From the WebLogic Domain menu, select Security, and then Application Roles. Search for the Administration application role by selecting the Application name Click Add User. On the Edit Application Role page, click OK.

Integration With Oracle Identity Management 10-35 4. Grant the WebCenter Spaces administrator application role to the user in LDAP using the grantAppRole command as shown below: grantAppRoleappStripe=webcenter, appRoleName=s8bba98ff_4cbb_40b8_beee_ 296c916a23ed-Administrator, principalClass=weblogic.security.principal.WLSUserImpl, principalName=WCAdmin where WCAdmin is the name of the administrator account. 5. To test the new account, log in to WebCenter Spaces using the new account name. The Administration link should appear, and you should be able to perform all administrator operations.

10.4.2.2 Granting the WebCenter Spaces Administrator Role Using Enterprise Manager

This section describes how to grant the WebCenter Spaces administrator role to a user account other than the default weblogic account. To grant the WebCenter Spaces Administrator role using Enterprise Manager: 1. Log into Fusion Middleware Control and select the WebLogic domain for WebCenter Spaces.

2. From the WebLogic Domain menu, select Security, and then Application Roles.

The Application Roles page displays.

3. Search for the Administration application role by selecting the Application name

for WebCenter Spaces WC_Spaceswebcenter, and providing the following internal identifier used by WebCenter Spaces as the Role Name: s8bba98ff_4cbb_40b8_beee_296c916a23ed-Administrator The search should return s8bba98ff_4cbb_40b8_beee_ 296c916a23ed-Administrator, which is the administrator role identifier. 4. Click the administrator role name s8bba98ff_4cbb_40b8_beee_ 296c916a23ed-Administrator in the Role Name column. The Edit Application Role page displays.

5. Click Add User.

The Add User pop-up displays. 6. Use the Search function to search for the user to assign the Administrator role to. 7. Use the arrow keys to move the user from the Available Users column to the Selected Users column, and click OK.

8. On the Edit Application Role page, click OK.

9. Restart the WC_Spaces managed server. When you log in to WebCenter Spaces, the Administration link should appear and you should be able to perform all administrator operations. Note: Before grantAppRole is called, WCAdmin must exist in LDAP. For user creation details, see Section 10.1.2.2.1, Provisioning Admin Users and Groups in an LDAP Directory. 10-36 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle WebCenter

10.4.3 Setting Up Discussions Server to Use OAM as SSO Provider

When associating the domain with a identity store that does not contain the group Administrators, you must assign some other valid user or group the admin role for the discussions server. You can do this by issuing the following command in the wlst console: cd ORACLE_HOMEcommonbin .wlst.sh connectweblogic, weblogic, ADMINVHN:7001 addDiscussionsServerAdminappName=owc_discussions, name=weblogic_wc, type=USER, server=wc_collaboration1 or: addDiscussionsServerAdminappName=owc_discussions, name=discussions-admin-group, type=GROUP, server=wc_collaboration1 Where weblogic_wc is an example of the user you want to assign the administrator role for the discussions server. To configure Oracle WebCenter Discussions Server for OAM single sign-on:

1. Log in to the Oracle WebCenter Discussions Server Admin Console at:

http:host:portowc_discussionsadmin Where host and port are the host ID and port number of the WC_Collaboration managed server.

2. Open the System Properties page and edit, if it already exists, or add the owc_

discussions.sso.mode property, setting its value to true.

3. Edit or add the jiveURL property to point to the base URL of the SSO server. For

example: jiveURL = example.com:8890owc_discussions

10.4.4 Configuring the Worklist Service for SSO

After completing the setup required for OAM SSO, run the following command on the WebCenter Administration server so that the Worklist service changes to take effect: setBPELConnectionwebcenter,WebCenter-Worklist, https:wc.mycompany.com,server=wc_spaces1

10.5 Configuring WebCenter and BPEL Authentication

This section covers the following topics: ■ Section 10.5.1, Set Authenticator ■ Section 10.5.2, Set Role Members for BPMWorkflowAdmin Application Role in soa-infra ■ Section 10.5.3, Configure SOA Callback URLs