Configuration of AXF solutions for Managed Attachment from UCM & IPM

Following are the steps to be followed to configure Managed Attachments from Oracle Webcenter Content for peoplesoft 

Please note : these steps are to cover the configurations required from UCM and IPM only.

And these steps are used for Oracle Webcenter Content and IPM 11.1.1.5.0

Overview

For configuring managed attachment to work for people soft with UCM,it requires an AXF solution.

And AXF solution comes with IPM (AXF tables are a part of IPM data base schema).

Following are the steps followed to setup the AXF solution adapter for people soft from ECM

1.      Setup IPM as managed server in ECM
2.     Configure a UCM connection from IPM for the content repository
3.      Enable IpmRespository, AppAdapterCore , AppAdapterPSFT and Content Folios in UCM

Please Note : for PS4, AppAdapterCore and AppAdapterPSFT components have bugs. A patch for these two components are available in support.oracle.com ( patch number : Patch 12878079: EBS/PSFT Adapter for ECM Managed Attachments 11.1.1.4.0 Patch (build 3) ).  Though it says for PS3, it is applicable for PS4 ( 11.1.1.5.0) as well.

 So if we are setting it for the first time, these two components need to be downloaded from the support and follow the steps given in the readme.txt for the same to apply it

Else disable the components, and install and enable the patched components by following the steps given in readme.txt file

        4. Run the following installation scripts  in IPM Schema

(Scripts are located in  MW_HOME/ECM_HOME/axf/adapters/psft/)

INSERT INTO AXF_SOLUTIONS (SOLUTION_NAMESPACE, SOLUTION_CONTEXT) VALUES ('UCM_Managed_Attachments', 'ejb.AxfCommandMediator#oracle.imaging.axf.service.AxfCommandMediatorRemote');

INSERT INTO AXF_COMMANDS (SOLUTION_NAMESPACE, COMMAND_CLASS, COMMAND_NAMESPACE) VALUES ('UCM_Managed_Attachments', 'oracle.imaging.axf.commands.ucm.AfGrantAccessCommand', 'UCM_Managed_Attachments');

INSERT INTO AXF_SOLUTION_PARAMETERS (SOLUTION_NAMESPACE, COMMAND_NAMESPACE, CONFIGURATION_NAMESPACE, PARAMETER_KEY, PARAMETER_VALUE) VALUES ('UCM_Managed_Attachments', 'UCM_Managed_Attachments', 'oracle.imaging.axf.commands.ucm.AfGrantAccessCommand', 'RIDC_CONNECTION_STR', 'idc://<hostname>:4444');

INSERT INTO AXF_SOLUTION_PARAMETERS (SOLUTION_NAMESPACE, COMMAND_NAMESPACE, CONFIGURATION_NAMESPACE, PARAMETER_KEY, PARAMETER_VALUE) VALUES ('UCM_Managed_Attachments', 'UCM_Managed_Attachments', 'oracle.imaging.axf.commands.ucm.AfGrantAccessCommand', 'UCM_CONNECTION_STR', 'http://<hostname>/cs/idcplg/_p/min/af/trigger-[ContentServerProfile]?IdcService=GET_SEARCH_RESULTS_FORCELOGIN&ResultCount=5&ResultTemplate=[ResultTemplate]&SearchEngineName=DATABASE.METADATA.AFLIST');

INSERT INTO AXF_SOLUTION_PARAMETERS (SOLUTION_NAMESPACE, COMMAND_NAMESPACE, CONFIGURATION_NAMESPACE, PARAMETER_KEY, PARAMETER_VALUE) VALUES ('UCM_Managed_Attachments', 'UCM_Managed_Attachments', 'oracle.imaging.axf.commands.ucm.AfGrantAccessCommand', 'UCM_ADMIN_USER', 'sysadmin');

 5.  Verifying Required Oracle UCM Components and Configuration

Follow these steps to verify that required Oracle UCM components are enabled on the Content Server.

          1.    Log in to Content Server as an administrator.

          2.    Click the Configuration for [Instance] link in the content server Administration tray.

          3.    In the Features And Components section, click Enabled Component Details.

         4.    From the details shown, verify that the following components are enabled. If a component is not listed, install and enable it according to its installation documentation.

The following components must be at or above the version level included with Oracle UCM 11gR1 release 11.1.1.4:

o    YahooUserInterfaceLibrary

o    CheckoutAndOpenInNative

o    CoreWebdav

o    NativeOsUtils

o    ContentFolios

         5.    In the User Admin applet, ensure that the roles below have the correct access level to the corresponding security groups. 

6.   In Content Server, select the Administration option from the main menu, choose Admin Applets, then User Admin. Select Security, then Permissions by Role.

o    AFAdmin: AFDocuments (RWDA) and no permissions on any other groups

o    AFDelete: AFDocuments (RWD) and no permissions on any other groups

o    AFWrite: AFDocuments (RW) and no permissions on any other groups

o    AFRead: AFDocuments (R) and no permissions on any other groups

Integrating Microsoft's Active Directory with Oracle Webcenter Cotnent -11g

In a production system, Oracle Enterprise Content Management Suite applications need to use an external Lightweight Directory Application Protocol (LDAP) authentication provider. You need to reassociate the identity store for your application with one of the following external LDAP authentication providers before you complete the configuration of a Managed Server, before you connect a Managed Server to a repository, and before the first user logs in to the application:

Unlike the previous versions, LDAP provider needs to be configured in Weblogic server NOT IN  UCM.

Steps to integrate microsoft's active directory is as follows ( i have used security group based security model to create this example)

1) Login to weblogic console of the domain and navigate to 'Domain Structure' as given below

                                    2) On click of 'Security Realms, following page appears

                                    3)  Click on 'myrealm'  and the following page appears

 

Click on 'Providers' link as marked above

                                    4) Providers page appears

                                  

                                     Select 'New' to create a new providers

                                    5) Screen to enter ther 'Name' and 'Type' for the new provider appears

                                        

                                      For active directory the type should be : ActiveDirectoryAuthenticator

LDAP Authentication Provider                   Authenticator Type

                                         Microsoft AD                                       ActiveDirectoryAuthenticator

                                           Click 'Ok'

                                                   

                                         6)  Settings for 'my realm' appears as given below.  

                                          The newly created  provider   should be the first on in the list. To do that, we need to

                                            reorder the listing of providers using ‘Reorder’.

Reorder page appears as given below

Using the arrow buttons, move the newly created provider to the top of the list and click 'Ok'

On clicking 'Ok' , providers list will be updated as given below

 

                                       

     7)   Click on the newly created provider name and ‘Settings for <newly created provider> page gets displayed . 

  

                                      Select 'Control Flag' as 'Sufficient' for the newly created provider and click 'Save'.

 

8)    After changing the control flag and saving the settings click on ‘Provider Specific’ tab in the same page.

                                      ‘Settings’ page for the new provider  gets displayed as given below

9)    To connect the specific provider, we need to provide the details

  Set Provider Specific values in the following fields, and leave default values in the other fields:

Set connection Details

• Host: The host name or IP address of the LDAP server.
•  Port: The Oracle Internet Directory Port, 389 by default.
• Principal: The Distinguished Name (DN) of the LDAP user that Oracle WebLogic Server should use to connect to the LDAP server; for example:
•  cn=orcladmin
• Credential: The credential used to connect to the LDAP server (usually a password).
•  Confirm Credential: The same value as for the Credential field.

 

User Details

• User Base DN: The base distinguished name (DN) of the tree in the LDAP directory that contains users; for example:
•  cn=users,dc=example,dc=co      
•  Note: Use an exact DN rather than a top-level DN. Using a top-level DN would provide access to all the default users and groups under the DN, giving access to more users than required by the application.

•  Use Retrieved User Name as Principal: Specifies whether or not the user   name retrieved from the LDAP server should be used as the Principal value.

Group Details

•   Group Base DN: The base distinguished name (DN) of the tree in the LDAP directory that contains groups; for example:

                           cn=groups,dc=example,dc=com

                                 After specifying connection, users and groups details. click on 'save' to save all the details.

                          10) Go back to the list of providers screen ( my realm page) and click on the default provider as give below

 

‘Settings’ page for the default provider opens as given below

Change the control flag for the ‘default provider’ to ‘Sufficient’ and click ‘Save’

11)    Restart the admin server using windows service

12)    Relogin to admin server

13)    Navigate to ‘my realm’ page as given below and click on ‘Users and Groups’ tab

 

14)    Users and Groups gets displayed as given below

 

Groups 

                          Verify whether the user names/groups  listed above are coming from the newly  configured provider by checking the ‘Provider’ column for each user as given in the screen shot. 

15) The next step is to map the groups from AD to UCM/Oracle Webcenter Groups

                           For that we need to create 'Roles' in Oracle Webcenter Content , with the same name as that of Groups

 

As given the screen shot above, we need to create Roles and assign rights to them. 

16) The next steps is to map the groups to these roles using credential mapping

For that we need to create a credential mapping as given below

 

                         Once the credential mapping is added as given above, an entry for the mapping should be added into the providers

                       For that  navigate to the provider.hda file for jps provider located at <domain_name>/ucm/cs/data/providers/jpsprovider

There in add the following variable:

ProviderCredentialsMap=<map name created above>

Save the file and restart UCM server .

17) Once the servers are restarted, login to Oracle Webcenter Content with the AD users and verify the access rights.

For more info : http://docs.oracle.com/cd/E12839_01/webcenter.1111/e12405/wcadm_security.htm#BGBHHGEH