After installing and configuring OAM and enabling Impersonation in OAM, you need to configure the OAM Impersonation trigger end points in your WebCenter Portal instance as shown below:

1. Using WLST, connect as administrator to the Weblogic Administration Server and run the following command replacing oamhost and oamserverport with the corresponding host ID and port for OAM:

   addOAMSSOProvider(loginuri="/${app.context}/adfAuthentication", logouturi="/oamsso/logout.html",
   beginimpuri="http://oamhost:oamserverport/oam/server/impersonate/start",
   endimpuri="http://oamhost:oamserverport/oam/server/impersonate/end")
   

2. Restart all servers in the WebCenter Portal domain, including the Admin Server.

3. You may also need to account for any time difference between your WebCenter Portal server and OAM. Although Impersonation start and end times are accepted in WebCenter Portal, they are enforced by OAM so the time settings must be consistent. To account for time differences:

   1. Log into WebCenter Portal as an administrator.

   2. Select Administration > Attributes.

      The Attributes page displays.

      Tip:

      You can also access the Attributes page directly by opening the page in your browser:

      http://host:port/webcenter/faces/oracle/webcenter/webcenterapp/view/pages/admin/WebCenterAdmin-CustomAttributes.jspx

      where host and port are the host and port IDs of the WC_Portal server.

   3. Specify the Impersonation time Delta in seconds using a + sign if the WebCenter Portal server is behind the OAM server, or a - sign if it is ahead. For example:

      oracle.webcenter.security.impersonation.timedelta = -480
      

      would indicate that there is a time difference of eight minutes between OAM and WebCenter Portal with the WebCenter Portal server being ahead.

      Tip:

      You can also add the setting to the $domain.home/bin/setDomainEnv.sh file:

      EXTRA_JAVA_PROPERTIES="-Doracle.webcenter.spaces.osso=true
      -Doracle.webcenter.security.impersonation.timedelta=-480"
      export EXTRA_JAVA_PROPERTIES 

   4. Restart the WebCenter Portal managed server (WC_Portal).

After configuring OAM and WebCenter Portal, you must configure the users to whom you want to grant impersonation privileges by adding those users or groups to the webcenter#-#impersonators role. Out-of-the-box, no users are granted this role. Only users belonging to this role either by direct membership or through an enterprise role membership are eligible to impersonate users in a WebCenter Portal instance.

Use the grantAppRole WLST command to grant the webcenter#-#impersonators role to one or more enterprise roles or users. For example:

• To grant the impersonators role to an enterprise role called SupportRepresentatives:

  grantAppRole(appStripe="webcenter", appRoleName="webcenter#-#impersonators", principalClass="weblogic.security.principal.WLSGroupImpl", principalName="SupportRepresentatives") 
  

• To grant the impersonators role to a user named weblogic:

  grantAppRole(appStripe="webcenter", appRoleName="webcenter#-#impersonators", principalClass="weblogic.security.principal.WLSUserImpl", principalName="weblogic")  
  

Use the revokeAppRole WLST to revoke impersonator permission from an enterprise role or user. For example:

• To revoke the impersonators role from an enterprise role called SupportRepresentatives:

  revokeAppRole(appStripe="webcenter", appRoleName="webcenter#-#impersonators", principalClass="weblogic.security.principal.WLSGroupImpl", principalName="SupportRepresentatives")  
  

• To revoke the impersonators role from a user named weblogic:

  revokeAppRole(appStripe="webcenter", appRoleName="webcenter#-#impersonators", principalClass="weblogic.security.principal.WLSUserImpl", principalName="weblogic")
  

WebCenter Portal Impersonation is disabled by default, so unless you have already enabled impersonation there is nothing that needs to be done to turn it off. However, if you have enabled it and now want to disable it, follow the steps below to turn it off in WebCenter Portal and OAM.

Note that turning off impersonation in WebCenter Portal only disables it for that particular instance. Any other WebCenter Portal instances for which impersonation was enabled will not be affected until you turn off impersonation in OAM.

To disable impersonation for WebCenter Portal:

1. Log into Fusion Middleware Control as an administrator.

2. Go to WebCenter Domain > Security > Security Provider Configuration.

3. Navigate to the Properties section and click Configure.

4. Under PropertySets, locate the property set that defines the impersonation start and stop URIs (typically "props.auth.uri.0").

5. Delete the properties imp.begin.url and imp.end.url.

6. Restart all servers in the WebCenter Portal domain, including the Admin server.

   Note that until you disable impersonation in OAM, impersonation in other WebCenter Portal domains will continue to be enabled.

To disable impersonation in OAM and turn off impersonation altogether:

The session indicator is an overlay that appears on the impersonator's screen by default during an impersonation session. Although the overlay provides a visual clue that the impersonation session is active, and also provides a quick way to stop the session by clicking Stop Impersonation, it may obstruct a view of part of the user's (impersonatee's) screen as show in Figure 30-2.

You can turn off the session indicator overlay as shown below:

To turn off the session indicator:

The default Ctrl+Shift+I hotkey sequence used by the impersonator to view the list of impersonatees can be overridden, if needed.

To change the hotkey sequence:

WebCenter Portal Impersonation, when enabled, activates logging for Impersonation-related events as part of the Fusion Middleware Audit Service. Audit log events are stored in a file (the Audit Bus-stop) by default, but can also be uploaded to a database for persistency.

Impersonation audit logging provides the following key benefits:

• Events that alter the security settings of Portal, Portal Server, and major Portal Server artifacts are traceable

• Auditable events contain all relevant event payload to help define the impersonator, impersonatee and the context surrounding an event

• Definable logging levels

• Events logged are available in perpetuity when uploaded to a database

• Reports on audit events are available through the Audit Service

For more information about managing audit logging for WebCenter Portal, see Managing WebCenter Portal Audit Logs. For information about configuring the Audit Service to use a database, see Configuring and Managing Auditing in Securing Applications with Oracle Platform Security Services.