File-based Credential Store Default Identity and Policy Stores

27-10 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter

27.3.3 Users Cannot Self-Register when WebCenter Spaces Configured with Active Directory

Problem Users cannot self-register with Active Directory after configuring WebCenter Spaces to use AD authenticator. When a user tries to self-register, the following error message appears: User not created. Either the user name or the password does not adhere to the registration policy or the identity store is unavailable. Specify the required user credentials or contact your administrator for assistance. Solution To fix the problem: 1. Set the user name attribute to sAMAccountName while configuring Active Directory in the WebLogic Administration Console. 2. Use the HTTPS port of the LDAP and enable the SSL checkbox while configuring Active Directory in the WebLogic Administration Console.

27.3.4 User Made Administrator Does Not Have Administrator Privileges

Problem After logging in as orcladmin and making a user an administrator, after logging out and logging in as that user, the Administrator link is still not available. Solution The problem is due to duplicate cn entries in the identity store. Since cn is mapped to the username attribute, it must be unique. Remove the duplicate from the identity store and the user should have the appropriate privileges.cn.

27.3.5 OmniPortlet Producer Authorization Exception in SSO Environment

Problem OmniPortlet producer receives an authorization exception when it tries to store connection information in the Credential Store Framework CSF wallet when WebCenter is configured with SSO. Solution Grant the required permissions to ssofilter.jar by connecting to the Oracle WebCenter Administration Server using WLST for more information, see Section 1.13.3.1, Running Oracle WebLogic Scripting Tool WLST Commands and running the following grant commands: grantPermissioncodeBaseURL=file:{oracle.home}modulesoracle.ssofilter_11.1.1s sofilter.jar, permClass=oracle.security.jps.service.credstore.CredentialAccessPermission, permTarget=context=SYSTEM,mapName=omniportlet_user,keyName=, permActions= grantPermissioncodeBaseURL=file:{oracle.home}modulesoracle.ssofilter_11.1.1s sofilter.jar, Managing WebCenter Portal Application Security 27-11 permClass=oracle.security.jps.service.credstore.CredentialAccessPermission, permTarget=context=SYSTEM,mapName=omniportlet_default,keyName=, permActions= grantPermissioncodeBaseURL=file:{oracle.home}modulesoracle.ssofilter_11.1 .1ssofilter.jar, permClass=oracle.security.jps.service.credstore.CredentialAccessPermission, permTarget=context=SYSTEM,mapName=omniportlet_user,keyName=, permActions=

27.3.6 Deploying the SAML SSO-specific Discussions EAR file Produces an Exception

Problem Undeploying the Discussions EAR file and deploying the SAML SSO-specific Discussions EAR file and then starting the application in the WLS Administration Console produces the following exception: java.lang.ClassCastException: org.apache.xerces.parsers.XIncludeAwareParserConfiguration Solution Restart the WC_Collaboration server. This should fix the issue and the Discussions application will be in an active state.

27.3.7 Configuring SAML Single Sign-on Produces 403 Error

Problem While testing a SAML SSO configuration you encounter 403 errors, and after turning on debug logging, as described in Section 30.4.2.4, Checking Your Configuration, you see the following kind of error logs in the destination server: Oct 11, 2010 10:20:31 PM PDT Debug SecuritySAMLLib adc2170966 soa_server1 [ACTIVE] ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning WLS Kernel efaf471a17d5a745:-5ba0524a:12b9b0b7849:-8000-0000000000015385 1286860831335 BEA-000000 SAMLSignedObject.verify: validating signature Oct 11, 2010 10:20:31 PM PDT Debug SecuritySAMLService adc2170966 soa_server1 [ACTIVE] ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning WLS Kernel efaf471a17d5a745:-5ba0524a:12b9b0b7849:-8000-0000000000015385 1286860831336 BEA-000000 SAMLDestinationSiteHelper: Signature verification failed with exception: org.opensaml.InvalidCryptoException: SAMLSignedObject.verify failed to validate signature value Oct 11, 2010 10:20:31 PM PDT Debug SecuritySAMLService adc2170966 soa_server1 [ACTIVE] ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning WLS Kernel efaf471a17d5a745:-5ba0524a:12b9b0b7849:-8000-0000000000015385 1286860831336 BEA-000000 SAMLDestinationSiteHelper: Unable to validate response -- returning SC_FORBIDDEN Oct 11, 2010 10:20:31 PM PDT Debug SecuritySAMLService adc2170966 soa_server1 [ACTIVE] ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning WLS Kernel efaf471a17d5a745:-5ba0524a:12b9b0b7849:-8000-0000000000015385 1286860831336 BEA-000000 SAMLSingleSignOnService.doACSGet: Failed to get SAML credentials -- returning