Creating Users and Groups Using Oracle Internet Directory

Configuring Human Workflow Service Components and Engines 19-27

19.8.3 Seeding Application Roles using WLST Scripts

For instructions on using the WebLogic Scripting Tool WLST to seed application roles, see Chapter 4, Infrastructure Security Custom WLST Commands of Oracle Fusion Middleware WebLogic Scripting Tool Command Reference.

19.8.4 Managing Application Roles in Oracle Enterprise Manager Fusion Middleware Control

This section describes how to manage application roles in Oracle Enterprise Manager Fusion Middleware Control. To manage application roles in Oracle Enterprise Manager Fusion Middleware Control:

1. In the navigator, select the appropriate Oracle WebLogic Server under WebLogic

Domain Farm_Domain_name. 2. Right-click the domain name, and select Security Application Roles. 3. Create an application role by performing the following steps:

a. Select the Create option in the Application Roles page.

The Create Application Role page appears.

b. In the Application list, select the application name server_namesoa-infra

under which to create a role.

c. Enter the role name, display name, and description for the application role.

d. Add members by selecting Add Role in the Roles section and Add User in the

Users section. e. Click OK to create the application role.

4. Edit application roles by performing the following steps:

a. In the Select Application Name to Search list of the Search section of the

Application Roles page, select an appropriate application for example, soa_ server1soa-infra .

b. To the right of the Role Name list, click the Search icon.

This action lists all the application roles created for that application.

c. Select the application role to edit for example, select SOADesigner.

d. Click Edit.

The Edit Application Role page appears.

e. Add application roles and groups in the Roles section and users in the Users

section for example, assign SOADesigner to a user to which to provide access to Oracle SOA Composer. The user must be defined in the Oracle WebLogic Server realm. Note: Follow these steps if you want to provide nonadministrators with access to Oracle SOA Composer. This is accomplished by assigning the SOADesigner role to users or groups on the Edit Application Role page. The users must exist in the Oracle WebLogic Server realm. 19-28 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite

f. Click OK.

5. Delete application roles by performing the following steps:

a. In the Select Application Name to Search list of the Search section of the

Application Roles page, select an appropriate application.

b. To the right of the Role Name list, click the Search icon.

This action lists all the application roles created for that application. c. Select the application role to delete.

d. Click the Delete button to delete the application role.

e. Click Yes in the Confirmation dialog.

19.9 Enabling Case Agnostic Group Names in Human Tasks

By default, only user names in human tasks are case agnostic case insensitive. This behavior is controlled by the value of the caseSensitive property in the System MBeans Browser for users, which is set to false by default. Group names in human tasks must be identical to what is seeded in the user directory. However, if you also want group names in human tasks to be case agnostic, you must set the caseSensitiveGroups property to false. To enable case agnostic behavior for group names in human tasks:

1. Right-click soa-infra, and select Administration System Mbean Browser.

The System MBean Browser is displayed on the right side of the page.

2. Expand Application Defined MBeans oracle.as.soainfra.config Server:

server_name WorkflowIdentityConfig human-workflow WorkflowIdentityConfig.PropertyType caseSensitiveGroups.

3. Click the Operations tab.

4. Click setValue.

5. In the Value field, enter false.

6. Click Invoke.

19.10 Configuring Security Policies for Human Workflow Web Services

A policy set, which can contain multiple policy references, enables you to attach policies globally to a range of endpoints of the same type. Attaching policies globally using policy sets enables you to ensure that all subjects are secured in situations in which multiple users, such as a developer, assembler, or deployer, did not explicitly specify the policies to attach. Policies that are attached using a policy set are considered externally attached. For example, if the developer did not specify policies in annotations or include policy references in deployment descriptors, then the deployer must attach them or risk a potential security risk. By attaching policies globally to a set of subjects by type, the administrator can ensure that all subjects are secured by default independent of, and even before, deployment. For example, the administrator can define a policy set that attaches a security policy to all web service endpoints in a domain. In this case, any new services added to the domain automatically inherit the security configuration defined in the policy set. Configuring Human Workflow Service Components and Engines 19-29 For more information about attaching policies globally using policy sets, see Oracle Fusion Middleware Security and Administrators Guide for Web Services. 19-30 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite 20 Monitoring Human Workflow Service Components and Engines 20-1 20 Monitoring Human Workflow Service Components and Engines This chapter describes how to monitor human task service components and the human workflow service engine. This chapter includes the following topics: ■ Section 20.1, Monitoring Human Task Service Component Instances and Faults ■ Section 20.2, Viewing the Status of Human Workflow Tasks ■ Section 20.3, Monitoring Human Task Service Component Instances ■ Section 20.4, Monitoring Human Workflow Service Engine Instances and Faults ■ Section 20.5, Monitoring Human Workflow Service Engine Active Requests and Operation Statistics ■ Section 20.6, Monitoring Human Workflow Service Engine Instances ■ Section 20.7, Monitoring Deployed Human Workflows in the Service Engine For more information, see the following sections: ■ Section 1.2.4, Introduction to Service Components and Service Component Instances ■ Section 1.2.6, Introduction to Service Engines

20.1 Monitoring Human Task Service Component Instances and Faults

You can monitor recent instances and faults for human task service components. Each service component in a SOA composite application has its own instance ID. These IDs are different from the overall instance ID of the SOA composite application of which each service component is a part. To monitor human task service component instances and faults: 1. Access this page through one of the following options: From the SOA Infrastructure Menu... From the SOA Folder in the Navigator... 1. Select Home. 2. Select the Deployed Composites tab. 3. In the Composite section, select a specific SOA composite application. 1. Under soa-infra, select a specific SOA composite application. 20-2 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite

2. Select the human task service component in the Component Metrics table.

The upper part of the Dashboard page displays the following details: ■ Recent instances of the human task service component, including the instance ID of the service component, the state of the instance for example, completed or running, the instance start time, the last modification time, and links to log files describing the instances. ■ Recent faults in the human task service component, including the error message, whether the fault is recoverable, the time at which the fault occurred, the instance ID of the human task service component, and links to log files describing the faults.

3. In the Recent Instances section, perform the following tasks:

a. In the Instance ID column, click an instance ID for a service component to

monitor the current status of a task on which approval actions are being taken.

b. In the Logs column, click a specific log to access the Log Messages page with

filtered messages specific to that instance.

c. Click Show All below the section to access the Instances page of the service

component.

4. In the Recent Faults section, perform the following tasks:

a. In the Error Message column, click an error message to display complete

information about the fault. If the fault is identified as recoverable, click the Recover Now link to perform fault recovery.

b. In the Recovery column, click a fault identified as Recoverable to perform

fault recovery at the component instance level.

c. In the Logs column, click a specific log to access the Log Messages page with

filtered messages specific to that instance.

d. Click Show All below the section to access the Faults page of the service

component.