Adding an Authentication Provider

Configuring Human Workflow Service Components and Engines 19-21

9. Verify the status of the new domain, and click Finish to create the new domain.

To create a user:

1. Click the Create a new entry button in the Data Tree pane. The Entry Properties

page of the Create New Entry wizard appears.

2. Click the Add button to add the required object class for the user. The Add Object

Class dialog appears. 3. Enter the name of the object class. When the correct object class appears in the Name list, select it, and click OK. 4. Repeat Steps 2 and 3 to add all the required object classes for the user. Generally, top , person, inetorgperson, organizationalPerson, and orcluser are the object classes required for a user.

5. Click Browse to choose the parent of the user. The Select Distinguished Name

DN Path dialog appears.

6. Select the parent of the user and click Select.

7. Click Next in the Create New Entry dialog. The Mandatory Properties page of the

Create New Entry wizard appears.

8. Enter and select values for the required fields, and click Next.

You can specify the following information. The Status page of the Create New Entry wizard appears.

9. Verify the status of the new user, and click Finish to create the new user.

Field Description cn Required The common name. sn Required The surname last name. Relative Distinguished Name Required The relative distinguished name of the user. 19-22 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite

10. Click the entry for the newly-created user in the Data Tree pane. The Person page

for the user appears.

11. Enter details about the user, and click Apply.

To create a group:

1. Click the Create a new entry button in the Data Tree pane. The Entry Properties

page of the Create New Entry wizard appears.

2. Click the Add button to add the required object class for the group. The Add

Object Class dialog appears. 3. Enter the name of the object class. When the correct object class appears in the Name list, select it, and click OK. 4. Repeat Steps 2 and 3 to add all the required object classes for the group. Generally, top , groupOfUniqueNames, and orclGroup are the object classes required for a group.

5. Click Browse to choose the parent of the group. The Select Distinguished Name

DN Path dialog appears. Configuring Human Workflow Service Components and Engines 19-23

6. Select the parent of the group and click Select.

7. Click Next in the Create New Entry dialog. The Mandatory Properties page of the

Create New Entry wizard appears.

8. Enter and select values for the required fields, and click Next.

You can specify the following information. The Status page of the Create New Entry wizard appears.

9. Verify the status of the new group, and click Finish to create the new group.

10. Click the entry for the newly-created group in the Data Tree pane. The Group

page for the group appears. Field Description cn Required The common name. Relative Distinguished Name Required The relative distinguished name of the group. 19-24 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite

11. Specify details about the group, and click Apply.

To delete an entry:

1. Select an entry in the Data Tree pane.

2. Click the Delete this entry button in the Data Tree pane.

19.7.3 Configuring the Directory Service

When using Oracle Internet Directory as the authentication provider, you must set the orclsslinteropmode attribute to 0 zero using Oracle Directory Services Manager. To configure the directory service: 1. Launch Oracle Directory Services Manager and choose an Oracle Internet Directory connection using the drop-down list.

2. Click the Data Browser tab.

Note: If the GUID attribute in the LDAP server is set to a binary value, which cannot be properly handled in the identity service, you must map it to a unique attribute that exists in both the user and group object classes and cannot have a binary value. For example, if the cn attribute is unique, it can be used because it satisfies both of these requirements. You map GUID to cn in the jps-config.xml file: property value=GUID=cn name=PROPERTY_ATTRIBUTE_MAPPING For more information about identity store attribute mapping, see Chapter Developing with the User and Role API of the Oracle Fusion Middleware Application Security Guide. Configuring Human Workflow Service Components and Engines 19-25

3. Expand the cn=subconfigsubentry cn=osdldapd cn=oid1 nodes.

4. In the Attributes page, set the orclsslinteropmode attribute to 0.

5. Click the Apply button.

19.7.4 Customizing the Identity Provider

To customize the identity provider for example, to handle user and role information stored in home grown solutions, visit the following URL: http:www.oracle.comtechnologyproductsid_mgmtopssindex.html

19.8 Seeding Users, Groups, and Application Roles using LDAP Tools

This section provides an overview of the procedures required for seeding users, groups, and application roles with LDAP tools. When you create a task, you assign humans to participate in and act upon the task. Participants can perform actions upon tasks during runtime from Oracle BPM Worklist, such as approving a vacation request, rejecting a purchase order, providing feedback on a help desk request, or some other action. There are three types of participants: ■ Users ■ Groups ■ Application roles For more information, see Oracle Fusion Middleware Developers Guide for Oracle SOA Suite.

19.8.1 Changing the Default Password in the Embedded LDAP Server

The password credential is accessible from the Oracle WebLogic Server Administration Console by selecting Security Embedded LDAP for your domain.