Skip navigation.
Downloads | Product Documentation | Support

Administration Application Installation

# Setting Up and Administering the Database

This section provides information and guidelines to assist you in installing, configuring, and managing the database server and the database client to used with the WebLogic Enterprise Security Administration Application. This information is not meant to replace or supersede in any way the database documentation provided by Oracle and Sybase for their database server and client products. Also, the information provided here assumes that you are familiar with the Oracle database documentation.

BEA WebLogic Enterprise Security stores all policy and configuration data used by the Administration Application and Security Service Modules in the policy database. You can use either an Oracle database or a Sybase database for your policy data storage. You must install and configure the database server software before you install the Administration Application. If you install the Administration Application on a machine other than the machine on which you install the database, you must also install and configure the respective Oracle or Sybase client on that machine.

Note: To perform a database installation and setup, you must be a database administrator with a database administrator username and password and permission to create a new instance. In addition, you should be knowledgeable about the operating system you are working with and be adept at database installations and configuration issues. If you do not feel comfortable performing any of these tasks, ask your database administrator for assistance.

This section covers the following topics:

- Setting Up and Administering the Oracle Database and Client
- Setting Up and Administering the Sybase Database and Client

# Setting Up and Administering the Oracle Database and Client

This section contains the procedures for setting up and administering an Oracle database and an Oracle Client. It covers the following topics:

- Before you Begin the Oracle Database Setup
- Installing and Configuring the Oracle Database
- Installing and Configuring an Oracle Client
- Tuning an Oracle Database
- Administering an Oracle Policy Database

## Before you Begin the Oracle Database Setup

Before you install and set up your Oracle database, review the following topics to better understand Oracle database configuration requirements:

- Overview of the Oracle Client/Server Architecture
- Oracle Database System Requirements

### Overview of the Oracle Client/Server Architecture

The Oracle database service is the server in the Oracle client/server architecture (see Figure 3-1). The database service manages a database instance and multiple database users, keeps track of the actual location of data on disks, maintains mapping of logical data to physical data storage, and maintains data and procedure caches in memory. In this section, the example of the Oracle service name is viewed from the client perspective.

Each Oracle service is identified by a global database name and an Oracle system identifier referred to as the `SID`. The Oracle global database name is the full name of a database that uniquely differentiates it from any other databases in your network domain. One global database name can represent several database instances. The global database name is also known as the service name. The `SID` distinguishes the database instance from any other database instances on the same machine.

Figure 3-1 Oracle Database Setup

An Oracle instance is a running Oracle database made up of memory structures and background processes. Each instance is associated with an `SID`. With the Oracle Parallel Server, multiple instances can exist on different machines for a single database.

The policy database is a set of database schemas in which all data are stored. A database schema is a collection of objects associated with a particular schema name. The objects include tables, views, domains, constraints, assertions, privileges, and so on.

A datafile is an Oracle term for a file that contains the contents of logical database structures, such as tables and indexes. One or more datafiles form a logical unit of storage called a tablespace. A datafile is associated with only one tablespace and only one database.

A tablespace is a logical portion of a database used to allocate storage for table and index data. Each tablespace corresponds to one or more physical datafiles. Every Oracle database has a tablespace called `SYSTEM` and may have additional tablespaces. A tablespace is used to group related logical structures. The database username or user `ID` is a login that is given permission by the database administrator to access a specific database instance. This user is also called the schema owner, that is, the owner of the schema objects such as tables, views and triggers that are created.

### Oracle Database System Requirements

Table 3-1 describes the minimum requirements for the system on which the Oracle database server is installed.

Table 3-1 Oracle Setup Requirements

Requirement | Description
--- | ---
Software version | Oracle database server: Version 8i (8.1.7) Version 9i (9.0.1) and 9i Release 2 (9.2.0.1) Note: On Linux platforms, BEA recommends using the Oracle 9.2.0.4 client. Use of an earlier version may seriously increase the amount of system memory used by the WebLogic Enterprise Security servers or processes. This behavior can eventually cause the server to use up the system memory. The use of 9.2.0.4 does not exhibit this behavior.
Server platform | Any platform supported by Oracle.
Memory | As required by Oracle server installation (64 MB minimum).
Disk space for the starter database | As required by Oracle server installation, plus space required to store policy data; 500 MB recommended.
Disk space for Oracle software | Refer to your installation guide for the Oracle Database Server.
Disk space for policy database | Minimum of one tablespace with 250 MB of free space is required. To approximate space requirements for any policy size, use the formula in Calculating Oracle Tablespace Size Requirements.
Oracle Client | Oracle Client that ships with your version of the product. BEA requires that the version of your client software be the same as the database to which you are connecting. Do not use an older version of the client software to connect to a newer version of the database server.

## Installing and Configuring the Oracle Database

This section provides additional instructions for installing and configuring an Oracle database for use with the WebLogic Enterprise Security Administration Application.

To install and configure the database, perform the following tasks:

- Installing the Oracle Database—Use this procedure only if you are going to install the Oracle database software and create and configure an instance of the database.
- Creating an Instance of an Oracle Database—Use this procedure only if the Oracle database software is already installed and you want to create another instance of the database.
- Configuring an Oracle Policy Database—Use this procedure to configure a policy database for use by the WebLogic Enterprise Security Administration Application.

### Installing the Oracle Database

This section provides recommendations for installing the Oracle database and creating a database instance. When you run the Oracle installation program, it automatically starts the Database Configuration Assistant, which you use to create an instance of the database. If the Oracle database is already installed on the database host machine, you can skip this procedure and go to Creating an Instance of an Oracle Database and then go to Configuring an Oracle Policy Database.

To install the Oracle database and create a database instance, perform these steps:

1. Install the Oracle database according to instructions in the Oracle Database Installation Guide and system requirements defined in Table 3-1. During the installation, define the following parameters.

- Global Database Name—The full Oracle database name that distinguishes the database from any other databases in your network domain.
- Database System Identifier—The Oracle system identifier (`SID`). The `SID` distinguishes the database instance from any other database instances on the same machine.
- `SYS` and `SYSTEM` Passwords—The Oracle database install program creates two user accounts, `SYS` and `SYSTEM,` and assigns default passwords. During the installation, you are prompted to change these passwords. For security reasons, Oracle recommends that you specify new passwords for these user accounts when you install the database software.

Note: Be sure to record the settings you use for these parameters, because you will need them later in this procedure and also to configure the Oracle Client if you are required to do so.

1. Use the Oracle Database Configuration Assistant to configure the database. When the Database Configuration Assistant starts, step through the screens and select the Template Name and Memory settings as specified in Table 3-2.

Note: The Memory setting only applies to Oracle 9i databases.

Table 3-2 Database Configuration Assistant Settings

Database Configuration Assistant Setting | Recommended Setting
--- | ---
Template Name | General Purpose. Note: This selection specifies the template to use to create the instance of the database.
Memory (Typical or Custom), for 9i only | Custom Note: This selection is on the Initialization Parameters screen.

2. Use one of the following procedures to set the database initialization parameters.

1. For Oracle 8i, open the `ora.init` file located in `ORACLE_HOME/admin/``db_name``/pfile` directory and go to the step 4.
2. For Oracle 9i, click All Initialization Parameters on the Initialization Parameters screen of the Database Configuration Assistant. The All Initialization Parameters screen appears (see Figure 3-2). Go to step 4.

Figure 3-2 Oracle Initialization Parameters Screen

3. Refer to Table 3-3 and enter the initialization parameters.

Table 3-3 Initialization Parameters Recommended Values

Database Parameter Name | Recommended Value
--- | ---
shared_pool_size | 6925926 Bytes This value must be large enough for good server performance.
`db_block_buffers` | 1000
log_buffer | 32768 Bytes
`processes` | 150
`db_block_size` | 8192 Bytes (or greater) Note: Block Size is critical. Some Oracle installs set this value to 4096 by default, which creates problems for some scripts. You must set this value to 8192 or larger.
`open_cursors` | 500
`rollback_segments` | 80. See Calculating Oracle Rollback Tablespace Size Requirements.

4. Proceed through the Oracle Database Configuration Assistant pages to the Creation Options page, select Create Database, and click Finish. The assistant creates an instance of the Oracle database.
5. Set your system `PATH` environment variables as shown in Listing 3-1.

Note: In Listing 3-1, `<drive>` is the hard drive on which the Oracle database is installed and `<version>` is either 90 or 92.

Listing 3-1 System PATH Environment Variable Settings on Windows

>     For Oracle 9i:

>     <drive>:\oracle\ora<version>\bin;
>     C:\Program Files\Oracle\jre\1.3.1\bin;
>     C:\Program Files\Oracle\jre\1.1.8\bin;

>     For Oracle 8i:

>     <drive>:\oracle\ora81\bin;
>     C:\Program Files\Oracle\jre\1.1.7\bin;

1. Proceed to Configuring an Oracle Policy Database.

### Creating an Instance of an Oracle Database

This section describes how to create and configure an instance of an Oracle database. It assumes that the Oracle database software was installed.

Note: You should only perform this procedure when you want to create and configure instances of the database in addition to the instance that was created when the database software was installed.

Perform the following steps to create an instance of an Oracle database:

Note: The section provides guidance to assist you, but it does not supersede the documentation provided by Oracle.

1. To start the Oracle Database Configuration Assistant, click Start>Programs>Oracle-<OraHome>Configuration and Migration Tools>Database Configuration Assistant, where OraHome indicates the version of the software. The Database Configuration Assistant starts.
2. When the Database Configuration Assistant starts, step through the screens and select Template Name and Memory settings as specified in Table 3-2.

Note: The Memory setting only applies to Oracle 9i databases.

3. Use one of the following procedures to set the initialization parameters.

1. For Oracle 8i, open the `ora.init` file that is located in `ORACLE_HOME/admin/``db_name``/pfile` directory and go to the step 4.
2. For Oracle 9i, click the All Initialization Parameters bottom on the Initialization Parameters screen of the Database Configuration Assistant. The All Initialization Parameters screen appears (see Figure 3-2). Go to step 4.

4. Refer to Table 3-3 and enter the database configuration parameters.
5. Proceed through the Oracle Database Configuration Assistant pages to the Creation Options page, select Create Database, and click Finish. The assistant creates an instance of the Oracle database.
6. To configure a policy database for this instance of an Oracle database, see Configuring an Oracle Policy Database.

### Configuring an Oracle Policy Database

To configure an Oracle policy database, you must create the policy database, create a security role and a user, and grant the security role and user access.

To configure a policy database, perform the following steps:

1. Open a command window, run the Oracle SQLPlus utility, and login as user `SYSTEM` with the password you set for that user account when you installed the Oracle database software.

>     sqlplus system/password@asi

where: `password` is the password you set for the system account when you installed the database software and `asi` is the database instance name.

2. To configure the policy database, enter the following commands at the `SQL>` prompt:

>     SQL>connect sys as sysdba
>     SQL>create tablespace DATA datafile `C:/Oracle/oradata/ASI/data.dbf'
>           size 10M autoextend on next 1M MAXSIZE 250M;
>     SQL>CREATE ROLE asi_role;
>     SQL>GRANT CREATE SESSION to asi_role;
>     SQL>GRANT CREATE TABLE to asi_role;
>     SQL>GRANT CREATE PROCEDURE to asi_role;
>     SQL>GRANT CREATE SEQUENCE to asi_role;
>     SQL>GRANT CREATE TRIGGER to asi_role;
>     SQL>GRANT CREATE VIEW to asi_role;
>     SQL>CREATE USER wles IDENTIFIED BY password
>           default tablespace DATA QUOTA UNLIMITED on DATA;
>     SQL>GRANT asi_role to wles;
>     SQL>GRANT SELECT on SYS.V_$LOCKED_OBJECT to wles;

where: `asi_role` is the security role you define, `wles` is the user you define, and `password` is the user password.

3. To verify that the configured user can connect to the policy database, open a command window and type:

>     sqlplus wles/password@asi

where: `wles` and `password` are the user and `password` you defined and `asi` is the database instance name.

This completes the configuration of the instance of the policy database.

## Installing and Configuring an Oracle Client

If you intend to install the WebLogic Enterprise Security Administration Application on the same machine as you installed the Oracle database, you do not need to install or configure the Oracle Client. The Oracle database installation includes the Oracle Client, so you can skip this task.

However, if you intend to install the Administration Application on a machine other than the machine on which the Oracle database is installed, you must install and configure an Oracle client on that machine to be able to access the Oracle database server from the client machine.

To install and configure an Oracle Client, you need to know the following information:

- The Global Database Name that you defined when you created the database instance.
- The host name of the database machine
- The port number on which the database instance is running (the default port number is 1521).
- The policy database username and password that you defined when you configured the policy database.

For instructions on installing and configuring an Oracle Client, see the following topics:

- Installing and Configuring an Oracle Client on Windows
- Installing and Configuring the Oracle Client on Sun Solaris
- Installing and Configuring the Oracle Client on Red Hat Advanced Server 2.1
- Installing and Configuring the Oracle Client on Red Hat Advanced Server 3.0

### Installing and Configuring an Oracle Client on Windows

To install and configure an Oracle Client, perform these steps:

Note: This section provides guidance to assist you, but it does not supersede the documentation provided by Oracle.

1. Install the Oracle Client according to instructions in the Oracle Database Installation Guide for Windows. If the Oracle Client is already installed, skip this step and go to the next step.
2. Start the Oracle Net Configuration Assistant and use it to configure a Local Net Service Name entry for connecting to the Oracle database instance (see Figure 3-3).

Note: Figure 3-3 shows the Oracle 9i screen. The Oracle 8i screen offers the same options.

In this step, you set up a service entry in the Oracle configuration file, which is located on the client machine at: `ORACLE_HOME/network/admin/tnsnames.ora`.

Figure 3-3 Oracle Net Configuration Assistant: Welcome Page (Oracle 9i)

1. To verify that the Oracle Client can access the Oracle database, at the Net Configuration Assistant screen (see Figure 3-4), select the Yes, perform a test radio button, click Next, and execute the test.

Note: Figure 3-4 shows the Oracle 9i screen. The Oracle 8i screen offers the same options.

Figure 3-4 Oracle Net Service Name Configuration Test Page (Oracle 9i)

1. If the test in the previous step fails, click the Change Login button on the test results page, enter the database username and password, and execute the test again.

Note: If you experience problems getting the Oracle Client to connect to the Oracle database instance, check the configuration of the database instance in the `ORACLE_HOME\ora<version>\network\admin\tnsnames.ora` file located on the database server host machine, where <version> is `81`, `90`, or `92`.

1. To use SQLplus to connect to the Oracle database instance on the machine on which your Oracle client is running as the `wles` user, open a command window and type:

>     sqlplus wles/password@asi

where: `wles` and `password` are the user and password you defined when you configured the policy database and `asi` is the database instance name.

This completes the configuration of the Oracle Client.

### Installing and Configuring the Oracle Client on Sun Solaris

To install and configure the Oracle Client on a Sun Solaris platform, perform these steps:

Note: This section provides guidance to assist you, but it does not supersede the documentation provided by Oracle.

1. If they do not already exist, have a Sun Solaris system administrator create a group called `dba` and a user ID called `oracle`.
2. Set `dba` as the primary group for `oracle`.
3. Log into Sun Solaris as `oracle`.
4. Unload the Oracle client software to a local directory using the Oracle Installer.
5. Set the `ORACLE_HOME` environment variable to the local directory. If necessary, refer to your Oracle Installation Guide.
6. Set the `PATH` environment variable to include the bin subdirectory of `$ORACLE_HOME`.
7. Set the `LD_LIBRARY_PATH` environment variable to include the lib subdirectory of `$ORACLE_HOME`.
8. To connect to the Oracle database instance on the machine on which your Oracle client is running, open a command window and type the following SQLplus command:

`sqlplus` `wles``/``password``@``asi`

where: `wles` and `password` are the user and password you defined when you configured the policy database and `asi` is the database instance name.

If this command is successful, the client is configured, and you can skip the next step of this procedure. If this command fails, proceed to step 9.

9. Start an Oracle Network Configuration tool, such as Net Configuration Assistant or Net Manager, and configure a local net service name entry for connecting to the database instance. This step sets up a service entry in the Oracle configuration file located at: `$ORACLE_HOME/network/admin/tnsnames.ora`.

Note: You may also use a text editor to edit the `tnsnames.ora` file. However, you should be familiar with Oracle Net before editing the `tnsnames.ora` file with a text editor.

This completes the configuration of an Oracle Client.

### Installing and Configuring the Oracle Client on Red Hat Advanced Server 2.1

There may be some additional considerations when installing Oracle 9i and 8i Clients on Red Hat Advanced Server 2.1. To understand all the considerations relative to installing on the Red Hat Advanced Server in your environment, see the Oracle and Red Hat documentation.

Note: If you are installing the Oracle 8i Client on Red Hat Advanced Server 2.1, the Net8 Configuration tool may hang during the installation process. To start the Net8 Configuration tool, you need to download and install JRE-1.1.8v3, and switch the JRE to use the proper version of the tool: `$ORACLE_HOME/bin/netasst`, by changing the value for `JREDIR`.

To install and configure an Oracle Client on Red Hat Advanced Server 2.1, perform the following steps:

Note: This section provides guidance to assist you, but it does not supersede the documentation provided by Oracle.

1. If you are installing by downloading the software from the Oracle web site, go to step 2. If you are installing from an Oracle CD-ROM, skip step 2, and go to step 3.
2. Using the instructions provided on the Oracle download site, perform the following steps:

1. Download the Oracle Database Server software from the Oracle web site. For example, the Oracle 9.2 download kit requires that you download the following files:

>     ship_9204_linux_disk1.cpio.gz
>     ship_9204_linux_disk2.cpio.gz
>     ship_9204_linux_disk3.cpio.gz

2. To unzip each file, run:

>     gunzip <filename>

3. To extract the `cpio` archive, run the following command on each file:

>     cpio -idmv <filename>.cpio

This command creates directories named Disk1, Disk2, and Disk3.

Note: The Oracle 8i Database Server software is no longer available from the Oracle download site. The Oracle 8i Database Server is now in Extended Support (ES) mode.

3. To start the Oracle installer, run the following command from Disk1:

>     ./runInstaller

4. Select the Oracle Client for installation, and then select the Administrative edition or Application Programmer edition.
5. When an error window appears, wait for the following error message:

`Error in invoking target install of makefile /path/app/oracle/product/``version``/`xyz`/lib/ins_``xyz``.mk`, and prompt for `Retry`, `Ignore`, and `Cancel`, where `xyz` may be `precomp`, or `plsql`, or something else and `version` is either 8.1.7 or 9i.

6. When this error occurs, examine the file: `$ORACLE_HOME/install/make.log`.

The file contains the following lines of text.

>     path/app/oracle/product/version/bin/genclntsh

>     /lib/libc.so.6: undefined reference to \Q_dl_lazy@GLIBC_2.1.1'

>     /lib/libc.so.6: undefined reference to \Q_dl_dst_substitute@GLIBC_2.1.1'

>     /lib/libc.so.6: undefined reference to \Q_dl_out_of_memory@GLIBC_2.2'

>     /lib/libc.so.6: undefined reference to \Q_dl_relocate_object@GLIBC_2.0'

>     /lib/libc.so.6: undefined reference to \Q_dl_clktck@GLIBC_2.2'

>     /lib/libc.so.6: undefined reference to \Q__libc_enable_secure@GLIBC_2.0'

>     /lib/libc.so.6: undefined reference to \Q_dl_catch_error@GLIBC_2.0'

>     .....

>     /usr/bin/ld: cannot find -lclntsh

>     collect2: ld returned 1 exit status

>     /bin/chmod: getting attributes of \Qprocob18': No such file or directory

>     make: *** [procob18] Error 1

>     /usr/bin/make -f ins_precomp.mk relink ORACLE_HOME=/pathora/u01/app/oracle/product/version EXENAME=ott...

7. Set the environment variables for `ORACLE_HOME`, `PATH` and `LD_LIBRARY_PATH`.
8. Open another window, and change to the `$ORACLE_HOME/bin` directory.
9. Edit the `genclntsh` script by setting `LD_SELF_CONTAINED=``""`.
10. Run the following command:

>     ./genclntsh

The following message appears:

>     Created /path/app/oracle/product/version/lib/libclntst#.a

11. Return to the Oracle installer, and click Retry.
12. After linking the Oracle libraries, the installer prompts you to run `root.sh.`

Note: Before continuing with step 13, for Oracle 8i, edit `root.sh` and change the line: `RMF=/bin/rm -f to RMF="/bin/rm -f",` and the line that starts with `RUID=` by adding a single quote just before the last back-slash (`\Q`).

13. Log in as root and run:

>     ./root.sh

14. Return to the installer, and click OK to continue.

The installer continues. At the last step, it starts the Net Configuration tool to let you configure the first Net Service Name.

15. To connect to the Oracle database instance on the machine on which your Oracle client is running, open a command window and type the following SQLplus command:

`sqlplus` `wles``/``password``@``asi`

where: `wles` and `password` are the user and password you defined when you configured the policy database and `asi` is the database instance name.

If this command is successful, the client is configured and you can skip the remaining steps of this procedure. If this command fails, proceed to step 16.

16. Use the Net Configuration Assistant to configure a local net service name entry for connecting to the database instance. This step sets up a service entry in the Oracle configuration file (`$ORACLE_HOME/network/admin/tnsnames.ora`).

Note: If you installing the Oracle 8i Client on Red Hat Advanced Server 2.1, the Net8 Configuration tool may hang during the installation process. Abort that process. To start the Net8 Configuration tool, download JRE-1.1.8v3, and switch the JRE to use the proper version of the tool: `$ORACLE_HOME/bin/netasst`, by changing the value for `JREDIR`.

17. Exit the installer.

Note: If you installing the Oracle 8i Client on Red Hat Advanced Server 2.1, apply the client patch: `glibc-2.1.3-stubs.tar.gz` that you downloaded earlier.

This completes the configuration of an Oracle Client.

### Installing and Configuring the Oracle Client on Red Hat Advanced Server 3.0

There may be some additional considerations when installing Oracle 9i and 8i Clients on Red Hat Advanced Server 3. To understand all the considerations relative to installing on the Red Hat Advanced Server in your environment, see the Oracle and Red Hat documentation.

Note: If you are installing the Oracle 8i Client on Red Hat Advanced Server 3.0, the Net8 Configuration tool may hang during the installation process. To start the Net8 Configuration tool, you need to download and install JRE-1.1.8v3, and switch the JRE to use the proper version of the tool: `$ORACLE_HOME/bin/netasst`, by changing the value for `JREDIR`.

To install and configure an Oracle 9.2 Client on Red Hat Advanced Server 3.0, perform the following steps:

Note: This section provides guidance to assist you, but it does not supersede the documentation provided by Oracle.

1. If you are installing by downloading the software from the Oracle web site, go to step 2. If you are installing from an Oracle CD-ROM, skip step 2, and go to step 3.
2. Using the instructions provided on the Oracle download site, perform the following steps:

1. Download the Oracle Database Server software from the Oracle web site. For example, the Oracle 9.2 download kit requires that you download the following files:

>     ship_9204_linux_disk1.cpio.gz
>     ship_9204_linux_disk2.cpio.gz
>     ship_9204_linux_disk3.cpio.gz

2. To unzip each file, run:

>     gunzip <filename>

3. To extract the `cpio` archive, run the following command on each file:

>     cpio -idmv <filename>.cpio

This command creates directories named Disk1, Disk2, and Disk3.

Note: The Oracle 8i Database Server software is no longer available from the Oracle download site. The Oracle 8i Database Server is now in Extended Support (ES) mode.

3. Set the environment variable`LD_ASSUME_KERNEL` to `2.4.1`.
4. Install the following RedHat Package Managers (RPMs):

>     compat-db-4.0.14-5.i386.rpm \
>     compat-gcc-7.3-2.96.122.i386.rpm \
>     compat-gcc-c++-7.3-2.96.122.i386.rpm \
>     compat-libstdc++-7.3-2.96.122.i386.rpm \
>     compat-libstdc++-devel-7.3-2.96.122.i386.rpm \

5. Relink `gcc` to `gcc296` and `g++` to`g++296`.

Note: Be sure to restore the `gcc` and `g++` to `gcc323` and `g++323` after the installation.

6. Download the patch `p3006854_9204_LINUX.zip` from `http://metalink.oracle.com/`. For more information, see Oracle bug 3006854. To apply this patch, run:

>     su - root
>     # unzip p3006854_9204_LINUX.zip
>     Archive:  p3006854_9204_LINUX.zip
>        creating: 3006854/
>        inflating: 3006854/rhel3_pre_install.sh
>        inflating: 3006854/README.txt
>     # cd 3006854
>     # sh rhel3_pre_install.sh
>     Applying patch...
>     Patch successfully applied

7. Go to the `Disk1` directory and run this command: `./runInstaller`.

Note: You cannot run this command as root.

Note: If you are accessing the system through a Telnet connection, make sure that your display is set correctly.

The `./runInstaller` command displays the Oracle Universal Installer: Welcome window.

8. On the Oracle Universal Installer Welcome window, click Next. The Inventory Location window appears.
9. On the Inventory Location window, set the directory field to where you want to install Oracle, for example: `/export/home/oracle`. The UNIX Group Name window appears.
10. On the UNIX Group Name window, enter the name for your group, and click Next.
11. A message window opens and directs you to run the `/tmp/orainstRoot.sh` command as root. Running this command outputs the following two lines:

>     Creating Oracle Inventory pointer file (/etc/oraInst.loc)
>     Changing groupname of /export/home/oracle to engineering.

12. Return to the message window and click Continue. The File Locations window appears.
13. On File Locations window, verify that the Source field is correct and change the Destination Name and Path to where you want to store the oracle files, and click Next. For example:

>     Name: ORACLE
>     Path: /export/home/oracle

The Loading products progress indicator displays in the upper right corner of the window. When the loading completes, the Available Products window appears.

14. On the Available Products window, select Oracle 9i Client 9.2.0.1.0, and click Next. The Installation Types window appears.
15. On the Installation Types window, select the Runtime radio button and click Next. The Summary window appears.
16. On the Summary window, click Install. The Install window appears and a progress indicator displays showing the status of the installation process. When the installation completes, the following message is displayed:

>     A configuration script needs to be run as root before installation can proceed. Please leave this window up, run /export/home/oracle/root.sh as root from another window, then come back here and click OK to continue.

17. Run the `root.sh` command. The `root.sh` command outputs the following:

>            Running Oracle9 root.sh script...
>            \nThe following environment variables are set as:
>     ORACLE_OWNER= dbooth
>                	ORACLE_HOME=  /export/home/oracle
>     Enter the full pathname of the local bin directory: [/usr/local/bin]:
>     Copying dbhome to /usr/local/bin ...
>     Copying oraenv to /usr/local/bin ...
>     Copying coraenv to /usr/local/bin ...
>     \nCreating /etc/oratab file...
>     Adding entry to /etc/oratab file...
>     Entries will be added to the /etc/oratab file as needed by Database Configuration Assistant when a database is created
>     Finished running generic part of root.sh script.
>     Now product-specific root actions will be performed.

18. After the script completes, click OK. The Configuration Tools window appears. Click No on the Oracle Net Configuration Assistant: Welcome window, and click Next.
19. Select the oracle8i or later database or service radio button on the Oracle Net Configuration Assistant: Net Service Name Configuration, Database Version window, and click Next.
20. Enter a Service Name into the entry field, and click Next. For example: `mydbhost.mydomain.com.`
21. Select TCP on the oracle Net Configuration Assistant: Net Service Name Configuration. Select the Protocols window, and click Next.
22. Enter a host name into the entry field on the Oracle Net Configuration Assistant: Net Service name Configuration, TCP/IP Protocol window, and click Next. For example: `mydbhost.mydomain.com`.
23. Select Yes to perform a test on the Oracle Net Configuration Assistant: Net Service Name Configuration Test window, and click Next. You should get this message:

>     Connecting...Test successful.

If not, click Back, correct the settings, and retest. If successful, click Next.

24. Enter a Net Service Name value on the Oracle Net Configuration Assistant: Net Service Name Configuration Net Service Name window, and click Next. For example: `mydbhost`.
25. Select No on the ...Another Net Service Name window, and click Next.
26. Click Next on the ...Configuration Done window, and click Next.
27. Click Finish to complete the Configuration process.
28. On the Oracle Universal Installer: End of Installation window, click Exit to close the Oracle installation.

This completes the configuration of an Oracle Client.

## Tuning an Oracle Database

After you have installed and configured the Oracle database and the Oracle Client, you should tune the database to suit the needs of your particular environment. The following topics provide information to assist in tuning your Oracle database:

- Calculating Oracle Tablespace Requirements
- Calculating Oracle Tablespace Size Requirements
- Calculating Oracle Rollback Tablespace Size Requirements
- Optimizing the Oracle Database for Large Policies

### Calculating Oracle Tablespace Requirements

To determine the tablespace size requirements, allot the amount of disk space based on the size of your policy. You should use 250 MB as an absolute minimum, provided the rollback segments can handle the policy loading and distribution.

To determine your actual tablespace requirements, see the following topics:

- Minimum Disk Space Allotment
- Group Flattening and Rules
- Metadirectory Synchronization Services

#### Minimum Disk Space Allotment

The 250 MB minimum disk-space allotment works fine with a small policy and a small user community such as the following:

- The policy has a maximum of 1000 users
- Each user belongs to no more than one group
- Each user has one single-valued attribute
- The policy has less than 100 privileges, resources, and declarations
- The policy has less than 100 flattened rules; no composite privileges, resources, or subjects (users and groups) in the rule

#### Group Flattening and Rules

Group flattening means that a rule can exist in one of two forms: a simple rule or a composite rule. A composite rule is a combination of two or more simple rules to make them easier to use. The process for reducing a composite rule to its component simple rules is called "flattening the group."

For example, if you had three local users named Joe, Betty, and Sam, you could grant those users a role in an application by creating a composite rule like this:

>     Grant(//role/bookkeeper, //app/policy/AcctDept/AcctApp, [//user/AcctDept/Joe/, //user/AcctDept/Sam/, //user/AcctDept/Betty/]);

In the policy language, this rule means "grant Joe, Sam, and Betty, who belong to the `AcctDept`, the role of `bookkeeper` in the accounting application, `AcctApp`."

The rule is a composite rule because it reduces or flattens to these three simple rules:

>     Grant(//role/bookkeeper, //app/policy/AcctDept/AcctApp, //user/AcctDept/Joe/);

>     Grant(//role/bookkeeper, //app/policy/AcctDept/AcctApp, //user/AcctDept/Sam/);

>     Grant(//role/bookkeeper, //app/policy/AcctDept/AcctApp, //user/AcctDept/Betty/);

Even though you may see one composite rule, the composite is actually stored and distributed as three flattened simple rules. The main ramification of rule flattening is that your policies can take much more disk space than you might think when simply looking at your policy. For information on how to construct rules, see Securing Resources and Defining Policy Rules in the Policy Managers Guide.

#### Metadirectory Synchronization Services

If you want to use the BEA WebLogic Enterprise Security Metadirectory Synchronization Services, you must create an additional set of tables to use to synchronize identity information. As a result, the amount of space required to store identity information approximately doubles so allocate an appropriate amount of extra tablespace. For more information, see Configuring Metadirectories in WebLogic Enterprise Security Administration Application Installation.

### Calculating Oracle Tablespace Size Requirements

You can estimate your space requirements using the following formulas. With group flattening, as with rules, group memberships are also reduced or flattened to their simple data components. For example, if you have a user that belongs to a group through group inheritance, the membership is stored as though the user were a direct member of the group. Thus, there is a separate group to user mapping for each group in the inheritance hierarchy. All numeric results are represented in megabytes. All formulas use the variables described in Table 3-4.

Table 3-4 Oracle Variables

Variable | Description
--- | ---
a | Total number of user attribute values for all users, in thousands
d | Total number of declarations, in thousands
m | Total number of flattened user/group mappings, in thousands
o | Total number of objects, in thousands
p | Total number of privileges, in thousands
q | Total number of object attribute values for all resources, in thousands
r | Total number of flattened rules, in thousands
u | Total number of users, in thousands

Oracle Corporation recommends using multiple datafiles for any tablespace that approaches one GB in size.

Use the following formula to calculate your tablespace size requirements. For a description of the formula variables, see Table 3-4.

Data Tablespace = 250 + 0.3u + 0.2 a + 0.1m + 1.2(o + p) + 0.75(q-1) + 4d + 5r

For example, if all the variables had the value 5, the formula looks like this:

= 250 + 0.3(5) + 0.2(5) + 0.1(5) + 1.2(5 + 5) + 0.75(5-1) + 4(5) + 5(5)

and reduces to this:

= 250 + 1.5 + 1 + 0.5 + 12 + 3 + 20 + 25

and finally:

= 313

Thus, the example requires a minimum of 313 MB of disk space.

### Calculating Oracle Rollback Tablespace Size Requirements

The rollback tablespace is required to successfully distribute the largest policy changes between distributions. When you change the policy and distribute it frequently in smaller chunks, the space required is reduced dramatically.

Rollback Tablespace = 250 + 2.5(o + p) + 2.5(q-1) + 6d + 10r

For a very small policy (the built-in policy plus a few hundred users), you can use the system rollback segments that are created during the database installation. However, BEA recommends that you create a new tablespace with a few rollback segments. Configuring 250 MB of rollback segments works fine for the restricted policy mentioned earlier.

For more information on configuring tablespace requirements, see the following topics:

- Temporary Tablespace Requirements
- Adding Additional Tablespaces
- Creating the Rollback Segments

#### Temporary Tablespace Requirements

For a very small policy (the built-in policy plus a few hundred users), you can use the system temporary tablespace (`TEMP`) that is created during the database installation. For larger policy, check to ensure that your `TEMP` setting is sufficient. However, BEA recommends that you create a new temporary tablespace that is at least one-fourth the size of your data tablespace.

#### Adding Additional Tablespaces

The datafile name and tablespace sizes in the following instructions are given for illustration purposes only. You should determine your own needs and replace these values. In addition, BEA chose to use the `autoextend` option in the instructions, but your needs may differ. Consult your Oracle documentation for details.

Finally, the following instructions are specific to a Sun Solaris installation. If you are installing on Windows 2000, replace all the forward slashes with back slashes and begin all file paths with the drive name.

To add additional tablespaces, perform the following steps:

1. To login as the system administrator, open a command window and type:

>     sqlplus SYSTEM/password@asi

where: `password` is the password you defined when you installed the database software `asi` is the database instance name.

2. To create the data tablespace, at the sqlplus prompt, type:

>     SQL> create tablespace DATA datafile '/oradata/ASI/data.dbf' size 10 M
>             autoextend on next 1M MAXSIZE 250M;

where: `DATA` is the tablespace name and`/oradata/ASI/data.dbf` is the physical datafile used to store the database schema.

3. To create the rollback tablespace, type:

>     SQL> Create tablespace RBS datafile '/oradata/ASI/rbs.dbf' size 10 M
>             autoextend on next 1M MAXSIZE 250M;

where: `RBS` is the tablespace name and`/oradata/ASI/rbs.dbf` is physical datafile to contain the rollback schema.

#### Creating the Rollback Segments

Use the instructions provided in this section to create and enable the maximum number of rollback segments (five) in the rollback tablespace created previously. You may want to do this if the rollback segments for the default database installation are not sufficient. Depending on the size of the rollback tablespace (represented in the commands as `rbs_1` to `rbs_5`), you can either create and enable more segments or increase the size of the existing segments instead.

To create the rollback segments, open a command window, start SQLplus, and type the following commands:

>     SQL> create rollback segment rbs_1 tablespace RBS STORAGE(INITIAL 100K
>            NEXT 100K OPTIMAL 500K MINEXTENTS 2 MAXEXTENTS 100);

>     SQL> create rollback segment rbs_2 tablespace RBS STORAGE(INITIAL 100K
>            NEXT 100K OPTIMAL 500K MINEXTENTS 2 MAXEXTENTS 100);

>     SQL> create rollback segment rbs_3 tablespace RBS STORAGE(INITIAL 100K
>            NEXT 100K OPTIMAL 500K MINEXTENTS 2 MAXEXTENTS 100);

>     SQL> create rollback segment rbs_4 tablespace RBS STORAGE(INITIAL 100K
>            NEXT 100K OPTIMAL 500K MINEXTENTS 2 MAXEXTENTS 100);

>     SQL> create rollback segment rbs_5 tablespace RBS STORAGE(INITIAL 100K
>            NEXT 100K OPTIMAL 500K MINEXTENTS 2 MAXEXTENTS 100);

### Optimizing the Oracle Database for Large Policies

When your Oracle database contains a large policy, you may want to do one or more of the following to optimize performance:

- Ensure that you allot the maximum amount of RAM to the Oracle server in the initialization parameters file (for Oracle 9i, `SPFILESID.ORA`; for Oracle 8i, `INIT.ORA)`.
- Ensure that you increase `SORT_AREA_SIZE` for the Oracle server in the initialization parameters file.
- Ensure that you allot enough disk space for the data tablespace and rollback segments.
- Run `install_sort_oracle.bat` or `install_sort_oracle.sh` to install ASCII sorting, instead of the default dictionary sorting that comes with the database schema installation. This improves the Administration Console response time. See Administering an Oracle Policy Database for details.

## Administering an Oracle Policy Database

This section covers the following topics:

- Creating a User Account in an Oracle Policy Database
- Using the Database Administration Utilities with Oracle
- Backing Up an Oracle Database

### Creating a User Account in an Oracle Policy Database

This section describes how to configure a new user account in an Oracle policy database. This account is necessary so that the policy for the instance of the Administration Application managed by this user can have a dedicated storage area allocated in the database instance.

Note: To perform this procedure, you must log into the Oracle database server as a database administrator.

To set up a database user account, perform these steps:

1. To login to the Oracle database server, type:

>     sqlplus dba/password@ASERVER

where:

`dba` is the username you use to access the database.

`password` is your database administrator password.

`ASERVER` is the name of the Oracle service (as defined in your `tnsnames.ora` file).

2. To create a new role in the database server, type:

>     SQL> create role asi_role;

>     SQL> grant create session to asi_role;

>     SQL> grant create table to asi_role;

>     SQL> grant create procedure to asi_role;

>     SQL> grant create sequence to asi_role;

>     SQL> grant create trigger to asi_role;

>     SQL> grant create view to asi_role;

where: `asi_role` is the new role.

The following example uses the default tablespaces generated when the Oracle database was first installed, although you can specify any tablespaces.

3. To set up a new database user account, type:

Note: In this example, you use the default tablespaces generated when you created and configured the Oracle database instance, however, you can specify any tablespaces.

>     SQL> create user username identified by password

>     SQL> default tablespace users quota unlimited on users

>     SQL> temporary tablespace temp quota unlimited on temp;

where:

`username` is the name to assign to the new user account.

`password` is the password to assign to the new user account.

`unlimited` is size of the tablespace (shown here as set to unlimited).

4. To grant the role with the necessary privileges to the user, at the command prompt, type:

>     grant asi_role to username;

>     conn sys as sysdba;

>     GRANT SELECT ON SYS.V_$LOCKED_OBJECT to username;

>     commit;

In this case, you grant `SELECT` permission to the user you created in step 3. The Oracle database server does not allow you to grant the permission to the `asi_role`. BEA WebLogic Enterprise Security uses this dynamic view to check whether one of its tables is currently being accessed. Therefore, the `SELECT` permission is required.

5. Exit SQLplus.

### Using the Database Administration Utilities with Oracle

Table 3-5 lists and describes the batch and shell files provided for database administration. The files are located in the following directory:

>     bea\wles42-admin\bin\

where:

`bea` is the `BEA_HOME` directory.

`wles42-admin` is the installation directory for the Administration Application.

Table 3-5 Oracle Database Administration Utilities

File Name | Used to:
--- | ---
export_policy_dbtype.bat export_policy_dbtype.sh | Exports policy data. See the BEA WebLogic Enterprise Security Policy Managers Guide for information on how to export policy. The `dbtype` is the type of database, Sybase or Oracle.
install_schema_dbtype.bat install_schema_dbtype.sh | Installs the policy database schema. See Installing the Policy Database Schema for information on how to install the database schema.
install_sort_<dbtype>.bat install_sort_<dbtype>.sh | Switches the sort order. When using Administration Console, the list of usernames and other policy elements can be sorted in alphabetical order or in discretionary order. This script is used to switch such sorting order. Alphabetical sort order has better performance than discretionary sort order. The parameters for this script are same as the `install_schema``` script, except the parameter for sorting type, which can take value of either A (ASCII) or D (Dictionary).
refresh_schema_dbtype.bat refresh_schema_dbtype.sh | Clean up the policy created in the policy database and return it to the same state as it was following the schema installation. The parameters for this script are the same as the `install_schema` script.
uninstall_schema_dbtype.bat uninstall_schema_dbtype.sh | Uninstall the policy database schema from the database server. The parameters for this script are the same as the `install_schema` script.

Before running these scripts with an Oracle database, you need to ensure the following setup steps are completed:

- The current path (.) is in your `PATH` environment.
- Ensure that the Oracle client is set up and configured as described.
- For Windows, ensure that the `PATH` includes the `BIN` and `DLL` directory of Oracle installation.
- For Solaris, ensure that the environmental variable `ORACLE_HOME` is set, $`ORACLE_HOME`/bin is in the `PATH`, and $`ORACLE_HOME`/lib in the `LD_LIBRARY_PATH`.
- Ensure that you can connect to the Oracle database server using command sqlplus (the Net Service Name, login ID and password).

### Backing Up an Oracle Database

BEA strongly recommends that you backup your original policy database regularly. A database backup is always recommended before you uninstall or re-install the policy database. You may need to contact your database or system administrator to assist with this process. Backups should be done on a regularly scheduled basis.

For instructions on backing up your Oracle database, see the Oracle Backup and Recovery Guide that comes with your Oracle documentation.

# Setting Up and Administering the Sybase Database and Client

This section contains the procedures for setting up and administering an Sybase database and a Sybase Client. It covers the following topics:

- Before you Begin the Sybase Database Setup
- Installing and Configuring the Sybase Adaptive Server
- Installing and Configuring a Sybase Database Client
- Tuning the Sybase Database
- Administering the Sybase Policy Database

## Before you Begin the Sybase Database Setup

Before you begin to set up your Sybase database, review the following topics to better understand Sybase database configuration requirements:

- Overview of the Sybase Client/Server Architecture
- Sybase Database System Requirements

### Overview of the Sybase Client/Server Architecture

The Sybase Adaptive Server is the server in the Sybase client/server architecture (see Figure 3-5). It manages multiple databases and multiple users, keeps track of the actual location of data on disks, maintains mapping of logical data description to physical data storage, and maintains data and procedure caches in memory.

The policy database is a set of database schemas in which all data are stored. The Sybase database contains a set of related data tables and other database objects organized and presented to serve a specific purpose.

A database device is a Sybase term that represents the portion of a device (a portion of a hard drive, such as a partition) that is dedicated to holding database data. When creating the database device, you can choose either a raw partition or an existing file system. Choosing a raw partition can increase the performance of the database server.

Figure 3-5 Sybase Adaptive Server Setup

The Database Login ID is a login created by a system administrator to log onto the Adaptive Server. Each Database Login has a password and a default database to access. A login is valid if the Adaptive Server has an entry for that user in the system table `syslogins`.

The Database Administrator (DBA) has a special database login ID that can access all databases in the Adaptive Server. The DBA is also referred to as the system administrator. In fact, the name of the DBA login is `sa` (for System Administrator).

The Database Owner (DBO) is a special database login with permission to perform all actions on a policy database. Usually, the login that creates the database automatically becomes the DBO. The Database User ID is dbo (lowercase), which is different from its Database Login ID. For your policy database, you can use any Database Login ID as the DBO.

The Database User ID pertains to one specific database and is a login given permission by the DBO or DBA (system administrator) to access that one database. In most cases, the database user ID is the same as the Database Login ID. However, in some cases, they may be different, as with the special dbo user ID.

A database schema is a collection of objects associated with a particular schema name. The objects include tables, views, domains, constraints, assertions, privileges, and so on.

The policy owner is a Database User ID that controls the set of database schema in the database. BEA recommends that you not use dbo as a policy owner because it requires special administration. The WebLogic Enterprise Security architecture allows multiple policy owners in its database, each owning a policy different from the other policies.

### Sybase Database System Requirements

Table 3-6 describes the minimum requirements for the system on which the Sybase Adaptive Server is installed.

Table 3-6 Sybase Database Minimum Requirements

Requirement | Description
--- | ---
Software Version | Sybase Adaptive Server Enterprise 12.5.
Server Platform | Any platform supported by Sybase.
Memory | As required by Sybase server installation (42 MB minimum).
Disk Space for the default database | As required by Sybase server installation.
Disk Space for Sybase software | Refer to the Sybase Adaptive Server Enterprise Installation Guide for details.
Disk Space for the Policy Database | A minimum of two database devices is required, each having 250 MB. To approximate space requirements for any policy size, use the formula in Calculating Sybase Database Size Requirements.
Sybase Client | Sybase client that ships with Version 12.5 of the product.

## Installing and Configuring the Sybase Adaptive Server

This section provides instructions for installing and configuring a Sybase database for use with the WebLogic Enterprise Security Administration Application.

For guidance on installing and configuring the database, see the following topics:

- Installing the Sybase Database—Use this procedure only if you have to install and configure the Sybase database software.
- Setting the Sybase Database Configuration Parameters—Use this procedure if the Sybase database software is already installed and you only need to set the configuration parameters as required by WebLogic Enterprise Security policy database.
- Creating Sybase Database Devices—Use this procedure to create Sybase database devices. The database devices must be created before you can create and configure the policy database.
- Creating and Configuring a Sybase Policy Database—Use this procedure to create and configure a policy database for use by the WebLogic Enterprise Security Administration Application.

### Installing the Sybase Database

This section provides recommendations for installing and configuring the Sybase database software. If the Sybase database is already installed on the database host machine, you can skip this procedure and go to Setting the Sybase Database Configuration Parameters.

To install the Sybase Adaptive Server, perform these steps:

1. To install a Sybase Adaptive Server database software, follow the Sybase installation instructions in the Sybase Adaptive Server Enterprise Installation Guide. When you are finished, go to step 2.

Note: In Sybase 12.5, you can choose the logical page size of 2K, 4K, 8K and 16K when building the server. This choice can affect the maximum length of usernames, resource names, and the length of rules, etc., when administering the security policy. See the Sybase Adaptive Server documentation for more information regarding the logical page size and column size limit.

2. Use `isql` or the Sybase Adaptive Server tool to set the `sa` password and the Sybase database configuration parameters. Do one of the following:

- To use `isql`, open a command console and log into the server as user `sa` and set the Sybase database configuration parameters. For instructions on how to use `isql`, see Sybase Adaptive Server Enterprise Installation Guide.
- To use Sybase Central Java Edition tool to set the Sybase database configuration parameters, go to the next step.

To make modifications to the server configuration, you must login as a Sybase system administrator. After making changes, you must restart the Sybase database server for the change to take effect. Table 3-7 describes the settings that BEA recommends for the Sybase configuration parameters. These setting are case sensitive.

You can access Sybase Adaptive Server from the same machine as the Adaptive Server or from another client machine. To access it from a client machine, you must install the Sybase Open Client on the client machine and configure the client machine to connect to the Sybase database server (see Installing and Configuring a Sybase Database Client).

3. Click Start>Programs>Sybase>Sybase Central Java Edition. The Sybase Central control page appears (Figure 3-6).

Figure 3-6 Sybase Central Java Edition Tool

4. From the Menu Bar, click Tools and then select Connect.
5. Enter the username `sa` and click Ok. The Sybase database server appears as a node in the left pane.
6. Expand the server node, click on the Logins folder, right click on sa in the right pane and select properties. The Login Properties window appears.
7. From the Login Properties windows, select Parameters, click on Change Password, and then set the password as desired.
8. In the left pane, right click on the server node and select Configure from the drop-down menu. The Server Properties window appears.
9. Refer to Table 3-7 and set the configuration parameters as directed.

Table 3-7 Sybase Configuration Parameters

Parameter | Description
--- | ---
Max online engines | Sets the number of processors on the host machine. The installation does not detect the number of processors on the host, so if your host has more than one (the default), you should change this parameter to reflect that. This option can increase server performance.
Max memory | Increasing this value can dramatically increase the performance of the Sybase server and Administration Console. Consult your system administrator to determine the amount of RAM available for the Sybase server.
Procedure cache size | Increase this from its default value of 25% to potentially increase server performance.
Identity burning set factor | Use a smaller value than the default value of 5000. BEA recommends a value of 1.
Number of user connections | The default is 25 connections. If your server is shared with other databases other than the policy database, you may want to increase this number. The Policy Distributor uses two connections. The server uses a pool connection. You can adjust the size of the pool connection in the configuration file. Under normal conditions, it does not use a large number of connections.
Number of locks | Increase the default value of 5000 to a larger setting if you anticipate distribution of large policies. Consider a policy of more than 2000 users and roles as a large policy. In practice, this value may be set to 10,000 or 20,000, together with the lock promotion mechanism installed later. Locks use a lot of memory. The Administration Console solves this problem by including a mechanism called lock promotion. If you install lock promotion, you can greatly reduce the number of locks used for distribution.
Number of open indexes | Increase this number from its default setting to a value like 2000.

### Setting the Sybase Database Configuration Parameters

Use this procedure this procedure to set the Sybase database configuration parameters.

Note: If you installed the Sybase database software and set these parameters as described in Installing the Sybase Database, skip this procedure and go to Creating Sybase Database Devices.

To set the Sybase database configuration parameters, perform the following steps:

Note: The section provides guidance to assist you, but it does not supersede the documentation provided by Sybase.

1. Use `isql` or the Sybase Server Config tool to set the `sa` password and the Sybase database configuration parameters. Do one of the following:

- To use `isql`, open a command console and log into the server as user `sa` and modify the server configuration. For instructions on how to use `isql`, see Sybase Adaptive Server Enterprise Installation Guide.
- To use Sybase Server Config tool to set the Sybase database configuration parameters, go to the next step.

Note: After you make the configuration changes, reboot the database server machine to have changes take effect.

1. Click Start>Programs>Sybase>Server Config. The Configure Sybase Server screen appears (see Figure 3-7).

Figure 3-7 Configure Sybase Servers Screen

2. Select the Adaptive Server product, login as user `sa`, select the Command Line Change Option, and set the Sybase configuration parameters listed and described in Table 3-7

### Creating Sybase Database Devices

The policy database requires at least two database devices, each having at least 250 MB of free space. The first device stores policy data and the other stores the transaction log. You must create these two database devices before you create and configure the policy database.

Note: For better performance, BEA recommends a raw partition as the best configuration for the database device. Obviously, you must allocate sufficient disk space to ensure that the database meets your performance requirements.

For instructions on how to create Sybase database devices, see the Chapter "Managing Adaptive Server Databases" in the Sybase Adaptive Server Enterprise Configuration Guide for the platform on which you installed the database server: Microsoft Windows, Solaris, or Linux.

### Creating and Configuring a Sybase Policy Database

Like other Sybase databases, the policy database contains at least one set of database schemas, owned by a user referred to as the policy owner. While it is unusual, the same database may contain multiple sets of policies, each owned by a different user.

Note: Before continuing, be sure that you have the names of two existing database devices that have sufficient free space to hold the data and transaction log for the policy database. If the database devices do not exist, go to Creating Sybase Database Devices and create them.

To create and configure the policy database, perform these steps:

1. From a command prompt, log into the database server as the Sybase system administrator. For example, type:

>     isql -Usa -SASERVER

where: `ASERVER` is the name of your database server.

2. Enter the following commands:

>     1>use master
>     2>go
>     1>create database sspolicy on asi_data_dev = 250 log on asi_log_dev =
>        250

where: `ss` `policy` is the name of the database. The name `ss` `policy` is used only for the purpose of the example. You can assign any name to the database. In this example, the minimum database sizes, 250 MB, are used. If you choose to use other sizes, enter those sizes instead.

`asi_data_dev` and `asi_log_dev` are the names of the two devices.

>     2>go

3. To use the Sybase `sp_dboption` system procedure to set the database options, type the following commands at the `isql` command prompt:

>     1>use master
>     2>go
>     1>sp_dboption sspolicy, "select into/bulkcopy", true
>     2>go
>     1>sp_dboption sspolicy, "abort tran on log full", true
>     2>go
>     1>sp_dboption sspolicy, "trunc log on chkpt", true
>     2>go
>     1>sp_dboption sspolicy, "trunc. log on chkpt.", true
>     2>go

For more information on the `sp_dboption` system procedure, see Sybase Adaptive Server Enterprise Reference Manual: Procedures.

Note: In a development database, you may be set the `trunc log on chkpt` option to true because the DBA may not have time to run a dump transaction from time-to-time to truncate the transaction log. In a production database, you must set this option to false and perform a dump transaction to back up and truncate the database and transaction logs.

4. To create the database user account for the WebLogic Enterprise Security Administration Application to access the policy database, perform these steps:

1. To create the ASI Database Login ID, at the `isql` command prompt, type the following commands:

>     1>use master
>     2>go
>     1>sp_addlogin asi, password, sspolicy, null, "asi login"
>     2>go

The `password` must be at least six alphanumeric characters or other characters allowed by Sybase. The name of the default database is `ss` `policy`. If an `asi` login already exists, you must use the `sp_modifylogin` command to set its default database to `ss` `policy`.

2. To create the ASI Database User ID, type the following commands:

>     1>use sspolicy
>     2>go
>     1>sp_adduser asi
>     2>go

3. To grant Permissions to the ASI Database User ID, type the following commands:

>     1>use sspolicy
>     2>go
>     1>grant all to asi
>     2>go

5. To verify that the configured user `asi` can connect to the target Sybase database using `isql`, open a command window on the machine on which the database is installed and login. For example, using the values specified in the previous step, type the following:

>     isql -Uasi -Sserver_name
>     Password: password
>     1>

where: `server_name` is the database server name and `password` in the password of the `asi` user.

This completes the configuration of the policy database.

## Installing and Configuring a Sybase Database Client

Skip this step if you want to administer the Sybase Adaptive Server and run the WebLogic Enterprise Security Administration Application on the machine on which the Sybase Adaptive Server is installed.

You must install the Sybase Open Client (Sybase client for Adaptive Server) to:

- Administer the Adaptive Server from a machine that does not already have the Adaptive Server or Open Client installed.
- Install the database schema or run any of the servers on a machine that does not already have Adaptive Server or Open Client installed. These servers include the Administration Server (on which your administration console is running) and the Policy Distributor.

The information you need to install and configure the Sybase Open Client includes:

- Sybase Server Name
- Username and password to log in to the database server
- Hostname and port number the database server is running on
- Sybase Database name

The following topics provide guidance for installing and testing a Sybase Open Client:

- Testing an Existing Sybase Open Client Installation
- Installing and Configuring the Sybase Open Client on Windows
- Installing and Configuring the Sybase Open Client on Sun Solaris
- Installing and Configuring the Sybase Open Client on Red Hat Advanced Server 2.1

### Testing an Existing Sybase Open Client Installation

If the Sybase Open Client is already installed, you need to ensure that you can access the Adaptive Server from the client. To do so, open a command window and type:

>     isql -U loginid -S ASERVER -P loginidpassword

where: `loginid` is the identity you defined when configured the policy database, `ASERVER` is the name of the policy database, and `loginidpassword` is the password of the identity.

The `isql` prompt appears, indicating a successful connection.

If this command fails and you know the client is installed, the client is probably not configured properly to point to the database server. If the client is on the same machine as the Sybase database, the client is configured automatically when you do the installation. If the client is on a machine other than the Sybase database machine, you need to configure the client. For instructions on how to configure the Open Client, see the installation and configuration procedure that applies to you particular platform:

- Installing and Configuring the Sybase Open Client on Windows
- Installing and Configuring the Sybase Open Client on Sun Solaris
- Installing and Configuring the Sybase Open Client on Red Hat Advanced Server 2.1

### Installing and Configuring the Sybase Open Client on Windows

To install the Sybase Open Client in a Windows environment, do the following:

Note: The section provides guidance to assist you, but it does not supersede the documentation provided by Sybase.

1. Log into Windows as administrator.
2. Start the Open Client installation program on your computer (setup.exe) and install the Open Client according to instructions provided in the Sybase Adaptive Server Enterprise Installation Guide for Windows. If the Open Client is already installed, skip this step and go to the next step.
3. Check that your system environment variables are set correctly to point to the Sybase installation directory, as shown in the following example (where the installation is on the D: drive):

>     SYBASE=D:\Sybase
>     SYBASE-JRE=D:\sybase\shared-1_0\JRE-1_3
>     SYBASE_OCS=OCS-12_5

4. Check that your system `PATH` environmental variable includes the `bin` and `dll` subdirectories of your Sybase installation directory, as shown in the following example (where the installation is on the D: drive):

>     D:\Sybase\OCS-12_5\bin and D:\Sybase\OCS-12_5\dll

5. Using a text editor or the `Dsedit` utility provided by Sybase, edit the Sybase configuration file `sql.ini` in the `\ini` sub-folder of your Sybase Open Client installation directory to include a server entry that points to your policy database server. For instructions on how to use the `Dsedit` utility to edit the `sql.ini` file, see the Sybase Adaptive Server Enterprise Installation Guide for Windows. For parameters required to edit the `sql.ini` file, see the `sql.ini` file located in \sybase\ini directory on the machine on which the Sybase database server is installed. Here is an example `sql.ini` file produced by the `Dsedit` utility:

>     [ASERVER]
>     master=TCP,PCWIZ, 5000
>     query=TCP,PCWIZ, 5000

6. To test your installation, at the command prompt, type:

>     isql -U loginid -S ASERVER -P loginidpassword

where: `loginid` is the identity you defined when configured the policy database, `ASERVER` is the name of the policy database, and `loginidpassword` is the password of the identity.

The `isql` prompt appears, indicating a successful connection.

This completes the configuration of the Sybase Open Client.

### Installing and Configuring the Sybase Open Client on Sun Solaris

To install and configure a Sybase Open Client on Sun Solaris, perform the following steps:

Note: The section provides guidance to assist you, but it does not supersede the documentation provided by Sybase.

1. Login to Solaris with the username `sybase`. If the user `sybase` does not exist, have your Solaris system administrator create it.
2. Start the Open Client installation program to install on your workstation and install the Open Client according to instructions provided in Sybase Adaptive Server Enterprise Installation Guide for Solaris.
3. Set the `SYBASE` environment variable to point to the Sybase installation directory, as shown in the following example:

>     /export/home/sybase

4. Set the `PATH` environment variable to include the bin subdirectory of your Sybase installation directory, as shown in the following example:

>     /export/home/sybase/OCS-12_5/bin

5. Set the `LD_LIBRARY_PATH` environment variable to include the lib subdirectory of your Sybase installation directory, as shown in the following example:

>     /export/home/sybase/OCS-12_5/lib

6. Using a text editor or the `Dsedit` utility provided by Sybase, edit the Sybase configuration file `sql.ini` in the `\ini` sub-folder of your Sybase Open Client installation directory to include a server entry that points to your database server. For instructions on how to use the `Dsedit` Utility to edit the `sql.ini` file, see the Sybase Adaptive Server Enterprise Installation Guide for Solaris. For parameters required to edit the `sql.ini` file, see the `sql.ini` file located in `\sybase\ini` directory on the machine on which the Sybase database server is installed. Here is an example `sql.ini` file produced by the `Dsedit` utility:

>     [ASERVER]
>     master=TCP,PCWIZ, 5000
>     query=TCP,PCWIZ, 5000

7. To test your installation, at the Solaris command prompt, type:

>     isql -U loginid -S ASERVER -P loginpassword

where: `loginid` is the identity you defined when configured the policy database, `ASERVER` is the name of the policy database, and `loginidpassword` is the password of the identity.

The `isql` prompt appears, indicating a successful connection.

8. Repeat steps 3 to 5 for each user needing access to the Sybase Adaptive Server.

Include these settings in either .`profile` or .`cshrc`, depending on the default user shell.

This completes the configuration of the Sybase Open Client.

### Installing and Configuring the Sybase Open Client on Red Hat Advanced Server 2.1

To install and configure a Sybase Open Client on Red Hat Advanced Server 2.1, perform the following steps:

Note: The section provides guidance to assist you, but it does not supersede the documentation provided by Sybase.

1. Install the Red Hat Advanced Server software according to instructions in the Sybase Adaptive Server Enterprise Installation Guide.
2. To test your installation, at the command prompt, type:

>     isql -Usa -Ppassword -Sserver_name

where: `server_name` is the database server name and `password` in the password of the `sa` user.

The `isql` prompt appears, indicating a successful connection.

This completes the configuration of the Sybase Open Client.

## Tuning the Sybase Database

After you have installed and configured the Sybase database and the Sybase Client, you should tune the database to suit the needs of your particular environment. The following topics provide information to assist in tuning your Sybase database:

- Calculating Sybase Database Size Requirements
- Calculating Sybase Tablespace Requirements
- Calculating Sybase Data Size Requirements
- Calculating Sybase Transaction Log Size Requirements
- Preventing Database Log Bloat with Sybase
- Expanding the Policy Database with Sybase
- Optimizing the Sybase Database for Large Policies

### Calculating Sybase Database Size Requirements

For the policy database, allot the amount of disk space based on the size of your policy. BEA recommends 250 MB as an absolute minimum.

For the policy database transaction log, allot the size for the transaction log database by considering the following factors:

- How often the transaction log is dumped. The less frequent the dumping, the greater the size requirement.
- The greatest possible size of your distributed policy.
- How often the policy is distributed before the transaction is dumped. If the policy is distributed frequently before dumping the transaction, a larger transaction log is required.

The size of the data and transaction log can be increased later to use any database devices, by using the SQL command `alter database`.

### Calculating Sybase Tablespace Requirements

To determine the tablespace size requirements, allot the amount of disk space based on the size of your policy, with a 250 MB as an absolute minimum, provided the rollback segments can handle the policy loading and distribution.

To determine your actual tablespace requirements, see the following topics:

- Minimum Disk Space Allotment
- Group Flattening and Rules
- Metadirectory Synchronization Services

#### Minimum Disk Space Allotment

The 250 MB minimum space works fine with a small policy and a small user community such as the following:

- The policy has a maximum of 1000 users
- Each user belongs to no more than one group
- Each user has one single-valued attribute
- The policy has less than 100 privileges, resources, and declarations
- The policy has less than 100 flattened rules; no composite privileges, resources, or subjects (users and groups) in the rule

#### Group Flattening and Rules

Group flattening means that a rule can exist in one of two forms: a simple rule or a composite rule. A composite rule is a combination of two or more simple rules to make them easier to use. The process for reducing a composite rule to its component simple rules is called "flattening the group."

For example, if you had three local users named Joe, Betty, and Sam, you could grant those users a role in an application by creating a composite rule like this:

>     Grant(//role/bookkeeper, //app/policy/AcctDept/AcctApp, [//user/AcctDept/Joe/, //user/AcctDept/Sam/, //user/AcctDept/Betty/]);

In the policy language, this rule means "grant Joe, Sam, and Betty, who belong to the `AcctDept`, the role of bookkeeper in the accounting application, `AcctApp`."

The rule is a composite rule because it reduces or flattens to these three simple rules:

>     Grant(//role/bookkeeper, //app/policy/AcctDept/AcctApp, //user/AcctDept/Joe/); and

>     Grant(//role/bookkeeper, //app/policy/AcctDept/AcctApp, //user/AcctDept/Sam/); and

>     Grant(//role/bookkeeper, //app/policy/AcctDept/AcctApp, //user/AcctDept/Betty/);

Even though you may see one composite rule, the composite is actually stored and distributed as three flattened simple rules. The main ramification of rule flattening is that your policies can take much more disk space than you might think when simply looking at your policy. For information on how the policy rules and how to construct rules, see Securing Resources and Defining Policy Rules in the Policy Managers Guide.

#### Metadirectory Synchronization Services

If you want to use the BEA WebLogic Enterprise Security Metadirectory Synchronization Services, you must create an additional set of tables to use to synchronize identity information. The amount of space required to store identity information approximately doubles so you should allocate an appropriate amount of extra tablespace. For more information, see Configuring Metadirectories in WebLogic Enterprise Security Administration Application Installation.

### Calculating Sybase Data Size Requirements

You can estimate your space requirements using the following formulas. With group flattening, like rules, group memberships are also reduced or flattened to their simple data components. For example, if you have a user that belongs to a group through group inheritance, the membership is stored as though the user were a direct member of the group. Thus, there is a separate group to user mapping for each group in the inheritance hierarchy. All numeric results are represented in megabytes. All formulas use the variables described in Table 3-8.

Table 3-8 Sybase Variables

Variable | Description
--- | ---
a | Total number of user attribute values for all users, in thousands
d | Total number of declarations, in thousands
m | Total number of flattened user/group mappings, in thousands
o | Total number of objects, in thousands
p | Total number of privileges, in thousands
q | Total number of object attribute values for all resources, in thousands
r | Total number of flattened rules, in thousands
u | Total number of users, in thousands

Use the following formula to calculate your data size requirements. For a description of the formula variables, see Table 3-8.

Disk Space = 250 + 0.3u + 0.2a + 0.1m + 1.2(o + p) + 0.75(q-1) + 4d + 5r

For example, if all the variables had the value 5, the formula looks like this:

= 250 + 0.3(5) + 0.2(5) + 0.1(5) + 1.2(5 + 5) + 0.75(5-1) + 4(5) + 5(5)

and reduces to this:

= 250 + 1.5 + 1 + 0.5 + 12 + 3 + 20 + 25

and finally:

= 313

Thus, the example requires a minimum of 313 MB of disk space.

Note: If your server has logical page size other than 2K, increase this space proportionately.

### Calculating Sybase Transaction Log Size Requirements

Use the following formula to calculate log size requirements. For a description of the formula variables, see Table 3-8.

Disk Space = 250 + 2.5(o + p) + 2.5(q-1) + 6d + 10r

This formula represents the size needed for loading and distribution at once before dumping the transaction log. Once the log is dumped after loading, the space requirement drops by a third.

Note: Contact your Database Administrator to find out the actual database device usage and for assistance on extending the device size or to adding a device. If your server has a logical page size other than 2K, you need to increase this space in proportion.

### Preventing Database Log Bloat with Sybase

BEA recommends that you regularly backup your policy databases. If you fail to do so, the transaction log can become quite large and could become so full that the database stops functioning. If you set the `trunc log on chkpt` database option to true, you will not have to manually dump the log from time to time. If you do want to manually dump the database or transaction logs, use the `dump database` and `dump transaction` commands. See your Sybase Administration Guide for more information.

### Expanding the Policy Database with Sybase

If your policy grows, you may need to expand your policy database. To do so, use the `alter database` command. If there is no more free space on any of your Sybase database devices, you may need to create a new device. To do so, use the disk `init` command.

If you do create a new database device, be sure not to combine the data and log databases on the same database device. See your Sybase SQL Server Reference Manual for more information.

### Optimizing the Sybase Database for Large Policies

When your database must contain a large policy, you may want to do one or more of the following to optimize performance:

- If your server has multiple processors, ensure that the max online engines setting reflects the number of processors.
- Ensure that you allot the maximum amount of RAM to the Sybase server.
- Ensure that you allot enough disk space for the data and transaction logs.
- Increase your `tempdb` size to facilitate sorting of large data sets.
- Run `lockpromotion_sybase.bat` or `lockpromotion_sybase.sh` to install the lock promotion mechanism to facilitate policy distribution.
- Regularly backup your database.
- Regularly dump the transaction log.
- Run `install_sort_sybase.bat` or `install_sort_sybase.sh``` to enable ASCII sorting, instead of the dictionary sorting that comes with the default database schema installation. This improves the Administration Console response time.

## Administering the Sybase Policy Database

This section covers the following database administration topics:

- Creating a User Account in a Sybase Policy Database
- Using the Database Administration Utilities with Sybase
- Backing Up a Sybase Database

### Creating a User Account in a Sybase Policy Database

This section describes how to configure a new user account in a Sybase database. This account is necessary so that the policy for the instance of the Administration Application managed by this user can have a dedicated storage area allocated in the database instance.

To set up the user account, create the login to the Adaptive Server Enterprise database, create the user for policy database, and grant the user privileges to manipulate the policy schema.

Note: BEA strongly recommends that you not use the `dbo` of the policy database as the policy owner. While it is possible to do so, it requires additional database configuration that is beyond the scope of this guide.

To create a database user account, perform these steps:

1. Log in as the System Administrator.
2. At the command prompt, type:

`isql -Usa -S` `server_name`

where: `server_name` is the database server name.

3. To create the ASI Database Login ID, at the `isql` command prompt, type the following commands:

>     1>use master
>     2>go
>     1>sp_addlogin asi, password, sspolicy, null, "asi login"
>     2>go

where: `password` must be at least six alphanumeric characters or other characters allowed by Sybase and `ss` `policy` is the name of the default database. If an `asi` login already exists, you must use the `sp_modifylogin` command to set its default database to `ss` `policy`.

4. To create the ASI database user ID, at the `isql` command prompt, type the following commands:

>     1>use sspolicy
>     2>go
>     1>sp_adduser asi
>     2>go

5. To grant permissions to the ASI database user ID, at the `isql` command prompt, type the following commands:

>     1>use sspolicy
>     2>go
>     1>grant all to asi
>     2>go

### Using the Database Administration Utilities with Sybase

Table 3-9 lists and describes the batch and shell files provided for database administration. The files are located in the following directory:

>     bea\wles42-admin\bin\

where:

`bea` is the `BEA_HOME` directory.

`wles42-admin` is the installation directory for the Administration Application.

Table 3-9 Database Administration Utilities

File Name | Used to:
--- | ---
export_policy_dbtype.bat export_policy_dbtype.sh | Exports policy data. See the BEA WebLogic Enterprise Security Policy Managers Guide for information on how to export policy. The `dbtype` is the type of database, Sybase or Oracle.
install_schema_dbtype.bat install_schema_dbtype.sh | Installs the policy database schema. See Installing the Policy Database Schema for information on how to install the database schema.
install_sort_dbtype.bat install_sort_dbtype.sh | Switches the sort order. When using Administration Console, the list of usernames and other policy elements can be sorted in alphabetical order or in discretionary order. This script is used to switch such sorting order. Alphabetical sort order has better performance than discretionary sort order. The parameters for this script are same as the `install_schema` script, except the parameter for sorting type, which can take value of either A (ASCII) or D (Dictionary).
refresh_schema_dbtype.bat refresh_schema_dbtype.sh | Clean up the policy created in the policy database and return it to the same state as it was following the schema installation. The parameters for this script are the same as the `install_schema` script.
uninstall_schema_dbtype.bat uninstall_schema_dbtype.sh | Uninstall the policy database schema from the database server. The parameters for this script are the same as the `install_schema` script.
lockpromotion_sybase.bat lockpromotion_sybase.sh | Install the lock promotion mechanism to facilitate distribution of large policy in Sybase. See Expanding the Policy Database with Sybase for details. You need DBA access to the database to run this script.
unlockpromotion_sybase.bat unlockpromotion_sybase.sh | Uninstall the lock promotion mechanism performed by `lockpromotion_sybase`. See Expanding the Policy Database with Sybase for details. You need DBA access to the database to run this script.

Before running these scripts with a Sybase database, you need to ensure the following setup steps are completed:

- The current path (.) is in your `PATH` environment.
- Ensure Sybase 12.5 client is set up and configured as in the Database Setup.
- Ensure that the `SYBASE` environmental variable is set.
- In Windows, ensure that `PATH` includes `%SYBASE%\OCS-12_5\`bin and `%SYBASE%\OCS-12_5\dll`.
- In Solaris, ensure that `PATH` includes `$SYBASE/OCS-12_5/bin` and that `LD_LIBRARY_PATH` includes `$SYBASE/OCS-12_5/lib`.
- Ensure you can connect to the Sybase database server using the `isql` command (the name of the database server, login ID and password).

### Backing Up a Sybase Database

BEA strongly recommends that you backup your original policy database regularly. A database backup is always recommended before you uninstall or re-install the policy database. You may need to contact your database or system administrator to assist with this process. Backups should be done on a regularly scheduled basis.

If you have an existing backup procedure in place, you may choose to run it. Otherwise, follow these steps:

1. Login to your Sybase database server as the system administrator, database operator, or database owner.

The database owner is not the same as the policy owner.

2. Backup the transaction log by using the Sybase `dump transaction` command.
3. Backup the database by using the Sybase `dump database``` command.

Note: See your Sybase documentation for further information on using these commands.