Forum Stats

  • 3,874,496 Users
  • 2,266,746 Discussions
  • 7,911,867 Comments

Discussions

OPA-Siebel Connection; When calling OPA Answer Service Workflow it gives security token error

We have an ongoing Siebel upgrade project moving from 16.19 to 21.12. In the previous version we had a flawles integration to OPA version (opa hub: 12.2, policy modeling: 17D) via web services and web services only. Only the answer service was in use in that environment. 

The new OPA HUB version is 12.2.18 and policy modeling version is 22C in the new Siebel 21.12 environment. 

When we were setting up the connection in the OPA HUB to access Siebel's "OPA Get Meta Data Service" checkalive and checkmetadata ports we encountered an error:

Service with url 'https://epelldevweb01.tcs.allamkincstar.gov.hu/siebel/app/eai_anon/enu/?SWEExtSource=SecureWebService&SWEExtCmd=Execute' returned message Namespace value 'http://xmlns.oracle.com/policyautomation/hub/12.2/metadata/types' in SOAPAction does not match Namespace value '' in xml tag 'PUBContact1_CheckAlive_Input'.(SBL-EAI-08025)

We could successfully set up the connection between Siebel and OPA only by setting the Version to 12.2 (Obsolete version). The green checkmark was appeared, the error above disappeared.

After setting the outbounnd connection in OPA, we went to the policy modeling application and had checked the "load data related to a particaular" to checked and set HLSCase to the textbox (which is the root/global in our solution). We have deployed our project. This caused the answer service endpoint to show up. However please note that we could only set values in input mapping, the output mapping option for all attributes were inactive (mapped out field).

After getting the following URL as and answer service endpoint:

https://epelldevapp02.tcs.allamkincstar.gov.hu:7004/devopa/determinations-server/answer/soap/12.2.1/E-PELL

where "E-PELL" is the name of the policy modelling project in our solution.

we have added this URL to the following Siebel web services: (siebel WSDLs and WS definition XMLs are attached).

- DeterminationServer (port Assess, Authentication method in siebel: none)

- odsAnswerService12.2_TEBA_CST (port GetAnswer and GetMetaData) where TEBA_CST is a solution specific postfix. (Authentication method in siebel: Username/Password - clear text)

XSL files were in place (siebsrvr/xlst).

Please note that OPA HUB user and password are added to these steps in the "OPA Answer Service Workflow" workflow:

- "GetInputDataDefinition"

- "GetAnswer Send Receive"

The wf is deployed, the corresponding IOB is deployed and validated.

After calling "OPA Answer Service Workflow" from siebel we have encountered the following error: "The security token could not be authenticated or authorized."

We tried to invoke GetAnswer and GetMetaData from SOAPUI with the same results.

I would be grateful for any advice on how to fix the problem.

Best Answer

  • Richard Napier
    Richard Napier Member Posts: 525 Bronze Trophy
    Answer ✓

    Hi

    Thanks for coming back to me. Let's do a couple of things to try and eliminate the most obvious potential problems.

    1) When you run GetMetaData through SoapUI, what is the response? Are you seeing the correct metadata?

    2) Similarly, what is the SOAP UI response to a Load Request?

    Using SOAP UI gives us the opportunity to assess if the error is coming from a Siebel issue (you're using the wrong password for your Siebel user, or the authentication of the Web Service in the Administration is set incorrectly, or there is a missing Filter Service on the Web Service, or there is a fault in a Workflow Process) or if there is a more fundamental issue (the Web Service definition has expired, etc).

    Come back with the answers to those two and we will have a better picture of the situation. I'm in contact with Máté as well so if you want I can hop on a call some time to discuss.

    Have fun.

Answers

  • Richard Napier
    Richard Napier Member Posts: 525 Bronze Trophy

    Hi

    When you upgraded your Siebel environment did you keep the old metadata objects (Integration Objects and Components representing getmetadata-request and getmetadata-response, etc)?

    That could be part of the reason for the first problem you describe. The integration objects and components and other objects have User Properties that specify the namespace version. There is some information about this here : https://intelligent-advisor.com/main/oracle-policy-automation-and-siebel-21/ . That article series may prove useful as it walks through an integration between Siebel 21 and OPA 12.

    Regarding the second issue, the inability to map outbound fields, this is also possibly because the XSLT is not rendering the correct response to GetMetaData. Again, I've seen issues like this and I mention them in the link above.

    The complete series of Siebel 21/OPA articles is here : 123456

    Feel free to come back and we can discuss further.

    Regards to everyone at the Treasury!

    Richard

  • Boglárka Nagy
    Boglárka Nagy Member Posts: 5 Green Ribbon

    Hi,

    thank you for your answer. Unfortunately, it hasn’t led to a solution yet. 

    We’ve read through your articles and tried to make sure that we have the same namespace everywhere, so we’ve set it to 12.2.1 in all the following objects: 

    bs: 

    odsAnswerService12.2_SiebelOPAIntegration_type 

    odsAssessServiceGeneric122_TEBA_CST_type 

     

    iob: 

    get-answer-response 

    get-answer-request 

    get-input-data-definition-request 

    get-input-data-definition-response 

    get-metadata-request 

    get-metadata-response 

    check-alive-request 

    check-alive-response 

     

    get-checkpoint-request 

    get-checkpoint-response 

     

    set-checkpoint-request 

    set-checkpoint-response 

     

    We have the same version set in our connection in OPA hub and the connection is alive.

    Unfortunately, we still received the following error message upon trying to call the rule base: 

    “Error msg: Error invoking service 'odsAnswerService12.2_SiebelOPAIntegration_type', method 'GetInputDataDefinition' at step 'Get InputData Defination'.(SBL-BPR-00162) 

    Operation 'GetInputDataDefinition' of Web Service 'http://oracle.com/determinations/server/answer/12.2.1/rulebase/types.odsAnswerService12.2_TEBA_CST' at port 'odsAnswerService12.2_TEBA_CST' failed with the following explanation: "The security token could not be authenticated or authorized".(SBL-EAI-04308) 

    Custom msg: undefined” 

    In addition, in OPM the Output mapping is still inactive.

    Thank you for your help, and we are open to any additional ideas,

    the Treasury Team

  • Richard Napier
    Richard Napier Member Posts: 525 Bronze Trophy
    Answer ✓

    Hi

    Thanks for coming back to me. Let's do a couple of things to try and eliminate the most obvious potential problems.

    1) When you run GetMetaData through SoapUI, what is the response? Are you seeing the correct metadata?

    2) Similarly, what is the SOAP UI response to a Load Request?

    Using SOAP UI gives us the opportunity to assess if the error is coming from a Siebel issue (you're using the wrong password for your Siebel user, or the authentication of the Web Service in the Administration is set incorrectly, or there is a missing Filter Service on the Web Service, or there is a fault in a Workflow Process) or if there is a more fundamental issue (the Web Service definition has expired, etc).

    Come back with the answers to those two and we will have a better picture of the situation. I'm in contact with Máté as well so if you want I can hop on a call some time to discuss.

    Have fun.

  • Richard Napier
    Richard Napier Member Posts: 525 Bronze Trophy

    HI Again

    And one more thing - are your OIA and Siebel machines co-hosted or on different machines (probably on different machines but just wanted to check). Given that Siebel 17+ is in https / TLS at every level, you will perhaps encounter issues related to certificates and handshakes. Certainly embedded interviews will have some issues related to CORS.

    What authentication is enabled on the EAI Object Manager (DB, LDAP etc)?

  • Boglárka Nagy
    Boglárka Nagy Member Posts: 5 Green Ribbon

    Hi,

    here’s a very short summary of our journey:

    We restarted from setting the connection to the newest version in OPA HUB (12.2.18) and generating the wsdl from the new connection. We set the namespaces accordingly in all relevant IOBs and business services. The last step was to refresh the mapping settings in OPM and make sure that the checkbox to update HlsCase (Global in our entity structure) at the end of the interview is checked which enabled output mapping. Finally, our new versions of OIA and Siebel are communicating as expected.

    Thank you for your help,

    the Treasury team :)