User autherization in UCM.

Hi All,
Please help me to understand following.
--> in 11g authentication is done thorugh Admin server.
--> When we configure a new provider and reorder it to top, user autherization takes plase from this only.
--> do we need to create ldapProvider in UCM after creating new provider in Admin server.
--> what is use of jpsUserProvider in above senerio.
--> for embedded ldap users group r mapped to role/account.
--> do we need to create role/account with the same name in UCM too?
these are the basic questions that i am not able to figure out in oracle docs.
any help is highly appreciable. (please provide some inputs, i hv already gone through oracle docs security section in admin guide)
thanks
-somesh

Hi ,
--> in 11g authentication is done thorugh Admin server.
WLS is the central security handler where in Security Provider authenticator like Default Authenticator (for Embedded LDAP) ,OIDAUthenticator (for OID) , ADAUthenticator ( for AD) etc are created when any external identity store is to be used for UCM .
--> When we configure a new provider and reorder it to top, user autherization takes plase from this only.
That's correct . This is one of the steps that need to be done where in while configuring Security providers on WLS . With PS5 we can have multiple authentication providers and using the virtualize=true flag in security xml file , users can be authenticated from these multiple sources .
--> do we need to create ldapProvider in UCM after creating new provider in Admin server.
No . This is taken care from WLS .
--> what is use of jpsUserProvider in above senerio.
To read / provision the users to UCM from WLS .
--> for embedded ldap users group r mapped to role/account.
For all the cases groups on LDAP / AD are mapped as Roles in UCM.
-> do we need to create role/account with the same name in UCM too?
No .You can use credential maps to map the LDAP group / accounts to UCM roles / accounts .
Hope this helps .
Thanks,
Srinath

Similar Messages

Segurity users with accounts UCM (a strange case )

Hello everybody,
I have a problem configuring the security with accounts.
My structure of accounts is something like this
Enterprise/HHRR
Enterprise/HHRR/DocsA
Enterprise/HHRR/DocsB
It's required that some users were allowed to access to documents in Enterprise/HHRR and Enterprise/HHRR/DocsB, but NO at Enterprise/HHRR/DocsA
If I give them access to Enterprise/HHRR, they are going to access automatically to Enterprise/HHRR/DocumentsA. How can I avoid it?
Can anybody help me?
Thank you in advance

You can't ... this is how account structures work. It is essentially a tree, and when you have access to a particular branch, you get access to all its leaves (and sub branches).
So, instead of putting documents directly under Enterprise/HHRR, you could create a sub folder, ie. Enterprise/HHRR/Base.
Then you can do your security again.

Getting Active Directory Users in UCM User Admin - Users Tab

Hello All
We have integrated WLS with our Active Directory. And we are getting all the active directory users under Security Realms >myrealm >Users and Groups tab in WLS Console.
We are also able to login to webcenter spaces and Content server using those userid and credentials. But our problem is in UCM under Admin Applets - User Admin - Users tab all the active directory users are not listed. So we are not able to assign particular roles to the users.
When a particular Active Directory user logins in UCM (First Time) after that the admisistrator (weblogic) is able to get that user under Admin Applets - User Admin - Users tab. And also it comes as an External user so we are not able to assign role.
So basically UCM requires a login to get all the users listed in users tab.
Our requirement is we want all the Active Directory users to get listed in UCM without the condition that the users has to login in content server once.
Thanks

Hi Navin ,
First and foremost the requirement that you have posted is not possible and the reason for that is :
Users are created on AD which is outside the realm of UCM hence there is no way that the users created on AD will be shown up under Users tab without they login atleast once . UCM does not know which all users are part of the realm until and unless the AD users login in atleast once .
Secondly external users cannot be assigned roles from UCM because when the Auth type is set to External UCM sees it as external entity hence not giving it any way to relate roles / groups from UCM . As a workaround you can change the AuthType for the External users to Global from User Admin applet after the users login for the first time . This will enable you to assign roles / groups for the AD users .
Hope this helps .
Thanks
Srinath

External LDAP user only has search priviledge in UCM

After I have configed external LDAP successfully in weblogic console, I can see all user from external LDAP. And external LDAP user can login UCM successfully, but these users only has search priviledge. I want external LDAP user has Admin priviledge as weblogic(Default in embed LDAP). How to solve it. Any help will be appreciated greatly! Otherwise, I refer to Oracle's ducument,
51.1.14 LDAP Users Not Receiving Some Administrator Privileges
UCM inspects for the group "Administrators" on each user's login to grant UCM roles. If a user should have access to the UCM admin server, the UCM server requires that the user be a member in a group named "Administrators."
How to add external LDAP user to the group of Administrators.

Hi ,
You can use Credential Maps to be achieve the requirement:
Steps for the same are :
1. Login to UCM - Administration - Credential Maps .
2. Create the map name and the following mapping :
<ldap role> , admin
3. Save the changes
4. Navigate to <domain_home>/ucm/cs/data/providers/jpsuserprovider/provider.hda
add the following variable there :
ProviderCredentialsMap=<map name created in step 2>
5. Save the changes and restart ucm server .
After that login with the user who has the ldap role that is mapped in stpe 2 , this user will have the ucm admin role .
Hope this helps .
Thanks
Srinath

Content migration Stellent 7.5 to UCM 11g | Facing trouble

Hi All,
We are upgrading from Stellent 7.5 to UCM 11g. Stellent 7.5 is on windows 2003 with SQL 2005 database, and UCM 11g is on Linux RHEL 5.6 with Oracle 11g database.
We are using archiver to migrate contents from Stellent to UCM. The import batch program is successfully executing. Below is the process we follow to migrate the contents which are in workflow.
1- Moved folders for migrating user workflow history and states of workflows
     <stellent idc root>\data\workflow to <ucm root>\data\workflow
     <stellent idc root>\data\user\profiles to <ucm root>\data\user\profiles
2- Migrated table data
     - truncating table data, the tables are : Revisions, DocMeta, Documents, DocumentHistory and RevClasses etc
     - Migrating data of these tables from MSSQL to Oracle so that workflow state, document checkout states are also preserved
     - wf_in_queue stores did of content therefore old did (of 7.5) needs to be preserved to show documents lying in user's queue
     - As well as there are some custom tables which are dependent on did.
Now the problem is, the native url of the link is pointing to new did.extention which was generated while content import through archiver. And if we migrate the table data as mentioned above the native url shows the old did.xls but this file doesnot exists in the file system.
Is there any who also faced the same situation?
Or is there a better way of migrating contents from 7.5 to 11g.
Thanks,
Rajiv

There is no supported direct migration path from 7.5 to 11g. The supported migration path is to upgrade the 7.5 instance to 10g, then upgrade the 10g instance to 11g.
I think Tim says it best here.
Changing the UCM Database

Contributor mode for external users (SSXA)

Hi All
On our environment we have UCM 11g and SSXA (with deployed application) and
ActiveDIrectory provider configured on WLS.
I created WCMContributor group in AD and WCMContributor role in UCM
The goal is that external users in WCMContributor group in AD has contributors rights in SSXA (lets be user “test1”)
Weblogic.xml in application has below block:
<security-role-assignment>
<role-name>WCMContributor</role-name>
<principal-name>WCMContributor</principal-name>
</security-role-assignment>
But I get error for user test1:
ERROR: Error creating the contribution markup for placeholder 'ContentPlaceholder'
REASON: User 'test1' does not have sufficient privileges.
If I create local user ‘test2’ in UCM, add him to WCMContributor role and add him to weblogic.xml - it works:
<security-role-assignment>
<role-name>WCMContributor</role-name>
<principal-name>WCMContributor</principal-name>
<principal-name>test2</principal-name>
</security-role-assignment>
But I need to work with external users
Web.xml in application has below block:
<security-constraint>
<web-resource-collection>
<web-resource-name>ContributionMode</web-resource-name>
<url-pattern>/wcm-contrib/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>WCMContributor</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>DesignerMode</web-resource-name>
<url-pattern>/wcm-design/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>WCMContributor</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>OpenWCM</realm-name>
<form-login-config>
<form-login-page>/wcm/support/login/wcm-login.jsp</form-login-page>
<form-error-page>/wcm/support/login/wcm-login.jsp?tryagain=true</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>WCMContributor</role-name>
</security-role>
Please advise
Thanks

Could you please provide a bit more details:
If I create local user ‘test2’ in UCM, add him to WCMContributor role and add him to weblogic.xml - it works:a) Do you really use local users; that is, those created only in User Admin applet? b) Or is it rather that you create users in the security realm of the Weblogic server? I'd actually expect that a) without b) won't work - except for few admin tasks (running applets as standalone applications), local users should not be used in 11g or higher. If you do just b), it's an external user, just coming from a different source.
My guess is that rather than external vs. local, the issue is that mapping of roles from AD is somehow mis-configured (that is, your users don't actually get the role assigned). Pls. check everything once again - a guidance how to map roles is described here: http://docs.oracle.com/cd/E21764_01/doc.1111/e10792/c03_security.htm#BGBCIGEH

Is it mandatory to run wcConfigure script for UCM integration????

Hi,
I'm looking to integrate an already running instance of UCM 10.1.3.5.1 version with webcenter. I have tried the integration steps by following the documentation and was able to do it. But wcConfigure script is making lots of configuration changes in our UCM instance which are not acceptable.
Is it necessary to run the wcConfigure sript for UCM integration?
Is there any other option to integrate UCM without running this script?
Thanks,
Varun

Hey Varun,
Each Contribution Folder in UCM has a set of metadata associated with it. You can change this metadata in the UCM interface by going to the particular folder and selecting Information (or Folder Information) from the actions drop down. This will display the metadata associated with that folder including security group and account. Select Update from the actions drop down on that page to change this info.
Whenever an item (folder or content) is created under another folder it will automatically inherit the default metadata set for that folder. There is also an option to propagate the changes you make to the metadata to content directly underneath a particular folder. That option is also in the actions dropdown on the folder information screen.
The other thing to check is that the user who is logged into Webcenter has privileges in UCM to the security group and account that you define for the folders and content. By default UCM is not going to be hooked up to the embedded WLS LDAP so you would need to create the user locally in UCM via the User Admin applet or (preferably) integrate UCM with the WLS LDAP. (See Chapter 7 in the Managing Security guide http://download.oracle.com/docs/cd/E10316_01/cs/cs_doc_10/documentation/admin/managing_security_10en.pdf for LDAP integration instructions)
Hope that helps,
Andy Weaver - Senior Software Consultant
Fishbowl Solutions < http://www.fishbowlsolutions.com?WT.mc_id=L_Oracle_Consulting_amw_OTN_WC >

Webcenter Application Roles not getting imported in UCM on Migration

Hi All,
I migrated the webcenter resources (Service Data, Customizations and security policies) and UCM content (Using configuration utility, Archiver and Folder Archive components). After migration I am able to see the application roles in the destination webcenter spaces instance by navigating to Webcenter Spaces -> Security -> Application Roles, but I am not able to see the corresponding accounts created in the UCM for that particular user.
For Ex: I have a application role: s1a472022_f8bb_48e1_a519_15841780df72#-#Moderator in Webcenter Spaces for user ABC
In UCM I am not able to see the account AUTHEN/s1a472022f8bb48e1a51915841780df72 for the user ABC.
I verified in the source UCM instance and I am able to see the accounts in that instance.
Please help me out. Let me know if extra details required.
Thanks,
Sachin

Hi Srinath,
Yes, I have migrated data from UCM1 to UCM2 using insert script. But, I think there should be some other way also. There may be some options to check while creating export archive. We can migrate UCM schema tables also while migrating the content but I was not able to find USEREXTENDEDATTRIBUTES table. There are some other options like export additional user config, I need to check those options also.
Thanks,
Sachin

Content accessible only in application, not in UCM

Hi,
is it possible to create such environment, that user can access some content only in application (custom portal and/or webcenter spaces) but not in UCM? Content should be obviously stored in UCM.
I have no experience with task like this, please provide some pointers.
Thanks

Quick off-the-cuff thought.
what about creating some dummy security groups where you can apply people to them based on what they should be able to see. This would allow you to use the user roles in ucm to map to permissions. But, as jiri said, you couldn't map the content directly to these groups.
You could map the content to a group/account where only a service user could access. then, your app does the content to user role isAccessAllowed logic. if allowed, then you can use a trusted ridc connection to retrieve the content.
other option would be to create a filter that alters user access for that request (in the how-to-components). then you could perhaps could use a trusted key over ssl to verify that the request is coming from your app. or perhaps use the origin/refer url to determine if the location is valid. then the users could be granted access to the group which they would not have access to during a direct call from within the content server.
-ryan

ODC and UCM integration

Hi All,
I am facing one problem while using ODC and UCM.
Thing we are able to do:
1. We are able to login in ODC through Windows Active User Credentials.
2. We can add users in Capture and that users are able to login into capture. We manage users in Capture Administration.
Note: We are using Windows Active Directory for Authentication.
Things we are not able to get:
1. We want to login into Oracle Document Capture (ODC) using Oracle UCM user credentials.
2. After login (with above possibility) into ODC with UCM user, how can we get user credential automatically populated in
File CabinetàCommit profileàCommit DriveràConfigureà here those user should come.
3. All the users created in UCM must be present in ODC user list.
Kindly revert back in case of any concerns.
Thanks in Advance

Hello,
Maybe I'm wrong but I'll try to answer myself.
Finally we have managed to connect ODC and UCM, but not passing the content ID from ODC. The solution was to set up UCM to autogenerate IDs in documents. That way you don't need to pass and ID from ODC.
Hope it helps to someone.
Plan.

Integration of Oracle UCM with MOSS 2010

Hi Experts,
Do you know if it the following scenario is possible:
- MOSS 2010 for the user interface
- Oracle UCM for all the document management core activities
Are there any standard connectors available?
Thanks in advance,
Ricardo

Hi
Yes, there are Share Point adapters available for UCM - MOSS integration .
Please check the following link : http://www.oracle.com/technetwork/middleware/webcenter/content/downloads/index-ucm10g-082682.html
Thanks
Srinath

Weblogic user lost its Admin rights in Content Server

Hello,
I happened to change auth type for weblogic to Local. After logging in as weblogic, I couldnt see the Administration tab. This was the only user with admin privileges.
I tried logging in as sysadmin/idc, but i could not. Logging in as sysadmin/idc was working in 10g but in 11g it does not work.
Is there a way to get back the admin privileges foe weblogic user?. Please help as I cannot work without the Admin Utilities.
Regards,
Richa

Hi Richa ,
I did not update the sysadmin password.
update users set dpasswordencoding='' where dname like 'sysadmin';
update users set dpassword='idc' where dname like 'sysadmin';
Open SystemProperties.
Go to the “Database” tab.
Select Oracle Thin JDBC Driver.
JDBC Connection String = jdbc:oracle:thin:@hostname:1521:orcl
JDBC User Name = dev_urmserver (ucm schema user)
JDBC User Password = <pwd set>
This will let you access the standalone applets from /bin directory .
login with sysadmin/idc after launching user admin applet and then change the auth type for weblogic user to External from Local .
I did not update the weblogic password but did change its type from External to Local in Content Server.
Same as point above .
Unfortunately, I did not give admin rights to any of the accounts and so I cannot access the User Admin Applet.
Test after step 1 is completed .
I have installed UCM in my laptop running win7. Surprisingly, i cannot see Oracle Content Server in my start->All programs menu.
There will be no Content Server munu with UCM 11g . It will be the managed server under Weblogic that will be needed to start UCM.
Hope this helps .
Thanks
Srinath

Issue Starting BatchLoader for UCM

Ok so I'm trying to run BatchLoader for UCM and I get the error
"Unable to start the batch loader. Failed to initialize. Unable to initialize the system provider 'SystemDatabase'. Cannot find the parameter 'JdbcConnectionString'."
Any protips on why this error is happening?

In 11g, UCM uses a datasource provided by WLS. Unfortunately, the standalone applets still need a database connection defined in the pre-11g format.
Go into System Properties (or manually in config.cfg if you know the parameter names) and provide the following data (assuming an Oracle database is being used for UCM):
Oracle Thin JDBC Driver Radio button     Selected
Database Driver Classpath: *(enter the exact string listed here including the dollar sign.)*     ${IdcHomeDir}/jlib/ojdbc5.jar
JDBC Connection String:     jdbc:oracle:thin:@<YourDatabase Server Name>:<YourDatabase Server Port>:<YourDatabase Service Name>
JDBC User Name:     <Your UCM Schema User Name>
JDBC User Password:     <Your UCM Schema User Password>
The next gotcha is going to be the user login name. The standalone applets only "know" those users in the Users table that are "local", and the only local user is "sysadmin" in 11g. And you won't know the password... no one does. So before trying to launch any of these applets, either change the sysadmin password from the web UI, or create a new local user similar to sysadmin with a password you can control. (I generally use option 2.)

Issue with User web page into Call Manager

Hello
I have an issue where all my users can log into their User page on UCM but when they make a change to speed dial or anything else, the change does not reflect on the phone in UCM. Doing a reset from their web page doesn't reset the phone. This is UCM 7.1.5 and the standard ccm end user group is enable for all end users.
thanks

Hi Bill -
Have you verified your User Management Roles and effective permissions? Go to User Management - Roles - select Standard CCMUSER Administration and for the permissions you want, ensure both Read and Update are selected.
Role Information
Application
Cisco Call Manager End User
Name
Description
Resource Access Information
">Resource Description Privilege
read                                               update
CCMUser: Access List
read                       update
CCMUser: Device
read                       update
CCMUser: Directory
read                       update
CCMUser: Fast Dials
read                       update
CCMUser: IP Phone Services
read                       update
CCMUser: Line Settings
read                       update
CCMUser: Personal Address Book
read                       update
CCMUser: Plugins
read                       update
CCMUser: RemoteDestination
read                       update
CCMUser: Service URL
read                       update
CCMUser: Speed Dial User
read                       update
CCMUser: User Settings
read                       update
You can also check an individual's effective permissions by using these procedures:
Viewing a User's Roles, User Groups, and Permissions
This section describes how to view the roles, user groups, and permissions that are assigned to a user that belongs to a specified user group. Use the next procedure to view the roles, user groups, and permissions that are assigned to a user in a user group.
Note: You can also view user roles by using User Management > Application User (for application users) or User Management >End User (for end users) to view a particular user and then display the user roles.
Choose User Management > User Group.
The Find and List User Groups window displays.
Find the user group that has the users for which you want to display assigned roles.
Click the name of the user group for which you want to view the roles that are assigned to the users.
The User Group Configuration window displays for the user group that you chose. The Users in Group pane shows the users that belong to the user group.
For a particular user, click the i icon in the Permission column for the user.
The User Privilege window displays. For the user that you chose, this information displays:
User groups to which the user belongs
Roles that are assigned to the user
Resources to which the user has access. For each resource, this information displays:
Application
Resource
Permission (read and/or update)
Now if both items above look OK, you might check your DB replication status. I assume you have a Publisher and one or more Subscribers? User phones registered to Subscriber? You can check replication several ways:
CLI
RTMT
Unified Reporting on CUCM administrator web page - select "Unified CM Database Replication Debug" report. This is the easiest.
The desired Replication State is 2.
Here is some further information:
Check the DB replication status on all the Cisco Unified Communications Manager nodes in the cluster to ensure that all servers are replicating database changes successfully. You can check by using either RTMT or a CLI command.
• To check by using RTMT, access the Database Summary and inspect the replication status.
• To check by using the CLI, enter the command that is shown in the following example: admin: show perf query class "Number of Replicates Created and State of Replication"
==>query class :
- Perf class (Number of Replicates Created and State of Replication) has instances and values:
ReplicateCount -> Number of Replicates Created = 344 ReplicateCount -> Replicate_State = 2
Be aware that the Replicate_State object shows a value of 2 in this case. The following list shows the possible values for Replicate_State:
0—Replication Not Started. Either no subscribers exist, or the Database Layer Monitor service is not running and has not been running since the subscriber was installed.
1—Replicates have been created, but their count is incorrect.
2—Replication is good.
3—Replication is bad in the cluster.
4—Replication setup did not succeed.
I'm thinking it's more your Roles/permissions and not replication, but I included just in case. Hope this helps!
Ginger

Problem with ECM 10G working with Apache 2.2.22

Hello all and thanks for your help.
I'm facing an issue when trying to use the Apache to display my UCM URL.
I get this error whenever I try to user Apache:
[oracle@ucm-2 bin]$ ./apachectl start
httpd: Syntax error on line 465 of /app/apache2/conf/httpd.conf: Cannot load /app/oracle/ecm/ucm/shared/os/linux/lib/IdcApache22Auth.so into server: /app/oracle/ecm/ucm/shared/os/linux/lib/IdcApache22Auth.so: wrong ELF class: ELFCLASS32
I'm using Linux Oracle 5u6, Oracle DB 11G, ECM 10G, Apache 2.2.22 (my VM). The host is Windows 7 64 bits Enterprise.
I know it's an older and outdated version of ECM but we need this configuration for training purposes.
What is the line 465 (and below) is:
LoadModule IdcApacheAuth "/app/oracle/ecm/ucm/shared/os/linux/lib/IdcApache22Auth.so"
IdcUserDB oracle "/app/oracle/ecm/ucm/data/users/userdb.txt"
Alias /idc "/app/oracle/ecm/ucm/weblayout"
<Location /idc>
Allow from all
DirectoryIndex portal.htm
IdcSecurity oracle
</Location>
So, there's anyway I could fix this? I'm new to Linux (specially Oracle's), I searched a great deal before coming here creating this post.
Can you, please, help me?
Thanks for your help and kindness.
Have a nice weekend!

Please forget the post above!
I was not copying the IdcApache22Auth.so 64bits lib. Sorry about that.
Now I copied from the zip to the folder /app/oracle/ecm/ucm/shared/os/linux/lib (saved the old one before).
Tried to start the Apache, got this message:
[oracle@ucm-2 ~]$ cd /app/apache2/bin/
[oracle@ucm-2 bin]$ ll
total 1828
-rwxr-xr-x 1 oracle oracle 76678 Jul 6 12:53 ab
-rwxr-xr-x 1 oracle oracle 3411 Jul 6 12:52 apachectl
-rwxr-xr-x 1 oracle oracle 6938 Jul 6 12:53 apr-1-config
-rwxr-xr-x 1 oracle oracle 6425 Jul 6 12:53 apu-1-config
-rwxr-xr-x 1 oracle oracle 22647 Jul 6 12:52 apxs
-rwxr-xr-x 1 oracle oracle 12654 Jul 6 12:53 checkgid
-rwxr-xr-x 1 oracle oracle 8925 Jul 6 12:52 dbmmanage
-rw-rw-r-- 1 oracle oracle 972 Jul 6 12:52 envvars
-rw-rw-r-- 1 oracle oracle 972 Jul 6 12:52 envvars-std
-rwxr-xr-x 1 oracle oracle 44194 Jul 6 12:53 htcacheclean
-rwxr-xr-x 1 oracle oracle 30564 Jul 6 12:53 htdbm
-rwxr-xr-x 1 oracle oracle 21938 Jul 6 12:53 htdigest
-rwxr-xr-x 1 oracle oracle 30169 Jul 6 12:53 htpasswd
-rwxr-xr-x 1 oracle oracle 1488070 Jul 6 12:53 httpd
-rwxr-xr-x 1 oracle oracle 20667 Jul 6 12:53 httxt2dbm
-rwxr-xr-x 1 oracle oracle 22087 Jul 6 12:53 logresolve
-rwxr-xr-x 1 oracle oracle 25005 Jul 6 12:53 rotatelogs
[oracle@ucm-2 bin]$ ./apachectl start
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
[oracle@ucm-2 bin]$
Do I have to change the listening port to 8080?
Thanks again!
EDIT:
When I tried to user as su, got this message:
[oracle@ucm-2 bin]$ su
Password:
[root@ucm-2 bin]# ./apachectl start
httpd: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1 for ServerName
Fernando
Edited by: fgomes on 09/07/2012 06:42

User autherization in UCM.

Similar Messages

Maybe you are looking for