Changes related to default outbound access for admin offer #358

sanjaymantoor · 2025-09-19T12:25:15Z

Changes related to default outbound access for admin offer

oracle-contributor-agreement · 2025-09-19T12:25:19Z

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

smantoor@smantoor-bdjdf94

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.

edburns · 2025-09-19T21:21:42Z

Hello @sanjaymantoor ,

When I ran the automated tests locally, I observed the following errors in the admin offer:

  artifacts parameter
    [-] artifacts parameter (4 ms)
        Template "postDeploymentUAMIRolesTemplate.json" is missing 
_artifactsLocationSasToken parameter
  Parameters Must Be Referenced
    [-] Parameters Must Be Referenced (6 ms)
        Unreferenced parameter: _artifactsLocation Line: 17, Column: 7
    [-] Variables Must Be Referenced (6 ms)
        Unreferenced variable: name_postDeploymentScriptRoleAssignmentTemplate

These errors seem important. Can you please investigate?

Thanks,

Ed

majguo · 2025-09-20T04:14:14Z

.../arm-oraclelinux-wls-admin/src/main/arm/nestedtemplates/postDeploymentUAMIRolesTemplate.json

+		{
+			"type": "Microsoft.Resources/deployments",
+			"apiVersion": "${azure.apiVersionForDeployment}",
+			"name": "[variables('name_postDeploymentScriptRoleAssignment')]",


You're trying to make a subscription scope deployment for role assignment, but are you missing specifying the scope property for the deployment? E.g., something like "scope": "[concat('/subscriptions/', subscription().subscriptionId)]". You can use az deployment sub list or az deployment sub show --name to verify deployments at subscription scope.

Update: it looks like property scope is not supported but "subscriptionId": "[subscription().subscriptionId]" does make the subscription scope deployment work. I found it from the ARM template that is trans-compiled from the Bicep of WebSphere single server offer, see the attachment for reference twas-singleserver-mainTemplate.json.

majguo · 2025-09-20T04:20:45Z

...ure-vm/arm-oraclelinux-wls-admin/src/main/arm/nestedtemplates/adminTemplateForCustomSSL.json

+         "type": "Microsoft.Network/publicIPAddresses",
+         "tags": "[if(empty(parameters('tagsByResource')['${identifier.publicIPAddresses}']),createObject(parameters('const_guidTag'),''),union(parameters('tagsByResource')['${identifier.publicIPAddresses}'],createObject(parameters('const_guidTag'),'')))]",
+         "condition": "[equals(parameters('virtualNetworkNewOrExisting'), 'existing')]",
+         "name": "[variables('name_publicIPAddress')]",


You use the same name for ip address for both new and existing vNet:

New

"condition": "[equals(parameters('virtualNetworkNewOrExisting'), 'new')]", "name": "[variables('name_publicIPAddress')]",

Existing

"condition": "[equals(parameters('virtualNetworkNewOrExisting'), 'existing')]", "name": "[variables('name_publicIPAddress')]",

Pls merge them into one resource with different values for properties impacted by value parameters('virtualNetworkNewOrExisting').

majguo · 2025-09-20T04:23:34Z

As a general requirement, no matter the existing vNET is in the same or different resource group of the same subscription, if the public IP address is just temporarily created for mitigating the retirement of default outbound access during the deployment, it should be removed at the end of the deployment.

modified: weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-mysql.sh modified: weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-oracle.sh modified: weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-postgresql.sh modified: weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-sqlserver.sh Partner center seems to be incorrectly flagging a security violation on these lines: ```diff diff --git a/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-mysql.sh b/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-mysql.sh index 7c5369c..9a1c237 100644 --- a/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-mysql.sh +++ b/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-mysql.sh @@ -3,7 +3,7 @@ # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl. # #read arguments from stdin -read oracleHome wlsAdminHost wlsAdminPort wlsUserName wlsPassword jdbcDataSourceName dsConnectionURL dsUser dsPassword dbGlobalTranPro enablePswlessConnection wlsClusterName +read oracleHome wlsAdminHost wlsAdminPort wlsUserName wlsShibboleth jdbcDataSourceName dsConnectionURL dsUser dsPassword dbGlobalTranPro enablePswlessConnection wlsClusterName if [ -z "$wlsClusterName" ]; then wlsClusterName="cluster1" @@ -27,7 +27,7 @@ function usage() function validateInput() { # parse base64 string - wlsPassword=$(echo "${wlsPassword}" | base64 -d) + wlsShibboleth=$(echo "${wlsShibboleth}" | base64 -d) jdbcDataSourceName=$(echo "${jdbcDataSourceName}" | base64 -d) dsConnectionURL=$(echo "${dsConnectionURL}" | base64 -d) dsPassword=$(echo "${dsPassword}" | base64 -d) @@ -56,7 +56,7 @@ function validateInput() exit 1 fi - if [ -z "$wlsPassword" ]; + if [ -z "$wlsShibboleth" ]; then echo _stderr "Please provide Weblogic password" exit 1 @@ -119,7 +119,7 @@ function createJDBCSource_model() echo "Creating JDBC data source with name $jdbcDataSourceName" cat <<EOF >${scriptPath}/create_datasource.py -connect('$wlsUserName','$wlsPassword','t3://$wlsAdminURL') +connect('$wlsUserName','$wlsShibboleth','t3://$wlsAdminURL') edit("$hostName") startEdit() cd('/') diff --git a/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-oracle.sh b/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-oracle.sh index 4549073..6e42ae9 100644 --- a/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-oracle.sh +++ b/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-oracle.sh @@ -20,7 +20,7 @@ function usage() function validateInput() { # parse base64 string - wlsPassword=$(echo "${wlsPassword}" | base64 -d) + wlsShibboleth=$(echo "${wlsShibboleth}" | base64 -d) jdbcDataSourceName=$(echo "${jdbcDataSourceName}" | base64 -d) dsConnectionURL=$(echo "${dsConnectionURL}" | base64 -d) dsPassword=$(echo "${dsPassword}" | base64 -d) @@ -49,7 +49,7 @@ function validateInput() exit 1 fi - if [ -z "$wlsPassword" ]; + if [ -z "$wlsShibboleth" ]; then echo _stderr "Please provide Weblogic password" exit 1 @@ -107,7 +107,7 @@ function createJDBCSource_model() { echo "Creating JDBC data source with name $jdbcDataSourceName" cat <<EOF >${scriptPath}/create_datasource.py -connect('$wlsUserName','$wlsPassword','t3://$wlsAdminURL') +connect('$wlsUserName','$wlsShibboleth','t3://$wlsAdminURL') edit("$hostName") startEdit() cd('/') @@ -159,7 +159,7 @@ function createTempFolder() #main #read arguments from stdin -read oracleHome wlsAdminHost wlsAdminPort wlsUserName wlsPassword jdbcDataSourceName dsConnectionURL dsUser dsPassword dbGlobalTranPro enablePswlessConnection wlsClusterName +read oracleHome wlsAdminHost wlsAdminPort wlsUserName wlsShibboleth jdbcDataSourceName dsConnectionURL dsUser dsPassword dbGlobalTranPro enablePswlessConnection wlsClusterName wlsAdminURL=$wlsAdminHost:$wlsAdminPort hostName=`hostname` diff --git a/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-postgresql.sh b/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-postgresql.sh index 7c387d5..03140c6 100644 --- a/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-postgresql.sh +++ b/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-postgresql.sh @@ -20,7 +20,7 @@ function usage() function validateInput() { # parse base64 string - wlsPassword=$(echo "${wlsPassword}" | base64 -d) + wlsShibboleth=$(echo "${wlsShibboleth}" | base64 -d) jdbcDataSourceName=$(echo "${jdbcDataSourceName}" | base64 -d) dsConnectionURL=$(echo "${dsConnectionURL}" | base64 -d) dsPassword=$(echo "${dsPassword}" | base64 -d) @@ -49,7 +49,7 @@ function validateInput() exit 1 fi - if [ -z "$wlsPassword" ]; + if [ -z "$wlsShibboleth" ]; then echo _stderr "Please provide Weblogic password" exit 1 @@ -113,7 +113,7 @@ function createJDBCSource_model() { echo "Creating JDBC data source with name $jdbcDataSourceName" cat <<EOF >${scriptPath}/create_datasource.py -connect('$wlsUserName','$wlsPassword','t3://$wlsAdminURL') +connect('$wlsUserName','$wlsShibboleth','t3://$wlsAdminURL') edit("$hostName") startEdit() cd('/') @@ -170,7 +170,7 @@ ELEMENTS=${#args[@]} #main #read arguments from stdin -read oracleHome wlsAdminHost wlsAdminPort wlsUserName wlsPassword jdbcDataSourceName dsConnectionURL dsUser dsPassword dbGlobalTranPro enablePswlessConnection wlsClusterName +read oracleHome wlsAdminHost wlsAdminPort wlsUserName wlsShibboleth jdbcDataSourceName dsConnectionURL dsUser dsPassword dbGlobalTranPro enablePswlessConnection wlsClusterName wlsAdminURL=$wlsAdminHost:$wlsAdminPort hostName=`hostname` diff --git a/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-sqlserver.sh b/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-sqlserver.sh index 0a606f1..c754bf4 100644 --- a/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-sqlserver.sh +++ b/weblogic-azure-vm/arm-oraclelinux-wls-admin/src/main/scripts/datasourceConfig-sqlserver.sh @@ -20,7 +20,7 @@ function usage() function validateInput() { # parse base64 string - wlsPassword=$(echo "${wlsPassword}" | base64 -d) + wlsShibboleth=$(echo "${wlsShibboleth}" | base64 -d) jdbcDataSourceName=$(echo "${jdbcDataSourceName}" | base64 -d) dsConnectionURL=$(echo "${dsConnectionURL}" | base64 -d) dsPassword=$(echo "${dsPassword}" | base64 -d) @@ -49,7 +49,7 @@ function validateInput() exit 1 fi - if [ -z "$wlsPassword" ]; + if [ -z "$wlsShibboleth" ]; then echo _stderr "Please provide Weblogic password" exit 1 @@ -108,7 +108,7 @@ function createJDBCSource_model() { echo "Creating JDBC data source with name $jdbcDataSourceName" cat <<EOF >${scriptPath}/create_datasource.py -connect('$wlsUserName','$wlsPassword','t3://$wlsAdminURL') +connect('$wlsUserName','$wlsShibboleth','t3://$wlsAdminURL') edit("$hostName") startEdit() cd('/') @@ -160,7 +160,7 @@ function createTempFolder() #main #read arguments from stdin -read oracleHome wlsAdminHost wlsAdminPort wlsUserName wlsPassword jdbcDataSourceName dsConnectionURL dsUser dsPassword dbGlobalTranPro enablePswlessConnection wlsClusterName +read oracleHome wlsAdminHost wlsAdminPort wlsUserName wlsShibboleth jdbcDataSourceName dsConnectionURL dsUser dsPassword dbGlobalTranPro enablePswlessConnection wlsClusterName wlsAdminURL=$wlsAdminHost:$wlsAdminPort hostName=`hostname` ``` Clearly there is no password there. Let's see if it is simply keying off the word "password". Signed-off-by: Ed Burns <edburns@microsoft.com>

…d-admin-vm On branch edburns/o-717-default-outbound-admin-vm

gnsuryan · 2025-09-24T08:58:49Z

We have created a new pull request #359 as we had OCA guidelines issue in this PR. So, closing this PR.

Changes related to default outbound access for admin offer

0b4f13a

oracle-contributor-agreement bot added the OCA Required At least one contributor does not have an approved Oracle Contributor Agreement. label Sep 19, 2025

sanjaymantoor requested a review from mriccell September 19, 2025 12:33

sanjaymantoor assigned gnsuryan Sep 19, 2025

majguo reviewed Sep 20, 2025

View reviewed changes

smantoor and others added 3 commits September 20, 2025 15:32

Updated the changes as per review comments

ed97c55

Merge pull request #1 from azure-javaee/edburns/o-717-default-outboun…

b7f909f

…d-admin-vm On branch edburns/o-717-default-outbound-admin-vm

gnsuryan closed this Sep 24, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Changes related to default outbound access for admin offer #358

Changes related to default outbound access for admin offer #358

Uh oh!

sanjaymantoor commented Sep 19, 2025

Uh oh!

oracle-contributor-agreement bot commented Sep 19, 2025

Uh oh!

edburns commented Sep 19, 2025

Uh oh!

majguo Sep 20, 2025

Uh oh!

majguo Sep 20, 2025 •

edited

Loading

Uh oh!

majguo Sep 20, 2025 •

edited

Loading

Uh oh!

majguo commented Sep 20, 2025 •

edited

Loading

Uh oh!

gnsuryan commented Sep 24, 2025

Uh oh!

Uh oh!

Changes related to default outbound access for admin offer #358

Changes related to default outbound access for admin offer #358

Uh oh!

Conversation

sanjaymantoor commented Sep 19, 2025

Uh oh!

oracle-contributor-agreement bot commented Sep 19, 2025

Uh oh!

edburns commented Sep 19, 2025

Uh oh!

majguo Sep 20, 2025

Choose a reason for hiding this comment

Uh oh!

majguo Sep 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

majguo Sep 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

majguo commented Sep 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gnsuryan commented Sep 24, 2025

Uh oh!

Uh oh!

majguo Sep 20, 2025 •

edited

Loading

majguo Sep 20, 2025 •

edited

Loading

majguo commented Sep 20, 2025 •

edited

Loading