The Administration tray is the default layout for the WebCenter Content Server browser interface to provide access to Content Server administration log files and to pages for configuring and managing Content Server applications and tools.

To access the Administration tray, log in as a Content Server administrator, then choose Administration to view available administration options. If your Content Server instance is configured to use Menus, choose Administration to view the same options in a menu layout. Figure 2-1 shows a sample Oracle WebCenter Content tray layout with the Administration selection expanded to show options.

Figure 2-1 Sample Oracle WebCenter Content Administration Tray

Description of "Figure 2-1 Sample Oracle WebCenter Content Administration Tray"

The Administration Apps page provides access to Content Server administration apps and configuration tools. To access this page, log in as a WebCenter Content administrator and choose Administration, then Desktop Client Apps.

Administration apps accessed using a web browser are displayed and can be used only in the native interface.

Figure 2-2 Administration Apps page

Description of "Figure 2-2 Administration Apps page"

Fusion Middleware Control is a Web-based interface that you use to monitor and administer a farm, domains, and WebCenter Content instances.

A farm is a collection of components managed by Fusion Middleware Control. It can contain an Oracle WebLogic Server domain, one Administration Server, one or more Managed Servers, clusters, one or more Oracle instances, and the Oracle Fusion Middleware components that are installed, configured, and running in the domain or Oracle instances, including Oracle WebCenter Content.

Fusion Middleware Control organizes a wide variety of performance data and administrative functions into distinct, Web-based home pages for the farm, domain, servers, components, and applications. These home pages make it easy to locate the most important monitoring data and the most commonly used administrative functions for a component from your web browser.

Fusion Middleware Control can be used to:

• Start and stop Oracle WebLogic Server

• Start and stop components

• Start and stop applications

• Access log files and manage log configuration

• Modify Oracle BPEL Process Manager MBean properties

• Debug applications such as Oracle BPEL Process Manager applications

• Deploy ADF applications

• Deploy Java EE applications

• Configure and manage auditing

• Configure SSL

• Manage Oracle HTTP Server

• Manage Oracle Web Cache

For more information about accessing Fusion Middleware Control to administer WebCenter Content, see Accessing WebCenter Content Using Fusion Middleware Control. For more information about accessing and using Fusion Middleware Control, see Getting Started with Oracle Enterprise Manager Fusion Middleware Control in Administering Oracle Fusion Middleware.

For detailed information while using the Fusion Middleware Control Console, you can click Help at the top of the page. In most cases, the Help window displays a help topic about the current page. Click Contents in the Help window to browse the list of help topics, or click Search to search for a particular word or phrase.

Oracle WebLogic Server Administration Console is a Web-based interface that you use to manage a WebLogic Server domain. It is accessible from any supported Web browser with network access to the Administration Server. A WebLogic Server domain includes one or more WebLogic Servers. You manage your applications as part of a domain.

One instance of WebLogic Server in each domain is configured as an Administration Server. The Administration Server provides a central point for managing a WebLogic Server domain. All other WebLogic Server instances in a domain are called Managed Servers. In a domain with only a single WebLogic Server instance, that server functions both as Administration Server and Managed Server. The Administration Server hosts the Administration Console, which is a Web application accessible from any supported Web browser with network access to the Administration Server. Managed Servers host applications.

The Administration Console can be used to:

• Configure, start, and stop WebLogic Server domains

• Configure WebLogic Server clusters

• Configure WebLogic Server services, such as database connectivity (JDBC) and messaging (JMS)

• Configure security parameters, including creating and managing users, groups, and roles

• Configure and deploy applications

• Monitor server and application performance

• View server and domain log files

• View application deployment descriptors

For detailed information on using the Oracle WebLogic Server Administration Console, click Help from any Administration Console page, or see Getting Started Using Oracle WebLogic Server Administration Console in Administering Oracle Fusion Middleware.

Content Server provides the following administration software tools to configure and maintain system operation:

• Management Pages

• Applications

• Utilities

• IdcShell Command-Line Tool

The Oracle WebLogic Scripting Tool (WLST) can be used to manage Fusion Middleware components, such as Oracle WebCenter Content with a Content Server instance, from the command line.

The WebLogic Scripting Tool is a command-line scripting environment for creating, managing, and monitoring Oracle WebLogic Server domains. It is based on the Java scripting interpreter, Jython. In addition to supporting standard Jython features such as local variables, conditional variables, and flow control statements, the WebLogic Scripting Tool provides a set of scripting functions (commands) that are specific to Oracle WebLogic Server instances. Administrators can extend the WebLogic scripting language to suit site-specific needs by following the Jython language syntax.

Oracle WebCenter Content is supported by custom WLST commands for managing Content Server application connections (to the repository, portlet producers, external applications, and other back-end services) and for configuring the WebCenter Content user interface (based on the Oracle Development Application Framework). All the WLST commands specific to Oracle WebCenter Content Server are described in Oracle WebCenter Content Custom WLST Commands in WebCenter WLST Command Reference.

The WebCenter Content user interface uses the IDC socket protocol to communicate with Content Server. To enable this communication, you must set the IntradocServerPort and SocketHostAddressSecurityFilter values in the WCC_domain/ucm/cs/config/config.cfg configuration file for Content Server, in the Oracle WebCenter Content domain. Server-specific IntradocServerPort (TCP listen port for SystemServerSocket) can now also be set through both Java system property and config.cfg parameter, enabling multiple Content servers to run SystemServerSocket providers on the same machine and avoid port conflict.

IntradocServerPort=port_number
SocketHostAddressSecurityFilter=IP addresses of permitted UI hosts separated by a bar symbol (|)
 
For example:
IntradocServerPort=4444
SocketHostAddressSecurityFilter=123.456.789.0
 
If you want to open this up to all hosts in the network, use this setting:
SocketHostAddressSecurityFilter=*.*.*.*

IntradocServerPort=7034
IntradocServerPort.UCM_serverHA=7036

For the WebCenter Content user interface, you can also set Content Server parameters for folders and searching.

1. From the Content Server Administration menu or tray, choose Admin Server and then General Configuration.
2. Select the Enable Accounts checkbox.
3. In the Additional Configuration Variables area, add the following parameters, if not set already, to go in the config.cfg file:

   • FoldersIndexParentFolderValues=true

     This parameter enables you to search for content within folders, including subfolders.

   • FldEnforceFolderFileNameUniqueness=true

     This parameter prevents folders from having a child folder with the same name as a child document.

   • FldEnforceCaseInsensitiveNameUniqueness=true

     This parameter makes name-uniqueness checks for folder and file names case-insensitive. It also makes path resolution case-insensitive.

   • SearchIndexerEngineName=OracleTextSearch or SearchIndexerEngineName=DATABASE.METADATA

     This parameter enables OracleTextSearch full-text searching or database metadata searching, instead of the default database full-text searching.

4. Restart the WebCenter Content Managed Server.

When using the WebCenter Content user interface instead of the native interface, set the following properties using either MBean or WebLogic Scripting Tool.

For full-text searching, you need to rebuild the Content Server index using OracleTextSearch (SearchIndexerEngineName=ORACLETEXTSEARCH parameter).

1. Access Content Server with the native user interface:

   http://WCCHOST1:16200/cs

2. From the Administration menu or tray, choose Desktop Client Apps and then Repository Manager.
3. Click the Indexer tab.
4. Under Collection Rebuild Cycle, click the Start button.
5. Deselect Use Fast Rebuild.
6. Click the OK button.

If you want to obtain thumbnail images and web-viewable renditions of files from the WebCenter Content user interface, you can configure Inbound Refinery to provide them. You can set up an Inbound Refinery provider for thumbnails and file conversions, such as PDF Export, through the native user interface.

1. Access Content Server with the native user interface:

   http://WCCHOST1:16200/cs

2. From the Administration menu or tray, choose Configure Thumbnail Options.
3. Select Enable this server to create the thumbnail images box.
4. Click the Update button.

Digital Asset Management (DAM) is available through the WebCenter Content user interface. To enable the DAM user interface in Content Server, you need to enable the DigitalAssetManager, DAMConverterSupport, ContentBasket, and ZipRenditionManagement components and set up document conversion for DAM documents in Inbound Refinery.

1. Log in to Content Server (http://WCCHOST1:16200/cs) as a WebCenter Content administrator.
2. Enable these components, or verify that they are enabled:

   • DigitalAssetManager

   • DAMConverterSupport

   • ContentBasket

   • ZipRenditionManagement (enabled by default)

3. Restart Content Server.
4. Log in to the Inbound Refinery Managed Server (http://WCCHOST1:16250/ibr) by default, as an administrator, and enable the DAMConverter component for DAM.
5. Restart the Inbound Refinery Managed Server.
6. Log in to Content Server again as an administrator to choose file formats for conversion:
   1. From the Administration menu or tray, choose Desktop Client Apps and then Configuration Manager.
   2. From the Options menu, choose File Formats.
   3. For image asset formats that you want to convert to digital assets (such as image/gif and image/png, change the conversion to Digital Media Graphics.

   For more information about configuring DAM in Content Server and the Inbound Refinery Managed Server, see Configuring Digital Asset Manager in Managing Oracle WebCenter Content.

Some Content Server features are supported but not necessarily required by the WebCenter Content user interface. For example, Access Control Lists (ACLs) and Accounts are not configured out of the box. If these features are enabled on Content Server, however, the WebCenter Content user interface provides access to the additional functionality.

To complete the workflow configuration for the WebCenter Content user interface, you need to restart the Managed Servers and verify the configuration. The UseDatabaseWfInQueue configuration variable enables the WebCenter Content user interface to filter workflows assigned to a user. The EmailNotificationType configuration variable specifies where the links in notification emails point for workflows and subscriptions in different Content Server user interfaces, and its default value is NativeWebUI.

1. Set UseDatabaseWfInQueue=1 in config.cfg.
2. Make sure that the WCC_DOMAIN/ucm/cs/config/config.cfg file contains the EmailNotificationType variable with either of the following settings:

   • To generate emails with links that point only to the WebCenter Content user interface, set EmailNotificationType=ContentUI in config.cfg.

   • To generate emails with links that point to both the WebCenter Content user interface and the native user interface, set EmailNotificationType=ContentUI,NativeWebUI in config.cfg.

3. Restart the Content Server Managed Server.
4. Click the alert that appears on the Content Server home page after restart: Click to complete workflow setup.

   Ensure that Content Server returns a success message: Workflow setup is now complete.

5. Restart the WebCenter Content user interface Managed Server.

Complete the steps described in this section to configure a JAX-WS connection from the WebCenter Content user interface to Content Server.

1. Ensure that Metadata Services (MDS) schemas have been created in Oracle Database by the Repository Creation Utility (RCU).

   Create an MDS schema for the common Oracle WebCenter Content and WebCenter Content user interface domains.

2. Apply the WSM Policy Manager Template to the common Oracle WebCenter Content domain and the WebCenter Content user interface domain, if the domain does not already have this template. The template is in this file:

   MW_HOME/oracle_common/common/templates/applications/oracle.wsmpm_template_11.1.1.jar

   If the file is not in the MW_HOME/oracle_common/common/templates/applications directory, you can extend the domain with the template.

   To extend a domain with the WSM Policy Manager Template:

   1. If a Managed Server in the domain that you are planning to extend is running, stop it through the Administration Console.

   2. Launch an Oracle WebLogic Scripting Tool (WLST) shell in offline mode.

   3. Run the following commands in sequence:

      wls:/offline> readDomain(r'${DOMAIN_HOME}')
      
      addTemplate(r'${MW_HOME}/oracle_common/common/templates/applications /oracle.wsmpm_template_11.1.1.jar')
      
      updateDomain()
      
      closeDomain()
      
      exit()

      The addTemplate.cmd command creates a dummy schema.

3. Restart the Administration Servers in the common domain.
4. For the common domain, update the mds-owsm JDBC connection pool to point to the MDS schema for the domain. The targets should be the Administration Server and all Oracle ADF servers. The update can be done from Services > Data sources > mds-owsm in the Administration Console.

   After updating a domain, restart the corresponding Administration Server. Confirm that Monitoring > Testing > Check data source is giving zero errors. A success message is expected, like "Test of mds-owsm on server AdminServer was successful."

   Note:

   Use separate schemas for ADF UI connection architecture and ADF UI OWSM.

5. Restart both the Managed Servers for UCM and Web user interface.
6. Create a policy set for the WebCenter Content user interface domain:

   1. In Oracle Enterprise Manager Fusion Middleware Control, expand WebLogic Domain in the navigation tree on the left, and then click the name of the domain.

   2. From the WebLogic Domain drop-down menu at the top of the domain page, choose Web Services, then Policy Sets.

   3. From the Type of Resources menu under Policy Set Summary, choose Web Service Client, enter a name for the policy set in the Name field, and click Create.

   4. Make sure the policy set is enabled.

   5. Under the scope, enable the policy set, enter the name of the domain in the Domain Name field, and then attach a policy, such as oracle/wss10_saml_token_client_policy.

7. Create a policy set for the Oracle WebCenter Content domain:

   1. In Fusion Middleware Control, expand WebLogic Domain in the navigation tree on the left, and then click the name of the domain.

   2. From the WebLogic Domain drop-down menu at the top of the domain page, choose Web Services, then Policy Sets.

   3. From the Type of Resources menu under Policy Set Summary, choose Web Service Endpoint, enter a name for the policy set in the Name field, and click Create.

   4. Make sure the policy set is enabled.

   5. Under the scope, enter the name of the domain in the Domain Name field, and then attach a policy, such as oracle/wss_saml_or_username_token_service_policy.

8. To expedite applying the policy changes, restart the servers.
9. Confirm that the WebCenter Content web service has the GPA policy applied by inspecting the WSDL, at the following URL:

   http://WCC_HOST:WCC_PORT/idcnativews/IdcWebLoginPort?WSDL

   For example:

   http://slc05amp.example.com:16200/idcnativews/IdcWebLoginPort?WSDL

   In the WSDL, check for this code:

   wsp:PolicyReference xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"
   URI="#wss_saml_or_username_token_service_policy" wsdl:required="false"/>

10. To do an identity switch over the top of a standard SAML identity propagation policy, you need to be able to override subject precedence from its default value of true, to be false instead.

    This instructs the server not to automatically send the connected subject, but rather allow it to explicitly set the identity that should be sent across.

    The connection architecture has a Boolean property that you can set to activate an RIDC filter that results in requestContext.put(ClientConstants.WSM_SUBJECT_PRECEDENCE, "false") being set.

    Note:

    If a Credential map exists, ensure that the password property (oracle.wcc.ridc.credential.password) is cleared from the Credential map before executing the following command. To check this property in Fusion Middleware Control, go to the WebCenter Content user interface page, and from the WebLogic Server drop-down menu, choose Security, then Credentials, then WccAdf.oracle.wcc.adf, and then anonymous#WccAdfServerConnection. To clear the property, click Edit, remove oracle.wcc.ridc.credential.password, and save the change.

    To activate the RIDC filter, run the following command:

    updateRIDCConnection('Oracle WebCenter Content - Web UI', 
    'WccAdfServerConnection', 
    connUrl="http://slc05elc.example.com:16200/idcnativews", 
    jaxwsRegisteridentityswitchfilter="true",credImpersonationAllowed='false')

    Run the following Connection Architecture command:

    displayRIDCConnection('Oracle WebCenter Content - Web UI', 'WccAdfServerConnection')

    Now the Connection Architecture attributes should look as follows:

    PropConnectionUrl = http://WCCUI_HOST:16200/idcnativews
    PropConnectionSocketTimeout = null
    PropConnectionPoolMethod = null
    PropConnectionPoolSize = null
    PropConnectionWaitTime = null
    PropCredentialUsername = weblogic
    PropCredentialAppIdKey = null
    PropCredentialImpersonationAllowed = null
    PropProtocolJaxWSStack = null
    PropProtocolJaxWSPolicy = null
    PropProtocolJaxWSJpsConfigFile = null
    PropProtocolJaxWSSkipStackOptimize = null
    PropProtocolJaxWSServerInsName = null
    PropProtocolJaxWSRegisterIdentitySwitchFilter = true
    PropProtocolHttpLibrary = null
    PropProtocolIdcsAlgorithm = null
    PropProtocolIdcsKeystoreFile = null
    PropProtocolIdcsKeystoreAlias = null
    PropProtocolIdcsTrustManagerFile = null

    Note:

    Make sure PropCredentialImpersonationAllowed is set to null or false, not to true.

11. For an application to switch identity, grant it a special policy-code grant in the system-jazn-data.xml file, under WCCUI_MW_HOME/user_projects/domains/WCCUI_domain/config/fmwconfig. Change the name, as in the following code:

    <grant>
       <grantee>
         <codesource>
           <url>file:${common.components.home}/modules/oracle.wsm.agent.
           common_11.1.1/wsm-agent-core.jar</url>
         </codesource>
       </grantee>
       <permissions>
         <permission>
           <class>oracle.wsm.security.WSIdentityPermission</class>
           <name>resource=Oracle WebCenter Content - Web UI</name>
           <actions>assert</actions>
         </permission>
       </permissions>
    </grant>

12. Restart the WebCenter Content user interface Managed Server.

An SSL Incoming Provider is leveraged and instantiated to create an SSL server socket to which Intradoc clients can connect, and whereby traffic is encrypted. The provider can be configured with or without requiring client authentication (the WebCenter Content user interface Managed Server is a client of Content Server). When client authentication is not required, the JAVA RIDC client making the connection to the SSL server socket (Intradoc secure-socket port) does not need to present a valid certificate. This mode is not very different from a normal, non-SSL Intradoc connection. The main difference, however, is that traffic is encrypted and cannot be viewed by packet capture, and so on, in the clear. Client authentication means that the client must supply a valid SSL certificate signed by an authority that is in the server's trust store. In this context, client authentication is not tied to any particular end user, but rather to the Java client program. When the Require Client Authentication option is selected for the provider, and a secure Intradoc connection is made by the Java RIDC client to Content Server, a client that does not present a valid certificate will receive an exception, such as this one:

javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate oracle.stellent.ridc.protocol.ProtocolException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate at oracle.stellent.ridc.protocol.intradoc.HdaProtocol.readResponse(HdaProtocol.java:257) at oracle.stellent.ridc.IdcClient.sendRequest(IdcClient.java:184) at Ping.ping(Ping.java:42) at Ping.main(Ping.java:20) Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1720) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:954) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:753) at com.sun.net.ssl.internal.ssl.AppInputStream.read(AppInputStream.java:75) at java.io.BufferedInputStream.fill(BufferedInputStream.java:218) at java.io.BufferedInputStream.read(BufferedInputStream.java:237) at oracle.stellent.ridc.common.util.StreamUtil.readRawLine(StreamUtil.java:227) at oracle.stellent.ridc.common.util.StreamUtil.readLine(StreamUtil.java:254) at oracle.stellent.ridc.protocol.intradoc.HdaProtocol.readHeaders(HdaProtocol.java:459) at oracle.stellent.ridc.protocol.intradoc.HdaProtocol.readResponse(HdaProtocol.java:215)

#hostname -i :- 10.229.187.227

SocketHostAddressSecurityFilter=10.229.187.227|127.0.0.1|0:0:0:0:0:0:0:1

You can configure an IDC secured (IDCS) connection with or without Require Client Authentication. The WebCenter Content user interface Managed Server is a client of Content Server.

For an IDC connection to Content Server, the WebCenter Content user interface application is authenticated based on an IP address. Therefore, you need to make sure the WCC_DOMAIN_HOME/ucm/cs/config/config.cfg file has SocketHostAddressSecurityFilter set correctly. SocketHostAddressSecurityFilter includes the IP address of the client machine (the WebCenter Content user interface machine); for example:#hostname - i :- 10.229.187.227 SocketHostAddressSecurityFilter=10.229.187.227|127.0.0.1|0:0:0:0:0:0:0:1.

1. Connect to the WebCenter Content user interface.
2. Run the following updateRIDCConnection() command, on one line:

   updateRIDCConnection('Oracle WebCenter Content – Web UI',
   'WccAdfServerConnection',connUrl='idc://adc2120610.example.com:4444',
   credUsername='weblogic')

   The port number 4444 is the IntradocServerPort value for Content Server.

3. Restart the WebCenter Content user interface Managed Server.

The steps in this section describe how to configure an HTTP connection from the WebCenter Content UI to Content Server.

1. Connect to the WebCenter Content user interface.
2. Run the following updateRIDCConnection() command, on one line:

   updateRIDCConnection('Oracle WebCenter Content – Web UI', 'WccAdfServerConnection',connUrl='http://adc2120610.example.com:7777/cs /idcplg',credUsername='weblogic',credPassword='password', httpLibrary='oracle',credImpersonationAllowed='true')

3. Restart the WebCenter Content user interface Managed Server.

The steps in this section describe how to configure an HTTPS connection to Content Server without a certificate.

1. Enable the SSL listen port in the WebLogic Server Administration Console. For example:

   SSL listen port: 16201

2. Update the following two entries in the Content Server configuration file, config.cfg, under WCC_MW_HOME/user_projects/domains/cs_domain/ucm/cs/config:

   HttpServerAddress=adc2120610.example.com:16201
   UseSSL=Yes

3. Restart the Oracle WebCenter Content Managed Server.
4. Connect to the WebCenter Content user interface.
5. Run the following updateRIDCConnection() command, on one line, with the appropriate SSL port:

   updateRIDCConnection('Oracle WebCenter Content – Web UI', 'WccAdfServerConnection',
   connUrl='https://adc2120610.example.com:16201/cs/idcplg',
   credUsername='weblogic',credPassword='password',httpLibrary='oracle', 
   credImpersonationAllowed='true')

   Note:

   In case the httpLibrary attribute is not set to oracle in the preceding command, Apache 3/4 is used for HTTP or HTTPS communication, so it is necessary to explicitly add the httpclient/httpcodec JAR in the WebCenter Content user interface (Model) classpath.

6. Restart the WebCenter Content Managed Server.