This chapter includes the following topics:
For more information about Oracle Fusion Middleware and Oracle WebLogic Server security, see the documentation listed in Table 16-2.
Table 16-1 Security Documentation
| For Information On... | See The Following Guide... |
|---|---|
|
Securing Oracle Fusion Middleware |
Securing Applications with Oracle Platform Security Services |
|
Securing and administering Web services |
|
|
Understanding Oracle WebLogic Server security |
|
|
Securing an Oracle WebLogic Server production environment |
Securing a Production Environment for Oracle WebLogic Server |
|
Securing Oracle WebLogic Server |
Administering Security for Oracle WebLogic Server 12c (12.2.1) |
|
Developing new security providers for use with Oracle WebLogic Server |
|
|
Securing Web service for Oracle WebLogic Server |
|
|
Programming security for Oracle WebLogic Server |
Oracle WebCenter Content runs on Oracle WebLogic Server. The Oracle WebLogic Server domain includes an embedded Lightweight Directory Access Protocol (LDAP) server that acts as the default security provider data store for the Default Authentication, Authorization, Credential Mapping, and Role Mapping providers. WebCenter Content provides the default JpsUserProvider to communicate with Oracle WebLogic Server. See Managing the Embedded LDAP Server in Administering Security for Oracle WebLogic Server 12c (12.2.1), and Configure the Embedded LDAP Server in Oracle WebLogic Server Administration Console Online Help.
In almost all cases, an Oracle WebCenter Content production system identity store must be reassociated with an external LDAP authentication provider rather than use the embedded LDAP server. Once the new LDAP authentication provider is configured, then you migrate users from the embedded LDAP provider to the new LDAP provider. The external LDAP authentication provider, such as Oracle Internet Directory (OID), must be listed before all other authentication providers including the default authentication provider. See Reassociating the Identity Store with an External LDAP Authentication Provider in Oracle Fusion Middleware Installing and Configuring Oracle WebCenter Content, 11g Release 1 (11.1.1.9).
Note:
As of 11g Release 1 (11.1.1.6.0) Oracle WebCenter Content supports use of the Oracle Virtual Directory library (libOVD) feature, which enables a site to use multiple providers for login and group membership information. For example, it would be possible to use two Oracle Internet Directory (OID) providers as sources of user and role information. See Configuring Single and Multiple LDAPs in Securing Applications with Oracle Platform Security Services.
Table 16-2 lists some of the LDAP providers that can be configured for user authentication.
Table 16-2 LDAP Authenticator Types
| LDAP Servers | Authenticator Providers |
|---|---|
|
Microsoft AD |
ActiveDirectoryAuthenticator |
|
SunOne LDAP |
IPlanetAuthenticator |
|
Oracle Directory Server Enterprise Edition (ODSEE) |
IPlanetAuthenticator |
|
Oracle Unified Directory (OUD) |
IPlanetAuthenticator |
|
Oracle Internet Directory |
OracleInternetDirectoryAuthenticator |
|
Oracle Virtual Directory |
OracleVirtualDirectoryAuthenticator |
|
EDIRECTORY |
NovellAuthenticator |
|
OpenLDAP |
OpenLDAPAuthenticator |
|
EmbeddedLDAP |
DefaultAuthenticator |
If you want to configure WebCenter Content to use an external LDAP server and have dynamic groups (as well as static groups) on your Directory whose privileges you want recognized by WebCenter Content, additional configuration is necessary. User creation, authentication, and authorization is managed using Oracle Platform Services Security (OPSS), which uses a different mechanism to gather Directory Server information when compared to the native Oracle WebLogic Server providers for an external LDAP server. See Oracle WebCenter and Dynamic Groups from an External LDAP Server blog.
You can configure Oracle Fusion Middleware to secure communications with WebCenter Content using SSL, which is an industry standard for securing communications. Oracle Fusion Middleware supports SSL version 3, as well as TLS version 1.
This section covers the following topics:
Invoking References in One-Way SSL Environments in Oracle JDeveloper
Configuring WebCenter Content, Oracle HTTP Server for SSL Communication
Switching from Non-SSL to SSL Configurations for WebCenter Content
Enabling an Asynchronous Process to Invoke an Asynchronous Process
For additional information, see Configuring SSL in Administering Security for Oracle WebLogic Server 12c (12.2.1). For information on Web Tier configuration, see SSL Configuration in Oracle Fusion Middleware in Administering Oracle Fusion Middleware.
WebCenter Content uses the Oracle WebLogic Server secure socket layer (SSL) stacks for two-way SSL configurations.
For the inbound Web service bindings, WebCenter Content uses the Oracle WebLogic Server infrastructure and, therefore, the Oracle WebLogic Server libraries for SSL.
For the outbound Web service bindings, WebCenter Content uses JRF HttpClient and, therefore, the Oracle Sun JDK libraries for SSL.
Due to this difference, start Oracle WebLogic Server with the following JVM option:
Open the following file:
On UNIX operating systems, open $MIDDLEWARE_HOME/user_projects/domains/domain_name/bin/setDomainEnv.sh.
On Window operating systems, open MIDDLEWARE_HOME\user_projects\domains\domain_name\bin\setDomainEnv.bat.
Add the following lines in the JAVA_OPTIONS section, if the server is enabled for one-way SSL (server authorization only):
-Djavax.net.ssl.trustStore=your_truststore_location
For two-way SSL, the keystore information (location and password) is not required.
To enable two-way SSL for WebCenter Content to invoke another application:
Note:
Both the server and client are assumed to have been configured for SSL with mutual authentication.
On the client side, provide the keystore location.
From the SOA Infrastructure menu, choose SOA Administration, then Common Properties.
At the bottom of the page, click More SOA Infra Advanced Configuration Properties.
Click KeystoreLocation.
In the Value column, enter the keystore location.
Click Apply.
Click Return.
On the client side, provide the keystore location in DOMAIN_HOME\config\soa-infra\configuration\soa-infra-config.xml.
<keystoreLocation>absolute_path_to_the_keystore_location_and_the_file_name
</keystoreLocation>
During design time in Oracle JDeveloper, update the reference section in the composite.xml file with the oracle.soa.two.way.ssl.enabled property.
<reference name="Service1"
ui:wsdlLocation=". . .">
<interface.wsdl interface=". . ."/>
<binding.ws port=". . .">
<property name="oracle.soa.two.way.ssl.enabled">true</property>
</binding.ws>
</reference>
In Oracle Enterprise Manager Fusion Middleware Control Console, select WebLogic Domain, then domain_name.
Right-click domain_name and select Security, then Credentials.
Click Create Map.
In the Map Name field, enter a name (for example, SOA), and click OK.
Click Create Key.
Enter the following details:
| Field | Description |
|---|---|
|
Select Map |
Select the map created in Step 7 (for this example, SOA). |
|
Key |
Enter the key name ( |
|
Type |
Select Password. |
|
User Name |
Enter the keystore user name ( |
|
Password |
Enter the password that you created for the keystore. |
Note:
When you set up SSL on an Oracle WebLogic Server domain, a key alias is required. You must enter mykey as the alias value. This value is required.
Set the keystore location in Oracle Enterprise Manager Fusion Middleware Control Console. See Step 1 for instructions.
Modify the composite.xml syntax to use https and sslport to invoke Oracle WebCenter Content. For example, change the syntax shown in bold:
<?xml version="1.0" encoding="UTF-8" ?> <!-- Generated by Oracle SOA Modeler version 1.0 at [4/1/09 11:01 PM]. --> <composite name="InvokeEchoBPELSync" revision="1.0" label="2009-04-01_23-01-53_994" mode="active" state="on" xmlns="http://xmlns.example.com/sca/1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:orawsp="http://schemas.example.com/ws/2006/01/policy" xmlns:ui="http://xmlns.example.com/soa/designer/"> <import namespace="http://xmlns.example.com/CustomApps/InvokeEchoBPELSync/BPELProcess1" location="BPELProcess1.wsdl" importType="wsdl"/> <import namespace="http://xmlns.example.com/CustomApps/EchoBPELSync/ BPELProcess1"location="http://hostname:port/soa-infra/services/default/EchoBPEL Sync/BPELProcess1.wsdl" importType="wsdl"/>
to use https and sslport:
location="https://hostname:sslport/soa-infra/services/default/EchoBPELSync /BPELProcess1.wsdl"
When invoking a Web service as an external reference from WebCenter Content in one-way SSL environments, ensure that the certificate name (CN) and the host name of the server exactly match. This ensures a correct SSL handshake.
For example, if a Web service is named adfbc and the certificate has a server name of host, the following results in a SSL handshake exception.
<import namespace="/adfbc1/common/"
location="https://host.example.com:8002/CustomApps-adfbc1-context-root/AppModuleService?WSDL"
importType="wsdl"/>
<import namespace="/adfbc1/common/" location="Service1.wsdl"
importType="wsdl"/>
If you switch the order of import, the SSL handshake passes.
<import namespace="/adfbc1/common/" location="Service1.wsdl"
importType="wsdl"/>
<import namespace="/adfbc1/common/"
location="https://host.example.com:8002/CustomApps-adfbc1-context-root/AppModuleService?WSDL"
importType="wsdl"/>
Note the following restrictions around this issue:
There are no options for ignoring host name verification in Oracle JDeveloper as exist with the . This is because the SSL kit used by Oracle JDeveloper is different. Only the trust store can be configured from the command line. All other certificate arguments are not passed.
In the WSDL file, https://hostname must match with that in the certificate, as described above. You cannot perform the same procedures as you can with a browser. For example, if the host name is host.example.com in the certificate's CN, then you can use host, host.example.com, or the IP address from a browser. In Oracle JDeveloper, always use the same name as in the certificate (that is, host.example.com).
Follow these procedures to configure SSL communication between WebCenter Content and Oracle HTTP Server.
See Configuring SSL for the Web Tier in Administering Oracle Fusion Middleware.
To configure Oracle HTTP Server for SSL communication:
Append ssl.conf with the <Location /cs> location directive, where port is the port number of the target managed server.
<Location /cs>
WebLogicPort 8002
SetHandler weblogic-handler
ErrorPage http://host.example.com:port/error.html
</Location>
Start the Oracle WebLogic Server as described in Configuring WebCenter Content for Two-Way SSL Communication .
To configure certificates for Oracle Client, Oracle HTTP Server, and Oracle WebLogic Server:
Switching from non-SSL to SSL configurations for WebCenter Content requires the Frontend Host and Frontend HTTPS Port fields to be set in the Oracle WebLogic Server Administration Console. Not doing so results in exception errors when you attempt to create to-do tasks.
wls_console.UCM_server1).To invoke WebCenter Content over HTTPS when using a custom trust store created with a tool such as keytool or orapki, perform the following actions in Oracle JDeveloper:
To enable an asynchronous process deployed to a SSL-enabled, managed server to invoke another asynchronous process over HTTP, start by assuming you create the following environment:
Asynchronous BPEL process A that invokes asynchronous BPEL process B
Asynchronous BPEL process A is deployed to a one-way SSL enabled, managed server
All WSDL reference and bindings use plain HTTP
At run time, the WSDL is looked for over HTTPS, and the callback message from asynchronous BPEL process B fails.
To resolve this issue, the callbackServerURL property must be passed at the reference binding level in the composite.xml file. This explicitly indicates the value of the callback URL for the given reference invocation. If the client composite is running in a SSL-managed server, then the callback defaults to SSL.
<reference name="Service1" ui:wsdlLocation="http://localhost:8000/soa-infra/services/default/
AsyncSecondBPELMTOM/BPELProcess1.wsdl">
<interface.wsdl interface="http://xmlns.example.com/Async/AsyncSecondBPELMTOM/BPELProcess1#
wsdl.interface(BPELProcess1)" callbackInterface="http://xmlns.example.com/Async/
AsyncSecondBPELMTOM/BPELProcess1#wsdl.interface(BPELProcess1Callback)"/>
<binding.ws port="http://xmlns.example.com/Async/AsyncSecondBPELMTOM/BPELProcess1#
wsdl.endpoint(bpelprocess1_client_ep/BPELProcess1_pt)"
location="http://localhost:8000/soa-infra/services/default/AsyncSecondBPELMTOM
/bpelprocess1_client_ep?WSDL">
<wsp:PolicyReference URI="oracle/wss_username_token_client_policy"
orawsp:category="security" orawsp:status="enabled"/>
<wsp:PolicyReference URI="oracle/wsaddr_policy" orawsp:category="addressing"
orawsp:status="enabled"/>
<property name="callbackServerURL">http://localhost:8000/</property>
</binding.ws>
<callback>
<binding.ws port="http://xmlns.example.com/Async/AsyncSecondBPELMTOM/BPELProcess1#
wsdl.endpoint(bpelprocess1_client_ep/BPELProcess1Callback_pt)">
<wsp:PolicyReference URI="oracle/wss_username_token_service_policy"
orawsp:category="security" orawsp:status="enabled"/>
</binding.ws>
</callback>
</reference>
You can configure one of these single sign-on (SSO) solutions for Oracle WebCenter Content:
Oracle Access Manager 11g
Oracle Access Manager 10g
Oracle Single Sign-On (OSSO)
Windows Native Authentication (WNA)
Oracle Access Manager (OAM) is the recommended single sign-on (SSO) solution for Oracle Fusion Middleware enterprise-class installations including WebCenter Content. OAM is part of Oracle's suite of enterprise-class products for identity management and security.
If your enterprise-class installation uses Microsoft desktop logins that authenticate with a Microsoft domain controller with user accounts in Active Directory, then configuring Windows Native Authentication (WNA) single sign-on may be an option. For more information about WNA, see Configuring WebCenter Content and Single Sign-On for Windows Native Authentication.
For an overview of Oracle WebLogic Server authentication providers, see Configuring Authentication Providers in Administering Security for Oracle WebLogic Server 12c (12.2.1).
Note:
WebDAV (/dav) is protected by basic authentication per WebDAV protocol and is not protected by SSO, which typically requires form-based login. If you want to use a custom SSO solution for WebDAV, then a custom component is necessary.
Configuration information is provided in the following sections:
This section describes how to integrate WebCenter Content with Oracle Access Manager (OAM) 11g. Configuration information is provided for Oracle WebCenter Content: Content Server (CS), Oracle WebCenter Content: Records (URM), Oracle WebCenter Content: Inbound Refinery (IBR), and Oracle WebCenter Content: Site Studio (SS).
Note:
Before configuring OAM, ensure that the Oracle WebLogic Server domain and Oracle WebCenter Content domain are deployed. See About Oracle WebCenter Content Installation in Oracle Fusion Middleware Installation Guide for Oracle Enterprise Content Management Suite.
For more information, see Securing Applications with Oracle Platform Security Services
Before you can configure OAM 11g, install the software using the instructions provided in Installing and Configuring Oracle Identity Management in Oracle Fusion Middleware Installation Guide for Oracle Identity Management , 11g Release 1 (11.1.1.9.0).
Configure OAM 11g, Oracle HTTP Server (OHS), and WebGate as described in Administrator’s Guide for Oracle Access Management for All Plarforms.
Append entries to the mod_wl_ohs.conf file to add WebCenter Content Uniform Resource Identifiers (URIs) to forward. Use the appropriate location entries from the following example. Each entry in the example maps the incoming path to the appropriate Oracle WebLogic Server on which the corresponding application resides.
In the following list of entries, hostname represents the name of the computer hosting the Content Server, and portnumber represents the port number of the Oracle WebLogic Server on which the corresponding applications resides. Replace hostname and portnumber with your system's host name and port name.
Note:
The URIs you forward depend on the WebCenter Content functionality that you have installed. Use the appropriate location entry for your functionality. For example: /cs, /adfAuthentication, /_ocsh, /ibr, /urm.
For Site Studio, the URI to forward is configured by the customer. For example, if the site is accessed as /mysite, then you need to append a location entry for /mysite.
Caution:
The Content Server location /cs can be customized, so the /cs designation can't guarantee that HTTP requests will include the correct location. If /cs has been changed, then forward the location the administrator has configured.
# Content Server
<Location /cs>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# Content Server authentication
<Location /adfAuthentication>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# WebCenter online help
<Location /_ocsh>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# IBR
<Location /ibr>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# URM
<Location /urm>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# SS
<Location /customer-configured-site-studio
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
Use the OAM 11g remote registration tool (oamreg) to register an OAM Agent, specifying Oracle WebCenter Content URIs to protect and to make public.
See Administrator’s Guide for Oracle Access Management for All Plarforms.
Note:
The URIs you protect and make public depend on the WebCenter Content functionality that you have installed: Content Server (CS), Inbound Refinery (IBR), Records (URM), Site Studio (SS).
For Site Studio, the URI to protect is configured by the customer. For example, if the site is accessed as /mysite, then you need to specify the URI /mysite.
| Functionality | Type | URI |
|---|---|---|
|
CS |
Protect |
|
|
CS |
Public |
|
|
CS |
Public |
|
|
IBR |
Protect |
|
|
IBR |
Public |
|
|
URM |
Protect |
|
|
URM |
Public |
|
|
SS |
Protect |
|
Add the URL /oamsso/logout.html to the logout URL setting for the AccessGate so the single sign-on logout works properly. See Configuring Centralized Logout for OAM 11g in Oracle Fusion Middleware Administrator’s Guide for Oracle Access Manager with Oracle Security Token Service, 11g Release 1 (11.1.1).
Configure the WebCenter Content domain by ensuring you perform these tasks.
Configure the OAM Identity Asserter. The control flag for the OAM Identity Asserter must be set to REQUIRED, and both OAM_REMOTE_USER and ObSSOCookie must be selected as Active Types.
Configure the Authentication provider. This is necessary to specify the external LDAP server for the user store, such as Oracle Internet Directory (OID) or Oracle Virtual Directory (OVD), to match the LDAP server used by OAM. For example, if OAM is using OID, then an OID Authentication provider must be added to the WebCenter Content domain.
Note:
When the Oracle WebLogic Server domain for WebCenter Content is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or WebCenter Content will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set to SUFFICIENT. For more information, see Configuring the First Authentication Provider.
Configure the OPSS (OAM) Single Sign-On provider.
After installing and configuring OAM 11g, check that you can access all of the configured applications, and that the login is giving you access to all of your configured applications without prompting you to sign in again. Also test global logout where available and make sure you are logged out of all other related applications.
This section describes how to integrate WebCenter Content with Oracle Access Manager (OAM) 10g. Configuration information is provided for Oracle WebCenter Content Server (CS), Oracle WebCenter Content: Records (URM), Oracle WebCenter Content: Inbound Refinery (IBR), and Oracle WebCenter Content: Site Studio (SS).
Note:
Before configuring OAM, ensure that Oracle WebLogic Server and WebCenter Content are deployed. See Installation Modules in Oracle Fusion Middleware Installing and Configuring Oracle WebCenter Content, 11g Release 1 (11.1.1.9).
Before you can configure OAM, install the software. See information on OAM integration in Enterprise Deployment Guide for Oracle WebCenter Content.
Configure OAM 10g, Oracle HTTP Server (OHS), and WebGate.
Append entries to the mod_wl.conf file to add WebCenter Content Uniform Resource Identifiers (URIs) to forward. Use the appropriate location entries from the following example. The entries in the following Location list map the incoming paths to the appropriate Oracle WebLogic Server on which the corresponding applications reside.
In the following list of entries, hostname represents the name of the computer hosting the Content Server, and portnumber represents the port number of the Oracle WebLogic Server on which the corresponding applications resides. Replace hostname and portnumber with your system's host name and port name.
Note:
The URIs you forward depend on the WebCenter Content functionality that you have installed. Use the appropriate location entry for your functionality. For example: /cs, /adfAuthentication, /_ocsh, /ibr, /urm.
For Site Studio, the URI to forward is defined by the customer. For example, if the site is accessed as /mysite, then you need to append a location entry for /mysite.
Caution:
The Content Server location /cs can be customized, so the /cs designation can't guarantee that HTTP requests will include the correct location. If /cs has been changed, then forward the location the administrator has configured.
# Content Server
<Location /cs>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# Content Server authentication
<Location /adfAuthentication>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# WebCenter online help
<Location /_ocsh>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# IBR
<Location /ibr>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# URM
<Location /urm>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# SS
<Location /customer-configured-for-site-studio>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portname>
</Location>
Use the OAM 10g configuration tool (OAMCfgTool) to specify WebCenter Content URIs to protect.
The OAM Configuration tool is a command-line utility you can use to launch a series of scripts to request information and set up the required profiles and policies in OAM.
Note:
The URIs you protect depend on the WebCenter Content functionality that you have installed: Oracle WebCenter Content (CS), Inbound Refinery (IBR), Records (URM), Site Studio (SS).
For Site Studio, the URI to protect is configured by the customer. For example, if the site is accessed as /mysite, then you need to specify the URI /mysite.
| Functionality | URI |
|---|---|
|
CS |
|
|
IBR |
|
|
URM |
|
|
SS |
|
Note:
If the URL for WebCenter Content does not link correctly after completing the OAM configuration, you might need to change the server host and server port values. For more information, see Configuring the WebCenter Content URL for Single Sign-On.
Configure the WebGate to handle the end_url in order to complete the setup for OAM global logout. Without this additional configuration, you are logged out, but not redirected to the end URL because end_url is not processed.
Add the URL /oamsso/logout.html to the logout URL setting for the AccessGate so the single sign-on logout works properly. See Configuring Centralized Logout for OAM 11g in Oracle Fusion Middleware Administrator’s Guide for Oracle Access Manager with Oracle Security Token Service, 11g Release 1 (11.1.1).
Note:
Deploying WebCenter Content version 11gR1 in an environment using OAM version 10g requires additional configuration to process logout requests properly.
Configure the WebCenter Content domain by performing the following tasks.
Configure the OAM Identity Asserter. The control flag for the OAM Identity Asserter must be set to REQUIRED.
Configure the Authentication provider. This is necessary to specify the external LDAP server for the user store, such as Oracle Internet Directory (OID) or Oracle Virtual Directory (OVD), to match the LDAP server used by OAM. For example, if OAM is using OID, then an OID Authentication provider must be added to the Oracle WebCenter Content domain.
Note:
When the Oracle WebLogic Server domain for WebCenter Content is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or WebCenter Content will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set to SUFFICIENT. For more information, see Configuring the First Authentication Provider.
Configure the OPSS (OAM) Single Sign-On provider.
After installing and configuring OAM 10g, check that you can access all of the configured applications, and that the login is giving you access to all of your configured applications without prompting you to sign in again. Also test global logout where available and make sure you are logged out of all other related applications.
Oracle Single Sign-On (OSSO) is part of the 10g Oracle Application Server suite. OSSO is an enterprise-level single sign-on solution that works with the OC4J application server in conjunction with Oracle Internet Directory and Oracle HTTP Server (OHS) 11g.
If OSSO is already in place as the enterprise solution for your existing Oracle deployment, Oracle Fusion Middleware continues to support the existing OSSO as a solution. However, Oracle recommends that you consider upgrading to OAM 11g Single Sign-On solution.
This section provides information for integrating WebCenter Content with OSSO. Configuration information is provided for Oracle WebCenter Content Server (CS), Oracle WebCenter Content: Records (URM), and Oracle WebCenter Content: Inbound Refinery (IBR), and Oracle WebCenter Content: Site Studio (SS).
Before you can configure OSSO, ensure that the software is installed. OSSO and Oracle Delegated Administration Service are not part of the 11g release. Customers must download the 10.1.4.* versions of these products, which are compatible with 11g Oracle Internet Directory and Oracle Directory Integration Platform, to form what was known in 10g as the Application Server Infrastructure. For deployment instructions on these 10g products, read "Installing and Configuring JAZN-SSO/DAS" in the Oracle Application Server Enterprise Deployment Guide (B28184-02) for Oracle Identity Management release 10.1.4.0.1. This manual is available on Oracle Technology Network at:
http://download.oracle.com/docs/cd/B28196_01/core.1014/b28184/toc.htm
Configure OSSO.
Append WebCenter Content Uniform Resource Identifier (URI) entries to the mod_wl_ohs.conf file. Use the appropriate location entries from the following example. Each entry in the example maps the incoming path to the appropriate Oracle WebLogic Server on which the corresponding application resides.
In the following list of entries, hostname represents the name of the computer hosting the Content Server, and portnumber represents the port number of the Oracle WebLogic Server on which the corresponding applications resides. Replace hostname and portnumber with your system's host name and port name.
Note:
The URIs you forward depend on the WebCenter Content functionality that you have installed. Use the appropriate location entry for your functionality. For example: /cs, /adfAuthentication, /_ocsh, /ibr, /urm.
For Site Studio, the URI to forward is configured by the customer. For example, if the site is accessed as /mysite, then you need to append a location entry for /mysite.
Caution:
The Content Server location /cs can be customized, so the /cs designation can't guarantee that HTTP requests will include the correct location. If /cs has been changed, then forward the location the administrator has configured.
# Content Server
<Location /cs>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# Content Server authentication
<Location /adfAuthentication>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# WebCenter online help
<Location /_ocsh>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# IBR
<Location /ibr>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# URM
<Location /urm>
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
# SS
<Location /customer-configured-site-studio
SetHandler weblogic-handler
WebLogicHost <hostname>
WebLogicPort <portnumber>
</Location>
Modify the mod_osso.conf file (at ORACLE_HOME/ohs/conf/) to include WebCenter Content Uniform Resource Identifiers (URIs) to protect.
Note:
The URIs you protect depend on the WebCenter Content functionality that you have installed: Content Server (CS), Inbound Refinery (IBR), Records (URM), and Site Studio (SS).
For Site Studio, the URI to protect is configured by the customer. For example, if the site is accessed as /mysite, then you need to specify the URI /mysite.
| Functionality | URI |
|---|---|
|
CS |
|
|
IBR |
|
|
URM |
|
|
SS |
/customer_configured_site_studio |
Caution:
The Content Server location /cs can be customized, so the /cs designation can not guarantee that HTTP requests will include the correct location. If /cs has been changed, then forward the location the administrator has configured.
Configure the WebCenter Content domain by ensuring you perform these tasks.
Add and configure the OSSO Identity Asserter for the Oracle WebLogic Server for WebCenter Content. Oracle recommends the following Authentication Providers: OSSO Identity Asserter, OID Authenticator, Default Authenticator.
The OID Authenticator provider is for the Oracle Internet Directory server, which is used in production-level systems. The Default Authenticator provider is for the Oracle WebLogic Server embedded LDAP server.
Ensure that OSSOIdentityAsserter is set as the primary provider authenticator for the domain, so that user profiles can be retrieved from the associated Oracle Internet Directory server. If necessary, reorder the providers so they appear in the following order, with control flags set as listed:
OSSOIdentityAsserter (REQUIRED)
OIDAuthenticator (SUFFICIENT)
DefaultAuthenticator (SUFFICIENT)
Note:
When the Oracle WebLogic Server domain for WebCenter Content is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or WebCenter Content will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set to SUFFICIENT. For more information, see Configuring the First Authentication Provider.
Configure the Authentication provider. This is necessary to specify the external LDAP server for the user store, such as Oracle Internet Directory (OID) or Oracle Virtual Directory (OVD), to match the LDAP server used by OAM. For example, if OSSO is using OID, then an OID Authentication provider must be added to the WebCenter Content domain.
Note:
If the URL for WebCenter Content does not link correctly after completing the OSSO configuration, you might need to change the server host and server port values. For more information, see Configuring the WebCenter Content URL for Single Sign-On.
When the Oracle WebLogic Server domain for WebCenter Content is configured to use an authentication provider other than its default authentication provider for user authentication (such as Oracle Internet Directory or another LDAP provider), the primary provider must be the first authentication provider listed in the security realm configuration, or login authentication will fail.
If the primary provider is not listed first (for example, it is listed below the Oracle WebLogic Server provider, DefaultAuthenticator), then WebCenter Content will fail to successfully load users' Group membership and therefore fail to load any user privileges. You can use the Oracle WebLogic Server Administration Console to change the order in which the configured authentication providers are called. See Configuring Authentication Providers in Administering Security for Oracle WebLogic Server 12c (12.2.1).
Note:
When you use Oracle Internet Directory, all WebCenter Content administrator and other users must be defined in Oracle Internet Directory.
Note:
Content Server assigns a Content Server administrator role to administrative users defined in the internal Oracle WebLogic Server user store. This is true regardless of whether Oracle Internet Directory is used or not used. However, if you use Oracle Internet Directory and the Oracle Internet Directory Authentication provider is not listed first, then any request by the Content Server instance to retrieve the roles of the Oracle WebLogic Server defined administrative users will fail.
Note:
As of 11g Release 1 (11.1.1.6.0) Oracle WebCenter Content supports use of the Oracle Virtual Directory library (libOVD) feature, which enables a site to use multiple providers for login and group membership information. For example, it would be possible to use both Oracle Internet Directory (OID) and Active Directory as sources of user and role information. For more information about multi-LDAP configuration in Oracle WebLogic Server, see Configuring the Service for Multiple LDAP using Fusion Middleware Control in Oracle Fusion Middleware Application Security Guide.
When you configure an Oracle application for use with Single Sign-On (SSO) and have set up Oracle Access Manager (OAM) or Oracle Single Sign-On (OSSO), the WebCenter Content GET_ENVIRONMENT service provides the server name, server port, and relative webroot to the application service call (for example, the WebCenter Content Doclib service). However, the values provided by GET_ENVIRONMENT might not be correct for your SSO configuration.
If you want to redirect the application service to use the OHS server host and server port (because both OAM and OSSO solutions require front-end applications with OHS), you must modify the Content Server host and server port configuration values.
You can use either of the following two methods to modify the Content Server host and server port values:
Use the Oracle WebLogic Server Administration Console.
Use the WebCenter Content standalone System Properties application.
Go to the WebCenter Content domain directory.
Change the directory to ucm/cs/bin
Run the standalone application: ./SystemProperties
In the System Properties window, select the Internet tab.
Update the HTTP Server address to the OHS (or Load Balancer) server host and server port values.
Exit the System Properties window.
Restart the Oracle WebLogic Server domain.
Setting up WebCenter Content and single sign-on (SSO) with Microsoft clients for Windows Native Authentication (WNA) requires configuring the Microsoft Active Directory, the client, and the Oracle WebLogic Server domain. Details including system requirements for SSO with Microsoft clients are provided in Configuring Single Sign-On with Microsoft Clients in Administering Security for Oracle WebLogic Server 12c (12.2.1).
As part of configuring SSO with Microsoft clients, you must specify a LDAP authentication provider to access the external Microsoft Active Directory. Oracle WebLogic Server offers the Active Directory Authentication provider. See Configuring LDAP Authentication Providers in Administering Security for Oracle WebLogic Server 12c (12.2.1).
Note:
When the Oracle WebLogic Server domain for WebCenter Content is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or WebCenter Content will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set to SUFFICIENT. For more information, see Configuring the First Authentication Provider.
As part of configuring SSO with Microsoft clients, you must configure the Negotiate Identity Assertion provider in Oracle WebLogic Server security realm. The identity assertion provider decodes Simple and Protected Negotiate (SPNEGO) tokens to obtain Kerberos tokens, validates the Kerberos tokens, and maps Kerberos tokens to WebLogic users. Use the Oracle WebLogic Server Administration Console to add a new provider in the appropriate security realm in the domain structure, assign it a name, then select NegotiateIdentityAsserter for its Type. Activate the changes and restart the Oracle WebLogic Server. Now your server can use the Kerberos ticket it receives from the browser.
You must redeploy each WebCenter Content application (Content Server, Inbound Refinery, Records) that will be used in the Windows Native Authentication (Kerberos) environment, using an associated deployment plan. A deployment plan is a XML document. Oracle provides a plan for each of the three WebCenter Content applications: Example 16-1, Example 16-2, and Example 16-3. You also can implement a deployment plan using the Oracle WebLogic Scripting Tool.
Example 16-1 cs-deployment-plan.xml
Use the provided cs-deployment-plan.xml file, or create a .xml file and name it cs-deployment-plan.xml.
<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan
xmlns="http://xmlns.oracle.com/weblogic/deployment-plan"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd"
global-variables="false">
<application-name>cs.ear</application-name>
<variable-definition>
<variable>
<name>http-only</name>
<value>false</value>
</variable>
</variable-definition>
<module-override>
<module-name>cs.war</module-name>
<module-type>war</module-type>
<module-descriptor external="false">
<root-element>weblogic-web-app</root-element>
<uri>WEB-INF/weblogic.xml</uri>
<variable-assignment>
<name>http-only</name>
<xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
</variable-assignment>
</module-descriptor>
</module-override>
</deployment-plan>
Example 16-2 ibr-deployment-plan.xml
Use the provided ibr-deployment-plan.xml file, or create a .xml file and name it ibr-deployment-plan.xml.
<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan xmlns="http://xmlns.oracle.com/weblogic/deployment-plan" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation= "http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd" global-variables="false">
<application-name>ibr.ear</application-name>
<variable-definition>
<variable>
<name>http-only</name>
<value>false</value>
</variable>
</variable-definition>
<module-override>
<module-name>ibr.war</module-name>
<module-type>war</module-type>
<module-descriptor external="false">
<root-element>weblogic-web-app</root-element>
<uri>WEB-INF/weblogic.xml</uri>
<variable-assignment>
<name>http-only</name>
<xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
</variable-assignment>
</module-descriptor>
</module-override>
</deployment-plan>
Example 16-3 urm-deployment-plan.xml
Use the provided urm-deployment-plan.xml file, or create a .xml file and name it urm-deployment-plan.xml.
<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan
xmlns="http://xmlns.oracle.com/weblogic/deployment-plan"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd"
global-variables="false">
<application-name>urm.ear</application-name>
<variable-definition>
<variable>
<name>http-only</name>
<value>false</value>
</variable>
</variable-definition>
<module-override>
<module-name>urm.war</module-name>
<module-type>war</module-type>
<module-descriptor external="false">
<root-element>weblogic-web-app</root-element>
<uri>WEB-INF/weblogic.xml</uri>
<variable-assignment>
<xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
</variable-assignment>
</module-descriptor>
</module-override>
</deployment-plan>
Oracle Infrastructure Web services provide the ability to create and attach policy sets to subjects on a global scope (domain, server, application, or SOA composite). Oracle Infrastructure Web services are implemented according to the Web services for Java EE 1.2 specification, which defines the standard Java EE runtime architecture for implementing Web services in Java. The specification also describes a standard Java EE Web service packaging format, deployment model, and runtime services, all of which are implemented by Oracle Infrastructure Web services.
Differences in behavior, and any limitations, for Oracle Infrastructure Web services supported on IBM WebSphere are described in Managing Web Services on IBM WebSphere in Third-Party Application Server Guide, 11g Release 1 (11.1.1.9).