LDAP help

Question

It says in the documentation (Fusion developer guide) that any LDAPv3 will do the job...
Well I have a problem (that seems to be a little oracle specific). After configuring OpenLDAP (added some users and groups), I added it as an provider for WLS (an it works... meaning that the users and groups are retrieved). Then I started ADF Security wizard and choose LDAP, entered all the necessary info and finished. Now I have some problems:
1) Using BC Browser triggers the authentification, but the process fails with
javax.naming.NameNoFoundException: [LDAP: error code 32 - No Such Object]; remaining name 'cn=common, cn=products, cn=oraclecontext'I must say I do not have such entry 'cn=common, cn=products, cn=oraclecontext'. I would like to replicate that (I bet in OID it exists) but I don't know where it sits what it contains(attributes,sub-entry)
Anyone managed some other LDAP sever beside OID? How did you do it?
2)testing in browser (with internal WLS) i authenticate ( on a page i display my status)
username florinp
principal florinp
subject florinp; developers; authenticated-role; anonymous-role;
roles developers; authenticated-role; anonymous-role;
authenticated true
code behind is
    public boolean isAuthenticated() {
        return ADFContext.getCurrent().getSecurityContext().isAuthenticated();
    public String getPrincipal() {
        return ADFContext.getCurrent().getSecurityContext().getUserPrincipal().getName();
    public String getRoles() {
        StringBuffer sb = new StringBuffer();
        int roles = ADFContext.getCurrent().getSecurityContext().getUserRoles().length;
        String[] rol = ADFContext.getCurrent().getSecurityContext().getUserRoles();
        for (int i = 0 ;i < roles ; i++)  {
            sb.append(rol[i]+"; ");
        return sb.toString();
    public String getSubject() {
        StringBuffer sb = new StringBuffer();
        for(Principal p :ADFContext.getCurrent().getSecurityContext().getSubject().getPrincipals()){
            sb.append(p.getName()+"; ");
        return sb.toString();
    public String getUser() {
        return ADFContext.getCurrent().getSecurityContext().getUserName();
    }but trying to access a taskflow ( it contains deps.jspx with no grants) granted to authenticated-role gives me
oracle.adf.controller.security.AuthorizationException: ADFC-0619: Authorization check failed: '/WEB-INF/task-flow-definition.xml#task-flow-definition' 'VIEW'.although is granted to any user
<grant>
                  <grantee>
                     <principals>
                        <principal>
                           <class>oracle.security.jps.internal.core.principals.JpsAuthenticatedRoleImpl</class>
                           <name>authenticated-role</name>
                        </principal>
                     </principals>
                  </grantee>
                  <permissions>
                     <permission>
                        <class>oracle.adf.share.security.authorization.RegionPermission</class>
                        <name>hxbs.view.pageDefs.statusPageDef</name>
                        <actions>view</actions>
                     </permission>
                     <permission>
                        <class>oracle.adf.controller.security.TaskFlowPermission</class>
                        <name>/WEB-INF/task-flow-definition.xml#task-flow-definition</name>
                        <actions>view</actions>
                     </permission>
                  </permissions>
               </grant>and 'authenticated=true'
on standalone WLS Can't even access the status page (granted to anonymous-role and authenticated-role)... perhaps I have to migrate my policies... but why isn't it working on the internal wls?
thanks
Florin POP

Answer 1

Hi,
1) Setting LDAP as a security provider at design time is not supported and will be removed in a next release. So the solution is - don't configure LDAP.
2) for authorization,
<grantee>
<principals>
<principal>
<class>oracle.security.jps.internal.core.principals.JpsAuthenticatedRoleImpl</class>
<name>authenticated-role</name>
</principal>
</principals>
</grantee>
needs to be mapped to
Role (Group)
from      oracle.security.jps.internal.core.principals.JpsAuthenticatedRoleImpl
to weblogic.security.principal.WLSGroupImpl
User      -->     weblogic.security.principal.WLSUserImpl
Frank