3 Adding Groups with JSP Tags and Controls

Developers can use Oracle Enterprise Pack for Eclipse to provide the capability to create groups, add group profiles, and delete groups with JSP tags and controls. Portal administrators might prefer to add or edit a small number of groups in the WebLogic Portal Administration Console.

If you are using an external user store, determine if there are existing groups in that user store. You can use the WebLogic Scripting Tool to retrieve existing groups, as well as users. See the Oracle WebLogic Server WebLogic Scripting Tool Guide at http://download.oracle.com/docs/cd/E12840_01/wls/docs103/config_scripting/using_WLST.html for more information.

You should plan your role structure before you create groups. Making groups role-based to control what each group can do and see in your portal will save you time later.

If you are using an external user store and it does not contain groups, developers can use the following tools to create and manage groups:

JSP Tags – Use the createGroup JSP tag to create a new group. Other JSP tags let you add a subgroup, remove a group or subgroup, and create a group profile.
Controls – Use the createGroup action in the group provider control to create a new group. Other controls allow you to add a subgroup, remove a group or subgroup, and create a group profile. See the Oracle Fusion Middleware Java API Reference for Oracle WebLogic Portal for more information.
Java – Work directly with the com.bea.p13n.security.management.authentication.AtnManagerProxy Java class to add groups, create group profiles, and remove groups. When you use the API to create a user, a user profile is not automatically created. See the Oracle Fusion Middleware Java API Reference for Oracle WebLogic Portal for more information on the Java class.

Portal administrators can use the following tools to create and manage groups:

WebLogic Portal Administration Console – Add and edit groups here if you work primarily in the Administration Console. See Chapter 8 for instructions.
WebLogic Server Administration Console – Add and edit groups here if you work primarily in the WebLogic Server Administration Console. See the Oracle WebLogic Server Securing WebLogic Resources Guide at http://download.oracle.com/docs/cd/E12840_01/wls/docs103/secwlres/intro.html for instructions.

Tip:
Roles and entitlements are stored in the LDAP server by default. The WLP Propagation Utility does not propagate this data from your staging environment to production. See the Oracle Fusion Middleware Production Operations Guide for Oracle WebLogic Portal for more information.

This chapter includes the following sections:

Section 3.1, "Creating Groups"
Section 3.2, "Removing Groups"
Section 3.3, "Creating a Group Profile"

3.1 Creating Groups

If the user store you are accessing already has users organized into groups, you can build a hierarchical tree in the Administration Console to match that group structure. See Section 8.1, "Using Existing Groups" for instructions. If you are using WebLogic Server's default RDBMS user store, you do not need to build a group hierarchy tree.

When you create a group, you are creating an empty group to which you can add any number of users. A subgroup exists under a parent group.

Tip:

Create groups before you add users. If the group exists before you add a user, you can then immediately add the user to the group.

This section contains the following topics that explain how to add a group programmatically with JSP tags and controls:

Section 3.1.1, "Creating a Group with a JSP Tag"
Section 3.1.2, "Creating a Subgroup with a JSP Tag"
Section 3.1.3, "Creating a Group with a Control"
Section 3.1.4, "Creating a Subgroup with a Control"

3.1.1 Creating a Group with a JSP Tag

The <ugm:createGroup> tag adds a new group in the Security realm, and a corresponding group profile in the personalization database. The logged-in user must have administrator rights to execute this tag. You can use the JSP you create alone, in a page flow, or in a web project.

Note:

Page flows are a feature of Apache Beehive, which is an optional framework that you can integrate with WLP. See "Apache Beehive and Apache Struts Supported Configurations" in the Oracle Fusion Middleware Portal Development Guide for Oracle WebLogic Portal.

You can determine which portal administrator can manage each user group by assigning delegated administration roles to those groups.

The <ugm:createGroup> tag automatically creates a group profile. You can use this tag with the <ugm:addUserToGroup> tag to add a user to your new group and with the <ugm:addGroupToGroup> tag to add a subgroup to the group you just created. Verify your results with the <ugm:getTopLevelGroups> tag.

See the Oracle Fusion Middleware JSP Tag Java API Reference for Oracle WebLogic Portal for more information on the Java class.

Tip:

If you test your JSP tag or control in the Staging phase and the new group does not appear, verify that you built a group hierarchy tree for the user store. If you built the tree but you still do not see a list of groups, the user store probably does not allow read access. See the Oracle Fusion Middleware Security Guide for Oracle WebLogic Portal for instructions on giving the provider read access.

3.1.2 Creating a Subgroup with a JSP Tag

The <um:addGroupToGroup> JSP tag adds a child group to a parent group. A group can have more than one parent. Both the parent group and the child group must already exist.

After you create the subgroup, you can use the <profile:createProfile> tag to create a group profile for the new group. You might want to use the <ugm:addUserToGroup> tag to add users to the new subgroup. You can verify your results with the <ugm:getChildGroupNames> and <ugm:getUsernamesForGroup> tags.

The steps to create the <ugm:addGroupToGroup> tag are similar to the <um:createGroup> tag.

See the Oracle Fusion Middleware JSP Tag Java API Reference for Oracle WebLogic Portal for more information on the Java class.

3.1.3 Creating a Group with a Control

The group provider control contains an action called createGroup, which adds a new parent group in the Security realm, and a corresponding group profile in the personalization database. The logged-in user must have administrator rights to execute this control.

The createGroup action provides a pre-built form (a form bean) you can add to your JSPs to add a new parent group. Using a form can save you development time because it simplifies data entry and group management.

The createGroup action fails if the group you are adding already exists in WebLogic Portal or if you give the group an invalid name. Use the createGroup action instead of the JSP tag if you want to add a parent group in a page flow where a successful action forwards the user to another JSP.

Note:

After you use the createGroup action, you can use the createGroupProfile action in the Profile control to create a group profile for the new group. You can also use the addGrouptoGroup action to create a subgroup.

For more information on using the Group Provider control and its properties, see the Oracle Fusion Middleware Java API Reference for Oracle WebLogic Portal.

3.1.4 Creating a Subgroup with a Control

The addGroupToGroup action in the Group Provider control adds a child group to a parent group. You must log in as a user with administrator rights to add a group to a group.

The addGroupToGroup action provides a pre-built form (form bean) to add to your JSPs to add an existing group to another group. Using a form can save you development time because it simplifies data entry and group management.

Use the addGroupToGroup action instead of the JSP tag if you want to add a subgroup in a page flow where a successful action forwards the user to another JSP.

Note:

After you use the addGroupToGroup action, you can use the createGroupProfile action in the Profile control to create a group profile for the new group.

For more information on using the Group Provider control and its properties, see the Oracle Fusion Middleware Java API Reference for Oracle WebLogic Portal.

3.2 Removing Groups

When you delete a group, you permanently remove the group and all of its subgroups from the user store. You must re-create all of the affected groups if you want to use them again. Deleting a group does not remove the users contained within it.

You can remove a subgroup from a group, and you can move a group within the group hierarchy to change its relationship to other groups. If the group was listed in a delegated administration or visitor entitlement role, you must also remove that group from the role definition.

In addition to deleting a group with a JSP tag or control in Oracle Enterprise Pack for Eclipse, you can remove a group in the Administration Console. See Chapter 8 for instructions. If you are using an external user store, you can also remove the group there.

This section contains the following topics that explain how to remove groups programmatically with JSP tags and controls:

Section 3.2.1, "Removing a Group with a JSP Tag"
Section 3.2.2, "Removing a Subgroup with JSP Tag"
Section 3.2.3, "Removing a Group with a Control"
Section 3.2.4, "Removing a Subgroup with a Control"

3.2.1 Removing a Group with a JSP Tag

The <ugm:removeGroup> JSP tag deletes a specific group. The logged-in user must have administrator rights to execute this tag.

The <ugm:removeGroup> tag is often used with the <ugm:removeGroupFromGroup> tag and the <ugm:removeUserFromGroup> tag. After you remove the group, you can verify the results with the <ugm:getTopLevelGroups> tag to view a list of all top groups.

See the Oracle Fusion Middleware JSP Tag Java API Reference for Oracle WebLogic Portal for more information on the Java class.

3.2.2 Removing a Subgroup with JSP Tag

The <ugm:removeGroupFromGroup> JSP tag removes a child group from a parent group. This tag does not delete the group. The logged-in user must have administrator rights to execute this tag.

The <ugm:removeGroupFromGroup> tag is often used with the <ugm:removeGroup> tag and the <ugm:removeUserFromGroup> tag. After you remove the subgroup, you can verify the results with the <ugm:getChildGroupNames> tag.

See the Oracle Fusion Middleware JSP Tag Java API Reference for Oracle WebLogic Portal for more information on the Java class.

3.2.3 Removing a Group with a Control

The removeGroup action in the Group Provider control removes a specific group. The logged-in user must have administrator rights to execute this tag.

Use the removeGroup action instead of the JSP tag if you want to remove a parent group in a page flow where a successful action forwards the user to another JSP.

Note:

You can also use another action, removeGroupFromGroup, to remove a group's subgroups. After you use the removeGroup action, you can verify the results with the getTopLevelGroupNames action.

For more information on using the Group Provider control and its properties, see the Oracle Fusion Middleware Java API Reference for Oracle WebLogic Portal.

3.2.4 Removing a Subgroup with a Control

The removeGroupFromGroup action in the Group Provider control removes a child group from a group. This tag does not delete the group. The logged-in user must have administrator rights to execute this tag.

Use the removeGroupFromGroup action instead of the JSP tag if you want to remove a child group in a page flow where a successful action forwards the user to another JSP.

Note:

After you use the removeGroupFromGroup action, you can verify the results with the getAllGroupNames action. You can also use the removeGroup action to remove a parent group.

For more information on using the Group Provider control and its properties, see the Oracle Fusion Middleware Java API Reference for Oracle WebLogic Portal.

3.3 Creating a Group Profile

After you create groups, an optional step is to create group profiles. You can use Oracle Enterprise Pack for Eclipse to create a group profile and its default property values. You can edit the profile's default values in Oracle Enterprise Pack for Eclipse or in the WebLogic Portal Administration Console.

A group profile contains information about the group that is stored in editable fields in the Administration Console. Group profile properties could include whatever group information you want, such as the group's location, a group e-mail alias, or the name of the group's administrator.

You can edit properties for groups, but users belonging to those groups do not automatically inherit the group properties you specify. If a user belongs to two groups, for example, and you have edited each group's properties, you must specify which set of group properties the user should inherit by configuring a ProfileWrapper successor at runtime. A ProfileWrapper is a lightweight object that can access the correct ProfileManager session beans based on the profile identity with which it is initialized.

For instructions on editing group profile values in the Administration Console, see Chapter 8.

This section contains the following topics that explain how to create a group profile programmatically with JSP tags and controls:

Section 3.3.1, "Creating a Group Profile with a JSP Tag"
Section 3.3.2, "Creating a Group Profile with a Control"

3.3.1 Creating a Group Profile with a JSP Tag

You can use the <profile:createProfile> tag to create a new group profile that corresponds to the profilekey. Creating a profile also creates designated successors for property inheritance. The logged-in user must have administrator rights to execute this tag.

You can also create a profile for a group in a user store that does not allow read access. When the user logs in, the user is paired with the profile. You cannot edit the group profile properties, but you can still use those properties to set up personalization, delegated administration, and visitor entitlement.

The <profile:createProfile> tag is often used with the <ugm:createGroup> tag and the <profile:getProfile> tag.

See the Oracle Fusion Middleware JSP Tag Java API Reference for Oracle WebLogic Portal for more information on the Java class.

3.3.2 Creating a Group Profile with a Control

The createGroupProfile action in the Profile control creates a new group profile that corresponds to the profilekey. Creating a profile also creates designated successors for property inheritance. The logged-in user must have administrator rights to execute this tag.

Developers use this action in the Profile control to retrieve a group's profile, use the Property control to put properties in working memory, and then use the Rules Executor control to evaluate and filter the group's profile properties in order to trigger actions based on that evaluation.

You can use the createGroupProfile action with the createGroup action to create a group profile for a new group. After you create the group profile, use the getGroupProfile action to access the ProfileWrapper for the group.

Use the createGroupProfile action instead of the <profile:createProfile> JSP tag if you want to create a group profile in a page flow where a successful action forwards the user to another JSP.

Note:

For more information on using the Profile control and its properties, see the Oracle Fusion Middleware Java API Reference for Oracle WebLogic Portal.