Contributor mode for external users (SSXA)

Question

Hi All
On our environment we have UCM 11g and SSXA (with deployed application) and
ActiveDIrectory provider configured on WLS.
I created WCMContributor group in AD and WCMContributor role in UCM
The goal is that external users in WCMContributor group in AD has contributors rights in SSXA (lets be user “test1”)
Weblogic.xml in application has below block:
<security-role-assignment>
<role-name>WCMContributor</role-name>
<principal-name>WCMContributor</principal-name>
</security-role-assignment>
But I get error for user test1:
ERROR: Error creating the contribution markup for placeholder 'ContentPlaceholder'
REASON: User 'test1' does not have sufficient privileges.
If I create local user ‘test2’ in UCM, add him to WCMContributor role and add him to weblogic.xml - it works:
<security-role-assignment>
<role-name>WCMContributor</role-name>
<principal-name>WCMContributor</principal-name>
<principal-name>test2</principal-name>
</security-role-assignment>
But I need to work with external users
Web.xml in application has below block:
<security-constraint>
<web-resource-collection>
<web-resource-name>ContributionMode</web-resource-name>
<url-pattern>/wcm-contrib/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>WCMContributor</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>DesignerMode</web-resource-name>
<url-pattern>/wcm-design/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>WCMContributor</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>OpenWCM</realm-name>
<form-login-config>
<form-login-page>/wcm/support/login/wcm-login.jsp</form-login-page>
<form-error-page>/wcm/support/login/wcm-login.jsp?tryagain=true</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>WCMContributor</role-name>
</security-role>
Please advise
Thanks

Answer 1

Could you please provide a bit more details:
If I create local user ‘test2’ in UCM, add him to WCMContributor role and add him to weblogic.xml - it works:a) Do you really use local users; that is, those created only in User Admin applet? b) Or is it rather that you create users in the security realm of the Weblogic server? I'd actually expect that a) without b) won't work - except for few admin tasks (running applets as standalone applications), local users should not be used in 11g or higher. If you do just b), it's an external user, just coming from a different source.
My guess is that rather than external vs. local, the issue is that mapping of roles from AD is somehow mis-configured (that is, your users don't actually get the role assigned). Pls. check everything once again - a guidance how to map roles is described here: http://docs.oracle.com/cd/E21764_01/doc.1111/e10792/c03_security.htm#BGBCIGEH