Contents

Title and Copyright Information

Preface

Audience

Documentation Accessibility

Related Documents

Conventions

1 Introduction

1.1 About This Guide

1.2 Getting Started

1.3 About This Product

1.4 Understanding Applications, Inputs, Searches, and Connections

1.5 About System Administration

1.5.1 Administrative Accounts

1.5.2 Administrative Tools

1.5.3 System Administration Tasks Not Covered in This Guide

1.6 Integration with Key Oracle Technologies

1.6.1 Integration with Oracle Document Capture

1.6.2 Integration with Content Server

1.6.3 Integration with Oracle WebLogic Server

1.6.3.1 Working Within a Clustered Environment

1.6.4 Integration with Oracle Workflow Server

1.7 Oracle WebCenter Content: Imaging Architecture

1.7.1 Application Architecture Overview

1.7.2 Web Services and Java API

1.7.3 Business Logic and Agents

2 Managing Security

2.1 Security Model Overview

2.1.1 System Access

2.1.2 Installation Security Initialization

2.1.2.1 Migrating User Store from LDAP Server to Oracle Internet Directory

2.1.3 Definition Management Security Rights and Definition Security Rights

2.1.3.1 Definition Management Rights

2.1.3.2 Definition Rights

2.1.4 Users and Groups

2.2 Definition Security and Definition Management Security

2.2.1 Working With Definition Management Security

2.2.2 Working with Definition Security

2.2.3 Working with Document Security

2.2.4 Working with Annotation Security

2.2.4.1 Annotation Permissions

2.2.5 Security Example

2.3 System Level Security

2.3.1 Configuring a Fusion Middleware Application to use SSL

2.3.1.1 Configuring an SSL Content Server Repository Connection

2.3.2 Integrating with a Workflow

2.3.2.1 Integration Points

2.3.2.2 Workflow Connection Configuration

2.3.2.3 SSL Configuration

2.3.3 Configuring a Fusion Middleware Application to Use Web Services

2.3.4 Web Services Security Configuration for Imaging

2.3.4.1 Working with Oracle Web Services Manager

2.3.4.2 Setting Policies on Services

2.3.4.3 API Usage

2.3.4.4 Examples

2.3.4.5 Working With Keystores

2.3.4.6 Working with the CSF through WLST

2.3.5 Integrating Imaging With Oracle Access Manager 11g

2.3.6 Integrating Imaging With Oracle Access Manager 10g

2.3.7 Configuring Oracle Single Sign-On for Imaging

2.3.8 Configuring Imaging and Single Sign-On for Windows Native Authentication

3 Changing Configuration Settings

3.1 Configuration Overview

3.2 Post-Installation Configuration

3.3 Configuration of Repository Options

3.3.1 Storage Management

3.3.2 Repository Capacity

3.3.3 Storage Media

3.3.4 Content Server File Store Provider Rules

3.3.4.1 Disabling the Repository Weblayout Directory

3.3.5 Additional Content Server Components

3.3.5.1 Required Components

3.3.5.2 Optional Components

3.4 Exporting and Importing Definitions

3.4.1 Exporting Definitions

3.4.2 Importing Definitions

3.5 File Size Limits

3.6 Configuring MBeans

3.6.1 Imaging MBeans

3.6.2 Using WLST to Change MBeans

3.6.3 Using Enterprise Manager to Set an MBean Value

3.7 Setting Font Variables

3.7.1 Configuring MBeans

3.8 Configuring Display of Seconds in Search Results

3.9 Configuring Imaging Logging

4 Managing Applications

4.1 Application Overview

4.1.1 Document Overview

4.1.1.1 Uploading Documents

4.2 Creating An Application

4.2.1 Specifying General Properties

4.2.2 Defining Application Fields

4.2.3 Assigning Application Security

4.2.3.1 Copying Permissions From One User to Another User

4.2.4 Assigning Document Security

4.2.5 Assigning a Storage Policy

4.2.6 Configuring Workflow Integration

4.2.7 Reviewing Application Settings

4.3 Modifying an Existing Application

5 Managing Inputs

5.1 Input Definition Overview

5.2 Creating Input Definitions

5.2.1 Enabling and Disabling an Input Definition

6 Managing Searches

6.1 Search Overview

6.2 Creating a Search

6.3 Modifying an Existing Search

7 Managing Connections

7.1 Creating an Content Server Connection

7.2 Creating a Workflow Connection

7.2.1 Configuring SSL for the Workflow Server

7.2.2 Configuring a Workflow Connection CSF Credential

8 Working with WebCenter Content

8.1 Content Server Document Profiles

8.1.1 Global Profile Rules

8.1.2 Application Profile and Profile Rules

8.1.3 Working With Folders

8.1.4 Working With Oracle Universal Records Manager

8.1.4.1 Oracle Records Management and Imaging Content

8.1.4.2 Synchronizing with WebCenter Content Adapter for Content Server

8.1.5 Working With Information Rights Manager

8.1.6 Working With WebCenter Spaces

8.2 Understanding Document Storage

8.2.1 Content Server Document Properties

9 Understanding Input Agents

9.1 Enabling Input Agent

9.2 Understanding Input Files

9.3 Using Input Filing Commands

9.3.1 Locale

9.3.2 New

9.3.3 Supporting Content

9.3.4 Apply Annotations

9.3.5 Workflow Inject Document

9.4 Input Agent Processing

9.4.1 Input Directory Structure

9.4.2 Input Agent Processing Order

9.4.2.1 Polling

9.4.2.2 Processing

9.4.3 Changing Oracle WebLogic Server Work Manager Settings

9.5 Checking Results and Error Files

10 Understanding Workflow Agents

10.1 Business Process Management

10.2 Business Process Execution Language (BPEL)

10.2.1 Configuring Workflow Properties

10.2.1.1 Workflow Payload Mapping Functions

10.2.1.2 Required Payload Element (MinOccurs) Handling

10.2.1.3 Date Field Format

10.2.1.4 Doc Property Functions

10.2.1.5 Field Value Functions

10.2.1.6 Format Value Function

10.2.1.7 Supporting Content Function

10.2.2 Payload Limitations

10.2.3 Mapping Secure Workflow Services

10.2.3.1 Configuring Message Protection Policies

10.2.3.2 Configuring SAML Policies

10.2.4 Changing WebLogic Server Work Manager Settings

10.2.5 Using a Workflow Connection CSF Credential

10.2.6 Workflow Agent Retry Sequence

10.2.7 Configuring the Workflow Faults Table

10.2.8 Initiating a Workflow Process Instance

11 Troubleshooting

11.1 Decimal Field Error

11.2 Imaging and Windows Server Prerequisites

11.3 NULL Number Fields

11.4 Full-Text Search Fails On Large Documents

11.5 Repository Capacity Errors

11.6 Font Errors

11.7 Input Agent and Input File Issues

11.7.1 Input Agent Will Not Detect and Process Input Files

11.7.2 Auto-detect Not Determining Character Set

11.7.3 Input File Entries Have Errors

11.8 Advanced Viewer Transformation Errors

11.9 Problems with TIFF Display in Viewer

11.10 Shared Temp Directory in Linux Causes Display Failure

11.11 Shifting Redaction and Other Annotations

11.12 Logging of ImagingException

11.13 Tracking Events in the Imaging and Content Server Log Files

11.14 Using Oracle Dynamic Monitoring System with Imaging

11.15 Reviewing Audit History of Deleted Documents

11.16 Deciphering Nested Stack Errors

11.17 Imaging Session Time Out When Using OSSO Requires Browser Refresh

11.18 Content Server 10g Provides Incorrect Dates for Workflow

11.19 Doc URL Returned With Invalid IP Address

11.20 Required Fields Added to Content Server Must Have Default Value Specified

11.21 Imaging Viewer Fails On UNIX, AIX, and Solaris SPARC

11.22 Viewer Displays Blank Page Instead of Document

11.23 HTML Login Form Displayed Instead of Document in Advanced Viewer Mode

11.24 Viewer Reports Magic Number Error

11.25 Invalid Skin Preference Displays Generic User Interface

11.26 Problem Displaying Second Page of Microsoft PowerPoint 2007 Document

11.27 Configuring Viewer for Use in UNIX Exalogic Environment with Solaris 11g

A User Interface

A.1 Icons

A.2 Navigator Pane

A.3 Navigation Train

A.4 Upload Document Page

A.5 Update Document Page

A.6 Export Definitions: Export Comments Page

A.7 Export Definitions: Applications Page

A.8 Export Definitions: Searches Page

A.9 Export Definitions: Inputs Page

A.10 Export Definitions: Summary Page

A.11 Import Definitions: File Location Page

A.12 Import Definitions: Select Imports Page

A.13 Import Definitions: Validate Imports Page

A.14 Import Definitions: Summary Page

A.15 Solution Editor Page

A.15.1 Solution Editor Page: General Tab

A.15.2 Solution Editor Page: Actions Tab

A.15.3 Solution Editor Page: Task Viewer Tab

A.15.4 Solution Editor Page: Enumerations Tab

A.16 Search Properties Page

A.17 Search Results Formatting Page

A.18 Search Conditions Page

A.19 Search Parameters Page

A.19.1 Operator Properties Dialog Box

A.20 Search Security Page

A.21 Add Security Member Page

A.22 Search Preview and Test Page

A.23 Search Review Settings Page

A.24 Search Summary Page

A.25 Application General Properties Page

A.26 Application Field Definitions Page

A.27 Application Security Page

A.28 Application Document Security Page

A.29 Application Storage Policy Page

A.30 Application Workflow Configuration Page

A.31 Workflow Server Properties Page

A.32 Workflow Component Properties Page

A.33 Workflow Payload Properties Page

A.33.1 Edit Format Value Page

A.33.2 Edit Supporting Content Value Page

A.34 Application Review Settings Page

A.35 Application Summary Page

A.36 Input Basic Information Page

A.37 Input Identify and Parse File Parameters Page

A.38 Input Field Mapping Page

A.38.1 Define Date Format Page

A.39 Input Security Page

A.40 Input Review Settings Page

A.41 Input Summary Page

A.42 Content Server Connection Basic Information Page

A.43 Content Server Connection Content Server Settings Page

A.44 Content Server Connection Security Page

A.45 Content Server Connection Review Settings Page

A.46 Content Server Connection Summary Page

A.47 Workflow Connection Basic Information Page

A.48 Workflow Connection Settings Page

A.49 Workflow Connection Security Page

A.50 Workflow Connection Review Settings Page

A.51 Workflow Connection Summary Page

A.52 Definition Management Security

Index

Oracle® WebCenter Content

Administrator's Guide for Imaging

Release 11gR1 (11.1.1)

E12782-04

November 2011

Oracle WebCenter Content: Imaging integrates electronic document storage, retrieval, and annotation with business processes to facilitate document use across an enterprise. This guide describes typical procedures necessary for administering Oracle WebCenter Content: Imaging including creating applications, inputs, searches, and connections.

Oracle WebCenter Content Administrator's Guide for Imaging, Release 11gR1 (11.1.1)

E12782-04

Copyright © 2011, Oracle and/or its affiliates. All rights reserved.

Primary Author: Bruce Silver

Contributor: David Jones

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark licensed through X/Open Company, Ltd.

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Preface

Oracle WebCenter Content: Imaging integrates electronic document storage, retrieval, and annotation with business processes to facilitate document use across an enterprise. Documents are uploaded into a repository managed by Oracle WebCenter Content Server using an application within Imaging. Applications are predefined by you based on your business need. Documents are uploaded to applications based on a business need. For example, one application would be used to upload an invoice and a different application would be used to upload a contract. The application determines the metadata that is associated with a document, as well as security permissions to the document and any document annotations. This guide details how to define applications and searches, connect to a workflow server to integrate with other business processes, and configure Imaging to best meet your company needs.

Audience

This guide is intended for administrators who need to configure and manage an Oracle WebCenter Content: Imaging implementation.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Related Documents

Oracle WebCenter Content: Imaging works with Oracle WebCenter Content Server to store and retrieve documents. For more information about using Imaging, see the following:

Oracle WebCenter Content User's Guide for Imaging

Oracle WebCenter Content Developer's Guide for Imaging

For more information about Oracle WebCenter Content Server, see administrator guides included in the Content Server documentation set and any applicable documents for external repositories, as necessary.

Conventions

The following text conventions are used in this document:

Convention | Meaning
boldface | Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.
italic | Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.
monospace | Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

1 Introduction

Oracle WebCenter Content: Imaging integrates electronic document storage, retrieval, and annotation with business processes to facilitate document use across an enterprise. This guide provides instructions for administering the Oracle WebCenter Content: Imaging product software on Oracle WebLogic Server.

This section covers the following topics:

Section 1.1, "About This Guide"

Section 1.2, "Getting Started"

Section 1.3, "About This Product"

Section 1.4, "Understanding Applications, Inputs, Searches, and Connections"

Section 1.5, "About System Administration"

Section 1.6, "Integration with Key Oracle Technologies"

Section 1.7, "Oracle WebCenter Content: Imaging Architecture"

1.1 About This Guide

The information contained in this document is subject to change as the product technology evolves and as hardware, operating systems, and third-party software are created and modified.

In this document and other documents in this product set, the terms application, search, input, and connection are typically being used in reference to object definition types within the Imaging product.

1.2 Getting Started

This guide assumes that Imaging is already installed. For information on installing Imaging and setting initial post-installation configuration options, see Oracle WebCenter Content Installation Guide.

This section provides an overview to the product architecture. Subsequent sections detail security contexts, initial configuration steps, administration procedures, and reference material for administering Imaging.

After installing Imaging and prior to configuring applications and other aspects of Imaging, ensure the following:

If using Oracle Document Capture or Oracle Distributed Document Capture, ensure that it has been configured with the Oracle I/PM 11g Commit Driver.

If installed on a Linux operating system, ensure that the GDFontpath values have been set.

Review the section on managing security to familiarize yourself with the security contexts within Imaging, the levels of security within those contexts and how they will apply to users and groups.

Ensure that Content Server is installed and configured for use with Imaging. See Oracle WebCenter Content Installation Guide for detailed information.

Obtain the necessary security, address, and port information to connect to a workflow server.

Obtain the necessary security, address, and port information to connect to an Content Server repository.

1.3 About This Product

Oracle WebCenter Content: Imaging provides organizations with a scalable solution upon which to develop process-oriented imaging applications and image-enablement solutions for enterprise applications. It enables image capture via Oracle Document Capture and Oracle Distributed Document Capture, annotation and markup of images, routing and approval automation, and support for high-volume applications for billions of items. With Imaging, organizations can quickly integrate their content and processes directly with Oracle enterprise applications, such as Oracle E-Business Suite, PeopleSoft Enterprise, and JD Edwards EnterpriseOne. Users benefit by having a single source for all transaction-based content, eliminating the need for double entry.

Imaging manages documents from image capture to archiving. A document is uploaded into Imaging either singly by individual users or in bulk via a background ingestion agent. Once uploaded, a document becomes part of an application. An application is a type of container for documents that defines metadata, storage information, and workflow process configuration for all documents within it. Applications are defined by the system administrator based on a specific business need. For example, an Invoicing application may track invoice number, date sent, date due, status, and any other metadata required by an accounting department. Applications use an input definition to map metadata from an input file to the correct application fields for bulk ingestion via the input agent. The input agent ingests the metadata and documents from a local file system or mapped network drive into Imaging.

Depending on how your repository is set up, uploaded documents can be stored within an Oracle database, on a file system, or in storage-specific hardware for retrieval. Security is applied to an Imaging document based on its application, ensuring access only by authorized users. And Imaging may be configured to initiate a business process instance within a workflow server.

Users can retrieve stored documents using a predefined search. Predefined searches are created to find documents based on document metadata and full-text indexes. With the proper permissions, users can:

View documents in a standard web-browser

Print, download, or e-mail the document to others

Annotate documents

Upload documents and initiate a workflow process if one is defined in the application

Delete, copy, or move documents

Figure 1-1 Imaging Process Overview

1.4 Understanding Applications, Inputs, Searches, and Connections

Applications, inputs, searches, and connections refer to specific objects within Imaging created using the Imaging interface or services in the application programming interface (API). Understanding what they are and how they work together to control access to documents is critical to creating them and working with Imaging.

Applications

Applications are the core of Oracle WebCenter Content: Imaging. In Imaging, an application is not a separate software package, but a type of management container for documents uploaded to Imaging. In effect, an application is a category into which documents get sorted. Each application has unique security rights that are applied to documents in the application, and unique metadata fields to store the metadata values associated with each document. Changing security rights within an application affects access to all documents within the application. Similarly, adding a metadata field to an application adds the field to all documents within the application, however metadata values for the added field must be supplied individually to each document.

Inputs

Inputs are the way that documents are uploaded to Imaging and metadata is associated with them. Metadata values for a document are typically supplied when a document is uploaded. Documents can be uploaded individually and metadata values supplied manually by the person uploading the document. Most often documents are uploaded in bulk using a scanning station. When uploaded in bulk, the scanning station generates an input file. The input file includes the path to the scanned document and the values for the document metadata.

An input agent is used to watch specified locations and process any input files placed there by the scanning station. The documents specified in the input file are uploaded to an application in Imaging. The target application is also specified in the input file. The metadata values in the input file populate the fields of the application based on an input definition created in Imaging. The input definition maps the metadata values in the input file to the correct metadata fields of the selected application. Once documents are uploaded into an application with the correct metadata values, a search is used to retrieve documents relevant to your business process.

Searches

Searches are used to retrieve a listing of documents from Imaging. A search can be run across one or multiple applications, and the returned results listing can be e-mailed to others or exported to a file. Documents listed in a search result can be viewed, downloaded, copied to other applications, or otherwise manipulated as your business need requires.

Searches are created using the Imaging interface in much the same way that applications are created. The person responsible for creating the search determines what fields are to be searched within which applications. Note that searches can span multiple applications. For example, someone in the Accounts Payable department at XYZ Company receives an invoice that references a purchase order number. Before the person pays the invoice, they must first verify that the purchase order is valid and that the goods listed on the invoice have been received. They could execute a single search on the purchase order number that would search both the documents uploaded into the Purchase Orders application and the documents uploaded into the Shipping Receipts application. The search results listing returned could show whether the purchase order existed and note if there is a shipping receipt associated with it, verifying that the goods were received. If the person needed more detailed information from the documents, they could open both the purchase order and the shipping receipt in the Imaging viewer and compare them to ensure that all items on the purchase order matched the items on the invoice and that all items on the invoice were listed as received on the shipping receipt.

Connections

Connections are created in Imaging and used to access necessary servers. Two types of server connections are defined in Imaging:

repository connections are created to connect to a Content Server or servers where documents are stored

workflow connections are created to connect to workflow servers where a workflow process is defined

Imaging stores documents in repositories set up using Oracle WebCenter Content. Multiple repositories can be used, with connections created in Imaging to each repository using the Imaging interface. If your business process requires documents in a particular application to move through a workflow, then a connection to the workflow server where the workflow is defined can also be created in Imaging, and the application can be set to initiate the workflow when a document is upload to it.

Controlling Access

Access to the documents is controlled by a number of factors. First, by controlling access to the Imaging system. Second, by assigning permissions to the applications, searches, and other tools provided by the Imaging system. Lastly, by assigning permissions to the documents within different applications. In the preceding XYZ Company example, only the people authorized to view the purchase order, shipping receipt, and invoice documents would have the rights to do so. The person accessing the documents must have the right to execute the search. If they do not, then they wouldn't even be able to retrieve the documents for viewing. They must also belong to a group that has access to the individual documents in each specific application they work with: Invoices, Purchase Orders, or Shipping Receipts. The type of document security rights granted to the group in the application determines what a person can do with the document. For example, a person in the Accounts Payable group may be able to delete an invoice, but not a shipping receipt, whereas someone in Shipping and Receiving could delete a shipping receipt, but not even view an invoice.

1.5 About System Administration

Imaging system administrators are typically responsible for the following tasks:

Installing Oracle WebCenter Content: Imaging

Configuring Imaging

Creating Imaging applications

Creating Imaging inputs

Creating Imaging searches

Configuring Imaging connections

Configuring workflow injection

Coordinating secure access to Imaging

Monitoring and troubleshooting Imaging issues

Editing AXF Solutions through the Solution Editor

1.5.1 Administrative Accounts

The first user to log into Imaging after installation is given full administrative privileges for the installation. This user can give permissions to access the system to others. If for any reason system security needs to be reset, you can do so following the procedure in the section "Installation Security Initialization" in chapter 2 of the full Oracle WebCenter Content Administrator's Guide for Imaging documentation set.

1.5.2 Administrative Tools

Administration of Imaging is done using the following administration tools:

Imaging user interface. Administration capabilities are exposed in the interface based on user permissions.

Note that business users typically do not interact with the Imaging administrative interface. Most user contact with Imaging is accessing search results listings and viewing documents, both of which are typically done from an integration of Imaging with an existing business suite such as Oracle E-Business Suite or PeopleSoft.

Oracle Enterprise Manager can be used for reviewing statistics on deployed resources, statistics of individual domains, details of web services, and other information. For more information, see the documentation that comes with Enterprise Manager.

Oracle WebLogic Server can be used for reviewing log files, installed modules, installed Enterprise JavaBeans, configuration parameters, setting configuration MBeans for Imaging, and more. For more information, see the documentation available with Oracle WebLogic Server.

WebLogic Scripting Tool (WLST) is a command-line interface for navigating, monitoring, and configuring Oracle WebLogic Server. It can be used to configure Imaging parameters, review log files, and more. For more information on using WLST, see Oracle Fusion Middleware WebLogic Scripting Tool Command Reference.

1.5.3 System Administration Tasks Not Covered in This Guide

Some Imaging system administration tasks are not covered in this guide. The following table explains what these tasks are and where to find more information.

Table 1-1 System Administration Tasks and Information Not Covered in This Guide

Task
Where to Go For More Information

Administering Oracle SOA Suite

Oracle Fusion Middleware Administrator's Guide for Oracle SOA Suite and Oracle Business Process Management Suite

Administering Oracle Enterprise Manager Fusion Middleware Control

Oracle Fusion Middleware Administrator's Guide

Administering Oracle WebLogic Server

Oracle Fusion Middleware Administrator's Guide

Administering WebCenter Content Server

Oracle WebCenter Content System Administrator's Guide for Content Server

Administering Oracle Document Capture

Oracle Document Capture Administrator's Guide

Administering Oracle Distributed Document Capture

Oracle Distributed Document Capture Administrator's Guide

Administering Oracle Application Adapters for Oracle E-Business Suite and Oracle PeopleSoft

Oracle WebCenter Administrator's Guide for Application Adapters

1.6 Integration with Key Oracle Technologies

This section contains the following topics:

Section 1.6.1, "Integration with Oracle Document Capture"

Section 1.6.2, "Integration with Content Server"

Section 1.6.3, "Integration with Oracle WebLogic Server"

Section 1.6.4, "Integration with Oracle Workflow Server"

1.6.1 Integration with Oracle Document Capture

Imaging integrates with Oracle Document Capture and Oracle Distributed Document Capture to allow you to convert physical documents into an electronic format to be uploaded to Imaging. If using Oracle Document Capture or Oracle Distributed Document Capture, ensure that it has been configured with the Oracle I/PM 11g Commit Driver. Talk to the Oracle Document Capture administrator or see the administration documentation for Oracle Document Capture or Oracle Distributed Document Capture.

1.6.2 Integration with Content Server

Imaging leverages Content Server as a repository for document storage and retrieval. Content Server supports both out-of-the-box content management services and open, customizable integration options that can manage a broad range of enterprise content such as emails, documents, and images from different content sources. Content Server supports Oracle, SQL Server, and DB2 databases to allow indexing and storage of content in a variety of ways. Depending on the database and configuration, documents and metadata can be stored within the database, on a file system, or a combination of both. Flexible search options allow you to configure the repository to support either metadata searching or full-text searching per Imaging application to provide the most applicable search capabilities.

1.6.3 Integration with Oracle WebLogic Server

Imaging is designed to leverage many of the features of Oracle WebLogic Server including its standard J2EE architecture, integrations with Oracle security components, scalability including clustering, system management tools like Enterprise Manager, WebLogic Scripting Tools, and WebLogic Server Console.

1.6.3.1 Working Within a Clustered Environment

For production environments that require increased application performance, throughput, or high availability, you can configure two or more Managed Servers to operate as a cluster. A cluster is a collection of multiple Oracle WebLogic Server managed servers running simultaneously and working together to provide increased scalability and reliability. In a cluster, most resources and services are deployed identically to each Managed Server (as opposed to a single Managed Server), enabling failover and load balancing. A single domain can contain multiple Oracle WebLogic Server clusters, as well as multiple Managed Servers that are not configured as clusters. The key difference between clustered and nonclustered Managed Servers is support for failover and load balancing. These features are available only in a cluster of Managed Servers. For more information on configuring a clusters in WebLogic Server, see the guide Oracle Fusion Middleware Using Clusters for Oracle WebLogic Server.

1.6.4 Integration with Oracle Workflow Server

A connection to an workflow server is used to initiate a workflow process when documents are uploaded to Imaging, allowing for business process integration across the enterprise.

1.7 Oracle WebCenter Content: Imaging Architecture

Imaging business logic produces business objects for defining applications, document control, and security. The following sections describe the underlying technology for Imaging:

Section 1.7.1, "Application Architecture Overview"

Section 1.7.2, "Web Services and Java API"

Section 1.7.3, "Business Logic and Agents"

1.7.1 Application Architecture Overview

Imaging resides within Oracle WebLogic Server, connected to a database. Imaging events are routed through Oracle WebLogic Server using Java Messaging Service (JMS) to communicate with its background agents. Custom applications can interact with Imaging through its set of custom Imaging application programming interfaces (APIs). For more information about Imaging APIs, see Oracle WebCenter Content Developer's Guide for Imaging.

Figure 1-2 Imaging Architecture Overview

1.7.2 Web Services and Java API

Custom applications integrating with an Imaging system can communicate with Imaging through the Imaging public API. The API is available in two forms:

through standard web services generated with the Java API for XML Web Services (JAX-WS)

through Imaging Java APIs, a set of portable Java class files

The Remote Java API uses the same API as the Imaging user interface.

Figure 1-3 Imaging Web Services and Java API

1.7.3 Business Logic and Agents

Imaging provides architectural concepts that are designed to help business managers simplify the process of building imaging solutions. These architectural concepts, such as applications, searches, and inputs, provide convenient constructs around which a business user can organize their solution, grant security to relevant user groups, and finally migrate between differing system instances, for example, development and production. Imaging's public API provides services aligned with these architectural concepts whose implementations reside in Imaging's business logic layer. Although most requests flow directly through these layers producing immediate responses, some tasks are better performed in the background. These tasks are relegated to a collection of Imaging background processes known as agents.

Standard Java Management J2EE Beans (or MBeans) are used to configure the operation of Imaging's business logic as well as its agents. The values of these MBean configuration objects can be manipulated through Oracle Enterprise Manager and WebLogic Scripting Tool, allowing you to choose the best system management tool for your needs.

Figure 1-4 Imaging Business Logic and Agents

2 Managing Security

Access to Imaging is granted through the configured credential store managed within the Oracle WebLogic Server domain using the available Oracle WebLogic Server providers. Once access to Imaging is granted, specific features within Imaging require security rights assigned by an Imaging administrator or user designated to grant rights to a specific feature.

This section contains the following topics:

Section 2.1, "Security Model Overview"

Section 2.2, "Definition Security and Definition Management Security"

Section 2.3, "System Level Security"

2.1 Security Model Overview

The first person to log in to Imaging after initial installation is granted full rights to all features, in order to properly set up an Imaging solution to meet company needs. After the system is properly set up, security rights can be changed or revoked if necessary. Additionally, initial security rights can be reset if the credential store has been changed during set up. See Section 2.1.2, "Installation Security Initialization" for more information.

Note:

When Imaging is first deployed, the role of IPMSYS_ADMIN is created within Content Server. This role provides specialized security rights necessary for Imaging and Content Server to operate together. The IPMSYS_ADMIN role is not intended for public use. This role is created and managed programmatically by the Imaging system.

Changes to the security rights assigned to the role or adding or removing users associated with that role will have a negative impact on the operation of both Imaging and Content Server. One such negative impact is that any users added to this role will be deleted from the Content Server system.

2.1.1 System Access

Oracle WebLogic Server controls user and group access to Imaging and its repository as managed servers running within the WebLogic Server domain. System security configuration and SSL connection configuration are handled through the Oracle WebLogic Server console. Oracle WebLogic Server controls can link to the WebLogic Server domain managing Imaging if additional services are required, such as Oracle Internet Directory or single sign on using Oracle Access Manager.

Note:

When configuring Imaging for use with Oracle Access Manager, you must protect the /imaging/faces directory. Failure to do so prevents access to the Imaging Viewer.

Access to Imaging through web services is controlled by Oracle Web Services Manager (OWSM) policies. Policies are configured through the Oracle WebLogic Server console. Some policies require a keystore be defined. For example, Imaging must use access credentials stored in Credential Store Framework (CSF) to communicate with a workflow server or to use SSL. Keystores can be defined using Keytool from the Java Development Kit. Credentials can be added to defined keystores using WebLogic Scripting Tool (WLST).

Note:

Content Server account and collaboration security can be enabled on a Content Server repository being used by Imaging, however Imaging does not support their use on Imaging documents.

Figure 2-1 Imaging Security Overview

For additional information, see the following documentation:

Table 2-1 Additional System Security Documentation

Task
Where to Go For More Information

Administering Oracle WebLogic Server

Oracle Fusion Middleware Administrator's Guide

Using WebLogic Scripting Tool

Oracle Fusion Middleware WebLogic Scripting Tool Command Reference

Administering WebCenter Content

Oracle WebCenter Content System Administrator's Guide for Content Server

2.1.2 Installation Security Initialization

The first person to log in to Imaging after initial installation is granted full rights to all features, in order to properly set up an Imaging solution to meet company needs.

During Oracle WebLogic Server installation, a credential store is defined as the default. Imaging uses this default credential store for its security. If the credential store changes after the first Imaging user logs in, system security must be reset. For example, if the security configuration is changed to point to an Oracle Internet Directory (OID) provider or a Microsoft Active Directory provider, you must reset Imaging system security.

To reset system security, do the following:

Create or migrate users and groups to the new policy store using the management tools associated with the policy store.

Open WebLogic Scripting Tool (WLST) and run refreshIPMSecurity() MBean command. The system security is reset. For information on using WLST to run MBean commands, see Oracle Fusion Middleware WebLogic Scripting Tool Command Reference.

Note:

During the refresh, users or groups for whom matching identifying information is not found are ignored. As security changes are made, invalid users or groups are removed from the Imaging database.

For information on configuring Oracle WebLogic Server security providers, such as Oracle Internet Directory (OID) or Microsoft Active Directory, see Oracle WebCenter Content Installation Guide.

2.1.2.1 Migrating User Store from LDAP Server to Oracle Internet Directory

For information on migrating an existing LDAP Server credential store to Oracle Internet Directory, see "Reassociating the Identity Store with an External LDAP Authentication Provider" in Oracle WebCenter Content Installation Guide.

2.1.3 Definition Management Security Rights and Definition Security Rights

Once a user or group has been authenticated and access to Imaging has been granted, security rights to Imaging definitions take over.

Imaging definitions include the following:

Applications

Inputs

Searches

Connections

Solutions

Note:

Document security is defined within an application and includes security rights to annotations associated with a document. See Section 2.2.3, "Working with Document Security" and Section 2.2.4, "Working with Annotation Security".

If a user has been authenticated for access to Imaging but has not yet been given security rights to any Imaging definitions or definition management, they are presented with the Home page, but no navigation links are displayed in the Navigator Pane.

To properly administer an Imaging solution, a distinction must be made between definition management rights and definition rights:

Definition management security rights grant a user the ability to create or administer definitions (applications, inputs, searches, connections, and solutions).

Definition rights grant a user the ability to view, modify, delete, or manage access to specific definitions, such as an application named Invoices_US or search named US Purchase Orders.

Imaging definition management security rights and definition security rights are managed within the Imaging user interface.

2.1.3.1 Definition Management Rights

Definition management security is done using the Definition Management Security pages, accessed from the Manage Security panel of the Navigator Pane. Definition management rights have two levels of security:

Security Right | Description
Administrator | Grants users or groups full rights to definition management and includes the ability to assign other users or groups Administrator or Create rights.
Create | Grants the ability to create new definitions. Users who create a definition are automatically assigned all definition rights for that definition by default.

Administrator Rights

Administrator rights are typically given to few people, as they allow full control of definitions across the enterprise. Administrator rights are specific to definitions and do not apply to document rights. Therefore, someone with definition Administrator rights cannot modify any document security within an application.

This is designed to prevent people with Administrator rights to definition management from changing definitions in order to gain access to documents that are restricted to them. For this reason, users must be granted access to all of the security layers in order to have access to specific definitions. This approach comes from a need to have separation of business units. For example, if you set up an Content Server for a specific business unit in order to limit access to content on the server, you would not want other business units to have rights to put applications in that Content Server, nor to find documents within it.

Note:

Solution security is unique in that solutions are configured outside of Imaging. Administrators with access to the Solution Editor can, by default, edit any available solutions. For more information, see the Oracle WebCenter Administrator's Guide for Application Adapters.

Examples

The following are examples of what typical employees can do with assigned security rights.

Sasha in IT

An IT employee named Sasha at XYZ Company has Create rights to application and search definitions. This gives Sasha the ability to create new applications and grant rights to any application and search definitions she creates, even for other departments. It does not allow her to grant rights to all applications.

Theo in Accounts Receivable

Theo is a new employee in Accounts Receivable. He must be able to create searches and have access to all documents in Accounts Receivable, including orders that have customer credit card information in them. To secure the credit card information, all US orders are uploaded to the Orders_US application and stored in a specific repository connected to Imaging that Sasha doesn't have access to.

Sasha could add Theo as a user and grant him Create rights to searches using the Definition Management Security page, as well as add him as a user to most of the Accounts Receivable applications. However, Sasha does not have View rights to the connection defined in the Orders_US application, and so she cannot add him as a user to that application.

Someone other than Sasha who manages system access but has no specific definition management rights in Imaging would add Theo to a group that has Create rights to searches. The group would already be defined in the Orders_US application as having access to the documents within that application. By separating access control and limiting access to the connection, Sasha is prevented from modifying the Orders_US application to add herself as a user and therefore gain access to customer credit card data.

Bob in HR

Bob is a new employee in Human Resources. He must have rights to search all HR documents including private employee information, such as Social Security numbers, salary and health related documents. Such documents are stored in Imaging using the HR_Confidential application and retrieved using the Private Employee Information search.

Sasha doesn't have View rights to the HR_Confidential application, so she cannot modify the Private Employee Information search to give Bob access. Like Theo, Bob will most likely be added to a group already defined in the necessary search by someone other than Sasha who manages system access but has no specific definition management rights in Imaging.

Create Rights

Create rights are typically given to business managers throughout the enterprise, as these people know the business processes associated with the documents being uploaded to Imaging. They allow a manager to create and modify application, search, input, and connection definitions unique to their business needs. Additionally, by controlling access to the repository connections used to store documents, different business units can be isolated to help secure documents.

Example

For example, Theo is the new Director of Accounting for the XYZ Company US division. Bob in Human Resources says that the company is implementing a new employee program that allows employees to debit their pay check when ordering company product.

Initially Theo wants to modify the Pending Orders search to not only search the Orders_US application for orders not yet filled, but also the HR_Confidential application. Theo wants to verify that the person placing the order is a current employee by verifying Social Security information from the search results against Social Security information entered on the new order form. However, Theo doesn't have access to the repository connection used to store the documents in the HR_Confidential application.

When Theo contacts Bob to ask for access, Bob explains the legal reasons that Theo cannot capture Social Security information on an order form nor access such information from Human Resources. Instead, Bob suggests Theo use the employee e-mail address as a unique identifier that is available on documents accessible to Theo.

In this example, Theo knew the business need he was implementing, but his knowledge of business practice outside of his area was limited. The security put in place by Imaging allowed him to meet his business need without compromising privacy.

2.1.3.2 Definition Rights

Definition security is defined on the security train stop when the definition is created and managed using the appropriate panel of the Navigator Pane. For example, security for an application definition is defined on the Application Security Page and security for a search definition is defined on the "Search Security Page". Definition rights have four levels of security:

Security Right | Definition
View | Enabled by default. Grants the user or group the right to view this definition.
Modify | Grants the user or group the right to modify all aspects of this definition except for granting security rights.
Delete | Grants the user or group the right to delete this definition.
Grant Access | Grants a user or group the right to grant security rights to others for this definition. If this is the only security level granted, the user can modify only the security information for this definition.

Definition rights are specific to each definition created. Anyone needing access to a definition through other definition types must have at least View rights to the specific definition. For example, users in XYZ Company needing to create or modify search definitions against the Invoices_US application need to have at least View rights to that application definition. Theo, as director of the US Accounting department, has View rights to the Invoices_US application and all rights to the All US Invoices search in order to be able to refine or change the search as business needs refine or change. Theo also has Grant Access rights to the search in order to provide View rights to individual contract employees that help during high volume periods.

2.1.4 Users and Groups

Definition management rights and definition rights are defined for either individual users or for user groups managed through separate security providers to Oracle WebLogic Server, such as Oracle Internet Directory (OID) or other. Users or groups are granted various levels of access to definitions and definition management using the Imaging user interface. For example, when an application definition is created, a user or group is granted View rights to the application when they are added using the Application Security Page. Additional rights are then specified as required.

Groups are an efficient way to assign security rights to many individuals in an organization with identical access needs. For example, a Managers group could contain managers across an enterprise who need View rights to documents in the Resumes application. An HR_Managers group can be given Write, Delete, and Grant Access document rights to the same application in order to upload and delete resumes to and from Imaging, or grant access to the Resumes application and related searches to individual employees who might be asked to help when hiring a new employee.

Note:

Group membership is loaded at the time a user logs in to Imaging and remains active throughout the session until the user logs out. If a user is removed from a group while the user is logged in, that user retains the full rights of the group until the user logs out or the session is closed. The new user rights will take effect at the next log in.

Note that document security is assigned when an application is defined and only allows security rights to be assigned at the group level.

2.2 Definition Security and Definition Management Security

Definition security and definition management security is managed through the Imaging user interface. This section covers the following topics:

Section 2.2.1, "Working With Definition Management Security"

Section 2.2.2, "Working with Definition Security"

Section 2.2.3, "Working with Document Security"

Section 2.2.4, "Working with Annotation Security"

Section 2.2.5, "Security Example"

2.2.1 Working With Definition Management Security

Definition management security is managed using the Definition Management Security pages, accessed from the Manage Security panel of the Navigator Pane. To grant, revoke, or copy users and groups rights to applications, inputs, searches or connections, do the following:

Changing Existing User and Group Rights To Definitions

Click Manage Security in the Navigator Pane to expand the pane and expose the definition type you want to manage.

Click the definition type you want to manage:

Applications

Inputs

Searches

Connections

Solutions

The Definition Management Security page for that definition type is displayed.

Click Modify. A toolbar is displayed above the listing of security members and the Create and Administrator security rights columns become active.

Enable or disable the rights next to the security member being modified and click Submit. The modification toolbar closes and the definition management security has been changed.

Revoking Existing Users and Groups Security Rights to Definitions

With the Manage Security page displayed, click Modify.

Select the user or group to delete from the Security Member column.

Click Remove. The user or group is removed from the list and definition management rights for the definition type are revoked.

Granting Users and Groups Rights to Definitions

With the Manage Security page displayed, click Modify.

Click Add or select a user or group and click Copy to replicate the security options of the item selected. The Add Security Member Page is displayed.

Select Search Groups or Search Users from the choice list and enter the search criteria, then click Search. If no criteria is entered, a listing of all users or groups is returned.

Select the user or group to grant rights from the Security Member column. Multiple selections can be made by holding down either the Shift key on your keyboard when clicking to select a range, or the Control key when clicking to select non-sequential members.

Click Add. The Add Security Member page closes and the users or groups are listed in the Security Member column of the security page.

Enable or disable the rights next to the security member being added and click Submit. The modification toolbar closes and the definition management security has been changed.

2.2.2 Working with Definition Security

Definition security is defined when the definition is created and managed using the appropriate panel of the Navigator Pane. For example, Searches are managed using the Manage Searches panel in the Navigator Pane.

Managing definition security is detailed in the sections of this guide specific to the definition:

Section 4, "Managing Applications"

Section 5, "Managing Inputs"

Section 6, "Managing Searches"

Section 7, "Managing Connections"

Note:

Definitions can be accessed and modified by anyone with Administrator security rights to the definition. Definitions cannot be locked while being modified. Consequently, if the same definition is being modified at the same time by different people, only the last changes submitted are saved.

2.2.3 Working with Document Security

While application definition security and document security are different, document security is defined in the application when it is created. Document security rights can only be applied to groups and are specified for each group using the Application Document Security Page when the application is defined. Note that this means if you modify document security rights in an application, all documents currently in that application are affected. The following document rights can be enabled:

Security Right
Definition

View
Grants a user group rights to view documents within a specific application. If a user does not have at least View rights to a document, the document is not listed in a search result when the user executes a search.

Write
Grants a user group rights to upload, update, and copy documents and document metadata within a specific application. Until a user has Write security rights to documents in at least one application, the Upload tool is not visible in the Tools panel of the Navigator Pane.

Delete
Grants a user group rights to delete a specific document from an application. If a user has Delete rights to one application and Write security rights to a second application, then they can move a document from the first to the second application. Note that users with Delete permission are automatically assigned Write permission.

Grant Access
Grants a user group rights to assign document rights to other user groups. Note that users with Grant Access rights are automatically assigned Delete and Write security rights.

Lock Admin
Grants a user group rights to unlock any locked document in the application.

2.2.4 Working with Annotation Security

All users who have the rights to view a document also have the rights to view Standard and Restricted annotations. Annotations are placed on a document by a user with the rights to do so, but when viewed by a user who does not have rights to modify the annotation, a TIFF version of the document is rendered and displayed with the annotation burned in. This helps ensure that any redactions or other necessary annotations keep the document secure. A user must be granted annotation security rights in order to create, modify, or hide annotations.

All or some annotations can be burned in or hidden based on the security rights granted a group when the application is defined. For example, in the event that a user has Annotate Standard permissions and a document has Standard, Restricted, and Hidden annotations, the user would view a TIFF image of the document with the Restricted annotations burned in, the Standard annotations overlaid on top, and the Hidden annotations not displayed.

Annotations are specific to individual documents, but annotation security rights are defined in an application when specifying document security on the Application Document Security Page. Annotation security rights apply to every document in the application. Changing annotation security rights for a group in an application affects access to all annotations on documents in the application. Note that even though annotations are associated with and specific to each document in a repository, the annotations are stored separately so as to preserve the original document.

Because annotations are laid on top of documents, documents containing text data can sometimes shift underneath annotations. This can be a concern if text or images overlaid with a redaction annotation shift and become exposed. This is not an issue with improper security rights. It can happen when documents are created using fonts not available to the rendering engine when the document was uploaded. The rendering engine will then substitute fonts which may cause text shift and repagination. For information on how to avoid this problem, see Section 11.6, "Font Errors."

2.2.4.1 Annotation Permissions

There are three levels of security applicable to a document annotation within a specific application.

Security Right | Definition
Annotate Standard | Grants view, create, modify, and delete security rights to all annotations within the application that are not explicitly specified as Restricted or Hidden.
Annotate Restricted | Grants security rights to mark annotations within an application as Restricted and create, modify, or delete annotations marked as Restricted by others. All users have permission to view restricted annotations but must have Restricted annotation rights to create, modify, or delete them.
Annotate Hidden | Grants security rights to mark annotations within an application as Hidden and create, modify, and delete annotations marked as Hidden by others. You must have Annotate Hidden rights to view Hidden annotations.

2.2.5 Security Example

Maya, Sasha, John, Bob and Louis are employees at XYZ Company. They have the following business roles and are members of the following departments and groups:

Name
Department
Role
Group

Maya
IT
Director of Information Technology at XYZ Company. She was the first to log into Imaging after installation and set up all definitions, definition security rights, and definition management security rights. She has full administrative access to all of Imaging across the enterprise, but does not use it on a daily basis.
IT_Director

Sasha
IT
Administrator for Imaging at XYZ Company. She has full access to all of Imaging across the enterprise, except confidential employee information isolated on some repository connections to which she does not have access.
IT_Admin

John
HR
The Imaging administrator for the entire department. Because John is the HR Department administrator, he requires security rights to all Imaging actions pertinent to HR, but not security rights to anything pertinent to the Accounts Payable department, for example. John is the only individual allowed to create and modify application, search and input and connection definitions for Human Resources.
HR_IT

Bob
HR
Determines salary offerings to potential new employees, making the offer to a potential employee, and receiving the document when it has been accepted. Bob uses references external to the company to determine salary offers but once an offer has been accepted, he uploads the salary acceptance document to the Imaging system in an application called Offers and annotates it with an Accepted stamp. Once it has been uploaded, stamped, and saved, a workflow process is initiated that creates an HR new employee file that contains the stamped salary acceptance document. So Bob requires security rights to View, Create and Modify Documents called Offers.
HR_Managers

Louis
HR
Administrative assistant. Updates the database of employees' personal information. He does not use the personal salary information in an Offers document for his job, therefore, Louis would not have security rights to access, search, or upload Offers documents in Imaging
HR_Users

Definition Management Security Rights

Within the HR_Managers and HR_Users group of Imaging, Bob and Louis do not have any security rights to define definitions. That is because they do not create or manage applications, inputs, searches, and connections. They only use them.

Maya, Sasha and John however are granted the following definition management security rights according to the needs of their specific job responsibilities:

Security Right | Application | Input | Search | Connection
Administrator | Maya, Sasha | Maya, Sasha | Maya, Sasha | Maya, Sasha
Create | John | John | John | John

Definition Security Rights

Four of the five people need some level of security rights to the Offers definitions. John needs to administer them and Maya needs to have the ability to administer them or assign rights to someone else to administer them if John leaves or becomes incapacitated. Bob must have full rights to upload, annotate (to approve and redact salary information), find, view, and initiate the workflow process to create the new employee file. Louis must have rights to search and view documents to update personal information, but not to view redacted salary information. Sasha, however, does not have responsibility for administering confidential information, and so does not have rights to the repository connection where confidential information such as salaries and personal information is stored.

Each are granted the following definition security rights according to the needs of their specific job responsibilities:

Security Right | Offers Application | Offers Input | Offers Search | Workflow Connection
View | Maya, John, Bob, Louis | Maya, Bob | Maya, John, Bob, Louis | Maya, John
Modify | Maya, John | Maya, John | Maya, John | Maya, John
Delete | Maya, John | Maya, John | Maya, John | Maya, John
Grant Access | Maya, John | Maya, John | Maya, John | Maya, John

Document Security Rights

Only Bob and Louis work with the documents stored in the Offers application, so only the HR_Managers and HR_Users groups would be added on the Application Document Security Page when the Offers application was defined. Maya and John would not have access to the documents in the application, even though the application definition security rights grant them access to see and modify the Application definition.

Bob and Louis are granted the following document security rights according to their specific responsibilities:

Security Right | Documents | Group Members
View | HR_Managers, HR_Users | Bob, Louis
Write | HR_Managers | Bob
Delete | HR_Managers | Bob
Lock Admin | HR_Managers | Bob
Grant Access | HR_Managers | Bob
Annotate Standard | HR_Managers, HR_Users | Bob, Louis
Annotate Restricted | HR_Managers | Bob
Annotate Hidden | HR_Managers | Bob

These permissions allow Bob to upload and redact salary information from a document into the Offers application, where Louis can search for and view it to get updated personal information without being able to modify the redactions and see the salary information.

2.3 System Level Security

Imaging runs as a managed server within an Oracle WebLogic Server domain. Access to Imaging and the Content Server repository is controlled by Oracle WebLogic Server. System security, including SSL configuration, is handled through the Oracle WebLogic Server console. This section contains the following topics:

Section 2.3.1, "Configuring a Fusion Middleware Application to use SSL"

Section 2.3.2, "Integrating with a Workflow"

Section 2.3.3, "Configuring a Fusion Middleware Application to Use Web Services"

Section 2.3.4, "Web Services Security Configuration for Imaging"

Section 2.3.5, "Integrating Imaging With Oracle Access Manager 11g"

Section 2.3.6, "Integrating Imaging With Oracle Access Manager 10g"

Section 2.3.7, "Configuring Oracle Single Sign-On for Imaging"

Section 2.3.8, "Configuring Imaging and Single Sign-On for Windows Native Authentication"

For additional information, see the following:

Task | Where to Go For More Information
Administering Oracle WebLogic Server | Oracle Fusion Middleware Administrator's Guide
Configuring SSL with Oracle WebLogic Server | Oracle Fusion Middleware Securing Oracle WebLogic Server: Chapter 12, Configuring SSL

2.3.1 Configuring a Fusion Middleware Application to use SSL

You can configure Oracle Fusion Middleware to secure communications between Oracle Fusion Middleware components using SSL, which is an industry standard for securing communications. Oracle Fusion Middleware supports SSL version 3, as well as TLS version 1:

Table 2-2 SSL Documentation

For Information On...
See The Following Guide...

Configuring SSL with Oracle Fusion Middleware: Web Tier, Middle Tier, and Data Tier

Oracle Fusion Middleware Administration Guide: Chapter 6, SSL Configuration in Oracle Fusion Middleware

2.3.1.1 Configuring an SSL Content Server Repository Connection

To connect to an Content Server repository over SSL, the following steps must be taken:

Enable SSL on the Content Server Connection Content Server Settings Page

Add and configure an SSL incoming socket provider to the Content Server. See Connecting to Outside Entities with Providers in the Oracle WebCenter Content System Administrator's Guide for Content Server for additional information.

2.3.2 Integrating with a Workflow

Workflow integration is detailed in Section 10, "Understanding Workflow Agents" and Section 7.2, "Creating a Workflow Connection."

2.3.2.1 Integration Points

Imaging connects to a workflow process at the following times, using different mechanisms for each:

Configuration

Runtime

Configuration

Imaging connects to a workflow server when application fields are mapped to workflow payload elements. To connect, the provider, port, and credential information are passed using Web Services Inspection Language (WSIL). WSIL uses the HTTP protocol and a specific XML format to allow for the discovery of the web service end points on a server. Imaging follows links in the WSIL that meet certain criteria in order to discover deployed composites.

Once a composite and service are selected, the WSDL document is read from the server and parsed to obtain the list of available operations as defined by the service bindings in the WSDL. The protocol for reading the WSDL is HTTP and the address and port used are contained in part of the WSDL URI. Note that the address and port used may be different than the connection hostname and port if the workflow server is configured with an HTTP front end load balancer such as Oracle HTTP Server (OHS).

Once read, the WSDL is used to obtain the schema of the operation payload so that application fields can be mapped to it.

Details of the connection, composite name, service name, operation name, and application field to payload mapping are stored in the Application.BpelConfig section for use at runtime.

Runtime

Runtime communication occurs when Workflow Agent has received a notification that a document has been created in Imaging and a workflow process instance must be created for the document. For this communication, the connection, composite, and service name stored in BpelConfig is first used to obtain the service WSDL URI.

The WSDL URI is read to obtain the operation payload schema. The payload schema is used to construct the XML for the payload and the application field values are then inserted into the XML as defined by the mapping.

Once the payload is fully defined to include the mapped field values, the payload is submitted to the workflow service operation as a web service call using the address as specified in the WSDL document. The web service call is submitted using the HTTP protocol.

2.3.2.2 Workflow Connection Configuration

The first step in configuring the Imaging workflow integration is to create a connection definition for the workflow system within Imaging. The procedure for creating a workflow connection is detailed in Section 7.2, "Creating a Workflow Connection."

The parameters required for the configuration are described as follows:

Parameter
Details

HTTP Front End Address
The URL address of the workflow server, including the listening port if it is not the default port for the protocol defined in the URL.

Credential Alias
Provides the alias of a user name and password that are stored in the Credential Store Framework (CSF). These credentials are required to make the remote JNDI connection. The parameter is not the actual user name or password, but rather an alias, or key used to look up the user name and password in the CSF, which encrypted them to provide for proper security.

The credential must be created in the CSF before the workflow connection configuration can be completed. A credential can be created in the CSF in one of two ways: through Enterprise Manager (EM) or through WebLogic Scripting Tool (WLST).

Provider
Specifies the host name or names used for the connection. If the workflow server is a single instance, it is the name or IP of the workflow machine. If the workflow server is operating within a cluster, this parameter value can be a comma-separated list of machine names or IP addresses of servers in the cluster, or it can be the cluster name for the cluster.

When the cluster name is used, the cluster name must be defined in domain name server to resolve to the multiple machines within the cluster. Neither Imaging nor BPEL defines this behavior. Rather, it is defined by the WebLogic support for JNDI in a cluster. For details on clustered JDNI support, see the section "Using WebLogic JNDI in a Clustered Environment" in the Oracle Fusion Middleware Programming JNDI for Oracle WebLogic Server guide.

2.3.2.3 SSL Configuration

The Imaging integration can be configured to use SSL to secure communications with the workflow server instance. The procedure for enabling and configuring an SSL connection to a workflow server is detailed in Section 7.2.1, "Configuring SSL for the Workflow Server."

Working with the Default Demo Credential Store Framework and Credential Certificates

Once SSL is enabled on the workflow server instance, communication to the server will work properly for testing if both workflow and Imaging servers are configured to use the default DemoTrust certificates, because WebLogic configures a specific self-signed demo certificate and trust configuration when it is installed. These files are located in $WL_HOME/server/lib and are named DemoIdentity.jks and DemoTrust.jks. By default, WebLogic is configured to use these files.

Note:

These files should be used for test and demonstration purposes only. In a production environment, you should obtain proper and valid certificates and follow appropriate procedures for importing and configuring those certificates to establish identity and trust. When properly signed certificates are used and configured properly, SSL will work properly without special configuration.

You can use the demo certificate to test and confirm a workflow SSL connection. The SSL configuration allows Imaging to enumerate the composites and services, but when Imaging goes to read the WSDL, it will fail. This is because two SSL stacks are being used within the server:

The WLS SSL stack, which is integrated with the demo identity and trust configuration, is used for communication.

The native Java SSL stack, which is not integrated with the WebLogic demo identity and trust configuration, is used by the WSDL reader, which uses a native Java API.

To make the WSDL reader work, the Java SSL stack on the Imaging server instance must be told to trust the self-signed certificate on the workflow server.

To do this, the javax.net.ssl.trustStore system property must be set on the Imaging managed server JVM to point to the SSL trust store. To configure this to point to the DemoTrust.jks, add the following to the JAVA_OPTIONS in the setDomainEnv script:

-Djavax.net.ssl.trustStore=$WL_HOME/server/lib/DemoTrust.jks.

After pointing to the DemoTrust.jks, restart the managed Imaging server.

This works because all Oracle WebLogic Server shares use the same DemoTrust.jks file.

At runtime, there is still a potential that when WebLogic is installed and automatically generates an identity keystore (DemoIdentity.jks), the identity is keyed to the machine name. In some cases, the identity may only be hostname with no domain (so, sta00319, not sta00319.us.oracle.com). When Imaging goes to send the workflow process message, WebLogic performs hostname verification as part of its SSL handshake that attempts to validate that the hostname in the HTTPS request matches the identity to the server. However, the URL that the workflow system is giving is full DNS name, not just the hostname. So the handshake fails verification and the communication fails.

The simplest solution for demo purposes is to disable host name verification on the Imaging system. This is probably the easiest solution, but not a real world production solution. The procedure for this is documented here:

Configuring New CSF Credentials

You can also create self-signed CSF credentials instead of using the default demo credentials. For information on configuring a CSF credential for a workflow connection, see Section 7.2.2, "Configuring a Workflow Connection CSF Credential."

2.3.3 Configuring a Fusion Middleware Application to Use Web Services

WebLogic Web Services are implemented according to the Web Services for Java EE 1.2 specification, which defines the standard Java EE runtime architecture for implementing Web Services in Java. The specification also describes a standard Java EE Web Service packaging format, deployment model, and runtime services, all of which are implemented by WebLogic Web Services.

Table 2-3 Web Services Documentation

For Information On...
See The Following Guide...

Web Services consumed by JAX-WS clients

Oracle Fusion Middleware Getting Started with JAX-WS Web Services for Oracle WebLogic Server

Apply OWSM security to Web Services

Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server: Appendix A: Using Oracle Web Service Security Policies

Use MTOM with Web Services

Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server: Section 2.2: Example of Adding Security to MTOM Web Service

Invoke secured Web Service from BPEL

Oracle® Fusion Middleware Developer's Guide for Oracle SOA Suite: Chapter 7, Invoking a Synchronous Web Service from a BPEL Process

Oracle® Fusion Middleware Developer's Guide for Oracle SOA Suite: Chapter 8, Invoking a Asynchronous Web Service from a BPEL Process

Invoke Web Service using Oracle Server Bus

Oracle® Fusion Middleware Developer's Guide for Oracle Service Bus: 32 WS Transport

Invoke Web Service using Oracle Enterprise Server Bus

Oracle® Fusion Middleware Developer's Guide for Oracle SOA Suite: Chapter 19 Creating Mediator Routing Rules

2.3.4 Web Services Security Configuration for Imaging

Access to Imaging through web services is controlled by Oracle Web Services Manager (OWSM) policies. Policies are configured through the WebLogic Server console. Some policies require a keystore be defined. For example, Imaging must use access credentials stored in Credential Store Framework (CSF) to communicate with a workflow server or to use SSL. Keystores can be defined using Keytool from the Java Development Kit. Credentials can be added to defined keystores using WebLogic Scripting Tool (WLST).

Oracle Web Services Manager is designed to be flexible by allowing the end user to define the security policy that will be used rather than to have them predefined.

2.3.4.1 Working with Oracle Web Services Manager

When no policy is applied, the services default to using Http Basic Authorization or WS-Security UsernameToken based authorization. Http Basic Authorization passes user credentials in the HTTP header in the Authorization field. The value of this field contains a base64 encode of the username and password. The BasicUserToken client class is intended to use this form of authentication.

WS-Security UsernameToken profile passes both username and password but in a SOAP header structure. Refer to documentation on WS-Security UsernameToken Profile 1.0 for details. Note that the UsernameToken policies can also be enforced using an OWSM policy, in which case the OWSM policy implementation supersedes the default implementation. This option applies only when OWSM policies are not in use.

Because the password is transmitted unencrypted when using basic authentication and UsernameToken security, Imaging includes a configuration MBean called RequireBasicAuthSSL, allowing the service to require that SSL be used with this form of authentication.

For more robust security, OWSM polices can be applied to the services provided the OWSM Policy Manager is installed to the domain. OWSM policies can enforce various ws-security token usage, including message level encryption, transport level encryption, or supplying credentials in the SOAP header rather than HTTP header. Because SSL can be specified as part of the applied policies, the RequireBasicAuthSSL MBean setting does not apply when security policies are in use.

2.3.4.2 Setting Policies on Services

During domain creation, the Imaging application is supplied with a default deployment plan defined in the applications directory, although this plan is not yet assigned to the deployment. The default plan uses the wss_username_token_service_policy which enforces simple username and password in the ws-security soap header and requires no encryption. This default plan assigns the wss_username_token_service_policy to all Imaging services.

To assign the default plan, do the following:

Login to the WebLogic Server Console.

Click Deployments, enable imaging in the Deployments table, then click Update. The Update Application Assistant is displayed.

Click Change Path next to Deployment plan path. Changing the source path does not redeploy with a new plan.

Using the links in the Current Location field, browse to $MW_HOME/user_projects/applications/<domain_name>/server/ipm and enable the Plan.xml file.

Continue through the wizard to complete the deployment.

Once this process is complete, services all have the wss_username_token_service_policy applied.

If you want to change the policies at runtime, do the following:

Login to WebLogic Server console.

Click Deployments and then expand imaging in the Deployments table. A list of Imaging web services is displayed. You may need to scroll to see them.

Click the service name for each service you want to configure and do the following:

Note:

No policy should ever be applied to the DocumentContentService service.

Select the Configuration tab

Select the Ws-Policy tab. The currently applied policy is displayed.

Click the service end point. For example, the ApplicationServicePort. A listing of Available Message Policies and Chosen Message Policies is displayed.

Select the currently applied policy from the Chosen Message Policies list on the right and click the arrow to move it to remove it from the Chosen Message Policy list.

Select the preferred policy from the Available Message Policies list on the left and click the arrow to move it to the Chosen Message Polices list on the right.

Note:

You need to apply the same policy to all Imaging services with the exception of DocumentContentService. No policy should be applied to the DocumentContentService service.

When changes are made to all services, update the deployment with the newly edited plan.

Enable imaging in the Deployments table on the main deployments page, then click Update. The Update Application Assistant is displayed.

Check the top option to update only the deployment plan.

Click Finish.

To facilitate deployment, alternative deployment plan descriptors have been created. The are located in $MW_HOME/user_projects/applications/<domain_name>/server/ipm/plan/imaging-ws.war/WEB-INF directory. You can copy any one of the policy-<X> files on to weblogic-webservices-policy.xml in that same directory, and then update the deployment with the plan. Note that for the default plan, weblogic-webservices-policy.xml = policy-username_token.xml.

2.3.4.3 API Usage

It is important that all services be assigned the same policies. In the client API the ServicesFactory is coded to obtain the appropriate client policy from the provided UserToken, along with the required configuration parameters for the policy, and use that client policy configuration on all service interfaces. In order to work, client code must know what service policy is in effect. The following are examples of how to code the client for each of the predefined policy types within the UserToken class.

The UserToken class exposes a number of new properties to facilitate configuring client side policies. The set of parameters exposed is a subset of the full set of possible Oracle Web Service Manager parameters, but is commonly used. Note that the properties are wrappers around a name/value pair map which is directly exposed using the securityParameters property. All properties in this map get passed along to the web service request context and therefore any OWSM policy is usable.

2.3.4.4 Examples

The following examples are detailed here:

Example 2-1, "No Policy: Http Basic Auth"

Example 2-2, "Policy: wss_username_token_client_policy"

Example 2-3, "Policy: wss11_username_token_with_message_protection_client_policy"

Example 2-4, "Policy: wss10_saml_token_client_policy"

Example 2-5, "Policy: wss11_saml_token_with_message_protection_client_policy"

Example 2-1 No Policy: Http Basic Auth

The simplest and the default. Because this is the default the BasicUserToken provides the client implementation.

UserToken userToken = new BasicUserToken("weblogic", "weblogic");
ServicesFactory.login(userToken,  wsurl);

BasicUserToken is functionally equivalent to the following.

UserToken userToken = new UserToken();
userToken.setUserName("weblogic");
userToken.setPassword("weblogic");

When OWSM policies are applied to the services, the WsmUserToken is used to provide the client side policy configurations. This is done as follows for various policies.

Example 2-2 Policy: wss_username_token_client_policy

This is the simplest policy.

WsmUserToken userToken = new WsmUserToken ("weblogic", "weblogic");
userToken.setClientPolicy(WsmUserToken.USERNAME_TOKEN_POLICY);
ServicesFactory.login(userToken,  wsurl);

Example 2-3 Policy: wss11_username_token_with_message_protection_client_policy

Message_protection policies provide message level encryption. However to make them work, client and server keystores need to be configured. See the section Section 2.3.4.5, "Working With Keystores" for how to create and configure the key stores. When a keystore is used client side by a JSE client, the client code needs to configure the location, type, and password for the keystore. The client side keystore must contain a RecipientAlias which is the key used to encrypt the message sent to the server. This same key must exist server side to decrypt and encrypt the responses.

WsmUserToken userToken = new WsmUserToken ("weblogic", "weblogic");
userToken.setClientPolicy(WsmUserToken.USERNAME_TOKEN_MP_POLICY);
userToken.setKeystore(".\\config\\default-keystore.jks", "JKS", "welcome");
userToken.setRecipientAlias("orakey");

If this policy were being used server side, for example, from a web app or servlet, the key store would be configured underneath JPS security and therefore the client would not need to specify the keystore configuration parameters. This behavior can be replicated in JSE as well by setting the oracle.security.jps.config environment property to point to a jps-config file.

System.setProperty("oracle.security.jps.config", ".\\config\\jps-config.xml");
WsmUserToken userToken = new new WsmUserToken ("weblogic", "weblogic");
userToken.setClientPolicy(WsmUserToken.USERNAME_TOKEN_MP_POLICY);

Once JPS is configured for the client, you can also leverage the Credential Store Framework (CSF) to define the username and password credentials. See the section Section 2.3.4.6, "Working with the CSF through WLST." To use, create the credentials on the server and copy them to your client. You can use any alias in the credential store, but the standard default is the alias basic-credentials.

System.setProperty("oracle.security.jps.config", ".\\config\\jps-config.xml");
WsmUserToken userToken = new WsmUserToken ();
userToken.setClientPolicy(WsmUserToken.USERNAME_TOKEN_MP_POLICY);
userToken.setCsfKey("basic.credentials");

Example 2-4 Policy: wss10_saml_token_client_policy

This policy is similar to username token but only the passes the username in the saml token header. Also, its not encrypted and therefore not secure.

WsmUserToken userToken = new WsmUserToken ("weblogic");
userToken.setClientPolicy(WsmUserToken.SAML_TOKEN_POLICY);

Example 2-5 Policy: wss11_saml_token_with_message_protection_client_policy

This option encrypts and signs the message using keys and certificates from the keystore. This is the most secure of all the options and requires the most configuration. Typically, service-side code has the user identity in the form of a java.security.Principal object. So server-side code might look as simple as the following.

WssUserToken userToken = new WssUserToken (principal.getUserName();
userToken.setClientPolicy(WsmUserToken.SAML_TOKEN_MP_POLICY);
ServicesFactory.login(userToken,  wsurl);

For JSE, the jps configuration trick works here as well.

System.setProperty("oracle.security.jps.config", ".config\\jps-config.xml");
WssUserToken userToken = new WssUserToken ("weblogic");
userToken.setClientPolicy(WsmUserToken.SAML_TOKEN_MP_POLICY);

Without JPS configuration, the client can provide the full set of keys. Since this seems like an extreme use case, the UserToken does not provide full access to all of the key properties required by the policy. This demonstrates how any policy parameters can be supplied through the securityParameters property.

WssUserToken userToken = new WssUserToken ();
userToken.setUserName("weblogic");
userToken.setClientPolicy(WsmUserToken.SAML_TOKEN_MP_POLICY);
userToken.setKeystore(".\\config\\default-keystore.jks", "JKS", "welcome");
userToken.getSecurityParameters().put(SecurityConstants.ClientConstants.WSS_ENC_KEY_ALIAS, "orakey");
userToken.getSecurityParameters().put(SecurityConstants.ClientConstants.WSS_ENC_KEY_PASSWORD, "welcome");
userToken.getSecurityParameters().put(SecurityConstants.ClientConstants.WSS_SIG_KEY_ALIAS, "orakey");
userToken.getSecurityParameters().put(SecurityConstants.ClientConstants.WSS_SIG_KEY_PASSWORD, "welcome");

In these configuration examples, the same key is used in all cases. In a production environment, the keystore should contain client and service-side certificates or signing and encrypting respectively.

2.3.4.5 Working With Keystores

For any of the message_protection policies, client and server keystores need to be configured. In a production environment, you should obtain proper and valid certificates and follow appropriate procedures for importing and configuring those certificates to establish identity and trust. This example is meant to provide a workable solution for development and testing. You can create a keystore using a build in JDK tool called KeyTool. You use the following command to generate a keystore.

>keytool -genkey -alias orakey -keyalg RSA -keystore default-keystore.jks
Enter keystore password:   ß welcome
Re-enter new password:    ß welcome
What is your first and last name?
  [Unknown]:  Joe Smith
What is the name of your organizational unit?
  [Unknown]:  Human Resources
What is the name of your organization?
  [Unknown]:  Our Company
What is the name of your City or Locality?
  [Unknown]:
What is the name of your State or Province?
  [Unknown]:
What is the two-letter country code for this unit?
  [Unknown]:  US
Is CN=Joe Smith, OU=Human Resources, O=Our Company, L=Unknown, ST=Unknown, C=US correct?
  [no]:  yes

Enter key password for <orakey>
        (RETURN if same as keystore password):   ß RETURN...so welcome
>

You can list keys in a keystore with

>  keytool -list -keystore default-keystore.jks

The above example creates the single common key used in all of the examples above. The same default-keystore.jks was used on both the server and the client.

2.3.4.6 Working with the CSF through WLST

The following command can be used from WLST to add credentials into the keys store. However, to use these commands, you have to run WLST from the $ORACLE_HOME/common/bin directory rather than from the WLS home common/bin. In JDeveloper, this is located in Oracle/Middleware/jdeveloper/common/bin and not Oracle/Middleware/wlserver_10.3/common/bin. From the $ORACLE_HOME/common/bin, run wlst.sh (Linux) or wlst.cmd (Windows) and the run connect().

The full set credential store commands are documented in the Oracle Fusion Middleware WebLogic Scripting Tool Command Reference, but the main two used in these examples are:

createCred(map="oracle.wsm.security", alias="<alias>", user="<user>", password="<pwd>")

and

listCred(map="<map>", key="<key>)

The credential store can store any userid and password pair accessed by an alias. For WSM policies, the acsf aliases are used to obtain keystore aliases and passwords. These CSF aliases are configured in the jps-config.xml file in the following element.

  <!-- KeyStore Service Instance -->
  <serviceInstance name="keystore" provider="keystore.provider" location="./default-keystore.jks">
      <description>Default JPS Keystore Service</description>
      <property name="keystore.type" value="JKS"/>
      <property name="keystore.csf.map" value="oracle.wsm.security"/>
      <property name="keystore.pass.csf.key" value="keystore-csf-key"/>
      <property name="keystore.sig.csf.key" value="enc-csf-key"/>
      <property name="keystore.enc.csf.key" value="enc-csf-key"/>
  </serviceInstance>

The keystore needs one alias named keystore-csf-key that includes the password for the key store. In this example, it is the first password entered in the keytool, above. The username here is ignored. Then the keystore needs a second alias named enc-csf-key. The username is a keystore alias and the password is the private password for that keystore alias, which is the second password in the keytool, above.

2.3.5 Integrating Imaging With Oracle Access Manager 11g

This section describes how to configure Imaging to work with Oracle Access Manager (OAM) 11g. For more information on deploying Imaging and OAM within an enterprise, see the Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Enterprise Content Management Suite.

To integrate OAM 11g with Imaging, do the following:

Install and configure Oracle Access Manager (OAM), Oracle HTTP Server (OHS), and WebGate as described in "Installing the Oracle Identity Management 11g Software" in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

Append Imaging entries to mod_wl_ohs.conf, using the example below. Replace hostname with the name of the machine hosting the Imaging instance, and portnumber with the port of the Oracle WebLogic Server domain hosting Imaging:

Forwarding URLs:
<Location /imaging>
      SetHandler weblogic-handler
      WebLogicHost <hostname>
      WebLogicPort <portnumber>
</Location>

Use the Oracle OAM remote registration tool (oamreg) to register an Oracle OAM Agent, specifying protected and public Imaging URIs. For more information, see Provisioning an ORACLE OAM Agent with Oracle Access Manager 11g" in Oracle Fusion Middleware Application Security Guide and "Setting Up OAM Agents" in Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

Imaging Public URI | Imaging Private URI
/imaging | /imaging/faces

Configure the Imaging domain by ensuring you perform these tasks. See "Deploying the Oracle Access Manager 11g SSO Solution" in Oracle Fusion Middleware Application Security Guide.

Configure the OAM Identity Asserter. The control flag for the OAM Identity Asserter must be set to REQUIRED, and both OAM_REMOTE_USER and ObSSOCookie must be selected as Active Types.

See "Identity Asserter for Single Sign-on Function," "About Using the Identity Asserter for SSO with OAM 11g and 11g WebGates," and "Configuring Identity Assertion for SSO with Oracle Access Manager 11g" in Oracle Fusion Middleware Application Security Guide.

Configure an Authentication provider. This is necessary to specify the user store, such as Oracle Internet Directory (OID) or another external LDAP server. For example, if OAM is using OID, then an OID Authentication provider must be added to the Imaging domain.

Note:

When the Oracle WebLogic Server domain for Imaging is configured to use an authentication provider other than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or Imaging will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set to SUFFICIENT. For more information, see the section, "Configuring the First Authentication Provider." in the Oracle WebCenter Content System Administrator's Guide for Content Server.

See "Installing the Authentication Provider with Oracle Access Manager 11g" and "Setting Up Providers for Oracle Access Manager Identity Assertion" in Oracle Fusion Middleware Application Security Guide.

See Table 12-1 in Oracle Fusion Middleware Application Security Guide for information on the differences when deploying the Authentication Provider with OAM 10g versus OAM 11g.

Configure the OPSS (OAM) Single Sign-On provider.

See Oracle Fusion Middleware Security Guide: Configuring Single-Sign On in Oracle Fusion Middleware.

After installing and configuring OAM 11g, check that you can access all of the configured Imaging applications, and that the login is giving you access to all of your configured Imaging applications without prompting you to sign in again. Also test global logout where available and make sure you are logged out of all other related applications.

Note:

When using Oracle Access Manager (OAM) 11g WebGate 11g single sign-on (SSO), you must set the WebGate 11g Agent user-defined parameter, filterOAMAuthnCookie=false. Failure to do so causes an error when using the viewer in advanced mode. For more information on setting the Agent user-defined parameters using the OAM console or when registering partners remotely, refer to the Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager with Oracle Security Token Service.

For more information, see Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager and Oracle Fusion Middleware Application Security Guide.

2.3.6 Integrating Imaging With Oracle Access Manager 10g

This section describes how to configure Imaging to work with Oracle Access Manager (OAM) 10g. Before configuring OAM, ensure that Oracle WebLogic Server, WebCenter Content, and Imaging are deployed. For details, see Oracle WebCenter Content Installation Guide.

Note:

Deploying Imaging version 11gR1 in an environment using Oracle Access Manager version 10g requires additional configuration to process logout requests properly. For detailed information, see the section "Configuring Global Logout for Oracle Access Manager 10g and 10g WebGates" in the Oracle Fusion Middleware Application Security Guide.

Before you can configure Oracle Access Manager (OAM), install the software using the instructions provided in "Installing the Oracle Identity Management 10g Software" in Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

Install and configure Oracle Access Manager (OAM), Oracle HTTP Server (OHS), and WebGate as described in "Deploying SSO Solutions with Oracle Access Manager 10g" in Oracle Fusion Middleware Application Security Guide.

Append Imaging entries to mod_wl_ohs.conf, using the example below. Replace hostname with the name of the machine hosting the Imaging instance, and portnumber with the port of the Oracle WebLogic Server domain hosting Imaging:

<Location /imaging>
      SetHandler weblogic-handler
      WebLogicHost <hostname>
      WebLogicPort <portnumber>
</Location>

Use the Oracle OAM configuration tool (cfgtool) to specify the Imaging URIs to protect. For Imaging, protect /imaging/faces.

The Oracle Access Manager Configuration tool is a command-line utility, which you can use to launch a series of scripts to request information and set up the required profiles and policies in Oracle Access Manager. For details, see "About Using OAMCtgTool" in Oracle Fusion Middleware Installation Guide for Oracle Identity Management.

Configure the Imaging domain by ensuring you perform these tasks. For details, see "Deploying SSO Solutions with Oracle Access Manager 10g" in Oracle Fusion Middleware Application Security Guide.

Configure the OAM Identity Asserter. The control flag for the OAM Identity Asserter must be set to REQUIRED.

See "Configuring OAM Identity Assertion for SSO with Oracle Access Manager 10g" in Oracle Fusion Middleware Application Security Guide.

Configure an Authentication provider. This is necessary to specify the user store, such as Oracle Internet Directory or an external LDAP server.

See "Installing and Setting Up Authentication Providers for OAM 10g" and "Configuring the Authenticator for Oracle Access Manager 10g" in Oracle Fusion Middleware Application Security Guide.

See Table 12-1 in Oracle Fusion Middleware Application Security Guide for information on the differences when deploying the Authentication Provider with OAM 10g versus OAM 11g.

Configure the OPSS (OAM) Single Sign-On provider.

See Oracle Fusion Middleware Security Guide: Configuring Single-Sign On in Oracle Fusion Middleware.

For more information, see Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager.

2.3.7 Configuring Oracle Single Sign-On for Imaging

Oracle Single Sign-On (OSSO) is part of the 10g Oracle Application Server suite. OSSO is an enterprise-level single sign-on solution that works with the OC4J application server in conjunction with Oracle Internet Directory and Oracle HTTP Server (OHS) 11g.

If OSSO is already in place as the enterprise solution for your existing Oracle deployment, Oracle Fusion Middleware continues to support the existing OSSO as a solution. However, Oracle recommends that you consider upgrading to Oracle Access Manager 11g Single Sign-On solution.

This section provides information for integrating Imaging with Oracle Single Sign-On.

See also Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management, Oracle Fusion Middleware Application Security Guide, Oracle Fusion Middleware Upgrade Planning Guide, and Oracle Fusion Middleware Upgrade Guide for Oracle Identity Management.

Before you can configure Oracle Single Sign-On (OSSO), ensure that the software is installed. Oracle Single Sign-On and Oracle Delegated Administration Service are not part of the 11g release. Customers must download the 10.1.4.* versions of these products, which are compatible with 11g Oracle Internet Directory and Oracle Directory Integration Platform, to form what was known in 10g as the Application Server Infrastructure. For deployment instructions on these 10g products, read Chapter 4 "Installing and Configuring JAZN-SSO/DAS" in the Oracle Application Server Enterprise Deployment Guide (B28184-02) for Oracle Identity Management release 10.1.4.0.1. This manual is available on Oracle Technology Network at:

http://download.oracle.com/docs/cd/B28196_01/core.1014/b28184/toc.htm

Configure Oracle Single Sign-On (OSSO). See Oracle Fusion Middleware Application Security Guide.

Append entries to the mod_wl_ohs.conf file for Imaging to add Enterprise Content Management (ECM) Uniform Resource Identifiers (URIs) to forward. Use the appropriate location entries from the following example. Each entry in the example maps the incoming path to the appropriate Oracle WebLogic Server on which Imaging resides.

In the following list of entries, hostname represents the name of the computer hosting the Imaging server, and portnumber represents the port number of the Oracle WebLogic Server on which Imaging. Replace hostname and portnumber with your system's host name and port name.

Caution:

The Imaging location /ipm can be customized, so the /ipm designation can not guarantee that HTTP requests will include the correct location. If /ipm has been changed, then forward the location the administrator has configured.

# IPM
<Location /imaging>
      SetHandler weblogic-handler
      WebLogicHost <hostname>
      WebLogicPort <portnumber>
</Location>

Append entries to the mod_osso.conf file (at ORACLE_HOME/ohs/conf/) to include Imaging URIs to protect. Use the appropriate Location entries from the following example. Each entry in the following example maps the incoming path to the appropriate Oracle WebLogic Server on which Imaging resides.

# IPM
<Location /imaging/faces>
    require valid-user
    AuthType Osso
</Location>

Configure the Imaging domain by ensuring you perform these tasks. See "Configuring Single Sign-On using OracleAS SSO 10g" in Oracle Fusion Middleware Application Security Guide.

Add and configure the OSSO Identity Asserter for the Oracle WebLogic Server for WebCenter Content. Oracle recommends the following Authentication Providers: OSSO Identity Asserter, OID Authenticator, Default Authenticator.

The OID Authenticator provider is for the Oracle Internet Directory server, which is used in production-level systems. The Default Authenticator provider is for the Oracle WebLogic Server embedded LDAP server.

Ensure that OSSOIdentityAsserter is set as the primary provider authenticator for the domain, so that user profile can be retrieved from the associated Oracle Internet Directory server. If necessary, reorder the providers so they appear in the following order, with control flags set as listed:

OSSOIdentityAsserter (REQUIRED)

OIDAuthenticator (SUFFICIENT)

DefaultAuthenticator (SUFFICIENT)

Note:

When the Oracle WebLogic Server domain for Imaging is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or Imaging will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set to SUFFICIENT. For more information, see the section "Configuring the First Authentication Provider" in the Oracle WebCenter Content System Administrator's Guide for Content Server.

Configure the Authentication provider. This is necessary to specify the external LDAP server for the user store, such as Oracle Internet Directory (OID) or Oracle Virtual Directory (OVD), to match the LDAP server used by OAM. For example, if OSSO is using OID, then an OID Authentication provider must be added to the WebCenter Content domain.

2.3.8 Configuring Imaging and Single Sign-On for Windows Native Authentication

Setting up Imaging and single sign-on (SSO) with Microsoft clients requires configuring the Microsoft Active Directory, the client, and the Oracle WebLogic Server domain. Details including system requirements for SSO with Microsoft clients are provided in "Configuring Single Sign-On with Microsoft Clients" in Oracle Fusion Middleware Securing Oracle WebLogic Server.

As part of configuring SSO with Microsoft clients, you must specify an LDAP authentication provider to access the external Microsoft Active Directory. Oracle WebLogic Server offers an LDAP provider already configured for Microsoft Active Directory: the Active Directory Authentication provider. See "Configuring LDAP Authentication Providers" in Oracle WebLogic Server Securing Oracle WebLogic Server.

Note:

When the Oracle WebLogic Server domain for Imaging is configured to use a different authentication provider than the DefaultAuthenticator provider, the new authentication provider must be the first authentication provider listed in the security realm configuration, or Imaging will fail to load any user privileges. Make sure to re-order the authentication providers so the new authentication provider is listed before the DefaultAuthenticator provider. Also ensure that the DefaultAuthenticator control flag is set to SUFFICIENT. For more information, see the section "Configuring the First Authentication Provider" in the Oracle WebCenter Content System Administrator's Guide for Content Server.

As part of configuring SSO with Microsoft clients, you must configure the Negotiate Identity Assertion provider in Oracle WebLogic Server security realm. The identity assertion provider decodes Simple and Protected Negotiate (SPNEGO) tokens to obtain Kerberos tokens, validates the Kerberos tokens, and maps Kerberos tokens to WebLogic users. Use the Oracle WebLogic Server Administration Console to add a new provider in the appropriate security realm in the domain structure, assign it a name, then select NegotiateIdentityAsserter for its Type. Activate the changes and restart the Oracle WebLogic Server. Now your server can use the Kerberos ticket it receives from the browser.

You must redeploy Imaging using the Imaging deployment plan. A deployment plan is an XML document. Oracle provides a plan for Imaging, or you also can create a deployment plan using the Oracle WebLogic Scripting Tool. To deploy using the provided plan, do the following:

Log in to the Oracle WebLogic Server Administration Console.

Click Deployments in the Domain Structure navigation tree.

On the Control tab, click Next until you see the Imaging deployment.

Select the checkbox to the left of the deployment.

Click Update.

Under the Deployment plan path, select Change Path.

Navigate to and select the ipm-deployment-plan.xml plan file.

Verify that Redeploy this application using the following deployment files is selected.

Click Next.

Click Finish.

To verify that SSO with Microsoft clients is configured properly, access the Microsoft Web application or Web service you want to use using a browser. If you are logged on to a Windows domain and have Kerberos credentials acquired from the Active Directory server in the domain, you should be able to access the Web application or Web service without providing a username or password.

ipm-deployment-plan.xml

Use the provided ipm-deployment-plan.xml file, or create an .xml file and name it ipm-deployment-plan.xml.

<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan
    xmlns="http://xmlns.oracle.com/weblogic/deployment-plan"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd"
    global-variables="false">
  <application-name>ipm.ear</application-name>
  <variable-definition>
   <variable>
      <name>http-only</name>
      <value>false</value>
    </variable>
  </variable-definition>
  <module-override>
    <module-name>ipm.war</module-name>
    <module-type>war</module-type>
    <module-descriptor external="false">
      <root-element>weblogic-web-app</root-element>
      <uri>WEB-INF/weblogic.xml</uri>
      <variable-assignment>
        <name>http-only</name>
        <xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
      </variable-assignment>
    </module-descriptor>
  </module-override>
</deployment-plan>

3 Changing Configuration Settings

Imaging runs within Oracle WebLogic Server and connects to one or more Content Server repositories. This section describes the configuration options available to an Imaging administrator and how they are accessed.

This section contains the following topics:

Section 3.1, "Configuration Overview"

Section 3.2, "Post-Installation Configuration"

Section 3.3, "Configuration of Repository Options"

Section 3.4, "Exporting and Importing Definitions"

Section 3.5, "File Size Limits"

Section 3.6, "Configuring MBeans"

Section 3.7, "Setting Font Variables"

Section 3.8, "Configuring Display of Seconds in Search Results"

Section 3.9, "Configuring Imaging Logging"

3.1 Configuration Overview

Imaging configuration is done in one of the following ways:

Using Content Server repository product configuration tools to set configuration settings, such as adding users and managing user roles and system access rights. For more information, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

Using the Imaging web-based interface for the creation and modification of applications, searches, inputs, and connections to set application security, searches security, document security, repository connections and BPEL configurations.

Using WebLogic Scripting Tools (WLST) to configure MBeans. For more information about changing Imaging custom MBeans, see Section 3.6, "Configuring MBeans."

Using Enterprise Manager (EM) to configure MBeans. For more information about using Enterprise Manager to configure MBeans, see Oracle Fusion Middleware Administrator's Guide.

3.2 Post-Installation Configuration

If this is an initial installation of Imaging and WebCenter Content in the same Oracle WebLogic Server domain, you must do the following before logging in to Imaging:

Log in to Content Server

Accept the Content Server configuration

Restart Content Server.

Once Content Server is configured and ready, the first user who logs in to Imaging is granted security rights to complete the following post-installation configuration steps:

connecting to an Content Server repository

configuring Content Server Storage Provider for production use. See Section 3.3.1, "Storage Management" for more information.

on Linux systems, configuring the GDFontPath MBeans

setting environment variables for Oracle Outside In

connecting to a workflow server

These steps and the full installation procedure are documented in the Oracle WebCenter Content Installation Guide.

3.3 Configuration of Repository Options

Imaging uses the functionality of the Content Server to store and retrieve documents. Documents are stored and secured based on criteria specified in the application into which they were uploaded. You must create a connection for Imaging to recognize the repository you are using. For more information about creating a connection, see Section 7, "Managing Connections."

Configuring repository options, such as defining the maximum number of search results returned or if the full-text of a document can be indexed, must be done through the Content Server repository. It is recommended that you make all necessary repository configuration prior to defining any application, input, search, or connection objects in Imaging. For more information, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

3.3.1 Storage Management

Content Server uses file store providers to determine where and on what type of media content is stored. Note that the default storage provider configured when Content Server is installed is not intended for a production environment and is not adequate for large numbers of ingested documents. The default can be used for demonstration systems of less than 10,000 documents, but production systems require more advanced configurations. File store providers are configured in Content Server independent of Imaging. For more information, see Section 3.3.4, "Content Server File Store Provider Rules" and the Oracle WebCenter Content System Administrator's Guide for Content Server.

When integrated with Oracle URM, Content Server has the option to move documents from one media to another based on time, and documents can be deleted based on lifecycle. If Imaging is not integrated with Oracle URM and you need to move content to a different file store or delete documents and all revisions, you must do so explicitly using the Content Server Archiver or the Content Server Repository Manager tool.

For more information about configuration options provided by Imaging on the Storage Policy page, see Section A.29, "Application Storage Policy Page." For more information on retention management using Oracle URM, see Oracle WebCenter Content Setup Guide for Records.

3.3.2 Repository Capacity

An Content Server repository can get full to the point of reducing its operating efficiency at which time it will not accept any new Imaging applications. However, you may continue to upload documents to existing applications in that repository.

An Content Server repository is considered full if any of the following are true:

The number of security groups exceeds the value of the environment variable IpmMaxGroupLimit.

The number of roles assigned permission to security groups exceeds the value of the environment variable IpmMaxGroupRoleLimit.

The number of metadata fields exceeds the value of the environment variable IpmMaxMetadataFields.

The Content Server configuration setting IpmRepositoryForceFull=True

Setting IpmRepositoryForceFull equal to True allows you to configure Content Server to identify itself as full to Imaging in order to prevent additional applications from being created. This does not prevent documents from being uploaded.

To get additional space for applications, do one of the following:

Install an additional Content Server repository as a master, or set it as a proxy to the main Content Server. For information on how to configure a master or proxy server, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

Increase the values of the IpmMaxGroupRoleLimit environment variable (maximum number of security group versus security group role mappings that have privileges assigned before a Content Server is considered full) and IpmMaxMetadataFields environment variable (maximum number of metadata fields before a Content Server is considered full) by editing the config.cfg file directly or by using the Content Server administrative server. The default value for both of these variables is 500. For more information about changing Content Server environment variables, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

3.3.3 Storage Media

Content Server defines where and how it stores content using file store providers, which are configured in Content Server and can be a combination of any media supported by Content Server. Because document storage location is not defined by the media being used for storage, the term volume is used to represent a storage location when defining an application in the Imaging user interface. Note that Imaging cannot be used to create or define a volume. It only connects to one defined and configured by a Content Server administrator from within Content Server.

3.3.4 Content Server File Store Provider Rules

File Store Provider functionality within Content Server allows you to have more control over how and where files are stored and managed within Content Server. For example, typically you would only be able to store all content on a single file system in the vault and weblayout directories. However, using FileStoreProvider, you have the ability to store content across multiple file systems, while also being able to store content within a database.

3.3.4.1 Disabling the Repository Weblayout Directory

Content Server traditionally uses a weblayout directory on a file system to store content in a format for viewing in a web browser, even though the main storage volume may be set up in a database. This can allow for faster retrieval of content when Content Server is being used to manage a web site, or can be used to store a secondary file used to describe the primary content item, but it doesn't have much use in an Imaging solution. Retaining a web layout directory for an exclusively Imaging solution would copy files to a web layout directory that would never get used, taking up unnecessary storage space. It is recommended that any file store provider configured for use as an Imaging volume should have the weblayout functionality disabled. For information about disabling the weblayout directory, or about FileStoreProvider in general, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

3.3.5 Additional Content Server Components

Imaging uses Content Server components to provide compatibility and additional options. Ensure that they are installed and enabled.

3.3.5.1 Required Components

The following component is required to be installed and enabled to ensure compatibility with Content Server:

IpmRepository: Sets global profile rules to support document profiles specific to Imaging applications, for compatibility with other products supported by Content Server, including:

Content Server Folders

Oracle Universal Records Manager (URM)

Oracle Information Rights Management (IRM)

3.3.5.2 Optional Components

The following components provide useful functionality that can be leveraged by Imaging:

OracleTextSearch: Provides full-text indexing capability.

ContentTracker: Provides audit capability for content access.

Folders: Provides integration with LDAP and would allow Imaging to be configured to automatically add documents to specific folders.

3.4 Exporting and Importing Definitions

When deploying an Imaging solution, you must define applications, searches, inputs, and connections. Applications are the core of Imaging. An application is a type of management container for documents, defining a metadata set, storage information, and security for all documents within it. Searches enable a user to quickly retrieve a document they need, and an input definition is used to map information from an input file to the metadata fields defined in an application. Applications, searches, inputs, and connections are defined using the Imaging user interface.

You can reuse the application, search, and input definitions by exporting the desired definition to an XML file format. You can then import that definition file into other systems to make those same items available there. For example, if you created an Invoices application for Accounts Receivable and now want to create a similar application for Accounts Payable, you can start with the imported application definition and then modify it as necessary in the Imaging user interface.

Note that when exporting an application, you can explicitly export it by selecting the application and following the procedure detailed in Section 3.4.1, "Exporting Definitions." However, you can also implicitly export application definitions by selecting a search or input that references the application and following the export procedure. Explicitly exported application definitions can modify existing application definitions if you specify them to do so. Implicitly exported application definitions cannot modify existing definitions.

3.4.1 Exporting Definitions

To export a definition file, do the following:

Under Tools in the navigator pane, select Export Definitions. The Export Definitions: Export Comments Page page displays.

Enter any comments about the exported definitions, such as the need for exporting, and click Next. The Export Definitions: Applications Page is displayed.

Enable any application definitions needed for export.

Click Next. The Export Definitions: Searches Page is displayed.

Enable any search definitions needed for export.

Click Next. The Export Definitions: Inputs Page.

Enable any input definitions needed for export.

Click Next. The Export Definitions: Summary Page is displayed.

Review the information on the summary page and ensure it is accurate. Use the navigation train to go back and make any changes. When satisfied, click Create Export File.

3.4.2 Importing Definitions

After you have created a definition file, complete the following steps to import it:

Under Tools in the navigator pane, click Import Definitions. The Import Definitions: File Location Page displays.

Enter the path or click Browse to navigate to the definition file that contains the exported definitions you want to import and click Next. The Import Definitions: Select Imports Page displays.

Note:

If using your keyboard rather than your mouse to select the Browse button, tab to the Browse button and then use the Space bar to execute the Browse button function and open the dialog box. The Enter key does not execute the Browse button function.

Select the action for each application, input and search definition to be imported. Options are:

Overwrite: the imported definition overwrites the current definition

Add: the imported definition is added to the system

Note:

Remember that implicitly exported application definitions cannot overwrite existing definitions. Implicitly exported application definitions are those applications that were not explicitly selected for export, but are referenced by a search or input definition that was selected.

If more than one repository is available, select the repository to be used with the imported definition. Click Next. The Import Definitions: Validate Imports Page displays.

Select your decisions about whether to change the Security, Document Security, Storage Policy, Workflow, and Full-Text Option settings of the imported definitions. Click Submit. The Import Summary page displays.

Review the information on the summary page and ensure it is accurate. Use the navigation train to go back and make any changes. When satisfied, click Close.

3.5 File Size Limits

File size limitations are primarily a factor when retrieving a document for viewing. System architecture, hardware limitations, network load and other factors can influence document retrieval times and cause the viewer to time out. Imaging has been optimized to store tiff image files of sizes to 200KB. If the documents you need to upload and view are larger than to 200KB, test the performance of with those files in the specific network architecture you are planning to use while simulating peak network load.

3.6 Configuring MBeans

Java Management Beans, called MBeans, are part of the greater Java Management eXtensions (JMX) standard which defines ways for administration applications to configure and control Java applications externally. At installation, Imaging registers its MBeans with the hosting application server's MBean server. This allows other applications to interact with Imaging's configuration data. This includes WebLogic Scripting Tools (WLST) and Oracle Enterprise Manager MBean browser.

3.6.1 Imaging MBeans

The following table describes MBeans specific to Imaging.

MBean
Description

CacheAgeLimit
Render page-cache timeout duration (used to set the JOC IdleTime). Takes effect at server restart.

Value limits: Cache idle time in minutes

Default: 60 minutes

CacheLocation
Render page-cache temp file location. Takes effect at server restart.

Value limits: Value is used as third parameter to File.createTempFile; a valid system file path spec.

Default: If value is not supplied, system temp location is used.

CheckInterval
Configures how often (in minutes) input agent checks for work. Takes effect on the next check cycle.

Value limits: Min=1, Max=60

Default: 15 minutes

CleanupExpireDays
Sets the number of days after which images are deleted. Acceptable values are 0 through 30. The default is 0, which disables purging of the images directory. Modification requires a server restart.

CleanupFileExclusionList
String value specifies a list of file names excluded from being purged. This allows files to be reused in filings like annotations, without being deleted after filing.

Specified file names must be exact, without wildcards. Entered values are concatenated into a single semicolon delimited string that must not exceed 250 characters, including delimiters. Modification requires a server restart.

DefaultColorSet
Name of default skin used by UI if user has not set a preference. If blank, the default is blafplus-rich. String values that are skin names found in the UI are valid. Takes effect on next login.

Value limits: Any valid skin names on the install.

Default: blafplus-rich

DefaultSecurityGroup
The default security group to use for document security when creating an application. If blank the user must specify the group during application creation. Takes effect on next application creation.

Value limits: Any valid security group name.

Default: None (empty string)

DocumentFileTimeout
The timeout in mSec. for any repository operations like create/update/move document. Used as a timeout for requests to repository. This is effectively the timeout period for requests made through RIDC to UCM.

Value limits: Min = 0, Max = Integer.MAX_VALUE

Default: 2000000

GDFontPath
Path referencing a location containing TTF font files for use by OIT rendering package. Takes effect on session bean initialization.

Value limits: This value is specifically for LINUX and is ignored on Windows systems. It is an Oracle Outside In Technology requirement.

Default: No default provided - this must be explicitly defined.

ImagingTenantId
The unique tenant identifier of the Imaging system.

Note: This and the associated ImagingTenantName should only be set in a Fusion Application multi-tenant environment.

The Imaging server must be restarted after setting.

ImagingTenantName
The unique tenant name of the Imaging system.

Note: This and the associated ImagingTenantId should only be set in a Fusion Application multi-tenant environment.

The Imaging server must be restarted after setting.

InputAgentRetryCount
Controls how many times a job can be retried. The default is 3; on the 4th try the job is placed in the failed directory.

Default: 3

InputDirectories
Provides list of directories stored as CSV strings where input sources should look for work. Takes effect immediately.

Value limits: Any valid directory path the server can access with a minimum of 1 entry and maximum of 10.

Default: IPM/InputAgent/Input

IPMVersion
String file of the Imaging version number.

JpegImageQuality
Specifies desired quality level of rendered JPG images. A lower value results in a more compressed document that facilitates faster load times, but reduces the visual quality of the image. Takes effect each image rendering.

Value limits: Value in range 0-100

Default: 100

LogDetailedTimes
Provides detailed logging of UI activity with durations of many of the UI activities. Takes effect at server restart. Turn on LogDetailedTimes only when you are experiencing long delays with the UI because it floods the log with entries which you generally only need to identify slowdowns.

Value limits: True - Turns on the logging; False - Turns off the logging

Default: False

MaximumDocuments
Sets the upper limit on the maximum number of documents displayed in a single viewer window.

Value limits: Any positive integer.

Default: 25

MaxSearchResults
Maximum number of rows a search is allowed to return. After this value is reached, the search is stopped. Takes effect on next search.

Value limits: Min = 1, Max = 10000

Default: 100

PolicyStoreProvider
This is a non-configurable read-only MBean that displays the type of security being used for the policy store.

Value limits: Allowable values are Internal, OPSS (DB) and OPSS (LDAP)

Default: value of security used for policy store

PreferredDPI
Sets the preferred dots per inch (DPI) of a document when converted to TIFF.

Value limits: 0 (the default value of the transformation platform used to convert the document), 75, 96, 120, 144, 192, 300

Default: 0

RequireBasicAuthSSL
Forces the use of SSL in all web service communication when set to true. Note that the RequireBasicAuthSSL setting only applies when no HTTP Basic Authentication is in use because no OWSM security policies have been applied.

Default: False.

SampleDirectory
Specifies which directory holds the sample data for the input UI. Takes effect immediately.

Value limits: Any valid directory path to which the server has access.

Default: IPM/InputAgent/Input/Samples

TiffCompressionType
Compression algorithm used when creating TIFF images. Takes effect each time a TIFF is generated.

Value limits: Allowable values are LZW and FAX4

Default: LZW

Uptime
Returns the duration the I/PM server has been running since the last startup. The value is returned in the format: HH:MM:SS. This is a read-only MBean.

UseAdvancedAsDefaultViewerMode
Causes the advanced viewer to be used as the default viewer mode if a user has not set a preference. Takes effect at next login.

Value limits: True - Makes the advanced viewer the default; False - Makes the basic viewer the default

Default: False

3.6.2 Using WLST to Change MBeans

WebLogic Server Scripting Tool (WLST) is a command line scripting environment that you can use to create, manage, and monitor Oracle WebLogic Server domains including Imaging MBeans. For a list of custom Imaging MBeans, see Section 3.6.1, "Imaging MBeans." WLST commands are issued on a command line and provide a way to navigate through Oracle WebLogic Server domains into MBean servers and down to specific application MBeans. From there, you can change Imaging MBean settings. To view or change these settings, you can use the WebLogic Server Scripting Tool (WLST) provided with Oracle WebLogic Server. To learn more about the WLST commands and command line protocol, see Oracle Fusion Middleware Administrator's Guide.

Figure 3-1 WebLogic Scripting Tool Use Within Imaging Architecture

Note that:

Strings must be surrounded by single quotation marks (')

Boolean must be entered as: Boolean(true) or Boolean(false)

MBean settings are case-sensitive

Long must be entered as: Long(123456)

The following procedure describes how to use WLST to view Imaging MBean settings.

Log in to the target system on which the Imaging installation resides.

Open a command-line shell.

Change directories to Middleware Home.

For Windows systems, enter:

>cd ('%MW_HOME%/wlserver_10.3/common/bin')

For Linux systems, enter:

>cd ('$MW_HOME/wlserever_10.3/common/bin')

Start WebLogic Server Scripting Tool.

For Windows systems, enter:

wls> wlst.cmd

For Linux systems, enter:

wls> ./wlst.sh

This starts the WLST shell in a disconnected mode.

Connect to the WebLogic administration server using the correct Imaging managed server port. For example:

wls:/offline>connect()
wls:/base_domain/serverConfig> connect()
Please enter your username [weblogic]: <enter>
Please enter your password [welcome1]: <enter>
Please enter your server URL [t3://localhost:7001]:t3://localhost:16000
Connecting to t3://localhost:16000 with userid weblogic...
Successfully connected to managed Server 'IPM_server1' that belongs to domain 'base_domain'.

Note that the port listed in the above example is the default listening port of the Imaging managed server and not that of the WLS administration server. Both the host name and port must point to the Imaging server. In some cases the Imaging host name may be different from the administration server.

Switch to the custom MBean server where the Imaging MBean is exposed.

wls:/base_domain/serverConfig> custom()

Location changed to custom tree. This is a writable tree with no root.

wls:/base_domain/custom> ls()
drw-   EMDomain
drw-   JMImplementation
drw-   com.oracle.igf
drw-   com.oracle.jdbc
drw-   com.oracle.jps
drw-   oracle.adf.share.config
drw-   oracle.adf.share.connections
drw-   oracle.as.util
drw-   oracle.dfw
drw-   oracle.dms
drw-   oracle.dms.event.config
drw-   oracle.imaging
drw-   oracle.j2ee.config
drw-   oracle.joc
drw-   oracle.jocssl
drw-   oracle.jrf.server
drw-   oracle.logging

The ls() command in this example lists the contents of the custom directory. Locate the oracle.imaging entry. Note that if the oracle.imaging MBean is not listed, you are not connected to the correct Imaging managed server port and should disconnect and then reconnect using the correct port.

The MBeans are arranged in a directory structure, so change to the directory that contains the Imaging settings.

wls:/base_domain/custom> cd('oracle.imaging')
wls:/base_domain/custom/oracle.imaging> cd('oracle.imaging:type=config')

Now you are in the directory that contains all of the Imaging settings. Enter the ls() command to see all of the configuration options and their settings, or the get('<name>') function to get a specific value.

wls:/base_domain/.../> ls()
.
.
.
wls:/base_domain/.../> get('TiffCompressionType')
'FAX4'

Use the set(name, value) function to change a value. See Section 3.6.1, "Imaging MBeans" for information about when the change will take effect because it differs for each MBean.

wls:/base_domain/.../> set('CheckInterval', 5)

3.6.3 Using Enterprise Manager to Set an MBean Value

If you use Enterprise Manager (EM) to monitor server performance, you may want to also use the Enterprise Manager System MBean Browser to view and change Imaging MBean values. To use the System MBean Browser, following this procedure:

Log on to Enterprise Manager.

Under Deployments, click the appropriate target (such as IPM_server1). The Summary page displays.

To view MBeans, select System MBean Browser on the WebLogic Server menu. On the left navigation pane, under Application Defined MBeans, expand oracle.imaging. Select the appropriate server.

Expand the appropriate server.

Expand config.

Double-click config to display the list of Imaging MBeans and their settings.

Change the appropriate MBean setting and click Apply. See Section 3.6.1, "Imaging MBeans" for information about when the change will take effect because it differs for each MBean.

3.7 Setting Font Variables

Using unsupported fonts in your documents can cause the document to be unreadable, create incorrect text formatting, or cause shifting of data on text documents, including potentially exposing redacted content. For example, a redaction annotation is laid on top of a document. If that document is rendered using fonts on one system and the redaction is placed over a word based on the rendering, different fonts on a different system may cause the document text to render in a slightly different position. It would be possible for the data hidden beneath a redaction annotation to move and be exposed.

To help ensure that rendered text does not mistakenly shift beneath a redaction, ensure that all client machines being used to place redactions have the same fonts as the Imaging server. This allows the Oracle Outside In rendering engine to render the document using the same fonts as the client machine used to place the redaction. Once a TIFF image of the redacted file is rendered, redactions and text are displayed as an image, without use of fonts, unless a person has the proper security rights to see redacted text. This ensures that a user cannot try to force text to shift below a redaction by deleting a font and attempting to view the document, because the viewed document has already been converted to an image.

If running Imaging on a UNIX system, ensure that your UNIX servers are configured to use TrueType fonts (*.ttf or *.ttc files). Use WLST or Oracle Enterprise Manager 11g Fusion Middleware Control to set the Imaging server GDFontPath configuration MBean to include one or more paths to supported font files. If GDFontPath cannot be located, the current directory is used, which may or may not have the required fonts.

Note:

Setting the GDFontPath is required for UNIX systems only. It is not required to be set on Windows systems.

3.7.1 Configuring MBeans

The following steps are used to configure MBeans and detail specifically how to set the GDFontPath MBean.

To configure GDFontPath MBeans with Fusion Middleware Control:

Access the Imaging domain in Oracle Enterprise Manager 11g Fusion Middleware Control at the following URL:

http://adminServerHost:adminServerPort/em

For example:

http://machineName:7001/em

Log in as the Administration user (for example, weblogic).

In the navigation tree, expand Application Deployments, and then click the imaging application.

On the Application Deployment menu, select System MBean Browser.

Expand the oracle.imaging folder under Application Defined MBeans.

Expand the Server: <server_name> and config folders, where <server_name> is the name of an Imaging server, such as IPM_server1. Repeat steps 6 through 10 for each Imaging server.

Click config.

Set GDFontPath to the location of your TTF files on the UNIX system (for example: /usr/share/X11/fonts/TTF).

Click Apply.

Restart the Imaging server.

3.8 Configuring Display of Seconds in Search Results

By default, the Content Server repository is not set to return seconds to Imaging when returning time information for display in a search results table. If you require seconds to be displayed in a search results table date and time field, you must configure the Content Server repository to return seconds using the SystemProperties applet. In order to run the SystemProperties applet, you must first temporarily disable JpsUserProvider. To configure Content Server to return seconds, do the following:

Log in to the target system on which the Content Server installation resides.

Open a command-line shell.

Change directories to <domain_home>/ucm/cs.

For Windows systems, enter:

>cd ('%UCM_HOME%/ucm/cs')

For Linux systems, enter:

>cd ('$UCM_HOME/common/bin')

Run ComponentTool and disable JpsUserProvider using the following command:

./bin/ComponentTool --disable JpsUserProvider

Launch the SystemProperties applet by using the following command:

./bin/SystemProperties

The SystemProperties applet is displayed.

In the SystemProperties user interface, click the Localization tab.

Select the Locale you want to modify. For example, English-US, then click Edit. The Configure Locale dialog box is displayed.

Remove the square brackets ([]) from around the seconds in each field to require seconds be displayed. For example, change

M/d/yy {h:mm[:ss] {aa}[zzz]}!mAM,PM

to

M/d/yy {h:mm:ss {aa}[zzz]}!mAM,PM

Click OK. The Configure Locale dialog box closes.

Run ComponentTool and enable JpsUserProvider using the following command:

./bin/ComponentTool --enable JpsUserProvider

Restart Content Server. For information on how to restart Content Server, see the Oracle Universal Content Management Getting Started with Content Server guide.

3.9 Configuring Imaging Logging

Configure and view log files for Imaging using Oracle Enterprise Manager (EM) by doing the following:

Log in to Enterprise Manager.

Expand the WebLogic Domain navigation tree for Application Deployments and select your imaging server. The status of your Imaging server is displayed.

On the Application Deployment menu, select Logs then Log Configuration.

Select the Log Levels tab, which allows you to control the logging level. Under the Logger name section, expand Root Logger, oracle, then oracle.imaging to display the logger names associated with Imaging. From here you can change the logging level which affects the severity level of error messages collected.

Optionally enable the Persist log level state across component restarts to ensure logging levels between restarts.

Click Apply.

Select the Log Files tab to display the Handler Name, Log Path, Log File Format and Rotation Policy of the logging file. From here you can create a new file, or copy, edit, or view the configuration of an existing file.

For more information about managing log files, log levels, and diagnostic data, see the Oracle Fusion Middleware Administrator's Guide.

4 Managing Applications

Applications are the core of Oracle WebCenter Content: Imaging. In Imaging, an application is not a separate software package, but a type of management container for uploaded documents.

This section describes how to create and configure applications in Imaging. It contains the following topics:

Section 4.1, "Application Overview"

Section 4.2, "Creating An Application"

Section 4.3, "Modifying an Existing Application"

4.1 Application Overview

In effect, an application is a category into which documents get sorted. When you define an application, you name it, determine what repository is used to store the documents, what metadata fields are used to track metadata values for each document, who has rights to affect the application definition and to the documents stored in the application, and if the documents are connected to a workflow process.

For example, the Accounts Payable department of XYZ Company needs an application to store invoices. A typical invoice application would contain metadata fields to capture the vendor name and address, vendor ID, the invoice number, the original purchase order number or numbers the invoice covers, any payment terms, and the invoice total. An IT administrator for XYZ Company ensures that only the Accounts Payable manager has the rights to create the application. The manager creates the application and defines the metadata fields, then ensures that the Accounts Payable clerks have the rights to access the application and use it to add but not delete documents to the application. The manager also connects the application to a workflow process so that when the invoices are uploaded, they are sent through a workflow. Additionally, the manager grants rights to the clerks to view and annotate the documents in the application so that the invoices can be stamped Approved, On Hold, Received or Rejected as necessary.

Most likely applications are defined and tested on a development system prior to being implemented in a production environment. To facilitate this, you can reuse an existing application definition within Imaging by exporting the desired definition to a transportable format via XML. You can then import that definition file into other systems, such as a production system. Or you can import an application definition similar to one that you want to create, then modify the imported definition appropriately. For more information about exporting and importing, see Section 3.4, "Exporting and Importing Definitions."

4.1.1 Document Overview

Applications are used to store and control access to documents, either in the original electronic file format or as images of physical documents. To fully understand applications, it helps to have an understanding of an Imaging document and how it is uploaded.

A document in Imaging consists of a file and the following information that describes the file:

ID: Unique identifier

Name: Original file name when added to the system

Properties: File size, MIME type, file name, creator, lock, version, application ID and application name

Application ID: The unique system identifier for the application storing a document

Application Name: The name of the application storing a document

Field Values: Application metadata

Security Rights: Access to documents

Supporting Documents: Associated files such as text or images. For example, XYZ Company may want to keep track of what scanning station scanned in the document, but doesn't want to expose that information in an application metadata field. Instead, they could output the information to an XML or text file and upload it to Imaging as a supporting document.

Annotations: Online notes within the document such as an approval stamp or text.

4.1.1.1 Uploading Documents

Uploading, sometimes called ingesting, is the process for getting documents into the Imaging system, populating the application metadata fields with values specific to each document, and indexing the values to enable retrieving the document using a search. Document metadata and possibly the full-text of a document is indexed at the time of uploading. The indexing process varies depending on the repository settings and the format of the document.

Once a document is uploaded, it can be searched for and retrieved by all people with security rights to the search and to the documents within the application or applications being searched. Once retrieved, documents can be printed, viewed, downloaded, or annotated, provided you have the rights to do so. Viewing is done using the Imaging Viewer, which uses Oracle Outside In Technology that supports more than 500 file formats. To learn more about Oracle Outside In Technology, see the Oracle Outside In Technology web site at http://www.oracle.com/technologies/embedded/outside-in.html.

Upload a document in one of the following ways:

Upload individual documents using the Upload Document Tools interface.

Upload documents in bulk using the Imaging input agent. For more information, see Section 5, "Managing Inputs."

Use a custom application to upload documents using the Imaging APIs. For more information about using Imaging APIs, see the Oracle® WebCenter Content Developer's Guide for Imaging.

For more information about uploading documents, see Oracle® WebCenter Content User's Guide for Imaging.

4.2 Creating An Application

Note:

The Imaging user interface displays different panels in the navigator pane based on your permissions. Unless you have application system permissions, or administration permissions to at least one individual application, the Manage Applications panel is not displayed in the navigator pane. You must have either Create or Administrator permission to create an application. The user creating an application must also have at least View permission to the connection (repository) being used.

Open the Manage Applications panel in the navigator pane of the Imaging user interface to start the process of defining an application.

You will complete the following tasks in the following order:

Specifying General Properties: Name and describe the application

Defining Application Fields: Define fields used and indexed in the application

Assigning Application Security: Assign application security permissions.

Assigning Document Security: Assign document security permissions.

Assigning a Storage Policy: Define a storage policy for content.

Configuring Workflow Integration: Configure any workflow processes for content within the application.

Reviewing Application Settings: Review application settings and submit.

Note:

Changes to the repository DOCMETA table caused by creating, deleting, or modifying an application can potentially cause a problem on an active repository server if any other operation is also affecting the table. While this is unlikely, it can cause a problem uploading documents and so it is helpful to coordinate changes to an application with idle time on the Content Server repository server.

To help mitigate any potential problems, multiple Content Server repository instances can be used to isolate business units so that any one application change has less impact on the enterprise organization.

4.2.1 Specifying General Properties

You must provide each application with a name. The application name is displayed in the Applications panel in the navigation pane once the application is created. You must also specify the repository for the application. Once the application is created, you cannot change the repository selection. An optional brief description of the application can be entered that displays on the application summary page when an application is selected. To view this page, see Section A.25, "Application General Properties Page."

To specify the application general properties, do the following:

Expand the Manage Applications panel in the Navigator Pane and click the Create Application icon. The Application General Properties Page is displayed.

Enter a name for the application in the Name field. For example, if creating an invoicing application for XYZ Company to store invoices from the United States division, name the application Invoices_US. The application name is displayed to users on the Upload Document page and to system administrators when creating inputs and searches. This field is required.

Optionally enter a description of the application in the Description field. For example, All Invoices for the United States Division. This description is displayed beneath the title on the application Summary page, when using the Document Upload Tool, and when you hover your cursor over the application name in the Manage Applications panel in the Navigator Pane.

Select a repository for the application from the field. Because it is likely that you will have many repositories, this field specifies which Content Server repository to use for this application. Multiple Content Server repositories can be used for different applications to balance the load or to offer a way to isolate content to specific business units. In the XYZ Company example, one repository can be used to hold all invoices from the European division, another repository can be used to hold all invoices from the United States division, and another can be used to hold all Human Resource documents, etc. Once defined and the application is created, the repository cannot be changed. This field is required.

Note:

The user creating an application must also have View security rights to the repository connection being used.

Specify if you want to be able to search the full text of a document. In order to do so, the repository server must be set to index full text and the document must be in a format that has text information. Many imaging solutions do not require full-text indexing or need to search text information. For example, the XYZ Company Invoices_US application does not require full-text indexing because the invoices are scanned in and uploaded as TIFF images. TIFF images of documents do not contain text information, and so cannot be full-text indexed, and invoices are searched for using the metadata values. However, the Human Resources department may upload resumes and employment contracts as electronic files and have a need to search for the text of the files. In such a case, an Employment Contract application may need to be full-text indexed.

Click Next to go to the Application Field Definitions Page.

4.2.2 Defining Application Fields

Fields defined for an application track metadata associated with content in an application. You can specify one of four types of field definitions, whether they are required, and if they are indexed to improve searching speeds. You must define at least one field. The four available field types are:

Text: Field accepts a text string. Possible string length is specified in the Length element with a maximum of 200 characters supported.

Number: Field accepts integers from -2.14 billion to 2.14 billion.

Decimal: Field accepts 1 to 15 digits total, including digits before and after the decimal. For example, if the scale factor is 5, then the range would be -9999999999.99999 to 9999999999.99999. The decimal scale is set in the Scale element.

Date: Field accepts date in the regional format.

All field types can be indexed. Enabling indexing of a metadata field applies only to that field. The information specified will appear under the Field Definitions category on the application Summary page. Indexes are applied to the underlying repository database tables. The application of either too many or too few indexes will be detrimental to the system's performance. Generally, indexes should be applied to those fields that will be the core of the document searching that will be performed. Defining this list of fields should be done as part of the business process analysis with the additional help of a database administrator.

You can add and remove fields in applications when creating and modifying applications. There is a restriction that when adding or modifying an application you cannot delete an existing field and add a new field with the same name during the process. If this happens, click Cancel and start defining the application fields again to add the field with the correct name.

For more information on available field types and options, see Section A.26, "Application Field Definitions Page."

To define fields for the XYZ Company Invoices_US application example, do the following:

On the Application Field Definitions Page, click Add and for this example, select Date as the type of field and enable Required and Indexed.

Change the name of the field to a descriptive name. For this example, change the name of the first field to Date Received.

Click the Edit Default Value icon to enter a default value, for example, to 12/31/2009. The default value is only a suggestion to users. The field is not automatically set to this value when left blank.

Click Add and for this example, select Date as the type of field and Indexed.

Change the name of the field to a descriptive name. For this example, change the name of the first field to Date Paid.

Click Add, select Number as the field type, and enable Indexed.

Change the field name to a descriptive name. For this example, change the name of the field to Invoice Number.

Click Add, select Text as the field type, and enable Indexed.

For this example, change the field name to the descriptive name Vendor ID.

Click the Add Picklist icon in the Picklist column. The Picklist dialog is displayed. Use the dialog to add a list of selectable options for the metadata field. For this example, anything can be entered that conforms to the limits of the text field. For instance, XYZ Company may have a unique code for each vendor. Adding a picklist allows a user to select from the list and ensures that the Vendor ID metadata is entered accurately. Leading and trailing spaces on picklist items are not retained. Click the pencil icon in the Picklist column to edit an existing list, or click the Remove Picklist icon to delete an existing picklist.

Note:

If a field is defined with a picklist, the user must select from the picklist to populate the field and cannot enter data directly into the field. Likewise, if documents are input using an input agent and definition file, the definition file must specify valid picklist values.

To continue with the XYZ Company example, repeat step 8 and 9 to add text fields with the following names:

Vendor Name

PO Number

Payment Terms

Click Add, select Decimal as the field type, and enable Indexed.

Change the field name to Invoice Total.

Click Next to go to the Application Security Page.

4.2.3 Assigning Application Security

Security rights to view, modify, delete and grant access to an application is assigned at the user or group level when defining an application on the Application Security Page. To assign application security permissions, do the following:

On the Application Security Page, click Add. The Add Security Member Page displays. Type a user or group name or click Search to display a list of users or groups from which to select. Leave the field blank to return all users or groups, or use wildcards to filter results.

Select the user or group you want to add. For example, for the XYZ Company Invoices_US application, you might add a group of Accounting directors called Acct_Directors. There may also be a specific user, such as the manager of the US Accounts Payable department that also needs access to the application. And an IT administration group may need at least View and Grant Access rights to the application. The groups or users you select must be defined in whatever credential store you use to authenticate users. The user name is added to the Display Name column on the Application Security Page.

Enable the permissions you want to assign to this user by selecting the field in the appropriate column. Options are:

View: Enabled by default. Grants the user or group the right to see this application as an option when creating searches. For the XYZ Company Invoices_US example, you may want to grant View rights to an Information Technology employee so they could create a search for invoices without having access to the invoices themselves. The right to modify a document in the application would be determined by the Document Security rights assigned.

Modify: Enable to grant the user or group the right to modify all aspects of this application except for granting security rights. For the XYZ Company Invoices_US example, you would want to grant Modify rights to the manager of the US Accounts Payable department, but not to all of the employees of the department or to managers of other divisions.

Delete: Enable to grant the user or group the right to delete this application. For the XYZ Company Invoices_US example, you would want to grant Delete rights to the Acct_Directors group.

Grant Access: Enable to grant a user or group the right to grant security rights to others for this application. For the XYZ Company Invoices_US example, you would want to grant this right to the Acct_Directors group. However, if this is the only security level granted, the user can modify only the security information for this application. This is so that you can also grant this right to IT Administrators or others that may need to grant access to the application but not modify the application or be allowed to search within it.

A user with Grant Access permission can grant themselves all other rights. At least one user must be given Grant Access rights.

Click Next to go to Application Document Security Page.

4.2.3.1 Copying Permissions From One User to Another User

You can copy the permissions from one user to another by completing the following steps:

Select and highlight the user whose permissions you want to copy from the Display name column and click Copy. The Add Security Member Page displays.

Select the new user to whom you are copying the permissions. The new user's name is displayed in the Display Name column with the copied permissions enabled.

Click Next to go to the Application Document Security Page.

4.2.4 Assigning Document Security

Assigning access and modification security rights to documents are managed separately from assigning access and security rights to applications. This protects an application from being inadvertently modified by users who need greater access to content. Likewise, sensitive documents are protected from those with rights to access and modify applications.

Security rights to view, write, delete, grant access, lock, and annotate documents is assigned at the group level on the Application Document Security Page.

To assign document security permissions, do the following:

On the Application Document Security Page, click Add. The Add Security Member Page is displayed.

Type a group name or select the group you want to add from the list. This group name is added to the Display Name column of the Application Document Security Page. For example, for the XYZ Company Invoices_US application, people likely needing access to invoice documents would be the US Accounts payable clerks, the manager of the US Accounts Payable department, and the Shipping and Receiving department. Leave the field blank to return all groups, or use wildcards to filter results.

Enable the security rights you want to assign to the group. Note that anyone in a group with Grant Access permission can grant the group all other rights. Document security adds security rights for modifying either metadata or document content, and the ability to lock documents to prevent changes.

For example, for the XYZ Company Invoices_US application, you would grant Modify rights to all US Accounts payable clerks so that they can sign off that all items on the invoice have been received. To keep invoices secure, you would likely limit delete rights to the manager of the US Accounts Payable department in case an invoice was scanned in incorrectly or needed to be removed from the system for some other reason. You would also grant Grant Access rights to the ACCT_Directors group so that they could assign access as necessary to new employees or remove access if someone leaves the department.

Depending on your business process, you would also assign ether View or Modify rights to the Shipping and Receiving department to verify invoices against shipping receipts. For example, if your business process requires only a person in Accounting to review the invoice and compare it against the shipping receipts in order to verify that all items on the invoice have been received, then Shipping and Receiving would only need View rights to the invoices. However, if your business process requires both a person in Accounts Payable and a person in Shipping and Receiving to stamp an invoice as approved, then they both would need Modify rights to the documents, and the appropriate annotation rights assigned. For details on the different annotation rights, see Section A.28, "Application Document Security Page."

Click Next.

4.2.5 Assigning a Storage Policy

Content Server does not support time-based storage of content, so currently there is a single storage stage with an indefinite duration. The user can only choose the volume to apply. Once chosen, the content stays on that volume indefinitely. Note that the status of the volume chosen is not indicated on the user interface for creating an application.

To create an application storage policy, complete the following steps:

Select the name of the storage volume used to store documents from the Document Storage Volume field. This may be a file store, database, or storage device.

Select the name of the storage volume used to store annotation from the Supporting Content Storage Volume field. This may be a file store, database, or storage device.

Click Next to go to the Application Workflow Configuration Page.

4.2.6 Configuring Workflow Integration

Workflow processes export and import information by using Web Service interfaces. A workflow server defines services that can be used by other applications. If a connection has been defined to a workflow server, the Workflow Configuration option is enabled in the Application definition navigation train and a component from the workflow server can be selected to integrate the application with a workflow meeting the business need.

For example, when an invoice at XYZ Company is uploaded to the Invoices_US application, it needs to enter a workflow that routes it to the appropriate people for approval. First it goes to Shipping and Receiving for comparison to the shipping receipts to verify that everything listed on the invoice has been received. Then it moves to the appropriate department head to verify that the purchase order was valid. Then it goes to the appropriate person in Accounts Payable for approval to pay the invoice amount. The appropriate person may be different depending on the amount of the invoice. Once approved, an Accounts Payable clerk is cleared to cut a check and pay the invoice.

Remember that the workflow is not defined in Imaging, but Imaging connects to a workflow server with a workflow component defined outside of Imaging. The complexity of the workflow is not addressed in Imaging. Integrating an application with a workflow requires connecting to a workflow server, specifying the defined workflow component to integrate with, selecting the component properties and mapping a value between the Imaging application and the workflow composite payload.

To add a workflow configuration to an application, do the following:

On the Application Workflow Configuration Page, click Add. The Workflow Server Properties Page is displayed.

Select the connection from the Connection field and click Next. The Workflow Component Properties Page is displayed.

Note:

The user creating an application must also have View security rights to the workflow connection being used.

Select the component properties of the business process being configured. Composite, Service, and Operation are required values. Click Next. The Workflow Payload Properties Page is displayed.

Select a Mapped Value for each Payload Element. Note that if selecting Format Value, you can construct a value from parts of text and application fields using the Edit Format Value Page. For example, you would use this page to construct custom URLs or to concatenate multiple values together into a single value.

Click Finish to exit workflow configuration and return to the main application definition navigation train. The Application Workflow Configuration Page is displayed.

Click Next to move to the Application Review Settings Page.

You can also modify or delete an existing workflow configuration in an existing application by doing the following:

Click on an existing application name in the Manage Application panel of the navigator pane. The Application Review Settings Page is displayed.

Click Modify. The Application General Properties Page is displayed.

Click Workflow Configuration in the Application navigation train. Note that the Workflow Configuration option in the navigation train is only available if a connection to a Workflow server has been defined. The Application Workflow Configuration Page is displayed.

Click Modify. The Workflow Server Properties Page is displayed. Follow the procedure in the section Section 4.2.6, "Configuring Workflow Integration."

4.2.7 Reviewing Application Settings

To review application settings, do the following:

From the Application Review Settings Page, review the application settings and ensure they are correct.

Make any necessary changes by clicking Back to return to the necessary section, or click the specific section in the navigation train to return the section directly.

Once you are satisfied that the application is correct, return to the Application Review Settings Page and click Submit. The Application Summary Page is displayed.

Review the details of the application. Click the magnifying glass icon in the Picklist column to review the values of any defined picklists. Click Modify to go back to the Application General Properties Page to make any changes, if necessary. When satisfied with the application, return to the Application Review Settings Page and click Submit.

4.3 Modifying an Existing Application

Once an application is created, all aspects of the application can be modified with the exceptions of which repository is used and what scale is used for decimal field definitions. Note that in order to modify an application you must have Modify rights to the application as well as at least View rights to the repository connection used by the application.

WARNING:

Changes to the repository DOCMETA table caused by creating, deleting, or modifying an application can potentially cause a problem on an active repository server if any other operation is also affecting the table. While this is unlikely, it is helpful to coordinate changes to an application with idle time on the Content Server repository server.

To help mitigate any potential problems, multiple Content Server repository instances can be used to isolate business units so that any one application change has less impact on the enterprise organization.

Note:

Unlike documents, definitions cannot be locked while being modified. Consequently, if the same definition is being modified at the same time by different people, only the last changes submitted are saved.

To modify an existing application, do the following:

From the navigator pane, click the application name to change. The application summary page displays.

Click Modify. The Application General Properties Page is displayed.

In the navigation train, select the page on which to make changes. For information on the page options, see the pertinent subsection of the section Section 4.2, "Creating An Application," or the appropriate page in the User Interface section.

When you have changed all the appropriate settings, select Review Settings. The Application Review Settings Page is displayed.

Review the application settings and ensure they are correct.

Make any necessary changes by clicking Back to return to the necessary section, or click the specific section in the navigation train to return the section directly.

Once you are satisfied that the application is correct, return to the Application Review Settings Page and click Submit. The Application Summary Page is displayed.

Review the details of the application. Click the magnifying glass icon in the Picklist column to review the values of any defined picklists. Click Modify to go back to the Application General Properties Page to make any changes, if necessary. When satisfied with the application, return to the Application Review Settings Page and click Submit.

Note:

Content Server cannot store null values in a numeric field. When an application containing documents is modified to have a number field, search results will display -1 for that new field on documents that were in Content Server prior to when the new field was added. When a new document is uploaded after the field is added and the number field is left blank, search results will display 0 for the number field value.

5 Managing Inputs

An input definition defines the mapping between an input file and the metadata fields of the selected application when a document is uploaded. The input file is typically generated by a scanning station when documents are scanned for upload into Imaging.

This section contains the following topics:

Section 5.1, "Input Definition Overview"

Section 5.2, "Creating Input Definitions"

5.1 Input Definition Overview

Typically, documents are scanned and placed in a directory monitored by an Imaging input agent (see Chapter 9, "Understanding Input Agents."). The scanning station creates an input file that includes what document files to upload on the file system, what metadata values to use, and other initial document creation options. It can also attach supporting content to a document or set annotations on a document image. You can reuse an existing input definition within Imaging by exporting the desired definition to an XML file. You can then import that definition file into other systems and modify it appropriately. For more information about exporting and importing, see Section 3.4, "Exporting and Importing Definitions."

5.2 Creating Input Definitions

You must have Create or Administrative rights for the input you are creating, and View rights for the application to which the documents are uploaded. To create an input definition, do the following:

From the navigator pane under Manage Inputs, click the Create Input icon. The Input Basic Information Page displays.

Enter the name of the input. This name will appear under Manage Inputs in the navigator pane. This is a required field.

In the Description field, type a short description of the Input being created.

Enable Online to tell the Input Agent to start polling the definition files of this input once it is completed, or leave disabled until input definition is finished. Once enabled and submitted, you cannot modify the input until it is first taken offline. For information on enabling and disabling an input, see Section 5.2.1, "Enabling and Disabling an Input Definition."

The Auto-detect input file character set field is enabled by default. If you disable it, a picklist displays from which you can select the file character set to be used. Note that this is the character set used to read the input definition file, not the character set of the documents to be uploaded.

Note:

Auto-detect does not work if the provided sample file is not large enough to get an accurate determination of the character set. If the sample file is too small, disable Auto-detect input file character set and manually select the character set.

Select an sample file to use. There are two options to locate an input file:

Browse: Displays a list of input files in the Samples directory that are available to use.

Upload: Opens a standard file navigation dialog to locate and upload a new input file from a local or shared network drive to the Samples directory. Although any delimited text file is accepted, preferable file types are ASCII or UTF-8 text files.

When a sample file has been selected, click Next. The Input Identify and Parse File Parameters Page is displayed. By default, the Input Mask field lists the selected sample file to use as the input mask.

Ensure the delimiter is the same single character that is used to separate columns within the sample file. By default, a pipe is indicated.

Select an application for mapping from the Applications field.

Click Next. The Input Field Mapping Page is displayed.

Define how the input file fields will map to the application. At least one field must be mapped to the application field definitions and the file path must be specified. Table columns are defined as follows:

Application Fields: Name of field within application

Input Column: Number of corresponding column within input file

Sample Data: Column data taken from sample file

Use Application Default: Specifies whether to use the default value specified in an application when the definition file contains empty data for the field.

Date Format: Specifies how the Input Agent parses the date string. If no date format is specified, the server's locale is used to parse date values. To specify a date format, click the Add a date format for this mapping icon. Click the Edit date format icon to change an existing date format. Click the Delete date format icon to delete the date format specified.

Click Next. The Input Security Page is displayed.

Click Add. The Add Security Member Page displays. Type a user name or click Search to display a list of users from which to select.

Select the user you want to add. The user name is added to the Display Name column on the Input Security Page page.

Enable the permissions you want to assign to this user by selecting the field in the appropriate column. Options are:

View: Enabled by default. Grants the user or group the right to view this input.

Modify: Enable to grant the user or group the right to modify all aspects of this input except for granting security rights.

Delete: Enable to grant the user or group the right to delete this input.

Grant Access: Enable to grant a user or group the right to grant security rights to others for this input. If this is the only security level granted, the user can modify only the security information for this input.

A user with Grant Access permission can grant themselves all other rights. At least one user must be given Grant Access rights.

Click Next. The Input Review Settings Page is displayed.

Review your settings. Click Back to return to the appropriate pages to make any necessary changes. When done, return to the Input Review Settings Page and click Submit. The Input Summary Page is displayed.

Review the details of the input. Click Modify to go back to the Input Basic Information Page to make any changes, if necessary. When satisfied with the input, return to the Input Review Settings Page and click Submit.

Click Toggle Online to activate the input then close the summary page.

5.2.1 Enabling and Disabling an Input Definition

To enable or disable an input definition, do the following:

From the navigator pane under Manage Inputs, click the name of the input to be enabled or disable. The Input Summary Page is displayed.

Click Toggle Online. If the input was online, the input is disabled. If the input was offline, the input is enabled and the Input Agent starts polling the definition files of the input. Inputs must be disabled in order to be modified.

Note:

If changing the format of an inbound data file, disable the Input after the last of the original formatted files has been processed. Make changes to the Input definition to handle the new format and then enable the Input. This facilitates a smoother transition with predictable results.

6 Managing Searches

At the core of Imaging is the capability to define and execute searches that retrieve the relevant documents for the user. Search management allows the creation and modification of searches that other users may use to find specific documents.

The ability to manage searches is controlled by the security rights that a user has to applications. This means that to ensure security, a person managing searches can be limited to creating searches by the security assigned to the applications defined in Imaging. A search manager may only create or modify a search of applications to which the manager has view rights. If the manager does not have view rights to an application, the manager cannot create or modify a search of that application. For a detailed description of security rights, see Section 2, "Managing Security."

At a high level, creating a search involves the following:

Selecting the applications to search.

Configuring the fields that are displayed in the results.

Selecting the conditions that comprise the where clause of the search.

Customizing the parameters and the operators used in the search.

Assigning security rights so that groups and individuals may use or modify the search.

This section discusses the following topics:

Section 6.1, "Search Overview"

Section 6.2, "Creating a Search"

Section 6.3, "Modifying an Existing Search"

6.1 Search Overview

Remembering that most often Imaging is integrated with an Enterprise Resource Planning (ERP) system such as Oracle E-Business Suite or PeopleSoft, consider the following example:

Clark works as a shipping clerk in the US Shipping and Receiving department at XYZ Company. He sees in his daily task list that an invoice is queued for his approval. The listed invoice shows the invoice number and associated purchase order number. Clark enters the purchase order number from the invoice into a field of their ERP system and clicks a button that displays a list of several shipping receipts associated with that purchase order number. The associated receipts are documents in the ShippingReceipts_US application of Imaging, and the returned listing was generated by running a predefined search for all documents in the application associated with that purchase order number.

Clark views the invoice and each shipping receipt in a browser page and compares the items listed on the invoice with the shipping receipts to verify that the items were received. When satisfied that all items were received, Clark annotates the invoice with his or her initials and the date and time and sends it on the next step of the workflow. In actuality, the documents were viewed in the Imaging viewer, and because Clark has Standard Annotation security rights to the documents in the ShippingReceipts_US application, he was able to annotate it.

Once the invoice moves on in the workflow, the HR department manager, Bob, is notified that the invoice needs his approval. Bob enters the purchase order number and a list is displayed of all invoices and shipping receipts associated with that purchase order. Several invoices and shipping receipts are listed because the large order was delivered over several months and invoices were sent from the vendor as each group of items was delivered. The list is the result of a search through the documents in both the ShippingReceipts_US application and the Invoices_US application.

Bob reviews the list and sees that a critical item on the purchase order still has not been delivered, despite an annotation on the purchase order that the vendor had promised delivery by this month. He stamps the invoice On Hold and annotates the purchase order that the vendor must be contacted to determine why the critical item was not delivered and explain that anymore payments against that purchase order will be withheld until the critical item is delivered.

This example illustrates how searches are created and managed through the Imaging administration interface, but are generally executed through some other means, such as an ERP system. It also shows that a business need often requires one search to search multiple applications and that careful thought should be applied to application and search creation to ensure successful solutions.

6.2 Creating a Search

Create a search using the Manage Searches panel in the navigator pane of the Imaging user interface.

You can reuse an existing search definition within Imaging by exporting the desired definition to XML. You can then import that definition file into other systems and modify it appropriately. For more information about exporting and importing, see Section 3.4, "Exporting and Importing Definitions."

Note:

The Imaging user interface changes based on your security rights. You must have either Search Definition Management security rights of Create or Administrator, or have Search Definition security rights of Modify, Delete, or Grant Access for the Manage Searches panel to display in the navigator pane.

To create a search, complete the following steps. Additional information about each page used in the procedure can be found in Section A.16 through Section A.23 of Appendix A, "User Interface".

Open the Manage Searches panel and click the Create New Search icon. If you have View security rights to at least one application, the Search Properties Page displays.

Note:

If you do not have View security rights to at least one application, and error message is displayed.

In the Search Name field, type a descriptive name for the search. For example, HR Invoices to Pay. This search name is displayed under the Searches panel in the navigator pane. This field is required, and it must be unique within Imaging.

In the Description field, type a description of the new search that will be helpful to the user. For example, Invoices for the Human Resources Department. The description is displayed when the cursor hovers over the search name in the navigator pane. The field contains a maximum of 1000 characters.

In the Instructions field, enter instructions for the search. The instructions provide helpful information about what criteria is being searched for and how a user should use the search. For example, Enter a purchase order number or shipping receipt number to view associated invoices. These instructions are available on the search form and also appear on the Search Tab display. The field contains a maximum of 1000 characters.

In the Maximum Search Results field, enter the maximum number of search results returned. This limits how many results retrieved from the repository are displayed, per the number of applications being searched. For example, if the search spans both the ShippingReceipts_US application and the Invoices_US application, and the Maximum Search Results is set to 10, the results table could have up to 20 rows. A setting of 0 defaults to the maximum number of rows set in the Imaging MBean configuration variable.

Note:

Three configuration variables affect the maximum number of search results returned:

The value specified in the Maximum Search Results field when defining a search. This value is checked first and used if it does not exceed the Content Server MaxAppSearchResults setting. The default is 0.

The value specified in the MaxSearchResults MBean. This value is used if the value specified in the Maximum Search Results field is 0, provided the MaxSearchResults MBean value does not exceed the Content Server MaxAppSearchResults value. The default for MaxSearchResults is 100. For more information about Imaging MBeans, see Section 3.6.1, "Imaging MBeans."

The value specified in the MaxAppSearchResults Content Server configuration file config.cfg. The default value for MaxAppSearchResults is dependent on the search engine being used. If OracleTextSearch is used, the default is 2000. For all other supported search engines, the default is 10000.

Each setting is per the number of applications being searched.

For example, if a search is defined to include two applications, and the Maximum Search Results field value is set to 100, the MaxSearchResults MBean is set to 50, and the Content Server MaxResults is set to 300, then the value specified in the Maximum Search Results field is used and 200 results are returned - 100 for each application searched.

If a search is defined to include two applications, and the Maximum Search Results field value is set to 0, the MaxSearchResults MBean is set to 300, and the Content Server MaxResults is set to 200, then the value specified in the Content Server MaxResults is used and 400 results are returned - 200 for each application searched.

Click Next. The Search Results Formatting Page is displayed.

Select the application or applications in which to search from the Source Application field. For example, the Invoices_US application and the ShippingReceipts_US application. For full-text searching, the application selected must be configured for full-text indexing. See Section 4.2.1, "Specifying General Properties" for more information on defining a full-text application.

Select the metadata to be displayed on the search results. Choices are determined by the metadata field options in the applications being searched. For example, you may want to display the invoice number, the vendor name, the received date, the paid date, the invoice total.

Note:

If creating a search across multiple applications, it is a good idea to align the fields with like data and data types and put data and data types that are not alike in separate columns. This allows a user to click the column header and sort the data in a column effectively. For example, if searching one application with a Purchase Order field of the Number data type and another with a PO No. field also of the Number data type, aligning the fields would allow a user to click the header and sort the results sequentially based on the number. However, aligning a field of the data type Date and named Received Date with a Text data type field named Notes would not allow a user to sort the information because the data type is incompatible.

Modify how the columns are displayed by clicking the Column Options icon, displayed as a pencil in the column header. Modification options are:

Modify Column Name: Allows you to rename the column header. This is useful if the same metadata information is returned from multiple applications that have different names for the metadata. For example, in the Invoices_US application the metadata column may be named Purchase Order No., but in the ShippingReceipts_US application it is named PO. Using this option you can consolidate the information under the heading name PO No.

Move Column Left: Moves the column one space to the left.

Move Column Right: Moves the column one space to the right.

Delete Column: Displays a dialog window asking you to confirm deleting the column.

Click Next. The Search Conditions Page is displayed.

Select the fields, operators, and values you want to use to find the documents in the selected applications. Three system fields are available for searching: Document Creation Date, Document Created By, and Document Batch Id. Otherwise field options are dependent on the applications being searched. For example, select PO as the Field, = as the Operator, and Parameter Value as the Value to search for the purchase order number in the ShippingReceipts_US application. This enables a person to enter a PO number and return the associated shipping receipts. Complex search conditions can be grouped using parentheses and combined using AND or OR conjunctions.

The conditions for each application are entered independently. Select the application from the Application Selection menu to enter conditions for that application. Each condition will be entered on one line of the table. To enter a new condition, select the conditional operator and a new line will be generated. The conditions may be moved up or down within the table, but be careful to apply the correct conditional operators to each clause.

Using parentheses changes the order of evaluation of the conditions. The normal order is to evaluate all AND conditions first and then evaluate the OR conditions. A OR B AND C would be evaluated as condition B and condition C need to be true or condition A needs to be true. Using parentheses the evaluation order may be changed. (A OR B) AND C would be evaluated as either condition A or condition B needs to be true and condition C needs to be true.

For example, you want to find shipping documents for shipments driven to a specific location (condition C) by a specific person. The person could be either the driver (condition A) or the co-driver (condition B). In this example there would be two parameters:

the person's name

the destination zip code

Leaving a parameter blank effectively drops the condition from the search when it is run. If a user leaves both parameters blank, all documents up to the maximum search results are returned. Leaving the destination zip code blank returns all documents where the specified person is the driver or co-driver, up to the maximum search results. Leaving the person's name blank returns all documents with the specified destination zip code, up to the maximum search results.

However, if no parenthesis are used when constructing the search and values are entered for both parameters by the user, an undesired result could be returned. The conditions would be evaluated so that either B AND C would be true (co-driver and destination zip code) OR A would be true (driver). So the returned documents would either have the correct co-driver and destination zip code (a desired result), or the correct driver regardless of destination zip code (an undesired result.) Using parenthesis to group the driver and co-driver solves this problem. Grouping (A OR B) AND C returns results where the entered name is either driver or co-driver, and the entered number is the destination zip code.

You can also enter search conditions that have a static value hidden from the user to help narrow the search. For example, if looking for invoices in the Invoices_US application from companies in a specific region, you could select the Zip Code field as a condition and set a static value of the zip code for the specific region. Then all invoices from the region matching the Zip Code will display.

If more than one condition needs to use the same parameter value, you can select the edit icon for the parameter and select the common parameter name. The parameter names are unique and this allows you to map more than one condition to a specific parameter entry. You can also select Create New Value to create a new prompt for information that maps to one or more conditions across multiple applications. For example, if you want the user to enter a value for a vendor identification number that may be called Vendor in one application and ID in another, you can use Create New Value to set the field prompt to Enter Vendor or ID.

Click Next. The Search Parameters Page is displayed.

Select how you want the user to be prompted to enter parameters into the search:

Enter a name for each field to be used to enter parameters. For example, Purchase Order Number. If no field name is entered, the name of the field as defined in the application is used.

Enter the prompt text for each field. The prompt text precedes the operator on the search form to more clearly define the required entry for the parameter. This can help clarify the field name and is especially useful if the parameter spans multiple fields.

Click the icon in the Operator Text column. The Operator Properties Dialog Box is displayed. The Operator Properties dialog box is used to change the name of the operator or to enable Allow user to choose operator. If enabled, the Operator Properties dialog box expands so you can select what operators are available to a user from a valid operators listing. Once all desired valid operators are moved to the selected column, click OK.

If you want to specify a default value, click the icon in the Default Value column. The Modify Default Value dialog box is displayed. If a picklist of values is defined for the field, use the picklist to specify a default value. Defined values for a picklist are created when the application is created. If a field does not have a picklist, then enter the default value. If the parameter is a date value, enter either a static date value or a relative date value. The relative date value is a positive or negative integer that specifies number of days from the current date. Click OK.

If a picklist is defined for the field, enable to allow a user to select a value from the picklist.

Enable which parameters, if any, that you want to be required or Read Only, and click Next. The Search Security Page is displayed.

Click Add to search for and select users and groups who need access to this search. The Add Security Member Page page is displayed.

On the Add Security Member Page, select whether you want to search for groups or users and click Search. A listing of results is displayed.

Select the users or groups you want to add and click Add. Users or groups must be added in order to gain View rights to the search so that they can execute it. Additional permissions can be granted as necessary in the next step. You can select more than one from the results listing by holding the Ctrl key on your keyboard while clicking on the search results. The Add Security Member Page closes.

Select additional permissions each user and group will have: Modify, Delete, or Grant Access and click Next. For a description of the permission options, see Section A.20, "Search Security Page." The Search Preview and Test Page is displayed.

On the Search Preview and Test Page, review how the search form will display for the user. Test it and if necessary, go back and make modifications where necessary. When satisfied with the display and operation, click Next. The Search Review Settings Page is displayed.

Review the details of the new search and go back in the navigation train to make changes, if necessary. When satisfied with the search, return to the Search Review Settings Page and click Submit.

6.3 Modifying an Existing Search

To modify an existing search, complete these steps:

Note:

Unlike documents, definitions cannot be locked while being modified. Consequently, if the same definition is being modified at the same time by different people, only the last changes submitted are saved.

Expand the Manage Searches panel in the navigator pane.

Click the name of the search you want to change. The Search Review Settings Page is displayed.

Click Modify. The Search Properties Page for that search is displayed.

Note:

If you only have the Grant Access security rights, the Search Security Page is displayed. The Search Security Page and the Search Review Settings Page are the only two you will have access to.

Navigate to the appropriate page or pages to make the desired modifications using the navigation train. Review the section Section 6.2, "Creating a Search" for information regarding page options. Once you have made the desired modifications, return to the Search Review Settings Page.

On the Search Review Settings Page, click Submit to enter the changes.

Note:

In some circumstances, a -1 may be listed in a number field on a search results table. This happens when an application containing documents is modified to have a number field. The new field displays a -1 on documents that were in Content Server prior to when the new field was added. When a new document is uploaded after the field is added and the number field is left blank, search results will display 0 for the number field value.

7 Managing Connections

To successfully have all aspects of your business flow communicate with Imaging, you must define the appropriate connection types. Using the Imaging user interface, you can create a connection to both an Content Server repository or a workflow server.

Note:

You must ensure that the Imaging support component IpmRepository is installed and enabled on the Content Server you are connecting to. For information on enabling Content Server components, see Oracle WebCenter Content System Administrator's Guide for Content Server.

This section describes the connection configuration options available to an Imaging administrator and how they are accessed. It contains the following topics:

Section 7.1, "Creating an Content Server Connection"

Section 7.2, "Creating a Workflow Connection"

7.1 Creating an Content Server Connection

To connect Imaging to an Content Server document repository, do the following:

From the navigator pane, under Manage Connections, click the Create new connection icon and select the Create Content Server Connection. The Content Server Connection Basic Information Page is displayed.

Enter a name for the connection. The name will display in the Manage Connections panel. This field is required.

Enter a brief description of the connection and click Next. The Content Server Connection Content Server Settings Page is displayed.

Optionally, enable SSL to connect to the repository over SSL. Note that to connect over SSL, the Content Server must be configured for SSL connections. For more information, see Configuring WebCenter Content to Use SSL.

Enable Use Local Content Server and set the port number in order to specify localhost as the machine name and connect Imaging to the Content Server sharing the computer. Local communication offers the fastest connection option. If enabled, localhost is used exclusively unless a communication failure occurs. If there is a communication failure to localhost and a pool of Content Servers is defined, messages are sent to the machines named in the Content Server pool until communication to localhost resumes.

Alternately, disable Use Local Content Server and define a pool of Content Servers. Each connection in the connection pool must be unique. Messages are then sent to multiple Content Servers. This option is for load balancing in a clustered environment.

Note:

If a single server is identified in the connection pool and it is a load balancer to a Content Server cluster, then stickiness should be configured in the load balancer for a short period of time (30 to 60 seconds). This is necessary to avoid errors when an application is created and the application summary page tries to display. There can be latency in the propagation of application data from the Content Server where the application is defined to other Content Servers in the cluster.

Click Next. The Content Server Connection Security Page is displayed.

Add any additional users required. To add a user, do the following:

Click Add. The Add Security Member Page is displayed.

Select either Search Groups or Search Users, then click Search. A listing of available groups or users is displayed.

Select the users or groups to be added. You can make multiple selections by holding down the Control or Shift key on your keyboard when making a selection.

When you have selected all the users or groups you wish to add to the connection, click Add. The Add Security Member page is closed and the new users or groups are listed on the Connection Security page.

Enable the security permissions desired for each user or group and click Next. The Content Server Connection Review Settings Page is displayed.

Ensure that settings are correct. If they are not, click Back to return to the page you need to modify, or click the link in the navigation train to return directly to the desired page. When satisfied with the settings, return to the Review settings page and click Submit. The Connection Summary page is displayed that includes the audit history of changes made to the connection.

Review the details of the connection. Click Modify to go back to the Content Server Connection Basic Information Page to make any changes, if necessary. When satisfied with the connection, return to the Content Server Connection Review Settings Page and click Submit.

7.2 Creating a Workflow Connection

To integrate a workflow process with an Imaging application, you must first create a connection to a workflow server. An Imaging workflow connection makes no distinction between BPEL or BPM engines. A single workflow connection can be used to configure an application for use with BPEL or BPM as long as both engines are available on the workflow server.

Note:

To create a workflow connection, a user must be members of all three of the following WebLogic Server groups or the connection is not created:

Operators

Monitors

Administrators

Failure to create the connection is logged on the workflow server.

To create a workflow connection, do the following:

From the navigator pane, under Manage Connections, click the Create new connection icon and select the Create Workflow Connection. The Workflow Connection Basic Information Page is displayed.

Enter a name for the connection. The name will display in the Manage Connections panel. This field is required.

Optionally enter a brief description of the connection and click Next. The Workflow Connection Settings Page is displayed.

Specify the HTTP front end address for the workflow server. The address should include the listening port if it is not the default port for the protocol defined in the URL. For example, enter http://soa.server.company.com:8001 in the HTTP Front End Address. This field is required.

Enter the Credential Alias. For example, basic.credential. This field is required. The credential alias is an alias, or key, used to look up the user name and password in the Credential Store Framework (CSF), which encrypted them to provide for proper security.

This credential must be created in the CSF before the workflow connection configuration can be completed. A credential can be created in the CSF in one of two ways: through Fusion Middleware Control or through WLST. This field is required.

If necessary, enter providers by specifying the host name or names used for the connection. If the workflow server is a single instance, the provider is the host name or IP and port of the workflow machine. For example, t3://server:8001. If the workflow server is operating within a cluster, this parameter value must be a comma-separated list of machine names or IP addresses and ports of servers in the cluster. Entering only the front end address of a workflow server with multiple providers does not work. This step is necessary only if integrating with Oracle E-Business Suite Adapter for Oracle Enterprise Content Management.

Click Test Connection to ensure the connection is made. When successful, a list of BPEL composites is displayed.

Click Next. The Workflow Connection Security Page is displayed.

Add any additional users required. To add a user, do the following:

Click Add. The Add Security Member Page is displayed.

Select either Search Groups or Search Users, then click Search. A listing of available groups or users is displayed.

Select the users or groups to be added. You can make multiple selections by holding down the Control or Shift key on your keyboard when making a selection.

When you have selected all the users or groups you wish to add to the connection, click Add. The Add Security Member Page is closed and the new users or groups are listed on the Workflow Connection Security Page.

Enable the security permissions desired for each user or group and click Next. The Workflow Connection Review Settings Page is displayed.

Ensure that settings are correct. If they are not, click Back to return to the page you need to modify, or click the link in the navigation train to return directly to the desired page. When satisfied with the settings, return to the Workflow Connection Review Settings Page and click Submit. The Connection Summary page is displayed that includes the audit history of changes made to the connection.

Review the details of the connection. Click Modify to go back to the Workflow Connection Basic Information Page to make any changes, if necessary. When satisfied with the connection, return to the Workflow Connection Review Settings Page and click Submit.

7.2.1 Configuring SSL for the Workflow Server

For the Imaging SSL configuration to work with a workflow, the SSL listening port must be enabled on the workflow server. This can be done at the time the workflow server is first installed, through the configuration wizard, or after installation, through the Oracle WebLogic Server Administration Console. For more information on configuring SSL, see Oracle Fusion Middleware Administration Guide: Chapter 6, SSL Configuration in Oracle Fusion Middleware.

In order to create a connection to an SSL enabled workflow server, the HTTPS protocol and listen port must be specified in the Workflow Connection's HTTP Front End Address on the Workflow Connection Settings Page when the connection is created. For example, https://yourhost.com:8002.

Communication to the server will work properly if both the workflow managed server and the Imaging managed server are configured to use the default DemoTrust certificates. All Oracle WebLogic Server instances use the same DemoTrust self-signed certificates and, therefore, are configured to trust the others by default. Note that this should only be used to test the system in a demonstration or test environment. For security, DemoTrust certificates should never be used in production.

Note:

These files should be used for test and demonstration purposes only. In a production environment, you should obtain proper and valid certificates and follow appropriate procedures for importing and configuring those certificates to establish identity and trust. When properly signed certificates are used and configured properly, SSL will work properly without special configuration.

7.2.2 Configuring a Workflow Connection CSF Credential

A credential store framework (CSF) credential is a username/password pair that is keyed by an alias and stored inside a named map in the CSF. Because of its integration with Oracle Web Services Manager (OWSM), Imaging leverages the standard OWSM CSF map named oracle.wsm.security.

A credential can be created through Enterprise Manger (EM) or through WebLogic Scripting Tool (WLST).

Creating a Credential Using EM

To create a credential using EM, do the following:

Log in to Enterprise Manager.

Click WebLogic Domain.

Click Security and then Credentials.

Select the oracle.wsm.security map. If it does not exist, do the following:

Select Create Map.

Enter oracle.wsm.security in the map field and click OK.

Click Create Key. The key is now available for selection.

Enter a key name. This is the credential alias used in the workflow connection configuration.

Select password as the type.

Enter a user name and password.

Optionally, enter a description for the credential.

Click OK.

Creating a Credential Using WLST

To create a credential using WLST, execute the following command:

createdCred(map="oracle.wsm.security", key="basic.credential", user="weblogic", password="Welcome1")

where key is the alias which is used for the credential alias property of a workflow connection definition in the user interface. In the API, it is used for the Connection.CONNECTION_WORKFLOW_CSFKEY_KEY property. The alias, basic.credential, is used in the example because it is a standard default name used by OWSM and BPEL. However, the alias can be anything as long as it is unique within the map.

8 Working with WebCenter Content

Imaging uses the functionality of a database to store and retrieve uploaded documents. Documents are stored based on criteria specified in the application in which they reside.

This section contains the following topics:

Section 8.1, "Content Server Document Profiles"

Section 8.2, "Understanding Document Storage"

8.1 Content Server Document Profiles

When an application is created in Imaging, a corresponding profile and set of profile rules are created in the Content Server repository. It is expected that a profile trigger field has been configured. For Content Server 11g, a profile trigger field should be automatically configured. For Content Server 10g, configure a profile trigger field by doing the following:

Add EnableIdcProfileField=1 as a general configuration variable to the 10g Content Server config.cfg file. For information on adding a general configuration variable to Content Server, see the documentation that came with the product.

Restart Content Server.

8.1.1 Global Profile Rules

The IpmRepository component sets up global profile rules to group system fields and ensure their display when an application profile is created. These profiles are created or updated each time Content Server is started.

Note:

You can disable the automatic update of the global profile rules by setting the Content Server configuration setting IpmUpdateProfileRules to 0 (zero). For information about configuring Content Server, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

The IpmRepository component creates the following rules:

Name | Description | Global Rule
IpmSystemFields | Groups Imaging system fields. Can be used to include Imaging system fields in a profile. | No
IpmSystemFields_Hide | Hides the Imaging system fields by default. To show the fields, include a rule that shows the fields (see IpmSystemFields rule). | Yes
IpmSystemFields_Restricted | Restricts the ability to choose Imaging-specific values in security group and document type. | Yes

Any global rule does not need to be referenced by a specific profile in order to be active.

8.1.2 Application Profile and Profile Rules

When an application is created, a profile and rules are created to handle the display of the application fields. The profile rules determine how the application fields are grouped and provide any default values for those fields. The following table describes the rules:

Name | Description | Global Rule
IpmApp_<X>_Fields | Groups the application fields | No
IpmApp_<X>_Fields_Hide | Hides the application fields | Yes
IpmApp_<X>_Defaults | Sets defaults for Imaging system (Security Group, IPM Application ID) fields and application specific fields | No

In the rule names above, <X> is replaced with an internal application identifier. Any rules that are not global rules need to be referenced by a profile to become active.

A profile is created for the application and is given IpmApp_<X> as the profile name, where <X> is an internal application identifier. The label for the rule is the application name.

8.1.3 Working With Folders

Imaging does not automatically assign application documents to a folder. However, by modifying an application profile and profile rules, you can automatically assign documents to a specific folder. To modify application rules to automatically assign documents to a specific folder, do the following:

Create a new contribution folder to hold the application content. Make a note of the folder's identifier, for example 932000007.

Add a new profile rule and make note of the name. For example, App_<X>_Folder.

Select the Folder (xCollectionID) field and set the type to Info Only.

Enable Use default value and set the default value to the folder identifier obtained above. This allows people checking content in using the Content Server check in form to see the assigned folder.

Enable Is derived field and set the default value to the folder identifier obtained above. This allows the value to be set upon check in from any source, including from Imaging upload.

Setting the rule in this manner will not allow users to move content from one folder to another, including the trash folder. To allow the ability to delete documents and move files between folders, change the derived value to use custom script and add something similar to:

<$if not (IDC_SERVICE like "COLLECTION_DELETE_LOT|COLLECTION_RESTORE_ITEM")$>
                                           <$dprDerivedValue="932000007"$>
<$endif$>

Edit the application profile for the Imaging application you wish to modify and add the rule defined above to the Rules tab.

Note:

If an application is modified in Imaging, and the modification includes an application name change, then the rule you just added to the application profile will need to be added again.

8.1.4 Working With Oracle Universal Records Manager

Imaging does not automatically assign documents to a retention category or life cycle. However, by modifying an application's profile and profile rules, you can automatically assign documents to a retention category or life cycle. The following steps are for assigning a retention category value. If you wish to assign a life cycle, substitute xLifeCycleID for xCategoryID.

Create a new retention category and make note of the retention category identifier. For example, you could use App <X> Category.

Add a new profile rule and make note of the name. For example, you could use App_X_Category_rule.

Select the Retention Category field (xCategoryID) and set the type to Info Only.

Enable Use default value and set the default value to the retention category identifier obtained above. For example, App X Category. This allows people using the Content Server check in form to see the assigned category.

Enable Is derived field and set the default value to the retention category identifier obtained above (App X Category). This allows the value to be set upon check in from any source, including from Imaging upload.

Note:

If the category to which you are mapping the documents is a category that is a records-only category, you will also need to add a field for xIsRecord and set its default and derived values to "1".

Edit the application profile for the Imaging application you wish to modify and add the rule defined above to the Rules tab.

Note:

If an application is modified in Imaging, and the modification includes an application name change, then the rule you just added to the application profile will need to be added again.

8.1.4.1 Oracle Records Management and Imaging Content

When Imaging content is configured correctly with an Oracle URM system, a number of restrictions are applied to Imaging content.

If the Imaging document is subject to a freeze in Oracle URM and you attempt to delete the document from Imaging, you will recieve the error "The documents cannot be deleted because they are in a legislative hold in the repository." You will be unable to update the document in Imaging, or move or copy the document to another application. Only the Imaging or WebCenter Content Administrator will be able to delete documents which are frozen. Once unfrozen, the restrictions within Imaging are removed.

8.1.4.1.1 Using Oracle URM 10g

If Imaging is connected with a system using Oracle URM 10g, content associated with "Records-only" Categories are subject to the same restrictions.

8.1.4.1.2 Using Oracle URM 11g

If Imaging is connected with a system using Oracle URM 11g, content associated with categories using the "Restrict Edits", "Restrict Revisions" or "Restrict Deletes," designators are subject to the same restrictions in Imaging.

WARNING:

The "rule" used to associate content with an Oracle URM category must be carefully constructed per the instructions for integrating with Oracle URM. Failure to create this rule correctly may assign Imaging content to records categories or allow them to be frozen, which restricts an Imaging user's ability to modify the document if necessary.

8.1.4.2 Synchronizing with WebCenter Content Adapter for Content Server

When using the WebCenter Content Adapter for Content Server to allow Oracle Universal Records Manager to use multiple Content Server repositories, you must ensure that security groups are consistent between the Content Server and Oracle URM. The WebCenter Content Adapter does not synchronize security groups created by Imaging with Oracle URM.

If an application is created in Imaging that adds security groups to the Content Server repository, you must manually configure the same security groups on Oracle URM that was created by Imaging. This should be done prior to uploading any content to the Imaging application. Additionally, if there is any modification to an Imaging application or to document security in an application, you must manually update the security groups in Oracle URM.

Note:

Imaging metadata fields are not propagated to Oracle URM at all, so documents in Oracle URM do not have any indication of the values specified in Imaging.

8.1.5 Working With Information Rights Manager

Imaging does not automatically assign application documents to an IRM classification. However, by modifying an application profile and profile rules, you can automatically assign documents to an IRM classification.

Add a new profile rule and make note of the name. For example App_X_IRM).

Select the IRMProtection field (xIRMProtection) and set the Type to Info Only.

Enable Use default value and set the default value. This value must match an Oracle IRM context. This allows people using the Content Server check in form to see the assigned IRM classification.

Enable Is derived field and set the default value. This value must match an Oracle IRM context. This allows the value to be set upon check in from any source, including Imaging upload.

Note:

If IRM is not configured correctly, or the value does not match a valid context, you will be unable to check content into Content Server because it will fail IRM validation.

Edit the application profile for the Imaging application you wish to modify and add the rule defined above to the Rules tab.

Note:

If an application is modified in Imaging, and the modification includes an application name change, then the rule you just added to the application profile will need to be added again.

8.1.6 Working With WebCenter Spaces

Imaging documents are not automatically accessible within WebCenter Spaces, but documents can be automatically assigned to Folders visible within WebCenter Spaces. Manual configuration and modification of an application profile and profile rules are required to ensure that Imaging documents will be accessible.

Configure Content Server and Imaging to use the same LDAP-based identity store that Oracle WebCenter has been configured to use.

For information on configuring WebCenter and Content Server to use an LDAP identity store, see Oracle Fusion Middleware Administrator's Guide for Oracle WebCenter Portal.

Configure Content Server as the bridge between Imaging and WebCenter Document Service using an Imaging supported version of Java.

WebCenter Spaces' Document Service uses the Folders component, and Imaging must be configured to automatically specify Folders for checked in content. For more information regarding configuring Imaging with Folders, see the section Section 8.1.3, "Working With Folders."

For further information regarding WebCenter Spaces integration with Content Server, see Oracle Fusion Middleware Administrator's Guide for Oracle WebCenter Portal.

8.2 Understanding Document Storage

Conceptually, applications represent containers of documents with common characteristics as defined and enforced by the application. A single instance of Content Server may not be able to handle the multiple applications required by an organization. In order to scale a solution to handle the multiple applications required, multiple Content Server instances can be used. However, an application cannot be divided across multiple Content Server instances. To support multiple Content Server instances, you must associate each application with its target Content Server instance. To represent this at the Imaging level, a new object has been added to the public API known as the repository. The repository object is responsible for keeping track of the connection information to each Content Server instance. Each application will be associated with a particular repository. For more information about creating connections to repositories, see Section 7, "Managing Connections."

8.2.1 Content Server Document Properties

The following table identifies how Imaging document properties map to Content Server document properties.

Imaging Document Property
Content Server Property
Comment

Id
dDocName

Name
dOriginalName
Could also come from dDocTitle but dDocTitle can be changed in the Content Server user interface

Properties.ApplicationId
none
Custom metadata field

Properties.ApplicationName
none
Read from Application definition not from Content Server

Properties.BatchId
xIPMSYS_BATCH_ID
Custom metadata field

Properties.CreateDate
dDocCreatedDate (Content Server 11g)

xIPMSYS_CREATE_DATE (Oracle Content Server 10g)

dDocCreatedDate (11g) or xIPMSYS_CREATE_DATE (10g) is the date a document is initially created. When additional revisions are checked in, the value the property tracks the initial document creation date. When using Oracle Content Server 10g, xIPMSYS_CREATE_DATE is implemented as a custom metadata field.

Properties.Creator
dDocCreator (Content Server 11g)

xIPMSYS_CREATOR (Oracle Content Server 10g)

dDocCreator (11g) or xIPMSYS_CREATOR (10g) is the user who initially creates a document. When additional revisions are checked in, the value of the property tracks the original creator.When using Oracle Content Server 10g, xIPMSYS_CREATOR is implemented as a custom metadata field.

Properties.DocUrl
none
Will be computed with imaging code. There is an Content Server IdocScript function to compute the URL in the weblayout directory.

Properties.LastModifiedBy
dDocLastModifier (Content Server 11g)

dDocAuthor of latest revision (Oracle Content Server 10g)

dDocLastModifier (11g) or dDocAuthor (10g) is the author of the latest revision. If additional revisions are checked in, the value of the property tracks the revision.

Properties.LastModifiedDate
dDocLastModifiedDate (Content Server 11g)

dCreateDate of latest revision (Oracle Content Server 10g)

dDocLastModifiedDate (11g) or dCreateDate of the latest revision (10g) is the date the last revision was checked in. If additional revisions are checked in, the value of the property tracks the revision.

Properties.LockedBy
dCheckoutUser
Content Server does not have a locking concept other than checking out a document to prevent others from checking it out.

Properties.LockedDate
none

Properties.MimeType
dFormat

Properties.Size
dFileSize

Properties.Version
dRevisionID
This distinct from dRefLabel which can be modified by the user.

Properties.VolumeName
none
If a file store provider is configured and used, this could come from the rules.

FieldValues
Custom metadata fields defined by Application

Permissions.Delete
Delete
Can be determined from IdocScript userHasGroupPrivilege(dSecurityGroup, "D") function (or code that implements the function).

Permissions.Grant
Admin
Can be determined from IdocScript userHasGroupPrivilege(dSecurityGroup, "A") function (or code that implemented the function)

Permissions.Modify Fields
Write
Can be determined from IdocScript userHasGroupPrivilege(dSecurityGroup, "W") function (or code that implements the function)

Permissions.Update
Write
Can be determined from IdocScript userHasGroupPrivilege(dSecurityGruop, "W") function (or code that implements the function)

Permissions.View
Read
Can be determined from IdocScript userHasGroupPrivilege(dSecurityGroup, "R") function (or code that implements the function)

AnnotationPermissions
N/A
Annotation permissions are managed via Imaging Entity Beans.

Revision History

Audit History

<Versions>

<Content Tracker>

Revision history is provided as part of DOC_INFO service.

Auditing history must be obtained by reading the appropriate auditing data via the Content Tracker APIs.

9 Understanding Input Agents

The Input Agent is an Imaging service used to upload and index documents in bulk into the Imaging system. This section describes how to enable the Input Agent and create the input files for batch uploading in Imaging.

This section contains the following topics:

Section 9.1, "Enabling Input Agent"

Section 9.2, "Understanding Input Files"

Section 9.3, "Using Input Filing Commands"

Section 9.4, "Input Agent Processing"

Section 9.5, "Checking Results and Error Files"

9.1 Enabling Input Agent

Input Agent indexes Imaging documents in bulk by using an application definition, input definition, and a specially formatted text file called an input file. The input file specifies the list of images to index and the metadata to associate with them in the application. Input Agent is multithreaded and is configurable to handle large and small volumes of data.

To configure the Input Agent, do the following:

Start the managed servers and navigate to the Imaging configuration MBean using WLST or the Enterprise Manager MBean browser.

Set CheckInterval to a value that is appropriate for your environment. The CheckInterval MBean is a system setting that specifies how many minutes to pause before checking for new work to do. The default is 15 minutes.

Set the InputAgentRetryCount to control how many times a job can be retried after it has failed. The default is 3, after which the job is placed in the failed directory.

Set the InputDirectories MBean to specify the paths to the input files. This value can be expressed as an array of locations. If using a multinode installation of Imaging, this location is shared among all the Input Agents and must be accessible by all agents. If Input Agents are on different machines, this must be a shared network.

Note:

In order to process input files, the Input Agent must have the appropriate permissions on the input directory and the input directory must allow file locking. The Input Agent requires that the user account that is running the WebLogic Server service have read and write privileges to the input directory and all files and subdirectories in the input directory. These privileges are required so that Input Agent can move the files to the various directories as it works on them. File locking on the share is needed by Input Agent to coordinate actions between servers in the cluster.

After completing these steps, the Input Agent is active and ready to process work. Once you create an application (see Section 4.2, "Creating An Application") and input definitions (see Section 5.2, "Creating Input Definitions"), the Input Agent will start processing jobs.

9.2 Understanding Input Files

The Input Agent performs work based on input files. These are simple text documents, similar to CSV (comma-separated values) files, that contain lists of files and associated metadata to index into the Imaging system. The input file can use different encodings as long as the correct encoding is specified in the input definition. Input Agent looks for all input files that match the input mask of the input definition and not the sample file that is used to define the input definition. Note that sample files are not required when creating an input through the API. They are only used when creating an input through the user interface so a user can see the data to help choose the columns.

WARNING:

Input file masks must be unique to the Imaging system and cannot overlap. Input Agent only processes an input file for one input and will not restage a file to be processed again for a different input definition. The order in which inputs are processed is random so it is unknown as to which input will pick up a shared input file.

A sample input file looks like:

C:\IPMData\Input Files\print\NewPrintstreams\doc16.txt|NEW ORDER|10/06/94|B82L|218482
C:\IPMData\Input Files\print\NewPrintstreams\doc17.txt|NEW ORDER|10/06/94|N71H|007124
C:\IPMData\Input Files\print\NewPrintstreams\doc18.txt|NEW ORDER|10/06/94|B83W|24710

The detailed structure of an input file is defined as:

[path to document file][delimiter][metadata value 1]<[delimiter]<metadata value 2> ... <delimiter>>

Items in brackets ([]) are required and items in angle brackets (<>) are optional.

path to document file is the location of the tiff, jpeg, doc or other file type that is being saved to Imaging. It must be a path that is accessible to the user account running the Input Agent.

delimiter is the character that separates the values from one another, such as the | character.

metadata value x are the index values that the application uses to index the document.

The delimiter character must be the same character throughout the entire input file and match what is specified in the input definition. The default is a pipe character (|).

Only one metadata value is required per required field in the application. For example, if a Name and Date field are both marked as Required in an application, then the input file must have values for both the Name and Date field as well. Additional values are optional but they must continue to follow the [delimiter]<metadata value> format.

There is no length restriction per line, but all metadata pertaining to the file must be on a single line because the newline character specifies the start of a new document.

Each value is separated by a delimiter, with the delimited values treated by the Input Agent as Column 1... Column N. Any commands on the line do not count as a column. See Section 9.3, "Using Input Filing Commands."

Columns in the input file need not match the ordering of the Application, but they must be in the same locations as specified in the input definition to be indexed correctly.

Note:

Dates and times specified in the input file are subject to current Daylight Savings Time rules, and not the DST rules in effect for the specified date. This can cause the timestamp of the document to shift forward or back up to two hours. If the timestamp shifts forward or back across midnight, the date used for the document input may also shift.

9.3 Using Input Filing Commands

Input Agent gives users more control over the filing process by inserting special command sequences in the input file. An Input Definition applies to all files, but commands can be inserted by Input Agent in the input file as needed and can change from file to file, offering the flexibility of setting a specific behavior per file, such as the file locale for changing date formats or numeric display.

These commands can be used for processing the entire input file or just a single row of the file, depending on the command. The details of the individual commands are specified below.

9.3.1 Locale

The locale command changes the locale which the agent uses to parse the data. This command can only be used once at the beginning of the input file before any documents are specified. If the command is used after data has been processed then an error will occur and the filing will stop.

Syntax

@Locale[delimiter][locale]

Example

@Locale|es-es

Notes

This command can only be used at the very beginning of the input file and applies to the whole file. If multiple locales need to be used then that data must be separated into different files. The delimiter must be the same as is used throughout the input file. The locale follows the format of ISO Language - ISO Country code.

9.3.2 New

The new command creates a new document in the Imaging system and behaves the same as leaving the index data on a line by itself. The command only applies to the line that is annotated and will reset on the next line.

Syntax

@New[delimiter][line data]

Line Data: The metadata values for the document as would exist on a typical input file.

Example

@New|TestTiff.TIF|98.765|Good Company LTD|10/08/2003|0000|1.733,12|10/09/2003

Notes

The @New at the beginning of the line is not counted as one of the columns to be mapped.

9.3.3 Supporting Content

The supporting content command allows the user to apply a file as supporting content to a document instead of creating a new document. The content is applied to the last new document line that appears in the input file unless an explicit document ID is specified in the command. If the last new document fails to index then the supporting content command also fails since the intended document to add content to doesn't exist.

Syntax

@Support[delimiter][key][delimiter][content path]<[delimiter][document id]>

Key: The supporting content key to store the file under. It must be unique for the document.

Content Path: The path to the file to save as supporting content.

Document ID (optional): The Imaging document ID that the supporting content should be applied to. If this value is given then the previous new document is ignored and the supporting content is placed on the document ID given.

Example

@Support|supporting content key 1|C:\temp\sample.tif

9.3.4 Apply Annotations

The apply annotations command applies a pre-generated annotation file to a document. The annotation is applied to the last new document line that appears in the input file unless an explicit document ID is specified in the command. If the last new document fails to index then the apply annotations command also fails since the intended document to apply annotations to doesn't exist.

Note that multiple annotation commands overwrite each other. They are not cumulative.

Syntax

@Annotation[delimiter][file path]<[delimiter][document id]>

File Path: The path to the annotation file to apply to the document.

Document ID (optional): The Imaging document ID that the annotation should be applied to. If this value is given then the previous new document is ignored and the supporting content is placed on the document ID given.

Example

@Annotation|C:\temp\annot.xml

9.3.5 Workflow Inject Document

The workflow inject document command kicks off a workflow injection for the specified document id. The command is only intended for use in the error file and is documented here for informational purposes only.

Syntax

@WorkflowInjectDoc[delimiter][document id]

Document ID (required): The Imaging document ID to inject into workflow.

Example

@WorkflowInjectDoc|2.IPM_014404

9.4 Input Agent Processing

This section describes how the Input Agent processes the input files.

9.4.1 Input Directory Structure

The input directory specified in the configuration MBean is the top level of the directory structure. Below the top level input directory, the Input Agent creates and manages other directories in the following structure to process its work. Directory definitions follow the following file structure.

Input
   - Errors
   – Holding
   – Processed
      — YYYY-MM-DD
   – Samples
   – Stage

Directory
Definitions

Input
This is the top level that is defined in the configuration MBean. This is where Input Agent looks for new input files. There can be multiple input directories defined in the MBean and each entry in the MBean will have this same structure below it.

Errors
Whenever an input file has a mixture of failed index attempts along with some successful indexes, an error file is created for that filing in this directory.

Holding
If CleanupExpireDays and CleanupFileExclusionList MBeans are enabled, the holding directory stores any successfully processed file, including annotation and supporting content files. The images remain there until the number of days specified in the CleanupExpireDays setting elapses. After that point the files and the batch folder are deleted. Specify any files that should not be deleted in the CleanupFileExclusionList setting with exact file names.

YYYY-MM-DD
These directories are date values in the form of year-month-day (such as 2009-04-01) that organize the input files by the date they were processed. This gives the date of when the file was processed and prevents any one directory from getting too many files in it.

Processed
Files under this directory have been parsed all the way through the filing process. If an error occurred during processing, then an error file is placed in the Errors directory and the original file is placed in the Processed directory even if no document is created in the Imaging system.

Samples
This directory contains all the sample files that work with input objects via the user interface. Files in this directory are visible in the input wizard under the user interface and should not contain production data. Note that the Samples directory location is configured separately from the input directories and may not be under the input directory.

Stage
Files in this directory have been selected for processing and are being worked on by the agent. Once the filing is complete, the file is moved to the Processed directory. If the processing fails, an error report is generated.

9.4.2 Input Agent Processing Order

Input Agent polls for input files, stages them, and posts a message to the JMS queue that there are files available for processing. Input ingestors listen to the JMS queue and start processing staged files. The sequence of events is as follows:

9.4.2.1 Polling

First, Input Agent polls for files:

Upon Input Agent wake up (specified by the CheckInterval MBean), Input Agent gets a list of the currently online input definitions.

For each of the input definitions, Input Agent checks all input directories for files that match the input file mask.

When a file is found, it is moved to the Stage directory and a message is generated on a JMS queue to process the file, at which point input ingestors are notified and processing can begin.

Steps 2 and 3 are repeated until all input definitions and directories have been checked.

9.4.2.2 Processing

Once input ingestors are notified that there are files staged for processing in the JMS queue, they begin processing the files:

The ingestor opens a connection to the repository and creates an error file and a new batch object for tracking the documents.

The thread begins parsing the input file and indexing the documents into Imaging. Any errors that are encountered during indexing are recorded in the error file. This step is repeated for all entries in the input file.

After all the documents have been processed, the batch is closed and, if there were no error entries, the error file is deleted.

The ingestor closes the connection to the repository and the input file is moved to the current date directory under the Processed or Failed directory, and the ingestor moves on to the next staged input file.

9.4.3 Changing Oracle WebLogic Server Work Manager Settings

A work manager is an Oracle WebLogic Server concept for controlling how many threads are assigned to a process. In Imaging, they are used to control how many threads are assigned to the Input Agents and for increasing or decreasing their load on the system. On a new installation, Input Agent is assigned 10 threads. You can reconfigure how many threads Oracle WebLogic Server should provide to the Input Agents by changing the default settings of the WebLogic Server work manager InputAgentMaxThreadsConstraint (default 10) to match your system needs. The number of maximum threads should be adjusted equally on all systems to avoid one machine falling behind and creating a backlog. A value of -1 or 0 disables the constraint. Values above 1 constrain the number of threads to the specified number.

To update thread settings, complete the following steps from the WebLogic Server administration console. For more information about WebLogic Server, see Oracle® Fusion Middleware Configuring Server Environments for Oracle WebLogic Server.

Bring up the WebLogic console for the domain and go to the deployments section.

Select the Imaging application to display the details for Imaging.

Select the Configuration and then Workload tabs to get to the Work Manager list.

Select InputAgentWorkManager to adjust.

Select InputAgentMaxThreadsConstraint at the bottom of the page.

Update the count to the new maximum thread count and click Save.

Restart the managed server(s) and the new thread count will be in effect.

9.5 Checking Results and Error Files

Input Agent has a retry mechanism to allow it to reattempt processing the input file in the event of a recoverable error. An example of this type of error is when the repository is not yet available and needs to finish initializing. When Input Agent detects a recoverable error, it puts the filing back on the JMS queue. The queue has a configurable retry wait timer that prevents the input file from being reprocessed immediately. You can also set the InputAgentRetryCount MBean to control how many times a job can be retried. The default is 3, after which the job is placed in the failed directory.

To troubleshoot any input file errors, do the following:

Determine if a severe error is preventing the input file from being parsed by examining the Errors directory. In the case of a severe error, two files are placed in the Errors directory: the original input file and an error file. The original input file is renamed by appending an error code, date and time the error occurred to the original file name in the following format:

original name-error code.YYYY-MM-DD.HH-mm-SS.original ext

The error file is named using the original input file name appended with the date and time of the error with a .err extension in the following format:

original name.YYYY-MM-DD.HH-mm-SS.err

For example, the failed input file invoices.dat would be renamed and placed in the Processed directory as invoices.dat-errorcode.05-21-2010.16_36_07.dat and have an associated error file of invoices.dat.05-21-2009.16_36_07.err.

Note:

The file name character limitations of the file system being used should be considered when naming input files. Input file names should be at least 55 characters less than the file system limit in order to allow for the appended error codes and date-time stamps.

For example the Windows NTFS file system restricts the file name plus the length of the file path to 256 characters. If the Errors directory path is 150 characters long, then no input file name should exceed 51 characters: 256 character limit - 150 character directory path - 55 character error code date-time stamp = 51 characters left for a file name. In this example, if more than 51 characters is required for input file names, then the Errors directory must be moved to a shorter path.

If an error report does exist it will contain a list of all lines from the original input file that failed with an additional column containing the error message. So, an original line of:

C:\IBPM Data\WorkFiles\Filer\input\Images\C885|Identifier 165|27/06/2008|28215|495.75|

would be listed in the error file as the following:

C:\IBPM Data\WorkFiles\Filer\input\Images\C885|Identifier 165|27/06/2008|28215|495.75|Could not find file C:\IBPM Data\WorkFiles\Filer\input\Images\C885

If a more detailed logging level is enabled for Imaging and a filing was placed in the processed directory, a log entry is created stating:

Filing <Input Name> completed successfully with <indexed doc count> documents processed successfully out of <total doc count> documents.

If the filing failed, then a log entry is created that states:

An error occurred while completing a batch.

Common causes of errors on a line by line basis are problems with proper formatting of metadata to be loaded, or invalid value ranges and truncation of data.

Refer to the server's Oracle Diagnostic Logging (ODL) framework logs. The most common way to check this is via the Enterprise Managers's Log viewer for the imaging application. Typical problems here are from underlying repository or file permissions issues.

10 Understanding Workflow Agents

Business Process Management (BPM) technology is a framework for applications that can effectively track and orchestrate business processes. BPM solutions can automatically manage processes and process flow, yet also allow for manual intervention when necessary.

This section contains the following topics:

Section 10.1, "Business Process Management"

Section 10.2, "Business Process Execution Language (BPEL)"

10.1 Business Process Management

BPM might coordinate the extraction of customer information from a database or manage a new customer information transaction. BPM could generate transactions in multiple related systems or support complete through processing automatically, without human intervention. BPM allows you to automate tasks involving information from multiple systems with rules to define the sequence in which the tasks are performed, as well as responsibilities, conditions and other aspects of the process. BPM not only allows a business process to be executed more efficiently, it also provides the tools to allow you to measure performance and identify opportunities for improvement. A benefit of BPM is that changes can be easily made in processes or flow by adding, removing or updating a process.

To best take advantage of BPM, the software application components of an Oracle process follow a Service-Oriented Architecture (SOA). These components are published as web services for reuse and ease of integration using BPEL.

10.2 Business Process Execution Language (BPEL)

Business Process Execution Language (BPEL) is an executable language for specifying interactions with web services. It extends and enables the web services interaction model to support business transactions and human interaction. BPEL is emerging as the clear standard for composing multiple synchronous and asynchronous services into collaborative and transactional process flows. BPEL is to business process management what SQL is to data management.

You can use BPEL to define services that can be used by other applications. You define all aspects of a process, from the definitions of data required to start a process to the available forms for human interaction with a process. These components are bundled into a composite and deployed to an workflow server.

To integrate a workflow process with Imaging, you must complete the following steps:

Create a workflow connection (see Section 7.2, "Creating a Workflow Connection").

Create an application with a workflow process defined within it (see Section 4.2, "Creating An Application").

Configure workflow properties, which is part of the process to create an application in the Imaging user interface (see Section 10.2.1, "Configuring Workflow Properties").

10.2.1 Configuring Workflow Properties

A workflow process can be added to an application when the application is created, or by modifying an existing application. Adding a workflow process begins with the Application Workflow Configuration Page. Before configuring an application to use a workflow, you must ensure that a connection to a workflow server has been created and the required workflow component is available on the server. The workflow server connection must include a name, protocol, server, and port (for example, name=t3://sta00319:7001). Then when creating an application, select the workflow connection on the Workflow Server Properties Page. Imaging must authenticate with the server to discover the deployed workflow components.

Once a server connection is selected for the application, a list of workflow components is identified. A workflow component can provide many different services, so you must identify the service you want to use on the Workflow Component Properties Page. Services can be invoked in multiple ways, so you must also identify the operation used to start a process. This operation is assumed to be asynchronous; it is a one-way communication into the workflow. Imaging uses it to initiate a process instance and does not wait for a response. A business process may take hours or days to complete.

Once the operation is selected, Imaging knows which data has to be provided to start the process. This is called the payload. A workflow uses web services so the payload reflects the data contained in the Web Services Description Language (WSDL) that defines the service. This data is represented as a schema with defined data types. On the Workflow Payload Properties Page, the payload type and a list of allowed values are displayed which are called mapping functions. Workflow Payload Mapping Functions return a value of a given type: text, number, date, and so on. If the payload value can accept a date, mapping functions that return a date are shown. If a text function cannot properly evaluate to a date, it is excluded from the list of available functions. If the payload value can accept a string, then all mapping functions are allowed since they can all be represented as text.

10.2.1.1 Workflow Payload Mapping Functions

The Workflow Payload Properties Page is used to map Imaging application metadata fields to elements within a workflow process service payload. Predefined mapping functions are associated with simple typed elements in the payload. At runtime, when a document is created and the workflow agent is triggered to create a workflow process instance for the document, the mapping function for each element is evaluated to transform metadata from the document into payload element values. The mapping functions that are available may provide the raw metadata of the document, including system properties and application defined field values. A special mapping function named Format Value is also provided, allowing mapping of any value. The format is custom concatenation of constant values as well as values from other mapping functions.

Mapping functions are typically specific to type and must match the schema type of the payload element. This means that numeric, decimal, and date types in the payload may only map be mapped with mapping functions that return these types. String types in the payload can typically be mapped with any mapping function. Also, the Format Value mapping function can be mapped to any payload element. However, The Format Values return type is technically a string, and care must be taken to ensure that the return value is a valid string representation of the payload schema type.

The following table lists the available specific payload BPEL schema types and their compatible mapping functions:

BPEL Schema Types
Mapping Function

string, normalizedString, token
All Functions

All Field Values

Doc URL Path

anyType
All Functions

All Field Values

Doc URL Path

anyUri
DocUrl

DocUrlRoot

Format Value

byte

unsignedByte

integer

positiveInteger

negativeInteger

long

unsignedLong

short

unsignedShort

Note: Imaging uses integer bounded types to store numbers. Mapping to schema elements with lower bounds is allowed but may result in errors or loss of data during mapping execution

AppId

BatchId

DocSize

Version

Format Value

Number Field Values

time

date

dateTime

Create Date

Modify Date

Volume Date

Format Value

DateField Values

Boolean
True

False

Boolean Field Values

Supporting Content
Format Value

All other schema types
Format Value

The following table lists the available specific payload BPM schema types and their compatible mapping functions:

BPM Argument
BPM Schema Types
Mapping Function

String
string
All Functions

All Field Values

Int
int

Note: Imaging uses integer bounded types to store numbers. Mapping to schema elements with lower bounds is allowed but may result in errors or loss of data during mapping execution

AppId

BatchId

DocSize

Version

Format Value

Number Field Values

Bool
boolean
True

False

Boolean Field Values

Real
double
Format Value

Decimal
decimal
Format Value

Decimal Field Values

Time
dateTime
Create Date

Modify Date

Volume Date

Format Value

DateField Values

Interval
duration
Format Value

Binary
base64binary
Format Value

Format Values for types other than string-based types must return valid string representation of the schema type. Also, there are many other valid payload schema XSD types that may be present in a payload. Format Value is the only mapping function supporting types other than those specifically listed in the table above. As with other Format Value usages, it is up to the application and workflow process implementer to ensure that the format string returns a compatible type. Because the actual value returned is only known at runtime, Imaging cannot do any validation on such a configuration. It is recommended that payloads use the known types listed in the above table whenever possible.

10.2.1.2 Required Payload Element (MinOccurs) Handling

Workflow payload elements annotated with minOccurs are defined as being required when mapping Imaging application fields. These elements are designated with a (*) symbol on the Workflow Payload Properties Page of the Imaging user interface.

Payload elements with a minOccurs=1 are interpreted as being required and Imaging requires a mapping for them. In this case, required means that the element must be supplied in the payload, but does not need a value. It is possible for a field value mapped to a payload element to be null even when mapped to a minOccurs=1 payload element. In this case, an empty element will be passed. In cases where the workflow process wants required to mean that a value must be supplied, the application field value mapped to the element can be marked as required in the application definition to ensure that it has a value. The workflow payload mapping does not enforce this.

Payload elements with a minOccurs=0 are interpreted as being optional and need not be supplied in the payload if there is no mapping for the element. This means that providing a mapping is optional as well. If no mapping is provided, the node will not be included in the payload sent to the workflow server. If a mapping is provided, however, the node will always be included, even if the value returned by the mapping function is empty. In this case, an empty element node is passed.

Note:

In the workflow payload, Imaging does not support types where the minOccurs or maxOccurs attributes are greater than one.

10.2.1.3 Date Field Format

For mapping functions that map to a payload schema date or time based type (time, date, dateTime), values are encoded to ISO 8601 compliant formats as follows:

Schema Type | Format | Example
time | hh:mm:ss±tz | 12:45:15-05:00
date | yyyy-MM-dd | 2009-11-09
datetime | yyyy-MM-ddThh:mm:ss±tz | 2009-11-09T12:45:15-05:00

As indicated, types that include a time use the positive/negative time zone designator as an offset in hours and minutes (hh:mm).

10.2.1.4 Doc Property Functions

Document property functions assign the value of a system property of the document to a payload element. Document Id, Application Name, Create Date, etc.

10.2.1.5 Field Value Functions

The Field Value function assigns application field values from a document to a payload element. Although "Field Value" is technically the name of the function, with the name of the field as a parameter, the Workflow Payload Properties Page presents each of an application's field definitions as a item in the mapping function selection box listed by the field's name. As with all mapping functions, the field definition type is used to determine whether or not it is compatible with the payload element schema type. Only compatible field values are listed as options next to any particular payload element.

10.2.1.6 Format Value Function

Format value is a special mapping function that allows assigning any string value to a payload element. The format value can also embed multiple other mapping function values in the format string value as variables that will be supplied at runtime.

A format value is assigned to a payload item on the Workflow Payload Properties Page by selecting Format Value as the mapping function and then clicking the Edit Format Value button that appears next to selection box. On the "Edit Format Value" dialog that appears, the format value is entered at the bottom. A selection list at the top provides the available mapping functions, which can be inserted into the edit box. (Items append to the end of any currently entered text.)

When creating a format value string manually, mapping function variables are encoded in the value using the mapping function name surround by square brackets (e.g., "[DocUrl]"). Field Values are coded by include the mapping function (Field Value), a colon, and then the desired field name, all within square brackets.

For an example, suppose that the workflow process includes a data variable that is expected to contain custom URL. The custom URL must include a customerId, which is available in the metadata of the document, and the document's unique identifier. The root of the URL is hard coded. This example might be coded in a format value as follows:

http://example.com/svc.jspx?custId=[FieldValue:custId]&docId=[DocId]

10.2.1.7 Supporting Content Function

The Supporting Content function maps supporting content data associated with a document to a workflow process payload element. Supporting content can be mapped to any complex node within the process payload. When the supporting content function is mapped, a supporting content key and XPath parameter are both required. The supporting content key is used to associate the XML content with the document and is limited to 30 characters. The XPath expression identifies the node within the XML content to be mapped to the payload element and is limited to 224 characters.

When mapping to a complex payload element at runtime, the supporting content is treated as a mapping of elements into the payload complex element rather than just copying the supporting content element in verbatim. Each element in the payload element is processed one by one. For each element, a matching element sought in the supporting content, starting at the node identified by the XPath parameter. If a match is found, the value of the matching element in the XML is assigned to payload element. Processing the supporting content avoids namespace conflict issues between the supporting content XML and the payload XML.

Supporting content can also be assigned to an anyType node in the payload. When mapped this way, the supporting content identified by the XPath is copied into the anyType element. When used this way, namespace prefixes should be avoided in the supporting content because the namespaces may not be defined correctly in the payload.

10.2.2 Payload Limitations

In general, the workflow payload mapping can handle payloads containing nesting of complex types. However, there are of number of standard XSD constructs that it cannot handle. Workflow process service payload definitions containing any of the following cannot be used:

Hierarchical depth greater than 10

Choice element types

List elements with minOccurs greater than 1

Payload definitions containing list like structures (maxOccurs is greater than 1 or unbounded) with a minOccurs equal 0 or 1 can be used, but only support mapping to a single element in the array.

10.2.3 Mapping Secure Workflow Services

When the Workflow Process service has server-side Oracle Web Services Manger (OWSM) policies applied to it, additional parameters need to be supplied in the imaging application's workflow configuration such that the client-side policy is also used. These additional configuration parameters are provided on the Workflow Payload Properties Page with the normal workflow process instance payload mappings. If the service has a OWSM policy applied, Imaging detects this policy and provides an additional payload mapping section labeled with the policy name. The full set of keys that are possible for all OWSM policies is provided by the OWSM API in the class oracle.wsm.security.util.SecurityConstants. Imaging however filters out the full set and lists only those parameters relevant to the server policy in use. Currently, only parameters are provided for wss_username_token and wss11_username_token_with_message_protection policies.

The following parameters are possible:

Parameter
Description
Policies

csf.key
Provides the username and password for the policy.
wss_username_token

wss11_username_token_with_message_protection policies

recipient.key.alias
Provides the key store alias for encrypting the sent message.
wss11_username_token_with_message_protection policies

10.2.3.1 Configuring Message Protection Policies

When configuring message protection policies, the proper credentials and certificates must also be configured to support encryption of the message. In default installations, the exact keys required are defined in the jps-config.xml file located in the $DOMAIN_HOME/config/fmwconfig directory. This file also defines the location of the default keystore file. The jps-config.xml file is generally configured to look for this file in the fmwconfig directory with the file name default-keystore.jks. However, this file does not exist by default and must be provided. The default jps-config.xml file defines the following:

Description | Policies
keystore-csf-key | Provides the credentials for opening the keystore file. Only the password portion of the credential is used.
enc-csf-key | Provides the credentials for accessing the encryption certificate within the keystore used to encrypt the message.
sign-csf-key | Provides the credentials for accessing the certificate used to sign the message. Note that the jps-config.xml file may be configured to use the enc-csf-key for both encryption and signing. In such a case the sign-csf-key is not necessary but does not cause a problem if defined.

For more information on setting up keystores, CSF keys and aliases for Oracle Web Services Manager, see Oracle Web Services Manager Administrator's Guide.

10.2.3.2 Configuring SAML Policies

The user used to connect to a workflow for a SAML policy is provided by the "basic.credential" CSF key value. In order for the server to be allowed to authenticate as the user provided by the CSF key, the following policy grant must be issued from WebLogic Scripting Tool (WLST), where MW_HOME is the correct path to the installations Oracle Fusion Middleware Home directory:

grantPermission(permClass="oracle.wsm.security.WSIdentityPermission",
           permTarget="resource=imaging",permActions="assert",codeBaseURL="file:<MW_HOME>/oracle_common/modules/oracle.wsm.agent.common_11.1.1/wsm-agent-core.jar")

10.2.4 Changing WebLogic Server Work Manager Settings

A work manager is a WebLogic server concept for controlling how many threads are assigned to a process. In Imaging, they are used to control how many threads are assigned to the input and workflow agents and for increasing or decreasing their load on the system. On a new installation, the workflow agent is assigned 20 threads. You can reconfigure how many threads WebLogic server (WLS) should provide to the input and workflow agents by changing the default settings of the WLS work managers WorkflowAgentMaxThreadsConstraint (default 20) to match your system needs. The number of maximum threads should be adjusted equally on all systems to avoid one machine falling behind and creating a backlog. A value of -1 or 0 disables the constraint. Values above 1 constrain the number of threads to the specified number.

To update thread settings, complete the following steps from the WLS administration console. For more information about the WebLogic server, see Weblogic Web Services Reference for Oracle Weblogic Server.

Open the WebLogic Server console and click Deployments.

Select the Imaging deployment to display the details for Imaging.

Click the Configuration tab and then the Workload tab to display the Work Manager list.

Select the agent you want to adjust, such as WorkflowAgent.

Select the Max Threads Constraint.

Update the count to the new maximum thread count and click Save.

Restart the managed server or servers and the new thread count will be in effect.

10.2.5 Using a Workflow Connection CSF Credential

A credential store framework (CSF) credential is a username/password pair that is keyed by an alias and stored inside a named map in the CSF. Because of its integration with Oracle Web Services Manager (OWSM), Imaging leverages the standard OWSM CSF map named oracle.wsm.security.

A credential can be created through Enterprise Manger (EM) or through WebLogic Scripting Tool (WLST). For details, see Section 7.2.2, "Configuring a Workflow Connection CSF Credential."

10.2.6 Workflow Agent Retry Sequence

If the workflow agent cannot connect to the workflow server, there will be three immediate attempts at connection. If all three attempts fail, the message is returned to the JMS queue for deployed process. The BpelInjectorQueue JMS queue is configured for a five minute retry delay. Each subsequent retry attempt to process the message is again manually retried three times. Like the manual retry mechanism, the message is returned to the queue two times (for three process attempts). After the third message processing attempt fails, the document details are written to a workflow agent faults table, including the exception message from the last exception received, and the message is not returned to the queue. This provides nine retries over a time period of 10 minutes. Note: If for any reason the attempt to record the document details to the fault table fails, the message is returned to the queue to avoid dropping the request.

10.2.7 Configuring the Workflow Faults Table

Workflow agent processing faults that are recorded to the faults table are managed using a set of WebLogic Scripting Tool (WLST) diagnostic commands. To access these commands, you must execute WLST from the Enterprise Content Management $ORACLE_HOME/common/bin directory. Also, when connecting to WLST, you must connect to an Imaging managed server instance, not the admin server. These commands are only available when the Imaging managed server is online.

The following workflow diagnostic commands are available using WLST:

sumIPMWorkflowFaults: Counts processing failures during workflow agent processing, grouped by choice of date, application ID, or batch ID.

clearIPMWorkflowFaults: Clears processing failures that occurred during workflow agent processing.

listIPMWorkflowFaults: Provides details of processing failures that occurred during workflow agent processing.

repairIPMWorkflowFaults: Repairs processing failures that occurred during workflow agent processing.

Details about use and syntax of these faults can be found in the Oracle Fusion Middleware WebLogic Scripting Tool Command Reference.

10.2.8 Initiating a Workflow Process Instance

Once a user has configured all of the workflow properties, they are ready to be used to initiate workflow processes. When a document is uploaded to Imaging, a message is sent to the workflow agent indicating new content. The workflow agent monitors these messages, and when it receives a message that the document's application has been configured to use workflow, it uses the configuration to build a payload of values for that specific document and then calls the service to initiate a workflow process.

The workflow process must be designed in such a way that if a user needs to look at a document from Imaging, it has the necessary information needed to launch the viewer. This can be accomplished by defining a payload value to hold the viewer URL. It is up to the workflow designer to create a form that includes a button or link to open the target of the viewer URL property. If the business process must update information in Imaging, it can do so by using the Imaging API. For more information about APIs, see Oracle® WebCenter Content Developer's Guide for Imaging. The Imaging API is exposed as a web service which can easily be added to any workflow process by a process designer. Again, the designer needs to ensure that he or she has collected enough information at the start of the process to communicate updated data for the document. For example, the document ID and application field names would be necessary.

Note:

A document can be resubmitted to a workflow using WebLogic Scripting Tools by calling the submitIPMToWorkflow() WLST command. A confirmation message is displayed stating that the document has been submitted, however if the document is stored in an application that is not configured with a workflow, no action is taken.

11 Troubleshooting

This section contains information about troubleshooting Oracle WebCenter Content: Imaging.

This section includes information about the following topics.

Section 11.1, "Decimal Field Error"

Section 11.2, "Imaging and Windows Server Prerequisites"

Section 11.3, "NULL Number Fields"

Section 11.4, "Full-Text Search Fails On Large Documents"

Section 11.5, "Repository Capacity Errors"

Section 11.6, "Font Errors"

Section 11.7, "Input Agent and Input File Issues"

Section 11.8, "Advanced Viewer Transformation Errors"

Section 11.9, "Problems with TIFF Display in Viewer"

Section 11.10, "Shared Temp Directory in Linux Causes Display Failure"

Section 11.11, "Shifting Redaction and Other Annotations"

Section 11.12, "Logging of ImagingException"

Section 11.13, "Tracking Events in the Imaging and Content Server Log Files"

Section 11.14, "Using Oracle Dynamic Monitoring System with Imaging"

Section 11.15, "Reviewing Audit History of Deleted Documents"

Section 11.16, "Deciphering Nested Stack Errors"

Section 11.17, "Imaging Session Time Out When Using OSSO Requires Browser Refresh"

Section 11.18, "Content Server 10g Provides Incorrect Dates for Workflow"

Section 11.19, "Doc URL Returned With Invalid IP Address"

Section 11.20, "Required Fields Added to Content Server Must Have Default Value Specified"

Section 11.21, "Imaging Viewer Fails On UNIX, AIX, and Solaris SPARC"

Section 11.22, "Viewer Displays Blank Page Instead of Document"

Section 11.23, "HTML Login Form Displayed Instead of Document in Advanced Viewer Mode"

Section 11.24, "Viewer Reports Magic Number Error"

Section 11.25, "Invalid Skin Preference Displays Generic User Interface"

Section 11.26, "Problem Displaying Second Page of Microsoft PowerPoint 2007 Document"

Section 11.27, "Configuring Viewer for Use in UNIX Exalogic Environment with Solaris 11g"

11.1 Decimal Field Error

Imaging supports 15 digits of precision independent of the location of the decimal separator. Note the min/max values are not inclusive. Some examples:

Scale of 2:

Value must be less than 10,000,000,000,000.00

Value must be greater than -10,000,000,000,000.00

Scale of 5:

Value must be less than 10,000,000,000.00000

Value must be greater than -10,000,000,000.00000

11.2 Imaging and Windows Server Prerequisites

Imaging uses Oracle Outside In Technology which requires certain libraries to be installed that are not part of Imaging. These libraries must be installed on the Imaging server, Content Server, and client machines using the advanced viewer mode, regardless of the machine platform. For more information on what libraries are required for each platform and how to obtain, install, and configure them, see the Oracle WebCenter Content Installation Guide.

11.3 NULL Number Fields

When a search is executed on an application with a number field that returns hits with documents with nothing entered in a number field, either a 0 or a -1 appears in the field. When an application containing documents is modified to have a number field, the search returns -1 for those documents. When a document is uploaded and the number field is left blank, the search returns 0. If a search is executed with the number field as a condition, they are treated as empty fields and when viewed in Content Server, the fields are empty.

The null number field issue is a result of Content Server functionality.

11.4 Full-Text Search Fails On Large Documents

By default, the maximum document size that will be indexed is 10MB. This is changed by setting the MaxIndexableFileSize configuration variable in the Content Server repository. The default is MaxIndexableFileSize=10485760. If larger documents require full-text indexing, the value of MaxIndexableFileSize should be increased.

11.5 Repository Capacity Errors

Each Imaging application that is created increases the structure complexity of the underlying Content Server repository. Imaging monitors multiple factors to estimate when then structure complexity of its Content Server might be hampering its performance. Once that threshold is exceeded, the Imaging system will consider the Content Server to be full and no longer allow the creation of new applications. The factors used to calculate fullness are configurable and are listed below. This fullness is a reflection of structural complexity of the Content Server, not its ability to continue to accept additional documents. To resolve fullness issues the configuration values below can be adjusted, provided the Content Server system continues to perform well, or an additional Content Server installation can be used to contain new Imaging applications.

A Content Server repository is considered full if any of the following are true:

The number of security groups exceeds the value of the environment variable IpmMaxGroupLimit.

The number of roles assigned permission to security groups exceeds the value of the environment variable IpmMaxGroupRoleLimit.

The number of metadata fields exceeds the value of the environment variable IpmMaxMetadataFields.

The Content Server configuration setting IpmRepositoryForceFull=True

Setting IpmRepositoryForceFull equal to True allows you to configure Content Server to identify itself as full to Imaging in order to prevent additional applications from being created. This does not prevent documents from being uploaded.

To get additional space for applications, do one of the following:

Install an additional independent WebCenter Content system and define a new connection to it in Imaging. For information on how to configure a an additional Content Server repository, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

Increase the values of the IpmMaxGroupRoleLimit and IpmMaxMetadataFields environment variables by editing the config.cfg file directly or by using the Content Server administrative server. For more information about changing Content Server environment variables, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

You can also change these environment variable values in the config.cfg file for your Content Server Repository. For more information, see the Oracle WebCenter Content System Administrator's Guide for Content Server.

11.6 Font Errors

Documents with text content require the fonts necessary to render the document to be available to the Oracle Outside In rendering engine, which uses TrueType fonts. Fonts are not provided by Oracle. If the font used in a document is not available to Oracle Outside In, then a suitable substitute will be used. Font substitutions can cause a document to be unreadable, create incorrect text formatting, or cause shifting of data or repagination on text documents, including potentially exposing redacted content.

Indicators of font problems are when a document renders properly in the advanced Viewer mode but not the basic Viewer mode, or if TIFF documents display properly but rendered Microsoft Office documents do not.

To ensure that proper fonts are used when rendering documents, the administrator should install them to the client and server system. The server MBean GdFontPath should be set to the directory where the fonts are installed. For more information on setting MBeans, see Section 3.7.1, "Configuring MBeans."

When using the advanced viewer mode on Linux systems, the fonts can be installed and the environment variable GDFONTPATH set to that directory. If the environment variable is not found, the user will be prompted for that path the first time the advanced viewer mode is used. In cases where an attempt to download a document as a TIFF before the path is set, an error may occur that prevents downloading the TIFF rendition.

11.7 Input Agent and Input File Issues

The following issues involve input agents or input files.

11.7.1 Input Agent Will Not Detect and Process Input Files

If the input agent will not pick up input files, try the following steps to determine a solution.

Check the settings of the following Imaging MBeans:

CheckInterval: Make sure this is set to a reasonable amount of time for your environment (for example, maybe 1 minute for test systems or 30 minutes for production systems that do not need to get data right away) and ensure that enough time has expired for at least one polling interval to have occurred.

InputDirectories: Examine the list of directories and ensure that they are the correct directories where the input files are stored.

Ensure that the input file has Read/Write permissions for WebLogic Server.

Check the permissions on the input directory paths and make sure they are accessible to the user that is running the WLS managed server.

Look at the input definition in the user interface and make sure the input that is supposed to be processing is marked online and that the input file mask matches the files that are in the directory.

If the input agent is still not running then examine the log files to see if an error was encountered that is preventing the agent from functioning.

11.7.2 Auto-detect Not Determining Character Set

Auto-detect does not work if the provided sample file is not large enough to get an accurate determination of the character set. If the sample file is too small, disable Auto-detect input file character set and manually select the character set.

11.7.3 Input File Entries Have Errors

For the steps below, refer to the following directory structure:

Input
   - Errors
   – Processed
      — YYYY-MM-DD
   – Samples
   – Stage

If some or all of the entries in the input file have errors, try the following steps to determine a solution.

Look at the Errors directory in which the input file was placed and see if an error file was created. If an error file exists, then open it and examine the last column of the file to determine the specific error.

Examine the input file and verify that the path to the image file is accessible to the user that is running the Imaging managed server and that the user has permissions to the path and image files.

Copy one of the failing input files to the samples directory and load it into the input definition editor UI. Verify that the mappings are correct and that one of the columns has not shifted.

Finally, look at the Imaging log file and examine the errors that are listed for the individual lines to determine the exact cause of the problems.

Once you have determined the cause of the error and are able to correct it, copy the corrected input file back into the input directory. For additional information, see Section 9.5, "Checking Results and Error Files."

11.8 Advanced Viewer Transformation Errors

In cases where the advanced viewer applet experiences transformation errors, the first response is to delete temporary files on the user's workstation. Doing so will remove the distribution of Oracle Outside In files which will cause a new deployment next time the applet is used.

11.9 Problems with TIFF Display in Viewer

The Advanced Viewer mode renders Group 6 and Group 7 TIFFs, while the Basic Viewer mode supports Group 7 but not Group 6 TIFFs. Group 7 TIFFs must conform to the TIFF standard for JPEG compression. Color images should use YCbCr for photometric interpretation or the image will be treated as a grayscale image. YCbCr is the standard color for JPEG images.

11.10 Shared Temp Directory in Linux Causes Display Failure

When using Imaging in a multi-user Linux environment, ensure that individual temp directories are set up for each user. Using a temp directory shared among several users can cause the Advanced Viewer to delete temp files for one user that are necessary for another, causing a problem with documents not displaying. Ensure that each user has a temp directory created and configured as recommended by the operating system documentation.

11.11 Shifting Redaction and Other Annotations

Annotations are placed based on coordinates, and in some circumstances, content underneath the annotation may shift. This can be a particular problem when a redaction annotation shifts, potentially exposing sensitive information. For example, if a document contains text data and the font used in a document is not available to the Oracle Outside In rendering engine, then a suitable substitute will be used. Font substitutions can cause a document to be unreadable, create incorrect text formatting, or cause shifting of data and repagination on text documents, including potentially exposing redacted content.

If annotations become misaligned and expose text they originally covered, ensure that a consistent set of fonts is being used across the servers and clients. For information on font errors, see Section 11.6, "Font Errors."

11.12 Logging of ImagingException

By default, not all exceptions caught within Imaging are logged. In the event that all exceptions need to be monitored, the following steps will help identify all exceptions thrown. Imaging exception handlers do not inherit a log level from a parent logger (oracle.imaging.service). To get exceptions from the core Imaging services, you must explicitly set the logger named oracle.imaging.service.exceptions.To enable some degree of flexibility, it uses the following log levels:

ERROR 1(SEVERE): Logs SYSTEM and DATABASE ImagingExceptions

NOTIFICATION(INFO): Logs SYSTEM, DATABASE, and SECURITY ImagingExceptions

TRACE(FINE): Logs SYSTEM, DATABASE, SECURITY, and USAGE ImagingExceptions

For example, all ImagingExceptions would be logged at throw time by setting oracle.imaging.service.exceptions to TRACE:32.

11.13 Tracking Events in the Imaging and Content Server Log Files

When investigating events in Imaging, start with the Imaging log files. In cases where the event occurs in Content Server, reviewing the Content Server log files may provide additional information. Both Imaging and Content Server logs can be viewed in Oracle Enterprise Manager. The Content Server logs can also be viewed from the Content Server administrative links.

Tracing sections can be enabled in Content Server for more or less detail in the logging information. The IpmRepository component installed into Content Server does not generate its own logging, but includes entries into the standard Content Server logs. Turn on tracing for the section named ipmrepos in Content Server for detailed logging information of the IpmRepository component. For more information about Content Server logging, see Oracle WebCenter Content System Administrator's Guide for Content Server "Finding Error and Status Information."

11.14 Using Oracle Dynamic Monitoring System with Imaging

Oracle Dynamic Monitoring Service (DMS) can display statistics of your system using the Oracle DMS Spy application to aid in troubleshooting and diagnostics. The Oracle DMS Spy application is launched by entering http://machine_name:port/dms/ into your browser URL address field. The following metric tables are available:

Metric Table
Description

IPM_API
Records timing statistics on imaging API operations. Statistics are recorded on a per service operation basis.

IPM_Activity
Records general system activity. Counts of system activity occurrences are recorded including:

API Operations

Documents Created

Documents Retrieved

Input Agent Documents

Input Agent Errors

Input Files Processed

Login

Logout

Render Annotation Cache Retrieval

Render Transformed Document Cache Retrieval

Render Transformed Document Generation

Search Executions

Workflow Instances

IPM_BPEL_Agent
Records workflow process instance injection statistics on a per imaging application basis.

IPM_Input_Agent
Records input process instance statistics on a per imaging input basis

IPM_Rendering
Records detailed metrics on the rendering subsystem including details on:

IPM_Repository
Records detailed metrics on repository calls.

IPM_Search
Records Imaging search execution timings. Statistics are recorded on a per search definition basis.

IPM_UCMRequest
Records detailed metrics on requests to Universal Content Server.

AXF_API
Records timing for AXF (Oracle Application Adapters for ECM) operations in the system infrastructure, commands, and user interface.

AXF_BPEL_API
Records timing for AXF (Oracle Application Adapters for ECM) operations which communicate to the workflow server.

11.15 Reviewing Audit History of Deleted Documents

If documents are deleted from Imaging, administrators can view the entry for the delete action in the Content Server DocumentHistory table. This is the only place for administrators to view audit entries for deleted documents.

11.16 Deciphering Nested Stack Errors

A nested stack error, also called a nested exception, is basically an error that has been wrapped by another error, which is standard with Java and other languages to help provide more context to the issue. You can usually find the nested exception by locating the caused by string in the stack trace as shown in bold in the following example. If there is not enough information provided by the Imaging error, look deeper into the error message to see if other components are involved. Imaging uses nested stack errors to display repository related problems, workflow issues, or problems caused by other components. After you locate the possible initial error, check the diagnostic logs for more troubleshooting information.

In the following example, the TCM-00787 error is occurring because the default provider within the Content Server repository was corrupted and reset (see boldface text).

[2009-06-11T09:56:21.720-07:00] [ipm_server1] [ERROR] []
[oracle.imaging.ui.backing.application.LifecycleState] [tid:
[ACTIVE].ExecuteThread: '4' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: weblogic] [ecid:
0000I7GFuQ9F8DT6uBj8EH1AC2Ut0000WK,0] [APP: imaging#11.1.1.1.0] IPM UI Exception[[
oracle.imaging.ImagingException: TCM-00787: A repository error has occurred. Contact your system administrator for assistance.
        stackTraceId: 9-1244739381674
        faultType: SYSTEM
        faultDetails:
          ErrorCode = oracle.stellent.ridc.protocol.ServiceException,
ErrorMessage = File
'/app/stellent/content/10gR3/proxy1/data/providers/defaultfilestore/provider.hda'
does not exist.
        at
oracle.imaging.repository.ucm.UcmErrors.convertRepositoryError(UcmErrors.java:108)
        at
oracle.imaging.repository.ucm.UcmLifecycleOperationImpl.getStorageRules(UcmLifecycleOperationImpl.java:58)
...
<...snip...>
        at
weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1428)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)  at
weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Caused by: oracle.stellent.ridc.protocol.ServiceException: File
'/app/stellent/content/10gR3/proxy1/data/providers/defaultfilestore/provider.hda'does not exist.
       at
oracle.stellent.ridc.protocol.ServiceResponse.getResponseAsBinder(ServiceResponse.java:116)
at
oracle.stellent.ridc.protocol.ServiceResponse.getResponseAsBinder(ServiceResponse.java:92)
at
oracle.imaging.repository.ucm.UcmResponse.<init>(UcmResponse.java:61)
at
oracle.imaging.repository.ucm.UcmRequest.makeOneServiceCall(UcmRequest.java:310)
at
oracle.imaging.repository.ucm.UcmRequest.makeServiceCallWithRetries(UcmRequest.java:228)
at
oracle.imaging.repository.ucm.UcmRequest.makeServiceCall(UcmRequest.java:210)
at
oracle.imaging.repository.ucm.UcmLifecycleOperationImpl.getStorageRules(UcmLifecycleOperationImpl.java:53)
... 234 more

11.17 Imaging Session Time Out When Using OSSO Requires Browser Refresh

When using Oracle Single Sign On, POST requests to WebLogic Server will return an internal server error when the Imaging session has expired. Refreshing the page returns to the Imaging log in page for reauthentication to start a new session.

11.18 Content Server 10g Provides Incorrect Dates for Workflow

When using Content Server 10g, the BPEL payload is populated with the incorrect date when the date is less than 1969 or greater than 2068. As a workaround, it is recommended that if you are using dates that fall outside the range of 1969-2068, use four digit years for the date. You can set this using the Content Server System Properties utility.

11.19 Doc URL Returned With Invalid IP Address

Users that are getting a host name or IP address that they don't expect for the document URL probably need to configure the Listener Address in their WLS server. This can be done either by setting listen-address in config.xml for the WLS server, or by using the WLS console. To use the console, expand Environment and click Servers in the Domain Structure window. In the Servers Configuration tab, click on the desired server name. Set Listen Address on this page. Restart WLS. For more information about WLS configuration, see Oracle Fusion Middleware Administrator's Guide.

11.20 Required Fields Added to Content Server Must Have Default Value Specified

Adding a metadata field to an Content Server instance using Configuration Manager can cause problems if the field is set as required but no default value is specified. Any metadata fields set as required in Content Server that do not have default values specified in Content Server prevents Imaging from creating documents on the Content Server instance. Administrators can prevent issues within Imaging by either setting a default value for the metadata field or by using Content Server profiles to address the field.

11.21 Imaging Viewer Fails On UNIX, AIX, and Solaris SPARC

To view documents on a UNIX operating system, you must ensure that library path and display environment variables are properly set. For more information, see the section on setting a library path in an environment variable on a UNIX platform in the Oracle WebCenter Content Installation Guide.

11.22 Viewer Displays Blank Page Instead of Document

In some situations Content Server may return a document in a search result that the user does not have View rights to in the application. If the user tries to view the document in the Viewer, a blank page is presented instead. This occurs when a user is mapped to the admin group in Oracle Internet Directory, which is then mapped to the admin role in Content Server. Users having the admin role in Content Server have rights to all security groups in Content Server. When a user having the admin role in Content Server uses an Imaging search, all documents matching the search criteria are returned in the search result, even if the user does not have View rights to the documents. Attempting to view a document to which the user does not have the Imaging View right defined in the associated Imaging application presents a blank page.

11.23 HTML Login Form Displayed Instead of Document in Advanced Viewer Mode

The Imaging advanced viewer is a Java applet that needs to submit cookies in its requests to authenticate a session and properly display documents. If a system is configured to limit cookies to HTTP only requests, the Viewer cannot authenticate and so the HTML login form is displayed instead of the requested document. To allow the advanced viewer applet to authenticate properly, cookies cannot be limited to HTTP only requests.

11.24 Viewer Reports Magic Number Error

If Imaging is integrated with Oracle Access Manager and the /imaging directory is incorrectly configured as protected, a magic number error is reported by the Viewer in advanced mode. To correct this, ensure that Oracle Access Manager is properly configured to protect the /imaging/faces directory. For more information, see Section 2.3.5, "Integrating Imaging With Oracle Access Manager 11g" and Section 2.3.6, "Integrating Imaging With Oracle Access Manager 10g".

11.25 Invalid Skin Preference Displays Generic User Interface

If an invalid value is set in the DefaultColorSet MBean, or if a user has specified a UI skin in their preferences that has been deprecated when Imaging is upgraded, then a generic user interface is displayed when the user logs in. The generic interface has a larger font and does not display a logo. Correcting the invalid value of the DefaultColorSet MBean or applying a current skin from the User Preference page corrects the problem.

11.26 Problem Displaying Second Page of Microsoft PowerPoint 2007 Document

There is a know issue with the Oracle Outside In Technology libraries that causes a memory error when attempting to display the second page of a Microsoft PowerPoint 2007 .pptx file. To avoid this, save the original PowerPoint 2007 file to an older PowerPoint version.

11.27 Configuring Viewer for Use in UNIX Exalogic Environment with Solaris 11g

When running Imaging in an Exalogic environment with Solaris 11g, you must set the display environment variable in order for the Imaging Viewer to work properly in basic mode. To set the display variable, do the following:

Open a new terminal and run the command xhost +.

In the IPM_server terminal, set the DISPLAY environment variable.

Restart the Imaging server.

A User Interface

This section contains information about the interface used with Oracle WebCenter Content: Imaging. It details the user interface specific to administrative tasks. For information on pages used by a typical business user, such as when searching for or viewing documents, refer to the Oracle WebCenter Content User's Guide for Imaging.

The following pages are shown in this section:

Section A.1, "Icons"

Section A.2, "Navigator Pane"

Section A.3, "Navigation Train"

Section A.4, "Upload Document Page"

Section A.5, "Update Document Page"

Section A.6, "Export Definitions: Export Comments Page"

Section A.7, "Export Definitions: Applications Page"

Section A.8, "Export Definitions: Searches Page"

Section A.9, "Export Definitions: Inputs Page"

Section A.10, "Export Definitions: Summary Page"

Section A.11, "Import Definitions: File Location Page"

Section A.12, "Import Definitions: Select Imports Page"

Section A.13, "Import Definitions: Validate Imports Page"

Section A.14, "Import Definitions: Summary Page"

Section A.15, "Solution Editor Page"

Section A.16, "Search Properties Page"

Section A.17, "Search Results Formatting Page"

Section A.18, "Search Conditions Page"

Section A.19, "Search Parameters Page"

Section A.20, "Search Security Page"

Section A.21, "Add Security Member Page"

Section A.22, "Search Preview and Test Page"

Section A.23, "Search Review Settings Page"

Section A.24, "Search Summary Page"

Section A.25, "Application General Properties Page"

Section A.26, "Application Field Definitions Page"

Section A.27, "Application Security Page"

Section A.28, "Application Document Security Page"

Section A.29, "Application Storage Policy Page"

Section A.30, "Application Workflow Configuration Page"

Section A.31, "Workflow Server Properties Page"

Section A.32, "Workflow Component Properties Page"

Section A.33, "Workflow Payload Properties Page"

Section A.33.1, "Edit Format Value Page"

Section A.33.2, "Edit Supporting Content Value Page"

Section A.34, "Application Review Settings Page"

Section A.35, "Application Summary Page"

Section A.36, "Input Basic Information Page"

Section A.37, "Input Identify and Parse File Parameters Page"

Section A.38, "Input Field Mapping Page"

Section A.38.1, "Define Date Format Page"

Section A.39, "Input Security Page"

Section A.40, "Input Review Settings Page"

Section A.41, "Input Summary Page"

Section A.42, "Content Server Connection Basic Information Page"

Section A.43, "Content Server Connection Content Server Settings Page"

Section A.44, "Content Server Connection Security Page"

Section A.45, "Content Server Connection Review Settings Page"

Section A.46, "Content Server Connection Summary Page"

Section A.47, "Workflow Connection Basic Information Page"

Section A.48, "Workflow Connection Settings Page"

Section A.49, "Workflow Connection Security Page"

Section A.50, "Workflow Connection Review Settings Page"

Section A.51, "Workflow Connection Summary Page"

Section A.52, "Definition Management Security"

A.1 Icons

The following icons are used throughout the Imaging interface without explicit identification. In some cases, as in the pencil icon, the exact use is determined by the context it is in. You can place your cursor over an icon to view identifying text about it.

Name
Icon
Description

Collapse or Restore Pane
Collapse and Restore Pane icon

Click to expose or hide a pane.

Show or Hide this Panel
Show/Hide This panel icon

Click to expose or hide a panel.

Create
Create icon

Click to create a new item. Items may be searches, application, or other.

Close Current
Close Current icon

Click to close a current tab or window.

More Options
More Options icon

Click to expand a hidden menu.

Expand Horizontally
Expand Horizontally icon

Click to expand an item horizontally.

Edit, Modify, or Update
Edit, Modify, or Update icon

Click to edit, update, or modify a value or document.

A.2 Navigator Pane

The navigator pane displays the top-level navigation panels used to access the main features of Imaging.

The following table describes the options available on the page.

Panel
Description

Searches
Lists all searches to which you have rights. Clicking on a search name displays the search form in the content region. The search form is used to enter criteria to find documents in Imaging.

Tools
Contains the following options:

Upload Documents: Displays the Upload Document Page used to add documents to the repository.

Export Definitions: Displays the Export Definitions: Export Comments Page used to export application, input and search definitions.

Import Definitions: Displays the Import Definitions: File Location Page used to import application, input and search definitions.

Solution Editor: Displays the Solution Editor Page used to modify the Application Extension Framework (AXF) configuration. This tool displays to users given administrator access to solutions in Manage Security options.

Manage Searches
Lists all searches to which you have at least Modify or Grant Access rights. Click the expand icon to view the Create New Search icon. Click this icon to open the Search Properties Page to create a new search.

Manage Applications
Lists all created applications to which you have at least Modify or Grant Access rights. Click the expand icon to view the Create Application icon. Click this icon to open the Application General Properties Page to create a new application.

Manage Inputs
Lists all created inputs to which you have at least Modify or Grant Access rights. Click the expand icon to view the Create Input icon. Click this icon to open the Input Basic Information Page to create a new input.

Manage Connections
Lists all created connection to which you have at least Modify or Grant Access rights. Click the expand icon to view the Create New Connection menu icon. Click this icon to open a menu and select Create Content Server Connection to display the Content Server Connection Basic Information Page or select Create Workflow Connection to display the Workflow Connection Basic Information Page.

Manage Security
Used to grant security rights to applications, inputs, searches, connections, and solutions.

A.3 Navigation Train

The Navigation Train is displayed on all pages in Imaging that are used within a procedure such as creating searches, applications, inputs, and connections. The current step of the procedure is in Bold and has a double box icon above the step name. Click Next when the required information has been entered to proceed to the next page. Click Back to visit a previous page or access steps directly by clicking the step name or icon in the navigation train. Steps displayed in gray have not yet been completed in a sequential process, such as creating an application, and cannot be navigated to until each preceding step is completed. Once all steps have been completed, all steps in the navigation train are enabled and can be used to jump from one step to another non-sequentially.

A.4 Upload Document Page

Access the Upload Document page by clicking Upload Document in the Tools panel in the Navigator Pane.

Note:

When uploading a document, be aware of the file size. File size limitations are primarily a factor when retrieving a document for viewing. System architecture, hardware limitations, network load and other factors can influence document retrieval times and cause the viewer to time out. Imaging has been optimized to store tiff image files of sizes to 200KB. If the documents you need to upload and view are larger than to 200KB, test the performance of those files in the specific network architecture you are planning to use while simulating peak network load.

The following table describes the elements available on the page.

Element
Description

Open Viewer
Displays the Viewer in the Advanced mode next to the Upload Document page, replacing the Document Image field and Browse button. Use the Viewer to navigate to a document and to review and annotate a document before uploading. This is useful when you need to view the document to see the associated metadata to be entered, such as an invoice number or title, if you need to see the document to determine what application should be used, or if you want to annotate a document when uploading. Note that you must select an application and enter the associated metadata values before completing the upload.

Upload
Submits the document and metadata to Imaging based on the selected application. When the document has been successfully uploaded, you will see a confirmation message. Clicking the confirmation message opens the uploaded document in the viewer.

Reset
Resets the page and allows for another document to be uploaded. Click this to clear inaccurate information before submitting the document or to clear the information and confirmation of a successfully submitted document so you can upload another one.

Close
Closes the Upload Document page and returns to the Welcome page or an open search tab if one or more searches have been run.

Select An Application
Select an application in which to upload the document. This is a required field. Once an application is selected, metadata fields specific to the application are displayed. Application-specific metadata fields are determined when the application is defined and will likely be different for each application.

Document Image field and Browse button
Enter the path to the image being uploaded, or click Browse to select the file. This is a required field. This field is replaced with the Viewer if Open Viewer is clicked, and the viewer is used to navigate and select the file to upload.

Note that if using your keyboard rather than your mouse to select the Browse button, use the Space bar to execute the Browse button function and open the dialog box. The Enter key does not execute the Browse button function.

A.5 Update Document Page

Use the Update Document function to update or add a new version of an existing document. You can create a new version of the document or update one or more application fields of the existing document.

From within a search results list, select a document and click Update in the Search Results toolbar. The Update Document window opens and displays the Original File Name, Document ID, and its application. To add a new version of the existing document, enter the path and name of the file, or click Browse to select it, and click Update. To update specific fields in the existing document, make your changes to the fields displayed and click Update. Upon successful update, you will see a confirmation message.

It is recommended that you lock a document prior to updating it in order to prevent others from updating the document at the same time. You can easily lock a document from a search results listing using the contextual menu or search results toolbar. If a document is locked before being updated, the Keep Lock check box is displayed at the bottom of the Update document page. Select to keep the document locked after it is updated. If you did not have it locked before clicking Update, the Lock Document check box will appear. Select to lock the document after it is updated.

The following table describes the elements available on the page.

Element
Description

Update
Submits the document and metadata to Imaging based on the selected application. When the document has been successfully updated, you will see a confirmation message. If you receive a system error message, review the log files to determine its cause.

File name field and Browse button
Type the name of the new file or click Browse to select it.

Note that if using your keyboard rather than your mouse to select the Browse button, use the Space bar to execute the Browse button function and open the dialog box. The Enter key does not execute the Browse button function.

Application fields
Information fields vary by application. Change the information in an existing document by updating one or more of the application fields.

Keep Lock or Lock Document
If document is locked, select Keep Lock to remain locked after being updated. If document is not locked, select Lock Document to lock document after being updated.

A.6 Export Definitions: Export Comments Page

Application, input, and search definitions can be exported to a transportable file format (XML) for import and use in other systems. Enter a short description and other pertinent information in the Export Comments field about the export file.

Access the Export Definitions Comments page by clicking Export Definitions in the Tools panel in the navigator pane.

The following table describes the elements available on the page.

Element | Description
Cancel | Cancels the export procedure and returns to Imaging welcome page.
Next | Continues to next step.
Export Comments field | Type the description or other pertinent information for the definitions file being created.

A.7 Export Definitions: Applications Page

Select the applications to be included in the export definitions file by enabling the check box in the Export column next to the application name.

Access the Export Applications page by clicking Next on the Export Comments page.

The following table describes the elements available on the page.

Element | Description
Export | Select to export the application on that line.
Application | Name of the application to include in the Export Definitions file.

A.8 Export Definitions: Searches Page

Select the searches you want to export by selecting the field in the Export column next to the search name.

Access the Export Definitions Searches page by clicking Next on the Export Definitions Applications page or by clicking searches in the Navigation Train.

The following table describes the elements available on the page.

Element | Description
Export | Select to export the search on that line.
Search | Name of the search to include in the Export Definitions file.

A.9 Export Definitions: Inputs Page

Choose the input definitions to export by selecting the field in the Export column next to the input name.

Access the Export Definitions Inputs Page by clicking Next on the Export Definitions Searches page or by clicking on Inputs in the Navigation Train.

The following table describes the elements available on the page.

Element | Description
Export | Select to export the input on that line.
Input | Name of the input to include in the Export Definitions file.

A.10 Export Definitions: Summary Page

Review your selected definitions and make any necessary changes. Then click Create Export File. A File Download window displays where you indicate whether you want to open, save or cancel the new Export Definitions File.

Access the Export Definitions Summary Page by clicking Next on the Export Definitions Inputs page or by clicking Summary in the Navigation Train.

The following table describes the elements available on the page.

Element | Description
Summary sections | Displays a summary of the selections made in each of the Export Definitions pages.

A.11 Import Definitions: File Location Page

Access the Import Definitions Select File page by clicking Import Definitions on the Tools panel in the Navigator Pane.

The following table describes the elements available on the page.

Element
Description

Select File field
Click Browse to locate and select the file that contains the definitions to import or type the file name in the field.

Note that if using your keyboard rather than your mouse to select the Browse button, use the Space bar to execute the Browse button function and open the dialog box. The Enter key does not execute the Browse button function.

File Properties section
After a file is selected, displays the date of file creation and associated comments.

A.12 Import Definitions: Select Imports Page

Choose the applications, inputs, and searches to be imported by selecting the field in the Import column next to the application, input or search name.

Access the Import Definitions Select Definitions page by clicking Next on the Import Definitions: File Location Page.

The following table describes the elements available on the page.

Element
Description

Action
Select the specific definitions to import for applications, inputs, and searches by selecting the field under the Action heading. Options are:

Add: If the object you are importing the definition of does not exist on the system you are importing to, then the action taken is to add the imported definition file and create the object.

Overwrite: If the object you are importing the definition of exists on the system you are importing to, then the action taken is to overwrite the existing definition file with the imported definition file.

It is recommended that you take existing input definitions offline before you can import a definition to overwrite the existing input. You take an input definition offline and online by clicking Toggle Online on the Input Summary page, accessed by clicking the input name in the Manage Inputs panel.

Applications, Inputs, Searches Sections
Each application, input, or search is listed under the appropriate heading.

Repository
When importing an application definition into a system where the application is not currently defined, for example from a test environment to a production environment, use the Repository picklist to select the repository to be used by the application.

A.13 Import Definitions: Validate Imports Page

After all selections are made on this page, click Submit. The definitions being imported reference multiple system-specific items, such as security groups, storage devices, and repository connections. All of these items are referenced by name. As long as items are named correctly between the two systems, importing definitions will be successful with no additional adjustment. By the time the Validate Imports page is displayed, Imaging has validated each of these system-specific items to determine if the definitions can be imported as provided. If the definitions are valid, the Successful Validation icon (a check mark) will display in the Status column. If not valid, the Validation Failed icon will display. If a failure occurs, click the expand button to see details. Change options or verify that users and groups exist on the target system and click Submit again. If you receive a system error message, review log files to determine the problem.

Access the Import Definitions Select File page by clicking Next on the Import Definitions: Select Imports Page.

The following table describes the elements available on the page.

Element
Description

Submit
Click Submit to import the selected application, input, and search definitions.

Status
A Successful Validation icon or Failed Validation icon is displayed indicating whether or not to proceed with importing the definition or definitions.

Action
Specifies the action being taken with the import. Options are:

Add: If the object you are importing the definition of does not exist on the system you are importing to, then the action taken is to add the imported definition file and create the object.

Overwrite: If the object you are importing the definition of exists on the system you are importing to, then the action taken is to overwrite the existing definition file with the imported definition file.

Application
Name of application from which definitions are being imported.

Security
Select from the following security options:

Use Imported: Select this option to use the security information defined in the export file.

Current User: Select this option to allow only the current user permission to modify which groups and users will be granted permission to the definition. This will allow the definition to be imported and this user will then be able to modify later which groups and users will be granted permissions to the definition.

Valid Entries Only: Select this option for Imaging to check the security information in the export file and only pass entries that are valid for the target system. For example, if the file specifies user UserX but the target system does not recognize that user name, then UserX will not be configured in the target system.

Choose New: Select this option to allow the user to select a user or group to be the only one with security to the definition. Similar to the Current User option, this selected user or group will be able to later modify which groups and users will be granted permissions to the definition. The user or group is selected by choosing the name from the popup dialog window that is launched when you click the Edit icon next to the Choose New picklist. When a user or group is selected, the Security and Document Security picklist is populated with the new user or group name.

Use Existing: Select this option to use the existing definition security, ignoring the configuration in the imported definition. This option is available only for definitions that already exist on the system.

Document Security
Select from the following options:

Use Imported: Select this option to use the security information defined in the export file.

Valid Entries Only: Imaging checks the security information in the export file and only passes entries that are valid for the target system. For example, if the file specifies group GroupY but the target system does not recognize that group name, then GroupY will not be configured in the target system.

Choose New: Select this option to allow the user to select a group to be the only group with security to the definition. The selected group will be able to later modify which groups will be granted permissions to the definition. The group is selected by choosing the name from the popup dialog window that is launched when you click the Edit icon next to the Choose New picklist. When a group is selected, the Security and Document Security picklist is populated with the new group name.

Use Existing: Select this option to use the existing definition security, ignoring the configuration in the imported definition. This option is available only for definitions that already exist on the system.

Storage Policy
Select from the following options:

Use Imported: Select this option to use the Storage Policy options defined in the export file.

Use Existing: Select this option to use the existing Storage Policy settings, ignoring the configuration in the imported definition. This option is available only for applications that already exist on the system.

Use Default: Select this option to clear out the Storage Policy options and use the system default.

Additional Choices: If there are specific storage options defined in your system, such as Network Attached Storage, they are appended to the list in the Storage Policy field.

Workflow
Select from one of the following options:

Use Existing: Select this option to use the existing workflow settings, ignoring the configuration in the imported definition. This option is available only for applications that already exist on the system.

Use Imported: Select this option to use the workflow configurations defined in the export file.

Clear: Select this option to remove all workflow configurations for the application.

Additional Choices: workflow connections defined for the target system are listed here. Different systems may connect to the same workflow server but have different names for the connection. Because the input file being imported specifies the workflow connection name of the original system, selecting the name of the target system workflow connection ensures proper field mapping between the two.

Full-Text Option
Use Existing: Select this option to use the existing Full-Text configuration, ignoring the configuration in the imported definition. This option is available only for definitions that already exist on the system.

Use Imported: Select this option to use the Full-Text options defined in the export file.

None: Select if full-text is not configured.

A.14 Import Definitions: Summary Page

Review your selected definitions and make any necessary changes. Then click Submit. Access the Import Definitions Summary Page by clicking Next on the Import Definitions: Validate Imports Page page or by clicking Summary in the Navigation Train.

The following table describes the elements available on the page.

Element | Description
Summary sections | Displays a summary of the selections made in each of the Import Definitions pages.

A.15 Solution Editor Page

The Solution Editor is available in the Tools menu of the Navigator Pane provided that Imaging is using an Oracle database. If Imaging is integrated with a business application such as Oracle Peoplesoft or Oracle E-Business Suite and a solution has been implemented using Oracle Application Extension Framework (AXF), then the Solution Editor provides an easy user interface to modify certain aspects of the solution presentation. For example, you can hide, display, and reorder the profiles displayed to users in the Task List, and specify which actions and metadata fields are displayed in the Task Viewer. If given access to the Solution Editor, you can access all implemented solutions.

Not all aspects of a solution presentation can be edited using the Solution Editor. If you need to modify a solution presentation beyond the capabilities of the Solution Editor, see the Oracle WebCenter Administrator's Guide for Application Adapters.

You access the Solution Editor page for all solutions by clicking Solution Editor in the Tools menu of the Navigator Pane.

The following tabs are available on the Solution Editor page:

Solution Editor Page: General Tab

Solution Editor Page: Actions Tab

Solution Editor Page: Task Viewer Tab

Solution Editor Page: Enumerations Tab

A.15.1 Solution Editor Page: General Tab

The General tab on the Solution Editor page allows you to display or hide profiles (BPEL views) to restrict the task list view. You can also use the General tab to reorder the profile list, set a default profile, and to hide or display the Comments field on specified web tools (task flows). Click General on the Solution Editor Page to display the General tab options.

The following table lists and describes the elements on the Solution Editor Page General tab.

Element
Description

Solution Namespace
Use the Solution Namespace menu to select the solution to edit. Only solutions to which you have access are displayed.

List of Profiles
Displays a list of profiles available in the specified solution namespace. Click a profile in the list to do the available actions. Available actions are:

Move Up: Click to move the selected profile higher in the list.

Move Down: Click to move the selected profile lower in the list.

Add: Click to add a profile to the list of available profiles.

Remove: Click to remove a selected profile from the list of available profiles.

Default: Click to set the selected profile as the default profile displayed when the page is first accessed.

Comments
The Comments section allows you to display or hide the Comments field from specified web tools and to change the field label. Select a comment field to do the available actions. Available actions are:

Edit Display Label: Allows you to change the name of the field as it is displayed on the page.

Enable Comments Field: Click to have the field displayed on the page.

Disable Comments Field: Click to remove the Comments field from view on the page.

A.15.2 Solution Editor Page: Actions Tab

The Actions tab on the Solution Editor page allows you enable and disable what actions are available in a solution. You can also use the Actions tab to order the list of actions or edit the display name of the action. Click Actions on the Solution Editor Page to display the Actions tab options.

The following table lists and describes the elements on the Solution Editor Page Actions tab.

Element
Description

Solution Namespace
Use the Solution Namespace menu to select the solution to edit. Only solutions to which you have access are displayed.

Menu Label
Displays the name of the action menu on the page. You can edit the Menu Label field directly to change the menu display name.

Menu Actions
Displays a list of actions available in the action menu. Click a menu action to change the display. Available changes are:

Move Up: Click to move the selected action higher in the menu.

Move Down: Click to move the selected action lower in the menu.

Edit: Click to edit the display name of the action in the menu.

Enable: Click to display the action in the menu.

Remove: Click to remove the action from the menu.

A.15.3 Solution Editor Page: Task Viewer Tab

The Task Viewer tab on the Solution Editor page allows you to specify which metadata fields to display or hide in the Task Viewer and what panel tabs are displayed on the bottom of the page. You can also use the Task Viewer tab to order the fields on the page or edit the display name of the field. Click Task Viewer on the Solution Editor Page to display the Task Viewer tab options.

The following table lists and describes the elements on the Solution Editor Page Task Viewer tab.

Element
Description

Solution Namespace
Use the Solution Namespace menu to select the solution to edit. Only solutions to which you have access are displayed.

Display Label
Displays the name of the Task Viewer page. You can edit the Display Label field directly to change the Task Viewer display name.

Metadata Items
Displays a list of metadata fields available on the Task Viewer page. Click a metadata item to do the available actions. Available actions are:

Move Up: Click to move the selected item higher in the page order.

Move Down: Click to move the selected item lower in the page order.

Edit: Click to edit the display name of the metadata field on the page.

Enable: Click to display the metadata field on the page.

Remove: Click to remove the metadata field from the page.

Bottom Panel Tabs
Displays a list of bottom panels available on the Task Viewer page. Click a panel to do the available actions. Available actions are:

Move Up: Click to move the selected panel higher in the panel order.

Move Down: Click to move the selected panel lower in the panel order.

Edit: Click to edit the display name of the panel on the page.

Enable: Click to display the panel on the page.

Remove: Click to remove the panel from the page.

A.15.4 Solution Editor Page: Enumerations Tab

The Enumerations tab on the Solution Editor page allows you to specify the enumeration values available for specified enumerations on the Enumeration Picker page. You can also use the Enumerations tab to order the enumerations or edit the display name. Click Enumerations on the Solution Editor Page to display the Enumerations tab options.

The following table lists and describes the elements on the Solution Editor Page Enumerations tab.

Element
Description

Solution Namespace
The Solution Namespace menu is disabled on the Enumerations tab because changes to an enumeration may affect more than one solution.

Enumeration Name
Use the Enumeration Name menu to select the enumeration to edit.

Enumerations
Displays a list of enumeration items for the selected enumeration. Click an item in the list to do the available actions. Available actions are:

Move Up: Click to move the selected item higher in the list.

Move Down: Click to move the selected item lower in the list.

Add: Click to add an item to the list of available items.

Edit: Click to edit the display label of the item on the Enumeration Picker page.

Remove: Click to remove a selected item from the list of available items.

A.16 Search Properties Page

Use the Create Search Properties page to start creating a search that will be used more than once. If the Accounting department often searches for all Invoices during a specific year, create a search that specifies Invoices between the desired dates, such as January 1, 2008 and December 31, 2008.

Access this page by clicking the Create New Search icon on the Manage Searches panel in the Navigator Pane. Expand the Manage Searches panel to view the Create New Search icon.

The following table describes the elements available on the page.

Element
Description

Search Name
Enter a descriptive name for the search. This search name will be displayed to users under the searches panel of the navigator pane and must be unique to Imaging.

Description
Enter a description of the new search. The description is displayed when the cursor hovers over the search name in the navigator pane. The field contains a maximum of 1000 characters.

Instructions
Enter helpful information about what criteria is being searched for and how a user should use the search. These instructions are available on the search form and also appear on the Search Tab display. If no instructions are defined, the Instructions section is not displayed on the search form. The field contains a maximum of 1000 characters.

Maximum Search Results
Select the maximum number of rows per application a search will return before stopping. The search can span multiple applications, which are selected on the Search Results Formatting Page. The default is zero which means that the search will use the maximum results value set on the server.

A.17 Search Results Formatting Page

The Create Search Results Formatting page is used to format how search results are displayed. Searches can be limited to one application or span multiple applications. For example, you can create a single search that returns purchase orders from a Purchase Order application and invoices from an Invoice application.

Access the Create Search Results Formatting page by clicking Next on the Create Search Properties page or by clicking Results Formatting on the Navigation Train.

The following table describes the elements available on the page.

Element
Description

Source Application
Specifies the application to be searched. The application selected determines the criteria fields available. Only applications to which you have View security rights are listed.

Field Columns
The second and subsequent columns represent the columns of metadata and system fields from the searched applications that appear in the search results. Metadata fields are created in the application when the application is created or modified. System fields are created by the system, including Document Id, Document Creation Date, Document Created By, and Document Batch Id.

Selecting a search field populates the column header with the name and enables the next column. Clicking the pencil icon allows you to modify the column name to something more descriptive. For example, if fields with different names from multiple applications are aligned in the same column, such as Vendor Name and Company Name, you can change the column title to account for both.

If searching multiple applications, aligning like field types in one column can facilitate sorting search results. For example, a purchase order application may have a field named Account Number that corresponds with a field in an invoicing application called VendorID. Aligning the fields in the results allows you to click on the header to sort the results so that invoices and purchase orders from the same company are grouped.

Note that when aligning fields from multiple applications, be careful to align only fields of the same field type, for example, date fields with date fields and text fields with text fields. Failing to align fields of like types can cause errors when sorting search results.

Column Options Icon
Clicking the Column Options icon in the column header displays the following options:

Modify Column Name: Allows you to rename the column header.

Move Column Left: Moves the column one space to the left.

Move Column Right: Moves the column one space to the right.

Delete Column: Displays a dialog window asking you to confirm deleting the column.

Remove Application Icon
Clicking the Remove Application Icon next to the Source Application displays a dialog window asking for confirmation to remove the application from the search.

A.18 Search Conditions Page

Specify the conditions to be applied to each document in the searched applications to determine if they should be shown in the search results. Each condition contains three parts: the application's metadata field, the operator used for the comparison and the data value to be used. These conditions for each application can be grouped using parentheses and combined using the conjunction operators (and/or) to form complex conditions.

Access the Create Search Conditions page by clicking Next on the Create Search Results Formatting page or by clicking Conditions in the Navigation Train.

The following table describes the elements available on the page.

Element
Description

Application Selection
Select the application to add or modify search conditions for that application.

Move Up Arrow

Moves the selected condition up one row.

Move Down Arrow

Moves the selected condition down one row.

Delete Condition Icon

Displays a dialog window requesting confirmation to remove the selected condition.

(
Opening parenthesis for beginning conditional grouping.

Field
Selects the application field to be used in the condition.

Operator
Selects the operator used for the search. Available operators depend on the data type of the application selected.

Value
A search condition value is the value that the selected Field is being compared to. This value can be one of the following:

Static Value: This is a value that does not change. The selected field is compared directly to this value. For example, Text_Field1 equals "Hello". Note that leaving a blank value for a static value deletes the condition. Search execution always drops conditions that have no value.

Relative Date: This value represents a number of days from the current day. The value can be positive or negative. When the search is executed, the value is calculated from the current day. For example, Relative Date +7 is one week from today.

Logged in UserID: This value represents the userid of the user executing the search. The user's textual userid is used when the search is executed.

Parameter Value <name>: This value represents a value that is to be provided by the user when they execute the search.

Create New Parameter: This creates a new prompt for information that maps to one or more conditions. It also allows you to create a new parameter, which is useful if you map a condition field to an existing parameter and then the business need changes. For example, if you have driver and co-driver fields mapped to one parameter named Driver, and now need them split, you could remap the co-driver field to a new parameter named Co-driver.

Modify Value Icon
Displays a dialog window with options for modifying value types.

)
Closing parenthesis for ending conditional grouping.

Conjunction
Logical operator for grouping together the smaller condition elements.

And: Both search conditions must be met for the document to be returned.

Or: Either condition must be met for the document to be returned.

A.19 Search Parameters Page

Specify the parameters for conditions used in a search. Values can be set as default or to read only, and picklists can be used to define parameter choices. The Create Search Parameters page is accessed by clicking Next on the Search Conditions Page or by clicking Parameters on the Navigation Train.

The following table describes the elements available on the page.

Element
Description

Move Up Arrow

Move the parameter up in the list. The ordering in this list corresponds to the presentation the user will see on the Search Form page.

Move Down Arrow

Move the parameter down in the list. The ordering in this list corresponds to the presentation the user will see on the Search Form page.

Parameter Name
Specifies the parameter name.

Prompt Text
Specifies what is listed on the Search Form page to prompt the user. This information can be edited to provide more descriptive text to the user.

Modify Operator Properties Icon
Clicking displays the Operator Properties Dialog Box for making additional operator options available to a user when searching.

Modify Default Value Icon
Displays a dialog window for specifying a default value for the parameter. The value you enter is of the same data type as the parameter. Defaults for date data type will have two choices: Static Value and Relative Date. Defaults for text data type will have two choices: Static Value and Logged in UserID. Picklists can also be used to choose a default value if a picklist was defined for the application and the picklist is enabled in the Picklist column.

Text Value: Value will validate using textual rules.

Date Value: Value will be validated using regional date settings.

Number Value: Value will be validated as a whole number.

Decimal Value: Value will be validated as a number.

Relative Date: Value will be calculated as the number of days from today and the date value from that day displayed. The value will then be validated as a date.

Logged in UserID: The current user's userid will be placed into the value and validated as text.

Picklist
Enable to allow users to choose from defined parameter values or to use the picklist to define a default value. Defined values for a picklist are created when the application is created.

Required
Enable to require users to enter a parameter when using this search.

Read Only
Enable to prevent a user from modifying a parameter. This is similar to the static value on the Search Conditions Page but allows the user to see the value being used. If the parameter is set to Read Only, but has no default value specified, the condition is effectively deleted from the search because the user has no way to specify a value.

A.19.1 Operator Properties Dialog Box

The Operator Properties dialog box allows two things:

If Allow user to choose operator is disabled, you can change the displayed text for the operator prompt. For example, you can change the text Less Than to the < symbol. Changing the prompt text does not change the behavior of the operator. For example, changing the text Not Equal to the = sign still returns results not equal to the specified value.

If Allow user to choose operator is enabled, you can allow users to select from multiple operators.

The Operator Properties Dialog Box is accessed by clicking the Modify Operator Properties icon in the Operator Text column on the Search Parameters Page. Note that valid operators are symbols for numeric fields and text for text fields.

The following table describes the elements available on the page.

Element | Description
Allow user to choose operator | Enable to make additional operators available to users.
Valid Operators | Displays a list of available operators. Valid operators are dependent on the type of field the condition is mapped to. To select an operator, enable it in the valid operators list and click Move to make the operator available to the user. Click OK once the desired operators are selected and moved.
Selected Operators | Displays a list of operators that are available to the user.
Move | Enable a valid operator and click Move to send it to the selected operator list.
Move All | Moves all valid operators to the selected operator list. Using Move All does not require you to enable an operator in the valid operators list first.
Remove | Removes enabled operators from the selected operators list.
Remove All | Removes all selected operators from the selected operator list. Using Remove All does not require you to enable an operator in the selected operators list first.

A.20 Search Security Page

Use the Security page to define who has rights to view, modify, delete and grant access to the search being created.

The Search Security page is accessed by clicking Next on the Search Parameters Page or by clicking Security on the Navigation Train.

The following table describes the elements available on the page.

Element | Description
Add | Displays the Add Security Member Page from which you can search for and select users or predefined security groups.
Copy | Selecting a user or group from the existing list and clicking Copy displays the Add Security Member Page and copies the permissions of the selected user or group to the next user or group added.
Remove | Removes the selected user or group from the list.
User/Group Icon | Displays a single person for a user and multiple persons for a group.
Display Name | The name of the user or group.
View | Enabled by default. Grants the user or group the right to view and execute this search.
Modify | Enable to grant the user or group the right to modify all aspects of this search except for granting security rights.
Delete | Enable to grant the user or group the right to delete this search.
Grant Access | Enable to grant a user or group the right to grant security rights to others for this search. If this is the only security level granted, the user can modify only the security information for this search.

A.21 Add Security Member Page

Use the Add Security Member page to manage definition security and to add users and groups to an application, search, connection, or input. Access this page by clicking Add on the Definition Management Security pages, Content Server Connection Security Page, Workflow Connection Security Page, Search Security Page, Application Security Page, Application Document Security Page, or Input Security Page.

The following table describes the elements available on the page.

Element
Description

Search Menu
Select Search Users to search for users by their login identifier; select Search Groups to search for groups by group name. Note that for document security, only Search Groups are available.

Search Field
Enter the name of a user or group to find. Criteria is not case-sensitive. The asterisk (*) can be used as a wildcard. For example, you can enter *group to find UserGroup and AdminGroup, but would need to enter *group* to find AdminGroups. Click Search without entering any criteria to return the entire listing of either users or groups.

Search
Click Search to submit search criteria.

Results Listing
Displays the returned results. Select multiple adjacent results using Shift + Click or multiple non-adjacent results using Ctl + Click.

Add
Click Add to close the dialog and return the selected user(s) or group(s) to originating security configuration page.

Cancel
Cancels the procedure and closes the Add Security Member page.

A.22 Search Preview and Test Page

From this page, you can test the search you just created to ensure it is working and displaying properly before deploying it.

Access the Create Search Preview and Test page by clicking Next on the Search Security Page.

The following table describes the elements available on the page.

Element
Description

Search
Runs the test search. Once run, the results are displayed in the lower section as they will display on a search results page. Go back to any previous page to alter any elements of the search that are not producing the desired results. Navigate backwards by clicking the back button, or skipping directly to it using the Navigation Train.

Search Result Toolbar
The Search Results Toolbar is displayed above the search results area and provides options for manipulating returned documents. Functionality is documented in the Oracle WebCenter Content User's Guide for Imaging and in the help system on a search results page.

A.23 Search Review Settings Page

Review the details of the search you just created on the Search Review Settings page. Go back to previous pages to make changes by clicking the Back button or by clicking the name of the page on the Navigation Train.

Access this page by clicking Next on the Search Preview and Test Page.

The following table describes the elements available on the page.

Element | Description
Properties Section | Lists the search name and other criteria defined on the Search Properties Page.
Results Formatting Section | Displays the information defined on the Search Results Formatting Page.
Conditions Section | Displays information defined on the Search Conditions Page.
Parameters Section | Displays information defined on the Search Parameters Page.
Security Section | Displays information defined on the Search Security Page.
Audit History Section | Once a search is created, the audit history section displays a list of all actions performed on a search. It is blank on the summary page of a search being created.

A.24 Search Summary Page

The Search Summary page is displayed when clicking an existing search in the Manage Searches panel of the Navigator Pane. It summarizes the search settings and allows for deleting or initiating changes to a search.

The following table describes the elements available on the page.

Element | Description
Modify | Click to display the Search Properties Page to begin modifying the search.
Delete | Click to delete the search.
Close | Click to close the search.
Properties Section | Lists the search name and other criteria defined on the Search Properties Page.
Results Formatting Section | Displays the information defined on the Search Results Formatting Page.
Conditions Section | Displays information defined on the Search Conditions Page.
Parameters Section | Displays information defined on the Search Parameters Page.
Security Section | Displays information defined on the Search Security Page.
Audit History Section | Once a search is created, the audit history section displays a list of all actions performed on a search. It is blank on the summary page of a search being created.

A.25 Application General Properties Page

Note:

The user creating an application must also have View permission to the repository connection being used.

Applications define a set of common metadata and access to a group of documents. On this page, provide general properties information about the application being created.

Access the Create Application General Properties page by clicking the Create Application icon on the Application panel in the navigator pane.

The following table describes the elements available on the page.

Element
Description

Application Name
Enter a descriptive name for the application. The application name is displayed to users on the Upload Document page and to system administrators when creating inputs and searches. This field is required and must be unique.

Description
Enter a description for the application.

Repository
Imaging can leverage multiple instances of Content Server to store documents. This field specifies which Content Server repository instance will contain this application and its documents. The choices for this field are the Imaging repository connections to which the user has access. Once the application is created, the repository cannot be changed. This field is required.

Full-Text Search
Disable to search metadata only. Enable to search metadata and the full-text of any documents with text information, provided the Content Server repository is configured to index full-text. Note that images of documents do not contain text information, and so are not full-text indexed when uploaded. For example, a Microsoft Word has text that can be indexed, but a TIFF image of a Microsoft Word document does not, and so cannot be indexed.

A.26 Application Field Definitions Page

Specify the fields and their definitions that will appear in the new application.

Access the Create Application Field Definitions page by clicking Next on the Application General Properties Page or by clicking Field Definitions in the Navigation Train.

The following table describes the elements available on the page.

Element
Description

Add
Adds a new field to the application.

Remove
Removes a selected field from the application.

Name
Specifies the name of the field. This name must be unique. There is a restriction that when adding or modifying an application you cannot delete an existing field and re-add it with the same name. If this happens, click Cancel and start again.

Type
Specifies the type of information to be input. Options include:

Text: Fields of this type accept text consisting of all character types. The maximum number of characters to be allowed is defined in the Length element

Number: Fields of this type accept integer values of up to 10 digits from approximately -2 billion to +2 billion.

Decimal: Fields of this type accept decimal values up to 15 digits of precision. The scale, or number of decimal places, is specified in the Scale element.

Date: Fields of this type accept date values.

Note that once a field type has been selected when the field is added, it cannot be changed.

Length
Specifies the maximum number of text characters allowed in the associated text field. The system supports up to 200 characters. This applies only to the Text data type.

Scale
Specifies the number (1-15) of decimal places. This applies only to Decimal data type.

Required
Fields marked required must always have a value. No document can be added to the application without providing a value for this field.

Indexed
Fields marked as Indexed cause the repository to create database level indexes to accelerate searching.

Default Value
Specifies a value to be recommended to the user as a default when uploading a document. Clicking the pencil icon displays a form in which to enter the value. If a default value is to be assigned from a picklist, you must define the picklist first. If you assign a default value from a picklist and then clear the value from the picklist, it also clears the default value.

Picklist
Click the Add Picklist icon to display the Picklist window where you can enter values for the new picklist. Click the Edit Picklist icon to edit an existing list. Click the Remove Picklist icon to remove the picklist.

A.27 Application Security Page

Specify the users and groups that will be able to view, modify, or delete the application or grant access to others.

Access the Create Application: Application Security page by clicking Next on the Application Field Definitions Page or by clicking on Application Security in the Navigation Train.

The following table describes the elements available on the page.

Element | Description
Add | Displays the Add Security Member Page from which you can search for and select users or predefined security groups.
Copy | Selecting a user or group from the existing list and clicking Copy displays the Add Security Member Page and copies the permissions of the selected user or group to the next user or group added.
Remove | Removes the selected user or group from the list.
User/Group Icon | Displays a single person for a user and multiple persons for a group.
Display Name | The name of the user or group.
View | Enabled by default. Grants the user or group the right to see and select this application when creating a search.
Modify | Enable to grant the user or group the right to modify all aspects of this application except for granting security rights.
Delete | Enable to grant the user or group the right to delete this application.
Grant Access | Enable to grant a user or group the right to grant security rights to others for this application. If this is the only security level granted, the user can modify only the security information for this application.

A.28 Application Document Security Page

Application Document Security applies to groups but not users. Select the field in the appropriate column to grant a group that aspect of document security.

Access the Create Application Document Security page by clicking Next on the Application Security Page or by clicking Document Security in the Navigation Train.

The following table describes the elements available on the page.

Element | Description
Add | Displays the Add Security Member Page from which you can search for and select predefined security groups.
Copy | Selecting a group from the existing list and clicking Copy displays the Add Security Member Page and copies the permissions of the selected group to the next group added.
Remove | Removes the selected group from the list.
User/Group Icon | Displays multiple persons for a group.
Display Name | The name of the group.
View | Enabled by default. Grants the group the right to view documents in this application. A person must have View rights to documents to see a search result listing when searching this application.
Write | Grants a group rights to upload, update, and copy documents and document metadata within a specific application. Until a group has Write security rights to documents in at least one application, the Upload tool is not visible to group members in the Tools panel of the Navigator Pane.
Grant Access | Grants a group rights to assign document rights to other groups. Note that groups with Grant Access rights are automatically assigned Delete and Write security rights.
Delete | Enable to grant a group the right to delete documents in this application.
Lock Admin | Grants the selected group the right to unlock documents locked by users other than themselves within this application.
Annotate Standard | Grants a group the right to create and manipulate annotations classified as standard by the annotator
Annotate Restricted | Grants a group the right to create and manipulate annotations classified as restricted by the annotator.
Annotate Hidden | Grants a group the right to create and manipulate annotations classified as hidden by the annotator.

A.29 Application Storage Policy Page

On this page, specify the location of storage for the documents in this application.

WARNING:

Changing the Storage Policy in an existing application affects future documents only. Existing documents maintain the Storage Policy that was in place at the time they were uploaded.

Access the Create Application Storage Policy page by clicking Next on the Application Document Security Page or by clicking Storage Policy in the Navigation Train.

The following table describes the elements available on the page.

Element | Description
Document Storage Volume | Specify where documents will be stored. This is configured on Content Server and may be a file system or a database.
Supporting Content Storage Volume | Specify where annotations and supporting content will be stored. This is configured on Content Server and may be a file system or a database.

A.30 Application Workflow Configuration Page

Workflow enables your organization to automate its business processes by orchestrating services within the process flow. Click Add to create a workflow process to define an integration to an existing workflow process. A new instance of this process will be created each time a document is created within this application.

Access the Create Application Workflow Configuration General Properties page by clicking Next on the Application Storage Policy Page.

The following table describes the elements available on the page.

Element | Description
Add | Click to add a new workflow configuration.
Modify | Click to modify an existing workflow configuration.
Remove | Remove the configuration from the application.

A.31 Workflow Server Properties Page

On this page select the workflow connection to the workflow server hosting the desired process. Connection, User name, and Password are required values.

Access this page by clicking Add or Modify on the Application Workflow Configuration Page. Access the Create Application Workflow Server Properties page by clicking Next on the Application Workflow Configuration Page or clicking Modify on an existing Application Workflow Configuration Server Properties page.

The following table describes the elements available on the page.

Element | Description
Connection | Select the workflow connection to the workflow server hosting the desired process. This is a required value.

A.32 Workflow Component Properties Page

Select from the Composite, Service, and Operation fields to identify the workflow process you want to initiate.

Access the Create Application Workflow Component Properties page by clicking Next on the Application Workflow Configuration Page or clicking Modify on an existing Application Workflow Configuration Component Properties page.

The following table describes the elements available on the page.

Element
Description

Composite
Select the name and version of a deployed workflow composite. This is a required value. Deployed composites are listed by their version number. A composite listed as Default in the selection list always uses the default version of the composite as specified on the workflow server. For example, selecting Payment!1.0 causes the workflow to use the 1.0 version of the Payment composite, even if a 2.0 version has been deployed and specified as the default. Selecting Payment!Default causes the workflow to use the specified default composite version. Selecting the Default option may be preferred if changes made to the composite will not impact the way Imaging and the workflow server have been configured to work together.

Service
Select the name of a service associated with the selected composite. This is a required value.

Operation
Select the name of an operation associated with the selected service. This is a required value.

A.33 Workflow Payload Properties Page

The Workflow Payload Properties page defines which application field values will be transferred to the new process instance when it is created. Access the Create Application Workflow Payload Properties page by clicking Next on the Create Application Component Properties page or clicking Modify on an existing Application Workflow Configuration Payload Properties page. When you have completed the changes, click Finish.

The following table describes the elements available on the page.

Element
Description

Payload Element
Select the application field to provide a value for the workflow field.

Type
This column lists the data type for the workflow process field. This data type is used to limit the list of possible application fields to compatible data types.

Mapped Value, Function
Select the application field to provide a value for the workflow field. Available fields are dependent on the application. The Format Value option allows a user to define a string expression. This expression can include a constant value (1.23) or a function (AppId) or a combination of both. Selecting the Format Value option displays an icon to launch the Edit Format Value Page to facilitate creating custom URLs or concatenation of values.

Selecting the Supporting Content option from the Mapped Value column displays an icon which when clicked launches the Edit Supporting Content Value Page that enables you to identify what portion of a supporting XML document is included in a workflow payload.

A.33.1 Edit Format Value Page

This page is accessed from the Workflow Payload Properties Page. Selecting the Format Value option from the Mapped Value column displays an icon which when clicked launches the Edit Format Value page. This page enables you to construct a value from parts of text and application fields. For example, you would use this page to construct custom URLs or to concatenate multiple values together into a single value.

A.33.2 Edit Supporting Content Value Page

This page is accessed from the Workflow Payload Properties Page. Selecting the Supporting Content option from the Mapped Value column displays an icon which when clicked launches the Edit Supporting Content Value page. This page enables you to identify what portion of a supporting XML document is included in a workflow payload.

Element
Description

Supporting Content Key
Provide the content key to identify a supporting document. This field is required. Maximum length cannot exceed 30 characters.

XPath
Specify the XPath that identifies the portion of the supporting document to include in the payload. This field uses standard XPath syntax. For example, to get the root element of a supporting document without specifying the name of the element, the XPath would be:

/*

To get all elements directly below a root element of a supporting document, the XPath would be:

/root/*

Maximum length cannot exceed 224 characters. This field is required.

A.34 Application Review Settings Page

The Create Application Review Settings page allows you to check the settings defined in the application prior to creating the application. Access the Create Application Review Settings page by clicking Next on the Create Application Workflow Payload Properties page. To make any changes to the settings prior to submitting them, click Back or the appropriate link in the navigation train to return to the necessary page. When you are satisfied with the Application settings, click Submit.

A.35 Application Summary Page

Review the details of the application you just created. Click Modify to go to the Application General Properties Page to change settings if necessary. Click the magnifying glass icon in the Picklist column to review the values of a picklist.

Access this page by clicking Submit on the Application Review Settings Page.

A.36 Input Basic Information Page

An input is a configuration that maps an input file to an application for doing bulk uploads to Imaging. Access the Create Input Basic Information page by clicking the Create Input icon on the Manage Inputs panel of the navigation pane.

The following table describes the elements available on the page.

Element | Description
Name | The name of the input.
Description | A brief description of the input.
Online | Select this field when you want the input agent to start its search for work. You can leave this field unselected until after you test the file.
Auto-detect input file character set | When enabled, the input file character set of the application is automatically detected. When this field is not selected, you can manually specify the input file character set and override the default character set of the application used in the input.
Sample File | A path to a sample text file that illustrates the content of an input for this input definition. Input Identify and Parse File Parameters Page and will be used when mapping columns in the file to application fields.
Upload | Click to upload a sample file on a local or shared drive to the samples directory on the server.
Browse | Click to select from a list of sample files in the samples directory of the server.

A.37 Input Identify and Parse File Parameters Page

Specify the input mask, delimiter used to separate data, and the application to which the input file is being mapped. The contents of the sample input file is displayed in the Sample Data section of the page for reference.

The input mask supports regular expressions in addition to the * or ? characters for masks. For example, specifying an input mask of abc*|*.def pulls all files starting with abc or ending in .def. Specifying an input mask of [abc]try.lst pulls files atry.lst, btry.lst, and ctry.lst, but not dtry.lst.

WARNING:

Each input's mask should resolve to a unique set of input files that do not overlap the masks of other inputs. Input Agent only processes an input file for one input and will not restage a file to be processed again for a different input definition. The order in which inputs are processed is random so it is unknown as to which input will pick up a shared input file.

Access the Create Input Review Sample File page by clicking Next on the Input Basic Information Page.

The following table describes the elements available on the page.

Element | Description
Input Mask | This is the filter that the input agent uses to locate files for the input.
Delimiter | Specify the character that indicates the boundary between independent regions of data.
Application | Select the application to be mapped to the input file.
Sample Data | Displays contents of uploaded sample file.

A.38 Input Field Mapping Page

This page facilitates mapping of the columns of data from input files into the correct fields of the target application. Access the Create Input Field Mapping page by clicking Next on the Input Identify and Parse File Parameters Page.

The following table describes the elements available on the page.

Element | Description
Application Fields column | List of field names that are specific to the selected application.
Input Column | A green check mark in the radio button indicates that the mapping is good. A red X indicates that the mapping will not work and you must specify a different column. The picklist lets you choose the column in the input file that will be mapped to the specified data in the application.
Sample Data | After you select a column, the corresponding data from the sample input file will be displayed in the Sample Data column. Click the Show Previous Line or Show Next Line icon to see more data from the sample file.
Use Application Default | Enable to use the default value specified in the application if this value is blank in the input file. The check box is only displayed if the application defines a default value.
Date Format | Click the Add or Edit icons to access the date mask editing dialog. This dialog allows you to create a custom date mask for deciphering nonstandard date values in the input file. Click the Delete icon to remove the custom date mask.

A.38.1 Define Date Format Page

The Define Date Format Page is displayed when clicking the Add a Date Format or Edit a Date Format icon in the Date Format column of the Input Field Mapping Page. Use the Define Date Format page to specify how the date is displayed. If no date format is specified, the default is to the format of the input agent server locale.

The following table describes the elements available on the page.

Element
Description

Add
Click to add the selected format value to the to the Format Value field. Once added, an example is displayed in the Sample Date section.

Format Values
Select format values to add to the Format Value field to determine how a date will be displayed. Only one value can be selected at a time. Values are displayed in the order they are added to the Format Value field. Format value options are:

Era: GG - Sample: AD

Year (4 digit): yyyy - Sample: 2010

Year (2 digit): yy - Sample: 10

Month (number in year): MM - Sample: 01

Month (abbreviated month name): MMM - Sample: Jan

Month (full month name): MMMM - Sample: January

Day: dd - Sample: 01

Hour (24 hour): HH - Sample: 17

Hour (12 hour): hh - Sample: 05

Minute: mm - Sample:16

Second: ss - Sample: 59

/ separator: Separates values with a forward slash

- separator: Separates values with a dash

_ separator: Separates values with an underscore

: separator: Separates values with a colon

. separator: Separates values with a period

space: Adds a space to the string

For example, if the Format Value field were populated with yyMMMdd - HH:mm:ss, the Sample Date would display 10Jan01 - 15:16:59 for a date and time of January 1st, 2010 at 5:16 and 59 seconds PM, based on the following Format Values being added in the following order:

Year (2 digit)

Month (abbreviated month name)

Day

space

- separator

space

Hour (24 hour)

: separator

Minute

: separator

Second

A.39 Input Security Page

The Create Input: Security page is accessed by clicking Next on the Input Field Mapping Page.

The following table describes the elements available on the page.

Element | Description
Add | Displays the Add Security Member Page from which you can search for and select users or predefined security groups.
Copy | Selecting a user or group from the existing list and clicking Copy displays the Add Security Member Page and copies the permissions of the selected user or group to the next user or group added.
Remove | Removes the selected user or group from the list.

A.40 Input Review Settings Page

The Input Review Settings page allows you to check the settings defined in the input wizard prior to creating the input. To make any changes to the settings prior to submitting them, click Back or the appropriate link in the navigation train to return to the desired page. When you are satisfied with the input settings, click Submit. The Input Summary Page is displayed.

The Input Review Settings page is accessed by clicking Next on the Input Security Page.

A.41 Input Summary Page

Review the details of the created input. Click Modify to go to the Input Basic Information Page to change settings if necessary. Click Toggle Online to tell the Input Agent to start polling the definition files of this input.

Access this page by clicking Submit on the Input Review Settings Page.

A.42 Content Server Connection Basic Information Page

Create and modify connections to a Content Server repository server by expanding the Manage Connections panel in the Navigator Pane. Click the Create New Connection icon or click an existing connection and click Modify to display the Connection Basic Information page.

The following table describes the elements available on the page.

Element | Description
Name | A name for the repository to which you are connecting.
Description | A brief description of the connection.
Connection Type | Identifies the type of connection. The type of connection cannot be changed once it is defined.

A.43 Content Server Connection Content Server Settings Page

Specify the details of the Content Server repository to connect to on the Content Server Settings page. It is accessed by clicking Next on the Content Server Connection Basic Information Page when creating a new connection, or directly using the navigation train on any repository connection page for an existing connection.

The following table describes the elements available on the page.

Element
Description

SSL
Enable connection using Secure Socket Layer (SSL). Additional steps must be taken to configure SSL on Content Server and ensure proper credentials. For detailed information, see the full Oracle WebCenter Content Administrator's Guide for Imaging.

Use Local Content Server
Enable to specify localhost as the machine name and connect Imaging to the Content Server sharing the computer. Local communication offers the fastest connection option. If enabled, localhost is used exclusively unless a communication failure occurs. If there is a communication failure to localhost and a pool of Content Servers is defined, messages are sent to the machines named in the Content Server pool until communication to localhost resumes.

If Use Local Content Server is not enabled, then a pool of Content Servers must be defined and messages are sent to multiple Content Servers. This option is for load balancing in a clustered environment.

Server Port
Specifies the Content Server's remote API (RIDC) connection port. If the SSL option is checked, then the port provided must be the SSL listening port for the server.

Content Server Pool
Specify the machine names and connection ports for all Content Servers used remotely. Content Servers can be added to the pool for load balancing.

Machine Name
Specifies the host name or names used for the connection. It is the name or IP address of the server.

A.44 Content Server Connection Security Page

Specify the connection definition security on Connection security page. It is accessed by clicking Next on the Content Server Connection Content Server Settings Page when creating a new connection, or directly using the navigation train on any connection page for an existing connection.

The following table describes the elements available on the page.

Element | Description
Add | Displays the Add Security Member Page from which you can search for and select users or predefined security groups.
Copy | Selecting a user or group from the existing list and clicking Copy displays the Add Security Member Page and copies the permissions of the selected user or group to the next user or group added.
Remove | Removes the selected user or group from the list.
User/Group Icon | Displays a single person for a user and multiple persons for a group.
Display Name | The name of the user or group.
View | Enabled by default. Grants the user or group the right to view this connection.
Modify | Enable to grant the user or group the right to modify all aspects of this connection except for granting security rights.
Delete | Enable to grant the user or group the right to delete this connection.
Grant Access | Enable to grant a user or group the right to grant security rights to others for this connection. If this is the only security level granted, the user can modify only the security information for this connection.

A.45 Content Server Connection Review Settings Page

Review connection settings prior to submitting the connection on the Review Settings page. Access the Review Settings by clicking Next on the Content Server Connection Security Page when creating a new connection, or directly in the navigation train on any connection page when modifying an existing connection.

If settings need to be changed, navigate to the connection page to make the changes either by clicking Back or by clicking the needed page in the navigation page. Once you are satisfied with your settings, click Submit. The Content Server Connection Summary Page is displayed.

A.46 Content Server Connection Summary Page

The Connection Summary page is accessed by clicking Submit on the Content Server Connection Review Settings Page. Review the details of the created connection. Click Modify to go to the Content Server Connection Basic Information Page to change settings if necessary.

A.47 Workflow Connection Basic Information Page

Create and modify connections to a workflow server by expanding the Manage Connections panel in the Navigator Pane. Click the Create New Connection icon or click an existing connection and click Modify to display the Workflow Connection Basic Information page.

The following table describes the elements available on the page.

Element | Description
Name | Provide a unique name for this connection.
Description | A brief description of the connection.
Connection Type | Identifies the type of connection.

A.48 Workflow Connection Settings Page

Specify the details of the workflow server to connect to on the Workflow Connection Settings page. It is accessed by clicking Next on the Workflow Connection Basic Information Page when creating a new connection, or directly using the navigation train on any Content Server connection page for an existing workflow connection.

The following table describes the elements available on the page.

Element
Description

HTTP Front End Address
The URL address of the workflow server, including the listening port if it is not the default port for the protocol defined in the URL. For example:

http://soaserver1:8001
http://ohs_frontend_server:80
http://ohs_frontend_server

Credential Alias
Provides the alias for username and password credentials encrypted in the credential store. These credentials are used when making the remote connection to the workflow server and must reference a username and password with appropriate permissions in the workflow system, not Imaging.

This credential must be created in the credential store before the workflow connection configuration can be completed. A credential can be created in the credential store in one of two ways: through Fusion Middleware Control or through WLST.

Provider
Specifies the host name or names used for the connection. The transport mechanism and listening port should be included in the setting. If the workflow server is a single instance, it is the name or IP of the workflow machine. If the workflow server is operating within a cluster, this parameter value can be a comma-separated list of machine names or IP addresses of servers in the cluster, or it can be the cluster name for the cluster.

When a cluster name is used, the name must be defined in DNS to resolve to the multiple machines within the cluster. Neither Imaging nor SOA defines this behavior. Rather, it is defined by the Oracle WebLogic Server support for JNDI in a cluster. For example:

Single SOA server (or cluster with DNS cluster name):

t3://soaserver1:8001

Multiple, clustered SOA servers:

t3://soaserver1,soaserver2,soaserver3:8001

Test Connection
Click to test if connection settings are configured correctly. A dialog box is displayed indicating whether or not the connection test was successful. If successful, the available composites deployed on the workflow server are also displayed in a list at the bottom.

Note that if the test button fails, you can attempt to diagnose the problem outside of Imaging by opening a standard desktop browser from the Imaging managed server machine and attempt to connect to the server using the HTTP front end address and specifying the inspection.wsil and html=true in the URL. For example:

http://soaserver1:8001/inspection.wsil?html=true

If this connection fails, Imaging cannot connect. Check the configuration of the SOA server and any load balancing products that may be front ending the SOA server.

A.49 Workflow Connection Security Page

Specify the connection definition security on Connection security page. It is accessed by clicking Next on the Workflow Connection Settings Page when creating a new connection, or directly using the navigation train on any connection page for an existing connection.

The following table describes the elements available on the page.

Element | Description
Add | Displays the Add Security Member Page from which you can search for and select users or predefined security groups.
Copy | Selecting a user or group from the existing list and clicking Copy displays the Add Security Member Page and copies the permissions of the selected user or group to the next user or group added.
Remove | Removes the selected user or group from the list.
User/Group Icon | Displays a single person for a user and multiple persons for a group.
Display Name | The name of the user or group.
View | Enabled by default. Grants the user or group the right to view this connection.
Modify | Enable to grant the user or group the right to modify all aspects of this connection except for granting security rights.
Delete | Enable to grant the user or group the right to delete this connection.
Grant Access | Enable to grant a user or group the right to grant security rights to others for this connection. If this is the only security level granted, the user can modify only the security information for this connection.

A.50 Workflow Connection Review Settings Page

Review connection settings prior to submitting the connection on the Review Settings page. Access the Review Settings by clicking Next on the Workflow Connection Security Page when creating a new connection, or directly in the navigation train on any workflow connection page when modifying an existing connection.

If settings need to be changed, navigate to the connection page to make the changes either by clicking Back or by clicking the needed page in the navigation page. Once you are satisfied with your settings, click Submit. The Workflow Connection Summary Page is displayed.

A.51 Workflow Connection Summary Page

The Workflow Summary page is accessed by clicking Submit on the Workflow Connection Review Settings Page. Review the details of the created connection. Click Modify to go to the Workflow Connection Basic Information Page to change settings if necessary.

A.52 Definition Management Security

Create and modify the top level security settings for applications, inputs, searches, connections, and solutions by selecting the appropriate category in the Manage Security panel in the navigator pane.

Access the Manage Security pages by clicking the expand icon on the Manage Security panel in the navigator pane.

The following table describes the elements available on the page.

Element | Description
Create | Select to assign Create permission to a user which allows the user to create an application, input, search, or connection.
Administrator | Select to assign a user permission to view, create, modify, and delete an application, input, search, or connection.

Index

A  B  C  D  E  F  G  H  I  J  L  M  N  O  P  R  S  T  U  V  W 

A

Add Security Member Page, A.21

administrative account, 1.5.1

default, 1.5.1

password, 1.5.1

advanced viewer

default MBean, 3.6.1

setting font variables, 3.7

troubleshooting

Linux shared temp directory, 11.10

setting library path variables on UNIX, AIX, and SPARC, 11.21

shifting redactions, 11.11

TIFF Display, 11.9

transformation errors, 11.8

annotation

annotate hidden, 2.2.4.1

annotate restricted, 2.2.4.1

annotate standard, 2.2.4.1

annotation security, 2.2.4

Annotations

Redaction

shifting problem, 11.11

Application, 1.3

application security, 4.2.3

BPEL configuration, 10.2.1

creating, 1.4, 3.4, 4.1, 4.2

defining application fields, 4.2.2

document security, 4.2.4

general properties, 4.2.1

modifying, 4.3

permission, 2.1.3

user interface

Document Security Page, A.28

General Properties Page, A.25

Review Setting Page, A.34

Storage Policy Page, A.29

Summary Page, A.35

Workflow Component Properties Page, A.32

Workflow Configuration Edit Format Value Page, A.33.1

Workflow Configuration Edit Supporting Content Page, A.33.2

Workflow Configuration Page, A.30

Workflow Payload Properties Page, A.33

Workflow Server Properties Page, A.31

user interfaceI

Application Security Page, A.27

Field Definitions Page, A.26

Application Security Page, A.27

Application server, 1.6.3

architecture

WebCenter Content: Imaging, 1.7

asctl, 1.6.3

AXF Solution Editor, A.15

B

Batch uploading, 9.1

BPEL

creating process, 10.2.8

WLS

thread settings, 9.4.3, 10.2.4

BPM (Business Process Management), 10

Business logic, 1.7.3

Business Process Management, 10

C

CleanupExpireDays, 3.6.1

CleanupFileExclusionList, 3.6.1

Configuration

overview, 3.1

post-installation, 3.2

configuration

repository options, 3.3

Connections

configuration of, 7

user interface

Content Server Basic Information Page, A.42

Content Server Connection Review Settings Page, A.45

Content Server Connection Security Page, A.44

Content Server Connection Summary Page, A.46

Content Server Settings Page, A.43

Workflow Basic Information Page, A.47

Workflow Connection Review Settings Page, A.50

Workflow Connection Security Page, A.49

Workflow Connection Settings Page, A.48

Workflow Connection Summary Page, A.51

Content Server, 1.6.2, 11.5

fullness, 3.3.2

optional components, 3.3.5

repository

capacity, 3.3.2

repository capacity, 11.5

Content Server file store provider, 3.3.4

ContentTracker, 3.3.5

D

Default Values

Creating Default Values

Applications, 4.2.2, A.26

Searches, 6.2, A.19

Definition Managment Security

user interface, A.52

Definitions

how to export, 3.4.1

how to import, 3.4.2

document security, 2.2.3

Document Security Page, A.28

E

Edit Format Value Page, A.33.1

Edit Supporting Content Page, A.33.2

Editor

Solution, A.15

Enterprise Manager

System MBean Browser, 3.6.3

Exception, 11.16

Export Comments Page, A.6

Export Definitions Applications Page, A.7

Export Definitions Inputs Page, A.9

Export Definitions Searches Page, A.8

Export Definitions Summary Page, A.10

Exporting Definitions

how to, 3.4.1

user interface

Applications Page, A.7

Export Comments Page, A.6

Inputs Page, A.9

Searches Page, A.8

Summary Page, A.10

F

File Location Page, A.11

File size limits, 3.5, A.4

fonts

errors, 11.6

GDFontPath MBean, 3.7

setting variables, 3.7

TrueType, 3.7

TTF font files, 3.6.1

full, 11.5

Fullness, 3.3.2

fullness, 11.5

full-text searching, 3.3, 3.3.5.2, 3.4.2, 4.2.1, 4.2.1, 11.4, A.25

G

GDFontPath MBean, 3.7

H

Help

troubleshooting, 11

I

icons, user interface, A.1

images

quality, 3.6.1

TIFF

compression algorithm, 3.6.1

Imaging

architecture, 1.7

business logic, 1.7.3

ImagingTenantId, 3.6.1

ImagingTenantName, 3.6.1

Importing Definitions

how to, 3.4.2

user interface

File Location Page, A.11

Select Imports Page, A.12

Summary Page, A.14

Validate Imports Page, A.13

Input agent, 9.1

configuration MBeans

CheckInterval, 3.6.1

InputAgentRetryCount, 3.6.1

InputDirectories, 3.6.1

SampleDirectory, 3.6.1

error files, 9.5

input file mask, 9.2

permissions, 9.1

processing order, 9.4

troubleshooting, 11.7

user interface

Basic Information Page, A.36

Field Mapping Page, A.38

Identify and Parse File Parameters Page, A.37

Input Security Page, A.39

Review Settings Page, A.40

Summary Page, A.41

Input Basic Information Page, A.36

Input definition

creating, 1.4, 5.1

Input Field Mapping Page, A.38

Input file

commands

Locale, 9.3.1

New, 9.3.2

entries error, 11.7.3, 11.7.3

example, 9.2

troubleshooting, 11.7

Input file mask

warning, 9.2

Input Identify and Parse File Parameters Page, A.37

Input Review Settings Page, A.40

Input Review Summary Page, A.41

Input Security Page, A.39

J

Java API, 1.7.2

Java Management Beans (see MBeans), 3.6

JMX (see MBeans), 3.6

JOC IdleTime, 3.6.1

L

logging

levels, 11.12

MBean, 3.6.1

M

Maximum Search Results, 6.2

setting, 6.2

MaxResults, 6.2

MaxSearchResults, 6.2

MBeans

and WLST, 3.6.2

CacheAgeLimit, 3.6.1

CacheLocation, 3.6.1

CheckInterval, 3.6.1

CleanupExpireDays, 3.6.1

CleanupFileExclusionList, 3.6.1

command line configuration, 3.6

DefaultColorSet, 3.6.1

DefaultSecurityGroup, 3.6.1

DocumentFileTimeout, 3.6.1

Enterprise Manager MBean browser, 3.6.3

GDFontPath, 3.6.1

ImagingTenantId, 3.6.1

ImagingTenantName, 3.6.1

InputAgentRetryCount, 3.6.1

InputDirectories, 3.6.1

IPMVersion, 3.6.1

JpegImageQuality, 3.6.1

list of, 3.6.1

LogDetailedTimes, 3.6.1

MaxSearchResults, 3.6.1, 3.6.1, 3.6.1, 6.2

PolicyStoreProvider, 3.6.1

RequreBasicAuthSSL, 3.6.1

SampleDirectory, 3.6.1

TiffCompressionType, 3.6.1

UseAdvancedAsDefaultViewerMode, 3.6.1

Middleware Administration Server, 1.6.3

N

navigation

icons, A.1

Navigation Train, A.3

Navigator Pane, A.2

Navigation Train, A.3

Navigator Pane, A.2

O

OC4J, 1.6.3

Operators Properties Dialog Box, A.19.1

Oracle Access Manager (OAM) 10g integration, 2.3.6

Oracle Access Manager (OAM) 11g integration, 2.3.5

Oracle Document Capture, 1.2, 1.5.3

Oracle Web Services Manager (see OWSM), 7.2.2, 10.2.5

OracleTextSearch, 3.3.5

Outside In Technology, 4.1.1.1

OWSM

credential, 7.2.2, 10.2.5

P

page cache, 3.6.1

Permission

application, 2.1.3

permission

annotation

annotate hidden, 2.2.4.1

annotate restricted, 2.2.4.1

annotate standard, 2.2.4.1

document access

create, 2.2.3

delete, 2.2.3

grant access, 2.2.3

lock, 2.2.3

view, 2.2.3

Picklist

defining, 4.2.2

PolicyStoreProvider, 3.6.1

Process flow

BPEL, 10.2

R

Redaction

shifting problem, 11.11

repository

capacity, 11.5

configuration, 7

Content Server file store provider, 3.3.4

fullness, 3.3.2, 11.5

S

Search Conditions Page, A.18

Search Parameters Page, A.19

Search Preview and Test Page, A.22

Search Properties Page, A.16

Search Results Formatting Page, A.17

Search Reveiw Settings Page, A.23

Search Security Page, A.20

Search Summary Page, A.24

searching

creating a search, 6.2

creating full-text search, 4.2.1

full-text, 3.3, 3.3.5.2, 3.4.2, 4.2.1, 4.2.1, 11.4, A.25

user interface

Add Security Member Page, A.21

Operators Properties Dialog Box, A.19.1

Search Conditions Page, A.18

Search Parameters Page, A.19

Search Preview and Test Page, A.22

Search Properties Page, A.16

Search Results Formatting Page, A.17

Search Review Settings Page, A.23

Search Security Page, A.20

Search Summary Page, A.24

security

annotation security, 2.2.4

Definition Management

application, input, search, and connections, 2.1.3, A.52

definition management security rights, 2.1.3, 2.1.3.1, 2.2.1

definition security rights, 2.1.3, 2.2.2, 2.2.2

document security, 2.2.3

initialization, 2.1.2

login, 2

MBean

DefaultSecurityGroup, 3.6.1

Oracle Access Manager (OAM) 10g integration, 2.3.6

Oracle Access Manager (OAM) 11g integration, 2.3.5

Security Pages, A.52

Select Imports Page, A.12

Skin

default, 3.6.1

Solution Editor, A.15

solutions, 2.1.3

Storage, 3

Storage Policy Page, A.29

T

Thread settings, 9.4.3, 10.2.4

Transactions

BPEL, 10.2

Troubleshooting, 11

decimal field error, 11.1

font errors, 11.6

input agent, 11.7

input file, 11.7

input file entries errors, 11.7.3, 11.7.3

I/PM and windows server prerequisites, 11.2

logging of ImagingException

Exceptions, 11.12

nested stack errors, 11.16

NULL number fields, 11.3

repository capacity errors, 11.5

shifting redaction annotations, 11.11

TrueType fonts, 3.7

U

Update Document Page, A.5

Updating

user interface

Update Document Page, A.5

Upload file size limit, 3.5, A.4

Uploading

batch, 9.1

user interface

Uploading Document Page, A.4

Uploading Document Page, A.4

user interface icons, A.1

V

Validate Imports Page, A.13

viewer

advanced

MBean, 3.6.1

setting font variables, 3.7

setting library path variables on UNIX, AIX, and SPARC, 11.21

troubleshooting display failure due to Linux shared temp directory, 11.10

troubleshooting shifting redactions, 11.11

troubleshooting TIFF Display, 11.9

troubleshooting transformation errors, 11.8

basic

MBean, 3.6.1

W

Web services

BPEL, 10.2

Java API, 1.7.2

WebCenter Content: Imaging

architecture, 1.7

business logic, 1.7.3

WebCenter Suite, 1.6.3

Weblogic Server Scripting Tool (see WLST), 3.6.2

WLST

and MBeans, 3.6.2

workflow agents, 10

Workflow Basic Information Page, A.47

Workflow Component Properties Page, A.32

Workflow Configuration Page, A.30

Workflow Connection Review Settings Page, A.50

Workflow Connection Security Page, A.49

Workflow Connection Settings Page, A.48

Workflow Connection Summary Page, A.51

Workflow Payload Properties Page, A.33

Workflow Server Properties Page, A.31

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2010, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this software or related documentation is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms set forth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

Hazardous Applications Notice

This software is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure the safe use of this software. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software in dangerous applications.

Trademark Notice

Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

Third-Party Content, Products, and Services Disclaimer

This software and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.