34 Managing Users and Roles for WebCenter Spaces

34.1.1 Understanding Users

A WebCenter user is an member of WebCenter Spaces—provisioned directly from an existing identity store. See also, Section 24.3, "Adding Users to the Embedded LDAP Identity Store."

All users in the identity store are assigned minimal WebCenter Spaces privileges through the Spaces-User role. The only exception is the Fusion Middleware Administrator (weblogic). Out-of-the-box, the Fusion Middleware Administrator is the only user assigned full administrative privileges through the Administrator role. For more information, read the next section Section 34.1.2.1, "Default Application Roles".

It is the Fusion Middleware Administrator's job to assign each WebCenter user an appropriate application role. Alternatively, the Fusion Middleware Administrator may choose to assign the Administrator role to another user and delegate this responsibility.

WebCenter Spaces supports self-registration. When new WebCenter users self-register, they create their own login and password and a new user account is created in the identity store. See also, Section 34.4, "Allowing Self-Registration".

34.1.2 Understanding Application Roles

Application roles control the level of access a user has to information and services in WebCenter Spaces. Specifically, application roles determine what a user can see and do in their personal space.

Application role assignment is the responsibility of the WebCenter Spaces administrator. Administrators can assign users a default application role or create additional, custom roles specific to their WebCenter Spaces application. For more detail, see:

• Default Application Roles

• Custom Application Roles

Application roles only apply while a user is working within their personal space. Within a particular group space a different set of roles and permissions apply and it is the group space moderator's responsibility to determine suitable role assignments for each of its members. See also "Managing Group Space Roles and Permissions" in Oracle Fusion Middleware User's Guide for Oracle WebCenter.

34.1.3 Understanding Application Permissions

Every application role has specific, defined capabilities known as permissions. These permissions allow individuals to perform specific actions in their personal space. Permissions are categorized as follows and listed individually in the subsequent tables:

• Application

• Group Spaces

• Group Space Templates

• Pages

• Discussions

• Links

• People Connections

With a particular category, the Manage permission (such as Group Spaces-Manage) contains all other permissions (for example, Group Spaces-Configure and Group Spaces-View). No permission, except Manage, inherits privileges from other permissions.

34.1.4 Understanding Discussions Server Role and Permission Mapping

WebCenter Spaces uses application roles to manage user permissions in personal spaces and group space roles to manage user permissions with a group space. On the Oracle WebCenter Discussions server, a different set of roles and permissions apply.

Users who are working with discussions and announcements in WebCenter Spaces automatically map to the appropriate Oracle WebCenter Discussions server role, see Table 34-4 and Table 34-5.

Any user assigned the Application-Discussions-Manage permission in WebCenter Spaces is automatically added to Oracle WebCenter Discussions and assigned the Administrator role with the Category Admin permission. Out-of-the box, WebCenter Spaces assigns the Application-Discussions-Manage permission to the Administrator role only, as shown in Figure 34-1.

Figure 34-1 Application Roles - Default Discussion Permissions

Similarly, in group spaces, any member assigned the Discussions-Manage, Discussions-Edit, or Discussion-View permission is granted the corresponding permissions on the Oracle WebCenter Discussions server. Out-of-the box, discussion and announcement permissions for the default group space roles Moderator, Participant, and Viewer, are as shown in Figure 34-2.

Figure 34-2 Group Space Roles - Default Discussion Permissions

34.1.5 Understanding Group Space Roles and Permissions

Application roles and permissions only apply when users are working in their personal space. Within a particular group space, a different set of roles and permissions apply and it is the group space moderator's responsibility to determine suitable role assignments for each of its members. For details, see "Managing Group Space Roles and Permissions" in Oracle Fusion Middleware User's Guide for Oracle WebCenter.

34.2.1 What You Need to Know About Managing Users

From the Users and Groups page (Figure 34-3), administrators can manage application roles for all the users who have access to WebCenter Spaces, that is, all users defined in the identity store. From here, you can change user role assignments, grant administrative privileges, and revoke user permissions.

Only users granted special (nondefault) application privileges appear in this table. Initially, all users in the WebCenter Spaces identity store are assigned minimal privileges through the Spaces-User role. Users with the default Spaces-User role are not listed here.

See also, Section 24.3, "Adding Users to the Embedded LDAP Identity Store."

Figure 34-3 WebCenter Administration - Users Page

34.2.2 Assigning Users (and Groups) to Roles

Initially, all users in the WebCenter Spaces identity store are assigned minimal privileges through the Spaces-User role. You can assign individual users (or multiple users in the same enterprise group) to a different application role through WebCenter Spaces Administration.

Updates in your back-end identity store, such as new users or someone leaving an enterprise group, are automatically reflected in WebCenter Spaces. Initially, when you assign an enterprise group to a WebCenter Spaces role, everyone in the enterprise group is granted that role. If someone moves out of the group, the role is revoked. If someone joins the group, they are granted the role.

To assign a user (or a group of users) to a different application role:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the Security tab.

4. Click the Users and Groups tab (Figure 34-3).

   This page lists WebCenter users to which additional roles are defined.

5. Choose User or Group from the drop down.

   Select User to grant permissions to one or more users defined in the identity store. Select Group to grant permissions to groups of users.

6. If you know the exact name of the user or group, enter the name in the box provided, separating multiple names with a comma.

   If you are not sure of the name you can search your identity store:

   1. Click the Find icon (Figure 34-4).

      Figure 34-4 Find Icon

      
      

      The Find User (or Find Group) dialog box opens (Figure 34-5).

      Figure 34-5 Finding Users and Groups in the identity store

      
      

   2. Enter two or more characters that appear in the name you are looking for.

   3. Click the Search icon.

      Users (or groups) matching your search criteria display in the Select User dialog box. The search is case-sensitive.

   4. Select one or more names from the list.

      To assign roles to multiple users or groups, multi-select all the names required. Ctrl-Click rows to select multiple names.

      Note:

      Nested enterprise groups must be added explicitly. Groups that are nested within a group hierarchy do not automatically inherit the same permissions as the parent group.

   5. Click OK.

      The names that you select are display on the User and Groups tab.

7. To assign a role, select a Role from the drop down (Figure 34-6).

   Figure 34-6 Assigning a User Role

   
   

   Select an appropriate role for the selected users (or groups). Only choose Administrator to assign full, administrative privileges for WebCenter Spaces.

   If the role you want is not listed, create a new role that meets your requirements (see Section 34.3.2, "Defining Application Roles").

   When no role is selected, the user assumes the Spaces-User role. See Section 34.1.2.1, "Default Application Roles".

8. Click Grant Access.

User's names and new role assignment display in the table.

34.2.3 Assigning a User to a Different Role

From time to time, a user's role in WebCenter Spaces may change. For example, a user may move out of sales into the finance department and in this instance, the user's role assignment may change from Sales to Finance.

To assign a user to a different role:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the Security tab.

4. Click the Users and Groups tab.

5. In the Manage Existing Grants table, scroll down to the user you want.

   Only users with nondefault role assignments are listed in the table. If the user you want is not listed, grant the role required as described in Section 34.2.2, "Assigning Users (and Groups) to Roles".

6. Click the Actions icon, then choose Change Role from the drop down list.

   The Change Role dialog box opens (Figure 34-7).

   Figure 34-7 Changing a User's Application Role

   
   

7. Select roles as follows:

   • Select Administrator to assign full, administrative privileges for WebCenter Spaces.

   • Select select one or more roles from the list available.

     If the role you want is not listed, create a new role that meets your requirements (see Section 34.3.2, "Defining Application Roles").

     At least one role must be selected. To revoke all role assignments, reverting user permissions to the default Spaces-User role, see Section 34.2.5, "Revoking Application Roles".

8. Click OK.

New role assignments display in the table.

34.2.4 Giving a User Administrative Privileges

It is easy to give a user full, administrative privileges for WebCenter Spaces through the Administrator role. Administrators have the highest privilege level and can view and modify anything in WebCenter Spaces so take care when assigning the Administrator role.

Some administrative tasks are exclusive to the Administrator role and cannot be performed by granting the Application-Manage permission. These tasks include editing the login page, the self-registration page, and profile gallery pages.

To give a user administrative privileges:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the Security tab.

4. Click the Users and Groups tab.

   The Role column indicates which users already have full administrative privileges through the Administrator role.

5. In the Manage Existing Grants table, scroll down to the user you want.

   Only users with nondefault role assignments are listed in the table. If the user you want is not listed, follow steps in Section 34.2.2, "Assigning Users (and Groups) to Roles" to grant the Administrator role.

6. Click the Actions icon, then choose Change Role from the drop down list.

   The Change Role dialog box opens (Figure 34-7).

   Figure 34-8 Changing a User's Application Role

   
   

7. Select Administrator to assign full, administrative privileges for WebCenter Spaces.

8. Select OK.

The new role assignment displays in the table.

34.2.5 Revoking Application Roles

It is easy to revoke application role assignments that no longer apply. You can revoke roles individually or revoke all application roles assigned to a particular user at once.

Revoking all a user's application roles does not remove that user from the identity store and the user still has access to WebCenter Spaces through the default Spaces-User role.

To revoke application roles:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the Security tab.

4. Click the Users and Groups tab.

5. In the Manage Existing Grants table, scroll down to the user you want.

6. Click the Actions icon:

   • Choose Change Role icon to revoke one or more, specific application roles. See also Section 34.2.3, "Assigning a User to a Different Role".

   • Choose Delete Role Assignments to revoke all roles assigned to that user, and then click Delete when asked for confirmation.

   Access for that user is revoked immediately.

When you delete all the roles assigned to a particular user, the user is no longer listed on the Users page. The user remains in the identity store and still has access to WebCenter Spaces through the Spaces-User role. See Section 34.1.2.1, "Default Application Roles".

34.2.6 Adding or Removing Users

WebCenter Spaces administrators cannot add new user data directly to the WebCenter Spaces identity store or remove user credentials. Identity store management is the responsibility of the systems administrator and takes place through the WLS Administration Console or directly into embedded LDAP identity stores using LDAP commands. See also, Section 24.3, "Adding Users to the Embedded LDAP Identity Store."

WebCenter Spaces administrators can, however, enable self-registration for the application. Through self-registration, invited and uninvited users can create their own login and password for WebCenter Spaces. A user who self registers is immediately and automatically granted access to WebCenter Spaces and a new user account is created in the identity store. See also, Chapter 34, "Allowing Self-Registration".

34.3.1 What You Need to Know About Application Roles and Permissions

From the Roles page (Figure 34-9), administrators can manage application roles and permissions. From here, you can edit the permissions assigned to an application role, create new application roles, or delete unused roles.

Figure 34-9 WebCenter Administration - Roles Page

Application roles apply when a user is working within their personal space. A different set of roles and permissions apply when a user is working within a particular group space. It is the group space moderator's responsibility to determine suitable role assignments for each of its group space members. See also "Managing Group Space Roles and Permissions" in Oracle Fusion Middleware User's Guide for Oracle WebCenter.

WebCenter Spaces provides several default application roles. You cannot delete default application roles but you can modify the default permission assignments for each role. For more information, see Section 34.1, "Understanding Users, Roles, and Permissions".

34.3.2 Defining Application Roles

Use roles to characterize groups of WebCenter users and determine what they can see and do in their personal spaces.

When defining application roles, use self-descriptive role names and try to keep the role policy as simple as possible. Choose as few roles as you can, while maintaining an effective policy.

Take care to assign appropriate access rights when assigning permissions for new roles. Do not allow users to perform more actions than are necessary for the role but at the same time, try not to inadvertently restrict them from activities they must perform. In some cases, users might fall into multiple roles.

To define a new application role:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the Security tab.

4. Click the Roles tab.

   Current application roles for WebCenter Spaces display as columns in the table.

5. Click Create Role to define a new role for WebCenter users.

   Figure 34-10 Creating a New Role

   
   

6. Enter a suitable name for the role.

   Ensure the role names that are self-descriptive. Make it as obvious as possible which users should belong to which roles. Role names cannot include special characters or whitespace.

7. (Optional) Choose a Template Role.

   The new role inherits permissions from the template role. You can modify these permissions in the next step.

   Choose Administrator to create a role that inherits full, administrative privileges. Conversely, choose Public-User to create a role that typically provides minimal privileges. Alternatively, choose a custom application role to be your template.

8. Click OK.

   The new role appears as a column in the table. The permissions list shows which actions users with this role can perform.

9. To modify user permissions for the role, select or clear each permission check box.

10. Click Apply to save any changes that you make to the role's permissions.

34.3.3 Modifying Application Role Permissions

Administrators can modify the permissions associated with application roles at any time. Application permissions are described in Section 34.1.3, "Understanding Application Permissions".

Application role permissions allow individuals to perform specific actions in their personal space. With a particular category, the Manage permission (such as Group Spaces-Manage) contains all other permissions (for example, Group Spaces-Configure and Group Spaces-View).

To change the permissions assigned to a role:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the Security tab.

4. Click the Roles tab.

5. Select or clear Permissions check boxes to enable or disable permissions for a role.

6. Click Apply to save.

The new permissions are effective immediately.

34.3.4 Granting Permissions to the Public-User

Anyone who is not logged in to WebCenter Spaces assumes the Public-User role. Out-of-the-box, the Public-User role is granted minimal privileges, that is, the Application-View permissions only.

Granting the Application-View Permission

The Application-View permission allows unauthenticated users to see public WebCenter Spaces application pages, such as the welcome page, and also content that individual WebCenter users choose to make public.

When Application-View permissions are granted to the Public-User role:

• Ensure that your WebCenter users understand that any personal page or personal content they choose to make public will become accessible to unauthenticated users outside of the WebCenter Spaces community, that is, anyone with Web access.

• Consider customizing the default welcome page that displays to public users before they login. See Section 35.3.1, "Customizing the Public Welcome Page".

If you do not want unauthenticated users to see WebCenter Spaces content that is marked 'public', do not grant the Application-View permission to the Public-User role. When public access is disabled, public content cannot be seen by unauthenticated users. Also, the welcome page for WebCenter Spaces is not displayed; public users are directed straight to a login page. Administrators may customize the default login page, if required. See Section 35.3.2, "Customizing the Login Page".

Granting Other Permissions

Be careful when assigning permissions to the Public-User role. For security reasons, Oracle recommend that you limit what anonymous users can see and do in WebCenter Spaces.

34.3.5 Granting Permissions to the Spaces-User

Anyone who is logged in to WebCenter Spaces assumes the Spaces-User role. Out-of-the-box, the Spaces-User role is granted minimal privileges, that is, the Application-View, Group Space-Create, Group Space Templates-Create, Pages-Create, Profiles-Edit permissions only.

Note that the Spaces-User role always inherits permissions from the Public-User role.

34.3.6 Deleting Application Roles

When an application role is no longer required you should remove it from WebCenter Spaces. This helps maintain a valid role list, and prevents inappropriate role assignment.

Application roles are deleted even when users are still assigned to the them. As you cannot delete any default roles, WebCenter users will always have the Spaces-User role.

To delete an application role:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the Security tab.

4. Click the Roles tab.

5. Select the Delete Role icon next to the role you want to delete (Figure 34-11).

   Figure 34-11 Deleting an Application Role

   
   

6. Click OK to confirm that you want to delete the role.

   The role is removed from the table. Any users assigned to this role only, assume the default Spaces-User role and do not display on the Users tab.

34.4.1 Enabling Self-Registration By Invitation-Only

Out-of-the-box, only existing WebCenter users are candidates for group space membership. While this might meet the needs of most WebCenter Spaces applications it is likely that some group spaces will want to recruit members outside of the WebCenter Spaces community.

The WebCenter Spaces administrator can extend group space membership to users outside of WebCenter Spaces by allowing them to self-register on an invitation-only basis. When this facility is enabled, group space moderators can invite anyone to join their group space by sending them a customizable invitation by mail. The invitation includes a secure, self-registration URL which the invited party clicks to accept group space membership.

New members recruited in this way must create an account with WebCenter Spaces before gaining access to the group space. Users who self-register by invitation are added to the identity store, and to the group space member list.

To allow external users to join group spaces:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the General tab.

4. Select Allow Self-Registration Through Invitations (Figure 34-12).

   When you deselect this option, only existing WebCenter users are candidates for group space membership.

   Figure 34-12 Allowing Self-Registration Through Invitations

   
   

5. Click Apply.

Group space moderators may invite non-WebCenter users to become members of their group space. See "Inviting a Non-WebCenter Spaces User" in Oracle Fusion Middleware User's Guide for Oracle WebCenter.

34.4.2 Enabling Anyone to Self-Register

When anyone is allowed to self-register, that is any public user, a Register link displays in the top right corner of the application or a Register button displays below the WebCenter Spaces login form (Figure 34-13).

Figure 34-13 Self-Registration Available on Login Form

New users must create an account before gaining access to the WebCenter Spaces application.

Users who self-register are added directly to the WebCenter Spaces identity store and assigned the Spaces-User application role. Out-of-the-box, users with Spaces-User role have access to their own personal space, pages that they create, and public pages. They are also allowed to view public group spaces, join any group space that allows self-subscription, and create group spaces of their own. If you enable self-registration, consider modifying Spaces-User permissions to suit your exact requirements. See Section 34.3.3, "Modifying Application Role Permissions".

To allow anyone to self-register with WebCenter Spaces:

1. Login to WebCenter Spaces with administrative privileges.

   See Section 32.1, "Logging into WebCenter Spaces as an Administrator".

2. Click the Administration link at the top of the application.

3. Click the General tab.

4. Select Allow Public Users to Self-Register (Figure 34-14).

   When you deselect this option, public users cannot self-register with WebCenter Spaces. You still enable self-registration on an invitation-only basis if you want. See Section 34.4.1, "Enabling Self-Registration By Invitation-Only".

   Figure 34-14 Allowing Self-Registration Through Invitations

   
   

5. Click Apply.

See also, "Registering Yourself with WebCenter Spaces" in Oracle Fusion Middleware User's Guide for Oracle WebCenter.