Set the control flag to REQUIRED and check that OAM_REMOTE_USER and

30-28 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter EXTRA_JAVA_PROPERTIES=-Doracle.webcenter.spaces.osso=true {EXTRA_JAVA_PROPERTIES} export EXTRA_JAVA_PROPERTIES After making this change, restart the WC_Spaces server.

30.2.6.2 Configuring the Discussions Server for SSO

This section describes how to configure Oracle WebCenter Discussions Server for single sign-on. Before configuring the discussions server for SSO, ensure that it has been configured to use the same identity store LDAP as WebCenter Spaces, as described in Section 28.1, Reassociating the Identity Store with an External LDAP Server. If youve chosen not to move the default administrator account to an external LDAP, be sure to also follow the instructions in Section 28.5.1, Migrating the WebCenter Discussions Server to Use an External LDAP. To set up the discussions server for SSO: 1. Log in to the Oracle WebCenter Discussions Server Admin Console at: http:host:portowc_discussionsadmin Where host and port are the host ID and port number of the WC_Collaboration Managed Server.

2. Open the System Properties page and edit if it already exists or add the

owc_discussions.sso.mode property, setting its value to true.

3. Edit or add the jiveURL property to point to the base URL of the Web Tier. For

example: jiveURL = webtier.example.com:7777owc_discussions The jiveURL property is used when constructing links to forums in emails.

30.2.6.2.1 Creating a Discussions Server Connection for WebCenter Spaces

This section describes how to update the discussions server connection for WebCenter Spaces so that it uses the Web Tier’s host and port values. Note that the steps below assume that the Discussions service has already been installed and configured in the WebCenter domain. 1. Using Fusion Middleware Control or WLST, change the discussion server’s URL host and port settings from the WC_Spaces Managed Server’s settings, to the Web Tier’s host and port settings. For information about how to change these settings, see Section 14.5, Modifying Discussions Server Connection Details. 2. Restart the WC_Spaces Managed Server. When you log in to WebCenter Spaces, you automatically sign on to the discussion server as well.

30.2.6.3 Configuring the Worklist Service for SSO

Assuming that youve already set up a Worklist connection, modify the URL to use the Web Tier host and port instead of the SOA server host and port. You can do this using Fusion Middleware Control or using WLST commands as described in Section 22.4, Setting Up Worklist Connections. After modifying the URL and completing the setup required for OAM SSO, run the following command on the WebCenter Administration server so that the Worklist service changes take effect: Configuring Single Sign-on 30-29 setBPELConnectionwebcenter,WebCenter-Worklist, http:webtier.example.com:7777

30.2.6.4 Configuring OAM for RSS Feeds Using External Readers

By default, WebCenter RSS feeds are protected by SSO. However, they will not work well with external readers if left protected external readers will not work at all with OAM 11g protected RSS. If access using external readers is important, Oracle recommends that the WebCenter RSS resource be unprotected so that the authentication for the RSS Servlet is handled by WebLogic Server’s BASIC authentication that external readers can handle. Follow the steps below to unprotect the RSS feeds: 1. Open the OAM Admin Console.

2. Select Access System Console Policy Manager and open the applicable policy

domain. 3. Open the Resources tab and remove the resource rssrssservlet. 4. Go to the Default Public Policy page and uncheck the resource. 5. Return to the Resources tab and remove . 6. Restart OHS.

30.2.6.5 Configuring the WebLogic Server Administration Console and Enterprise Manager for OAM 10g

This section describes how to optionally set up OAM single sign-on for the WebLogic Server Administration Console and Enterprise Manager. To set up OAM SSO for the WebLogic Server Administration Console and Enterprise Manager:

1. Log in to the OAM Console using your browser to navigate to:

http:host:portaccessoblix Where host is the host ID of the server hosting the Access Manager for example, oam.example.com, and port is the HTTP port number for example, 8888.

2. Click Policy Manager.

The Policy Manager pane displays see Figure 30–15 . Note: Setting up OAM SSO for Enterprise Manager and the WebLogic Server Administration Console would provide single sign-on access to same set of users for whom OAM SSO access has been configured. If want the Web Tier to be accessible to external users through OAM, but want administrators to log in directly to Enterprise Manager and the WebLogic Server Administration Console, then you may not want to complete this additional configuration step.