Configure JOC for all the Managed Servers for a given cluster.

Advanced Administration 14-25 3. Select the domain for which you want to manage properties.

4. Select WebLogic Domain Web Services Platform Policy Configuration.

The Platform Policy Configuration page appears.

5. Select the Policy Accessor tab.

6. Click Add in the Policy Access Properties section.

7. In the Add New Configure Property dialog, enter the following: ■ Enter the name jndi.lookup.csf.key. This property provides credential configuration java.naming.security.principal and java.naming.security.credentials and is used when an account in the LDAP directory is configured to connect with the Oracle WSM Policy Manager. ■ Enter the value in this example, OID.

8. Click OK.

9. Click Apply and restart WebLogic Server.

Modify the User’s Group or Role Oracle WSM Policy Manager uses the logical role policy.Accessor to secure EJBs that are accessed by the Oracle WSM Agent runtime to access the policies. By default, the policy.Accessor role is mapped to the groups OracleSystemGroup and Administrators. Oracle WSM Agent run time uses the OracleSystemUser identity to access wsm-pm. The new default user must either be included in the Administrator or OracleSystemGroup if the groups exist, or be mapped to the logical role policy.Accessor if the Administrator or OracleSystemGroup groups do not exist. To ensure the user has the required role, perform the following steps: 1. If the Administrator or OracleSystemGroup groups exist in the LDAP or identity store, perform the following: a. In LDAP, add the user that you would like to use as a default administrative user. b. In WebLogic Server Administration Console, ensure that the user exists in the Administrator group. For more information, see Configure Authentication and Identity Assertion providers in Oracle WebLogic Server Administration Console Help. 2. If the Administrator or OracleSystemGroup groups do not exist in the LDAP or identity store, map the new user to the required logical role and redeploy the wsm-pm application using the modified deployment plan. To map the new user or existing users belonging to a group other than Administrator or OracleSystemGroup, perform the following steps: a. Create a deployment plan for deploying wsm_pm.ear. Example 14–1 describes a sample deployment plan. A sample deployment plan, shipped with WebLogic, is available in the ORACLE_HOMEmodulesoracle.wsm.pm_ 11.1.1prov folder. Modify the section to_be_replaced with the new user. Note: The csf-key that you specify in this step must match the csf-key specified for the Policy Manager administrative user in the credential store. For more information, see Configure the Credential Store Provider . 14-26 Oracle Fusion Middleware Security and Administrators Guide for Web Services Example 14–1 Sample Deployment Plan ?xml version=1.0 encoding=UTF-8? deployment-plan xmlns=http:xmlns.oracle.comweblogicdeployment-plan xmlns:xsi=http:www.w3.org2001XMLSchema-instance xsi:schemaLocation=http:xmlns.oracle.comweblogicdeployment-plan http:xmlns.oracle.comweblogicdeployment-plan1.0deployment-plan.xsd application-nameoracle.wsm.pm_11.1.1application-name variable-definition variable nameSecurityRoleAssignment_ejbRole_PrincipalNamename valueto_be_replacedvalue variable variable-definition module-override module-namewsm-pmserver-wls.jarmodule-name module-typeejbmodule-type module-descriptor external=false root-elementweblogic-ejb-jarroot-element uriMETA-INFweblogic-ejb-jar.xmluri variable-assignment nameSecurityRoleAssignment_ejbRole_PrincipalNamename xpathweblogic-ejb-jarsecurity-role-assignment[role-name=policy.Accessor] principal-namexpath operationreplaceoperation variable-assignment module-descriptor module-override deployment-plan b. Redeploy the EAR. For more information, see Deploying an Application with a Deployment Plan in Deploying Applications to Oracle WebLogic Server. Changing the JMS System User for Asynchronous Web Services By default, the JMS System User is set as the OracleSystemUser. For most users, this default value is sufficient. However, if you need to change this value to a custom user in your security realm, you can do so by changing the value of the user in Oracle Enterprise Manager Fusion Middleware Control and in the WebLogic Server Administration Console as described in the following procedure. To change the JMS System User: 1. Access the Configuration tab on the Web Service Endpoint page for the asynchronous Web service as described in Configuring Asynchronous Web Services on page 6-25.

2. Enter the name of the custom user in the JMS System User field and click Apply.

See Figure 14–12 . Note: The custom user must exist in the security realm and have the permissions required to access the JMS resources. Advanced Administration 14-27 Figure 14–12 Setting the JMS System User for Asynchronous Web Services

3. Access the WebLogic Server Administration Console. To do so from Fusion

Middleware Control, select the domain in the navigator pane. From the WebLogic Domain menu, select WebLogic Server Administration Console. 4. Log into the WebLogic Server Administration Console using a valid username and password with the required administrative privileges.

5. Click Deployments in the Domain Structure pane and navigate to the

corresponding service_AsynchRequestProcessorMDB or service_ AsynchResponseProcessorMDB MDBs. In these MDB names, service is the name of the asynchronous service for which you are changing the user name.

6. In the Change Center, select Lock Edit.

7. Select the MDB name for the request or response MDB. You will need to update

the user name for both the request and response MDBs. In the Settings page, select the Configuration tab.

8. In the Enterprise Bean Configuration section of the page, enter the custom user

name in the Run As Principal Name field and click Save. See Figure 14–13 . Note that the user name you enter in this field must match the user name you entered for the JMS System User in Fusion Middleware Control. 14-28 Oracle Fusion Middleware Security and Administrators Guide for Web Services Figure 14–13 WebLogic Server Administration Console Update for JMS System User The configuration changes need to be saved in a new deployment plan. 9. Use the Save Deployment Plan Assistant to save the new deployment plan. 10. Repeat steps 7 and 8 for the second MDB. The changes are automatically saved to the new deployment plan.

11. In the Change Center, click Activate Changes.

12. Redeploy the application. For more information, see Chapter 5, Deploying Web Services Applications.