Showing posts with label Oracle. Show all posts
Showing posts with label Oracle. Show all posts

Tuesday, June 11, 2013

Some thoughts on database locking in Oracle and Microsoft SQL Server


Deadlocks are the bane of those of us responsible for designing and maintaining any type of database system. I’ve written about these before on the dispatcher level. However this time around, I’d like to discuss them a little further “down” so to speak, at the database level. Also in talking to various people about this topic I've found that it’s potentially the most divisive question since “Tastes good vs. Less filling

Database deadlocks are much like application ones, typically come when two processes are trying to access the same database row at the same time. Most often this is when the system is trying to read and write to the row at the same time. A nice explanation can be found here. What we essentially wind up with is the database equivalent of a traffic jam where no one can move. It’s interesting to note that both Oracle and Microsoft SQL server handle these locking scenarios differently. I’m not going to go into DB2 at the moment but will address it if there is sufficient demand.

When dealing with SQL Server, management of locks is handled through the use of the “Hint” called No Lock. According to MSDN:

Hints are options or strategies specified for enforcement by the SQL Server query processor on SELECT, INSERT, UPDATE, or DELETE statements. The hints override any execution plan the query optimizer might select for a query. (Source)
When NOLOCK is used this is the same as using READUNCOMMITTED which some of you might have be familiar with if you did the NetWeaver portion of the IDM install when setting up the data source. Using this option keeps the SQL Server database engine from issuing locks. The big issue here is that one runs the risk of having dirty (old) data in the database operations. Be careful when using NOLOCK for this reason. Even though the SAP Provisioning Framework makes extensive use of the NOLOCK functionality, they regression test the heck out of the configuration. Make sure you do, too misuse of NOLOCK can lead to bad things happening in the Identity Store database.

There is also a piece of SQL Server functionality referred to as Snapshot Isolation which appears to work as a NOLOCK writ large where database snapshots are held in the TEMPDB for processing (source) This functionality was recommended by a DBA I worked with on a project some time ago. The functionality was tested in DEV and then rolled to the customer’s PRODUCTION instance.

Oracle is a little different in the way that it approaches locking in that the system has more internal management of conflicts through use of rollback logs forcing data to be committed before writes can occur and thus deadlocks occur much less often (Source) This means that there is no similar NOLOCK functionality in the Oracle Database System.

One final thing to consider with database deadlocks is how the database is being accessed, regardless of the database being used.  It is considered a best practice in SAP IDM to use To Identity Store passes as opposed to uIS_SetValue whenever possible (Source)

At the end of the day, I don’t know that I can really tell you to employ these mechanisms or not. In general we do know that it’s better not to have deadlocks than to have them and to do what you can to achieve this goal. In general, if you are going to use these techniques, do make sure you are doing so in concert with your DBA team and after careful testing. I have seen Microsoft SQL Server’s Snapshot Isolation work well in a busy productive environment, but I will not recommend its universal adoption as I can’t tell you how well it will work in your environment. I will however recommend that you look into it with your DBA team if you are experiencing Deadlocks in SQL Server.


Tuesday, August 02, 2011

Going Fishing for IdM

I think it's a given that Oracle's Identity Manager has been the 600 pound Gorilla in the provisioning space over the last few years.  From what I've been seeing, Microsoft's FIM and a resurgence of SAP Netweaver Identity Management will present a challenge with the new versions that are coming out, but first we need to get past the "Eye"

What Eye is this?  Well, it's the FishEye group.  Currently specializing in OIM, this practice features some pretty savvy architects, engineers and old friends.  I'm looking forward to seeing what they can do!

Wednesday, February 23, 2011

Too much in the JAR

Recently had a problem where Import/Export was not working.  I kept getting an interesting Error Message:


What was really interesting about this was the user that was referenced, mxmc_admin.  Now this is interesting, because during the Identity Store creation process, you are prompted to use mxmc_rt as the user and there is no time during the install that you are asked to create a JAVA based connection string using mxmc_admin.

This started a great deal of troubleshooting and conversations with people who have a great deal of knowledge with IDM's moving parts. Ultimately we wound up looking at the options in IDM's MMC interface.


The problem was in the Classpath Extension. It seems in this installation we had the old Microsoft SQL 2000 JARs loading before the SQL 2005 JAR. Since the MS SQL 2000 drivers were no longer needed, I removed them, regenerated my dispatcher scripts and restarted the dispatcher services. I was now able to export without a problem. I'm saying it's the order that the JARs are ordered in since I looked at my personal sandbox system and saw that I had the following Classpath: 


And my Import/Export works just fine, thank you very much.

Some more good troubleshooting to come...

Wednesday, December 29, 2010

2010 and the Year in Identity

As the year draws down, I've been thinking a bit about the year and what's it's meant in Identity Management. There's certainly been a bit of discussion about the nature of Identity, authentication and authorization controls.  As technology, process and legislation grow closer, there's a greater need for Governance and Compliance controls than ever before.  We're also seeing the beginning of the Cloud truly being a part of the IdM solution.

We're also seeing consolidation on the business side in both the product and implementation branches with Oracle, SAP and Microsoft all making purchases.

Related to this, one thing I've been wondering is what will happen with SAP systems if you rely on either CUA or SUN Identity Manager. What are your plans, if any, for migrating off?  I've started a discussion on LinkedIn about this. Please take a moment and  share your thoughts about what you are considering or planning.

On a personal note, I wish all of my readers a happy and healthy New Year.

Thursday, May 13, 2010

SAP + Sybase = Oracle

I've been wondering when SAP would finally acquire a decent database. I was quite astounded when SAP passed on MYSQL and letting it go to SUN. (A complete waste in my opinion since now it's a 3rd class citizen in Oracle-land)

Now we see that SAP has purchased Sybase. An interesting purchase to be sure and one that will have some far reaching implications. First off, I think SAP will have the ability to go toe-to-toe with Oracle on almost all fronts (Still think they lack a strong access control piece)

It also allows them to include the missing piece to the entire SAP ecosystem, the environment that everything will live in. Now one wonders if they will pick up a Linux of some sort (SUSE/Novell) to compete with Solaris and maybe a hardware vendor to compete with SUN servers.

SAP in a box, anyone?

Monday, April 19, 2010

SailPoint Training

Not too bad when you get to go to two training classes in a row. Even better when they are on cool technologies like SAP NetWeaver Identity Manager and SailPoint's Identity IQ.

Had a great time and learned lots of stuff down in Austin, TX with the SailPoint team. Clearly, the IdM field continues to expand and redefine itself as a combination of regulation and security concerns demand better audit and compliance rules. Corporate Governance policies are finding themselves enforced as IT tools embrace certification and audit along with "old school" concepts such as user provisioning, password management and access control. I think SailPoint will be aggressively moving forward to complete this integration to produce a new "Compliance Driven" IdM model.

Given these developments, I find it hard to understand how Burton Group feels that "IdM is not aging gracefully" as pointed out in an abstract on Bob Blakely's latest paper, "Identity and Privacy Strategies Assessment (Single Instance Use Case)"

While I have the greatest respect for the folks at Burton, I have to say I cannot disagree more with this assessment. (Disclosure: I am not currently a Burton Group customer and as such only have access to the abstract and have not read the whole article)

IdM is rising to meet several challenges, as I have indicated above, and if there are architectural flaws it is due more to the fact that current providers are channeling the products to reflect their application suites. Oracle, SAP and Microsoft all embrace some part of their technologies for application serving or the front end or require specialized programming in the form of JAVA, Xpress or ABAP and are increasingly being engineered to work first with their own products and then addressing the rest of the enterprise (SAP is particularly guilty here)

I also foresee additional growth as IdM embraces new technologies in User Identification. A tighter integration between Biometrics, Smart Cards and other identifiers becomes more mainstream. However, before this can begin, IT and IS have to agree on standards and adoption of these identification methods.

Also let's not forget about the Specter of Federated Identity Services. While there have been several successful architectures developed, it's still one of the most complicated IdM scenarios out there. Perfecting the Federation Use Case and its easy deployment will kick off another chapter in IdM's steady evolution.

Thursday, September 03, 2009

(Database - Sun) + Oracle = Acquisition

It seems that the Europeans are putting their two cents into the pending acquisition of Sun by Oracle.

Can't say I'm surprised as many businesses in Europe and around the world use MySQL. I've often thought that this more than anything else would get in the way of the acquisition. Of all the areas of overlap, this seems to be the one that matters the most.

Oracle already owns one of the biggest databases around, now it stands to acquire another one with world wide appeal. As the article quoted above mentions:

Regulators must “examine very carefully the effects on competition in Europe when the world’s leading proprietary database company proposes to take over the world’s leading open-source database company,”
It's also a key part of the SAP system (in the form of MaxDB), which I am sure is part of the European investigation whether it is specifically mentioned or not, as the article also states:

“the enquiry will focus on the extent to which open-source software developers would be able to continue to develop software based on the open-source MySQL database,” which Sun bought last year and which is widely used.
I'm still thinking that the simplest solution to to sell MySQL to SAP. It would create a level playing field between Microsoft, Oracle/Sun and SAP.

All would have ERP and database tools. Microsoft and Oracle/Sun would still have operating systems, but I don't think this is a big issue for SAP since they not only run just fine on both. Additionally I think we all realize that SAP drives purchases of operating systems and tools from the other companies.

Can't wait to see what happens...

Tuesday, April 07, 2009

The Next Frontier?

Identity Management continues to find a space in the Enterprise landscape. It would seem that it's been falling into the realm of Information Security. Not sure that I completely agree with this but at least it's being discussed as part of Enterprise Architecture.

Certain business verticals in particular have been embracing this technology more than others. Most notably, Higher Education has been a big proponent of Identity Management (Gotta give it to Oracle's OIM/Fusion Middleware, they're doing well here right now.) As I think about other verticals, it strikes me that it's about time that the Health Care industry embrace, IdM.

Why so, you might ask? Here's a few of my reasons:
  • HIPAA -- How can you discuss the Health Care field and not talk about HIPAA? Strict access controls, need for compliance, monitoring of changes to accounts? All easily done by IdM. Advances in GRC apps will make even more of a splash.
  • Lots of changes -- Permanent staff, temps, students, visiting professionals means there are lots of changes in the user community, topped with vendors, contractors, patients and visitors makes it seem to me that this should be captured and recorded. Virtual Directories will be key in maintaining these user communities.
  • Identity is more than people -- Role management will also be important for business and technical roles. The better we track how these roles are created and maintained, the easier it will be to administer them.
  • Physical Access management -- Hospitals by nature are intended to be secure, so including means of physical access management will be important, either through "smart cards", biometrics or a combination of both.
I'll be thinking more about this in the coming weeks and months, what about you? Anyone out there doing this in a medical/hospital facility? What are you doing?

Tuesday, July 29, 2008

Configuring Oracle and Lessons Learned

I've been in the process of working with Service Pack 2 Patch 1 running under Oracle 10g.

Strangely enough this was the first time I had ever made a serious attempt at running under Oracle. All professional and internal builds that I have ever done with NW IDM (and MIC before it) have always run under MS SQL Server. So I proceeded to jump right in and do the install. Afterall, how different could it be? It's a database that I've installed before for other applications and an application that I've installed hundreds, if not thousands of times. Little did I know...

During the process I learned quite a few things which may or may not be helpful to others configuring NW IDM under Oracle for the first time:

1. Read all of the installation documents supplied by SAP. This would have saved me a lot of headaches and about 6 hours of troubleshooting, not to mention 3 uninstall/reinstalls.

2. When installing Oracle 10g make sure that the OS user that is used to start up the database instance has the Log on as a Batch Job Local Policy Setting.

3. When configuring the ADO connections (Runtime Console) and make sure that you use the Oracle Provider for OLE DB.

4. When configuring the Java Runtime JDBC conneection make sure that you're using the odbc5.jar and that you're using the corresponding ODBC Thin Driver when setting up the JDBC RT Connection string.

5. See #1. Both points 3 and 4 were covered in the SAP install documention.

So now I appear to have a working, but empty IDM configuration. I've got running displatchers and a working Web UI. It's good to see everything up and running, and most importanly, I've learned a few lessons along the way. I've seldom had an internal, training or production install where I did not learn something, and these were ones I won't soon forget.

Next up... Installing Virtual Directory Server.