LCS - Installation LCS - Security Considerations

16-12 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter This section includes the following subsections: ■ Section 16.2.3.1, OWLCS - Installation ■ Section 16.2.3.2, OWLCS - Configuration ■ Section 16.2.3.3, OWLCS - Security Considerations ■ Section 16.2.3.4, OWLCS - Limitations

16.2.3.1 OWLCS - Installation

For detailed OWLCS installation instructions, see the Oracle WebLogic Communication Services Installation Guide.

16.2.3.2 OWLCS - Configuration

OWLCS supports both identity propagation and external application-based connections. Oracle recommends using identity propagation for OWLCS connections, since additional security can be set with WS-Security. OWLCS and the WebCenter application should point to the same LDAP-based identity store. If the OWLCS server and the WebCenter application use different LDAP-based identity stores, then you must configure an external application for the connection so that users can supply credentials to authenticate themselves on the OWLCS server. For information on reassociating the WebCenter application’s identity store, see Section 28.1, Reassociating the Identity Store with an External LDAP Server. If necessary, reconfigure OWLCS to use the same identity store. For more information, see the Oracle WebLogic Communication Services Administrators Guide.

16.2.3.3 OWLCS - Security Considerations

If the OWLCS server is running with WS-Security enabled, then the administrator must set the policyURI parameter in the presence server connection. If WS-Security is not required, then the administrator should disable WS-Security on the OWLCS server. For more information, see Section 32.4, Securing Oracle WebLogic Communication Services OWLCS with WS-Security and Section 31.11, Securing the WebCenter Spaces Connection to OWLCS with SSL.

16.2.3.4 OWLCS - Limitations

With OWLCS, user creation and deletion is manual. Any time a new user is added to or removed from the applications identity store, the same user must be created in or removed from the OWLCS user store. Each OWLCS user has a watcher list, which is a list of the other users allowed to see his presence. This watcher list must be under 125 KB approximately 400 users. In WebCenter, the presence of all users must be visible, even if they are not contact of the logged-in user. To get their presence, WebCenter creates a new account on OWLCS with the Space GUID and adds this new user as a watcher of the visible users. In other words, each member of a Space has an entry of that Space GUID in his watcher list. A problem can arise when a user is part of many Spaces. Because the watcher list contains entries for each Space, its size can grow greater than 125KB. When that happens, updates to the watcher list are rejected, giving the user a Subscription Request popup with that scope GUID. If this happens, then the user should just cancel the subscription request. Managing the Instant Messaging and Presence Service 16-13

16.3 Registering Instant Messaging and Presence Servers

You can register multiple presence server connections with a WebCenter application but only one of them is active at a time. To start using the new active presence server you must restart the managed server on which the WebCenter application is deployed. This section includes the following subsections: ■ Section 16.3.1, Registering Instant Messaging and Presence Servers Using Fusion Middleware Control ■ Section 16.3.2, Registering Instant Messaging and Presence Servers Using WLST

16.3.1 Registering Instant Messaging and Presence Servers Using Fusion Middleware Control

To register a presence server connection: 1. Log in to Fusion Middleware Control and navigate to the home page for the WebCenter application. For more information, see: ■ Section 6.2, Navigating to the Home Page for WebCenter Spaces ■ Section 6.3, Navigating to the Home Page for WebCenter Portal Applications 2. Do one of the following: ■ For WebCenter Spaces - From the WebCenter menu, choose Settings Service Configuration . ■ For WebCenter Portal applications - From the Application Deployment menu, choose WebCenter Service Configuration. 3. From the list of services on the WebCenter Service Configuration page, choose Instant Messaging and Presence .

4. To connect to a new presence server, click Add

Figure 16–6 . Figure 16–6 Configuring Instant Messaging and Presence Services 5. Enter a unique name for this connection, specify the presence server type, and indicate whether this connection is the active or default connection for the application Table 16–1 . 16-14 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter 6. Enter connection details for the server hosting instant messaging and presence services Table 16–2 . Table 16–1 Instant Messaging and Presence Connection - Name Field Description Name Enter a unique name for the connection. The name must be unique across all connection types within the WebCenter application. Connection Type Specify the type of presence server: ■ Microsoft Live Communications Server LCS ■ Microsoft Office Communications Server 2007 OCS ■ Oracle WebLogic Communications Server OWLCS Out-of-the-box, three presence connection types are available— LCS, OCS, and OWLCS. Active Connection Select to use this connection in the WebCenter application for instant messaging and presence services. While you can register multiple presence server connections for a WebCenter application, only one connection is used by the IMP service—the default or active connection. Table 16–2 Instant Messaging and Presence Connection - Connection Details Field Description Server URL Enter the URL of the server hosting instant messaging and presence services. For example: http:myocshost.com:8888 Policy URI OWLCS Only Specify the URI to the WS-Security policy that is required for authentication on the Oracle WebLogic Communication Server. Specify oraclewss11_saml_token_with_message_protection _client_policy when OWLCS is WS-Security enabled. Authentication Method OWLCS Only Specify how to authenticate users against the instant messaging and presence server. Select from: ■ Identity Propagation - Select this option if you want the application and OWLCS to use the same user identity. ■ External Application - Use an external application to authenticate users against the instant messaging and presence server. Select this option to use public, shared, or mapped credentials. If an external application is used for authentication, use the Associated External Application list to identify the application. If the application you want is not listed, select Create New... to define the external application. User Domain OCS Only Enter the name of the Active Directory domain on the Microsoft Office Communications Server that is associated with this connection. The user domain is mandatory for OCS connections. Refer to Microsoft Office Communications Server documentation for details. Managing the Instant Messaging and Presence Service 16-15 7. Sometimes, additional parameters are required to connect to the presence server. If WS-Security is enabled on this connection, add a property named recipient.alias and enter the alias used to import the OWLCS certificate. Ensure that this value is unique and is not used by some other service. If no alias name is supplied, then the default value is used webcenter_owlcs. Table 16–3 lists additional parameters. Pool Name LCS and OCS Only Enter the name of the pool that is associated with this connection. The pool name is mandatory for LCS and OCS connections. Refer to Microsoft Live Communications Server or Microsoft Office Communications Server documentation for details on the pool name. Associated External Application Associate the instant messaging and presence server with an external application. External application credential information is used to authenticate users against the instant messaging and presence server. An external application is mandatory for LCS and OCS connections. You can select an existing external application from the list, or click Create New to configure a new external application. The external application you configure for the Instant Messaging and Presence service must use the POST authentication method, and specify an additional field named Account Name property that is configured to Display to User checked. For more information, see Chapter 25, Managing External Applications. Connection Timeout in seconds Specify a suitable timeout for the connection. This is the length of time in seconds the WebCenter application waits for a response from the presence server before issuing a connection timeout message. The default is -1 which means that the service default is used. The service default is 10 seconds. Table 16–3 Additional IMP Connection Properties Additional Connection Property Valid IMP Servers Description presence.url OWLCS URL to the OWLCS Presence service. Required if the OWLCS Presence service is deployed on a separate node. When no value is specified, the Server URL property is used. contacts.url OWLCS URL to the OWLCS Contact Management service. Required if the OWLCS Contact Management service is deployed on a separate node. When no value is specified, the Server URL property is used. call.url OWLCS URL to the OWLCS Third Party Call service. Required if the OWLCS Third Party Call service is deployed on a separate node. When no value is specified, the Server URL property is used. Table 16–2 Cont. Instant Messaging and Presence Connection - Connection Details Field Description