Adding Users to the Identity Store Using an LDIF File

Configuring the Identity Store 28-17 650-555-1200 add mobile: 650-500-1200 add pager: 650-400-1200 add telephonenumber: 650-506-1212 add postaladdress: 200 Oracle Parkway add l: Redwood Shores add homepostaladdress: 123 Main St., Anytown 12345 adding new entry uid=john.doe,ou=people,ou=myrealm,dc=wc_domain modify complete

28.4 Managing Users and Application Roles

This section describes how you can use Fusion Middleware Control, WLST, and the runtime administration pages in WebCenter Spaces and WebCenter Portal applications to manage users and application roles. This section contains the following subsections: ■ Section 28.4.1, Granting the WebCenter Spaces Administrator Role ■ Section 28.4.2, Granting Application Roles ■ Section 28.4.3, Using the Runtime Administration Pages

28.4.1 Granting the WebCenter Spaces Administrator Role

WebCenter Spaces only recognizes users in the identity store that is mapped by the first authenticator. Since the WebCenter Spaces Administrator account is initially created only in the embedded LDAP server, if an external LDAP such as Oracle Internet Directory is configured as the primary authenticator for WebCenter Spaces, you must also create a user in that LDAP and grant that user the WebCenter Spaces Administrator role. You can grant a user the WebCenter Spaces Administrator role using Fusion Middleware Control or WLST as shown below in the sections on: ■ Section 28.4.1.1, Granting the WebCenter Spaces Administrator Role Using Fusion Middleware Control ■ Section 28.4.1.2, Granting the WebCenter Spaces Administrator Role Using WLST

28.4.1.1 Granting the WebCenter Spaces Administrator Role Using Fusion Middleware Control

This section describes how to grant the WebCenter Spaces administrator role to a user account other than the default weblogic account. To grant the WebCenter Spaces Administrator role using Fusion Middleware Control: 1. Log into Fusion Middleware Control and navigate to the WebCenter Spaces home page. For information on logging into Fusion Middleware Control, see Section 6, Starting Enterprise Manager Fusion Middleware Control. 28-18 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter

2. From the WebCenter menu, select Security - Application Roles.

The Application Roles page displays see Figure 28–16 . Figure 28–16 Application Roles Page

3. Search for the WebCenter Spaces Administrator role:

a. Select Select Application Stripe to Search.

b. Select webcenter.

c. In the Role Name field, enter the following internal identifier for the

Administrator role, and then click the Search arrow icon: s8bba98ff_4cbb_40b8_beee_296c916a23ed-Administrator The search should return s8bba98ff_4cbb_40b8_beee_296c916a23ed-Administrator, which is the administrator role identifier.

4. Click the administrator role identifier in the Role Name column.

The Edit Application Role page displays see Figure 28–17 . Configuring the Identity Store 28-19 Figure 28–17 Edit Application Role Page

5. Click Add User.

The Add User pop-up displays see Figure 28–18 . Figure 28–18 Add User Pop-up 6. Use the Search function to search for the user to assign the Administrator role to. 7. Use the arrow keys to move the user from the Available Users column to the Selected Users column, and click OK.

8. On the Edit Application Role page, click OK.

9. To remove the weblogic role, on the Edit Application Role page under Users, click

weblogic and the click Delete. 28-20 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter 10. Restart the WC_Spaces managed server. When you login to WebCenter Spaces, the Administration link should appear and you should be able to perform all administrator operations.

28.4.1.2 Granting the WebCenter Spaces Administrator Role Using WLST

To grant the WebCenter Administrator role to another user using WLST:

1. Start WLST as described in

Section 1.13.3.1, Running Oracle WebLogic Scripting Tool WLST Commands.

2. Connect to the WebCenter Spaces Administration Server for the target domain

with the following command: connectuser_name,password, host_id:port Where: ■ user_name is the name of the user account with which to access the Administration Server for example, weblogic ■ password is the password with which to access the Administration Server ■ host_id is the host ID of the Administration Server ■ port is the port number of the Administration Server for example, 7001. 3. Grant the WebCenter Spaces administrator application role to the user in Oracle Internet Directory using the grantAppRole command as shown below: grantAppRoleappStripe=webcenter, appRoleName=s8bba98ff_4cbb_40b8_beee_296c916a23ed-Administrator, principalClass=weblogic.security.principal.WLSUserImpl, principalName=wc_admin Where wc_admin is the name of the administrator account to create. 4. To test the new account, log into WebCenter Spaces using the new account name. The Administration link should appear, and you should be able to perform all administrator operations. 5. After granting the WebCenter Spaces Administrator role to new accounts, remove this role from accounts that no longer need or require it using the WLST revokeAppRole command. For example, if WebCenter Spaces was installed with a different administrator user name than weblogic, the administrator role should be given to that user and should be revoked from the default weblogic. revokeAppRoleappStripe=webcenter, appRoleName=s8bba98ff_4cbb_40b8_beee_296c916a23ed-Administrator, principalClass=weblogic.security.principal.WLSUserImpl, principalName=weblogic

28.4.2 Granting Application Roles

This section describes how to add users to application roles using Fusion Middleware Control and WLST commands. This section contains the following subsections: ■ Section 28.4.2.1, Granting Application Roles Using Fusion Middleware Control ■ Section 28.4.2.2, Granting Application Roles Using WLST Configuring the Identity Store 28-21

28.4.2.1 Granting Application Roles Using Fusion Middleware Control

This section describes how to grant an application role to users using Fusion Middleware Control.

1. Log into Fusion Middleware Control and navigate to the WebCenter Spaces or

WebCenter Portal application home page. For information on logging into Fusion Middleware Control, see Section 6, Starting Enterprise Manager Fusion Middleware Control.

2. From the WebCenter menu, select Security - Application Roles.

The Application Roles page displays see Figure 28–19 . Figure 28–19 Application Roles Page

3. Search for the WebCenter Spaces or WebCenter Portal application role:

a. Select Select Application Stripe to Search.

b. Sect the application stripe webcenter for WebCenter Spaces.

c. In the Role Name field, enter the name of the role you are looking for for

example, appConnectionManager, and then click the Search arrow icon: If you are not sure of the name, enter a partial search term or leave the field blank to display all the application roles.

4. Click the role identifier in the Role Name column.

The Edit Application Role page displays see Figure 28–20 . 28-22 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter Figure 28–20 Edit Application Role Page

5. Click Add User.

The Add User pop-up displays see Figure 28–21 . Figure 28–21 Add User Pop-up 6. Use the Search function to search for the user to assign the application role to. 7. Use the arrow keys to move the user from the Available Users column to the Selected Users column, and click OK.

8. On the Edit Application Role page, click OK.

9. Restart the managed server on which the WebCenter application is deployed. For WebCenter Spaces this is always WC_Spaces.