What You Should Know About WebCenter Personalization

Managing WebCenter Personalization 19-5 ■ Cross-domain trust i.e., integrated domain connection configured to use the WC_domain CMIS provider is required This section contains the following subsections: ■ Section 19.3.1, Configuring the Trust Service in the WebCenter Domain ■ Section 19.3.2, Configuring the Trust Service in the Integrated WLS Domain ■ Section 19.3.3, Configuring Cross-Domain Trust

19.3.1 Configuring the Trust Service in the WebCenter Domain

The default WebCenter installation includes the WebCenter Personalization domain extension template, which installs two WLST python scripts configureTrustWCPS.py and configureConnectionsWCPS.py, in the domain home: oracleuser_projectsapplicationswc_domainscripts These scripts and associated configureWCPS.properties file contain usage instructions. Note that these are sample scripts, and that before running the scripts, you must edit the properties file and, at a minimum, specify the ocs.server name typically the Oracle Content Server, the spaces.server.host name, and the fmwconfig.location. These values are unique to each WebCenter installation and must be edited. Other values may also need to be changed according to the local environment the machine port numbers, for example, may be different. The configureConnectionsWCPS.py script sets up the default WebCenter Personalization connection information for you i.e., connection information for Activity Graph, CMIS, and People Connections. The script relies on the WCPS.py library, which is only installed on the WebCenter domain and not in the integrated WLS domain. You can, however, run configureConnectionsWCPS.py in the WebCenter domain and point it using a t3 URL to an integrated WLS domain. You must use the oracleas11gr1wccommonbinwlst.sh command file that sets up environment variables correctly for as11gr1wc scripts. After running the scripts, restart all servers in the domain. Testing the Configuration To see Trust Service single sign-on in operation, you must be calling the Conductor or Property Service from a custom JEE Web application using the WebCenter Personalization client libraries, or be executing a scenario that uses a WebCenter Personalization connection such as the Activity Graph or CMIS data providers, or accessing a People Connections property using the People Connections locator. When doing any of the above, you should see the following default log entry in WC_Utilities-diagnostic.log: [2010-11-10T07:30:40.362-08:00] [WC_Utilities] [NOTIFICATION] [] [oracle.jps.trust] [tid: [ACTIVE].ExecuteThread: 3 for queue: weblogic.kernel.Default self-tuning] [ecid: 0000IkqQG4NBh49LJeCCyf1CqfXw000008,0] [APP: wcps-services11.1.1.4.0] Token issue operation Caution: the Trust Service configuration set up by configureTrustWCPS.py should not be applied remotely. The script should only be run from the WebCenter wc_domain. 19-6 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter You should also see the following default log entry in the WC_Spaces-diagnostic.log if accessing services there: [2010-11-10T07:30:40.236-08:00] [WC_Spaces] [NOTIFICATION] [] [oracle.jps.trust] [tid: [ACTIVE].ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning] [ecid: d461d36d4a552b90:-1fe62a5d:12c365bb19b:-8000-000000000000002c,0] [APP: webcenter11.1.1.4.0] Token validate operation.

19.3.2 Configuring the Trust Service in the Integrated WLS Domain

A separate python script is shipped with the JDeveloper installer to configure the integrated WLS domain located in the following directory: DefaultDomain\scrpts-wcps\ This script can be run manually or using JDeveloper’s Run External Script function. Edit the properties file if you are using a non-default user or password. After creating and starting the integrated WLS domain, run the script from the scrpts-wcps directory: Oracle\MiddlewareRC8\oracle_common\common\bin\wlst.cmd configureWCPS.py configureWCPS.properties Restart the integrated WLS domain. Testing the Configuration Default logging levels are not enough to confirm token-issue and token-validate operations. Use the Configure Oracle Diagnostic Logging feature in JDeveloper and navigate to the oracle.jps.trust logger and set the level to Finest. Now run a scenario involving a custom JEE Web application calling the Conductor or Property Services.

19.3.3 Configuring Cross-Domain Trust

The Trust Service supports cross-domain trust, meaning if keystores have been created in different WLS domains, a client may allocate a token in domain A, issue an HTTP request with the token to domain B, and have the identity asserter validate and authenticate the userrequest in domain B through single sign-on. Note that a key assumption is that the user in domain A exists in, and is the same user in domain B. By default, when running the configureWCPS.py script in the integrated WLS domain a certificate named extDomain.cer is generated. To enable cross-domain trust between the integrated WLS domain and WebCenter domain: Copy extDomain.cer to your WebCenter wc_domain installation and import it there. Copy the extDomain.cer file to the scripts location: oracleuser_projectsapplicationswc_domainscripts Type in the following command to import the certificate: keytool -importcert -alias orakey1 -file extDomain.cer -keystore ........wlserver_10.3wc_domainconfigfmwconfigdefault-keystore.jks -storepass weblogic Restart the servers in the WebCenter domain.