Introduction to WebCenter Application Security

27-6 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter Security configuration file jps-config.xml. When you reassociate the policy store to an LDAP directory, the application credentials are automatically migrated to the same LDAP directory as the policy store.

27.2.4 Default Policy Store Permissions and Grants

The ADF Security permissions model supports both permission-based and role-based authorization. These two types of authorization, and the default Policy Store permissions and code based grants are discussed in the following sections: ■ Section 27.2.4.1, Permission-based Authorization ■ Section 27.2.4.2, Role-mapping Based Authorization ■ Section 27.2.4.3, Default Policy Store Permissions for WebCenter Spaces ■ Section 27.2.4.4, Default Code-based Grants

27.2.4.1 Permission-based Authorization

Permission-based authorization is used for services, such as Lists, where access control is implemented within the WebCenter application using Oracle Platform Security Services OPSS. WebCenter Spaces provides extensive user and role management tools with which you can create application roles, and define what permissions should be granted to those roles. For information on managing users and roles in WebCenter Spaces, see Managing Application Roles and Permissions in Oracle Fusion Middleware Users Guide for Oracle WebCenter.

27.2.4.2 Role-mapping Based Authorization

Services that need to access remote back-end resources require role-mapping based authorization. For example, for the Discussions service, role mapping is required when the users of a WebCenter application mapping to one or more group space roles must be mapped to another set of roles on the Oracle WebCenter Discussions Server. In WebCenter Spaces: ■ WebCenter Spaces roles are mapped to corresponding roles on the Oracle WebCenter Discussions Server. ■ When a user is granted a new WebCenter Space role, a similar grant privilege is granted in the back-end server. For example, when user Pat is granted Discussions-CreateEditDelete permissions in WebCenter Spaces, Pat is granted corresponding permissions in the back-end discussion server. See also, Understanding Discussions Server Role and Permission Mapping in Oracle Fusion Middleware Users Guide for Oracle WebCenter.

27.2.4.3 Default Policy Store Permissions for WebCenter Spaces

Out-of-the box, WebCenter Spaces provides the following default roles: Default application roles: ■ Administrator ■ Authenticated-User ■ Public-User For more information about the default application roles, see Default Permissions for Application Roles in the Oracle Fusion Middleware Users Guide for Oracle WebCenter. Managing WebCenter Portal Application Security 27-7 Default roles in a space: ■ Moderator ■ Participant ■ Viewer For more information about the default role within a space, see Default Permissions for Roles in a Space in the Oracle Fusion Middleware Users Guide for Oracle WebCenter.

27.2.4.4 Default Code-based Grants

WebCenter applications make internal calls to APIs on the security platform that are secured with permission checks. Consequently, the WebCenter application must be granted appropriate permissions to invoke the OPSS APIs for example, the permission to access the policy store and grant or revoke permissions PolicyStoreAccessPermission, or grant basic permissions to application roles. In the case of WebCenter Spaces, basic application role permissions are granted by default as described in Default Permissions for Application Roles in the Oracle Fusion Middleware Users Guide for Oracle WebCenter. Similarly, WebCenter applications must pre-authorize access to various operations that it wants to expose using the WebCenter permissions, and then invoke the OPSS APIs as privileged actions.

27.2.5 Post-deployment Security Configuration Tasks

After deploying your WebCenter Portal application or WebCenter Spaces, consider the following security-related configuration tasks for your site: ■ Reassociating the identity store to use an external LDAP By default, WebCenter applications use an embedded LDAP for its identity store. Although secure, the out-of-the-box embedded LDAP may not scale appropriately for large enterprise production environments. For instructions on how to configure the identity store to use an external LDAP such as Oracle Internet Directory OID, see Chapter 28, Configuring the Identity Store. Note: By default, Oracle WebCenter Discussions is configured to use the embedded LDAP identity store: All users in the embedded LDAP store can log on to the discussions server, and all users in the Administrators group have administrative privileges on Oracle WebCenter Discussions. If you reassociate the identity store with an external LDAP server, you must either move the Fusion Middleware administrator account to the external LDAP as described in Section 28.5, Moving the Administrator Account to an External LDAP Server , or if you choose not to move the administrator account, you must perform some additional steps to identify the new administrator account for the discussions server as described in Section 28.5.1, Migrating the WebCenter Discussions Server to Use an External LDAP. For WebCenter Spaces, both WebCenter Spaces and Oracle Content Server must share the same LDAP server. For more information, see Section 28.6, Configuring the Oracle Content Server to Share the WebCenter Spaces Identity Store LDAP Server. 27-8 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter ■ Reassociating the policy store to use an external LDAP or database By default, WebCenter Portal applications use a file-based system-jazn-data.xml policy store to store policy grants. You should consider using an LDAP-based or database policy store. For information on how to configure the policy store to use an LDAP server or database, see Chapter 29, Configuring the Policy and Credential Store. ■ Configuring WS-Security Although the use of WS-Security adds complexity to the configuration and management of a WebCenter Portal application and the set of producers it consumes, it helps ensure the security of the information being published by the WebCenter Portal application. Adding WS-Security provides authentication for the consumer, and message-level security. For information on how to configure WS-Security for WebCenter applications and components, see Chapter 32, Configuring WS-Security. ■ Configuring SSO Single Sign-On SSO allows users to log in once across WebCenter applications and components rather than having to log in for each sub-application for example, for accessing a wiki page in WebCenter Spaces. Users do not have to maintain a separate user ID and password for each application or component that they access. However, you can still configure a variety of authentication methods, so that more sensitive applications can be protected using more stringent methods. WebCenter supports four single sign-on solutions: Oracle Access Manager OAM, Oracle Single Sign-on OSSO, a SAML-based single sign-on solution for Oracle WebCenter applications only, and an SSO solution for Microsoft clients, using Windows authentication based on the Simple and Protected Negotiate SPNEGO mechanism and the Kerberos protocol. For a discussion of these solutions and an overview of single sign-on, see Chapter 30, Configuring Single Sign-on. ■ Configuring SSL Secure Sockets Layer SSL provides additional security for connections between WebCenter applications or components by providing an additional authentication layer, and by encrypting the data exchanged. For connections between applications or components where the data exchanged is sensitive, consider securing the connection with SSL. For a list of the connections that can and should be protected with SSL in a production environment, see Chapter 31, Configuring SSL.

27.3 Troubleshooting Security Configuration Issues

This section includes the following sub-sections: ■ Section 27.3.1, Webcenter Spaces Does Not Find Users in LDAP Provider ■ Section 27.3.2, Group Space Gets Created with Errors When Logged in as OID User ■ Section 27.3.3, Users Cannot Self-Register when WebCenter Spaces Configured with Active Directory Note: Using SSL is computationally intensive and adds overhead to a connection. SSL should therefore not be used where it is not required, and is best reserved for production environments. Managing WebCenter Portal Application Security 27-9 ■ Section 27.3.4, User Made Administrator Does Not Have Administrator Privileges ■ Section 27.3.5, OmniPortlet Producer Authorization Exception in SSO Environment ■ Section 27.3.6, Deploying the SAML SSO-specific Discussions EAR file Produces an Exception ■ Section 27.3.7, Configuring SAML Single Sign-on Produces 403 Error

27.3.1 Webcenter Spaces Does Not Find Users in LDAP Provider

Problem Weblogic Server was configured with an external LDAP provider. Users in the external LDAP can log in to WebCenter Spaces, but when you try to assign the administrator role, in WebCenter Spaces, to a user from the external LDAP, no users are found. Solution Change the Control Flag for the DefaultAuthenticator Authentication Provider to Sufficient as described in Chapter 28, Configuring the Identity Store. Restart the Administration Server and Managed Servers for the domain.

27.3.2 Group Space Gets Created with Errors When Logged in as OID User

Problem When logged in to WebCenter as an OID user for example, orcladmin, and you try to create a group space, the group space gets created but with errors. The error message appears as No matching users were found with search string login user. Solution The following property is missing in the jps-config.xml file: property name=jps.user.principal.class.name value=weblogic.security.principal.WLSUserImpl To fix this: 1. Edit MIDDLEWARE_HOMEuser_projectsdomainsWebCenterconfigfmwc onfigjps-config.xml. 2. Add this line in the general properties: property name=jps.user.principal.class.name value=weblogic.security.principal.WLSUserImpl 3. Restart the WLS_Spaces server.