Create a New User

5-34 Oracle WebLogic Communications Server Administration Guide 3. Click on the Optional Properties tab Enter test.user1 for givenName Enter test.user1example.com for mail since this email address will be the users SIP address also, make sure you enter it in the form usernameyour-domain Change description to Test User for OWLCS Change orclSAMAccountName to test.user1 Enter test.user1 for uid Enter a password for this test user of your choice Enter true for orclIsVisible property this is important 4. Click OK.

5.13.2 Create a Group

If you want to run the ProxyRegistrar then all users must be members of the Location Service group. That group has to be created, as described below. The easiest way to add groups and add members to groups is via the OIDDAS web interface. Consult the OID documentation on how to create groups. Alternatively, you can create a new group by cloning an existing group using the oidadmin tool by doing the following: 1. Browse to Entry Management tree until you get to cn=Groups,dc=example,dc=com replacing the domain part with your domain

2. Right-click on an existing Group such as OCS_Portal_Users and choose Create

Like . 3. Set the Distinguished Name dn to cn=Location Service,cn=Groups,dc=example,dc=com change OCS_Portal_Users to Location Service 4. Enter Location Service for cn.

5. Click on the Optional Properties tab.

6. For the description, enter Location Service Role for OWLCS. 7. Enter Location Service for displayName.

8. Click OK.

9. Click on cn=Groups and choose Refresh SubTree Entries and make sure you see the new group.

5.13.3 Assign Group Memberships to Users

As already mentioned, if you want to run the ProxyRegistrar then all OWLCS users must be members of the Location Service group created above. To add a user to the new Location Service group, do the following: 1. Click on the new Location Service group you created. You will find the group in the Entry Management tree at cn=Location Service,cn=Groups,dc=example,dc=com replace domain part with your domain 2. In the pane on your right, scroll down to uniquemember attribute and add cn=test.user1,cn=Users,dc=example,dc=com to any existing entries replace domain part with your domain. Administering Security Features 5-35

3. Click Apply.

5.13.4 Set JAAS Realm for Users

Next you must set the JAAS Realm for users: 1. Navigate to dc=example,dc=com under Entry Management replace domain with your domain 2. Click the dc=example entry.

3. Click the Advanced radio button.

4. Select o from the Attribute drop down.

5. Click on the Apply button.

6. Enter example.com for the value of the o attribute replace with your realm.

7. Click Apply.

5.14 Configuring OWLCS Server Instance

Add an LDAPIdentityAssertionProvider with OID support:

1. In the WLS Admin Console go to your Security Realm and click the Providers tab.

2. Delete the DigestIdentityAsserter if you see it in the list of providers this is

created by default for out-of-the-box installation of OWLCS and restart OWLCS server.

3. After server restarts, in the WLS Admin Console, click on the Providers tab.

4. Add a new LDAP Digest Identity Assertion Provider by clicking the New button

and selecting LDAPDigestAssertionProvider from the Type drop-down. Enter LDAPDigestAssertionProvider for name. Click OK.

5. Click on the Provider Specific tab.

6. Set the UserBaseDN to cn=Users,dc=example,dc=com replace the domain part

with your domain. 7. Set the CredentialAttributeName to authpassword;wlcs. 8. Set the PaswordEncryptionType to PRECALCULATEDHASH. 9. Set the DigestRealmName to the example.com this should match the realm value in your ldif file used for installing static verifier. 10. Set Host and Port to those of the OID server. 11. Set the Principal to orclApplicationCommonName=WLCSInstance1,cn=WLCS,cn=Products,cn=Oracl eContext,dc=example,dc=com replace domain part with your domain 12. Set the Credential to what you configured the userPassword of the instance above. Confirm credential.

13. Check the OIDSupportEnabled checkbox and click Save.

14. Go back to the Providers tab described in step 1. If there is a DefaultAuthenticator

entry there, click it, and set the control flag to SUFFICIENT and click Save.