Undeploying Applications Oracle Fusion Middleware Online Documentation Library

6-2 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite

6.2 Configuring Oracle HTTP Server with Oracle BPM Worklist

You must add the integration location in the mod_wl_ohs.conf file of Oracle HTTP Server for Oracle BPM Worklist to work through Oracle HTTP Server. Location integration SetHandler weblogic-handler PathTrim weblogic ErrorPage http:WEBLOGIC_HOME:WEBLOGIC_PORT Location

6.3 Setting up SAML Message-Protected Policy Configuration for the SOA Infrastructure

This section describes how to set up and validate Security Assertion Markup Language SAML message-protected policy configuration for the SOA Infrastructure with the WebLogic Scripting Tool WLST. The example in this section describes task query service configuration. However, these instructions are relevant to all human workflow services that support SAML-token ports: ■ AG query service ■ AG metadata service ■ AG admin service ■ Task query service ■ Task service ■ Task metadata service ■ Runtime config service ■ Task evidence service ■ User metadata service If you want to change the policy for another service, you must apply the same WLST commands to that services SAML-token port. Securing and administering web services Oracle Fusion Middleware Security and Administrators Guide for Web Services Understanding Oracle WebLogic Server security Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server Securing an Oracle WebLogic Server production environment Oracle Fusion Middleware Securing a Production Environment for Oracle WebLogic Server Securing Oracle WebLogic Server Oracle Fusion Middleware Securing Oracle WebLogic Server Developing new security providers for use with Oracle WebLogic Server Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server Securing web services for Oracle WebLogic Server Oracle Fusion Middleware Securing WebLogic Web Services for Oracle WebLogic Server Programming security for Oracle WebLogic Server Oracle Fusion Middleware Programming Security for Oracle WebLogic Server Table 6–1 Cont. Security Documentation For Information On... See The Following Guide... Securing SOA Composite Applications 6-3 To set up an SAML message-protected policy configuration: 1. Log in to the SOA domain for example, named base_domain using WLST. 2. Detach the existing out-of-the-box service policy named wss10_saml_token_ service_policy. wls:base_domaindomainRuntime detachWebServicePolicybase_domainsoa _server1soa-infra,integrationservicesTaskQueryService,web, WorkflowProvider,TaskQueryServicePortSAML,oracle wss10_saml_token_service_policy 3. Restart the application to activate any policy or configuration change. 4. Attach the new policy. In this case, the policy is named oraclewss10_saml_ token_with_message_protection_service_policy. wls:base_domaindomainRuntime attachWebServicePolicybase_domainsoa _server1soa-infra,integrationservicesTaskQueryService, web,WorkflowProvider,TaskQueryServicePortSAML,ora clewss10_saml_token_with_message_protection_service_policy 5. Restart the application to activate any policy or configuration change. 6. List the policy to validate. wls:base_domaindomainRuntime listWebServicePoliciesbase_domainsoa _server1soa-infra,integrationservicesTaskQueryService, web,WorkflowProvider,TaskQueryServicePortSAML TaskQueryServicePortSAML : security : oraclewss10_saml_token_with_message_protection_service_policy, enabled=true Attached policy or policies are valid; endpoint is secure. 7. Create a keystore, add the orakey alias, and run the Oracle Web Service Manager OWSM configuration to activate the SAML message-protected policy. For example: keytool -genkeypair -keystore domain_homeconfigfmwconfigdefault-keystore.jks -keyalg RSA -dname cn=consumer,dc=example,dc=com -alias clientalias -keypass password -storepass password -validity 3600 keytool -exportcert -keystore domain_homeconfigfmwconfigdefault-keystore.jks -v -alias clientalias -storepass password -rfc -file domain_homeconfigfmwconfigcertificate.cer keytool -importcert -keystore domain_homeconfigfmwconfigdefault-keystore.jks -alias orakey -file domain_homeconfigfmwconfigcertificate.cer -storepass password createCredmap=oracle.wsm.security, key=keystore-csf-key, user=owsm, password=welcome1, desc=Keystore key 6-4 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite createCredmap=oracle.wsm.security, key=enc-csf-key, user=clientalias, password=welcome1, desc=Encryption key createCredmap=oracle.wsm.security, key=sign-csf-key, user=clientalias, password=welcome1, desc=Signing key 8. Restart the servers.

6.4 Automatically Authenticating Users

This section describes how to authenticate Oracle BPM Worklist and Oracle Business Process Management users in different environments.

6.4.1 Automatically Authenticating Oracle BPM Worklist Users in SAML SSO Environments

In order to be automatically authenticated when accessing a second Oracle BPM Worklist from a first Oracle BPM Worklist in SAML SSO environments, you must perform the following steps. Otherwise, you are prompted to log in again when you access the second Oracle BPM Worklist. In these environments, the first Oracle BPM Worklist is configured as the SAML identity provider and the second Oracle BPM Worklist that you are attempting to access is configured as the SAML service provider. To automatically authenticate Oracle BPM Worklist users in SAML SSO environments: 1. Add integrationworklistapp as the redirect URL for worklistapp to the SAML service provider sites SAML2IdentityAsserter configuration as follows.

a. In the Oracle WebLogic Server Administration Console, select Security

Realms . b. Click the realms for the service providers.

c. Select the Providers tab, and then the Authentication subtab.

d. From the provider list, select the provider with the description SAML 2.0

Identity Assertion Provider. If you do not see the SAML identity assertion provider configuration, follow the instructions in Oracle Fusion Middleware Securing Oracle WebLogic Server.

e. Select the Management tab.

Under the Management tab, you can see a list of identity provider partners. These are hosts that have been configured as the SAML identity provider partners for this SAML identity service provider site. Remember that this configuration step is performed on the identity service provider site on which the worklist application is hosted. f. Select the identity provider site where you want the user to perform the initial login.

g. Scroll down the page until you see the field Redirect URIs.

h. Add integrationworklistapp to the list. After performing this step, you can log in to Oracle BPM Worklist at the SAML identity provider site though the regular URL ofintegrationworklistapp. If necessary, you can then navigate to the URL integrationworklistappssologin at the SAML service provider site, where you gain access to Oracle BPM Worklist and are automatically authenticated. Securing SOA Composite Applications 6-5 For more information on SAML2IdentityAsserter and configuring SSO with web browsers and HTTP clients, see Oracle Fusion Middleware Securing Oracle WebLogic Server. 6.4.2 Automatically Authenticating Oracle BPM Worklist Users in Windows Native Authentication Environments For Windows native authentication through Kerberos to work with Oracle BPM Worklist, you must use the integrationworklistappssologin protected URL. For example, after configuring Windows native authentication, you access Oracle BPM Worklist as follows: http:host_name.domain_name:8001integrationworklistappssologin For information on configuring SSO with Microsoft clients, see Oracle Fusion Middleware Securing Oracle WebLogic Server. 6.4.3 Automatically Authenticating Oracle Business Process Management Process Composer Users in Windows Native Authentication Environments For Windows native authentication through Kerberos to work with Oracle Business Process Management Process Composer, you must use the bpmcomposerssologin protected URL. For example, after configuring Windows native authentication, you access Process Composer as follows: http:host_name.domain_name:8001bpmcomposerssologin For information on configuring SSO with Microsoft clients, see Oracle Fusion Middleware Securing Oracle WebLogic Server.

6.5 Listing the Authentication Provider

This section describes how to set the first authentication provider.

6.5.1 Listing Oracle Internet Directory as the First Authentication Provider

The Oracle BPM Worklist and workflow services use Java Platform Security JPS and the User and Role API. For this reason, the Oracle Internet Directory authenticator must be the first provider listed when workflow is used with Oracle Internet Directory. If Oracle Internet Directory is not listed first for example, it is listed below DefaultAuthenticator, login authentication fails. For information about changing the order of authentication providers, see Oracle Fusion Middleware Securing Oracle WebLogic Server.

6.5.2 Accessing Web-based Applications with the Default Authentication Provider

Logins to web-based applications may fail when using Oracle Internet Directory authentication. This is caused when the Oracle WebLogic Server configuration is set to use the Oracle Internet Directory authentication before default authentication. This may produce the following error: User weblogic is not found in configuration jazn.com Check if the user exists in the repository specified by the configurations. Check the error stack and fix the cause of the error. Contact oracle support if error is not fixable. The order of the security providers should be: