Matching Accounts and Roles

5-58 Oracle Fusion Middleware System Administrators Guide for Oracle Content Server mapping first filters all roles, then all accounts. For more information about mapping syntax see Section 5.8.2.3, Matching Accounts and Roles. |all|, |all|,

5.8.2.3 Matching Accounts and Roles

A special filter is available for matching accounts and roles. For example, the syntax for an account filter is designated by starting the account value with specifying the prefix | and ending with a | for example, |accountname|. The pipe | represents a command redirection operator that processes values through the filter. For proxied connections a space-separated list of accounts is specified; each account optionally starts with a dash - to denote a negative value. A filter is matched if any of the specified account strings that do not start with a dash are a prefix for a user account and all of the account strings that do start with a dash are not prefixes for that user account. Roles can be mapped using the same rules by removing the sign from the beginning of the filter. For example, the following input value passes through all roles except those that begin with the prefix visitor. Note that the expression all matches all roles. |all -visitor|,

5.8.2.3.1 Reference Input Value The special sequence in the output value can be

used to reference the input value. For example, given the following mapping, any account that did not start with financial as a prefix would map to the same account but with the prefix employee attached at the front: |all -financial|, employee If a user had the account marketing, then after the mapping the user would have the account employeemarketing.

5.8.2.3.2 Privilege Levels A particular privilege level read, write, delete, all can be

granted to an account in the output value by following the account specification with the letters R, W, D, or A enclosed in parentheses. For example, all the privilege Caution: If your credential map does not at least assign the minimum set of privileges that an anonymous user gets when visiting the Oracle Content Server web site, then logged in users may experience unusual behavior. For example, a common reaction for a browser that receives an ACCESS DENIED response is to revert back to being an anonymous user. In particular, a user may experience unpredictable moments when it is possible or not possible to access a document depending on whether at that moment the browser chooses to send or not to send the users authentication credentials. This is particularly true of NTLM authentication because that authentication has to be renewed periodically. Caution: The filter will not map the account all. The all accounts account value must be mapped explicitly by using all, all mapping. Managing Security and User Access 5-59 levels for all the accounts could be reduced to having read privilege by the following syntax: |all -financial|, employeeR

5.8.2.3.3 Substitution In certain cases it is useful to remove a prefix before the

substitution is applied. An offset for the substitution can be specified by using the syntax [n] where n is the starting offset to use before mapping the input value into the expression. The offset is zero based so that [1] removes the first character from the input value. For example, to remove the prefix DOMAIN1\ from all roles, the following expression can be used: |domain1\|, [8] Another use for this function might be to replace all accounts that begin with the prefix marketing and replace it with the prefix org1mkt. The expression for this would look like the following: |marketing|, org1mkt[10]

5.8.2.3.4 Special Characters In certain cases roles have unusual characters that may be

hard to specify in the input values. The escape sequence xx where xx is the ASCII hexadecimal value can be used to specify characters in the input value. For example, to pass through all roles that begin with , | hash, comma, ampersand, space, pipe, at the following expression can be used: |352c26207c40|,

5.8.2.4 Creating a Credential Map