24 Configuring the Identity Store

24.3.1 Adding Users to the Identity Store Using the WLS Administration Console

To add users to the embedded LDAP identity store from the WebLogic Server Administration Console:

1. Log in to the WebLogic Server Administration Console.

   For information on logging into the WebLogic Server Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console."

2. In the Domain Structure pane (see Figure 24-9), click Security Realms.

   Figure 24-9 Domain Structure Pane

   
   Description of "Figure 24-9 Domain Structure Pane"
   
   

   The Summary of Security Realms pane displays (see Figure 24-10).

   Figure 24-10 Summary of Security Realms pane

   
   Description of "Figure 24-10 Summary of Security Realms pane"
   
   

3. In the Name column, click the realm to which you want to add users.

   The Realm Settings pane displays (see Figure 24-11).

   Figure 24-11 Realm Settings Pane

   
   Description of "Figure 24-11 Realm Settings Pane"
   
   

4. Click the Users and Groups tab to display the list of current users.

5. Click New to add a new user.

   Figure 24-12 Create a New User Page

   
   Description of "Figure 24-12 Create a New User Page"
   
   

6. On the Create a New User page, enter the new user login name in the Name field.

   User names are case sensitive and must be unique. Do not use commas, tabs or any other characters in the following comma-separated list:

   < >, #, |, &, ?, ( ), { }

7. In the Description field, enter a description for the user (for example, the user's full name).

8. From the Provider drop-down menu, select DefaultAuthenticator.

9. In the Password field, enter a password for the user.

   The minimum password length for a user defined in the WebLogic Authentication provider is 8 characters (note that other LDAP providers may have different requirements for the password length). Do not use user name/password combinations such as weblogic/weblogic in a production environment.

10. Reenter the password in the Confirm Password field.

11. Click OK to save your changes and add the user.

    The user should now appear in the list of users.

24.3.2 Adding Users to the Identity Store Using an LDIF File

You can add users directly to the embedded LDAP identity store using an LDIF file. Using an LDIF file enables you to specify additional user attributes that are not available through the WebLogic Server Administration Console.As the embedded LDAP server is a conformant LDAP server, you can use LDAP commands to add or modify users. You can also search the directory, which is useful when exporting and importing user accounts.

To add users to the embedded LDAP using an LDIF file you must perform the following tasks:

• Enable External LDAP Access

• Create an LDIF File

• Add the Users

Enable External LDAP Access

When WebLogic Server is installed, the LDAP access credential is set as a randomized value and encrypted in the config.xml file. To enable external LDAP access, you must reset the access credential for the embedded LDAP.

To reset the access credential for the embedded LDAP:

1. Log in to the WebLogic Server Administration Console.

   For information on logging into the WebLogic Server Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console."

2. In the Domain Structure pane (see Figure 24-13), click wc_domain.

   Figure 24-13 Domain Structure Pane (wc_domain)

   
   Description of "Figure 24-13 Domain Structure Pane (wc_domain)"
   
   

3. In the Settings pane for wc_domain, click the Security tab, and then click the Embedded LDAP tab.

   The Settings Pane for wc_domain displays the embedded LDAP settings (see Figure 24-14).

   Figure 24-14 Settings Pane with Embedded LDAP Settings

   
   Description of "Figure 24-14 Settings Pane with Embedded LDAP Settings"
   
   

4. Enter a new password in the Credential field, and reenter it in the Confirm Credential field.

5. Click Save to save your settings.

6. Restart the WebLogic server.

   After this, you are ready to access the LDAP server with the following values:

   • the DN value for admin access is "cn=Admin"

   • the password is the value you entered in the Credential field

   • the port is the same as the admin port, which by default is 7001

Create an LDIF File

You can create an LDIF file with any text editor, and can include any attributes appropriate for the embedded LDAP directory. The objectclasses that are supported by default in the embedded LDAP server for WebLogic Server are the following:

• person

• inetOrgPerson

• organizationalPerson

• wlsUser

In order to interact successfully with the embedded LDAP server, you should understand the default layout of the directory information tree (DIT). The default layout in the embedded LDAP directory is shown in Figure 24-15.

Figure 24-15 Embedded LDAP Directory Information Tree

Description of "Figure 24-15 Embedded LDAP Directory Information Tree"

The following example shows an LDIF file with the attributes that are displayed in WebCenter Spaces user profile screens:

dn: uid=john.doe,ou=people,ou=myrealm,dc=wc_domain
description: John Doe
cn: john.doe
uid: john.doe
sn: Doe
objectclass: wlsUser
objectclass: organizationalperson
objectclass: inetOrgPerson
objectclass: person
objectclass: top
userpassword: welcome1
displayName: John Doe
employeeNumber: 12345
employeeType: Regular
givenName: John
homePhone: 650-555-1212
mail: john.doe@example.com
title: Manager
manager: uid=mary.jones,ou=people,ou=myrealm,dc=wc_domain
preferredLanguage: en
departmentNumber: tools
facsimiletelephonenumber: 650-555-1200
mobile: 650-500-1200
pager: 650-400-1200
telephoneNumber: 650-506-1212
postaladdress: 200 Oracle Parkway
l: Redwood Shores
homepostaladdress: 123 Main St., Anytown 12345

To create a file with multiple user entries, just replicate the above lines as many times as required, with a blank line between entries.

Add the Users

The example below uses the ldappadd command, a part of the LDAP command line utilities provided with the Oracle Internet Directory server. For more information about using the ldappadd command, see "Oracle Internet Directory Data Management Tools" in the Oracle Fusion Middleware User Reference for Oracle Identity Management.

ldapadd -h weblogichost.example.com -p 7001 -D cn=Admin -w password -v -f newuser.ldif
 
add description:
        John Doe
add cn:
        john.doe
add uid:
        john.doe
add sn:
        Doe
add objectclass:
        wlsUser
        organizationalperson
        inetOrgPerson
        person
        top
add userpassword:
        password
add displayname:
        John Doe
add employeenumber:
        12345
add employeetype:
        Regular
add givenname:
        John
add homephone:
        650-555-1212
add mail:
        john.doe@example.com
add title:
        Manager
add manager:
        uid=mary.jones,ou=people,ou=myrealm,dc=wc_domain
add preferredlanguage:
        en
add departmentnumber:
        tools
add facsimiletelephonenumber:
        650-555-1200
add mobile:
        650-500-1200
add pager:
        650-400-1200
add telephonenumber:
        650-506-1212
add postaladdress:
        200 Oracle Parkway
add l:
        Redwood Shores
add homepostaladdress:
        123 Main St., Anytown 12345
adding new entry uid=john.doe,ou=people,ou=myrealm,dc=wc_domain
modify complete

24.5.1 Migrating the WebCenter Discussions Server to Use an External LDAP

If you've installed Oracle WebCenter Discussions Server and choose not to move the administrator account to an external LDAP (as described in Section 24.5, "Moving the Administrator Account to an External LDAP Server"), you must perform some additional steps to identify the new administrator account for the discussions server prior to reordering the authenticators on the WebLogic Server:

1. Select a user account from the external LDAP to be the administrator for the discussions server.

2. Create an administrator account in the DefaultAuthenticator (that is, the embedded LDAP) that matches the one you selected from the external LDAP. The account names in the embedded LDAP and the external LDAP server must be the same.

   For information about adding users to the embedded LDAP, see Section 24.3, "Adding Users to the Embedded LDAP Identity Store."

3. Log in to the Oracle WebCenter Discussions Server Admin Console with the boot-identity account (that is, weblogic) at:

   http://host:port/owc_discussions/admin
   

   Where host and port are the host ID and port number of the WLS_Services managed server.

4. Click Settings > Admins/Moderators.

   The Admins & Moderators page displays (see Figure 24-16).

   Figure 24-16 Admins & Moderators Page

   
   Description of "Figure 24-16 Admins & Moderators Page"
   
   

5. Click Grant New Permissions.

   The Grant New Permissions pane displays (see Figure 24-17).

   Figure 24-17 Grant New Permissions Pane

   
   Description of "Figure 24-17 Grant New Permissions Pane"
   
   

6. Grant System Admin privileges to the user you created, as shown in Figure 24-18.

   Figure 24-18 Grant New Permissions Pane with New User

   
   Description of "Figure 24-18 Grant New Permissions Pane with New User"
   
   

7. Click System > System Properties.

   The Jive Properties page displays (see Figure 24-19).

   Figure 24-19 Jive Properties Page

   
   Description of "Figure 24-19 Jive Properties Page"
   
   

8. Check that the properties marked in red have been added and are set as shown in Figure 24-20.

9. Log in to the WebLogic Server Administration Console.

   For information on logging in to the WebLogic Server Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console."

10. In the Domain Structure pane (see Figure 24-20), click Security Realms.

    Figure 24-20 Domain Structure Pane

    
    Description of "Figure 24-20 Domain Structure Pane"
    
    

    The Summary of Security Realms pane displays (see Figure 24-21).

    Figure 24-21 Summary of Security Realms pane

    
    Description of "Figure 24-21 Summary of Security Realms pane"
    
    

11. In the Name column, click the realm for which you want to change the administrator group name.

    The Realm Settings pane displays (see Figure 24-22).

    Figure 24-22 Realm Settings Pane

    
    Description of "Figure 24-22 Realm Settings Pane"
    
    

12. Select the Providers tab and the Authentication sub-tab, and reorder the authentication providers so that the authenticator for the external LDAP appears at the top of the list as shown in the example in Figure 24-23:

    Figure 24-23 Providers Tab with Reordered Authentication Providers

    
    Description of "Figure 24-23 Providers Tab with Reordered Authentication Providers"
    
    

13. Restart the domain Administration Server and discussions server.

24.5.2 Changing the Administrator Group Name

You can change the group name to any other valid enterprise role in your LDAP server that contains users authorized to manage the domain. This lets you delegate the administration of specific domains in your enterprise. You can create various administration groups in the directory and have the corresponding domains be configured to use the appropriate group for defining its administrators.

The following example LDIF file creates an administrative group in Oracle Internet Directory:

dn: cn=wc_domain_Admin,cn=groups,dc=example,dc=com
cn: wc_domain_Admin
uniquemember: cn=joe.admin,cn=users,dc=example,dc=com
owner: cn=orcladmin
displayname: WebLogic Administrators Group
description: WebLogic Administrators Group
objectclass: orclgroup
objectclass: groupofuniquenames

Once this group is created, you must update the role definition for the WebLogic Server global Admin role using the WebLogic Server Administration Console.

To update the role definition for the WebLogic Server global Admin role:

1. Log in to the WebLogic Server Administration Console.

   For information on logging into the WebLogic Server Administration Console, see Section 1.12.2, "Oracle WebLogic Server Administration Console."

2. In the Domain Structure pane (see Figure 24-24), click Security Realms.

   Figure 24-24 Domain Structure Pane

   
   Description of "Figure 24-24 Domain Structure Pane"
   
   

   The Summary of Security Realms pane displays (see Figure 24-25).

   Figure 24-25 Summary of Security Realms pane

   
   Description of "Figure 24-25 Summary of Security Realms pane"
   
   

3. In the Name column, click the realm for which you want to change the administrator group name.

   The Realm Settings pane displays (see Figure 24-26).

   Figure 24-26 Realm Settings Pane

   
   Description of "Figure 24-26 Realm Settings Pane"
   
   

4. Open the Roles and Policies tab, and then the Realm Roles subtab.

   The Realm Roles settings pane displays (see Figure 24-27).

   Figure 24-27 Realm Roles Settings Pane

   
   Description of "Figure 24-27 Realm Roles Settings Pane"
   
   

5. Expand the Global Roles node, and then the Roles node.

6. Click View Role Conditions for the Admin role.

   The Edit Global Role page displays (see Figure 24-28).

   Figure 24-28 Edit Global Role Page

   
   Description of "Figure 24-28 Edit Global Role Page"
   
   

   By default, the Administrators group in Oracle Internet Directory (or other configured identity store) defines who has the administrator role in WebLogic Server.

7. Click Add Conditions to add a different group name.

   The Edit Global Role - Predicate List page displays (see Figure 24-29).

   Figure 24-29 Edit Global Role Page - Predicate List

   
   Description of "Figure 24-29 Edit Global Role Page - Predicate List"
   
   

8. Select Group from the Predicate List list and click Next.

   The Edit Global Role - Arguments page displays (see Figure 24-30).

   Figure 24-30 Edit Global Role Page - Arguments

   
   Description of "Figure 24-30 Edit Global Role Page - Arguments"
   
   

9. Enter the name for the new administrator group and click Add.

10. Select the pre-existing administrator group and click Remove to delete it leaving the new one you've selected in its place.

11. Click Finish to save your changes.

    After making this change, any members of the new group specified are authorized to administer WebLogic Server.

24.6.1 Granting the WebCenter Spaces Administrator Role Using Fusion Middleware Control

This section describes how to grant the WebCenter Spaces administrator role to a user account other than the default "weblogic" account.

To grant the WebCenter Spaces Administrator role using Fusion Middleware Control:

1. Log into Fusion Middleware Control and select the WebLogic domain for WebCenter Spaces.

   For information on logging into Fusion Middleware Control, see Section 6, "Starting Enterprise Manager Fusion Middleware Control."

2. From the WebLogic Domain menu, select Security -> Application Roles.

   The Application Roles page displays (see Figure 24-31).

   Figure 24-31 Application Roles Page

   
   Description of "Figure 24-31 Application Roles Page"
   
   

3. Search for the Administration application role by selecting the Application name for WebCenter Spaces (WLS_Spaces/webcenter), and providing the following internal identifier used by WebCenter Spaces as the Role Name:

   s8bba98ff_4cbb_40b8_beee_296c916a23ed#-#Administrator
   

   The search should return s8bba98ff_4cbb_40b8_beee_296c916a23ed#-#Administrator, which is the administrator role identifier.

4. Click the administrator role name (s8bba98ff_4cbb_40b8_beee_296c916a23ed#-#Administrator) in the Role Name column.

   The Edit Application Role page displays (see Figure 24-32).

   Figure 24-32 Edit Application Role Page

   
   Description of "Figure 24-32 Edit Application Role Page"
   
   

5. Click Add User.

   The Add User pop-up displays (see Figure 24-33).

   Figure 24-33 Add User Pop-up

   
   Description of "Figure 24-33 Add User Pop-up"
   
   

6. Use the Search function to search for the user to assign the Administrator role to.

7. Use the arrow keys to move the user from the Available Users column to the Selected Users column, and click OK.

8. On the Edit Application Role page, click OK.

9. To remove the weblogic role, on the Edit Application Role page under Users, click weblogic and the click Delete.

10. Restart the WLS_Spaces managed server.

    When you login to WebCenter Spaces, the Administration link should appear and you should be able to perform all administrator operations. See also, Section 32.1, "Logging into WebCenter Spaces as an Administrator."

24.6.2 Granting the WebCenter Spaces Administrator Role Using WLST

To grant the WebCenter Administrator role using WLST:

1. Start WLST as described in Section 1.12.3.1, "Running Oracle WebLogic Scripting Tool (WLST) Commands."

2. Connect to the WebCenter Spaces Administration Server for the target domain with the following command:

   connect('user_name','password, 'host_id:port')
   

   Where:

   • user_name is the name of the user account with which to access the Administration Server (for example, weblogic)

   • password is the password with which to access the Administration Server

   • host_id is the host ID of the Administration Server

   • port is the port number of the Administration Server (for example, 7001).

3. Grant the WebCenter Spaces administrator application role to the user in Oracle Internet Directory using the grantAppRole command as shown below:

   grantAppRole(appStripe="webcenter", appRoleName="s8bba98ff_4cbb_40b8_beee_296c916a23ed#-#Administrator",
   principalClass="weblogic.security.principal.WLSUserImpl", principalName="wc_admin")
   

   Where wc_admin is the name of the administrator account to create.

4. To test the new account, log into WebCenter Spaces using the new account name.

   The Administration link should appear, and you should be able to perform all administrator operations. See also, Section 32.1, "Logging into WebCenter Spaces as an Administrator."

5. After granting the WebCenter Spaces Administrator role to new accounts, remove this role from accounts that no longer need it or should no longer have it using the WLST revokeAppRole command. For example, if WebCenter Spaces was installed with a different administrator user name than "weblogic", the administrator role should be given to that user and should be revoked from the default "weblogic".

   revokeAppRole(appStripe="webcenter", appRoleName="s8bba98ff_4cbb_40b8_beee_296c916a23ed#-#Administrator", 
   principalClass="weblogic.security.principal.WLSUserImpl", principalName="weblogic")