Unable to open OIM Deployment Manager in Java 7 and Java 8

Issue:

Pop-up Error "Your security settings have blocked an application from running due to missing a "Permissions" manifest attribute in the main jar"

Cause:

Note: This attribute check was added into the Java 7 branch starting with 1.7.0_45 and the Java 8 branch starting with 1.8.0_20 for preventing an attacker to exploit a user by re-deploying an application that is signed with original certificate and running the application at a different privilege level. Detail about this new check can be referenced in the following Java documentation: https://www.java.com/en/download/help/java_blocked.xml 

Solution:


For low level steps to add Web Access to the URL exception list:
 1. Browse to the $JRE_Home\bin directory (example: C:\Program Files (x86)\Java\jre1.xxxxx\bin)
 2. Double-click javacpl.exe to open the Java Control Panel
 3. Select the security tab within the Java Control Panel
 4. Select the 'Edit Site List' button
 5. Select Add to add the Web Access URL
 6. In the new field added, enter the Web Access URL in the following format: 
      - If using HTTP protocol: http://server:port/xlWebApp/ 
      - If using HTTPS protocol: https://server:port/xlWebApp/
      - Note: You *must* add the preceding "/" at the end of the "xlWebApp" context
 7. Select OK to close the exception list
 8. Select OK to close the Java Control Panel
 9. Reload the browser for changes to take effect

Access Manager Error: Unexpected Error occurred while processing credentials . Please retry your action again!

[Enterprise Manager Log]

Unable to connect to the User Store. User Store Centralized Ldap Store with initParams {GROUP_SEARCH_BASE=cn=groups,cn=acme,dc=com, GroupCacheEnabled=true, USER_SCHEMA=none, NATIVE=false, USER_SEARCH_BASE=cn=Users, dc=acme,dc=com, ENABLE_PASSWORD_POLICY=true, MAX_CONNECTIONS=50, GroupCacheTTL=0, SECURITY_PRINCIPAL=cn=oamLDAP,cn=systemids,dc=acme,dc=com, Description=Centralized store , ConnectionRetryCount=3, USER_NAME_ATTRIBUTE=uid, IsSystem=false, IsPrimary=false, ConnectionWaitTimeout=120, Name=Centralized Ldap Store, SearchTimeLimit=0, MIN_CONNECTIONS=10, USER_PASSWORD_ATTRIBUTE=userPassword, LDAP_PROVIDER=OID, GROUP_NAME_ATTR=, LDAP_URL=ldap://<host>:3060, ReferralPolicy=follow, GroupCacheSize=10000, UserIdentityProviderType=OracleUserRoleAPI} could not be initialized due to oracle.security.am.engines.common.identity.provider.exceptions.IdentityProviderException.

[oam_server1-diagnostic.log]

oracle.security.am.engine.authn.api.exception.AuthenticationException
at oracle.security.am.engine.authn.internal.executor.AuthenticationModuleExecutor.checkAndThrowAuthenticationException(AuthenticationModuleExecutor.java:369)
at oracle.security.am.engine.authn.internal.executor.AuthenticationModuleExecutor.execute(AuthenticationModuleExecutor.java:291)
at oracle.security.am.engine.authn.internal.executor.AuthenticationSchemeExecutor.execute(AuthenticationSchemeExecutor.java:102)
at oracle.security.am.engine.authn.internal.controller.AuthenticationEngineControllerImpl.validateUser(AuthenticationEngineControllerImpl.java:267)
at oracle.security.am.engines.enginecontroller.AuthnEngineController.authenticateUser(AuthnEngineController.java:843)
at oracle.security.am.engines.enginecontroller.AuthnEngineController.processEvent(AuthnEngineController.java:317)
at oracle.security.am.controller.MasterController.processEvent(MasterController.java:596)
at oracle.security.am.controller.MasterController.processRequest(MasterController.java:788)
at oracle.security.am.controller.MasterController.process(MasterController.java:708)
at oracle.security.am.pbl.PBLFlowManager.delegateToMasterController(PBLFlowManager.java:209)
at oracle.security.am.pbl.PBLFlowManager.handleBaseEvent(PBLFlowManager.java:147)
at oracle.security.am.pbl.PBLFlowManager.processRequest(PBLFlowManager.java:107)
at oracle.security.am.pbl.transport.http.AMServlet.handleRequest(AMServlet.java:198)
at oracle.security.am.pbl.transport.http.AMServlet.doPost(AMServlet.java:157)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
at java.security.AccessController.doPrivileged(Native Method)
at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:324)
at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:460)
at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.security.wls.filter.SSOSessionSynchronizationFilter.doFilter(SSOSessionSynchronizationFilter.java:292)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:163)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Caused by: oracle.security.am.engines.common.identity.provider.exceptions.IdentityProviderException: OAMSSA-20007: Unable to connect to the User Store.

Cause:
                     User Identity Store Name contains space
Solution:
 Create a new User Identity Store name without space

Metalink Reference: OAM: 11.1.2.2 Space in DataStore name results in : "IdentityProviderException: OAMSSA-20007: Unable to connect to the User Store" (Doc ID 1645954.1)

Access Manager Error: MBean operation access denied. MBean: com.oracle.igf:type=Xml,name=IDSConfig Operation: listAllIdentityDirectoryService() Detail: Access denied.

Problem: Error while accessing Access Manager- > User Identity Store:

Messages for this page are listed below.
Error
MBean operation access denied. MBean: com.oracle.igf:type=Xml,name=IDSConfig Operation: listAllIdentityDirectoryService() Detail: Access denied. Required roles: Admin, Operator, Monitor, executing subject: principals=[oamadmin, OAMAdmins, OAMAdministrators, wlsadmingroup, OAMSystemAdminGroup]
Error
javax.management.RuntimeMBeanException: java.lang.SecurityException: MBean attribute access denied. MBean: com.oracle:name=ESSOIDSRepository,context=ids,type=OVD.AdaptersConfig,OVD=AdaptersConfig Getter for attribute Id Detail: Access denied. Required roles: Admin, Operator, Monitor, executing subject: principals=[oamadmin, OAMAdmins, OAMAdministrators, wlsadmingroup, OAMSystemAdminGroup]

Environment: OAM and OIM integrated and OID as repository

Cause: 

1. Administrators , Operator and Monitor groups missing in OID
2. OAM Admin User not a member of Administrators , Operator and Monitor in OID

Solution: 

Create Administrators , Operator and Monitor groups in OID and make OAM Admin User member of these groups.