Select Select Application Stripe to Search.

Configuring the Identity Store 28-23

28.4.2.2 Granting Application Roles Using WLST

Use the grantAppRole command to grant an application role to a user. For syntax and usage information, see grantAppRole in the Oracle Fusion Middleware WebLogic Scripting Tool Command Reference.

28.4.3 Using the Runtime Administration Pages

WebCenter Spaces provides a Security tab from which an administrator can define application roles and grant application roles to users defined in the identity store. For information about managing users and application roles in WebCenter Spaces, see Managing Users and Roles for WebCenter Spaces in Oracle Fusion Middleware Users Guide for Oracle WebCenter. WebCenter Portal applications can provide a similar Security tab for application administrators. For details, see Section 34.4, Managing Application Members and Roles. For more information about role-mapping for ADF-security based WebCenter applications, see the section What You May Need to Know About Application Roles and Enterprise Roles in the Oracle Fusion Middleware Fusion Developers Guide for Oracle Application Development Framework.

28.5 Moving the Administrator Account to an External LDAP Server

When configuring the domain to use an external LDAP server, you can also optionally move the Fusion Middleware administrator account weblogic by default to the LDAP server. If the Fusion Middleware administrator account, or any other appropriate user in LDAP, is in an LDAP group called Administrators, then this account should be sufficient to manage the server, and the DefaultAuthenticator provider can be removed from the list of authentication providers. In this case, all users, including the administrator account, are authenticated against the external LDAP. If you cannot create the weblogic default user in the external LDAP directory, there are two options. You can: ■ Keep the DefaultAuthenticator provider and use the weblogic account with the local embedded LDAP server in WebLogic Server to start and stop servers and do other administrator operations from the WebLogic Server Administration Console. If you keep the DefaultAuthenticator, make sure that the control flag for the DefaultAuthentication provider is set to SUFFICIENT. If you choose this option, you must also perform the additional steps described in Section 28.5.1, Migrating the WebCenter Discussions Server to Use an External LDAP. Caution: The Allow Password Change property, which specifies whether users can change their passwords within WebCenter Spaces, should be carefully controlled for corporate identity stores. WebCenter Spaces administrators can set this property from the Profile Management Settings page in WebCenter Spaces. For more information, see Configuring Profiles in Oracle Fusion Middleware Users Guide for Oracle WebCenter.