Default Policy Store Permissions for WebCenter Spaces

Managing WebCenter Portal Application Security 27-11 permClass=oracle.security.jps.service.credstore.CredentialAccessPermission, permTarget=context=SYSTEM,mapName=omniportlet_default,keyName=, permActions= grantPermissioncodeBaseURL=file:{oracle.home}modulesoracle.ssofilter_11.1 .1ssofilter.jar, permClass=oracle.security.jps.service.credstore.CredentialAccessPermission, permTarget=context=SYSTEM,mapName=omniportlet_user,keyName=, permActions=

27.3.6 Deploying the SAML SSO-specific Discussions EAR file Produces an Exception

Problem Undeploying the Discussions EAR file and deploying the SAML SSO-specific Discussions EAR file and then starting the application in the WLS Administration Console produces the following exception: java.lang.ClassCastException: org.apache.xerces.parsers.XIncludeAwareParserConfiguration Solution Restart the WC_Collaboration server. This should fix the issue and the Discussions application will be in an active state.

27.3.7 Configuring SAML Single Sign-on Produces 403 Error

Problem While testing a SAML SSO configuration you encounter 403 errors, and after turning on debug logging, as described in Section 30.4.2.4, Checking Your Configuration, you see the following kind of error logs in the destination server: Oct 11, 2010 10:20:31 PM PDT Debug SecuritySAMLLib adc2170966 soa_server1 [ACTIVE] ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning WLS Kernel efaf471a17d5a745:-5ba0524a:12b9b0b7849:-8000-0000000000015385 1286860831335 BEA-000000 SAMLSignedObject.verify: validating signature Oct 11, 2010 10:20:31 PM PDT Debug SecuritySAMLService adc2170966 soa_server1 [ACTIVE] ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning WLS Kernel efaf471a17d5a745:-5ba0524a:12b9b0b7849:-8000-0000000000015385 1286860831336 BEA-000000 SAMLDestinationSiteHelper: Signature verification failed with exception: org.opensaml.InvalidCryptoException: SAMLSignedObject.verify failed to validate signature value Oct 11, 2010 10:20:31 PM PDT Debug SecuritySAMLService adc2170966 soa_server1 [ACTIVE] ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning WLS Kernel efaf471a17d5a745:-5ba0524a:12b9b0b7849:-8000-0000000000015385 1286860831336 BEA-000000 SAMLDestinationSiteHelper: Unable to validate response -- returning SC_FORBIDDEN Oct 11, 2010 10:20:31 PM PDT Debug SecuritySAMLService adc2170966 soa_server1 [ACTIVE] ExecuteThread: 1 for queue: weblogic.kernel.Default self-tuning WLS Kernel efaf471a17d5a745:-5ba0524a:12b9b0b7849:-8000-0000000000015385 1286860831336 BEA-000000 SAMLSingleSignOnService.doACSGet: Failed to get SAML credentials -- returning 27-12 Oracle Fusion Middleware Administrators Guide for Oracle WebCenter Solution Chances are that something went wrong with your certificate setup due to which SAML assertions are not getting validated. This is likely because the certificate registered in the SAML Identity asserter is incorrect. Export the certificate used for SAML SSO setup in the WebCenter Spaces domain specified by certAlias and certPassword and copy it to a accessible location in the destination domain. 1. Update the relevant config section in the wcsamlsso.properties file in the WebCenter Spaces domain for example, if the certificate was invalid for the SOA configuration, update the certPath in the soa_config section. 2. Open the WebLogic Server Admin Console, and from the WC_Spaces domain go to Security Realm Providers Credential Mapping wcsamlcm Management Relying Parties and delete the relying parties relevant to the domain for example, for SOA, they would be Worklist Integration, Worklist Detail, and Worklist SDP.

3. Go to Destination Domain Security Realm Providers Authentication

wcsamlia Management Asserting Parties and delete the corresponding asserting parties. 4. Open the Certificates tab and delete the certificate as well. 5. Go back to the WebCenter Spaces domain and re-run the scripts for creating asserting-relying parties pairs. For SOA, for example, you would need to re-run: WC_ORACLE_HOMEwebcenterscriptssamlssoconfigureWorklistIntegration.py WC_ORACLE_HOMEwebcenterscriptssamlssoconfigureWorklistDetail.py WC_ORACLE_HOMEwebcenterscriptssamlssoconfigureWorklistSDP.py 6. Test your configuration again. If all works well, you can disable SAML logging.