2 Configuring Single Sign-On

2.1.3.1 Configuring mod_weblogic

Follow these steps to configure mod_weblogic:

1. Install mod_wl into Oracle HTTP Server 10.1.3.3+.

   Without this step, you get the following error when you start Oracle HTTP Server:

   --------
   09/02/12 01:35:25 Start process
   --------
   /scratch/ohsoam/install/ohs/ohs/bin/apachectl startssl: execing httpd
   Syntax error on line 247 of
   /scratch/ohsoam/install/ohs/ohs/conf/httpd.conf:
   Cannot load /scratch/ohsoam/install/ohs/ohs/modules/mod_wl_20.so into
   server: /scratch/ohsoam/install/ohs/ohs/modules/mod_wl_20.so: cannot open
   shared object file: No such file or directory
   

2. Confirm that you have the following entries at the end of h ttpd.conf (after the automatic updates to httpd.conf through Webgate Installer).

   For Linux:

   #*** BEGIN WebGate Specific ****
   
   LoadFile "/scratch/ohsoam/install/webgate/access/oblix/lib/libgcc_s.so.1"
   LoadFile "/scratch/ohsoam/install/webgate/access/oblix/lib/libstdc++.so.5"
    
   LoadModule obWebgateModule "/scratch/ohsoam/install/webgate/access/oblix/apps/webgate/bin/webgate.so"
   WebGateInstalldir "/scratch/ohsoam/install/webgate/access"
    
                                              
   LoadModule weblogic_module modules/mod_wl_20.so
    
                                              
   <IfModule mod_weblogic.c>
                                              
   MatchExpression /owc_discussions WebLogicHost=<host>|WebLogicPort=<port>
                                              
   </IfModule>
    
   WebGateMode PEER
    
   <Location /access/oblix/apps/webgate/bin/webgate.cgi>
   SetHandler obwebgateerr
   </Location>
    
   <Location "/oberr.cgi">
   SetHandler obwebgateerr
   </Location>
    
   <LocationMatch "/*">
   AuthType Oblix
   require valid-user
   </LocationMatch>
   
   #*** END WebGate Specific **** 
                                           

   For Windows:

   #*** BEGIN WebGate Specific ****
    
   LoadModule obWebgateModule "C:\OHSOAM\webgate\access/oblix/apps/webgate/bin/webgate.dll"
   WebGateInstalldir "C:\OHSOAM\webgate\access"
    
                                              
   LoadModule weblogic_module modules/mod_wl_20.so
    
                                              
   <IfModule mod_weblogic.c>
                                              
   MatchExpression /owc_discussions WebLogicHost=<host>|WebLogicPort=<port>
                                              
   </IfModule>
   
   WebGateMode PEER
    
   <Location /access/oblix/apps/webgate/bin/webgate.cgi>
   SetHandler obwebgateerr
   </Location>
    
   <Location "/oberr.cgi">
   SetHandler obwebgateerr
   </Location>
    
   <LocationMatch "/*">
   AuthType Oblix
   require valid-user
   </LocationMatch>
    
   #*** END WebGate Specific **** 
                                           

3. Configure the module mod_wl in Oracle HTTP Server so that it forwards requests to Oracle HTTP Server. To configure Oracle HTTP Server to work with multiple non-clustered servers, use the following example in httpd.conf:

   LoadModule weblogic_module modules/mod_wl_20.so
    
   <IfModule mod_weblogic.c>
        MatchExpression /owc_discussions WebLogicHost=jive.wls.example.com|WebLogicPort=8888
   </IfModule>
   

   
   

   Note: The WebLogic port is the port of the managed server where Discussions is deployed.

   
   

2.1.3.2 Validating the OPMN

Confirm that you have the following configuration in Oracle HTTP Server. The opmn.xml entries for Oracle HTTP Server where the Access Gate will be installed should include the following:

<ias-component id="HTTP_Server">
        <process-type id="HTTP_Server" module-id="OHS2">
          <environment>
               <variable id="TMP" value="/tmp"/>
               <variable id="LD_ASSUME_KERNEL" value="2.4.19"/>
          </environment>
          <module-data>
            <category id="start-parameters">
              <data id="start-mode" value="ssl-enabled"/>
            </category>
          </module-data>
          <process-set id="HTTP_Server" numprocs="1"/>
        </process-type>
      </ias-component>
  </ias-instance>…

2.1.4.1 Creating the Access Gate Instance in the Access System Console

Before installing an Access Gate, you must create an Access Gate instance within the Access System Console.

When creating the instance, provide the following properties:

• Set Name to wls-jive-access-gate or to any other name

• Set Hostname to the host on which the Oracle HTTP Server is installed (This should be in host:port format, with the port set to the Oracle HTTP Server port.)

• Set Preferred HTTP Host to the Oracle HTTP Server host name.

• Set ASDK Client, Access Management Service to On

• Set Primary HTTP Cookie Domain to an appropriate value depending on your installation. Typically, this would be a domain-based cookie; for example, ".yourcompany.com".

• Set Port to the Oracle HTTP Server port.

Click Save to retain this setup.

2.1.4.2 Installing the Access Gate

Install WebGate 10.1.4.0.1 for OHS2 ( Oracle_Access_Manager10_1_4_0_1_linux_OHS2_WebGate). The installer is included with the Oracle Access Manager CD. After successfully installing WebGate 10.1.4.0.1, you must apply the base patch 5957301 ( Oracle_Access_Manager10_1_4_2_0_Patch_linux_OHS2_WebGate.zip), which can be downloaded from My Oracle Support (formerly MetaLink):

2.1.5.1 Configuring the Access Gate

2.1.5.2 Configuring the Access Server

2.1.6.1 Configuring the Authentication Scheme

The following steps describe how to configure a new authentication scheme.

2.1.6.2 Creating a New Policy Domain in Oracle Access Manager

Figure 2-22 Jive Forums Setup

Figure 2-23 LDAP User System

Figure 2-24 LDAP User Data Storage Mode

2.2.2.1 Configuring SSO within the Jive Forums Admin Console

2.2.2.2 Running deploy-discussions-sso.jar to Complete SSO Configuration

To complete the SSO setup process, you must modify some configuration files. The recommended way to make these modifications is to run deploy-discussions-sso.jar, which is included with this release. The deploy-discussions-sso.jar file configures web.xml, xwork-community.xml (in jiveforums-<version>.jar), and jive_startup.xml, and it unzips oracle-jive-sso.zip.

Oracle recommends using the deploy tool deploy-discussions-sso.jar, because it reduces the risk of manual errors in the configuration files. It also automatically backs up the previous versions of your configurations files, which can be useful if you later undeploy the SSO configuration and return to your previous configuration.

To run deploy-discussions-sso.jar, perform the following steps:

1. Copy deploy-discussions-sso.ja r and oracle-discussions-sso.zip to $WLS_HOME/user_projects/domains/<domain_name>/owc_discussions.

2. Ensure that you have JDK 1.6 in your PATH variable. If not, then set PATH to point to the JDK 1.6 found in $WLS_HOME/jdk160_05/bin.

3. From WebLogic Server console, stop the Oracle WebCenter Discussions application.

4. Run the following command from $WLS_HOME/user_projects/domains/<domain_name>/owc_discussions:

   java -client -Dhttp.proxyHost=<proxy_host> -Dhttp.proxyPort=<proxy_port>
   -jar deploy-discussions-sso.jar jive_version=5.5.20-oracle
   

   For example:

   java -client -Dhttp.proxyHost=www-myproxy.mycomp.com -Dhttp.proxyPort=80
   -jar deploy-discussions-sso.jar jive_version=5.5.20-oracle
   

   
   

   Note: The proxy server and port are necessary to access the internet from the machine running this script. If the machine does not need proxy server and port to connect to internet, then you do not need to provide these values.

   
   

   To undeploy, you must reset AuthFactory.className to com.jivesoftware.base.ldap.LdapAuthFactory (from the Jive Forums Admin Console), stop the managed server on which Oracle WebCenter Discussions is deployed, and then run the following command from $WLS_HOME/user_projects/domains/owc_discussions:

   java -client -Dhttp.proxyHost=<proxy_host> -Dhttp.proxyPort=<proxy_port>
   -jar deploy-discussions-sso.jar jive_version=5.5.20-oracle undeploy=true
   

   For example:

   java -client -Dhttp.proxyHost=www-myproxy.mycomp.com -Dhttp.proxyPort=80
   -jar deploy-discussions-sso.jar jive_version=5.5.20-oracle undeploy=true
   

5. Restart the managed server on which Oracle WebCenter Discussions is deployed, then start the WebLogic Server.

When you run the command to deploy, the tool prompts you for the full path to your jiveHome directory. Enter the path that you used when you set up the jiveHome directory according to the instructions in owc_discussions\jive_forums_silver_5_5_20_oracle\documentation\install-guide.html.

You can also use the Jive Forums Admin Console to create and manage categories, forums, users, and groups (when using Jive database for user identity). For more information, see the Jive Forums Administrator's Guide ( forums-admin-guide.pdf) on the companion CD.

2.2.2.3 Manually Completing Single Sign-On Configuration

1. The SSO-related files are available in the oracle-discussions-sso.zip file on the companion CD. Unzip the file into $WLS_HOME/user_projects/domains/owc_discussions.

2. Stop the WebLogic Server.

3. Extract xwork-community.xml from $WLS_HOME/user_projects/domains/owc_discussions /WEB-INF/lib/jiveforums-5.5.20-oracle.jar. To extract the file, run the following command:

   jar xvf jiveforums-5.5.20-oracle.jar xwork-community.xml 
   

   
   

   Note: For the jar commands in these steps, Oracle recommends using the jar executable located in $MWHOME/jdk160_05/bin/java.

   
   

4. Open xwork-community.xml in a text editor and modify all of the log on/log off actions between the <!-- Base actions --> and <!--Default skin --> tags. The XML snippet to replace these action classes are available in the WEB-INF/sso-action-classes.xml file:

   The entries in the file are given below:

           <action name="login" class="oracle.jive.sso.actions.SSOLoginAction">
               <result name="input">loginform.jsp</result>
               <result name="success" type="redirect">${#attr['jive.login.successURL']}</result>
               <result name="cancel" type="redirect">${#attr['jive.login.cancelURL']}</result>
               <result name="error">loginform.jsp</result>
               <result name="newaccount" type="redirect">account!input.jspa?username=${username}</result>
               <result name="fatal" type="redirect">index.jsp</result>
               <result name="success-no-redirect" type="chain">index</result>
               <result name="create-account" type="chain">create-account</result>
               <result name="cancel-no-redirect" type="chain">index</result>
           </action>
    
           <action name="login-default" class="oracle.jive.sso.actions.SSOLoginAction" method="default">
               <result name="input">loginform.jsp</result>
               <result name="success" type="redirect">${#attr['jive.login.successURL']}</result>
               <result name="cancel" type="redirect">${#attr['jive.login.cancelURL']}</result>
               <result name="error">loginform.jsp</result>
               <result name="newaccount" type="redirect">account!input.jspa?username=${username}</result>
               <result name="fatal" type="redirect">index.jsp</result>
               <result name="success-no-redirect" type="chain">index</result>
               <result name="create-account" type="chain">create-account</result>
               <result name="cancel-no-redirect" type="chain">index</result>
           </action>
           <action name="login-withRedirect" class="oracle.jive.sso.actions.SSOLoginAction" method="withRedirect">
               <result name="input">loginform.jsp</result>
               <result name="success" type="redirect">${#attr['jive.login.successURL']}</result>
               <result name="cancel" type="redirect">${#attr['jive.login.cancelURL']}</result>
               <result name="error">loginform.jsp</result>
               <result name="newaccount" type="redirect">account!input.jspa?username=${username}</result>
               <result name="fatal" type="redirect">index.jsp</result>
               <result name="success-no-redirect" type="chain">index</result>
               <result name="create-account" type="chain">create-account</result>
               <result name="cancel-no-redirect" type="chain">index</result>
           </action>
    
           <action name="logout" class="oracle.jive.sso.actions.SSOLogoutAction">
               <result name="success" type="redirect">logout-success.jspa</result>
               <result name="error">error.jsp</result>
           </action>
    
           <action name="logout-success" class="oracle.jive.sso.actions.SSOLogoutAction" method="input">
               <result name="success">logout-success.jsp</result>
           </action>
   

5. Save the file, and run the following command to copy it back into the jar file:

   jar uvf jiveforums-5.5.20-oracle.jar xwork-community.xml
   

6. Make a backup of web.xml in $WLS_HOME/user_projects/domains/owc_discussions/WEB_INF.

7. To configure SSO with the Oracle WebCenter Discussions application, modify the web.xml file:

   1. Modify AdminActionFilter and PresenceFilter in the web.xml file as shown in the following example to override the Java SSO integration. If these filters are not present already, then you must create them.

      <filter>
       <filter-name>AdminActionFilter</filter-name>
        <filter-class>
         oracle.jive.sso.actions.SSOAdminActionFilter
        </filter-class>
      </filter>
      <filter> <filter-name>PresenceFilter</filter-name>
        <filter-class>
         oracle.jive.sso.actions.SSOPresenceFilter
        </filter-class>
      </filter> 
      

   2. In the beginning of the web.xml file after <web-app> tag, insert following lines:

        <security-constraint>
          <web-resource-collection>
            <web-resource-name>sample</web-resource-name>
            <url-pattern>/owc_discussions</url-pattern>
          </web-resource-collection>
          <auth-constraint>
            <role-name>valid-users</role-name>
          </auth-constraint>
        </security-constraint>
        <login-config>
          <auth-method>CLIENT-CERT</auth-method>
          <realm-name>myrealm</realm-name>
        </login-config>
      

8. Set admin.tryAlternativeLogin in jiveHome/jive_startup.xml by adding the following lines somewhere before the </jive> tag:

   <admin>
     <tryAlternativeLogin>true</tryAlternativeLogin>
   </admin>
   

9. To complete the configuration, start Oracle WebLogic Server and the managed server on which Oracle WebCenter Discussions is deployed.