In one of our Apex-like application user reported a HTTP 400 error after clicking on a button that invokes PL/SQL procedure. At first glance I suspected a missing execute privilege but the quick look at Oracle HTTP log revealed the true reason:
X:\ORACLE\OFM\OFM11\instances\instance1\diagnostics\logs\OHS\ohs1\ohs1.log)

[2016-05-04T10:58:23.9709+02:00] [OHS] [ERROR:32] [OHS-9999] [core.c] [host_id: ACMEHOST] [host_addr: 10.10.10.11] [pid: 5048] [tid: 1816] [user: SYSTEM] [VirtualHost: main]  MODPLSQL-00359: mod_plsql: /sales/!appschema.orderentry.program HTTP-400 Too many arguments passed in(2002). Limit is 2000, referer: http://ohs.acme.com/sales/!appschema.orderentry.program

-> HTTP-400 Too many arguments passed in(2002). Limit is 2000
.. so, the reason for the error is the default limit in mod_plsql on the number of parameters that can be passed to the pl/sql procedure.

A search on MOS confirmed by suspicion, please refer to:

Modplsql application throws “HTTP-400 Too many arguments passed in. Got 7076 parameters. Upper limit is 7000” (Doc ID 386946.1)

After adding directive “PlsqlMaxParameters 4000” to the plsql.conf and restarting the http listener (cmd> opmnctl restartproc process-type=OHS), the problem was solved.
Our plsql.conf looks like this:

X:\ORACLE\OFM\OFM11\instances\instance1\config\OHS\ohs1\moduleconf\plsql.conf

# ============================================================================ 
#                       mod_plsql configuration file                           
# ============================================================================ 
# 1. Please refer to plsql.README for a description of this file               
# 2. Parameters in this file have to be configured manually                    
# ============================================================================ 

# Configure Oracle HTTP Server to load mod_plsql
LoadModule plsql_module ${ORACLE_HOME}\ohs\modules\mod_plsql.dll

# Load in mod_plsql directives only if mod_plsql is loaded
<IfModule mod_plsql.c>

# ============================================================================ 
# Global Settings Section : Directives that apply to all DADs
# ============================================================================ 

PlsqlLogEnable on

PlsqlLogDirectory "${ORACLE_INSTANCE}\diagnostics\logs\${COMPONENT_TYPE}/${COMPONENT_NAME}"

# 4.5.2016 -- (see MOS ID 386946.1)

PlsqlMaxParameters 4000

# PlsqlIdleSessionCleanupInterval 15 (default)

# PlsqlDMSEnable On (default)

# ============================================================================ 
# Database Access Descriptors Settings Section
# ============================================================================ 
include "${ORACLE_INSTANCE}\config\${COMPONENT_TYPE}\${COMPONENT_NAME}\mod_plsql\dads.conf"

# Custom DAD's for Acme.com
include "${ORACLE_INSTANCE}\config\${COMPONENT_TYPE}\${COMPONENT_NAME}\mod_plsql\marvel.conf"

# ============================================================================ 
# Cache Settings Section
# ============================================================================ 
include "${ORACLE_INSTANCE}\config\${COMPONENT_TYPE}\${COMPONENT_NAME}\mod_plsql\cache.conf"

</IfModule>

We’re pleased that Oracle fixed the issue with the ODP.NET managed driver in the newly released ODAC 12c Release 4, that prevented us to use Oracle Wallet as a password store in the past. We have several .NET applications that’re read-only, intended to be used by multiply end users. Users don’t need personal database accounts. Instead, we want our application to read app-user credentials from Oracle Wallet.
Until ODAC 12c Release 4 we were unable to use ODP.NET managed driver with Oracle Wallet file method. The issue that we had was limited to the managed driver, unmanaged driver has no problem reading Oracle Wallet password store.
After we saw new feature announcement on page 3: Secure External Password Store SEPS….”ODP.NET, Managed Driver supports storing password credentials using SEPS.”, we decided to test this.

We created and configured Oracle Wallet:

cmd> mkstore -wrl D:\OW\ACME  -create
cmd> mkstore -wrl D:\OW\ACME -createCredential apptns appuser apppassword

Then we configured sqlnet.ora:

SQLNET.AUTHENTICATION_SERVICES = (NONE)
NAMES.DIRECTORY_PATH= (TNSNAMES)
WALLET_LOCATION = (SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=D:\OW\ACME)))
SQLNET.WALLET_OVERRIDE = TRUE

and tnsnames.ora:

APPTNS = 
  (DESCRIPTION = 
    (ADDRESS_LIST = 
       (ADDRESS = 
         (PROTOCOL = TCP)
         (HOST = acmedb.host.com)
         (PORT = 1521)
       )
    )
    (CONNECT_DATA =
       (SID = ACME)
    )
  )

Finally we tested the connection with:

sql> connect /@apptns
Connected.

So far, so good. Oracle Wallet is prepared to be used by .NET application with managed driver 12c Release 4.
We saved sqlnet.ora and tnsnames.ora in the same directory with Oracle Wallet files. Relevant part of the application config looked like this:

<oracle.manageddataaccess.client>
    <version number="*">
	  <settings> 
		<setting name="TNS_ADMIN" value="D:\OW\ACME"/>
                <setting name="TraceLevel" value="7" />
                <setting name="TraceOption" value="1"/> 
		<setting name="TraceFileLocation" value="D:\TRACE" />
	  </settings>
	</version>
  </oracle.manageddataaccess.client>

Just for the record, we could set everything (sqlnet.ora parameters + tns alias) in app.config as well:

  <oracle.manageddataaccess.client>
    <version number="*">
      <settings>
        <setting name="TraceLevel" value="7" />
        <setting name="TraceOption" value="1"/> 
        <setting name="TraceFileLocation" value="D:\TRACE" />
        <setting name="SQLNET.AUTHENTICATION_SERVICES" value="null" />
        <setting name="WALLET_LOCATION" value="(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=D:\OW\ACME)))" />
        <setting name="SQLNET.WALLET_OVERRIDE" value="TRUE" />
        <setting name="NAMES.DIRECTORY_PATH" value="(TNSNAMES)" />
      </settings>
      <dataSources>
        <dataSource alias="APPTNS" descriptor="APPTNS = (DESCRIPTION =(ADDRESS_LIST=(ADDRESS =(PROTOCOL = TCP)(HOST = acmedb.host.com)(PORT = 1521)))(CONNECT_DATA=(SID=ACME)))"/>
      </dataSources>
    </version>
  </oracle.manageddataaccess.client>

For the purpose of testing managed driver with Oracle Wallet, we wrote simple applet that takes Username, Password and TNS alias from the end user:

displays connection string:

and displays a message “Connection Opened!” if login was successful. But instead, we’re surprised by ORA-01017 error:

I will spare you with all the dirty details of troubleshooting that we went through, finally we decided to turn on sqlnet trace by adding three parameters to the app.config, namely; TraceLevel, TraceOption and TraceFileLocation (note that Oracle documentation at the time of this writing has a typo: TraceFileLocations. Note the “s”, this is wrong!).

And found this:

2015-11-25 13:08:47.270153 TID:3   (PRI) (CP) OracleConnectionImpl.Connect() OracleConnectionImpl.Connect => Querying Data Source:APPTNS
2015-11-25 13:08:47.291153 TID:3   (NET) (SQLNET) SEPS userid is null.
2015-11-25 13:08:47.291153 TID:3   (NET) (SQLNET) SEPS password is null.

What the hack? We have APPTNS in our Oracle Wallet. Or do we?

cmd> mkstore -wrl D:\OW\ACME -listCredential
Oracle Secret Store Tool : Version 12.1.0.2
Copyright (c) 2004, 2014, Oracle and/or its affiliates. All rights reserved.

Enter wallet password:
List credential (index: connect_string username)
1: apptns appuser

Is it possible that managed driver is handling tns alias in case sensitive manner? Bingo.
Even thought it doesn’t matter how you connect with the sqlplus, like:

sqlplus /@APPTNS
sqlplus /@apptns
sqlplus /@Apptns
...

in all three cases login will succeed. Not so with ODP.NET managed driver. You have to specify tns alias precisely with the properly cased string,
as it was used while adding credential to the Oracle Wallet. Is it a bug or a feature? I guess both.

Also, be careful how you compile, if your target is 64 bit OS, then use x86 or AnyCPU as a target. We were out of luck trying to compile for x64 target, meaning that application must run as a 32-bit process, even on 64-bit OS, otherwise Oracle Wallet won’t work.

We’re in the middle of replacing an old Fujitsu server running Windows 2003 R2, that was reliably humming for the last 6+ years, with the new one, running Windows 2012R2. One of the things that we decided to install on new server is Oracle Http Server 12c (12.1.0.3). Based on my previous experience, I knew I’ll have to deal with the crappy Oracle distribution of Apache Http server again. The only question was, is it possible to pack and distribute Apache Httpd in creepier form than before (11g), is it possible to surpass end user experience and joy installing and configuring Standalone Oracle Http Server 12c (12.1.0.3). Oracle, again, didn’t disappoint us ;-(. Let’s begin…

Download Oracle Http Server 12c (12.1.0.3) from edelivery.oracle.com:

->"Oracle Fusion Middleware" 
->-> "Microsoft Windows x64 (64-bit)" 
->->-> "Oracle Fusion Middleware 12c Media Pack" 
->->->-> "Oracle Fusion Middleware 12c (12.1.3.0.0) HTTP Server for Microsoft Windows x64 (64-bit)" -- Part Number: V45207-01, 471MB

Unpack zip file and begin installation by running setup_fmw_12.1.3.0.0_ohs_win64.exe. Fortunately, Oracle Http Server 12.1.0.3 is certified on Windows 2012 R2, so you should be fine…here’re the screenshots from our installation:

As you can see on the last screen, we’re not finished, we need to use Configuration wizard to create a “domain” and then start “Node Manager” and “Domain server”… — WTF — why we need to know anything about Weblogic Node Manager, Domain Servers, and other “weblogic parlance”…?? Oracle architects and developers, you should KISS more! ;-). Don’t forget, we’re talking about standalone Oracle Http Server which is not much more than minuscule Apache Httpd with some small proprietary code (mod_plsql…). Anyway, let’s continue…

Start configuration wizard (in our case it was located here: C:\ORACLE\OFM\OFM12\oracle_common\common\bin\config.cmd) and configure Oracle Http server in standalone mode…as you can see we left more or less everything at default:

The fun is not over yet. Your journey to the wonderland of Oracle Http server just started. If you check “Services”, you’ll (of course) find nothing, because Oracle didn’t bother to do this during configuration, it’s up to you to create service for Node Manager.

Steps for creating Windows Service for Node Manager:

Note that we installed Oracle  HttpServer 12c in ORACLE_HOME: C:\ORACLE\OFM.

1) Open command prompt (cmd) wit "Run as Administrator"

set DOMAIN_HOME_BIN=C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\bin
set PATH=%DOMAIN_HOME_BIN%;%PATH%

installNodeMgrSvc.cmd

And if everything has gone well you should see a new service named the
Oracle way, like this:

"Oracle Weblogic base_domain NodeManager (C_ORACLE_OFM_OFM12_wlserver)"

with path to executable like this:

C:\ORACLE\OFM\OFM12\wlserver\server\bin\wlsvcX64.exe

The service is installed using the default Node Manager listen port (5556).
By default Node Manager Listens only on localhost.

If you’re not yet familiar with OracleHttp server you might think that starting Node manager will also start Oracle Http server you created previously – remember, after all, our main goal from the start is to run Http server. But no, Oracle product managers believes that you need to suffer a bit more….

You can START Oracle HttpServer 12c on command line with:

set DOMAIN_HOME_BIN=C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\bin
set PATH=%DOMAIN_HOME_BIN%;%PATH%
startComponent ohs1

You’ll be asked to enter password for the Node Manager which you entered on screen 6 of Oracle Fusion Middleware Configuration Wizard.

You can STOP Oracle HttpServer 12c on command line with:

set DOMAIN_HOME_BIN=C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\bin
set PATH=%DOMAIN_HOME_BIN%;%PATH%
stopComponent ohs1

If you want to avoid entering password each time you start OHS, you can ask Oracle to save the password in local encrypted file with parameter storeUserConfig:

set DOMAIN_HOME_BIN=C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\bin
set PATH=%DOMAIN_HOME_BIN%;%PATH%
startComponent.cmd ohs1 storeUserConfig

Creating the key file can reduce the security of your system if it is not kept in a secured location after it is created. Creating new key...
The username and password that were used for this WebLogic NodeManager connection are stored in C:\Users\alesk.ACME\.wlst\nm-cfg-base_domain.props and C:\Users\alesk.ACME\.wlst\nm-key-base_domain.props.
Connecting to Node Manager ...
Successfully Connected to Node Manager.
Starting server ohs1 ...
Successfully started server ohs1 ...
Successfully disconnected from Node Manager.

What if you want to change username and password that is used to authenticate to Node Manager which we entered in step 6 of Configuration Wizard?
Checkout MOS note 1945039.1 “How to Change the Node Manager Username and Password for Oracle HTTP Server 12c in a Standalone Domain”

Basically what we did was:

1) Stop Http Server and Node Manager

C:\ORACLE\OFM\OFM12\oracle_common\common\bin>stopComponent ohs1

Open cmd with "Run as Administrator" and stop NodeManager service:

net stop "Oracle Weblogic base_domain NodeManager (C_ORACLE_OFM_OFM12_wlserver)"

2) Invoke WLST offline:

C:\ORACLE\OFM\OFM12\oracle_common\common\bin>wlst.cmd

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

wls:/offline>

3) Read in the domain (make sure you type / and not \ in the path!!)

wls:/offline> readDomain('C:/ORACLE/OFM/OFM12/user_projects/domains/base_domain')

4) Get the security MBean (Mr. Bean?):

wls:/offline/ohs_domain> cd('/SecurityConfiguration/base_domain')

5. We changed the NM user name, but you can skip this, if you only want to change the password:

wls:/offline/base_domain/SecurityConfiguration/base_domain>set('NodeManagerUsername','<new_NM_Username>')

...and my command was:

wls:/offline/base_domain/SecurityConfiguration/base_domain>set('NodeManagerUsername','weblogic')

6. We also changed NM password. In our case the encrypted password was stored in 
   C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\config\nodemanager\nm_password.properties.

wls:/offline/base_domain/SecurityConfiguration/base_domain>set('NodeManagerPasswordEncrypted','oursecretpassword')
wls:/offline/base_domain/SecurityConfiguration/base_domain>updateDomain()
wls:/offline/base_domain/SecurityConfiguration/base_domain>closeDomain()
wls:/offline/base_domain/SecurityConfiguration/base_domain>exit()

7. Start Node Manager Service

net start "Oracle Weblogic base_domain NodeManager (C_ORACLE_OFM_OFM12_wlserver)"

8. Start OHS

C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\bin> startComponent ohs1

If you already stored your password in a key store you have to delete cached key store file
(check your user profile directory) before restarting OHS component! 

And finally, let’s see where’re the config files for httpd and mod_plsql. According to Oracle Http 12c documentation there’re runtime and staging config files and we should always edit staging config files.
In our example the config file locations are (note that marvel.conf was created by us):

Domain home bin        : C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\bin
httpd.conf             : C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\config\fmwconfig\components\OHS\ohs1 
marvel.conf (mod_plsql): C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\config\fmwconfig\components\OHS\ohs1\mod_plsql\marvel.conf
include for marvel.conf: C:\ORACLE\OFM\OFM12\user_projects\domains\base_domain\config\fmwconfig\components\OHS\ohs1\moduleconf\plsql.conf

There is also a WLST tool (wlst.cmd) that allow us to manipulate with running OHS. Let’s see…

Using WLST to control OHS:

Open WLST C:\ORACLE\OFM\OFM12\oracle_common\common\bin\wlst.cmd:

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

wls:/offline> nmConnect('weblogic','mysecretpassword','localhost','5556','base_domain','C:/ORACLE/OFM/OFM12/user_projects/domains/base_domain','ssl')

// status
wls:/nm/base_domain> nmServerStatus(serverName='ohs1', serverType='OHS')

RUNNING

// soft restart
wls:/nm/base_domain> nmSoftRestart(serverName='ohs1', serverType='OHS')

// stop OHS
wls:/nm/base_domain> nmKill(serverName='ohs1', serverType='OHS')
Killing server ohs1 ...
Successfully killed server ohs1

// status
wls:/nm/base_domain> nmServerStatus(serverName='ohs1', serverType='OHS')

SHUTDOWN

// start
wls:/nm/base_domain> nmStart(serverName='ohs1', serverType='OHS')

** Edit March 2017 **
I needed a user friendly cli interface for controlling the OHS via “wlst.cmd” scripting environment for my client the other day and since wlst is controlled by Jython it was trivial to write simple python script that offers menu for basic actions, like start, stop and status.

# controlOHS.py
# Usage:
# C:\ORACLE\OFM\OFM12\oracle_common\common\bin\wlst.cmd  controlOHS.py
#
pwd = None
nmConnect('administrator',pwd,'localhost','5556','base_domain','C:/ORACLE/OFM/OFM12/user_projects/domains/base_domain','ssl')

def menu():
   print("")
   print("Available commands:")
   print("==========================================")
   print("1) softRestart     ....soft restart of OHS")
   print("2) stopOHS         ....stop OHS server")
   print("3) startOHS        ....start OHS server")
   print("4) statusOHS       ....status of OHS server")
   print("5) help            ....print this help")
   print("6) Exit            ....exit")
   print("==========================================")
   print("")

def softRestart():
   print("Soft restart...")
   nmSoftRestart(serverName='ohs1', serverType='OHS')

def stopOHS():
   print("Stop OHS....")
   nmKill(serverName='ohs1', serverType='OHS')
 
def startOHS():
   print("Start OHS...")
   nmStart(serverName='ohs1', serverType='OHS')
   
def statusOHS():
   print("Status...")
   nmServerStatus(serverName='ohs1', serverType='OHS')

while 1:  # endless loop
   menu()
   command = raw_input("Command [1..6]: ")
   
   if command == "1":
	  softRestart()
   elif command == "2":
	  stopOHS()
   elif command == "3":
	  startOHS()
   elif command == "4":
      statusOHS()
   elif command == "5":
	  menu()
   elif command == "6":
	  break
   else:
      print("Invalid choice!")
	   
   raw_input("Press Enter to continue...")