15 Integrating an Enterprise Deployment with Oracle Identity Management

15.2.2.1 Provisioning Admin Users and Groups in an LDAP Directory

As mentioned in the introduction to this section, users and groups from multiple WebLogic domains may be provisioned in a central LDAP user store. In such a case, there is a possibility that one WebLogic admin user may have access to all the domains within an enterprise. Oracle does not recommend this. To avoid one WebLogic admin user having access to all the domains, the users and groups provisioned must have a unique distinguished name within the directory tree. For the WebCenter Portal enterprise deployment WebLogic domain described in this guide, the admin user and group are provisioned with the DNs below:

• Admin User DN:

  cn=weblogic_wc,cn=Users,dc=us,dc=mycompany,dc=com
  

• Admin Group DN:

  cn=WC_Administrators,cn=Groups,dc=us,dc=mycompany,dc=com
  

To provision the admin user and admin group in Oracle Internet Directory:

1. Create an ldif file on the Oracle Internet Directory host named admin_user.ldif with the contents shown below, and then save the file:

   dn: cn=weblogic_wc, cn=Users, dc=us, dc=mycompany, dc=com
   orclsamaccountname: weblogic_wc
   givenname: weblogic_wc
   sn: weblogic_wc
   userpassword: MyPassword1
   mail: weblogic_wc
   objectclass: top
   objectclass: person
   objectclass: organizationalPerson
   objectclass: inetorgperson
   objectclass: orcluser
   objectclass: orcluserV2
   uid: weblogic_wc
   cn: weblogic_wc
   description: Admin User for the WebCenter Portal Domain
   

2. Run the ldapadd command located under the ORACLE_HOME/bin directory to provision the user in Oracle Internet Directory.

   Note:

   The Oracle home used here is the Oracle home for the Identity Management installation where Oracle Internet Directory resides. The ORACLE_HOME environment variable must be set for the ldapadd command to succeed.

   For example (the command is shown as two lines in the example below for readability purposes, but you should enter the command on a single line):

   OIDHOST1> ORACLE_HOME/bin/ldapadd -h oid.mycompany.com -p 389 -D
   cn="orcladmin" -w welcome1 -c -v -f admin_user.ldif
   

3. Create an ldif file named admin_group.ldif with the contents shown below and then save the file:

   dn: cn=WC_Administrators, cn=Groups, dc=us, dc=mycompany, dc=com
   displayname: WC_Administrators
   objectclass: top
   objectclass: groupOfUniqueNames
   objectclass: orclGroup
   uniquemember: cn=weblogic_wc,cn=users,dc=us,dc=mycompany,dc=com
   cn: WC_Administrators
   description: Administrators Group for the WebCenter Portal Domain
   

4. Run the ldapadd command located under the ORACLE_HOME/bin/ directory to provision the group in Oracle Internet Directory (the command is shown as two lines in the example below for readability purposes, but you should enter the command on a single line):

   OIDHOST1> ORACLE_HOME/bin/ldapadd -h oid.mycompany.com -p 389 -D
   cn="orcladmin" -w welcome1 -c -v -f admin_group.ldif
   

15.2.2.2 Assigning the Admin Role to the Admin Group

After adding the users and groups to Oracle Internet Directory, the group must be assigned the Admin role within the WebLogic domain security realm. This enables all users that belong to the group to be administrators for that domain.

To assign the Admin role to the Admin group:

1. Log into the WebLogic Server Administration Console.

2. In the left pane of the console, click Security Realms.

3. On the Summary of Security Realms page, click myrealm under the Realms table.

4. On the Settings page for myrealm, click the Roles & Policies tab.

5. On the Realm Roles page, expand the Global Roles entry under the Roles table. This brings up the entry for Roles. Click on the Roles link to bring up the Global Roles page.

6. On the Global Roles page, click the Admin role to bring up the Edit Global Role page:

   1. On the Edit Global Roles page, under the Role Conditions table, click the Add Conditions button.

   2. On the Choose a Predicate page, select Group from the drop down list for predicates and click Next.

   3. On the Edit Arguments Page, specify WC_Administrators in the Group Argument field and click Add.

7. Click Finish to return to the Edit Global Role page.

8. The Role Conditions table now shows the WC_Administrators Group as an entry.

9. Click Save to finish adding the Admin Role to the WC_Administrators Group.

10. Validate that the changes were successful by bringing up the WebLogic Administration Server Console using a web browser. Log in using the credentials for the weblogic_wc user.

    Note:

    Each Oracle application in the Oracle WebCenter Portal enterprise deployment topology may have has its own predefined roles and groups defined for administration and monitoring. By default, the Administrator group allows these operations. However, the Administrator group may be too broad. For example, you may not want Oracle SOA Suite administrators to be WebLogic Server domain administrators where Oracle SOA Suite, Oracle WebCenter Portal, and Oracle WebCenter Content are running. Therefore, as described in this section, you may wish to create a more specific group for WebCenter Portal, such as WC_Administrators. For the various applications to allow the WC Administrator group to administer the different systems, you must add the required roles to that group. For example, for SOA Worklistapp administration, add the SOAAdmin role to the SOA Administrators group. Refer to each component's specific roles for the required roles in each case.

15.2.2.3 Specifying the New Admin User on Connections

Now that a new administrative user weblogic_wc exists in LDAP, this user should be used for all administrative operations.

For example, review the discussions server connection you created in Section 12.2, "Configuring the Discussions Server Connection", and specify weblogic_wc as the admin user. Also ensure this user has administrator permissions on the discussions server, as described in Section 15.7.3.1, "Granting Administrator Permissions on the Discussions Server".

15.2.2.4 Updating the boot.properties File and Restarting the System

The boot.properties file for the Administration Server should be updated with the WebLogic admin user created in Oracle Internet Directory. Follow the steps below to update the boot.properties file:

1. On SOAHOST1, go the following directory:

   cd ORACLE_BASE/admin/domainName/aserver/domainName/servers/
   AdminServer/security
   

2. Rename the existing boot.properties file:

   mv boot.properties boot.properties.backup
   

3. Use a text editor to create a file called boot.properties under the security directory. Enter the following lines in the file:

   username=weblogic_wc
   password=MyPassword1
   

4. Save the file.

5. Stop the Administration Server:

   wls:/nm/domain_name>nmKill("AdminServer")
   

6. Restart the Administration Server using the procedure in Section 8.4.3, "Starting the Administration Server on SOAHOST1."

15.5.3.1 Prerequisites for Running the OAM Configuration Tool

Review the following prerequisites before running the OAM Configuration Tool:

• Password: Create a secure password. This will be used as the password for the WebGate installation created later.

• LDAP Host: Have the host name of the Directory Server or Load Balancer address available in the case of a high availability or enterprise deployment configuration.

• LDAP Port: Have the port of the Directory Server available.

• LDAP USER DN: Have the DN of the LDAP admin user available. This is a value such as "cn=orcladmin."

• LDAP password: Have the password of the LDAP admin user available.

• oam_aa_host: Have the host name of an Oracle Access Manager available.

• oam_aa_port: Have the port of the Oracle Access Manager available.

15.5.3.2 Running the OAM Configuration Tool

You can find the OAM Configuration Tool at the following location:

ORACLE_COMMON_HOME/modules/oracle.oamprovider_11.1.1

ORACLE_COMMON_HOME depends on the machine on which you are running the configuration tool. The tool can be run from any machine with the required installation files. The procedure described in this section runs the tool from WCPHOST1.

The OAM Configuration Tool provides a way to register protected and public resources into the OAM system. Example 15-1 and Example 15-2 list protected and public resources to be added to the OAM system:

• Example 15-1 applies if WebCenter Portal, WebCenter Content, Inbound Refinery, and SOA are installed in your domain:

• Example 15-2 applies if WebCenter Portal, WebCenter Content, and Inbound Refinery are installed in your domain

#########################################
#Product Name: Oracle WebCenter Portal
#########################################
#########################################
protected_uris
#########################################
/webcenter/adfAuthentication
/integration/worklistapp
/workflow/sdpmessagingsca-ui-worklist/faces/adf.task-flow
/workflow/WebCenterWorklistDetail/faces/adf.task-flow
/workflow/sdpmessagingsca-ui-worklist
/rss/rssservlet
/owc_discussions/login!withRedirect.jspa
/owc_discussions/login!default.jspa
/owc_discussions/login.jspa
/owc_discussions/admin
/rest/api/resourceIndex
/rest/api/spaces
/rest/api/discussions
/rest/api/tags
/rest/api/taggeditems
/rest/api/activities
/rest/api/activitygraph
/rest/api/feedback
/rest/api/people
/rest/api/messageBoards
/rest/api/searchresults
/activitygraph-engines
/wcps/api
/pagelets/admin
/pagelets/authenticateWithApplicationServer
/services-producer/adfAuthentication
/rsscrawl
/sesUserAuth
/services-producer/portlets
/wsrp-tools/portlets
/em
/console
/DefaultToDoTaskFlow
/sdpmessaging/userprefs-ui
/adfAuthentication
/ibr/adfAuthentication
/soa-infra
/soa/composer
/soa-infra/deployer
/soa-infra/events/edn-db-log
/soa-infra/cluster/info
/inspection.wsil
#########################################
public_uris
#########################################
/webcenter
/owc_discussions
/rss
/workflow
/rest/api/cmis
/pagelets
/services-producer
/wsrp-tools
/cs
/ibr
/idcnativews
/
/soa-infra/services/…/*
/soa-infra/directWSDL
/soa-infra/directWSDL/…/*
/ucs/messaging/webservice
/ucs/messaging/webservice/…/*

#########################################
#Product Name: Oracle WebCenter Portal
#########################################
#########################################
protected_uris
#########################################
/webcenter/adfAuthentication
/integration/worklistapp
/workflow/sdpmessagingsca-ui-worklist/faces/adf.task-flow
/workflow/WebCenterWorklistDetail/faces/adf.task-flow
/workflow/sdpmessagingsca-ui-worklist
/soa-infra
/rss/rssservlet
/owc_discussion/login!withRedirect.jspa
/owc_discussions/login!default.jspa
/owc_discussions/login.jspa
/owc_discussions/admin
/rest/api/resourceIndex
/rest/api/spaces
/rest/api/discussions
/rest/api/tags
/rest/api/taggeditems
/rest/api/activities
/rest/api/activitygraph
/rest/api/feedback
/rest/api/people
/rest/api/messageBoards
/rest/api/searchresults
/activitygraph-engines
/wcps/api
/pagelets/admin
/pagelets/authenticateWithApplicationServer
/services-producer/adfAuthentication
/rsscrawl
/sesUserAuth
/services-producer/portlets
/wsrp-tools/portlets
/em
/console
/adfAuthentication
/ibr/adfAuthentication

#########################################
public_uris
#########################################

/webcenter
/owc_discussions
/rss
/rest/api/cmis
/pagelets
/services-producer
/wsrp-tools
/workflow
/cs
/ibr
/idcnativews

To run the OAM Configuration Tool:

1. Depending on your topology, use either Example 15-1 or Example 15-2 to create a file containing the list of URIs you want to protect and those that are public:

   • Use Example 15-1 if WebCenter Portal, WebCenter Content, Inbound Refinery, and SOA are installed in your domain:

   • Use Example 15-2 if WebCenter Portal, WebCenter Content, and Inbound Refinery are installed in your domain

   In OAM 10g all resources under a URL prefix are protected by the default rules of a policy domain unless more specific rules are applied to them through policies. Refer to the 10g version of the Oracle Access Manager Access Administration Guide for details on the different patterns that can be used if more specialized protection patterns need to be used.

2. Run the OAM Configuration Tool for OAM 10g registration on a single command line, using the following command:

   MW_HOME/jrockit_160_<version>/bin/java -jar oamcfgtool.jar mode=CREATE
   app_domain="WebCenter_EDG"
   uris_file="full_path_to_file_containing_uri_definitions"
   app_agent_password=<Password_to_be_provisioned_for_App_Agent>
   ldap_host=OID.MYCOMPANY.COM
   ldap_port=389
   ldap_userdn="cn=orcladmin"
   ldap_userpassword=<Password_of_LDAP_Admin_User>
   oam_aaa_host=OAMHOST1
   oam_aaa_port=OAMPORT1
   

3. Validate that the command ran successfully. You should see the following output:

   Processed input parameters
   Initialized Global Configuration
   Successfully completed the Create operation
   Operation Summary:
   Policy Domain: WebCenter_EDG
   Host Identifier: WebCenter_EDG
   Access Gate ID: WebCenter_EDG_AG
   

15.5.3.3 Updating the REST Policies

To update the REST end points to use basic authentication:

1. Log in to the Oracle Access Manager console at:

   http://OAM_HOST:OAM_ADMINSERVER_PORT/oamconsole
   

2. Click Policy Manager and then My Policy Domains to locate the policy domain that you created and verified in the previous steps.

   You should see two policies already created Protected_JSessionId_Policy and Default Public Policy.

3. Open the Policies tab.

4. Create another policy called WebCenterRESTPolicy, using the values shown below:

   Description: This policy protects REST protected URIs using BASIC authentication scheme required for functioning with the WebCenter Outlook plug-in or iPhone integration.

   Resource Type: http

   Operation(s): GET,POST

   Resource: Select all resources starting with /rest except for /rest/cmis/repository.

   /rest/api/resourceIndex
   /rest/api/spaces
   /rest/api/discussions
   /rest/api/tags
   /rest/api/taggeditems
   /rest/api/activities
   /rest/api/activitygraph
   /rest/api/feedback
   /rest/api/people
   /rest/api/messageBoards
   /rest/api/searchresults
   

   Host Identifier: Same as the one used for the resources.

5. Click Save.

6. In the newly created policy, navigate to Authentication Rule and add a new rule using the authentication scheme OraDefaultBasicAuthNScheme.

7. Open the Policies tab and make sure that the polices are in the order shown below:

   WebCenterRESTPolicy

   Protected_JSessionId_Policy

   Default Public Policy

15.5.3.4 Creating an Exclusion Policy for Oracle SES and Portlets

To create an exclusion policy for Oracle SES (Secure Enterprise Search) and portlets:

1. Log in to the Oracle Access Manager console at:

   http://OAM_HOST:OAM_ADMINSERVER_PORT/oamconsole
   

2. Check that OraDefaultExclusionAuthNScheme is available in your OAM 10g installation. If it does not exist, create the OraDefaultExclusionAuthNScheme as shown below:

   1. Click Authentication Management.

   2. Click Add.

   3. Specify OraDefaultExclusionAuthNScheme in the Name field.

   4. Enter To exclude resources from being protected by OAM in the Description field.

   5. Enter 0 in the Level field.

   6. Specify None in the Challenge Method field.

   7. Add unprotected:true to the Challenge Parameter field.

   8. Click Save.

   9. Open the Plugins tab for this authentication scheme and click Modify.

   10. Select credential_mapping from the drop down list.

   11. Specify a value as:

       obMappingBase="dc=us,dc=oracle,dc=com",obMappingFilter="(uid=OblixAnonymous)"

       Make sure that this value matches the corresponding field for the OraDefaultAnonAuthNScheme.

   12. Click Save.

   13. Open the General tab again and click Modify.

   14. Check Yes for Enabled.

   15. Click Save.

3. Create a new policy called Exclusion Scheme:

   1. Click Policy Manager and then My Policy Domains to locate the policy domain that you created and verified in the previous steps.

      You should see three policies WebCenterRESTPolicy, Protected_JSessionId_Policy and Default Public Policy.

   2. Open the Policies tab.

   3. Create a new policy called Exclusion Scheme, using the values shown below:

      Description: This policy excludes SES and portlet end points.

      Resource Type: http

      Operation(s): GET,POST

      Resource: Select the following resources:

      /rsscrawl
      /sesUserAuth
      /services-producer/portlets
      /wsrp-tools/portlets
      
      

      Host Identifier: Same as the one used for the resources.

   4. Click Save.

   5. In the newly created policy, navigate to Authentication Rule and add a new rule using the authentication scheme OraDefaultExclusionAuthNScheme.

   6. Click Save.

4. Open the Policies tab and make sure that the polices are in the order shown below:

   WebCenterRESTPolicy

   Exclusion Scheme

   Protected_JSessionId_Policy

   Default Public Policy

15.5.3.5 Verifying Successful Creation of the Policy Domain and AccessGate

There are two parts to the procedure for verifying creation of the policy domain and the AccessGate.

To verify the policy domain:

1. Log on to the Access System Console using the following URL:

   http://OAMADMINHOST:port/access/oblix
   

2. Click Policy Manager.

3. Click the My Policy Domains link on the left panel.

   A list of all policy domains appears. The domain you just created will be listed there. It will have the suffix _PD (for example, WebCenter_EDG_PD). In the third column URL prefixes, the URIs you specified during the creation of this domain appear.

4. Click the link to the policy domain you just created.

   This link takes you to the General area of this domain.

5. Click the Resources tab.

   The URIs you specified appear. You can also click other tabs to view other settings.

To verify the AccessGate configuration:

1. Click the Access System Console link on the top right hand side.

   This acts like a toggle; after you click it, it becomes the Policy Manager link.

2. Click the Access System Configuration tab.

3. Click the AccessGate Configuration link on the left panel.

4. Enter WebCenter_EDG as the search criterion (or any other substring you may have used as the app_domain name in Section 15.5.3.2, "Running the OAM Configuration Tool"), and click Go.

5. Once the AccessGate for the domain you just created appears (this will have the suffix _AG (for example, WebCenter_EDG_AG), click it, and the details of the AccessGate which you just created appear.

15.5.3.6 Updating the Host Identifier

The OAM Configuration Tool uses the value of the app_domain parameter (for example, WebCenter_EDG) to create a host identifier for the policy domain. This host identifier must be updated with all the host name variations for the host so that the configuration works correctly. Follow the steps below to update the host identifier created by the OAM Configuration Tool:

1. Log in to the Access System Console using the following URL:

   http://host_name:port/access/oblix
   

   Where host_name refers to the host where WebPass Oracle HTTP Server instance is running and port refers to the HTTP port of the Oracle HTTP Server instance.

2. When prompted for a username and password, log in as an administrator. Click OK.

3. On the Access System main page, click the Access System Console link.

4. On the Access System Console page, click the Access System Configuration tab.

5. On the Access System Configuration page, click Host Identifiers at the bottom left.

6. On the List all host identifiers page, click on the host identifier created by the OAM Configuration Tool. For example, select WebCenter_EDG.

7. On the Host Identifier Details page, click Modify.

8. Add the Preferred HTTP Host value used in the Access System Configuration. The following is a list of all the possible host name variations using SSO/WebGate:

   • webhost1.mydomain.com:7777

   • webhost2.mydomain.com:7777

   • wcphost1.mycompany.com:9000

   • wcphost2.mycompany.com:9000

   • wcphost1.mycompany.com:9001

   • wcphost2.mycompany.com:9001

   • wcphost1.mycompany.com:9002

   • wcphost2.mycompany.com:9002

   • wcphost1.mycompany.com:9003

   • wcphost2.mycompany.com:9003

   • admin.mycompany.com:80

   • adminvhn.mycompany.com:7001

   • soahost1vhn1.mycompany.com:8001

   • soahost2vhn1.mycompany.com:8001

   • soahost1vhn1.mycompany.com:8010

   • soahost2vhn1.mycompany.com:8010

9. Select the check box next to Update Cache and then click Save.

   A message box with the following message is displayed: "Updating the cache at this point will flush all the caches in the system. Are you sure?".

   Click OK to finish saving the configuration changes.

10. Verify the changes on the Host Identifier Details page.

15.5.3.7 Updating the WebGate Profile

The OAM Configuration Tool populates the Preferred_HTTP_Host and hostname attributes for the WebGate profile that is created with the value of the app_domain parameter. Both these attributes must be updated with the proper values for the configuration to work correctly. Follow the steps below to update the WebGate profile created by the OAM CFG Tool.

1. Log in to the Access System Console using the following URL:

   http://host_name:port/access/oblix
   

   where host_name refers to the host where WebPass Oracle HTTP Server instance is running and port refers to the HTTP port of the Oracle HTTP Server instance.

2. On the Access System main page, click the Access System Console link, then log in as an administrator.

3. On the Access System Console main page, click Access System Configuration, and then click the Access Gate Configuration link on the left pane to display the AccessGates Search page.

4. Enter the proper search criteria and click Go to display a list of AccessGates.

5. Select the AccessGate created by the OAM Configuration Tool. For example: WebCenter_EDG_AG).

6. On the AccessGate Details page, select Modify to display the Modify AccessGate page.

7. On the Modify AccessGate page, update:

   • Hostname: Update the hostname with the name of the computer where WebGate is running, for example: webhost1.mycompany.com.

   • Preferred HTTP Host: Update the Preferred_HTTP_Host with one of the hostname variations specified in the previous section, for example: admin.mycompany.com:80.

   • Primary HTTP Cookie Domain: Update the Primary HTTP Cookie Domain with the Domain suffix of the host identifier, for example: mycompany.com

8. Click Save. A message box with the "Are you sure you want to commit these changes?" message is displayed.

9. Click OK to finish updating the configuration.

10. Verify the values displayed on the Details for AccessGate page to confirm that the updates were successful.

15.5.3.8 Adding Additional Access Servers

To assign an Access Server to the WebGate:

1. Log in as the Administrator to Oracle Access Manager using the following URL:

   http://OAMADMINHOST:port/access/oblix
   

   where OAMADMINHOST refers to the host where WebPass Oracle HTTP Server instance is running and port refers to the HTTP port of the Oracle HTTP Server instance.

2. Navigate to the Details for AccessGate page, if necessary. From the Access System Console, select Access System Configuration, then AccessGate Configuration, then the link for the WebGate (WebCenter_EDG_AG).

3. On the Details for AccessGate page, click List Access Servers.

4. A page appears showing the primary or secondary Access Servers currently configured for this WebGate.

   Click Add.

5. On the Add a New Access Server page, select an Access Server from the Select Server list, specify Primary Server, and increase the Number of Connections for the WebGate. For example, increment the number of connections from 1 to 2.

   Click the Add button to complete the association.

6. A page appears, showing the association of the Access Server with the WebGate. Click the link to display a summary and print this page for later use.

7. Repeat steps 3 through 6 to associate all the Access Servers you have defined to the WebGate.

15.5.3.9 Configuring Delegated Form Authentication

To configure the form authentication to redirect to the WebGate that was installed with the OAM installation:

1. Open the Access System Console.

2. In the Access System Configuration screen, select Authentication Management from the left-hand bar.

3. Select OraDefaultFormAuthNScheme.

4. Click Modify.

5. In the Challenge Redirect field, enter the host and port of the Oracle HTTP Server for the IDM installation; for example: http://sso.mycompany.com:7777.

A WebGate should already be installed in the IDM installation. Refer to, "Installing and Configuring WebGate" in the Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management for details.

15.5.6.1 Back Up Configuration Files

To be safe, first back up the relevant configuration files (stored under WebCenter Portal's Administration Server directory):

ORACLE_BASE/admin/domain_name/aserver/domain_name/config/config.xml
ORACLE_BASE/admin/domain_name/aserver/domain_name/config/fmwconfig/jps-config.xml
ORACLE_BASE/admin/domain_name/aserver/domain_name/config/fmwconfig/system-jazn-data.xml

Also back up the boot.properties file for the Administration Server.

15.5.6.2 Setting Up the OAM ID Asserter

Set up the OAM ID Asserter using the WebLogic Server Administration Console.

To set up the OAM ID Asserter:

1. Log in as an administrator to WebLogic Server Administration Console.

2. Navigate to the following location:

   SecurityRealms\Default_Realm_Name\Providers
   

3. Click New and Select OAM Identity Asserter from the dropdown menu.

4. Name the asserter (for example, OAM ID Asserter) and click Save.

5. Click the newly added asserter to see the configuration screen for OAM Identity Asserter.

6. Set the control flag to REQUIRED and click Save.

7. Check that OAM_REMOTE_USER and ObSSOCookie is set for Chosen Types.

8. Save the settings.

15.5.6.3 Setting the Order of Providers

To set the order of the providers:

1. Log in as an administrator to Oracle WebLogic Server Administration Console.

2. Click Lock & Edit.

3. Navigate to SecurityRealms >Default realm name > Providers and then click Reorder.

4. Reorder the OAM Identity Asserter, OID/OVD Authenticator, and Default Authenticator by ensuring that the control flag for each authenticator is set as follows:

   • OAM Identity Asserter: REQUIRED

   • OID LDAP Authenticator (or OVD LDAP Authenticator): SUFFICIENT

   • Default Authenticator: SUFFICIENT

5. Click OK.

6. Click Activate Changes to propagate the changes.

7. Restart the Administration Server and all managed servers.

15.6.3.1 Installing GCC Libraries

Before installing WebGate, download and install third-party GCC libraries on your machine. You can download the appropriate GCC library from the following third-party Web site:

http://gcc.gnu.org/

For Linux 32-bit the required libraries are libgcc_s.so.1 and libstdc++.so.5 version 3.3.2. Table 15-3 lists the versions of GCC third-party libraries for Linux and Solaris.

15.6.3.2 Installing WebGate

This section describes the procedures for installing WebGate.

The Installer program for Oracle HTTP Server 11g Webgate for Oracle Access Manager is included in the webgate.zip file.

To install WebGate:

1. Extract the contents of the webgate.zip file to a directory.

   By default, this directory is named webgate.

2. Move to the Disk1 directory under the webgate directory.

3. Set the MW_HOME environment variable to the Middleware Home for the web tier:

   export MW_HOME=ORACLE_BASE/product/fmw/web
   

4. Start the installer using the following command:

   $ ./runInstaller -jreLoc MW_HOME/jdk
   

   Note:

   When you install Oracle HTTP Server, the jdk directory is created under the WebTier_Home directory. You must enter the absolute path of the JRE folder located in this JDK when launching the installer.

   After the installer starts, the Welcome screen appears.

5. In the Welcome screen, click Next.

6. In the Prerequisite Checks screen, click Next.

7. In the Specify Installation Location screen, specify the Oracle Middleware Home and Oracle Home locations.

   • ORACLE_BASE/product/fmw

   • Oracle_OAMWebGate1 (leave the default name)

   Note:

   The Middleware Home contains an Oracle Home for Oracle web tier. The default name is Oracle_OAMWebGate1 for this Oracle home directory, which will be created under the Middleware Home.

   Click Next.

8. In the Specify GCC Library screen, specify the directory that contains the GCC libraries, and click Next.

9. In the Installation Summary screen, verify the information on this screen and click Install to begin the installation.

10. In the Installation Progress screen, you may be prompted to run the ORACLE_HOME/oracleRoot.sh script to set up the proper file and directory permissions.

    Click Next to continue.

11. In the Installation Complete screen, click Finish to exit the installer.

15.6.3.3 Post-Installation Steps

Complete the following procedure after installing Oracle HTTP Server 11g Webgate for Oracle Access Manager:

1. Move to the following directory under your Oracle Home for Webgate:

   $ cd Webgate_Oracle_Home/webgate/ohs/tools/deployWebGate
   

   Webgate_Oracle_Home is the directory where you have installed Oracle HTTP Server Webgate and created as the Oracle Home for Webgate, as in the following example:

   MW_HOME/Oracle_OAMWebGate1
   

2. On the command line, run the following command to copy the required bits of agent from the Webgate_Oracle_Home directory to the Webgate Instance location:

   $ ./deployWebGateInstance.sh -w ORACLE_BASE/admin/webN/config/OHS/ohsN 
   -oh Webgate_Oracle_Home
   

   The ORACLE_BASE/admin/webN/config/OHS/ohsN directory is the Instance Home of an Oracle HTTP Server (where N is a sequential number for your installation; for example, 1 for WEBHOST1 or 2 for WEBHOST2).

   Note:

   an Instance Home for Oracle HTTP Server is created after you configure Oracle HTTP Server.

3. Run the following command to ensure that the LD_LIBRARY_PATH variable contains Oracle_Home_for_Oracle_HTTP_Server/lib:

   $ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:ORACLE_BASE/product/fmw/webN/lib
   

   Note:

   Oracle_Home_for_Oracle_HTTP_Server is MW_HOME (web tier):

   ORACLE_BASE/product/fmw/webN

   Where N is a sequential number for your installation; for example, 1 for WEBHOST1, 2 for WEBHOST2, and so on.

4. From your present working directory, move up one directory level:

   $ cd Webgate_Oracle_Home/webgate/ohs/tools/setup/InstallTools
   

5. On the command line, run the following command to copy the apache_webgate.template from the Webgate_Oracle_Home directory to the Webgate Instance location (renamed to webgate.conf) and update the httpd.conf file to add one line to include the name of webgate.conf:

   $ ./EditHttpConf -w ORACLE_BASE/admin/webN/config/OHS/ohsN [-oh Webgate_Oracle_Home] [-o output_file]
   

   Note:

   The -oh WebGate_Oracle_Home and -o output_file parameters are optional.

   Where WebGate_Oracle_Home is the directory where you have installed Oracle HTTP Server Webgate for Oracle Access Manager and created as the Oracle Home for Webgate, as in the following example:

   MW_HOME/Oracle_OAMWebGate1
   

   The ORACLE_BASE/admin/webN/config/OHS/ohsN directory is the instance home of Oracle HTTP Server, where N is a sequential number for your installation; for example, 1 for WEBHOST1 or 2 for WEBHOST2.

   The output_file is the name of the temporary output file used by the tool, as in the following example:

   Edithttpconf.log

15.6.4.1 The RREG Tool

The RREG tool is part of the OAM 11g installation. If it is not already available, extract it using the following procedure:

1. After installing and configuring Oracle Access Manager, navigate to the following location:

   IDM_Home/oam/server/rreg/client
   

2. On the command line, untar the RREG.tar.gz file using gunzip, as in the following example:

   gunzip RREG.tar.gz
    
   tar -xvf RREG.tar
   

3. Edit the oamreg.sh script in the RREG_HOME/bin/ directory and change the OAM_REG_HOME parameter according to your setup:

   OAM_REG_HOME=RREG_Home
   

   (where RREG_Home is the directory to which you extracted the contents of RREG.tar.gz and rreg).

   Save the script file.

The RREG Configuration Tool provides a way to register protected, public, and excluded resources into the OAM system. The list of resources to be added to the OAM system are listed in OAM11gRequest.xml as shown in Example 15-3.

15.6.4.2 Updating the OAM11gRequest File

In the RREG_Home/input directory there are template files named OAM11gRequest.xml. Copy and edit this file to create the policies for the WebCenter Portal installation.

1. Open the template OAM11gRequest.xml file available in RREG_Home/input.

2. Copy policies required for the WebCenter Portal enterprise deployment provided in Example 15-3.

3. Replace the following values:

   • $$webtierhost$$, $$oamadminserverport$$, and $$oamhost$$ with the hostnames in your installation

   • ipvalidationExceptions value with the IP address of the Load Balancer

   Note:

   - This Guide describes the validation field entry in request files for Oracle Access Manager 11g (11.1.1.2) and later. The validation exception list is defined differently in earlier versions of Oracle Access Manager 11g. For earlier versions, instead of using the <ValList> entry as shown in the preceding text, use this syntax after the </publicResourcesList> entry:

    <userDefinedParameters>
           <userDefinedParam>
               <name>ipValidationExceptions</name>
               <value>10.1.1.1</value>
           </userDefinedParam>
       </userDefinedParameters>
   

   For more information about adding IP validation exceptions, see Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.

4. Save the changes.

5. Add execute permissions for the oamreg.sh script:

   chmod u+x /RREG_Home/bin/oamreg.sh
   

<?xml version="1.0" encoding="UTF-8"?> 
<!-- Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 NAME: OAM11GRequest_short.xml - Template for OAM 11G Agent Registration request file
         (Shorter version - Only mandatory values - Default values will be used for all other fields)
 DESCRIPTION: Modify with specific values and pass file as input to the tool.
-->
<OAM11GRegRequest>
    <serverAddress>http://$$oamhost$$:$$oamadminserverport$$</serverAddress>
    <hostIdentifier>$$webtierhost$$_webcenter</hostIdentifier>
    <agentName>$$webtierhost$$_webcenter</agentName>
    <applicationDomain>$$webtierhost$$_webcenter</applicationDomain>
 <ipValidation>1</ipValidation> 
    <ValList ListName="ipValidationExceptions">
        <ValListMember Value="10.1.1.1"/>
    <logOutUrls>
        <url>/oamsso/logout.html</url>
    </logOutUrls>
    <protectedResourcesList>
        <resource>/webcenter/adfAuthentication</resource>
        <resource>/integration/worklistapp</resource>
        <resource>/integration/worklistapp/.../*</resource>
<resource>/workflow/sdpmessagingsca-ui-worklist/faces/adf.task-flow</resource>
        <resource>/workflow/WebCenterWorklistDetail/faces/adf.task-flow</resource>
        <resource>/workflow/sdpmessagingsca-ui-worklist</resource>
        <resource>/workflow/sdpmessagingsca-ui-worklist/.../*</resource>
        <resource>/sdpmessaging/userprefs-ui</resource>
        <resource>/sdpmessaging/userprefs-ui/.../*</resource>
        <resource>/rss/rssservlet</resource>
        <resource>/owc_discussions/login!withRedirect.jspa</resource>
        <resource>/owc_discussions/login!default.jspa</resource>
        <resource>/owc_discussions/login.jspa</resource>
        <resource>/owc_discussions/admin</resource>
        <resource>/owc_discussions/admin/.../*</resource>
        <resource>/rest/api/resourceIndex</resource>
        <resource>/rest/api/spaces</resource>
        <resource>/rest/api/spaces/.../*</resource>
        <resource>/rest/api/discussions</resource>
        <resource>/rest/api/discussions/.../*</resource>
        <resource>/rest/api/tags</resource>
        <resource>/rest/api/tags/.../*</resource>
        <resource>/rest/api/taggeditems</resource>
        <resource>/rest/api/taggeditems/.../*</resource>
        <resource>/rest/api/activities</resource>
        <resource>/rest/api/activities/.../*</resource>
        <resource>/rest/api/activitygraph</resource>
        <resource>/rest/api/activitygraph/.../*</resource>
        <resource>/rest/api/feedback</resource>
        <resource>/rest/api/feedback/.../*</resource>
        <resource>/rest/api/people</resource>
        <resource>/rest/api/people/.../*</resource>
        <resource>/rest/api/messageBoards</resource>
        <resource>/rest/api/messageBoards/.../*</resource>
        <resource>/rest/api/searchresults</resource>
        <resource>/rest/api/searchresults/.../*</resource>
        <resource>/activitygraph-engines</resource>
        <resource>/activitygraph-engines/.../*</resource>
        <resource>/wcps/api</resource>
        <resource>/wcps/api/.../*</resource>
        <resource>/adfAuthentication</resource>
        <resource>/pagelets/admin</resource>
        <resource>/pagelets/admin/.../*</resource>
        <resource>/pagelets/authenticateWithApplicationServer</resource>
        <resource>/services-producer/adfAuthentication</resource>
        <resource>/em</resource>
        <resource>/em/.../*</resource>
        <resource>/console</resource>
        <resource>/console/.../*</resource>
        <resource>/soa/composer</resource>
        <resource>/soa/composer/.../*</resource>
        <resource>/soa-infra</resource>
        <resource>/soa-infra/deployer</resource>
        <resource>/soa-infra/deployer/.../*</resource>
        <resource>/soa-infra/events/edn-db-log</resource>
        <resource>/soa-infra/events/edn-db-log/.../*</resource>
        <resource>/soa-infra/cluster/info</resource>
        <resource>/soa-infra/cluster/info/.../*</resource>
        <resource>/inspection.wsil</resource>
        <resource>/cs/idcplg</resource>
        <resource>/cs/idcplg/.../*</resource>
        <resource>/cs/groups</resource>
        <resource>/cs/groups/.../*</resource>
        <resource>/ibr/adfAuthentication</resource>
        <resource>/ibr/adfAuthentication/.../*</resource>
    </protectedResourcesList>
    <publicResourcesList>
        <resource>/webcenter</resource>
        <resource>/webcenter/.../*</resource>
        <resource>/owc_discussions</resource>
        <resource>/owc_discussions/.../*</resource>
        <resource>/rss</resource>
        <resource>/rss/.../*</resource>
        <resource>/workflow</resource>
        <resource>/workflow/.../*</resource>
        <resource>/rest/api/cmis/.../*</resource>
        <resource>/pagelets</resource>
        <resource>/services-producer</resource>
        <resource>/wsrp-tools</resource>
        <resource>/cs</resource>
        <resource>/cs/.../*</resource>
        <resource>/ibr</resource>
        <resource>/ibr/.../*</resource>
        <resource>/soa-infra/directWSDL</resource>
        <resource>/integration/services</resource>
        <resource>/integration/services/.../*</resource>
    </publicResourcesList>
 <excludedResourcesList>
<resource>/rsscrawl*</resource>
<resource>/rsscrawl/.../*</resource>
<resource>/sesUserAuth*</resource>
<resource>/sesUserAuth/.../*</resource>
<resource>/services-producer/portlets*</resource>
<resource>/services-producer/portlets/.../*</resource>
<resource>soa-infra/services/.../*</resource>
 <resource>/wsrp-tools/portlets*</resource>
<resource>/wsrp-tools/portlets/.../*</resource>
        <resource>/wsm-pm</resource>
        <resource>/wsm-pm/.../*</resource>
        <resource>/ucs/messaging/webservice</resource>
        <resource>/ucs/messaging/webservice/.../*</resource>
 </excludedResourcesList>

</OAM11GRegRequest>

15.6.4.3 Running the oamreg Tool

1. Run the oamreg tool using the following command:

   $ ./RREG_Home/bin/oamreg.sh inband input/WebCenterOAM11GRequest.xml
   

2. When prompted for the agent credentials, enter your OAM administrator credentials.

   The run should look as follows:

------------------------------------------------
Welcome to OAM Remote Registration Tool!
Parameters passed to the registration tool are:
Mode: inband
Filename: MW_HOME/Oracle_IDM1/oam/server/rreg/input/WebCenterOAM11gRequest.xml
Enter your agent username:weblogic
Username: weblogic
Enter agent password:          
Do you want to enter a Webgate password?(y/n):
y
Enter webgate password:          
Enter webgate password again:          
Password accepted. Proceeding to register..
Aug 16, 2010 1:22:30 AM oracle.security.am.engines.rreg.client.handlers.request.OAM11GRequestHandler getWebgatePassword
INFO: Passwords matched and accepted.
Do you want to import an URIs file?(y/n):
n
----------------------------------------
Request summary:
OAM11G Agent Name:WEBHOST1_webcenter
URL String:WEBHOST1_webcenter
Registering in Mode:inband
Your registration request is being been sent to the Admin server at: http://oamserver.mycompany.com:7001
----------------------------------------
Inband registration process completed successfully! Output artifacts are created in the output folder.

15.6.4.4 Copying Access files to WEBHOSTs

The following two files are generated in RREG_Home/output/$$webtierhost$$_webcenter:

• ObAccessClient.xml

• cwallet.sso

To copy both these files to the WebGate instance location on WEBHOST1 and WEBHOST2:

1. Copy ObAccessClient.xml and cwallet.sso to the WebGate instance directory on WEBHOST1 and WEBHOST2.

   For example:

   scp ObAccessClient.xml oracle@WEBHOSTN:ORACLE_BASE/admin/webN/config/OHS/ohsN/webgate/config/

   scp cwallet.sso oracle@WEBHOSTN:ORACLE_BASE/admin/webN/config/OHS/ohsN/webgate/config/

   Where N is a sequential number for your installation; for example, 1 for WEBHOST1, 2 for WEBHOST2, and so on.

2. Restart Oracle HTTP Server.

15.6.4.5 Updating REST Policies

REST needs to follow the BASIC authentication scheme so that external clients, such as the Outlook plug-in and iPhone application, can connect to WebCenter REST and be protected with SSO.

To configure the REST end points to use basic authentication:

1. Log in to the Oracle Access Manager console at http://OAM_HOST:OAM_ADMINSERVER_PORT/oamconsole.

2. Locate the policy domain that you created and verified in the previous steps and open the Policies tab.

3. Go to Application Domains> $$webtierhost$$_webcenter > Authentication Policies.

4. Create a new policy called WebCenter REST Auth Policy, select Authentication Scheme as BASIC Scheme, and click Apply.

5. Go to Application Domains> $$webtierhost$$_webcenter > Resources.

6. Search for all the REST resources. Type /rest* in the Resource URL field and then click Search.

7. Edit each REST resource, except for /rest/api/cmis entries, and change Authentication Policy from Protected Resource Policy to WebCenter REST Auth Policy.

   Figure 15-6 Configuring REST End Points to use Basic Authentication

   
   

   You should see the following entries:

   /rest/api/resourceIndex
   /rest/api/resourceIndex/.../*
   /rest/api/spaces
   /rest/api/spaces/.../*
   /rest/api/discussions
   /rest/api/discussions/.../*
   /rest/api/tags
   /rest/api/tags/.../*
   /rest/api/taggeditems
   /rest/api/taggeditems/.../*
   /rest/api/activities
   /rest/api/activities/.../*
   /rest/api/activitygraph
   /rest/api/activitygraph/.../*
   /rest/api/feedback
   /rest/api/feedback/.../*
   /rest/api/people
   /rest/api/people/.../*
   /rest/api/messageBoards
   /rest/api/messageBoards/.../*
   /rest/api/searchresults
   /rest/api/searchresults/.../*
   

15.6.5.1 Back Up Configuration Files

To be safe, first back up the relevant configuration files stored under WebCenter Portal's Administration Server directory:

ORACLE_BASE/admin/domain_name/aserver/domain_name/config/config.xml 
ORACLE_BASE/admin/domain_name/aserver/domain_name/config/fmwconfig/jps-config.xml
ORACLE_BASE/admin/domain_name/aserver/domain_name/config/fwmconfig/system-jazn-data.xml

In addition, back up the boot.properties file for the Administration Server.

15.6.5.2 Setting Up the OAM ID Asserter

To set up the OAM ID Asserter:

1. Log in as an administrator to Oracle WebLogic Console.

2. Click Lock & Edit.

3. Navigate to SecurityRealms, Default Realm Name, and then Providers.

4. Click New and select OAM Identity Asserter from the dropdown menu.

5. Name the asserter (for example, OAM ID Asserter) and click Save.

6. Click the newly added asserter to see the configuration screen for OAM Identity Asserter.

7. Set the control flag to REQUIRED.

8. Select both the ObSSOCookie and OAM_REMOTE_USER options under Chosen types.

9. Save the settings.

10. Click Apply Changes.

11. Finally, connect to the WebLogic domain using WLST and add an OAM SSO provider by running the following command:

    addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi="/oamsso/logout.html")
    

15.6.5.3 Setting the Order of Providers

Set the order of providers using the WebLogic Administration Console.

To set the order of the providers:

1. Log in as an administrator to Oracle WebLogic Console.

2. Click Lock & Edit.

3. Navigate to SecurityRealms, then the default realm name, and then Providers.

4. Reorder the OAM Identity Asserter, OID/OVD Authenticator, and Default Authenticator by ensuring that the control flag for each authenticator is set as follows:

   • OAM Identity Asserter: REQUIRED

   • OID LDAP Authenticator (or OVD LDAP Authenticator): SUFFICIENT

   • Default Authenticator: SUFFICIENT

5. Click OK.

6. Click Activate Changes to propagate the changes.

7. Restart the Administration Server and all managed servers.

15.7.2.1 Granting the Spaces Administrator Role Using WLST

To grant the Spaces Administrator role using WLST:

1. Navigate to your WebCenter Portal Oracle home directory and invoke the WLST script:

   (UNIX) MW_HOME/wc/common/bin/wlst.sh

   (Windows) MW_HOME\wc\common\bin\wlst.cmd

2. Connect to the Administration Server for the target domain with the following command:

   wls:/offline>connect("user_name","password", "host_name:port_number")
   

   Where:

   • user_name is the name of the user account with which to access the Administration Server (for example, weblogic)

   • password is the password with which to access the Administration Server

   • host_id is the host ID of the Administration Server

   • port is the port number of the Administration Server (for example, 7001).

3. Create a user in the LDAP store named WCAdmin.

   This user will be assigned the Spaces Administrator role.

   For more information on how to create a user, see Section 15.2.2.1, "Provisioning Admin Users and Groups in an LDAP Directory."

4. Grant the Spaces administrator application role to the WCAdmin user in LDAP using the grantAppRole command.

   For example:

   grantAppRole(appStripe="webcenter", appRoleName="s8bba98ff_4cbb_40b8_beee_296c916a23ed#-#Administrator",
   principalClass="weblogic.security.principal.WLSUserImpl", principalName="WCAdmin")
   

   Where WCAdmin is the name of the administrator account you created in Step 3.

5. To test the new account, log in to the Spaces application using the new account name.

   The Administration link should appear, and you should be able to perform all administrator operations.

15.7.2.2 Granting the Spaces Administrator Role Using Fusion Middleware Control

This section describes how to grant the Spaces administrator role to a user account other than the default weblogic account.

To grant the Spaces Administrator role using Fusion Middleware Control:

1. Log into Fusion Middleware Control and navigate to the home page for Spaces.

2. From the WebCenter Portal menu, select Security, and then Application Roles.

   The Application Roles page displays.

3. Search for the Spaces Administrator role:

   1. Select the Select Application Stripe to Search check box.

   2. Select webcenter (the name of the Spaces application).

   3. In the Role Name field, enter s8bba98ff_4cbb_40b8_beee_296c916a23ed#-#Administrator, and then click the Search (arrow) icon.

4. Click the administrator role name (s8bba98ff_4cbb_40b8_beee_296c916a23ed#-#Administrator) in the Role Name column.

   The Edit Application Role page displays.

5. Click Add User.

   The Add User pop-up displays.

6. Use the Search function to search for the user to assign the Administrator role to.

7. Use the arrow keys to move the user from the Available Users column to the Selected Users column, and click OK.

8. On the Edit Application Role page, click OK.

9. Restart the WC_Spaces managed server.

   When you log in to the Spaces application, the Administration link should appear and you should be able to perform all administrator operations.

15.7.3.1 Granting Administrator Permissions on the Discussions Server

When associating the domain with an identity store that does not contain the group Administrators, you must assign some other valid user or group the administrator role for the discussions server.

The WLST command addDiscussionsServerAdmin lets you grant system administrator permissions on the discussions server to a user or a group. For command syntax and examples, see the section, "addDiscussionsServerAdmin" in Oracle Fusion Middleware WebLogic Scripting Tool Command Reference.

For example,

1. Connect to the Administration Server:

   For example:

   cd MW_HOME/wc/common/bin/
   ./wlst.sh
   
   connect("weblogic","mypassword1", "ADMINHOST:7001")
   

2. Grant administration permissions to a user or a group:

   addDiscussionsServerAdmin(appName='owc_discussions', name='weblogic_wc', type='USER', server='WC_Collaboration1')
   

   or:

   addDiscussionsServerAdmin(appName='owc_discussions', name='discussions-admin-group', type='GROUP', server='WC_Collaboration1')
   

Where weblogic_wc and discussions-admin-group are example user/groups that you want to assign the administrator role for the discussions server.

For command syntax and examples, see the section, "addDiscussionsServerAdmin" in Oracle Fusion Middleware WebLogic Scripting Tool Command Reference.

15.7.3.2 Configuring System Properties for Discussions Server

To configure Oracle WebCenter Discussions Server for OAM single sign-on:

1. Log in to the Oracle WebCenter Discussions Server Admin Console at:

   http://wcpinternal.mycompany.com/owc_discussions/admin

2. Open the System Properties page and edit, (if it already exists), or add the owc_discussions.sso.mode property, setting its value to true.

3. Edit or add the jiveURL property to point to the base URL of the web tier for the SSO server. For example:

   jiveURL = idmhost.example.com:8890/owc_discussions
   

15.7.3.3 Specifying a New Admin User for the Discussions Server Connection

Review the discussions server connection you created in Section 12.2, "Configuring the Discussions Server Connection". Ensure that the administrative user specified on the connection is available in LDAP and has administrator permissions on the discussions server, for example, weblogic_wc.