Administrator Accounts Application Roles and Enterprise Roles

Managing WebCenter Portal Application Security 27-9 ■ Section 27.3.4, User Made Administrator Does Not Have Administrator Privileges ■ Section 27.3.5, OmniPortlet Producer Authorization Exception in SSO Environment ■ Section 27.3.6, Deploying the SAML SSO-specific Discussions EAR file Produces an Exception ■ Section 27.3.7, Configuring SAML Single Sign-on Produces 403 Error

27.3.1 Webcenter Spaces Does Not Find Users in LDAP Provider

Problem Weblogic Server was configured with an external LDAP provider. Users in the external LDAP can log in to WebCenter Spaces, but when you try to assign the administrator role, in WebCenter Spaces, to a user from the external LDAP, no users are found. Solution Change the Control Flag for the DefaultAuthenticator Authentication Provider to Sufficient as described in Chapter 28, Configuring the Identity Store. Restart the Administration Server and Managed Servers for the domain.

27.3.2 Group Space Gets Created with Errors When Logged in as OID User

Problem When logged in to WebCenter as an OID user for example, orcladmin, and you try to create a group space, the group space gets created but with errors. The error message appears as No matching users were found with search string login user. Solution The following property is missing in the jps-config.xml file: property name=jps.user.principal.class.name value=weblogic.security.principal.WLSUserImpl To fix this: 1. Edit MIDDLEWARE_HOMEuser_projectsdomainsWebCenterconfigfmwc onfigjps-config.xml. 2. Add this line in the general properties: property name=jps.user.principal.class.name value=weblogic.security.principal.WLSUserImpl 3. Restart the WLS_Spaces server. 27-10 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter

27.3.3 Users Cannot Self-Register when WebCenter Spaces Configured with Active Directory

Problem Users cannot self-register with Active Directory after configuring WebCenter Spaces to use AD authenticator. When a user tries to self-register, the following error message appears: User not created. Either the user name or the password does not adhere to the registration policy or the identity store is unavailable. Specify the required user credentials or contact your administrator for assistance. Solution To fix the problem: 1. Set the user name attribute to sAMAccountName while configuring Active Directory in the WebLogic Administration Console. 2. Use the HTTPS port of the LDAP and enable the SSL checkbox while configuring Active Directory in the WebLogic Administration Console.

27.3.4 User Made Administrator Does Not Have Administrator Privileges

Problem After logging in as orcladmin and making a user an administrator, after logging out and logging in as that user, the Administrator link is still not available. Solution The problem is due to duplicate cn entries in the identity store. Since cn is mapped to the username attribute, it must be unique. Remove the duplicate from the identity store and the user should have the appropriate privileges.cn.

27.3.5 OmniPortlet Producer Authorization Exception in SSO Environment

Problem OmniPortlet producer receives an authorization exception when it tries to store connection information in the Credential Store Framework CSF wallet when WebCenter is configured with SSO. Solution Grant the required permissions to ssofilter.jar by connecting to the Oracle WebCenter Administration Server using WLST for more information, see Section 1.13.3.1, Running Oracle WebLogic Scripting Tool WLST Commands and running the following grant commands: grantPermissioncodeBaseURL=file:{oracle.home}modulesoracle.ssofilter_11.1.1s sofilter.jar, permClass=oracle.security.jps.service.credstore.CredentialAccessPermission, permTarget=context=SYSTEM,mapName=omniportlet_user,keyName=, permActions= grantPermissioncodeBaseURL=file:{oracle.home}modulesoracle.ssofilter_11.1.1s sofilter.jar,