16 Configuring Fusion Middleware Security for Content Server
This chapter includes the following topics:
For more information about Oracle Fusion Middleware and Oracle WebLogic Server security, see the documentation listed in Table 16-1.
16.1 LDAP Authentication Providers
Oracle WebCenter Content runs on Oracle WebLogic Server. The Oracle WebLogic Server domain includes an embedded Lightweight Directory Access Protocol (LDAP) server that acts as the default security provider data store for the Default Authentication, Authorization, Credential Mapping, and Role Mapping providers. WebCenter Content provides the default JpsUserProvider to communicate with Oracle WebLogic Server. See Managing the Embedded LDAP Server in Administering Security for Oracle WebLogic Server, and Configure the Embedded LDAP Server in Oracle WebLogic Server Administration Console Online Help.
In almost all cases, an Oracle WebCenter Content production system identity store must be reassociated with an external LDAP authentication provider rather than use the embedded LDAP server. Once the new LDAP authentication provider is configured, then you migrate users from the embedded LDAP provider to the new LDAP provider. The external LDAP authentication provider, such as Oracle Internet Directory (OID), must be listed before all other authentication providers including the default authentication provider. See Reassociating the Identity Store with an External LDAP Authentication Provider in Installing and Configuring Oracle WebCenter Content.
Note:
As of 11g Release 1 (11.1.1.6.0) Oracle WebCenter Content supports use of the Oracle Virtual Directory library (libOVD) feature, which enables a site to use multiple providers for login and group membership information. For example, it would be possible to use two Oracle Internet Directory (OID) providers as sources of user and role information. See Configuring Single and Multiple LDAPs in Securing Applications with Oracle Platform Security Services.
Table 16-1 lists some of the LDAP providers that can be configured for user authentication.
Table 16-1 LDAP Authenticator Types
| LDAP Servers | Authenticator Providers |
|---|---|
|
Microsoft AD |
ActiveDirectoryAuthenticator |
|
SunOne LDAP |
IPlanetAuthenticator |
|
Oracle Directory Server Enterprise Edition (ODSEE) |
IPlanetAuthenticator |
|
Oracle Unified Directory (OUD) |
IPlanetAuthenticator |
|
Oracle Internet Directory |
OracleInternetDirectoryAuthenticator |
|
Oracle Virtual Directory |
OracleVirtualDirectoryAuthenticator |
|
EDIRECTORY |
NovellAuthenticator |
|
OpenLDAP |
OpenLDAPAuthenticator |
|
EmbeddedLDAP |
DefaultAuthenticator |
If you want to configure WebCenter Content to use an external LDAP server and have dynamic groups (as well as static groups) on your Directory whose privileges you want recognized by WebCenter Content, additional configuration is necessary. User creation, authentication, and authorization is managed using Oracle Platform Services Security (OPSS), which uses a different mechanism to gather Directory Server information when compared to the native Oracle WebLogic Server providers for an external LDAP server. See Oracle WebCenter and Dynamic Groups from an External LDAP Server blog.
16.2 Configuring Oracle WebCenter Content to Use SSL
You can configure Oracle Fusion Middleware to secure communications with WebCenter Content using SSL, which is an industry standard for securing communications. Oracle Fusion Middleware supports SSL version 3, as well as TLS version 1.
This section covers the following topics:
-
Invoking References in One-Way SSL Environments in Oracle JDeveloper
-
Configuring WebCenter Content, Oracle HTTP Server for SSL Communication
-
Switching from Non-SSL to SSL Configurations for WebCenter Content
-
Enabling an Asynchronous Process to Invoke an Asynchronous Process
For additional information, see Configuring SSL in Administering Security for Oracle WebLogic Server. For information on Web Tier configuration, see SSL Configuration in Oracle Fusion Middleware in Administering Oracle Fusion Middleware.
16.2.1 Configuring WebCenter Content for Two-Way SSL Communication
WebCenter Content uses the Oracle WebLogic Server secure socket layer (SSL) stacks for two-way SSL configurations.
-
For the inbound Web service bindings, WebCenter Content uses the Oracle WebLogic Server infrastructure and, therefore, the Oracle WebLogic Server libraries for SSL.
-
For the outbound Web service bindings, WebCenter Content uses JRF HttpClient and, therefore, the Oracle Sun JDK libraries for SSL.
Due to this difference, start Oracle WebLogic Server with the following JVM option:
-
Open the following file:
-
On UNIX operating systems, open
$MIDDLEWARE_HOME/user_projects/domains/domain_name/bin/setDomainEnv.sh. -
On Window operating systems, open
MIDDLEWARE_HOME\user_projects\domains\domain_name\bin\setDomainEnv.bat.
-
-
Add the following lines in the
JAVA_OPTIONSsection, if the server is enabled for one-way SSL (server authorization only):-Djavax.net.ssl.trustStore=your_truststore_locationFor two-way SSL, the keystore information (location and password) is not required.
To enable two-way SSL for WebCenter Content to invoke another application:
Note:
Both the server and client are assumed to have been configured for SSL with mutual authentication.
-
On the client side, provide the keystore location.
-
From the SOA Infrastructure menu, choose SOA Administration, then Common Properties.
-
At the bottom of the page, click More SOA Infra Advanced Configuration Properties.
-
Click KeystoreLocation.
-
In the Value column, enter the keystore location.
-
Click Apply.
-
Click Return.
-
-
On the client side, provide the keystore location in
DOMAIN_HOME\config\soa-infra\configuration\soa-infra-config.xml.<keystoreLocation>absolute_path_to_the_keystore_location_and_the_file_name </keystoreLocation> -
During design time in Oracle JDeveloper, update the reference section in the
composite.xmlfile with theoracle.soa.two.way.ssl.enabledproperty.<reference name="Service1" ui:wsdlLocation=". . ."> <interface.wsdl interface=". . ."/> <binding.ws port=". . ."> <property name="oracle.soa.two.way.ssl.enabled">true</property> </binding.ws> </reference> -
In Oracle Enterprise Manager Fusion Middleware Control Console, select WebLogic Domain, then domain_name.
-
Right-click domain_name and select Security, then Credentials.
-
Click Create Map.
-
In the Map Name field, enter a name (for example,
SOA), and click OK. -
Click Create Key.
-
Enter the following details:
Field Description Select Map
Select the map created in Step 7 (for this example, SOA).
Key
Enter the key name (
KeystorePasswordis the default).Type
Select Password.
User Name
Enter the keystore user name (
KeystorePasswordis the default).Password
Enter the password that you created for the keystore.
Note:
When you set up SSL on an Oracle WebLogic Server domain, a key alias is required. You must enter
mykeyas the alias value. This value is required. -
Set the keystore location in Oracle Enterprise Manager Fusion Middleware Control Console. See Step 1 for instructions.
-
Modify the
composite.xmlsyntax to usehttpsandsslportto invoke Oracle WebCenter Content. For example, change the syntax shown in bold:<?xml version="1.0" encoding="UTF-8" ?> <!-- Generated by Oracle SOA Modeler version 1.0 at [4/1/09 11:01 PM]. --> <composite name="InvokeEchoBPELSync" revision="1.0" label="2009-04-01_23-01-53_994" mode="active" state="on" xmlns="http://xmlns.example.com/sca/1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:orawsp="http://schemas.example.com/ws/2006/01/policy" xmlns:ui="http://xmlns.example.com/soa/designer/"> <import namespace="http://xmlns.example.com/CustomApps/InvokeEchoBPELSync/BPELProcess1" location="BPELProcess1.wsdl" importType="wsdl"/> <import namespace="http://xmlns.example.com/CustomApps/EchoBPELSync/ BPELProcess1"location="http://hostname:port/soa-infra/services/default/EchoBPEL Sync/BPELProcess1.wsdl" importType="wsdl"/>
to use
httpsandsslport:location="https://hostname:sslport/soa-infra/services/default/EchoBPELSync /BPELProcess1.wsdl"
16.2.2 Invoking References in One-Way SSL Environments in Oracle JDeveloper
When invoking a Web service as an external reference from WebCenter Content in one-way SSL environments, ensure that the certificate name (CN) and the host name of the server exactly match. This ensures a correct SSL handshake.
For example, if a Web service is named adfbc and the certificate has a server name of host, the following results in a SSL handshake exception.
<import namespace="/adfbc1/common/"
location="https://host.example.com:8002/CustomApps-adfbc1-context-root/AppModuleService?WSDL"
importType="wsdl"/>
<import namespace="/adfbc1/common/" location="Service1.wsdl"
importType="wsdl"/>
If you switch the order of import, the SSL handshake passes.
<import namespace="/adfbc1/common/" location="Service1.wsdl"
importType="wsdl"/>
<import namespace="/adfbc1/common/"
location="https://host.example.com:8002/CustomApps-adfbc1-context-root/AppModuleService?WSDL"
importType="wsdl"/>
Note the following restrictions around this issue:
-
There are no options for ignoring host name verification in Oracle JDeveloper as exist with the Oracle WebLogic Server Administration Console. This is because the SSL kit used by Oracle JDeveloper is different. Only the trust store can be configured from the command line. All other certificate arguments are not passed.
-
In the WSDL file,
https://hostnamemust match with that in the certificate, as described above. You cannot perform the same procedures as you can with a browser. For example, if the host name ishost.example.comin the certificate's CN, then you can usehost,host.example.com, or the IP address from a browser. In Oracle JDeveloper, always use the same name as in the certificate (that is,host.example.com).
16.2.3 Configuring WebCenter Content, Oracle HTTP Server for SSL Communication
Follow these procedures to configure SSL communication between WebCenter Content and Oracle HTTP Server.
See Configuring SSL for the Web Tier in Administering Oracle Fusion Middleware.
To configure Oracle HTTP Server for SSL communication:
-
Append
ssl.confwith the<Location /cs>location directive, whereportis the port number of the target managed server.<Location /cs> WebLogicPort 8002 SetHandler weblogic-handler ErrorPage http://host.example.com:port/error.html </Location> -
Start the Oracle WebLogic Server as described in Configuring WebCenter Content for Two-Way SSL Communication .
To configure certificates for Oracle Client, Oracle HTTP Server, and Oracle WebLogic Server:
16.2.4 Switching from Non-SSL to SSL Configurations for WebCenter Content
Switching from non-SSL to SSL configurations for WebCenter Content requires the Frontend Host and Frontend HTTPS Port fields to be set in the Oracle WebLogic Server Administration Console. Not doing so results in exception errors when you attempt to create to-do tasks.
- Log in to the
wls_console. - In the Environment section, select Servers.
- Select the name of the managed server (for example,
UCM_server1). - Select Protocols, then select HTTP.
- In the Frontend Host field, enter the host name on which the WebCenter Content domain is located.
- In the Frontend HTTPS Port field, enter the SSL listener port.
- Click Save.
16.2.5 Using a Custom Trust Store for One-Way SSL
To invoke WebCenter Content over HTTPS when using a custom trust store created with a tool such as keytool or orapki, perform the following actions in Oracle JDeveloper:
16.2.6 Enabling an Asynchronous Process to Invoke an Asynchronous Process
To enable an asynchronous process deployed to a SSL-enabled, managed server to invoke another asynchronous process over HTTP, start by assuming you create the following environment:
-
Asynchronous BPEL process A that invokes asynchronous BPEL process B
-
Asynchronous BPEL process A is deployed to a one-way SSL enabled, managed server
-
All WSDL reference and bindings use plain HTTP
At run time, the WSDL is looked for over HTTPS, and the callback message from asynchronous BPEL process B fails.
To resolve this issue, the callbackServerURL property must be passed at the reference binding level in the composite.xml file. This explicitly indicates the value of the callback URL for the given reference invocation. If the client composite is running in a SSL-managed server, then the callback defaults to SSL.
<reference name="Service1" ui:wsdlLocation="http://localhost:8000/soa-infra/services/default/
AsyncSecondBPELMTOM/BPELProcess1.wsdl">
<interface.wsdl interface="http://xmlns.example.com/Async/AsyncSecondBPELMTOM/BPELProcess1#
wsdl.interface(BPELProcess1)" callbackInterface="http://xmlns.example.com/Async/
AsyncSecondBPELMTOM/BPELProcess1#wsdl.interface(BPELProcess1Callback)"/>
<binding.ws port="http://xmlns.example.com/Async/AsyncSecondBPELMTOM/BPELProcess1#
wsdl.endpoint(bpelprocess1_client_ep/BPELProcess1_pt)"
location="http://localhost:8000/soa-infra/services/default/AsyncSecondBPELMTOM
/bpelprocess1_client_ep?WSDL">
<wsp:PolicyReference URI="oracle/wss_username_token_client_policy"
orawsp:category="security" orawsp:status="enabled"/>
<wsp:PolicyReference URI="oracle/wsaddr_policy" orawsp:category="addressing"
orawsp:status="enabled"/>
<property name="callbackServerURL">http://localhost:8000/</property>
</binding.ws>
<callback>
<binding.ws port="http://xmlns.example.com/Async/AsyncSecondBPELMTOM/BPELProcess1#
wsdl.endpoint(bpelprocess1_client_ep/BPELProcess1Callback_pt)">
<wsp:PolicyReference URI="oracle/wss_username_token_service_policy"
orawsp:category="security" orawsp:status="enabled"/>
</binding.ws>
</callback>
</reference> 16.3 Configuring WebCenter Content for Single Sign-On
You can configure one of these single sign-on (SSO) solutions for Oracle WebCenter Content:
-
Oracle Access Manager 11g
-
Oracle Access Manager 10g
-
Oracle Single Sign-On (OSSO)
-
Windows Native Authentication (WNA)
Oracle Access Manager (OAM) is the recommended single sign-on (SSO) solution for Oracle Fusion Middleware enterprise-class installations including WebCenter Content. OAM is part of Oracle's suite of enterprise-class products for identity management and security.
If your enterprise-class installation uses Microsoft desktop logins that authenticate with a Microsoft domain controller with user accounts in Active Directory, then configuring Windows Native Authentication (WNA) single sign-on may be an option. For more information about WNA, see Configuring WebCenter Content and Single Sign-On for Windows Native Authentication.
For an overview of Oracle WebLogic Server authentication providers, see Configuring Authentication Providers in Administering Security for Oracle WebLogic Server.
Note:
WebDAV (/dav) is protected by basic authentication per WebDAV protocol and is not protected by SSO, which typically requires form-based login. If you want to use a custom SSO solution for WebDAV, then a custom component is necessary.
Configuration information is provided in the following sections:
16.3.1 Configuring Oracle Access Manager 12c with WebCenter Content
This section describes how to integrate WebCenter Content with Oracle Access Manager (OAM) 12c. Configuration information is provided for Oracle WebCenter Content: Content Server (CS), Oracle WebCenter Content: Inbound Refinery (IBR), and Oracle WebCenter Content: Site Studio (SS).
-
Configure OAM 12c, Oracle HTTP Server (OHS), and WebGate as described in Administrator’s Guide for Oracle Access Management for All Platforms.
-
Append entries to the
mod_wl_ohs.conffile to add WebCenter Content Uniform Resource Identifiers (URIs) to forward. Use the appropriate location entries from the following example. Each entry in the example maps the incoming path to the appropriate Oracle WebLogic Server on which the corresponding application resides.In the following list of entries, hostname represents the name of the computer hosting the Content Server, and portnumber represents the port number of the Oracle WebLogic Server on which the corresponding applications resides. Replace hostname and portnumber with your system's host name and port name.
Note:
The URIs you forward depend on the WebCenter Content functionality that you have installed. Use the appropriate location entry for your functionality. For example:
/cs,/adfAuthentication,/_ocsh,/ibr.For Site Studio, the URI to forward is configured by the customer. For example, if the site is accessed as
/mysite, then you need to append a location entry for/mysite.Caution:
The Content Server location
/cscan be customized, so the/csdesignation can't guarantee that HTTP requests will include the correct location. If/cshas been changed, then forward the location the administrator has configured.# Content Server <Location /cs> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # Content Server authentication <Location /adfAuthentication> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # WebCenter online help <Location /_ocsh> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # IBR <Location /ibr> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location># SS <Location /customer-configured-site-studioSetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> -
Use the OAM 12c remote registration tool (
oamreg) to register an OAM Agent, specifying Oracle WebCenter Content URIs to protect and to make public.See Administrator’s Guide for Oracle Access Management for All Platforms.
Note:
The URIs you protect and make public depend on the WebCenter Content functionality that you have installed: Content Server (CS), Inbound Refinery (IBR), Site Studio (SS).
For Site Studio, the URI to protect is configured by the customer. For example, if the site is accessed as
/mysite, then you need to specify the URI/mysite.Functionality Type URI CS
Protect
/adfAuthenticationCS
Public
/csCS
Public
/_ocshIBR
Protect
/ibr/adfAuthenticationIBR
Public
/ibrSS
Protect
/customer_configured_site_studio -
Add the URL
/oamsso/logout.htmlto the logout URL setting for the AccessGate so the single sign-on logout works properly. See Configuring Centralized Logout for Sessions Involving OAM WebGates in Oracle Fusion Middleware Administrator’s Guide for Oracle Access Management.
-
-
Configure the WebCenter Content domain by ensuring you perform these tasks.
-
Configure the OAM Identity Asserter. The control flag for the OAM Identity Asserter must be set to
REQUIRED, and bothOAM_REMOTE_USERandObSSOCookiemust be selected as Active Types. -
Configure the Authentication provider. This is necessary to specify the external LDAP server for the user store, such as Oracle Internet Directory (OID) or Oracle Virtual Directory (OVD), to match the LDAP server used by OAM. For example, if OAM is using OID, then an OID Authentication provider must be added to the WebCenter Content domain.
Note:
When you configure the Oracle WebLogic Server for WebCenter Content to use an authentication provider other than the default one, ensure that it is the first authentication provider listed in the security realm configuration; otherwise, WebCenter Content will fail to load any user privileges. You can re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the
DefaultAuthenticatorcontrol flag is set toSUFFICIENT. For more information, see Configuring the First Authentication Provider. -
Configure the OPSS (OAM) Single Sign-On provider.
-
-
After installing and configuring OAM 12c, check that you can access all of the configured applications, and that the login is giving you access to all of your configured applications without prompting you to sign in again. Also test global logout where available and make sure you are logged out of all other related applications.
16.3.2 Configuring Oracle Access Manager 11g with WebCenter Content
This section describes how to integrate WebCenter Content with Oracle Access Manager (OAM) 11g. Configuration information is provided for Oracle WebCenter Content: Content Server (CS), Oracle WebCenter Content: Inbound Refinery (IBR), and Oracle WebCenter Content: Site Studio (SS).
Before you can configure OAM 11g, install the software using the instructions provided in Installing and Configuring Oracle Identity Management in Oracle Fusion Middleware Installation Guide for Oracle Identity Management , 11g Release 1 (11.1.1.9.0).
-
Configure OAM 11g, Oracle HTTP Server (OHS), and WebGate as described in Administrator’s Guide for Oracle Access Management for All Platforms.
-
Append entries to the
mod_wl_ohs.conffile to add WebCenter Content Uniform Resource Identifiers (URIs) to forward. Use the appropriate location entries from the following example. Each entry in the example maps the incoming path to the appropriate Oracle WebLogic Server on which the corresponding application resides.In the following list of entries, hostname represents the name of the computer hosting the Content Server, and portnumber represents the port number of the Oracle WebLogic Server on which the corresponding applications resides. Replace hostname and portnumber with your system's host name and port name.
Note:
The URIs you forward depend on the WebCenter Content functionality that you have installed. Use the appropriate location entry for your functionality. For example:
/cs,/adfAuthentication,/_ocsh,/ibr.For Site Studio, the URI to forward is configured by the customer. For example, if the site is accessed as
/mysite, then you need to append a location entry for/mysite.Caution:
The Content Server location
/cscan be customized, so the/csdesignation can't guarantee that HTTP requests will include the correct location. If/cshas been changed, then forward the location the administrator has configured.# Content Server <Location /cs> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # Content Server authentication <Location /adfAuthentication> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # WebCenter online help <Location /_ocsh> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # IBR <Location /ibr> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location># SS <Location /customer-configured-site-studioSetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> -
Use the OAM 11g remote registration tool (
oamreg) to register an OAM Agent, specifying Oracle WebCenter Content URIs to protect and to make public.See Administrator’s Guide for Oracle Access Management for All Platforms.
Note:
The URIs you protect and make public depend on the WebCenter Content functionality that you have installed: Content Server (CS), Inbound Refinery (IBR), Site Studio (SS).
For Site Studio, the URI to protect is configured by the customer. For example, if the site is accessed as
/mysite, then you need to specify the URI/mysite.Functionality Type URI CS
Protect
/adfAuthenticationCS
Public
/csCS
Public
/_ocshIBR
Protect
/ibr/adfAuthenticationIBR
Public
/ibrSS
Protect
/customer_configured_site_studio -
Add the URL
/oamsso/logout.htmlto the logout URL setting for the AccessGate so the single sign-on logout works properly. See Configuring Centralized Logout for OAM 11g in Oracle Fusion Middleware Administrator’s Guide for Oracle Access Manager with Oracle Security Token Service, 11g Release 1 (11.1.1).
-
-
Configure the WebCenter Content domain by ensuring you perform these tasks.
-
Configure the OAM Identity Asserter. The control flag for the OAM Identity Asserter must be set to
REQUIRED, and bothOAM_REMOTE_USERandObSSOCookiemust be selected as Active Types. -
Configure the Authentication provider. This is necessary to specify the external LDAP server for the user store, such as Oracle Internet Directory (OID) or Oracle Virtual Directory (OVD), to match the LDAP server used by OAM. For example, if OAM is using OID, then an OID Authentication provider must be added to the WebCenter Content domain.
Note:
When the Oracle WebLogic Server domain for WebCenter Content is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or WebCenter Content will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the
DefaultAuthenticatorcontrol flag is set toSUFFICIENT. For more information, see Configuring the First Authentication Provider. -
Configure the OPSS (OAM) Single Sign-On provider.
-
-
After installing and configuring OAM 11g, check that you can access all of the configured applications, and that the login is giving you access to all of your configured applications without prompting you to sign in again. Also test global logout where available and make sure you are logged out of all other related applications.
16.3.3 Configuring Oracle Access Manager 10g with WebCenter Content
This section describes how to integrate WebCenter Content with Oracle Access Manager (OAM) 10g. Configuration information is provided for Oracle WebCenter Content Server (CS), Oracle WebCenter Content: Inbound Refinery (IBR), and Oracle WebCenter Content: Site Studio (SS).
Before you can configure OAM, install the software. See information on OAM integration in Enterprise Deployment Guide for Oracle WebCenter Content.
-
Configure OAM 10g, Oracle HTTP Server (OHS), and WebGate.
-
Append entries to the
mod_wl.conffile to add WebCenter Content Uniform Resource Identifiers (URIs) to forward. Use the appropriate location entries from the following example. The entries in the followingLocationlist map the incoming paths to the appropriate Oracle WebLogic Server on which the corresponding applications reside.In the following list of entries, hostname represents the name of the computer hosting the Content Server, and portnumber represents the port number of the Oracle WebLogic Server on which the corresponding applications resides. Replace hostname and portnumber with your system's host name and port name.
Note:
The URIs you forward depend on the WebCenter Content functionality that you have installed. Use the appropriate location entry for your functionality. For example:
/cs,/adfAuthentication,/_ocsh,/ibr.For Site Studio, the URI to forward is defined by the customer. For example, if the site is accessed as
/mysite, then you need to append a location entry for/mysite.Caution:
The Content Server location
/cscan be customized, so the/csdesignation can't guarantee that HTTP requests will include the correct location. If/cshas been changed, then forward the location the administrator has configured.# Content Server <Location /cs> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # Content Server authentication <Location /adfAuthentication> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # WebCenter online help <Location /_ocsh> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # IBR <Location /ibr> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location># SS <Location /customer-configured-for-site-studio> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portname> </Location> -
Use the OAM 10g configuration tool (OAMCfgTool) to specify WebCenter Content URIs to protect.
The OAM Configuration tool is a command-line utility you can use to launch a series of scripts to request information and set up the required profiles and policies in OAM.
Note:
The URIs you protect depend on the WebCenter Content functionality that you have installed: Oracle WebCenter Content (CS), Inbound Refinery (IBR), Site Studio (SS).
For Site Studio, the URI to protect is configured by the customer. For example, if the site is accessed as
/mysite, then you need to specify the URI/mysite.Functionality URI CS
/adfAuthenticationIBR
/ibr/adfAuthenticationSS
/customer_configured_site_studioNote:
If the URL for WebCenter Content does not link correctly after completing the OAM configuration, you might need to change the server host and server port values. For more information, see Configuring the WebCenter Content URL for Single Sign-On.
-
Configure the WebGate to handle the
end_urlin order to complete the setup for OAM global logout. Without this additional configuration, you are logged out, but not redirected to the end URL becauseend_urlis not processed. -
Add the URL
/oamsso/logout.htmlto the logout URL setting for the AccessGate so the single sign-on logout works properly. See Configuring Centralized Logout for OAM 11g in Oracle Fusion Middleware Administrator’s Guide for Oracle Access Manager with Oracle Security Token Service, 11g Release 1 (11.1.1).Note:
Deploying WebCenter Content version 11gR1 in an environment using OAM version 10g requires additional configuration to process logout requests properly.
-
-
Configure the WebCenter Content domain by performing the following tasks.
-
Configure the OAM Identity Asserter. The control flag for the OAM Identity Asserter must be set to
REQUIRED. -
Configure the Authentication provider. This is necessary to specify the external LDAP server for the user store, such as Oracle Internet Directory (OID) or Oracle Virtual Directory (OVD), to match the LDAP server used by OAM. For example, if OAM is using OID, then an OID Authentication provider must be added to the Oracle WebCenter Content domain.
Note:
When the Oracle WebLogic Server domain for WebCenter Content is configured to use a different authentication provider than the
DefaultAuthenticatorprovider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or WebCenter Content will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set toSUFFICIENT. For more information, see Configuring the First Authentication Provider. -
Configure the OPSS (OAM) Single Sign-On provider.
-
-
After installing and configuring OAM 10g, check that you can access all of the configured applications, and that the login is giving you access to all of your configured applications without prompting you to sign in again. Also test global logout where available and make sure you are logged out of all other related applications.
16.3.4 Configuring Oracle Single Sign-On for WebCenter Content
Oracle Single Sign-On (OSSO) is part of the 12c Oracle Application Server suite. OSSO is an enterprise-level single sign-on solution that works with the application server in conjunction with Oracle Internet Directory and Oracle HTTP Server (OHS) 12c.
If OSSO is already in place as the enterprise solution for your existing Oracle deployment, Oracle Fusion Middleware continues to support the existing OSSO as a solution. However, Oracle recommends that you consider upgrading to OAM 12c Single Sign-On solution.
This section provides information for integrating WebCenter Content with OSSO. Configuration information is provided for Oracle WebCenter Content Server (CS), Oracle WebCenter Content: Inbound Refinery (IBR), and Oracle WebCenter Content: Site Studio (SS).
Before you can configure OSSO, ensure that the software is installed. OSSO and Oracle Delegated Administration Service are not part of the 11g release. Customers must download the 10.1.4.* versions of these products, which are compatible with 11g Oracle Internet Directory and Oracle Directory Integration Platform, to form what was known in 10g as the Application Server Infrastructure. For deployment instructions on these 10g products, read "Installing and Configuring JAZN-SSO/DAS" in the Oracle Application Server Enterprise Deployment Guide (B28184-02) for Oracle Identity Management release 10.1.4.0.1. This manual is available on Oracle Technology Network at:
http://download.oracle.com/docs/cd/B28196_01/core.1014/b28184/toc.htm
-
Configure OSSO.
-
Append WebCenter Content Uniform Resource Identifier (URI) entries to the
mod_wl_ohs.conffile. Use the appropriate location entries from the following example. Each entry in the example maps the incoming path to the appropriate Oracle WebLogic Server on which the corresponding application resides.In the following list of entries, hostname represents the name of the computer hosting the Content Server, and portnumber represents the port number of the Oracle WebLogic Server on which the corresponding applications resides. Replace hostname and portnumber with your system's host name and port name.
Note:
The URIs you forward depend on the WebCenter Content functionality that you have installed. Use the appropriate location entry for your functionality. For example:
/cs,/adfAuthentication,/_ocsh,/ibr.For Site Studio, the URI to forward is configured by the customer. For example, if the site is accessed as
/mysite, then you need to append a location entry for/mysite.Caution:
The Content Server location
/cscan be customized, so the/csdesignation can't guarantee that HTTP requests will include the correct location. If/cshas been changed, then forward the location the administrator has configured.# Content Server <Location /cs> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # Content Server authentication <Location /adfAuthentication> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # WebCenter online help <Location /_ocsh> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> # IBR <Location /ibr> SetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location># SS <Location /customer-configured-site-studioSetHandler weblogic-handler WebLogicHost <hostname> WebLogicPort <portnumber> </Location> -
Modify the
mod_osso.conffile (atORACLE_HOME/ohs/conf/) to include WebCenter Content Uniform Resource Identifiers (URIs) to protect.Note:
The URIs you protect depend on the WebCenter Content functionality that you have installed: Content Server (CS), Inbound Refinery (IBR), and Site Studio (SS).
For Site Studio, the URI to protect is configured by the customer. For example, if the site is accessed as
/mysite, then you need to specify the URI/mysite.Functionality URI CS
/adfAuthenticationIBR
/ibr/adfAuthenticationSS
/customer_configured_site_studio
-
-
Configure the WebCenter Content domain by ensuring you perform these tasks.
-
Add and configure the OSSO Identity Asserter for the Oracle WebLogic Server for WebCenter Content. Oracle recommends the following Authentication Providers: OSSO Identity Asserter, OID Authenticator, Default Authenticator.
The OID Authenticator provider is for the Oracle Internet Directory server, which is used in production-level systems. The Default Authenticator provider is for the Oracle WebLogic Server embedded LDAP server.
Ensure that OSSOIdentityAsserter is set as the primary provider authenticator for the domain, so that user profiles can be retrieved from the associated Oracle Internet Directory server. If necessary, reorder the providers so they appear in the following order, with control flags set as listed:
OSSOIdentityAsserter (
REQUIRED)OIDAuthenticator (
SUFFICIENT)DefaultAuthenticator (
SUFFICIENT)Note:
When the Oracle WebLogic Server domain for WebCenter Content is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or WebCenter Content will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the
DefaultAuthenticatorcontrol flag is set toSUFFICIENT. For more information, see Configuring the First Authentication Provider. -
Configure the Authentication provider. This is necessary to specify the external LDAP server for the user store, such as Oracle Internet Directory (OID) or Oracle Virtual Directory (OVD), to match the LDAP server used by OAM. For example, if OSSO is using OID, then an OID Authentication provider must be added to the WebCenter Content domain.
-
Note:
If the URL for WebCenter Content does not link correctly after completing the OSSO configuration, you might need to change the server host and server port values. For more information, see Configuring the WebCenter Content URL for Single Sign-On.
16.3.5 Configuring the First Authentication Provider
When the Oracle WebLogic Server domain for WebCenter Content is configured to use an authentication provider other than its default authentication provider for user authentication (such as Oracle Internet Directory or another LDAP provider), the primary provider must be the first authentication provider listed in the security realm configuration, or login authentication will fail.
If the primary provider is not listed first (for example, it is listed below the Oracle WebLogic Server provider, DefaultAuthenticator), then WebCenter Content will fail to successfully load users' Group membership and therefore fail to load any user privileges. You can use the Oracle WebLogic Server Administration Console to change the order in which the configured authentication providers are called. See Configuring Authentication Providers in Administering Security for Oracle WebLogic Server.
Note:
When you use Oracle Internet Directory, all WebCenter Content administrator and other users must be defined in Oracle Internet Directory.
Note:
Content Server assigns a Content Server administrator role to administrative users defined in the internal Oracle WebLogic Server user store. This is true regardless of whether Oracle Internet Directory is used or not used. However, if you use Oracle Internet Directory and the Oracle Internet Directory Authentication provider is not listed first, then any request by the Content Server instance to retrieve the roles of the Oracle WebLogic Server defined administrative users will fail.
Note:
As of 11g Release 1 (11.1.1.6.0) Oracle WebCenter Content supports use of the Oracle Virtual Directory library (libOVD) feature, which enables a site to use multiple providers for login and group membership information. For example, it would be possible to use both Oracle Internet Directory (OID) and Active Directory as sources of user and role information. For more information about multi-LDAP configuration in Oracle WebLogic Server, see Configuring the Service for Multiple LDAP using Fusion Middleware Control in Oracle Fusion Middleware Application Security Guide.
16.3.6 Configuring the WebCenter Content URL for Single Sign-On
When you configure an Oracle application for use with Single Sign-On (SSO) and have set up Oracle Access Manager (OAM) or Oracle Single Sign-On (OSSO), the WebCenter Content GET_ENVIRONMENT service provides the server name, server port, and relative webroot to the application service call (for example, the WebCenter Content Doclib service). However, the values provided by GET_ENVIRONMENT might not be correct for your SSO configuration.
If you want to redirect the application service to use the OHS server host and server port (because both OAM and OSSO solutions require front-end applications with OHS), you must modify the Content Server host and server port configuration values.
You can use either of the following two methods to modify the Content Server host and server port values:
-
Use the Oracle WebLogic Server Administration Console.
-
Use the WebCenter Content standalone System Properties application.
-
Go to the WebCenter Content domain directory.
-
Change the directory to ucm/cs/bin
-
Run the standalone application: ./SystemProperties
-
In the System Properties window, select the Internet tab.
-
Update the HTTP Server address to the OHS (or Load Balancer) server host and server port values.
-
Exit the System Properties window.
-
Restart the Oracle WebLogic Server domain.
-
16.3.7 Configuring WebCenter Content and Single Sign-On for Windows Native Authentication
Setting up WebCenter Content and single sign-on (SSO) with Microsoft clients for Windows Native Authentication (WNA) requires configuring the Microsoft Active Directory, the client, and the Oracle WebLogic Server domain. Details including system requirements for SSO with Microsoft clients are provided in Configuring Single Sign-On with Microsoft Clients in Administering Security for Oracle WebLogic Server.
As part of configuring SSO with Microsoft clients, you must specify a LDAP authentication provider to access the external Microsoft Active Directory. Oracle WebLogic Server offers the Active Directory Authentication provider. See Configuring LDAP Authentication Providers in Administering Security for Oracle WebLogic Server.
Note:
When the Oracle WebLogic Server domain for WebCenter Content is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or WebCenter Content will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set to SUFFICIENT. For more information, see Configuring the First Authentication Provider.
As part of configuring SSO with Microsoft clients, you must configure the Negotiate Identity Assertion provider in Oracle WebLogic Server security realm. The identity assertion provider decodes Simple and Protected Negotiate (SPNEGO) tokens to obtain Kerberos tokens, validates the Kerberos tokens, and maps Kerberos tokens to WebLogic users. Use the Oracle WebLogic Server Administration Console to add a new provider in the appropriate security realm in the domain structure, assign it a name, then select NegotiateIdentityAsserter for its Type. Activate the changes and restart the Oracle WebLogic Server. Now your server can use the Kerberos ticket it receives from the browser.
You must redeploy each WebCenter Content application (Content Server, Inbound Refinery, Records) that will be used in the Windows Native Authentication (Kerberos) environment, using an associated deployment plan. A deployment plan is a XML document. Oracle provides a plan for each of the three WebCenter Content applications: Example 16-1 and Example 16-2. You also can implement a deployment plan using the Oracle WebLogic Scripting Tool.
Example 16-1 cs-deployment-plan.xml
Use the provided cs-deployment-plan.xml file, or create a .xml file and name it cs-deployment-plan.xml.
<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan
xmlns="http://xmlns.oracle.com/weblogic/deployment-plan"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd"
global-variables="false">
<application-name>cs.ear</application-name>
<variable-definition>
<variable>
<name>http-only</name>
<value>false</value>
</variable>
</variable-definition>
<module-override>
<module-name>cs.war</module-name>
<module-type>war</module-type>
<module-descriptor external="false">
<root-element>weblogic-web-app</root-element>
<uri>WEB-INF/weblogic.xml</uri>
<variable-assignment>
<name>http-only</name>
<xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
</variable-assignment>
</module-descriptor>
</module-override>
</deployment-plan>Example 16-2 ibr-deployment-plan.xml
Use the provided ibr-deployment-plan.xml file, or create a .xml file and name it ibr-deployment-plan.xml.
<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan xmlns="http://xmlns.oracle.com/weblogic/deployment-plan" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation= "http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd" global-variables="false">
<application-name>ibr.ear</application-name>
<variable-definition>
<variable>
<name>http-only</name>
<value>false</value>
</variable>
</variable-definition>
<module-override>
<module-name>ibr.war</module-name>
<module-type>war</module-type>
<module-descriptor external="false">
<root-element>weblogic-web-app</root-element>
<uri>WEB-INF/weblogic.xml</uri>
<variable-assignment>
<name>http-only</name>
<xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
</variable-assignment>
</module-descriptor>
</module-override>
</deployment-plan>16.4 Configuring Oracle Infrastructure Web Services
Oracle Infrastructure Web services provide the ability to create and attach policy sets to subjects on a global scope (domain, server, application, or SOA composite). Oracle Infrastructure Web services are implemented according to the Web services for Java EE 1.2 specification, which defines the standard Java EE runtime architecture for implementing Web services in Java. The specification also describes a standard Java EE Web service packaging format, deployment model, and runtime services, all of which are implemented by Oracle Infrastructure Web services.
16.5 Configuring WebCenter Content for Oracle Identity Cloud Service (IDCS)
Configure Single Sign-On with IDCS for WebCenter applications such as WebCenter Content Server, Enterprise Capture (console and client), WebCenter Desktop Client, WebCenter Content: Imaging, and WebCenter Content ADFUI.
16.5.1 Updating SSL.hostnameVerifier Property
To update SSL.hostnameVerifier property, do the following:
Note:
This is necessary for the IDCS provider to access IDCS.- Stop all the servers in the domain including Admin server and all managed Weblogic servers.
- Update the
SSL.hostnameVerifierproperty: - Start the Admin server.
16.5.2 Configuring IDCS Security Provider
To obtain an OAuth client for IDCS Security Provider:
- Log in to the IDCS admin console.
- Create a trusted application. In the Add Confidential Application wizard:
16.5.2.1 Configuring Oracle Identity Cloud Integrator Provider
To configure Identity Cloud Integrator Provider:
16.5.2.3 Creating Admin User in IDCS for WebCenter Content
It is important to create the Admin user in IDCS because once the managed servers are configured for SAML, the domain admin user (typically weblogic user) will not be able to log into the managed servers.
To create WLS Admin user in IDCS for WebCenter Content JaxWS connection:
16.5.2.4 Managing Group Memberships, Roles, and Accounts
Oracle Identity Cloud Service can be used for user log-in authentication and an external LDAP server (such as OID or Active Directory) can be used to get user group memberships.
For every user, the same user name will be required in both IDCS and the LDAP server. Oracle Identity Cloud Service can be used to provide the WCC user role and account group memberships.
This will require modifying OPSS and libOVD to access IDCS. The following steps are required if using IDCS for user authorization. Do not run these steps if you are using IDCS only for user authentication. Ensure that all the servers are stopped (including admin) before proceeding with the following steps:
- Run the following
script:
<MW_HOME>/oracle_common/common/bin/wlst.shNote:
It's not required to connect to the port of the Admin server. - Read the domain:
readDomain(<DOMAIN_HOME>) - Add the template:
addTemplate(“<MIDDLEWARE_HOME>/oracle_common/common/templates/wls/oracle.opss_scim_template.jar")Note:
This step may throw a warning, which can be ignored. TheaddTemplateis deprecated. UseselectTemplatefollowed byloadTemplatesin place ofaddTemplate. - Update the domain:
updateDomain() - Close the domain:
closeDomain() - Start the servers (Admin and managed).
16.5.3 Configuring WebCenter Content for User Logout
If the Logout link is selected, you will be re-authenticated by SAML. To be able to select the Logout link:
16.5.3.1 Configuring Logout for WebCenter Content and WebCenter Content: Imaging
Complete the following steps for WebCenter Content and WebCenter Content: Imaging Logout to work:
- Deselect Enable Single Logout under SSO Configuration for WebCenter Content: Imaging and WebCenter Content applications in IDCS admin console.
- The cookie path should be set to
/for WebCenter Content: Imaging in theimaging.earfile and it should be redeployed. - Set
IpmCustomLogoutURLproperty for WebCenter Content: Imaging via MBean (underoracle.imaging) in EM to this value:http://<IPM Host>:<IPM Port>/imaging/adfAuthentication?logout=true&end_url=https://<IDC Tenant id>.identity.oraclecloud.com/sso/v1/user/logout - For WebCenter Content, specify the logout URL in the WebCenter Content configuration.
Either update the
config.cfgfile or you can do it from the WebCenter Content Admin configuration page. Make the following entry and restart WebCenter Content:LogoutServerUrl=http://<UCM Hostname>:<UCM Port>/adfAuthentication?logout=true&end_url=https://<IDC Tenant id>.identity.oraclecloud.com/sso/v1/user/logout
16.5.3.2 Configuring Logout for Enterprise Capture
Complete the following steps for Enterprise Capture Logout to work:
Go to Enterprise Manager Console, open MBean browser and change the Capture's MBean attribute logoutRedirectURL to https://<IDCS Tenantid>.identity.oraclecloud.com/sso/v1/user/logout. Save the changes. This change is effective immediately. To unset this attribute's value, put any empty string.
- The cookie path of
/dc-clientand/dc-consoleshould be set to/in thecapture.earfile and it should be redeployed. - Go to the Enterprise Manager console, open the MBean browser and change the Capture's
MBean attribute
logoutRedirectURLtohttps://<IDCS Tenantid>.identity.oraclecloud.com/sso/v1/user/logout. Save the changes. This change is effective immediately. To unset this attribute's value, add an empty string.
16.5.3.3 Configuring Logout for ADFUI
For WebCenter Content ADFUI Logout feature to work, do the following:
- Go to Enterprise Manager Console, open the System MBean browser.
- Expand the Application Defined MBeans and
oracle.adf.share.configand change theWccAdfConfigurationMBean attributecustomLogoutUrlto https://<IDCSTenantid>.identity.oraclecloud.com/sso/v1/user/logout. - Save the changes to the parent MBean by invoking the save operation.
- This change is effective after restarting the UI server.
To unset the attribute's value, add any empty string.
16.6 Configuring SAML-Based Single Sign-On
Security Assertion Markup Language (SAML) enables cross-platform user authentication between web-based applications or web services in a WebLogic Server domain and web browsers or other HTTP clients. When users log in to a website of the application that is part of a single sign-on network, they automatically gain access to all the applications in that network without having to log in separately in to each application.
16.6.1 SAML Components
A SAML-based single-sign on setup includes the following components:
-
SAML Credential Mapping: The SAML Credential Mapping provider allows WebLogic Server to act as a source site for using SAML for single sign-on. This provider generates valid SAML 1.1 assertions for authenticated subjects based on the configuration of the target site or resource.
- Inter Site Transfer Service (ITS): An addressable component that generates identity assertions and transfers the user to the destination site.
- Assertion Retrieval Service (ARS): An addressable component that returns the SAML assertion corresponding to the artifact. You can allocate the assertion ID at the time of generating the assertion.
- SAML Identify Asserter: The SAML Identity Assertion provider allows the WebLogic Server to act as a destination site for using SAML for single sign-on. This provider processes valid SAML 1.1 assertions for authenticated subjects obtained from the source site or resource.
- Assertion Consumer Service (ACS): An addressable component that receives assertions and/or artifacts generated by ITS and uses them to authenticate users at the destination site.
- SAML Relying Party: A SAML Relying Party is an entity that relies on the information in a SAML assertion produced by the SAML source site. You can configure SAML assertions for each Relying Party or use the defaults established by the Federation Services source site configuration for producing assertions.
- SAML Asserting Party: A SAML Asserting Party is a trusted SAML Authority, which asserts security information in the form of SAML assertions.
16.6.2 SAML Single Sign-On Perquisites
-
Create a domain with WebCenter Content and Portal servers: Applicable for SAML configurations with Content Server as a source and Portal as a destination.
- Create a domain with WebCenter Content and ADF UI servers: Applicable for SAML configurations with Content Server as a source and Application Development Framework (ADF) as a destination.
- Create a domain with WebCenter Content and Imaging servers: Applicable for SAML configurations with Content Server as a source and Imaging as a destination.
- Hiding Login Area for WebCenter Portal Landing Page
Note:
The instructions assume that you have already installed WebCenter Content and associated components.
These port numbers are used for source, destination, and SSL as examples:
Source-SSL Ports:
CS: 16200, SSL: 16201
Destination-SSl Ports:
Portal: 8888, SSL: 8788
Imaging: 16000, SSL: 16001
ADF UI: 16225, SSL: 16226
Note:
You can configure the port numbers based on your requirement.16.6.2.2 Enabling SSL for Destination Services
16.6.2.4 Hiding Login Area for WebCenter Portal Landing Page
- Open
$MIDDLEWARE_HOME/user_projects/domains/ domain_name/bin/setDomainEnv.sh.and update the following property:EXTRA_JAVA_PROPERTIES="-Doracle.webcenter.spaces.osso=true ${EXTRA_JAVA_PROPERTIES}"- export
EXTRA_JAVA_PROPERTIES
- Restart the Portal Server.
16.6.3 Configuring SAML 1.1 Source Services
You can configure a Content Server instance to function as a SAML source site that provides an Intersite Transfer Service (ITS). A source site generates assertions that are conveyed to a destination site using one of the single sign-on profiles.
The section covers the following topics:
16.6.4 Configuring SAML 1.1 Destination Services
To configure the SAML destination services, you must first configure a SAML Identity Asserter in the server's Security Realm. You can configure a WebLogic Server instance to function as a SAML destination site. A destination site receives SAML assertions and uses them to authenticate local subjects.
This section covers the following topics:
16.6.4.1 Creating Identity Asserters
16.6.5 Configuring SAML 2.0 (IDCS) Single Sign-On
- WebCenter Content Server (see Configuring WebCenter Content for Oracle Identity Cloud Service (IDCS))
- WebCenter Desktop Client
- Enterprise Capture (console and client)
- WebCenter Content ADFUI
- WebCenter Content: Imaging
The following topics are covered:
- Configuring SAML 2.0 Asserter
- Configuring Weblogic Managed Servers as SAML 2.0 SSO Service Providers
- Completing SAML 2.0 Identity Asserter Configuration
- Creating SAML Applications in IDCS
- Assigning Groups to SAML Applications
- Modifying Cookie Path
- Configuring Oracle HTTP Server
- Configuring Desktop Client
16.6.5.2 Configuring Weblogic Managed Servers as SAML 2.0 SSO Service Providers
To configure the Weblogic Managed Servers as SAML 2.0 SSO Service Providers:
16.6.5.3 Completing SAML 2.0 Identity Asserter Configuration
To complete SAML 2.0 Identity Asserter Configuration:
16.6.5.5 Assigning Groups to SAML Applications
For users to be authenticated through the IDCS SAML, users must be added to the SAML application. If users are members of an IDCS group, that group can be added to the application and those users will be authenticated. If IDCS will be used for user WCC authorization, the groups that will be used for corresponding WCC roles that can be added to the application (as WCC users will already be members of those groups).
To assign groups to SAML applications:
16.6.5.6 Modifying Cookie Path
For SAML 2.0, cookie path must be set to "/". Follow these steps to update cookie
path to “/” for capture.ear and WccAdf.ear:
Note:
Before you make changes, take a backup copy of theear file.
16.6.5.7 Configuring Oracle HTTP Server
For each OHS location, you must have a unique URI so that there can be only one
<Location /saml2>. If there are multiple managed servers configured
for SAML, then each managed server requires its own unique location.
After OHS installation and configuration is done, the
mod_wl_ohs file have the routing rules. Additionally, ensure the below
port mappings are there:
/saml2mapped to port for Content server./saml2_capturemapped to port for Capture./saml2_wccmapped to port for Content UI.
16.6.5.7.1 Manual Deployment of
saml2.war File
As different SAML2 context roots will be used for each of the SAML2 applications,
for each managed server or cluster, the saml2.war application needs to be
deployed manually, except of the managed server or cluster that will use the SAML2 context
root where it’s already automatically deployed.
16.6.5.8 Configuring Desktop Client
For Desktop client to be able to recognize an IDP’s login page, the string
<!--IdcClientLoginForm=1--> needs to be added to the SSO provider’s
login page. As this string can’t be added to the default IDCS login page, hence we need to
build a custom sign-in page so that we can add the string to that page.
Creating a Custom Sign-in Page in IDCS
To configure the custom sign-in page, see Customize the Oracle Identity Cloud Service Sign-In Page.
For Step 2 in the above link, Configure an Application to Use the Custom Sign-In Page, we need not create a new application instead use the existing SAML application for the WebCenter Content server. We need to update only the Custom Login URL field.
Note:
- This tutorial uses localhost:3000 to host the sample custom sign-in application. If you deploy this application to another location, update the Custom Login URL field with the corresponding URL for the sign-in sample application.
- Don't deploy the custom sign-in application in the same domain, URL and server where you host your other applications. The sign-in page needs to be deployed as a single central service accessible to all other applications and users.
- After performing the above steps, the WebCenter Content server would also get redirected to the custom sign-in page instead of the default IDCS login page.