Control user access in SOA Suite 11.1.1.2 Console

Question

Hi All,
We recently migrated our application from SOA Suite 11.1.1.1 to 11.1.1.2 . In 1.1 we had an end user account assigned to the Monitor group which could access the middleware console and view composite flows but could not deploy/undeploy or retire/activate processes. However the same user in 1.2 can log in to the console but cannot view a composite flow.
In the dashboard we get the following error:
Unable to retrieve composite details.
Error retrieving Composite CompositeName (1.0) details from soa-infra runtime. This could happen due to the errors in soa-infra initialization. Please view the log files for details.
EJB Exception: ; nested exception is:
java.lang.RuntimeException: Caller doesn't have enough permission to call this method.
My question is... how do we create a user in weblogic which will allow a user to view process flows but wont not deploy/undeploy or retire/activate privileges?
Thanks in advance,
Shaf
Edited by: soa_adf on Jul 15, 2010 11:44 AM

Answer 1

So the reason is, you need to add users/groups to the SOAMonitor Application Role for them to be able to view instance data. Below are the instructions.
Here are the instructions on how to create Monitoring Roles:
Instruction to add SOA application role SOA Monitor to user "monitoruser":
1. log in em as weblogic user
2. right click on SOA/soa-infra(soa_server1) on the left panel and select Security => Application Roles.
3. click on the "play button" to select "Role Name". A list will appear and you select SOAMonitor. The page "Application Roles > Edit Application Role" appears.
4. Click Users/Add Users, a "Add User" popup appears. Click on the "play button", select user "monitoruser" from left column and move it to the right column. And click on "ok"
If you have your WebLogic environment set up per EDG Guidelines (where your admin servers and managed servers are on different hosts or same host, different directories) you may not be able to see the list of Application Roles in the above instructions. First you would need to copy your JAZN Policies to the Admin Server or move to LDAP. The SOA Application Roles and policies will likely be stored in your mserver configuration (if you deployed SOA there). A restart is not required afterwards.
As per the docs EDG deployment requires OID for policy store because there are two copies of policy store file, system-jazn-data.xml:
$ORACLE_BASE/admin/soaedg_domain/mserver/soaedg_domain/config/fmwconfig/system-jazn-data.xml
and
$ORACLE_BASE/admin/soaedg_domain/aserver/soaedg_domain/config/fmwconfig/system-jazn-data.xml
EDG states in section 11.1.1
http://download.oracle.com/docs/cd/E14571_01/core.1111/e12036/oam.htm#CACJADGI
"...The Oracle Fusion Middleware SOA Suite EDG topology uses different domain homes for the Administration Server and the Managed Server, thus Oracle requires the use of an LDAP store as policy and credential store for integrity and consistency..."