This topics covers steps to integrate SiteCapture with OAM.

1. Integrate Oracle WebCenter Sites with Oracle Access Manager. For more information see, Integrating OAM with Oracle WebCenter Sites.
2. Additional configuration required for Oracle Access Manager for SiteCapture.
   1. Create additional resource definitions (see table below) for the WebCenter Sites application domain.

      Resource URL	Protection level	Authentication	Authorization
      /<sites-context>/REST/roles	Unprotected	Public	All Allowed
      /<sites-context>/custom/customCsResolver.jsp	Unprotected	Public	All Allowed
      /resources/.../*	Excluded	NA	NA
      /__admin/.../*	Protected	Protected	Protected

   2. Configure the Protected Resource Policy as follows:
   1. Click Application Domains and click the Open icon.
   2. Click Search and select WCSitesWebGate.
   3. Click the Authentication Policies tab and select Authentication Policies . For Authentication Scheme, select LDAPWemScheme, the authentication scheme previously created.
   4. Click Responses tab.
   5. Select the Identity Assertion checkbox.
   6. When an Authentication policy is satisfied, it can create responses. The responses are required by the WebCenter Sites HTTP filter to recognize LDAP attributes and provide information about the authenticated user. In the following steps, you will create these responses.
   7. Click the Add (+) icon. and enter the following:
   1. For Name: Enter FATGATE_CSTIMEOUT
   2. For Type: Select Header
   3. For Value: Enter 30
3. SiteCapture Application Installation. During installation process of SiteCapture use parameters that are mentioned below:

   Property Description	Property	Value
   Content server host name or IP	fw.cs.hostname	{ohs_host}
   Content server app server port	fw.cs.port	{ohs_port}
   Content server context	fw.cs.context	{sites_context_root}
   Content server protocol (http or https)	fw.cs.protocol	{sites.protocol}
   Content Server user name having RESTADMIN role	fw.cs.username	{username}
   Content server user password	fw.cs.password	{password}
   SiteCapture server hostname or IP	fw.sc.hostname	{sc_host}
   SiteCapture app server port	fw.sc.port	{sc_port}
   SiteCapture protocol (http or https)	fw.sc.protocol	{sc.protocol}
   CAS server hostname	fw.cas.host	{ohs_host} in installer. Or Empty in sitecapture.properties
   CAS server port	fw.cas.port	{ohs_port} in installer. Or Empty in sitecapture.properties
   CAS server context	fw.cas.context	cas in installer. Or Empty in sitecapture.properties

4. Adjust the root-context.xml file in SiteCapture Application. SiteCapture shipped with two files:
   1. root-context.xml
      Backup root-context.xml file and rename to root-context.xml.bak file.
   2. oam_root-context.xml
      Rename oam_root-context.xml file to root-context.xml file.

      <?xml version="1.0" encoding="UTF-8"?>
      <beans xmlns="http://www.springframework.org/schema/beans"
      	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jdbc="http://www.springframework.org/schema/jdbc"
      	xmlns:p="http://www.springframework.org/schema/p" xmlns:context="http://www.springframework.org/schema/context"
      	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
      	http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc-3.1.xsd
      	http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd">
      
      	<bean id="propertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer" />
      	<!-- Root Context: defines shared resources visible to all other web components -->
      	
      	<jdbc:initialize-database data-source="dataSource"	enabled="true" ignore-failures="ALL">		
      		<!-- For installer the first jdbc:script will opened. Installer will configure it automatically -->
      		<jdbc:script location="classpath:crawler_oracle_db.sql" />
      		<!--jdbc:script location="classpath:crawler_hsql_db.sql" /-->
      		<!--jdbc:script location="classpath:crawler_sql_server_db.sql" /-->
      		<!--jdbc:script location="classpath:crawler_oracle_db.sql" /-->
      		<!--jdbc:script location="classpath:crawler_db2_db.sql" /-->
      	</jdbc:initialize-database>
      	
      	<!-- Section# 1 Installer will consume below configuration to configure a datasource name created on the appservers -->
      	<bean id="dataSource" class="org.springframework.jndi.JndiObjectFactoryBean">
      		<property name="jndiName" value="wcsitesDS"/>
      	</bean>
      	
      	<!-- Single Sign On provider -->
      	<bean id="ssoprovider" class="com.fatwire.wem.sso.oam.OAMProvider">
      		<property name="config" ref="ssoconfig" />
      	</bean>
      	<!--It is invoked by the OAM filter to resolve an OAM authenticated user against a remote Site CS instance.--> 
      	<bean id="oamIdentity" class="com.fatwire.auth.identity.RemoteUsernameResolver" >
      		<property name="csServerUrl" value="http://{ohs_server_host}:{ohs_port}/{sites_context_root}/custom/customCsResolver.jsp"/>
      	</bean>
        
      	<!-- Single Sign On filter -->
      	<bean id="ssofilter" class="com.fatwire.wem.sso.oam.filter.OAMFilter">
      		<property name="config" ref="ssoconfig" />
      		<property name="provider" ref="ssoprovider" />
      		<property name="identityResolver" ref="oamIdentity" />
      		
      		<!-- Set "trustConfigured" to "true" in case of trust relationship configured between WebGate and WLS.
      		It will turn off check for OAM_ASSERTION header. -->
      		<property name="trustConfigured" value="false" />
      	</bean>
        
      
      	<!-- Single Sign On listener -->
      	<bean id="ssolistener" class="com.fatwire.wem.sso.oam.listener.OAMListener">
      	</bean>
      	
      	<!-- Single Sign On configuration -->
      	<bean id="ssoconfig" class="com.fatwire.wem.sso.oam.conf.OAMConfig">
      		<!-- URL prefix for REST service endpoint -->
      		<property name="serviceUrl" value="http://{ohs_server_host}:{ohs_port}/{sites_context_root}/REST" />
      		
      		<!-- URL prefix for Token Service servlet -->
      		<property name="ticketUrl" value="http://{oamtoken_server_host}:{oamtoken_port}/oamtoken" />
      		
      		<!-- URL to be called when WEM logout is required. -->
      		<property name="signoutUrl" value="http://{oam_server_host}:{oam_port}/oam/server/logout?end_url=http%3A%2F%2F{ohs_server_host}%3A{ohs_port}%2F{sites_context_root}%2Fwem%2Ffatwire%2Fwem%2FWelcome"/>
      		
      		<!-- Do not proxy tickets, tt's the last server in thecall chain -->
      		<property name="proxyTickets" value="false" />
      		
      		<!-- Database Credentials needed by user lookup inOAMFilter -->
      		<property name="dbUsername" value="fwadmin" />
      		<property name="dbPassword" value="xceladmin"/>
      		
      		<!-- Your application protected resources (relative to applicationUrl) -->
      		<property name="protectedMappingIncludes">
      			<list>
      				<value>/__admin</value>
      				<value>/__admin/**</value>
      			</list>
      		</property>
      		
      		<!-- Your application protected resources excludes (relative to applicationUrl) -->
      		<property name="protectedMappingExcludes">
      			<list>
      				<value>/__admin/layout</value>
      			</list>
      		</property>
      		<property name="applicationProxyCallbackPath" value="/sso/proxycallback" />
      		<property name="gateway" value="false" />
      	</bean>
      	
      	<context:component-scan base-package="com.fatwire.crawler.remote.dao" />
      	<context:component-scan base-package="com.fatwire.crawler.remote.support" />
      	<context:component-scan base-package="com.fatwire.crawler.remote.di" />
      	<context:component-scan base-package="com.fatwire.crawler.remote.resources.support" />
      
      </beans>

      Note:

      To update mod_wl_ohs.conf file the following code has to be included: 

      <IfModule weblogic_module>
      <Location /__admin>
      		SetHandler weblogic-handler
      		WebLogicHost SITECAPTURE_HOST
      	WebLogicPort SITECAPTURE_HOST 
      </Location>
      </IfModule>

This topics covers steps to integrate OAM with Oracle WebCenter Sites: Satellite Server.

<IfModule weblogic_module>
 <Location /ss>
       SetHandler weblogic-handler
       WebLogicHost SATELLITESERVER_HOST
     WebLogicPort SATELLITESERVER_HOST
 </Location>
 </IfModule>

This topic covers steps to integrate OAM with Visitor Services.

<IfModule weblogic_module>
    <Location /oamlogin>
      SetHandler weblogic-handler
       WebLogicHost SITES_HOST
       WebLogicPort SITES_PORT
   </Location>
 </IfModule>
 <IfModule weblogic_module>
 <Location /visitors-webapp>
   SetHandler weblogic-handler       
	WebLogicHost VISITORSERVICES_HOST    
	WebLogicPort VISITORSERVICES_HOST
 </Location>
 </IfModule>

This chapter lists the prerequisites required for configuring the Detached Credential Collector.

1. WebCenter Sites 14.1.2.0.0 is installed with CAS and is in working condition.
2. OAM 11.1.2.3.0 is installed and OAM domain is configured along with two OHS configured for webgate. The list below are required softwares for this installation:

   • OAM 11.1.2.3.0. For example : ofm_iam_generic_11.1.2.3.0_disk*.zip.

   • RCU 11.1.1.9.0. For example : ofm_rcu_linux_11.1.1.9.0_64_disk*.zip.

   • Latest version of SOA suite.

   • WebTier 11.1.1.9.0. For example : ofm_webtier_linux_11.1.1.9.0_64_disk*.zip

   • WebGate 11.1.2.3.0. For example : ofm_webgates_generic_11.1.2.3.0_disk*.zip

This topic describes hot to configure DCC Webgate.

1. Login to oamconsole. The Launch Pad of Application Security opens.
2. Click Agents >Create Webgate. The Create Webgate form opens.
3. In the Create Webgate form, enter the following values as given below:
   1. Version : 11g
   2. Name : DCC-11g-WG. For example, enter Some arbitrary name.
   3. Host Identifier : DCC-11g-WG. For example, enter Some arbitrary name.
   4. Security : Select the option of your choice
   5. Auto Create Policies : Leave the default selected option.
4. Click Apply.
5. A new webgate named DCC-11g-WG is created with default values. In the webgate form, update the following fields:
   1. Logout URL : /oamsso-bin/logout.pl
   2. Logout Callback URL : /oam_logout_success
   3. Logout Redirect URL : http://{OAM_host:OAM_port}/oam/server/logout
   4. Logout Target URL : end_url
   5. Allow Credential Collector Operations : Leave the default selected option.
6. Click Apply.
7. Navigate to Launch Pad and click on Access Manager>Host Identifiers.
8. A Search form is displayed, click Search
9. Click Host Identifier DCC-11g-WG as created in Step 3c.
10. Add the Hostname and port by clicking on ‘+’ in Host Name Variations area.
11. After entering all the details, click Apply.

    Note:

    These are the hostname and port of OHS to where DCC webgate files are copied to display the login challenge.
12. Navigate to Launch Pad and click Authentication Schemes.
13. A Search form is displayed, click Create.
14. Create a new Authentication theme that will be used by both the webgates as given in Step 15 a to g.
15. Click Apply. Using Weblogic’s Embedded LDAP as LDAP authentication module where fwadmin user is added to myrealm using the WebLogic Remote Console.
    1. Name : DCCAuthnScheme14c. For example, enter Some arbitrary name.
    2. Authentication Level : 2
    3. Challenge Method : FORM
    4. Challenge Redirect URL : http://{OHS_Host_of_Resource_Webgate:OHS_Port}
    5. Authentication Module : LDAP
    6. Challenge URL : /oamsso-bin/login.pl
    7. Context Type : external
16. Navigate to Launch Pad and click Application Domains.
17. A Search form is displayed, click Search, which should display all the application domains available that are created by default when a webgate is created.
18. Click Application Domain (created in Step 3b), which should open the application domain with multiple tabs and Summary is opened by default.
    1. Click Resources tab, which will display search form along with Create button.
    2. Click Create, update the form as below:

       Note:

       Add other excluded URLS similar to below, with changing Resource URL with each Create.

       • Type : HTTP

       • Host Identifier : DCC-11g-WG ( Name given in Step 3c)

       • Resource URL : /oamsso-bin/login.pl

       • Protection Level : excluded

    3. Click Apply.
    4. Click Authentication Policies tab and then click Protected Resource Policy. Update the form as below and click Apply.

       • Authentication Scheme : DCCAuthnScheme14c as created in Step 15.

19. Copy the DCC webgate files as given below created in WebLogic domain ($DOMAIN_HOME/output/DCC-11g-WG) to the OHS folder ($OHS_INSTANCE_HOME/config/OHS/$OHS_NAME /webgate/config) hosting these webgate files.

    • ObAccessClient.xml

    • cwallet.sso

20. Restart the OHS.

This topics provides steps to configure the Resource Webgate.

1. Login to oamconsole, which should display Launch Pad of Application Security.
2. Click Agents > create Webgate, which should display Create Webgateform.
3. Input the values as below in the Create Webgate form.
   1. Version : 11g
   2. Name : Resource-11g-WG (Some arbitrary name)
   3. Host Identifier : Resource-11g-WG (Same as Name above or some arbitrary name)
   4. Security : Open (select the option of your choice)
   5. Auto Create Policies : Option Selected
4. Click Apply
5. A new webgate named Resoruce-11g-WG is created with default values. In the webgate form, update the following fields:
   1. Logout URL : /logout
   2. Logout Callback URL : /oam_logout_success
   3. Logout Redirect URL : http://{OAM_Host_of_DCC_Webgate:OAM_Port}/oamsso-bin/logout.pl
   4. Logout Target URL : end_url
6. Click Apply
7. Navigate to Launch Pad and click Access Manager> Host Identifiers, which should display a search form. Click Search.
8. Click Host Identifier Resource-11g-WG as created in Step 3c.
9. Add the hostname and port by clicking on ‘+’ in Host Name Variations.
10. After all desired Host Name and Port are added then click Apply.

    Note:

    These are the hostname and port of OHS to where Resource webgate files are copied.
11. Navigate to Launch Pad and click Application Domains, which should display the Search form. Click Search, which should display all the application domains available that are created by default when a webgate is created.
12. Click Application Domain as created in Step 3b, which should open the application domain with multiple tabs and Summary is opened by default.
    1. Click Resources tab, which will display search form along with Create button. Click Create for each row in below table, update the create form as below and click Apply.

       Table 12-1 Resource Identifiers

       Type	Host Identifier	Resource URL	Protection Level	Authentication Policy	Authorization Policy
       HTTP	Resource-11g-WG	/{sites-context}/**	Protected	Protected Resource Policy	Protected Resource Policy
       HTTP	Resource-11g-WG	/{sites-context}/ContentServer/*	Protected	Protected Resource Policy	Protected Resource Policy
       HTTP	Resource-11g-WG	/{sites-context}/Satellite/*	Protected	Protected Resource Policy	Protected Resource Policy
       HTTP	Resource-11g-WG	/{sites-context}/faces/jspx/…/*	Protected	Protected Resource Policy	Protected Resource Policy
       HTTP	Resource-11g-WG	/{sites-context}/wem/fatwire/…/*	Protected	Protected Resource Policy	Protected Resource Policy
       HTTP	Resource-11g-WG	/{sites-context}/Xcelerate/LoginPage.html	Protected	Protected Resource Policy	Protected Resource Policy

    2. Click Authentication Policies tab and then click Protected Resource Policy. Update the form as below and click Apply.

       1. Authentication Scheme : DCCAuthnScheme11g (Created in Step 8)

       2. Click Responses tab and then select Identity Assertion. Click Add and include the following responses:

          Table 12-2 Identity Assertion Elements

          Type	Name	Value
          Header	FATGATE_POLICY	Protected
          Header	FATGATE_EMAIL	$user.attr.mail

    3. Click Authorization Policies tab and then click Protected Resource Policy. Update the form as given in the table below.
       1. Click Responses and then select Identity Assertion.

          Table 12-3 Identity Assertion Elements

          Type	Name	Value
          Header	FATGATE_POLICY	Protected
          Header	FATGATE_EMAIL	$user.attr.mail

       2. After adding the above responses, click Add

       3. Click Apply.

13. Copy the Resource webgate files as given below that's created in WebLogic domain ($DOMAIN_HOME/output/Resource-11g-WG) to the OHS folder ($OHS_INSTANCE_HOME/config/OHS/$OHS_NAME /webgate/config hosting these webgate files.
    1. ObAccessClient.xml
    2. cwallet.sso
14. Restart OHS.

This topic provides steps to configure the Sites OAM integration with DCC

1. Deploy oamtoken web application to sites server.

   Note:

   Do not deploy oamlogin web application since it is not used.
2. Undeploy cas web application from the sites server.
3. Navigate to CS web application and open SSOConfig.xml in edit mode.
4. Add the following bean to the file and Save the file.

   <!-- Single Sign On configuration -->
   		<bean id="ssoconfig" class="com.fatwire.wem.sso.oam.conf.OAMConfig">
   			<!-- URL prefix for REST service endpoint -->
   
   			<property name="serviceUrl" value="http://{OHS_Host_of_Resource_Webgate:OHS_Port}/{sites-context}/REST" />
   			<!-- URL prefix for Token Service servlet -->
   			<property name="ticketUrl" value="http://{Sites_Host:Sites_Port}/oamtoken" />
   			<!-- URL to be called when WEM logout is required. -->
   			<property name="signoutUrl" value="http:// {OHS_Host_of_DCC_Webgate:OHS_Port }/oamsso-bin/logout.pl?end_url=http%3A%2F%2F{OHS_Host_of_Resource_Webgate} %3A{OHS_Port }%2F{sites-context}%2Fwem%2Ffatwire%2Fwem%2FWelcome" />
   			<!-- Do not proxy tickets, tt's the last server in the call chain -->
   			<property name="proxyTickets" value="false" />
   			<!-- Database Credentials needed by user lookup in OAMFilter -->
   			<property name="dbUsername" value="fwadmin" />
   			<property name="dbPassword" value="{password_for_above_user}" />
   			<!-- Your application protected resources (relative to applicationUrl) -->			
   			<property name="protectedMappingIncludes">
   				<list>
    							<value>wem/fatwire/**value>wem/fatwire/**>
   							<value>/faces/jspx/**value>/faces/jspx/**>		
   <value>/ContentServer?[pagename=OpenMarket/Xcelerate/UIFramework/LoginPage|OpenMarket/Xcelerate/UIFramework/ShowMainFrames|fatwire/getAllUserGroups|fatwire/getAllSecurityConfigs|rest/asset,# </value>  
   <value><Satellite?[pagename=fatwire/insitetemplating/request|OpenMarket/Xcelerate/ControlPanel/Request|OpenMarket/Xcelerate/ControlPanel/EditPanel|fatwire/wem/ui/Ping|fatwire/wem/sso/validateMultiticket|OpenMarket/Xcelerate/UIFramework/ShowPreviewFrames,#]
   </value>
   							<value>Xcelerate/LoginPage.html</value>

5. Restart Sites server after the above changes.
6. Use a protected URL from the resource webgate to login to Sites. For example : http://{OHS_Host_of_Resource_Webgate:OHS_Port}/{sites-context}/.

   Note:

   Site Capture, Satellite Server and Visitor Services can be configured to the OAM in the same way.