4.2 Configuring Security for Oracle UCM and Content Server

4.2.2.1 Configuring Oracle UCM for Two-Way SSL Communication

Oracle ECM Suite uses both the Oracle WebLogic Server and Sun secure socket layer (SSL) stacks for two-way SSL configurations.

• For the inbound Web service bindings, Oracle ECM Suite uses the Oracle WebLogic Server infrastructure and, therefore, the Oracle WebLogic Server libraries for SSL.

• For the outbound Web service bindings, Oracle ECM Suite uses JRF HttpClient and, therefore, the Sun JDK libraries for SSL.

Due to this difference, start Oracle WebLogic Server with the following JVM option.

1. Open the following file:

   • On UNIX operating systems, open $MIDDLEWARE_HOME/user_projects/domains/domain_name/bin/setDomainEnv.sh.

   • On Window operating systems, open MIDDLEWARE_HOME\user_projects\domains\domain_name\bin\setDomainEnv.bat.

2. Add the following lines in the JAVA_OPTIONS section, if the server is enabled for one-way SSL (server authorization only):

   -Djavax.net.ssl.trustStore=your_truststore_location
   

   For two-way SSL, the keystore information (location and password) is not required.

In addition, perform the following steps to enable two-way SSL for Oracle UCM to invoke another application.

1. On the client side, provide the keystore location.

   1. From the SOA Infrastructure menu, select SOA Administration then Common Properties.

   2. At the bottom of the page, click More SOA Infra Advanced Configuration Properties.

   3. Click KeystoreLocation.

   4. In the Value column, enter the keystore location.

   5. Click Apply.

   6. Click Return.

2. During design time in Oracle JDeveloper, update the reference section in the composite.xml file with the oracle.soa.two.way.ssl.enabled property.

   <reference name="Service1" 
      ui:wsdlLocation=". . ."> 
      <interface.wsdl interface=". . ."/> 
        <binding.ws port=". . ."> 
         <property name="oracle.soa.two.way.ssl.enabled">true</property> 
     </binding.ws> 
    </reference> 
   

3. In Oracle Enterprise Manager Fusion Middleware Control Console, select WebLogic Domain, then domain_name.

4. Right-click domain_name and select Security then Credentials.

5. Click Create Map.

6. In the Map Name field, enter a name (for example, SOA), and click OK.

7. Click Create Key.

8. Enter the following details.

   Field	Description
   Select Map	Select the map created in Step 6 (for this example, SOA).
   Key	Enter the key name (KeystorePassword is the default).
   Type	Select Password.
   User Name	Enter the keystore user name (KeystorePassword is the default).
   Password	Enter the password that you created for the keystore.

   
   

   Note:

   When you set up SSL in Oracle WebLogic Server, a key alias is required. You must enter mykey as the alias value. This value is required.

9. Set the keystore location in Oracle Enterprise Manager Fusion Middleware Control Console. See Step 1 for instructions.

10. Modify the composite.xml syntax to use https and sslport to invoke Oracle UCM. For example, change the syntax shown in bold:

    <?xml version="1.0" encoding="UTF-8" ?> 
    <!-- Generated by Oracle SOA Modeler version 1.0 at [4/1/09 11:01 PM]. --> 
    <composite name="InvokeEchoBPELSync" 
    revision="1.0" 
    label="2009-04-01_23-01-53_994" 
    mode="active" 
    state="on" 
    xmlns="http://xmlns.oracle.com/sca/1.0" 
    xmlns:xs="http://www.w3.org/2001/XMLSchema" 
    xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" 
    xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" 
    xmlns:ui="http://xmlns.oracle.com/soa/designer/"> 
    <import 
    namespace="http://xmlns.oracle.com/CustomApps/InvokeEchoBPELSync/BPELProcess1"
      location="BPELProcess1.wsdl" importType="wsdl"/>
    <import namespace="http://xmlns.oracle.com/CustomApps/EchoBPELSync/
    BPELProcess1"location="http://hostname:port/soa-infra/services/default/EchoBPEL
    Sync/BPELProcess1.wsdl"
    importType="wsdl"/>
    

    to use https and sslport:

    location="https://hostname:sslport/soa-infra/services/default/EchoBPELSync
    /BPELProcess1.wsdl"
    

4.2.2.2 Invoking References in One-Way SSL Environments in Oracle JDeveloper

When invoking a Web service as an external reference from Oracle UCM in one-way SSL environments, ensure that the certificate name (CN) and the host name of the server exactly match. This ensures a correct SSL handshake.

For example, if a Web service is named adfbc and the certificate has a server name of myhost05, the following results in an SSL handshake exception.

<import namespace="/adfbc1/common/" 
           
@ location="https://myhost05.us.oracle.com:8002/CustomApps-adfbc1-context-root/Ap 
pModuleService?WSDL" 
          importType="wsdl"/> 
 <import namespace="/adfbc1/common/" location="Service1.wsdl" 
          importType="wsdl"/> 

If you switch the order of import, the SSL handshake passes.

<import namespace="/adfbc1/common/" location="Service1.wsdl" 
          importType="wsdl"/> 
  <import namespace="/adfbc1/common/" 
           
@ location="https://myhost05.us.oracle.com:8002/CustomApps-adfbc1-context-root/Ap 
pModuleService?WSDL" 
          importType="wsdl"/> 

Note the following restrictions around this issue:

• There are no options for ignoring host name verification in Oracle JDeveloper as exist with the Oracle WebLogic Server Administration Console. This is because the SSL kit used by Oracle JDeveloper is different. Only the trust store can be configured from the command line. All other certificate arguments are not passed.

• In the WSDL file, https://hostname must match with that in the certificate, as described above. You cannot perform the same procedures as you can with a browser. For example, if the host name is myhost05.us.oracle.com in the certificate's CN, then you can use myhost05, myhost05.us.oracle.com, or the IP address from a browser. In Oracle JDeveloper, always use the same name as in the certificate (that is, myhost05.us.oracle.com).

4.2.2.3 Configuring Oracle ECM Suite, Oracle HTTP Server for SSL Communication

Follow these procedures to configure SSL communication between Oracle ECM Suite and Oracle HTTP Server.

Configure Oracle HTTP Server for SSL Communication

1. Update mod_ssl.conf with the <Location /integration/services> location directive.

   LoadModule weblogic_module   ${ORACLE_HOME}/ohs/modules/mod_wl_ohs.so
   
   <IfModule mod_weblogic.c>
         WebLogicHost host.domain.com
         WLLogFile <logdir>/ohs_ssl.log
         Debug ALL
         DebugConfigInfo ON
         SecureProxy ON
         MatchExpression *.jsp
         WlSSLWallet <OHS_
   HOME>/instances/instance1/config/OHS/ohs1/keystores/default
   </IfModule>
   
   <Location /soa-infra>
         WebLogicPort 8002
         SetHandler weblogic-handler
         ErrorPage http://host.domain.com:port/error.html
   </Location>
   
   <Location /b2bconsole>
         WebLogicPort 8002
         SetHandler weblogic-handler
         ErrorPage http://host.domain.com:port/error.html
   </Location>
   
   <Location /b2b> 
         WebLogicPort 8002 
         SetHandler weblogic-handler 
          ErrorPage http://host.domain.com:port/error.html 
   </Location> 
   
   <Location /integration/worklistapp>
         WebLogicPort 8002
         SetHandler weblogic-handler
         ErrorPage http://host.domain.com:port/error.html
   </Location>
   
   <Location /integration/services>
         WebLogicPort 8002
         SetHandler weblogic-handler
         ErrorPage http://host.domain.com:port/error.html
   </Location>
   
   <Location /DefaultToDoTaskFlow>
         WebLogicPort 8002
         SetHandler weblogic-handler
         ErrorPage http://host.domain.com:port/error.html
   </Location>
   
   <Location /OracleBAM>
         WebLogicPort 9002
         SetHandler weblogic-handler
         ErrorPage http://host.domain.com:port/error.html
   </Location>
   
   <Location /OracleBAMWS>
   >       WebLogicPort 9002
   >       SetHandler weblogic-handler
   >       ErrorPage  http://host.domain.com:port/error.html
   > </Location>
   
   <Location /sdpmessaging/userprefs-ui/>
         WebLogicPort 8002
         SetHandler weblogic-handler
         ErrorPage http://host.domain.com:port/error.html
   </Location>
   

2. Start the Oracle WebLogic Servers as described in "Configuring Oracle UCM for Two-Way SSL Communication"

Configure Certificates for Oracle Client, Oracle HTTP Server, and Oracle WebLogic Server

1. Export the user certificate from the Oracle HTTP Server wallet.

   orapki wallet export -wallet . -cert cert.txt  -dn 'CN=\"Self-Signed Certificate for ohs1 \",OU=OAS,O=ORACLE,L=REDWOODSHORES,ST=CA,C=US'
   

2. Import the above certificate into the Oracle WebLogic Server truststore as a trusted certificate.

   keytool -file cert.txt -importcert -trustcacerts -keystore DemoTrust.jks
   

3. Export the certificate from the Oracle WebLogic Server truststore.

   keytool -keystore DemoTrust.jks -exportcert -alias wlscertgencab -rfc -file
   certgencab.crt
   

4. Import the above certificate to the Oracle HTTP Server wallet as a trusted certificate.

   orapki wallet add -wallet . -trusted_cert -cert certgencab.crt -auto_login_only
   

5. Restart Oracle HTTP Server.

6. Restart the Oracle WebLogic Servers as described in "Configuring Oracle UCM for Two-Way SSL Communication"

4.2.2.4 Switching from Non-SSL to SSL Configurations with Oracle UCM

Switching from non-SSL to SSL configurations with Oracle UCM requires the Frontend Host and Frontend HTTPS Port fields to be set in the Oracle WebLogic Server Administration Console. Not doing so results in exception errors when you attempt to create to-do tasks.

1. Log in to Oracle WebLogic Server Administration Console.

2. In the Environment section, select Servers.

3. Select the name of the managed server (for example, ucm_server1).

4. Select Protocols, then select HTTP.

5. In the Frontend Host field, enter the host name on which Oracle UCM is located.

6. In the Frontend HTTPS Port field, enter the SSL listener port.

7. Click Save.

4.2.2.5 Configuring SSL Between Oracle UCM Instances and Oracle WebCache

The Test Web Service page, in an Oracle WebCache and Oracle HTTP Server environment, may require communication back through Oracle WebCache. Therefore, SSL must be configured between the Oracle UCM instance and Oracle WebCache (that is, export the user certificate from the Oracle WebCache wallet and import it as a trusted certificate in the Oracle WebLogic Server truststore).

4.2.2.6 Using a Custom Trust Store for One-Way SSL During Design Time

To invoke Oracle UCM over HTTPS when using a custom trust store created with a tool such as keytool or orapki, perform the following actions in Oracle JDeveloper.

1. To fetch a WSDL file in the reference section, set the trust store information in Tools, then Preferences, then Http Analyzer, then HTTPS Setup, then Client Trusted Certificate Keystore.

2. During deployment to an SSL-enabled server, use the JSSE property at the command line:

   jdev -J-Djavax.net.ssl.trustStore=your_trusted_location
   

4.2.2.7 Enabling an Asynchronous Process to Invoke Another Asynchronous Process

To enable an asynchronous process deployed to an SSL-enabled, managed server to invoke another asynchronous process over HTTP, start by assuming you create the following environment:

• Asynchronous BPEL process A that invokes asynchronous BPEL process B

• Asynchronous BPEL process A is deployed to a one-way SSL enabled, managed server

• All WSDL reference and bindings use plain HTTP

At run time, the WSDL is looked for over HTTPS, and the callback message from asynchronous BPEL process B fails.

To resolve this issue, the callbackServerURL property must be passed at the reference binding level in the composite.xml file. This explicitly indicates the value of the callback URL for the given reference invocation. If the client composite is running in an SSL-managed server, then the callback defaults to SSL.

<reference name="Service1" 
ui:wsdlLocation="http://localhost:8000/soa-infra/services/default/AsyncSecondB 
PELMTOM/BPELProcess1.wsdl"> 
    <interface.wsdl
 interface="http://xmlns.oracle.com/Async/AsyncSecondBPELMTOM/BPELProcess1#wsdl 
.interface(BPELProcess1)" 
callbackInterface="http://xmlns.oracle.com/Async/AsyncSecondBPELMTOM/BPELProce
ss1#wsdl.interface(BPELProcess1Callback)"/> 
    <binding.ws 
port="http://xmlns.oracle.com/Async/AsyncSecondBPELMTOM/BPELProcess1#wsdl.endp 
oint(bpelprocess1_client_ep/BPELProcess1_pt)" 
                
location="http://localhost:8000/soa-infra/services/default/AsyncSecondBPELMTOM 
/bpelprocess1_client_ep?WSDL"> 
         <wsp:PolicyReference URI="oracle/wss_username_token_client_policy" 
                           orawsp:category="security" 
orawsp:status="enabled"/> 
      <wsp:PolicyReference URI="oracle/wsaddr_policy" 
                           orawsp:category="addressing" 
orawsp:status="enabled"/> 
. 
 <property name="callbackServerURL">http://localhost:8000/</property> 
. 
    </binding.ws> 
. 
  <callback> 
      <binding.ws 
port="http://xmlns.oracle.com/Async/AsyncSecondBPELMTOM/BPELProcess1#wsdl.endp 
oint(bpelprocess1_client_ep/BPELProcess1Callback_pt)"> 
            <wsp:PolicyReference 
URI="oracle/wss_username_token_service_policy" 
                           orawsp:category="security" 
orawsp:status="enabled"/> 
 </binding.ws> 
    </callback> 
    
. 
  </reference> 

4.2.2.8 Configuring RIDC SSL for Valid Certificate Path

To use Remote Intradoc Client (RIDC) and self-signed certificates, you must import the certificate into your local JVM certificate store so the certificate will be trusted.

1. Retrieve the key from the Content Server. For example:

   openssl s_client -connect dadvmc0022.us.company.com:7045 2>/dev/null
   
   CONNECTED(00000003)---Certificate chain 0 s:/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN=dadvmc0022   i:/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN=CertGenCAB---Server certificate-----BEGIN CERTIFICATE-----MIIB6zCCAZUCEItVMwHDFXAnYG//RoVbXQgwDQYJKoZIhvcNAQEEBQAweTELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB015U3RhdGUxDzANBgNVBAcTBk15VG93bjEXMBUGA1UEChMOTXlPcmdhbml6YXRpb24xGTAXBgNVBAsTEEZPUiBURVNUSU5HIE9OTFkxEzARBgNVBAMTCkNlcnRHZW5DQUIwHhcNMDkwMzI5MjM0NDM0WhcNMjQwMzMwMjM0NDM0WjB5MQswCQYDVQQGEwJVUzEQMA4GA1UECBYHTXlTdGF0ZTEPMA0GA1UEBxYGTXlUb3duMRcwFQYDVQQKFg5NeU9yZ2FuaXphdGlvbjEZMBcGA1UECxYQRk9SIFRFU1RJTkcgT05MWTETMBEGA1UEAxYKZGFkdm1jMDAyMjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCmxv+h8kzOc2xyjMCdPM6By5LY0Vlp4vzWFKmPgEytp6Wd87sG+YDBPeFOz210XXGMx6F/14/yFlpCplmazWkDAgMBAAEwDQYJKoZIhvcNAQEEBQADQQBnuF/s6EqCT38Aw7h/406uPhNh6LUF7XH7QzmRv3J1sCxqRnA/fK3JCXElshVlPk8GhwE4G1zxpr/JZu6+jLrW-----END CERTIFICATE-----subject=/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN=dadvmc0022issuer=/C=US/ST=MyState/L=MyTown/O=MyOrganization/OU=FOR TESTING ONLY/CN=CertGenCAB---No client certificate CA names sent---SSL handshake has read 625 bytes and written 236 bytes---New, TLSv1/SSLv3, Cipher is RC4-MD5Server public key is 512 bitCompression: NONEExpansion: NONE
   SSL-Session:   Protocol  : TLSv1   Cipher    : RC4-MD5   Session-ID: 23E20BCAA4BC780CE20DE198CE2DFEE4   Session-ID-ctx:    Master-Key: 4C6F8E9B9566C2BAF49A4FD91BE90DC51F1E43A238B03EE9B700741AC7F4B41C72D2990648DE103BB73B3074888E1D91   Key-Arg   : None   Start Time: 1238539378   Timeout   : 300 (sec)   Verify return code: 21 (unable to verify the first certificate)---
   

2. Copy and paste the Server Certificate including the surrounding -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. Save the certificate into a new file. For example:

   /tmp/dadvmc0022.pem:
   
   -----BEGIN CERTIFICATE-----
   MIIB6zCCAZUCEItVMwHDFXAnYG//RoVbXQgwDQYJKoZIhvcNAQEEBQAweTELMAkG
   A1UEBhMCVVMxEDAOBgNVBAgTB015U3RhdGUxDzANBgNVBAcTBk15VG93bjEXMBUG
   A1UEChMOTXlPcmdhbml6YXRpb24xGTAXBgNVBAsTEEZPUiBURVNUSU5HIE9OTFkx
   EzARBgNVBAMTCkNlcnRHZW5DQUIwHhcNMDkwMzI5MjM0NDM0WhcNMjQwMzMwMjM0
   NDM0WjB5MQswCQYDVQQGEwJVUzEQMA4GA1UECBYHTXlTdGF0ZTEPMA0GA1UEBxYG
   TXlUb3duMRcwFQYDVQQKFg5NeU9yZ2FuaXphdGlvbjEZMBcGA1UECxYQRk9SIFRF
   U1RJTkcgT05MWTETMBEGA1UEAxYKZGFkdm1jMDAyMjBcMA0GCSqGSIb3DQEBAQUA
   A0sAMEgCQQCmxv+h8kzOc2xyjMCdPM6By5LY0Vlp4vzWFKmPgEytp6Wd87sG+YDB
   PeFOz210XXGMx6F/14/yFlpCplmazWkDAgMBAAEwDQYJKoZIhvcNAQEEBQADQQBn
   uF/s6EqCT38Aw7h/406uPhNh6LUF7XH7QzmRv3J1sCxqRnA/fK3JCXElshVlPk8G
   hwE4G1zxpr/JZu6+jLrW
   -----END CERTIFICATE-----
   

3. Import the certificate into the local JVM certificate store. You will need the keystore password. For example (the password is changeit):

   sudo /opt/java/jdk1.6.0_12/bin/keytool -import -alias dadvmc0022 -keystore /opt/java/jdk1.6.0_12/jre/lib/security/cacerts -trustcacerts -file /tmp/dadvmc0022.pem
   
   Enter keystore password: changeit Owner: CN=dadvmc0022, OU=FOR TESTING ONLY, O=MyOrganization, L=MyTown, ST=MyState, C=USIssuer: CN=CertGenCAB, OU=FOR TESTING ONLY, O=MyOrganization, L=MyTown, ST=MyState, C=USSerial number: -74aaccfe3cea8fd89f9000b97aa4a2f8Valid from: Sun Mar 29 16:44:34 PDT 2009 until: Sat Mar 30 16:44:34 PDT 2024Certificate fingerprints:       MD5:  94:F9:D2:45:7F:0D:E3:87:CF:2B:32:7C:BF:97:FF:50   SHA1: A8:A5:89:8B:48:9B:98:34:70:56:11:01:5C:14:32:AC:CB:18:FF:1F       Signature algorithm name: MD5withRSA    Version: 1Trust this certificate? [no]:  yesCertificate was added to keystore
   

4.2.3.1 Configuring Oracle Access Manager (OAM)

Oracle Access Manager provides flexible and extensible authentication and authorization, and provides audit services. This section provides the minimum requirements to configure OAM as a single sign-on (SSO) authentication provider and describes how to configure Oracle WebLogic Server and the Content Server application as the partner application participating in SSO.

• "Concepts and Topology"

• "Oracle WebLogic Server and Oracle UCM"

• "Oracle Internet Directory"

• "Install and Configure Oracle HTTP Server (OHS)"

• "Create an AccessGate Object on OAM Access Server"

• "Install a WebGate Client on Your OHS"

• "Create a Domain Policy in OAM"

• "Configure Oracle UCM Domain for OAM"

4.2.3.1.1 Concepts and Topology

The following concepts are important to configuring OAM:

• Access Server: A standalone server that provides authentication, authorization, and auditing services for AccessGates. There is one Access Server set up on OAM, which is done as part of the OAM install itself.

• WebGate: An out-of-the-box plug-in that intercepts Web resource (HTTP) requests and forwards them to the Access Server for authentication and authorization.

• Identity Assertion Provider (IAP): A type of authenticator that asserts the identity of the user based on some header information that is set by perimeter authentication. The OAM integration provides an OAMAuthenticator that can be configured as the OAM IAP. The OAMAuthenticator can be used for authentication or for identity assertion. For OAM SSO integration, the OAMAuthenticator should be configured as an Identity Assertion Provider (IAP), by specifying the obSSOCookie under Active Types in the provider's general settings.

• Content Server: Content management server also referred to as ECM, UCM, or CS.

Figure 4-1 shows the topology involved in setting up Content Server deployed on an Oracle WebLogic Server with OAM for single sign-on.

Figure 4-1 Oracle Access Manager Single Sign-On Topology

<Location /cs>
      SetHandler weblogic-handler
      WebLogicHost <ucm-hostname>
      WebLogicPort <ucm-server-port>
  </Location>

cd /tmp   mkdir bin.$$   cd bin.$$   cat > mount <<EOF   #! /bin/sh   exec /bin/true   EOF   chmod 755 mount
   export PATH=`pwd`:$PATH

LogoutServerUrl=/oamsso/logout.html?end_url=<$HttpBrowserFullWebRoot$>

4.2.3.2 Configuring Oracle Single Sign-On for Oracle UCM

To configure Oracle Single Sign-On (OSSO) for Oracle Universal Content Management (UCM), follow this procedure:

1. Install Oracle UCM.

2. Install Oracle Single Sign-On.

3. Start the Oracle WebLogic Server Admin server and navigate the Domain Structure to Security Realms, then myrealm.

4. Select myrealm from the Summary of Security Realms.

5. Select the Providers tab in the Settings for myrealm, then click New in the Authentication Providers list.

6. Select OSSOIdentityAsserter from the menu, then enter the name for the provider (for example, "MyAssertionProvider")

7. Click OK.

8. Return to the Providers tab in the Settings for myrealm screen, and select the provider you named (in this example, "MyAssertionProvider"). Change the control flag to REQUIRED.

9. Follow the instructions in "Configure Oracle UCM Domain for OAM".

10. Edit the mod_wl_ohs.conf file in OHS so the locations point to Oracle WebLogic Server:

    LoadModule weblogic_module ${ORACLE_HOME}/ohs/modules/mod_wl_ohs.so
    
    <ifModule mod_weblogic.c>
          Debug ON
          WLLogFile /tmp/weblogic.log
          MatchExpression
    
       <Location /cs>
       WebLogicHost wlshost.company.com
       WebLogicPort port-number
       SetHandler weblogic_handler
       </Location>
       </IfModule>
    

11. Register the OHS in OSSO. Go to ORACLE_HOME/sso/bin and run ssoreg.sh.

    ./ssoreg.sh -oracle_home_path
    <path_to_10.1.4 SSO_Oracle_Home> -site_name <any_site_name> 
    -config_mod_osso TRUE - mod_osso_url 
    <front-ending-OHSSHost:port> -
    update_mode CREATE -remote_midtier -
    config_file <path_where_osso.conf_will_get_generated>
    

    For example:

    ./ssoreg.sh _oracle_home_path
    /root/<domain>/OraHome -site_name wls_server
    -config_mod_osso TRUE -mod_osso_url
    http://<domain>.<company-name>.<suffix>:7777 -
    update_mode CREATE -remote_midtier -
    config_file /tmp/osso.conf
    

12. Edit the file mod_osso.conf (at ORACLE_HOME/ohs/conf/) to include the following code:

    LoadModule osso_module modules/mod_osso.so
    <IfModule mod_osso.c>
    
    OssoIdletimeout off
    OssoIpCheck on
    OssoConfigFile /tmp/osso.conf
    
    <IfModule mod_osso.c>
        OssoIpCheck off
        OssoIdleTimeout off
        OssoSecureCookies off
        OssoConfigFile
    /root/username/Oracle/ECM_version/osso.conf
    
           <Location /cs/groups>
           require valid-user
           AuthType Osso
           </Location>
    
           <Location /cs/idcplg>
           require valid-user
           AuthType Osso
           </Location>
    </IfModule>
    

    For the two Location settings in the code, as appropriate replace /cs/ with /ibr/ for Inbound Refinery, or /urm/ for Universal Records Management.

4.2.3.3 Configuring SSO with Microsoft Clients

Configuring Single Sign-On (SSO) with Microsoft clients requires configuring the Microsoft Active Directory, the client, and the Oracle WebLogic Server domain as described in the section “Configuring Single Sign-On with Microsoft Clients” in Oracle Fusion Middleware Security Oracle WebLogic Server.

In addition to that configuration, you must redeploy each Oracle UCM application (Content Server, Inbound Refinery, or Universal Records Management) that will be used in the Windows Native Authentication (WNA) environment, using an associated deployment plan. A deployment plan is an XML document, which Oracle provides for each of the three Oracle UCM applications. The plans are listed in the sections: Plan-cs.xml, Plan-ibr.xml, and Plan-urm.xml. You also can implement a deployment plan using the Oracle WebLogic Scripting Tool.

To redeploy Oracle UCM for a WNA environment:

1. Log in to the Oracle WebLogic Server Administration Console.

2. Click Deployments in the Domain Structure navigation tree.

3. On the Control tab, click Next until you see the Oracle UCM deployment you want to change:

   • Oracle Universal Content Management - Content Server

   • Oracle Universal Content Management - Inbound Refinery

   • Oracle Universal Records Management

4. Select the check box to the left of the deployment to be changed.

5. Click Update.

6. Under the Deployment plan path, select Change Path.

7. Navigate to and select the appropriate plan file:

   • plan-cs.xml (for Content Server)

   • plan-ibr.xml (for Inbound Refinery)

   • plan-urm.xml (for Universal Records Management)

8. Verify that Redeploy this application using the following deployment files is selected.

9. Click Next.

10. Click Finish.

Plan-cs.xml

Use the provided plan-cs.xml file, or create an .xml file and name it plan-cs.xml.

<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan
    xmlns="http://xmlns.oracle.com/weblogic/deployment-plan"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd"
    global-variables="false">
  <application-name>cs.ear</application-name>
  <variable-definition>
    <variable>
      <name>url-pattern</name>
      <value>/*</value>
    </variable>
   <variable>
      <name>http-only</name>
      <value>false</value>
    </variable>
  </variable-definition>
  <module-override>
    <module-name>cs.war</module-name>
    <module-type>war</module-type>
    <module-descriptor external="false">
      <root-element>web-app</root-element>
      <uri>WEB-INF/web.xml</uri>
      <variable-assignment>
      <name>url-pattern</name>     <xpath>/web-app/security-constraint/[display-name="UCMConstraint"]/web-resource-collection/[web-
resource-name="idcauth"]/url-pattern</xpath>
        <operation>replace</operation>
      </variable-assignment>
    </module-descriptor>
    <module-descriptor external="false">
      <root-element>weblogic-web-app</root-element>
      <uri>WEB-INF/weblogic.xml</uri>
      <variable-assignment>
        <name>http-only</name>
        <xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
      </variable-assignment>
    </module-descriptor>
  </module-override>
</deployment-plan>

Plan-ibr.xml

Use the provided plan-ibr.xml file, or create an .xml file and name it plan-ibr.xml.

<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan xmlns="http://xmlns.oracle.com/weblogic/deployment-plan" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation= "http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd" global-variables="false">
  <application-name>ibr.ear</application-name>
  <variable-definition>
    <variable>
      <name>url-pattern</name>
      <value>/*</value>
    </variable>
   <variable>
      <name>http-only</name>
      <value>false</value>
    </variable>
  </variable-definition>
  <module-override>
    <module-name>ibr.war</module-name>
    <module-type>war</module-type>
    <module-descriptor external="false">
      <root-element>web-app</root-element>
      <uri>WEB-INF/web.xml</uri>
      <variable-assignment>
      <name>url-pattern</name>
<xpath>/web-app/security-constraint/[display-name="UCMConstraint"]/web-resource-collection/[web-
resource-name="idcauth"]/url-pattern</xpath>
        <operation>replace</operation>
      </variable-assignment>
    </module-descriptor>
    <module-descriptor external="false">
      <root-element>weblogic-web-app</root-element>
      <uri>WEB-INF/weblogic.xml</uri>
      <variable-assignment>
        <name>http-only</name>
        <xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
      </variable-assignment>
    </module-descriptor>
  </module-override>
</deployment-plan>

Plan-urm.xml

Use the provided plan-urm.xml file, or create an .xml file and name it plan-urm.xml.

<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan 
    xmlns="http://xmlns.oracle.com/weblogic/deployment-plan"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd" 
    global-variables="false">
  <application-name>urm.ear</application-name>
  <variable-definition>
    <variable>
      <name>url-pattern</name>
      <value>/*</value>
    </variable>
   <variable>
      <name>http-only</name>
      <value>false</value>
    </variable>
  </variable-definition>
  <module-override>
    <module-name>urm.war</module-name>
    <module-type>war</module-type>
    <module-descriptor external="false">
      <root-element>web-app</root-element>
      <uri>WEB-INF/web.xml</uri>
      <variable-assignment>
      <name>url-pattern</name>
<xpath>/web-app/security-constraint/[display-name="UCMConstraint"]/web-resource-collection/[web-
resource-name="idcauth"]/url-pattern</xpath>
        <operation>replace</operation>
      </variable-assignment>
    </module-descriptor>
    <module-descriptor external="false">
      <root-element>weblogic-web-app</root-element>
      <uri>WEB-INF/weblogic.xml</uri>
      <variable-assignment>
        <xpath>/weblogic-web-app/session-descriptor/cookie-http-only</xpath>
      </variable-assignment>
    </module-descriptor>
  </module-override>
</deployment-plan>