ORABPEL-30701: Insufficient privileges to access metadata for another user

Error:

<Error> <oracle.soa.services.workflow.user> <BEA-000000> <<.> Insufficient privileges to access metadata for another user.

User USER A attempted to access metadata for user USER B without having appropriate administrator privileges.

Ensure that the appropriate privileges have been granted before attempting to access metadata belonging to another user.

ORABPEL-30701

Error Stack:

Insufficient privileges to access metadata for another user.

User USER1 attempted to access metadata for user USER2 without having appropriate administrator privileges.

Ensure that the appropriate privileges have been granted before attempting to access metadata belonging to another user.

        at oracle.bpel.services.workflow.user.impl.UserMetadataService.validateOperation(UserMetadataService.java:2401)

        at oracle.bpel.services.workflow.user.impl.UserMetadataService.updateGrantedTaskView(UserMetadataService.java:1339)

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

        at java.lang.reflect.Method.invoke(Method.java:597)

        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)

        at oracle.bpel.services.workflow.common.WorkflowServiceCacheEventAdvice.invoke(WorkflowServiceCacheEventAdvice.java:91)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)

        at oracle.bpel.services.workflow.test.workflow.ExceptionTestCaseBuilder.invoke(ExceptionTestCaseBuilder.java:155)

        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)

        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)

        at $Proxy251.updateGrantedTaskView(Unknown Source)

        at oracle.bpel.services.workflow.user.ejb.UserMetadataServiceBean.updateGrantedTaskView(UserMetadataServiceBean.java:202)

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

        at java.lang.reflect.Method.invoke(Method.java:597)

        at com.bea.core.repackaged.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:310)

        at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)

        at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)

        at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

        at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

        at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)

        at com.oracle.pitchfork.spi.MethodInvocationVisitorImpl.visit(MethodInvocationVisitorImpl.java:34)

        at weblogic.ejb.container.injection.EnvironmentInterceptorCallbackImpl.callback(EnvironmentInterceptorCallbackImpl.java:54)

        at com.oracle.pitchfork.spi.EnvironmentInterceptor.invoke(EnvironmentInterceptor.java:42)

        at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)

        at com.bea.core.repackaged.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:89)

        at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)

        at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131)

        at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119)

        at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)

        at com.bea.core.repackaged.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)

        at $Proxy311.updateGrantedTaskView(Unknown Source)

        at oracle.bpel.services.workflow.user.ejb.UserMetadataService_5ksc1c_EOImpl.__WL_invoke(Unknown Source)

        at weblogic.ejb.container.internal.SessionRemoteMethodInvoker.invoke(SessionRemoteMethodInvoker.java:40)

        at oracle.bpel.services.workflow.user.ejb.UserMetadataService_5ksc1c_EOImpl.updateGrantedTaskView(Unknown Source)

        at oracle.bpel.services.workflow.user.ejb.UserMetadataService_5ksc1c_EOImpl_WLSkel.invoke(Unknown Source)

        at weblogic.rmi.internal.ServerRequest.sendReceive(ServerRequest.java:174)

        at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:345)

        at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:259)

        at oracle.bpel.services.workflow.user.ejb.UserMetadataService_5ksc1c_EOImpl_1036_WLStub.updateGrantedTaskView(Unknown Source)

        at oracle.bpel.services.workflow.user.client.UserMetadataServiceRemoteClient.updateGrantedTaskView(UserMetadataServiceRemoteClient.java:102

Problem:

--------
Let's say a user A shares a view, user B logs into worklist application and goes to shared view. User B clicks on a column to sort but receives an error message.
Error displayed to user: Error occured while sorting task list.
Insufficient privileges to access metadata for another user.Ensure that the appropriate privileges have been granted before attempting to access metadata belonging to another user.
 

Resolution:

--------------------
1) Issue does NOT happen when both users (UserA and UserB) are part of the Administrators group.

2) you should either look for a patch patch 12693265 and apply it, or contact support about obtaining a fix that is suitable for your environment (incase you have any conflicting patches that already exist in your environment).

 

[Note:] The base bug 12693265 fixed for 11.1.1.6.0 but may also have the problem. Other users can sort the columns now, but can see an error in the logs.

Workaround: Ignore the error.

 

References:

Bug 12693265 : UNABLE TO SORT TASKS IN BPM WORKLIST SHARED VIEWS

Bug 12870530 - SORTING A COLUMN FROM A VIEW GRANTED BY ANOTHER USER RESULTS IN ORABPEL-30701

Bug 13036746 : ORABPEL-30701 ERROR WHEN TRYING TO SORT COLUMNS BUT SORT WORKS FINE

Setting Audit level for SOA 11g

One of the important performance tuning parameter is setting up the correct audit level at soa infrastructure level, service engine (BPEL, BPMN, Mediator, etc) composite and component level

Now important questions is when we should change the audit level??

When your composite is accepting and processing huge payload, then production level can also be CPU heavy and processing time can be huge.

For eg: When I have a service which needs to accept a file content in form of byte array (base64) and write it into a directory, the bpel engine could be CPU heavy even when audit level is production. In that case, I can switch to audit level to minimal and can write custom code to do some audit trail and reduce lot of processing time

To know more on audit level and how to set it, you can continue reading the blog

.

Precedence of the audit level properties as per Oracle:

Component	Composite	Service Engine	SOA Infrastructure	Which Setting Takes Precedence?
No property	Off	Production	Development	Composite. The audit level is set to Off. The service engine and SOA Infrastructure audit levels do not take effect.
No property	Inherit	Development	Production	Service engine. The audit level is set to Development. The payload is shown in the assign activity. The SOA Infrastructure audit level does not take effect.
No property	Inherit	Inherit	Production	SOA Infrastructure. The audit level is set to Production.
No property	Inherit	Production/ Development/ Off/Inherit	Off	The overall audit is not shown. The composite inherits the audit level from the SOA Infrastructure. The payload is shown in the assign activity based on the service engine audit level setting.
Development	Off	Production	Development	Composite. Since the composite audit level is set to Off, the overall audit is not shown. The service engine audit level is shown, but the Development setting for the component takes precedence. The payload is shown in the assign activity based on the component audit level setting of Development.
Inherit	Off	Production	Development	Composite. Since the composite audit level is set to Off, the overall audit is not shown. The service engine audit level is not shown because Off is inherited from the composite.

Setting up Audit level at the infrastructure level:

Usually we configure the audit level at the soa infrastructure level and rest of the components will always have default values as inherited

(Note: If nothing is mentioned at composite level, it will inherit audit level properties from infrastructure)

To check and change audit level at infrastrucuture level go to soa-infra -> Common Properties -> Audit Level

Possible values and their explanation is below as per Oracle document:

Element

Description

Audit Level

Select the level of information to be collected by the message tracking infrastructure. This information is collected in the instance data store (database) associated with the SOA Infrastructure. This setting has no impact on what gets written to log files. Off: No composite instance tracking and payload tracking information is collected. Instances are created, but are not displayed. Development: Enables both composite instance tracking and payload detail tracking. However, this setting may impact performance. This level is useful largely for testing and debugging purposes. Production: Composite instance tracking is collected, but the Oracle Mediator service engine does not collect payload details and the BPEL process service engine does not collect payload details for assign activities (payload details for other BPEL activities are collected). This level is optimal for most normal production operations.

We recommend keeping Production value in prod environment. For any particular composite if you need to trace the value, you can change the audit level to development at composite level

Now in some cases we might have to set the audit level at composite level. Possible values of audit level are as below:

Off, Minimal, Inherit, Development, and Production

(Note: OFF will not show any instances on em but minimal will just show the instances but no audit trail)

You can set the audit level for BPEL process service components in two ways:

1. Using MBean browser through em

Soa-infra -> Adminsitration -> System MBean Browser -> Application Defined MBeans   -> 

oracle.soa.config -> Server: <soaserver_name>  - SCAComposite -> <Composite_Name >

-> SCAComposite.SCAComponent  -> <BPEL_Service_Component> -> Properties

Click on Add (+) icon and add the property bpel.config.auditLevel and save it as shown below:

2. Using Oracle Jdeveloper

<component name="BPELProcess">

   <implementation.bpel src="BPELProcess.bpel" />

   <property name="bpel.config.auditLevel">Minimal</property>

</component>

Note: Processing time and CPU utilization can be reduced a lot by setting the audit level property to none or minimal

I hope you would have got a fair idea on how to tune your soa environment by setting right audit level at different levels based on your requirements

In case of any queries, you are welcome to comment or write us at letslearnoraclesoa@gmail.com

Cheers,

LetsLearnOracleSOA Team