Configuring Human Workflow Task Service Properties

Configuring Human Workflow Service Components and Engines 19-13 This section describes how to add an authentication provider and create users and groups in the authentication provider using either Oracle WebLogic Administration Console or Oracle Directory Services Manager. This section describes the following topics: ■ Section 19.7.1, Adding an Authentication Provider ■ Section 19.7.2, Creating Users and Groups in the Authentication Provider ■ Section 19.7.3, Configuring the Directory Service

19.7.1 Adding an Authentication Provider

You can add an authentication provider to a security realm using the Oracle WebLogic Server Administration Console. To add an authentication provider: 1. Log in to the Oracle WebLogic Server Administration Console.

2. Click Security Realms in the Domain Structure pane, and click the name of a

realm in the list myrealm, for example. 3. Click Providers Authentication. The Authentication Providers page appears. Note: Although you can configure an alternative LDAP authentication provider for Oracle BPM Worklist, Oracle Platform Security Services does not support multiple LDAP authentication providers. The provider you want to use for Human Workflow authentication must be the first one listed in the order of authentication providers for Oracle SOA Suite. Note: Oracle Fusion Middleware supports providers that enable the User and Role API to interact with custom identity stores. For more information, see Chapter Developing with the User and Role API of the Oracle Fusion Middleware Application Security Guide. 19-14 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite

4. Click New to add a new authentication provider.

The Create a New Authentication Provider page appears.

5. In the Name field, type a name for the provider, choose the authenticator type

using the Type drop-down list, and click OK. For example, you can type OIDAuthenticator as the name and choose OracleInternetDirectoryAuthenticator as the type for a provider that authenticates users using the Oracle Internet Directory. Similarly, you can type a name and choose ActiveDirectoryAuthenticator, iPlanetAuthenticator , openLDAPAuthenticator, or NovellAuthenticator from the list to specify the corresponding authenticator. Configuring Human Workflow Service Components and Engines 19-15

6. On the Providers Authentication page, click the authenticator that you just

created. The settings for the authentication provider appears.

7. From the Control Flag drop-down list, choose SUFFICIENT, and click Save.

This specifies that if a user is authenticated successfully using this authenticator, WebLogic should accept the authentication and not continue to invoke any additional authenticators. If the authentication fails, Oracle WebLogic Server attempts to authenticate the user using the next authenticator in the list. If you set the Control Flag to SUFFICIENT, ensure that all subsequent authenticators also have the Control Flag set to SUFFICIENT. Likewise, ensure that the Control Flag of the default authenticator is set to SUFFICIENT as well.

8. Click Provider Specific to enter the details for the authenticator server.

9. Enter the provider-specific information about the authentication provider, check the Use Retrieved User Name as Principal checkbox, and click Save. You must specify the following information. Use the default setting for the rest of the fields. Note: When using Oracle Internet Directory as the authentication provider, you must set the orclsslinteropmode attribute to 0 zero using Oracle Directory Services Manager. See Section 19.7.3, Configuring the Directory Service for more information. Field Description Host The hostname or IP address on which the authenticator server is running. Port The port number on which the authenticator server is running. 19-16 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite If the user attribute being used is other than the default username attribute in the LDAP server, add the following entries to the identity store instance in the jps-config.xml file: property name=username.attr value=desired_attr property name=user.login.attr value=desired_attr where desired_attr can be one of CN, UID, or MAIL.

10. Click Security Realms Providers Authentication to return to the list of

authentication providers.

11. Click Reorder.

The Reorder Authentication Providers page appears.

12. Select the new authentication provider, click the Up arrow to move the provider to

the top of the list, and click OK. After reordering, the DefaultAuthenticator should appear at the bottom of the list. This action enables the system to handle logins as weblogic that are not typically in an LDAP directory, but still must be authenticated to start the server. Principal The Distinguished Name DN of the authenticator server user that Oracle WebLogic Server should use when connecting to the server. Credential The credential usually a password used to connect to the authenticator server. User Base DN The base Distinguished Name DN of the tree in the LDAP directory that contains users. Group Base DN The base Distinguished Name DN of the tree in the LDAP directory that contains groups. Use Retrieved User Name as Principal Specifies whether to use the user name retrieved from the LDAP server as the principal in the subject. User Name Attribute The attribute of an LDAP user object class that specifies the name of the user for example, UID, CN, MAIL. Field Description Configuring Human Workflow Service Components and Engines 19-17 Note that if multiple authentication providers are configured, authentication falls through the list of authenticators according to the control flags set. But the Java Portlet Specification JPS provides authorization against only the first entry in the list of providers.

19.7.2 Creating Users and Groups in the Authentication Provider

You can create users and groups in the authentication provider using either Oracle WebLogic Server Administration Console or Oracle Directory Services Manager.

19.7.2.1 Creating Users and Groups Using WebLogic Console

You can create users and groups for a specific provider, and define user and group membership, using the Oracle WebLogic Server Administration Console. To create a user using WebLogic Console: 1. Log in to the Oracle WebLogic Console.

2. Click Security Realms in the Domain Structure pane, and click the name of a

realm in the list myrealm, for example. 3. Click Users and Groups Users. The Users page appears.

4. Click New to add a new user. The Create a New User page appears.

5. Enter the required information about the user, and click OK.

You must specify the following information. Field Description Name Required The name of the new user. Description A description of the new user. Provider The provider for the user. Password The password associated with the login name for the new user. Confirm Password Confirmation of the password.