Security within Oracle Content Server

Managing Security and User Access 5-3 ■ The Oracle WebLogic Server user store also manages some additional user metadata such as e-mail and display names. You can use the Oracle WebLogic Server Administration Server interface to edit these values. User metadata can be changed in the Oracle Content Server system, but only after users have logged in to the Oracle Content Server instance at least one time to establish themselves as users in the Oracle Content Server metadata. After the first login, users can update their User Profile page, or an Oracle Content Server administrator can set user attribute values with the User Admin applet. ■ Users can be assigned groups with the Oracle WebLogic Server Administration Console. When a user logs in to the Oracle Content Server instance, the users groups are mapped to Oracle Content Server roles. For Oracle WebLogic Server groups to be recognized in the Oracle Content Server system, roles with the exact same names must be created in the Oracle Content Server system and assigned to security groups. If this is not done, the Oracle WebLogic Server groups assigned to users have no impact on users privileges in the Oracle Content Server system. ■ Configuration with an external user store is performed using the Oracle WebLogic Server Administration Server instead of the Oracle Content Server Admin Server. The Oracle WebLogic Server Administration Server has an embedded Lightweight Directory Access Protocol LDAP server, but it can be configured to work with other LDAP servers such as Oracle Internet Directory OID for enterprise-level systems. Integration with an external user store applies to the domain and all its servers; the Oracle WebLogic Server Administration Server could be shut down, and Oracle UCM and other applications could continue to use the configured LDAP server. For more information on security integration and configuration, see Section 5.2, Oracle Fusion Middleware Security Configuration for Oracle UCM.

5.1.2 Security within Oracle Content Server

The administrator sets up initial user and content security within the Oracle Content Server system by using the User Admin application to define user roles, permissions to groups, and accounts. Then the administrator uses the Oracle WebLogic Server Administration Console to create users and assign each user to one or more of the Oracle Content Server roles, which in turn are assigned specific permissions to security groups. If accounts are enabled on the Oracle Content Server system, the administrator can assign users specific permissions to certain accounts, which then limits the permissions the users might otherwise have through their assigned roles. For details, see Section 5.3, User Types, Logins, and Aliases, Section 5.4, Security Groups, Roles and Permissions, and Section 5.5, Accounts. The following components also can be used to provide additional internal Oracle Content Server security: ■ Security can be customized for user access by using the ExtranetLook component, which is installed disabled with Content Server. For details, see Section 5.9.1, LoginLogout Customization. Note: The ExtranetLook component is not applicable when the Oracle WebLogic Server domain is used as the web server for the Oracle Content Server instance. Modification of the security implementation is controlled through direct customization of the Oracle WebLogic Server domain and administrative configuration. 5-4 Oracle Fusion Middleware System Administrators Guide for Oracle Content Server ■ Security can be customized for user access and search results by using the Need to Know component. This component enables you to further configure user access restrictions, modify the display of search results, alter search behavior, and set up hit list roles. To use this component, you must install and enable it. For more information, see Appendix B, Need to Know Component . Be aware that Internet Explorer 7 supplies the following message to users logging in with basic authentication without a secure connection: Warning: This server is requesting that your username and password be sent in an insecure manner The behavior sending user name and password in text is not new for basic authentication and does not cause problems.

5.1.3 Additional Security Options