userId, user name, first name, last name, email address and so on, which could be used for linking users to entries in the local User Identity Store or create them, if they do not exist.

  For details, see OAuth Just-In-Time (JIT) User Provisioning in Administering Oracle Access Management.

• OAM Snapshot Tool

  Provides tooling to create a snapshot of the OAM IDM Domain with all its configurations, persist it and use it for creating fully functional OAM IDM Domain clones.

  For details, see Using the OAM Snapshot Tool in Administering Oracle Access Management.

• SAML Holder-of-Key (HOK) Profile Support

  SAML Holder-of-Key (HOK) profile support is added for OAM when acting as an Identity Provider (IdP). This support is with OCI Service Provider (SP) Partners.

  For details, see the note OAM 12c Identity Provider (IDP) for SAML Profile Support with OCI Service Provider (SP) Partners (Doc ID 2657717.1) at https://support.oracle.com.

Describes Bundle Patches and explains differences between Stack Patch Bundles, Bundle Patches, interim patches and Patch Sets.

Stack Patch Bundle deploys the IDM product and dependent FMW patches using a tool. For more information about these patches, see Quarterly Stack Patch Bundles (Doc ID 2657920.1) at https://support.oracle.com.

A Bundle Patch is an official Oracle patch for Oracle Fusion Middleware components on baseline platforms. In a Bundle Patch release string, the fifth digit indicated the bundle patch number. Effective November 2015, the version numbering format has changed. The new format replaces the numeric fifth digit of the bundle version with a release date in the "YYMMDD" format where:

• YY is the last 2 digits of the year

• MM is the numeric month (2 digits)

• DD is the numeric day of the month (2 digits)

Each Bundle Patch includes the libraries and files that have been rebuilt to implement one or more fixes. All fixes in the Bundle Patch have been tested and are certified to work with one another.

Each Bundle Patch is cumulative: the latest Bundle Patch includes all fixes in earlier Bundle Patches for the same release and platform. Fixes delivered in Bundle Patches are rolled into the next release.

In contrast to a Bundle Patch, an interim patch addresses only one issue for a single component. Although each interim patch is an official Oracle patch, it is not a complete product distribution and does not include packages for every component. An interim patch includes only the libraries and files that have been rebuilt to implement a specific fix for a specific component.

You may also know an interim patch as: security one-off, exception release, x-fix, PSE, MLR, or hotfix.

A Patch Set is a mechanism for delivering fully tested and integrated product fixes that can be applied to installed components of the same release. Patch Sets include all fixes available in previous Bundle Patches for the release. A Patch Set can also include new functionality.

Each Patch Set includes the libraries and files that have been rebuilt to implement bug fixes (and new functions, if any). However, a patch set might not be a complete software distribution and might not include packages for every component on every platform.

All fixes in the Patch Set have been tested and are certified to work with one another on the specified platforms.

Oracle has certified the dependent Middleware component patches for Identity Management products and recommends that Customers apply these certified patches.

For more information on these patches, see the note Certification of Underlying or Shared Component Patches for Identity Management Products (Doc ID 2627261.1) at https://support.oracle.com.

To remain in an Oracle-supported state, apply the Bundle Patch to all installed components for which packages are provided. Oracle recommends that you:

1. Apply the latest Bundle Patch to all installed components in the bundle.
2. Keep OAM Server components at the same (or higher) Bundle Patch level as installed WebGates of the same release.

The following topics help you, as you prepare and install the Bundle Patch files (or as you remove a Bundle Patch should you need to revert to your original installation):

The Oracle patch mechanism (OPatch) is a Java-based utility that runs on all supported operating systems. OPatch requires installation of the Oracle Universal Installer.

Patching process uses both unzip and OPatch executables. After sourcing the ORACLE_HOME environment variable, Oracle recommends that you confirm that both of these exist before patching. OPatch is accessible at:$ORACLE_HOME/OPatch/opatch

When OPatch starts, it validates the patch to ensure there are no conflicts with the software already installed in your $ORACLE_HOME:

• If you find conflicts with a patch already applied to the $ORACLE_HOME, stop the patch installation and contact Oracle Support Services.

• If you find conflicts with a subset patch already applied to the $ORACLE_HOME, continue the Bundle Patch application. The subset patch is automatically rolled back before the installation of the new patch begins. The latest Bundle Patch contains all fixes from the previous Bundle Patch in $ORACLE_HOME.

This Bundle Patch is not -auto flag enabled. Without the -auto flag, no servers need to be running. The Machine Name & Listen Address can be blank on a default install.

Perform the steps in the following procedure to prepare your environment and download OPatch:

• Log in to My Oracle Support: https://support.oracle.com/

• Download the required OPatch version.

• Use opatch -version to check if your OPatch version is the latest. If it is an earlier version of OPatch, download the latest version.

• Confirm if the required executables opatch and unzip are available in your system by running the following commands:

  Run which opatch - to get path of OPatch

  Run which unzip - to get path of unzip

  Check if the path of the executables is in the environment variable "PATH", if not add the paths to the system PATH.

• Verify the OUI Inventory using the following command:

  opatch lsinventory

  Windows 64-bit: opatch lsinventory -jdk c:\jdk180

  If an error occurs, contact Oracle Support to validate and verify the inventory setup before proceeding. If the ORACLE_HOME does not appear, it might be missing from the Central Inventory or the Central Inventory itself could be missing or corrupted.

• Review information in the next topic Applying the OAM Bundle Patch

Use information and steps here to apply the Bundle Patch from any platform using Oracle patch (OPatch). While individual command syntax might differ depending on your platform, the overall procedure is platform agnostic.

1. Download the OAM patch p37430708_122140_Generic.zip
2. Unzip the patch zip file into the PATCH_TOP.

   $ unzip -d PATCH_TOP p37430708_122140_Generic.zip

   Note:

   On Windows, the unzip command has a limitation of 256 characters in the path name. If you encounter this, use an alternate ZIP utility such as 7-Zip to unzip the patch.

   For example: To unzip using 7-Zip, run the following command.

   "c:\Program Files\7-Zip\7z.exe" x p37430708_122140_Generic.zip

3. Set your current directory to the directory where the patch is located.

   $ cd PATCH_TOP/37430708

4. Log in as the same user who installed the base product and:

   • Stop the AdminServer and all OAM Servers to which you will apply this Bundle Patch.

     Any application that uses this OAM Server and any OAM-protected servers will not be accessible during this period.

   • Back up your $ORACLE_HOME.

   • Move the backup directory to another location and record this so you can locate it later, if needed.

5. Run the appropriate OPatch command as an administrator to ensure the required permissions are granted to update the central inventory and apply the patch to your $ORACLE_HOME. For example:
   opatch apply

   Windows 64-bit: opatch apply -jdk c:\path\to\jdk180

   Note:

   OPatch operates on one instance at a time. If you have multiple instances, you must repeat these steps for each instance.
6. Start all Servers (AdminServer and all OAM Servers).

Use the information and steps described here to apply the Bundle Patch in an MDC setup.

If the AdminServer does not start successfully, the Bundle Patch application has failed.

1. Confirm that there are no configuration issues with your patch application.
2. Confirm that you can start the AdminServer successfully.
3. Shut down the AdminServer and rollback the patch as described in Removing the Bundle Patch then apply the Bundle Patch again.

If you want to rollback a Bundle Patch after it has been applied, perform the following steps. While individual command syntax might differ depending on your platform, the overall procedure is the same. After the Bundle Patch is removed, the system is restored to the state it was in immediately before patching.

1. Perform the steps in Applying the OAM Bundle Patch to set the environment variables, verify the inventory and shut down any services running from the ORACLE_HOME or host machine.
2. Change to the directory where the patch was unzipped. For example: cd PATCH_TOP/37430708
3. Back up the ORACLE_HOME directory that includes the Bundle Patch and move the backup to another location so you can locate it later.
4. Run OPatch to rollback the patch. For example:

   opatch rollback -id 37430708

5. Start the servers (AdminServer and all OAM Servers) based on the mode you are using.
6. Re-apply the Bundle Patch, if needed, as described in Applying the Bundle Patch.