How to configure SOA Suite 11g Worklist with LDAP Identity Store

Question

Hi
Im trying to configure the worklistapp to use an ldap identity store (SOA Suite 11g)
The ldap is a open source ldap (Open DS in this case), is NOT : OID, OVD, Active Directory, WLS OVD, IPlanet.
for doing so, i did the next configurations:
workflow-identity-config.xml
<configuration realmName="realm1">
<provider providerType="JPS" name="JpsProvider" service="Identity">
<property name="jpsContextName" value="worklist" />
</provider>
</configuration>
jps-config.xml
<?xml version="1.0" encoding="UTF-8" standalone='yes'?>
<jpsConfig xmlns="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/oracleas/schema/11/jps-config-11_1.xsd" schema-major-version="11" schema-minor-version="1">
     <!-- This property is for jaas mode. Possible values are "off", "doas" and "doasprivileged" -->
     <property name="oracle.security.jps.jaas.mode" value="off"/>
     <property name="custom.provider" value="true"/>
<serviceProviders>
<serviceProvider type="IDENTITY_STORE" name="idstore.ldap.provider" class="oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider">
<description>LDAP-based IdentityStore Provider</description>
</serviceProvider>
</serviceProviders>
<serviceInstances>
          <serviceInstance name="idstore.ldap.opends" provider="idstore.ldap.provider">
               <property name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
               <property name="idstore.type" value="CUSTOM"/>
               <property name="ldap.url" value="ldap://host:port"/>
               <property name="subscriber.name" value="dc=company,dc=com"/>
               <property name="search.type" value="SIMPLE"/>
               <property name="security.principal" value="cn=adminuser,dc=company,dc=com"/>
               <property name="security.credential" value="!adminuser_password"/>
               <property name="user.login.attr" value="cn"/>
               <property name="username.attr" value="cn"/>               
               <property name="groupname.attr" value="cn"/>
               <extendedProperty>
                    <name>group.mandatory.attrs</name>
                    <values>
                         <value>cn</value>
                         <value>objectClass</value>
                    </values>
               </extendedProperty>
               <extendedProperty>
                    <name>group.object.classes</name>
                    <values>
                         <value>top</value>
                         <value>groupOfUniqueNames</value>
                    </values>
               </extendedProperty>
               <extendedProperty>
                    <name>group.filter.object.classes</name>
                    <values>
                         <value>groupOfUniqueNames</value>
                    </values>
               </extendedProperty>
               <extendedProperty>
                    <name>group.member.attrs</name>
                    <values>
                         <value>uniqueMember</value>
                    </values>
               </extendedProperty>
               <extendedProperty>
                    <name>group.search.bases</name>
                    <values>
                         <value>o=groups,dc=company,dc=com</value>
                    </values>
               </extendedProperty>
               <extendedProperty>
                    <name>user.mandatory.attrs</name>
                    <values>
                         <value>cn</value>
                         <value>objectClass</value>
                         <value>sn</value>
                    </values>
               </extendedProperty>
               <extendedProperty>
                    <name>user.object.classes</name>
                    <values>
                         <value>organizationalPerson</value>
                         <value>person</value>
                         <value>inetOrgPerson</value>
                         <value>top</value>
                    </values>
               </extendedProperty>
               <extendedProperty>
                    <name>user.filter.object.classes</name>
                    <values>
                         <value>inetOrgPerson</value>
                    </values>
               </extendedProperty>
               <extendedProperty>
                    <name>user.search.bases</name>
                    <values>
                         <value>o=users,dc=company,dc=com</value>
                    </values>
               </extendedProperty>
          </serviceInstance>
     </serviceInstances>
<jpsContexts default="default">
<jpsContext name="worklist">
<serviceInstanceRef ref="credstore"/>
<serviceInstanceRef ref="keystore"/>
<serviceInstanceRef ref="policystore.xml"/>
<serviceInstanceRef ref="audit"/>
<serviceInstanceRef ref="idstore.ldap.opends"/>
</jpsContext>
</jpsContexts>
</jpsConfig>
but i get the error:
Jul 2, 2009 12:52:40 PM oracle.security.jps.internal.idstore.util.IdentityStoreUtil getIdentityStoreFactory
WARNING: The identity store factory name is not configured.
Jul 2, 2009 12:52:40 PM oracle.bpel.services.common.ServicesLogger __logException
SEVERE: <.> Error in authenticating user.
Error in authenticating and creating a workflow context for user realm1/user1.
Verify that the user credentials and identity service configurations are correct.
ORABPEL-30501
Error in authenticating user.
Error in authenticating and creating a workflow context for user sigfe.com/user1.
Verify that the user credentials and identity service configurations are correct.
at oracle.bpel.services.workflow.verification.impl.VerificationService.authenticateUser(VerificationService.java:603)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
So, anyone knows how i can specify the identity store factory?
or the correct parameters for a ldap identity store repository?
I used the 11G documentation for the security file :
http://download.oracle.com/docs/cd/E12839_01/core.1111/e10043/jpsprops.htm
thanks

Answer 1

I am having exactly the same issue. Once I configure jps-config.xml file to use my custom authenticator and login into the worklist app, the following gets thrown. I was wondering if you need map some roles to the existing users in the Custom Authenticator.
Exception
exception.70692.type: error
exception.70692.severity: 2
exception.70692.name: Error while granting BPMOrganizationAdmin role to SOAOperator.
exception.70692.description: Error occured while granting the application role BPMOrganizationAdmin to application role SOAOperator.
exception.70692.fix: In the policy store, please add SOAOperator role as a member of BPMOrganizationAdmin role, if it is not already present.