Migrating the WebCenter Discussions Server to Use an External LDAP

Configuring the Identity Store 28-29 13. Restart the domain Administration Server and discussions server.

28.5.2 Changing the Administrator Group Name

You can change the group name to any other valid enterprise role in your LDAP server that contains users authorized to manage the domain. This lets you delegate the administration of specific domains in your enterprise. You can create various administration groups in the directory and have the corresponding domains be configured to use the appropriate group for defining its administrators. The following example LDIF file creates an administrative group in Oracle Internet Directory: dn: cn=wc_domain_Admin,cn=groups,dc=example,dc=com cn: wc_domain_Admin uniquemember: cn=joe.admin,cn=users,dc=example,dc=com owner: cn=orcladmin displayname: WebLogic Administrators Group description: WebLogic Administrators Group objectclass: orclgroup objectclass: groupofuniquenames Once this group is created, you must update the role definition for the WebLogic Server global Admin role using the WebLogic Server Administration Console. To update the role definition for the WebLogic Server global Admin role: 1. Log in to the WebLogic Server Administration Console. For information on logging into the WebLogic Server Administration Console, see Section 1.13.2, Oracle WebLogic Server Administration Console. 2. In the Domain Structure pane see Figure 28–30 , click Security Realms. Figure 28–30 Domain Structure Pane The Summary of Security Realms pane displays see Figure 28–31 . 28-30 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter Figure 28–31 Summary of Security Realms pane 3. In the Name column, click the realm for which you want to change the administrator group name. The Realm Settings pane displays see Figure 28–32 . Figure 28–32 Realm Settings Pane Configuring the Identity Store 28-31 4. Open the Roles and Policies tab, and then the Realm Roles subtab. The Realm Roles settings pane displays see Figure 28–33 . Figure 28–33 Realm Roles Settings Pane 5. Expand the Global Roles node, and then the Roles node.

6. Click View Role Conditions for the Admin role.

The Edit Global Role page displays see Figure 28–34 . 28-32 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter Figure 28–34 Edit Global Role Page By default, the Administrators group in Oracle Internet Directory or other configured identity store defines who has the administrator role in WebLogic Server.

7. Click Add Conditions to add a different group name.

The Edit Global Role - Predicate List page displays see Figure 28–35 . Figure 28–35 Edit Global Role Page - Predicate List

8. Select Group from the Predicate List list and click Next.

The Edit Global Role - Arguments page displays see Figure 28–36 . Configuring the Identity Store 28-33 Figure 28–36 Edit Global Role Page - Arguments

9. Enter the name for the new administrator group and click Add.

10. Select the pre-existing administrator group and click Remove to delete it leaving

the new one youve selected in its place.

11. Click Finish to save your changes.

After making this change, any members of the new group specified are authorized to administer WebLogic Server.

28.6 Configuring the Oracle Content Server to Share the WebCenter Spaces Identity Store LDAP Server

Oracle Content Server OCS must be configured to use the same identity store LDAP server as Oracle WebCenter Spaces. For more information on configuring the OCS, see Chapter 11, Managing Content Repositories and also Configuring the LDAP Identity Store Service in the Oracle Fusion Middleware Security Guide.

28.7 Aggregating Multiple Identity Store LDAP Servers Using libOVD

Sites with muliple identity stores can use libOVD to aggregate their user profile information. Two scenarios are covered in the step-by-step configuration instructions below: ■ Users are available in distinct identity stores with complete user profile information available in the respective identity store. ■ The same user is available in both identity stores with some attributes in one store and other attributes in the other store. This section contains the following subsections: Note: If you are supporting self-registration with Active Directory, be sure to see the troubleshooting note in Section 27.3.3, Users Cannot Self-Register when WebCenter Spaces Configured with Active Directory. 28-34 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter ■ Section 28.7.1, Configuring libOVD for Identity Stores with Complete User Profiles ■ Section 28.7.2, Configuring libOVD for Identity Stores with Partial User Profiles ■ Section 28.7.3, Restoring the Single Authenticator

28.7.1 Configuring libOVD for Identity Stores with Complete User Profiles

To configure libOVD where each identity store contains complete user profiles: 1. Create the required authenticators in the WLS Admin Console for the identity stores being configured and restart the Weblogic Admin and Managed Servers for the domain. Alternatively, you can also configure the identity store information in jps-config.xml by hand. 2. Update the identity store service instance in jps-config.xml and add a property virtualize with the value true. You can do this either by editing the jps-config.xml file by hand, or using Fusion Middleware Control. 3. WebCenter lets users self-register, which creates a new user or group in the identity store. Since multiple identity stores are being used, you also need to explicitly specify the user create bases and group create bases in jps-config.xml. This step must be done by directly editing jps-config.xml. Thejps-config.xml file should look like the example below after the configuration. serviceInstance provider=idstore.ldap.provider name=idstore.ldap property value=oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider name=idstore.config.provider property value=oracle.security.idm.providers.stdldap.JNDIPool name=CONNECTION_POOL_CLASS property value=true name=virtualize serviceInstance extendedProperty nameuser.create.basesname values valueou=people,ou=myrealm,dc=wc_domainvalue values extendedProperty extendedProperty namegroup.create.basesname values valueou=groups,ou=myrealm,dc=wc_domainvalue values extendedProperty serviceInstance Be sure to replace the actual values for the user create base in ou=people,ou=myrealm,dc=wc_domain and group create base ou=groups,ou=myrealm,dc=wc_domain.

28.7.2 Configuring libOVD for Identity Stores with Partial User Profiles

To configure libOVD where each identity store contains only partial user profiles: 1. Create the required authenticators in the WLS Admin Console for the identity stores being configured and restart the Weblogic Admin and Managed Servers for