Portal Administration Console Login

Question

Hello!
I have integrated Oracle Weblogic Server with Oracle Identity Manager to achive Single Sign On. In IDM is set form login.
My base_domain configuration is : AdminServer and a Cluster_0 with two managed servers : Server_1 and Server_0.
I have as proxy server : Oracle HTTP Server (OHS) for each server : Admin-Server, Server-0, Server-1.
I targeted my portal app to cluster. My portal application contains Portal Administration Console, avaibled at /myAppAdmin.
Security Providers are (in this order):
1. OAMIDAsserter - Oracle Access Manager Identity Asserter( Control Flag : REQUIRED, Active Types : ObSSOCookie)
2. OIDAuthentificator - Provider that performs LDAP authentication (Control Flag: SUFFICIENT )
3. DefaultAuthenticator - Weblogic Authentication Provider ( Control Flag : SUFFICIENT
4. DefaultIdentityAsserter - Weblogic Identity Assertion provider.
When I access Portal Administration Console from /myAppAdmin (admin-tools.war)
     1. I login first in IDM with the user from LDAP : weblogic_ldap. The login is ok and the ObSSOCookie is set.
     2. I am redirected to login from Portal Administration Console (this thing is wrong and I want to jump this step. I want to go directly in Portal Administration Console after the first login).
     3. I login in the second login page from Portal Administration Console with the same user : weblogic_ldap. The login has succeed.
     4. I am logged in Portal Administration Console and I can add content ( for exemple)
What I have to do to have only the login form from IDM. To have the only two steps:
1. Login in Portal Administration Console using login form from IDM and a LDAP user
2. Access the Portal Administration Console
I have tried :
I have changed domain security Default Model : "Advanced" , set Combined Role Mapping Enabled to "FALSE", set Check Roles and Policies to
"ALL Web applications and EJBs" and selected for When Deploying Web Applications or EJBs: "Ignore roles and policies to DD".
After this changes I deployed myApp which contains /myAppAdmin Console with Security policies set to Advanced.
I have only the IDM login, the correct one, and after that I am able to see first page of the Portal Administration Console and whatever I click I receive the error:
####<Mar 29, 2011 11:20:55 AM EEST> <Error> <netuix> <server0-dns> <Server-0> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <<anonymous>> <> <> <1301386855474> <BEA-423142> <The control com.bea.netuix.servlets.controls.page.SingleLevelMenu could not be rendered properly due to the following error:
com.bea.p13n.entitlements.common.PolicyMgmtAccessException: Attempt to access Entitlement Policy Mgmt API by user in invalid role. Entitlement Policy operation attempted by disallowed user ["principals=[]"].
     at com.bea.p13n.entitlements.management.internal.SecurityHelper.isWLPAdminRole(SecurityHelper.java:937)
     at com.bea.p13n.entitlements.management.internal.RolePolicyDelegate.roleExists(RolePolicyDelegate.java:346)
     at com.bea.p13n.delegation.DelegationService.getParentInheritanceFlag(DelegationService.java:189)
     at com.bea.p13n.delegation.DelegationService.getAdminPolicies(DelegationService.java:753)
     at com.bea.p13n.delegation.DelegationService.isAdminPolicyOnResourceRoot(DelegationService.java:450)
     at com.bea.p13n.delegation.DelegationService.isAdminPolicyOnResourceRoot(DelegationService.java:430)
     at com.bea.jsptools.common.ToolsMenuTag.hasMenuAccess(ToolsMenuTag.java:354)
     at com.bea.jsptools.common.ToolsMenuTag.doStartTag(ToolsMenuTag.java:130)
I have to modified admin-tools.war or something in domain's security or myApp's descriptors to be able to login in Portal Administration Console
using only SSO and not both SSO and default login?
Thank you for helping me.
Edited by: bluerainbow on Mar 29, 2011 2:06 AM

Answer 1

no idea? :(