Oracle Fusion Middleware requires that a certified Java Development Kit (JDK) is installed on your system.

To start the installation program, perform the following steps.

When the installation program appears, you are ready to begin the installation. See Navigating the Installation Screens for a description of each installation program screen.

The installation program displays a series of screens, in the order listed in the following table.

If you need additional help with any of the installation screens, click the screen name or click the Help button on the screen.

If you have configured a separate shared storage volume or partition for secondary hosts, then you must install the Infrastructure on one of those hosts.

See Shared Storage Recommendations When Installing and Configuring an Enterprise Deployment.

To install the software on the other host computers in the topology, log in to each host, and use the instructions in Starting the Infrastructure Installer on SOAHOST1 and Navigating the Infrastructure Installation Screens to create the Oracle home on the appropriate storage device.

To check the directory structure:

Make sure that you have installed and configured a certified database, and that the database is up and running.

See the Preparing the Database for an Enterprise Deployment.

To start the Repository Creation Utility (RCU):

Follow the instructions in this section to create the schemas for the Fusion Middleware Infrastructure domain:

• Task 1, "Introducing RCU"

• Task 2, "Selecting a Method of Schema Creation"

• Task 3, "Providing Database Connection Details"

• Task 4, "Specifying a Custom Prefix and Selecting Schemas"

• Task 5, "Specifying Schema Passwords"

• Task 6, "Verifying the Tablespaces for the Required Schemas"

• Task 7, "Creating Schemas"

• Task 8, "Reviewing Completion Summary and Completing RCU Execution"

Task 1   Introducing RCU

Review the Welcome screen and verify the version number for RCU. Click Next to begin.

Task 2   Selecting a Method of Schema Creation

If you have the necessary permission and privileges to perform DBA activities on your database, select System Load and Product Load on the Create Repository screen. The procedure in this document assumes that you have the necessary privileges.

If you do not have the necessary permission or privileges to perform DBA activities in the database, you must select Prepare Scripts for System Load on this screen. This option generates a SQL script, which can be provided to your database administrator. See Understanding System Load and Product Load in Creating Schemas with the Repository Creation Utility.

Click Next.

Tip:

For more information about the options on this screen, see Create repository in Creating Schemas with the Repository Creation Utility.

Task 3   Providing Database Connection Details

Provide the database connection details for RCU to connect to your database.

1. As Database Type, select Oracle Database enabled for edition-based redefinition.

   Note:

   Oracle Database enabled for edition-based redefinition (EBR) is recommended to support Zero Down Time upgrades. For more information, see https://www.oracle.com/database/technologies/high-availability/ebr.html.

2. In the Host Name field, enter the SCAN address of the Oracle RAC Database.

3. Enter the Port number of the RAC database scan listener, for example 1521.

4. Enter the RAC Service Name of the database.

5. Enter the User Name of a user that has permissions to create schemas and schema objects, for example SYS.

6. Enter the Password of the user name that you provided in step 4.

7. If you have selected the SYS user, ensure that you set the role to SYSDBA.

8. Click Next to proceed, and then click OK on the dialog window confirming that connection to the database was successful.

Tip:

For more information about the options on this screen, see Database Connection Details in Creating Schemas with the Repository Creation Utility.

Task 4   Specifying a Custom Prefix and Selecting Schemas

1. Specify the custom prefix that you want to use to identify the Oracle Fusion Middleware schemas.

   The custom prefix is used to logically group these schemas together for use in this domain. For the purposes of this guide, use the prefix FMW1412_

   Tip:

   Make a note of the custom prefix that you choose to enter here; you will need this later, during the domain creation process.

   For more information about custom prefixes, see Understanding Custom Prefixes in Creating Schemas with the Repository Creation Utility.

2. Select AS Common Schemas.

   When you select AS Common Schemas, all the schemas in this section are automatically selected.

   If the schemas in this section are not automatically selected, then select the required schemas.

There are two mandatory schemas that are selected by default. You cannot deselect them: Common Infrastructure Services (the STB schema) and WebLogic Services (the WLS schema). The Common Infrastructure Services schema enables you to retrieve information from RCU during domain configuration. See Understanding the Service Table Schema in Creating Schemas with the Repository Creation Utility.

Tip:

For more information about how to organize your schemas in a multi-domain environment, see Planning Your Schema Creation in Creating Schemas with the Repository Creation Utility.

Click Next to proceed, and then click OK on the dialog window confirming that prerequisite checking for schema creation was successful.

Task 5   Specifying Schema Passwords

Specify how you want to set the schema passwords on your database, then specify and confirm your passwords. Ensure that the complexity of the passwords meet the database security requirements before you continue. RCU proceeds at this point even if you do not meet the password polices. Hence, perform this check outside RCU itself.

Click Next.

Tip:

You must make a note of the passwords you set on this screen; you need them later on during the domain creation process.

Task 6   Verifying the Tablespaces for the Required Schemas

You can accept the default settings on the remaining screens, or you can customize how RCU creates and uses the required tablespaces for the Oracle Fusion Middleware schemas.

Note:

You can configure a Fusion Middleware component to use JDBC stores for JMS servers and Transaction Logs, by using the Configuration Wizard. These JDBC stores are placed in the Weblogic Services component tablespace. If your environment expects to have a high level of transactions and JMS activity, you can increase the default size of the <PREFIX>_WLS tablespace to better suit the environment load.

Click Next to continue, and then click OK on the dialog window to confirm the tablespace creation.

For more information about RCU and its features and concepts, see About the Repository Creation Utility in Creating Schemas with the Repository Creation Utility.

Task 7   Creating Schemas

Review the summary of the schemas to be loaded and click Create to complete schema creation.

Note:

If failures occurred, review the listed log files to identify the root cause, resolve the defects, and then use RCU to drop and recreate the schemas before you continue.

Task 8   Reviewing Completion Summary and Completing RCU Execution

When you reach the Completion Summary screen, verify that all schema creations have been completed successfully, and then click Close to dismiss RCU.

To begin domain configuration, run the following command in the Oracle Fusion Middleware Oracle home on SOAHOST1.

$ORACLE_HOME/oracle_common/common/bin/config.sh

Follow the instructions in the following sections to create and configure the domain for the topology.

• Task 1, "Selecting the Domain Type and Domain Home Location"

• Task 2, "Selecting the Configuration Templates"

• Task 3, "Selecting the Application Home Location"

• Task 4, "Configuring the Administrator Account"

• Task 5, "Specifying the Domain Mode and JDK"

• Task 6, "Specifying the Database Configuration Type"

• Task 7, "Specifying JDBC Component Schema Information"

• Task 8, "Providing the GridLink Oracle RAC Database Connection Details"

• Task 9, "Testing the JDBC Connections"

• Task 10, "Selecting Advanced Configuration"

• Task 11, "Configuring the Administration Server Listen Address"

• Task 12, "Configuring Node Manager"

• Task 13, "Configuring Managed Servers"

• Task 14, "Configuring a Cluster"

• Task 15, "Assigning Server Templates"

• Task 16, "Configuring Dynamic Servers"

• Task 17, "Assigning Managed Servers to the Cluster"

• Task 18, "Configuring Coherence Clusters"

• Task 19, "Creating Machines"

• Task 20, "Assigning Servers to Machines"

• Task 21, "Reviewing Your Configuration Specifications and Configuring the Domain"

• Task 22, "Writing Down Your Domain Home and Administration Server URL"

Task 1   Selecting the Domain Type and Domain Home Location

On the Configuration Type screen, select Create a new domain.

In the Domain Location field, specify the value of the ASERVER_HOME variable, as defined in File System and Directory Variables Used in This Guide.

Tip:

For more information about the other options on this screen of the Configuration Wizard, see Configuration Type in Creating WebLogic Domains Using the Configuration Wizard.

Task 2   Selecting the Configuration Templates

On the Templates screen, make sure Create Domain Using Product Templates is selected, then select the following templates:

• Oracle Enterprise Manager [em]

  Selecting this template automatically selects the following dependencies:

  • Oracle JRF [oracle_common]

  • WebLogic Coherence Cluster Extension [wlserver]

• Oracle WSM Policy Manager [oracle_common]

Tip:

More information about the options on this screen can be found in Templates in Creating WebLogic Domains Using the Configuration Wizard.

Task 3   Selecting the Application Home Location

On the Application Location screen, specify the value of the APPLICATION_HOME variable, as defined in File System and Directory Variables Used in This Guide.

Tip:

More information about the options on this screen can be found in Application Location in Creating WebLogic Domains Using the Configuration Wizard.

Task 4   Configuring the Administrator Account

On the Administrator Account screen, specify the user name (oracle recommends using a different name from “WebLogic”) and password for the default WebLogic Administrator account for the domain.

Make a note of the user name and password specified on this screen; you need these credentials later to boot and connect to the domain's Administration Server and for other operations.

Task 5   Specifying the Domain Mode and JDK

On the Domain Mode and JDK screen:

• Select Production in the Domain Mode field.

  In the Enable or Disable Default Ports for You Domain field, use the default values provided for Production Mode:

  • Ensure that Enable Listen Ports (non-SSL Ports) is NOT checked.

  • Ensure that Enable SSL Listen Ports is checked.

  • Ensure that Enable Administration Port (SSL Port) is checked.

    Tip:

    More information about the options on this screen, including the differences between development mode and production mode, can be found in Domain Mode and JDK in Creating WebLogic Domains Using the Configuration Wizard.

• Select Oracle Hotspot JDK in the JDK field.

  Note:

  Ensure that it points to the folder where you have installed the JDK. See Installing the JDK Software.

Task 6   Specifying the Database Configuration Type

On the Database Configuration Type screen:

• Select RCU Data to activate the fields on this screen.

  The RCU Data option instructs the Configuration Wizard to connect to the database and Service Table (STB) schema to automatically retrieve schema information for the schemas needed to configure the domain.

• Verify that Vendor is Oracle and Driver is *Oracle's Driver (Thin) for Service Connections; Versions: Any.

• Verify that Connection Parameters is selected.

Note:

If you choose to select Manual Configuration on this screen, you have to manually fill in the parameters for your schema on the JDBC Component Schema screen.

After you select RCU Data, fill in the fields as shown in the following table:

Field	Description
Host Name	Enter the Single Client Access Name (SCAN) Address for the Oracle RAC database, which you entered in the Enterprise Deployment Workbook. For information about the Enterprise Deployment Workbook, see Using the Enterprise Deployment Workbook.
DBMS/Service	Enter the service name for the Oracle RAC database appropriate for this domain where you will install the product schemas. For example: soaedg.example.com Specify the service name based on the value configured earlier in the Preparing the Database for an Enterprise Deployment section.
Port	Enter the port number on which the database listens. For example, 1521.
Schema Owner Schema Password	Enter the user name and password to connect to the database's Service Table schema. This is the schema user name and password that was specified for the Service Table component on the Schema Passwords screen in RCU (see Creating the Database Schemas). The default user name is prefix_STB, where prefix is the custom prefix that you defined in RCU.

Click Get RCU Configuration when you finish specifying the database connection information. The following output in the Connection Result Log indicates that the operation is successful.

Connecting to the database server...OK
Retrieving schema data from database server...OK
Binding local schema components with retrieved data...OK

Successfully Done.

Click Next if the connection to the database is successful.

Tip:

More information about the RCU Data option can be found in Understanding the Service Table Schema in Creating Schemas with the Repository Creation Utility.

More information about the other options on this screen can be found in Datasource Defaults in Creating WebLogic Domains Using the Configuration Wizard.

Task 7   Specifying JDBC Component Schema Information

Verify that the values on the JDBC Component Schema screen are correct for all schemas.

The schema table should be populated, because you selected Get RCU Data on the previous screen. As a result, the Configuration Wizard locates the database connection values for all the schemas required for this domain.

At this point, the values are configured to connect to a single-instance database. However, for an enterprise deployment, you should use a highly available Real Application Clusters (RAC) database, as described in Preparing the Database for an Enterprise Deployment.

In addition, Oracle recommends that you use an Active GridLink datasource for each of the component schemas. For more information about the advantages of using GridLink data sources to connect to a RAC database, see Database Considerations in the High Availability Guide.

To convert the data sources to GridLink:

1. Select all the schemas by selecting the checkbox in the first header row of the schema table.

2. Click Convert to GridLink and click Next.

Task 8   Providing the GridLink Oracle RAC Database Connection Details

On the GridLink Oracle RAC Component Schema screen, provide the information required to connect to the RAC database and component schemas, as shown in following table.

Element	Description and Recommended Value
Service Name	Verify that the service name for the Oracle RAC database is the appropriate. For example, soaedg.example.com.
SCAN, Host Name, and Port	Select the SCAN check box. In the Host Name field, enter the Single Client Access Name (SCAN) Address for the Oracle RAC database. In the Port field, enter the SCAN listening port for the database (for example, 1521).
ONS Host and Port	These values are not required when you are using an Oracle 12c database or higher versions because the ONS list is automatically provided from the database to the driver.
Enable Fan	Verify that the Enable Fan check box is selected, so the database can receive and process FAN events.

For more information about specifying the information on this screen, as well as information about how to identify the correct SCAN address, see Configuring Active GridLink Data Sources with Oracle RAC in the High Availability Guide.

You can also click Help to display a brief description of each field on the screen.

Task 9   Testing the JDBC Connections

Use the JDBC Component Schema Test screen to test the data source connections that you have just configured.

A green check mark in the Status column indicates a successful test. If you encounter any issues, see the error message in the Connection Result Log section of the screen, fix the problem, and then try to test the connection again.

Tip:

More information about the other options on this screen can be found in Test Component Schema in Creating WebLogic Domains Using the Configuration Wizard.

Task 10   Selecting Advanced Configuration

To complete domain configuration for the topology, select the following options on the Advanced Configuration screen:

• Administration Server

  This is required to configure the listen address of the Administration Server.

• Node Manager

  This is required to configure Node Manager.

• Topology

  This is required to add, delete, or modify the Settings for Server Templates, Managed Servers, Clusters, Virtual Targets, and Coherence.

Note:

When you use the Advanced Configuration screen in the Configuration Wizard:

• If any of the above options are not available on the screen, then return to the Templates screen, and be sure that you selected the required templates for this topology.

• Do not select the Domain Frontend Host Capture advanced configuration option. You later configure the frontend host property for specific clusters, rather than for the domain.

Task 11   Configuring the Administration Server Listen Address

On the Administration Server screen:

1. In the Server Name field, retain the default value "AdminServer".

2. In the Listen Address field, enter the virtual host name that corresponds to the VIP of the ADMINVHN that you procured in Procuring Resources for an Enterprise Deployment and enabled in Preparing the Host Computers for an Enterprise Deployment.

   For more information about the purpose of using the ADMINVHN virtual host, see Reserving the Required IP Addresses for an Enterprise Deployment.

3. In the Configure Administration Server Ports section, perform the following steps:

   1. Leave the Enable Listen Port field unchecked. The Listen Port value will be disabled in grey.

   2. Ensure the Enable SSL Listen port field is checked.

   3. Leave the default value as 7002 in the SSL Listen Port field.

   4. Leave the default value as 9002 in the Administration Port.

4. Leave the default value as Unspecified in the Server Group.

Task 12   Configuring Node Manager

Select Manual Node Manager Setup as the Node Manager type.

WARNING:

You can ignore the warning in the bottom pane. This guide provides the required steps for the Manual Node Manager configuration.

Tip:

For more information about the options on this screen, see Node Manager in Creating WebLogic Domains Using the Configuration Wizard.

For more information about per domain and per host Node Manager implementations, see About the Node Manager Configuration in a Typical Enterprise Deployment.

For information about Node Manager configurations, see Configuring Node Manager on Multiple Machines in Administering Node Manager for Oracle WebLogic Server.

Task 13   Configuring Managed Servers

Use the Managed Servers screen to create two new Managed Servers:

1. Click the Add button to create a new Managed Server.

2. Specify WLS_WSM1 in the Server name column.

3. In the SSL Listen Address column, enter SOAHOST1. Ensure you enter the host name that corresponds to SOAHOST1 and do not use the IP address.

4. Ensure that Enable Listen is unchecked and Listen Port is "Disabled" (grayed out).

5. Ensure that Enable SSL Port is checked for all servers.

6. Set SSL Listen Port to 7010.

7. Set Administration Port to 9003.

8. In the Server Groups drop-down list, select JRF-MAN-SVR and WSMPM-MAN-SVR.

   These server groups ensure that the Oracle JRF and Oracle Web Services Manager (OWSM) services are targeted to the Managed Servers that you are creating.

   Server groups target Fusion Middleware applications and services to one or more servers by mapping defined groups of application services to each defined server group. Any application services that are mapped to a given server group are automatically targeted to all servers that are assigned to that group. See Application Service Groups, Server Groups, and Application Service Mappings in Domain Template Reference.

   Note:

   Nonce caching for Oracle Web Services is initialized automatically by the WSM-CACHE-SVR server group and is suitable for most custom applications. This initialization is automatically performed in SOA, OSB, and other FMW servers that run JRF and create a coherence cluster. Nonce is a unique number that can be used only once in a SOAP request and is used to prevent replay attacks. Nonce caching naturally scales with the number of added Managed Servers that run Web service applications.

   For information about advanced caching configurations, see Caching the Nonce with Oracle Coherence in Securing Web Services and Managing Policies with Oracle Web Services Manager, which provides additional guidance for the use of nonce caching and the WSM-CACHE-SVR server-group in custom WLS servers.

9. Repeat this process to create a second Managed Server named WLS_WSM2.

   Table 10-2 Managed Server

   Server Name	Listen Address	Enable Listen Port	Listen Port	Enable SSL Port	SSL Listen Port	Administration Port	Server groups
   WLS_WSM1	SOAHOST1	unchecked	Disabled	Checked	7010	9003	JRF-MAN-SVR and WSMPM-MAN-SVR
   WLS_WSM2	SOAHOST2	unchecked	Disabled	Checked	7010	9003	JRF-MAN-SVR and WSMPM-MAN-SVR

The Managed Server names suggested in this procedure (WLS_WSM1 and WLS_WSM2) are referenced throughout this document; if you choose different names then be sure to replace them as needed.

Tip:

More information about the options on this screen can be found in Managed Servers in Creating WebLogic Domains Using the Configuration Wizard.

Task 14   Configuring a Cluster

Use the Clusters screen to create a new cluster:

1. Click the Add button.

2. Specify WSM-PM_Cluster in the Cluster Name field.

3. Click Next.

Note:

If you specify a front-end host and a front-end port, the URL validation fails after domain configuration because the web tier is not setup at this point. Hence, any redirections in the hosted application returns to the front-end address. You must configure the web tier to allow accessing the URLs through LBR.

You can configure the front-end port and address at a later point. For instructions, see Setting the Front End Host and Port for a WebLogic Cluster.

Tips:

For more information about the options on this screen, see Clusters in Creating WebLogic Domains Using the Configuration Wizard.

Task 15   Assigning Server Templates

Click Next.

Task 16   Configuring Dynamic Servers

Verify that all dynamic server options are disabled for clusters that are to remain as static clusters.

1. Confirm that the Calculated Listen Port and Calculated Machine Names checkboxes on this screen are unchecked.

2. Confirm that the Server Template selection and Dynamic Server Groups are Unspecified.

3. Click Next.

Task 17   Assigning Managed Servers to the Cluster

Use the Assign Servers to Clusters screen to assign WLS_WSM1 and WLS_WSM2 to the new cluster WSM-PM_Cluster:

1. In the Clusters pane, select the cluster to which you want to assign the servers; in this case, WSM-PM_Cluster.

2. In the Servers pane, assign WLS_WSM1 to WSM-PM_Cluster by doing one of the following:

   • Click once on WLS_WSM1 to select it, and then click on the right arrow to move it beneath the selected cluster (WSM-PM_Cluster) in the Clusters pane.

     or

   • Double-click on WLS_WSM1 to move it beneath the selected cluster (WSM-PM_Cluster) in the clusters pane.

3. Repeat these steps to assign the WLS_WSM2 Managed Server to the WSM-PM_Cluster.

Tip:

More information about the options on this screen can be found in Assign Servers to Clusters in Creating WebLogic Domains Using the Configuration Wizard.

Task 18   Configuring Coherence Clusters

Use the Coherence Clusters screen to configure the Coherence cluster that is automatically added to the domain.

In the Cluster Listen Port, enter 9991.

Note:

For Coherence licensing information, see Oracle Coherence Products in Oracle Fusion Middleware Licensing Information User Manual.

Task 19   Creating Machines

Use the Machines screen to create new machines in the domain. A machine is required in order for the Node Manager to be able to start and stop the servers.

1. Select the Unix Machine tab.

2. Click the Add button to create new UNIX machines.

   Use the values in Table 10-3 to define the Name and Node Manager Listen Address of each machine.

3. Verify the port in the Node Manager Listen Port field.

   The port number 5556, shown in this example, may be referenced by other examples in the documentation. Replace this port number with your own port number, as needed.

Table 10-3 Values to Use When Creating Unix Machines

Name	Node Manager Listen Address	Node Manager Type	Node Manager Listen Port
ADMINHOST	Enter the value of the ADMINVHN variable.	SSL	5556
SOAHOST1	The value of the SOAHOST1 host name variable or SOAHOST1 alias. For example, SOAHOST1.example.com.	SSL	5556
SOAHOST2	The value of the SOAHOST2 host name variable or SOAHOST2 alias. For example, SOAHOST2.example.com.	SSL	5556

Tip:

More information about the options on this screen can be found in Machines in Creating WebLogic Domains Using the Configuration Wizard.

Task 20   Assigning Servers to Machines

Use the Assign Servers to Machines screen to assign any statically defined managed servers to the appropriate machines. Servers that are part of a dynamic cluster are assigned to the calculated machine names automatically.

The Assign Servers to Machines screen is similar to the Assign Managed Servers to Clusters screen. Select the target machine in the Machines column, select the server name in the left column, and click the right arrow to assign the server to the appropriate machine.

Assign the servers as follows:

• Assign the AdminServer to the ADMINHOST machine.

• Assign the WLS_WSM1 Managed Server to the SOAHOST1 machine.

• Assign the WLS_WSM2 Managed Server to the SOAHOST2 machine.

Tip:

More information about the options on this screen can be found in Assign Servers to Machines in Creating WebLogic Domains Using the Configuration Wizard.

Task 21   Reviewing Your Configuration Specifications and Configuring the Domain

The Configuration Summary screen contains the detailed configuration information for the domain that you are about to create. Review the details of each item on the screen and verify that the information is correct.

If you need to make any changes, you can go back to any previous screen either by using the Back button or by selecting the screen in the navigation pane.

Domain creation does not begin until you click Create.

In the Configuration Progress screen, click Next when it finishes.

Tip:

More information about the options on this screen can be found in Configuration Summary in Creating WebLogic Domains Using the Configuration Wizard.

Task 22   Writing Down Your Domain Home and Administration Server URL

The Configuration Success screen shows the following items about the domain you just configured:

• Domain Location

• Administration Server URL

You must make a note of both items as you need them later; the domain location is needed to access the scripts that are used to start the Administration Server.

Click Finish to dismiss the Configuration Wizard.

To start the Administration Server by using the Node Manager:

To navigate to Fusion Middleware Control, enter the following URL, and log in with the Oracle WebLogic Server administrator credentials:

You should be able to connect to the Admin Server from the Remote Console as before.

Placing the MSERVER_HOME on local storage is recommended to eliminate the potential contention and overhead caused by servers writing logs to shared storage. It is also faster to load classes and jars need from the domain directory, so any temporary or cache data that the Managed Servers use from the domain directory is processed quicker.

As described in Preparing the File System for an Enterprise Deployment, the path to the Administration Server domain home is represented by the ASERVER_HOME variable, and the path to the Managed Server domain home is represented by the MSERVER_HOME variable.

To create the Managed Server domain directory:

This procedure assumes you have copied the file that you created earlier in a location that is accessible from both SOAHOST1 and SOAHOST2; such as the ASERVER_HOME directory, which is located on the shared storage filer:

Use the procedure in Starting and Validating the WLS_WSM1 Managed Server on SOAHOST1 to start and validate the WLS_WSM2 Managed Server on SOAHOST2.

Before you create a new LDAP authentication provider, back up the relevant configuration files:

$ASERVER_HOME/config/config.xml
$ASERVER_HOME/config/fmwconfig/jps-config.xml
$ASERVER_HOME/config/fmwconfig/system-jazn-data.xml

In addition, back up the boot.properties file for the Administration Server in the following directory:

ASERVER_HOME/servers/AdminServer/security

This example shows how to create a user called soaLDAP in the central LDAP directory.

To provision the user in the LDAP provider:

1. Create an LDIF file named domain_user.ldif with the following contents and then save the file:

   dn: cn=soaLDAP,cn=systemids,dc=example,dc=com
   changetype: add
   orclsamaccountname: soaLDAP
   userpassword: password
   objectclass: top
   objectclass: person
   objectclass: organizationalPerson
   objectclass: inetorgperson
   objectclass: orcluser
   objectclass: orcluserV2
   mail: soaLDAP@example.com
   givenname: soaLDAP
   sn: soaLDAP
   cn: soaLDAP
   uid: soaLDAP

   Note:

   If you use Oracle Unified Directory, then add the following four group memberships to the end of the LDIF file to grant the appropriate read/write privileges:

   dn:
   cn=orclFAUserReadPrivilegeGroup,cn=groups,dc=example,dc=com
   changetype: modify
   add: uniquemember
   uniquemember: cn=soaLDAP,cn=systemids,dc=example,dc=com
   
   dn: cn=orclFAGroupReadPrivilegeGroup,cn=groups,dc=example,dc=com
   changetype: modify
   add: uniquemember
   uniquemember: cn=soaLDAP,cn=systemids,dc=example,dc=com
   
   dn: cn=orclFAUserWritePrivilegeGroup,cn=groups,dc=example,dc=com
   changetype: modify
   add: uniquemember
   uniquemember: cn=soaLDAP,cn=systemids,dc=example,dc=com
   
   dn: cn=orclFAGroupWritePrivilegeGroup,cn=groups,dc=example,dc=com
   changetype: modify
   add: uniquemember
   uniquemember: cn=soaLDAP,cn=systemids,dc=example,dc=com

2. Provision the user in the LDAP directory.

   For example, for an Oracle Unified Directory LDAP provider:

   OUD_INSTANCE_HOME/bin/ldapmodify -a \
                                    -h idstore.example.com
                                    -D "cn=oudadmin" \
                                    -w password \
                                    -p 1389 \
                                    -f domain_user.ldif

   For Oracle Internet Directory:

   OID_ORACLE_HOME/bin/ldapadd -h idstore.example.com \
                                -p 3060 \
                                -D cn="orcladmin" \
                                -w password \
                                -c \
                                -v \
                                -f domain_user.ldif
   

To configure a new LDAP-based authentication provider:

1. Log into the WebLogic Remote Console.
2. Click Edit Tree.
3. In the left navigational bar, click Security > Realms > myrealm > Authentication Providers.

   Note:

   The DefaultAuthenticator provider is configured for the realm. This is the default WebLogic Server authentication provider.
4. Click New button.

5. Enter a name for the provider.

   Use one of the following names, based on the LDAP directory service that you plan to use as your credential store:

   • OUDAuthenticator for Oracle Unified Directory

   • OIDAuthenticator for Oracle Internet Directory

6. Select the authenticator type from the Type drop-down list.

   Select one of the following types, based on the LDAP directory service that you plan to use as your credential store:

   • OracleUnifiedDirectoryAuthenticator for Oracle Unified Directory

   • OracleInternetDirectoryAuthenticator for Oracle Internet Directory

7. Select SUFFICIENT from the Control Flag drop-down menu for the newly created authenticator provider.

   Setting the control flag to SUFFICIENT indicates that if the authenticator can successfully authenticate a user, then the authenticator should accept that authentication and should not continue to invoke any additional authenticators.

   If the authentication fails, it falls through to the next authenticator in the chain. Make sure all subsequent authenticators also have their control flags set to SUFFICIENT; in particular, check the DefaultAuthenticator option and make sure that its control flag is set to SUFFICIENT.

8. Click Create.

9. Click the Authenticator Parameters tab and enter the details specific to your LDAP server, as shown in the following table.

   Note that only the required fields are discussed in this procedure. For information about all the fields on this page, consider the following resources:

   • To display a description of each field, click Help on the Provider Specific tab.

   • For more information on setting the User Base DN, User From Name Filter, and User Attribute fields, see Configuring Users and Groups in the Oracle Internet Directory and Oracle Virtual Directory Authentication Providers in Administering Security for Oracle WebLogic Server.

   Parameter	Sample Value	Value Description
   Host	For example: idstore.example.com	The LDAP server's server ID.
   Port	For example: 1389	The LDAP server's port number.
   Principal	For example: cn=soaLDAP, cn=systemids,dc=example,dc=com	The LDAP user DN used to connect to the LDAP server.
   Credential	Enter LDAP password.	The password used to connect to the LDAP server.
   SSL Enabled	Unchecked (clear)	Specifies whether SSL protocol is used when connecting to the LDAP server.
   User Base DN	For example: cn=users,dc=example,dc=com	Specify the DN under which your users start.
   All Users Filter	(&(uid=*)(objectclass=person))	Instead of a default search criteria for All Users Filter, search all users based on the uid value. If the User Name Attribute for the user object class in the LDAP directory structure is a type other than uid, then change that type in the User From Name Filter field. For example, if the User Name Attribute type is cn, then this field should be set to: (&(cn=*)(objectclass=person)))
   User From Name Filter	For example: (&(uid=%u)(objectclass=person))	If the User Name Attribute for the user object class in the LDAP directory structure is a type other than uid, then change that type in the settings for the User From Name Filter. For example, if the User Name Attribute type is cn, then this field should be set to: (&(cn=%u)(objectclass=person))).
   User Name Attribute	For example: uid	The attribute of an LDAP user object that specifies the name of the user.
   Group Base DN	For example: cn=groups,dc=example,dc=com	Specify the DN that points to your Groups node.
   Use Retrieved User Name as Principal	Checked	Must be turned on.
   GUID Attribute	entryuuid	This value is prepopulated with entryuuid when OracleUnifiedDirectoryAuthenticator is used for OUD. Check this value if you use Oracle Unified Directory as your authentication provider.

10. Click Save to save the changes.

11. Commit the changes in the shopping cart.
12. Navigate to Authenticator Providers under Security > Realms > myrealm.
13. Check the Authenticator Providers you just created and move up to the first position.

14. On the Authentication Providers screen, click DefaultAuthenticator.

15. From the Control Flag drop-down, select SUFFICIENT.

16. Click Save to update the DefaultAuthenticator settings.

17. Commit the changes in the shopping cart.

18. Restart the Administration Server and all managed servers.

    To stop the Managed Servers, sign in to Fusion Middleware Control, select the Managed Servers in the Target Navigator and click Shut Down in the toolbar.

    To stop and start the Administration Server by using the Node Manager:

    1. Start WLST:

       export WLST_PROPERTIES="
       -Dweblogic.security.TrustKeyStore=CustomTrust 
       -Dweblogic.security.CustomTrustKeyStoreFileName=/u01/oracle/config/keystores/appTrustKeyStore.pkcs12 
       -Dweblogic.security.CustomTrustKeyStorePassPhrase=password"
       cd $ORACLE_COMMON_HOME/common/bin
       ./wlst.sh
       

    2. Connect to Node Manager by using the Node Manager credentials that you defined when you created the domain in the Configuration Wizard:

       wls:/offline>nmConnect('nodemanager_username','nodemanager_password',
                   'ADMINVHN','5556','domain_name',
                   'ASERVER_HOME','SSL')

    3. Stop the Administration Server:

       nmKill('AdminServer')
       

    4. Start the Administration Server:

       nmStart('AdminServer')
       

    5. Exit WLST:

       exit()
       

       To start the Managed Servers, log in to Fusion Middleware Control, select the Managed Servers, and click Start Up in the toolbar.

       Note:

       If you plan to log in to the system immediately by using the central LDAP user role, you can skip the restart until you have assigned the Administration role to the new enterprise deployment administration group. For more information, see Adding the Administration Role to the New Administration Group.

19. After the restart, review the contents of the following log file:

    $ASERVER_HOME/servers/AdminServer/logs/AdminServer.log
    

    Verify that no LDAP connection errors occurred. For example, look for errors such as the following:

    The LDAP authentication provider named "OUDAuthenticator" failed to make connection to ldap server at ...
    

    If you see such errors in the log file, then check the authorization provider connection details to verify that they are correct and try saving and restarting the Administration Server again.

20. After you restart and verify that no LDAP connection errors are in the log file, try browsing the users and groups that exist in the LDAP provider:

    1. In the Remote Console, go to the Security Tree.

    2. Navigate to Realms > myrealm > Authentication Providers.

    3. Expand the new Authentication Provider.

    4. Click Users and then click Groups.

       You should be able to see all users and groups that exist in the LDAP provider structure.

This example shows how to create a user called weblogic_soa and a group called SOA Administrators.

To provision the administration user and group in LDAP provider:

1. Create an LDIF file named admin_user.ldif with the following contents and then save the file:

   dn: cn=weblogic_soa,cn=users,dc=example,dc=com
   changetype: add
   orclsamaccountname: weblogic_soa
   userpassword: password
   objectclass: top
   objectclass: person
   objectclass: organizationalPerson
   objectclass: inetorgperson
   objectclass: orcluser
   objectclass: orcluserV2
   mail: weblogic_soa@example.com
   givenname: weblogic_soa
   sn: weblogic_soa
   cn: weblogic_soa
   uid: weblogic_soa

2. Provision the user in the LDAP directory.

   For example, for an Oracle Unified Directory LDAP provider:

   OUD_INSTANCE_HOME/bin/ldapmodify -a \
                                    -h idstore.example.com
                                    -D "cn=oudadmin" \
                                    -w password \
                                    -p 1389 \
                                    -f admin_user.ldif

   For Oracle Internet Directory:

   OID_ORACLE_HOME/bin/ldapadd -h idstore.example.com \
                                -p 3060 \
                                -D "cn=oudadmin" \
                                -w password \
                                -c \
                                -v \
                                -f admin_user.ldif
   

3. Create an LDIF file named admin_group.ldif with the following contents and then save the file:

   dn: cn=SOA Administrators,cn=Groups,dc=example,dc=com
   displayname: SOA Administrators
   objectclass: top
   objectclass: GroupOfUniqueNames
   objectclass: orclGroup
   uniquemember: cn=weblogic_soa,cn=users,dc=example,dc=com
   cn:SOA Administrators
   description: Administrators Group for the Oracle SOA Suite Domain
   

4. Provision the group in the LDAP Directory.

   For Oracle Unified Directory:

   OUD_INSTANCE_HOME/bin/ldapmodify -a \
                                    -D "cn=oudadmin" \
                                    -h oudhost.example.com \
                                    -w password \
                                    -p 1380 \
                                    -f admin_group.ldif
   

   For Oracle Internet Directory:

   OID_ORACLE_HOME/bin/ldapadd -h oidhost.example.com \
                               -p 3060 \
                               -D "cn=oudadmin" \
                               -w password \
                               -c \
                               -v \
                               -f admin_group.ldif
   

5. Verify that the changes were made successfully:

   1. In the Remote Console, go to Security Tree.

   2. Navigate to Realms > myrealm > Authentication Providers.

   3. Expand the new Authentication Provider.

   4. Click Users and verify if the administrator user that you provisioned is listed.

   5. Click Groups and verify if the administrator group that you provisioned is listed.

After you add the users and groups to your LDAP directory, the group must be assigned the Administration role within the WebLogic domain security realm. This enables all users that belong to the group to be administrators for the domain.

To assign the Administration role to the new enterprise deployment administration group: