Protect Webcenter portal administration from authenticated users

Scenario - Protect Webcenter portal admin page from authenticated users 

Solution - Authenticated users have view access to Admin.jspx in webcenter portal. When any logged in user access http://<host>:<port>/<ContextPath>/admin it would take them to admin screen,  by default authenticated users do not have any permission to perform actions in administration screen but still its not a good practice for everyone to see admin pages. 

A very simple  and easy way to protect it is to disable permissions for Admin page in jazn-data.xml.

Step 1 - Go to Application Descriptors > jazn-data-xml > Resource Grants > Web Page permission > Select check box - Show web page from ADF libraries.










Step 2 - Admin page is shown in the list, choose it to see the permissions given . By default authenticated users have view access , SO delete default permissions and grant all permissions to Administrators.

Step 3 - Run the application, log in as Authenticated user and try to access /admin, You will see HTTP- 401 unauthorized page :-)

So Now /admin is protected :-)

Export , Import and Migrate Webcenter spaces across environments.

Scenario - Need to migrate Webcenter spaces from One Environment to another.

Situation - Lately we had a situation to deploy changes done to 12 pages of Webcenter spaces into a production environment which had group spaces , tags, subscription etc., data of real users. So export and import of complete Webcenter spaces is out of equation as it would replace the entire spaces application including the data.

Now a work around needed to specifically deploy selected files.

A brief about spaces deployment- Webcenter spaces stores all the customization in Metadata store, So any change that we do in any of the system pages / New business role page that we create would be stored  in metadata files.

So to migrate Webcenter spaces from one environment to next means we have to move the metadata files to the other environment. There is an option provided in Oracle docs to export the Complete Webcenter spaces and import it back to the next environment.

exportWebCenterApplication(appName, fileName, [exportCustomizations, 

exportSecurity, exportData, server, applicationVersion])

importWebCenterApplication(appName, fileName, [server, applicationVersion])


But the con is export and import will replace the complete environment , in the sense any Group space,Subscriptions, lists, tags , notes , saved searches, etc will get replaced too. So for continuous deployment to Prod environments this is not the ideal way.

Solution - 
In spaces we can customize OOTB system pages / create new page etc. So now lets find out how to deploy those pages customization without complete export and import.

For sample i have customized  MyProfile page by adding the rich text editor , lets see how to migrate this to other environment.

To understand it better, Try the following WLST command to export the metadata store of spaces.
exportMetadata(application='webcenter',server='WC_Spaces',toLocation='/u01/mydata');

specify the server and toLocation attribute according to your environment.

After executing this command, You would see the complete metadata store in /u01/mydata location.

To find out the customization we did to My profile page browse to this path - 

Original Page path -  /oracle/webcenter/page/scopedMD/s8bba98ff_4cbb_40b8_beee_296c916a23ed/businessRolePages/MyProfileMainView.jspx 

Metadata file which has the customization - 
 /oracle/webcenter/page/scopedMD/s8bba98ff_4cbb_40b8_beee_296c916a23ed/businessRolePages/mdssys/cust/site/webcenter/MyProfileMainView.jspx.xml 

Here when you open the file you would see the rich text editor we added to the MyProfile page.

<?xml version='1.0' encoding='UTF-8'?>
<mds:customization version="11.1.1.59.23" xmlns:mds="http://xmlns.oracle.com/mds">
<mds:insert parent="pcTopLeft" position="first">
<cust:showDetailFrame xmlns:cust="http://xmlns.oracle.com/adf/faces/customizable" id="e1014861134" text="#{componentExtensionBundle.TEXT}" background="#{changeModeBean.inEditMode ? 'medium' : 'light'}" contentStyle="background-color:transparent;" displayHeader="#{changeModeBean.inEditMode}" showMinimizeAction="none" selectChild="no" showResizer="never" stretchContent="false">
<af:richTextEditor xmlns:af="http://xmlns.oracle.com/adf/faces/rich" id="e957658699" simple="true" contentStyle="width:100%" clientComponent="true" toolboxLayout="font formatCommon color list mode" readOnly="true" value="&lt;span style=&quot;font-weight: bold; font-size: x-large; color: rgb(46, 139, 87);&quot;>Hi i customized this page right now, this one will get stored in MDS repository, lets find it out&lt;/span>" editMode="wysiwyg"/>
</cust:showDetailFrame>
</mds:insert>
</mds:customization>

PageDef of the page -

pageDefs/oracle/webcenter/page/scopedMD/s8bba98ff_4cbb_40b8_beee_296c916a23ed/businessRolePages/MyProfileMainViewPageDef.xml

Metadata of the pagedef -
pageDefs/oracle/webcenter/page/scopedMD/s8bba98ff_4cbb_40b8_beee_296c916a23ed/businessRolePages/mdssys/cust/site/webcenter/MyProfileMainViewPageDef.xml.xml


Now as we figured out where all our customization data resides , We can deploy only these files ,selectively.

Export the specific files from one (FROM) environment and deploy it to (TO) environment.

Here i export the MyProfile page and its page Def which by itself exports their corresponding metadata files.

exportMetadata(application='webcenter',server='WC_Spaces',toLocation='/u01/mydata',docs='/pageDefs/oracle/webcenter/page/scopedMD/s8bba98ff_4cbb_40b8_beee_296c916a23ed/businessRolePages/MyProfileMainViewPageDef.xml,/oracle/webcenter/page/scopedMD/s8bba98ff_4cbb_40b8_beee_296c916a23ed/businessRolePages/MyProfileMainView.jspx');


At the end of above command it would say 4 documents transferred successfully which includes their 2 metadata files.

Connect to the other environment using WLST connect and import it there.

importMetadata(application='webcenter',server='WC_Spaces',fromLocation='/u01/mydata',docs='/pageDefs/oracle/webcenter/page/scopedMD/s8bba98ff_4cbb_40b8_beee_296c916a23ed/businessRolePages/MyProfileMainViewPageDef.xml,/oracle/webcenter/page/scopedMD/s8bba98ff_4cbb_40b8_beee_296c916a23ed/businessRolePages/MyProfileMainView.jspx');

No need to restart , just login to the environment where you did import and browse to Myprofile page to see the rich text editor, Which means you have successfully migrated a page from one environment to next.

This way we can migrate any number of pages without doing a complete export and import, Just add the page paths and their pageDefs in the export command separated by commas.

There are also options to deploy a specific folders using filters in the docs attribute 

Eg - you can migrate entire pages of spaces using
docs='/pageDefs/oracle/webcenter/page/**,/oracle/webcenter/page/**' 
in the exportMedata/importMetadata wlst command.

Hope it helps :-)

Note - This method is useful in continuous deployments to Production environments where we cannot afford to loose any real data.

But to deploy the application that is developed using spaces to Production  / Any environment for the first time , its always advisable to use complete Export and Import.

Pretty URL for pages in Webcenter Portal with multiple navigational model

Scenario - There are multiple navigation models in the portal, and the requirement is to refer any page in any Navigation Model using pretty url.

How to do - So lets suppose our sample navigation model looks like this -

Just drag and drop the other navigation models inside the default navigation model,

now it will create a navigation reference inside the default navigation model.

If you run the application, the entire default-navigational-model will be iterated, so the navigation reference that is added will be visible. 

Suppose if there are 10 navigation reference, all of them will be visible which is not actually needed. If no reference is mentioned here , the pages in other navigation will not be accessible via pretty URL.


So to solve this , we can tweak the forEach loop which iterates the default navigational model , i will check for the node.title in render property of CommandLink so that the
navigation references wont render.

<af:forEach var="node" varStatus="vs"

                        items="#{navigationContext.defaultNavigationModel.listModel['startNode=/, includeStartNode=false']}">

              <af:subform id="pt_sfm1">

                <af:switcher id="pt_sw1"

                             facetName="#{(empty node.attributes['Target']) || (node.attributes['Target'] == '_popup') ? 'command' : 'golink'}">

                  <f:facet name="command">

                    <af:commandLink id="pt_cl1" text="#{node.title}"

                                    inlineStyle="font-size:small;#{node.selected ? 'font-weight:bold;' : ''}"

                                    action="pprnav"

                                    disabled="#{not node.navigable}"

                                    actionListener="#{navigationContext.processAction}"

                                    clientComponent="#{node.attributes['Target'] == '_popup' ? true : false}"

                                    rendered="#{node.title !='Navigation2'}">

The navigation reference will not be rendered as a part of iteration and all the pages will be accessible via pretty url.

Now we can access any page using pretty URL in the portal:-)
NavigationURL.zip





Important - I assume the default-navigation-model.xml is the default Portal's navigation model in the adf-config.xml . If the default Portal's navigation model is different , then use that Navigation Model which is configured as the base .

Webcenter - Users from Multiple LDAP Providers

Scenario: 

A Company has 3 different LDAP providers for their user repository , and they want to assign roles and give access to all users in WebCenter Portal / Webcenter Spaces.

Possibilities :  

Webcenter had a restriction previously, as that it can only fetch users from the first LDAP provider in the security realm.Though users from the second LDAP providers is made available to weblogic layer of security, webcenter cannot get them.  This was a huge limitation, but now its fixed.

Eg: As in below picture , though both ,OID and Default authenticator are configured in weblogic's security realm and their JAAS control flag is set to SUFFICIENT , Webcenter can only take up users from OID and not Default Authenticator.

 

 

 Solution :  

Now we do have a fix for this restriction

Step 1 - Configure all your LDAP Providers in Security realm , make their JAAS Flag as SUFFICIENT and re-order them to the top.

Step 2- Restart the weblogic server and check whether you have all the users in Weblogic's users and groups section.

Step 3- Browse to $DOMAIN_HOME/config/fmwconfig/jps-config.xml
 and find the following tag

 <serviceInstance name=idstore.ldap provider=idstore.ldap.provider>
 <property name="idstore.config.provider" 
        value="oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider"/>           
  <property name=CONNECTION_POOL_CLASS 

        value=oracle.security.idm.providers.stdldap.JNDIPool/> 

 </serviceInstance>

Step 4 - Add the following property tag , which enables multiple LDAP queries ,

<property name="virtualize" value="true"/>

Step 5- After changes the tag looks like this

 <serviceInstance name=idstore.ldap provider=idstore.ldap.provider>
 <property name="idstore.config.provider" 
      value="oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider"/>           
<property name=CONNECTION_POOL_CLASS 

      value=oracle.security.idm.providers.stdldap.JNDIPool/> 

<property name="virtualize" value="true"/> 

</serviceInstance>

Step 6- Restart the Admin and managed servers.

Step 7- Users from all LDAP is available in Webcenter, to check ,log in to  

portal administration ,browse to security tab, enter * in search users and click go.

You would see users from all the LDAP Providers :-)

Webcenter Portal vs Webcenter Spaces

Scenario : 

A portal/website is required with Social collaboration features + transaction to be integrated from the legacy portal/Application.

Possibilities :

Now there are two options here  to proceed upon , both with its own pros and cons, as to whether use Webcenter Spaces / Webcenter Portal . No doubt  either option would work , but its good to choose a better approach between them to  save cost ,effort ,without compromising on the effectiveness of the final solution.

How to Choose?

Does the Requirement involves creation of Personnel/Group Space(Which is similar to LinkedIn's Community) ?

Webcenter Spaces is a ready to use Collaboration portal , with all the built in Social collaboration Services from oracle such as

PeopleConnections (In LinkedIn terms it comprises of Friends list, Message board ,Profile Photo upload and download, Status update etc),Activity Stream,Document Management,Share , Notes,likes ,comment, Favorites etc
 and 
Group Spaces(LinkedIn terms : Community Creation, Discussion, Events,Lists, Share, Moderator approval/reject, membership list, Community Wikis , Blogs and Document Sharing etc)

Webcenter Spaces also has a concept of personnel Space , where each business user can create their own pages ,arrange them , add components they like etc

Most of the above said features are exposed as REST services using which, we can build the social collaboration component  how we visualize them to be, i.e. we can build them to achieve the same social collaboration features in WebCenter Portal, however its not that easy as it sounds when the requirement involves Personnel Space / Group Spaces 
Trying to Build these Personnel Space / Group Spaces features in Portal ,as i see it is a very cumbersome task and should not be attempted.


Does the project is of short span?

This parameter is another deciding factor to choose between the two, If the project has a very fast deadline
 like ,say, 10 -15 weeks, its a good idea to go for Webcenter Spaces, because it eases of your development effort as it has most common business needs prebuilt.

Does the project involves  Lot of Customizations and legacy integrations with minimal Social Collaboration features?

In this  case , the best choice  to go for is Webcenter Portal, because it is easy to extend portal and use it across multiple teams without too much of dependency / overlap if planned properly,
and it also gives you excellent code control in multi-developer environment. 
Minimal amount of social collaboration features can be built using Rest/API/Data Control to be integrated into portal, Lets  say, the requirement needs  to have just a message board + connections + activity stream+ profile snapshot only then its easy to build them/ use existing taskflows/Customize existing taskflows to our the needs. 

What are the features available in Webcenter Spaces PS5 Not available in Webcenter Portal PS5?

The following are not available in Portal -

a)Favorites - It may be available in portal from PS6  
b) Notes
c) Lists
d)Group Spaces Events- Events calendar for Microsoft exchange is available in portal but Group Space(Facebook : Community Events) feature is not available.

So Finally Webcenter Portal or Webcenter Spaces :-)?  

Its still a tricky question:-), As i know its a trade off among time , effort and effectiveness if you are little flexible with  your requirements to choose a better one for you.
However ,the above answers will help you reach a conclusion to some extent.
As i see it , if Personnel / Group Space is needed its best to go for Webcenter Spaces.

Oracle Social Network is all set to release, please see the demo , if social collaboration is a prime need .