WebCenter 11g PS3/PS4 Aggregating Multiple WebLogic LDAP Security Providers (Virtualize = True)

There is one tricky thing about WebCenter 11g PS3/PS4 services you should definitely know. Its related to WebLogic LDAP security providers. WebCenter always consumes only first WebLogic security provider from available providers list. Even SUFFICIENT flag is set for security provider, WebCenter still is using only first one. Thats sounds like a huge limitation, indeed it was before WebCenter 11g PS3/P4 - it was documented. But know situation is much better, we are not constrained anymore with only one single LDAP security provider configuration on WebLogic. I will describe in this blog post, how you can enable virtual aggregator for all defined security providers in WebLogic, so WebCenter will be able to retrieve user data from multiple LDAP servers. For additional info, I would recommend to read WebCenter Developer Guide - 28.7 Aggregating Multiple Identity Store LDAP Servers Using libOVD and Oracle FMW Security Guide 7.3.1.1 Configuring Multi-LDAP Lookup.

Sample application is based on WebCenter People Connections service - Profile:

In case if we would authenticate with user from 2nd or 3rd LDAP security provider, WebCenter service would fail to retrieve user larry information:

However as you can see, ADF authentication is completed successfully - this means security providers are configured correctly. ADF authentication works well, because first security provider is set to be SUFFICIENT, however same rule is not working for WebCenter services:

User larry is defined inside StudentsProvider, however WebCenter is always using only first provider - ProffesorsProvider to look for users info:

Let's fix this, according WebCenter PS3/PS4 and Oracle FMW Security documentation instructions. These instructions looks complex, but at the end it all fairly simple. Open Oracle FMW Enterprise Manager and select WebLogic domain, where your WebCenter application is deployed - wc_domain. From menu go to WebLogic Domain -> Security -> Security Provider Configuration:

Expand Identity Store Provider and press Configure button:

Add new property to Identity Store Configuration - virtualize = true:

This will virtually merge available security providers into one and WebCenter will be able to retrieve user information, no matter where it is defined.

New property is successfully added, all security providers will be virtualized into one now - no matter what order is defined:

Restart WebLogic server and here we go - we are cool again - user information is retrieved from LDAP, defined as second provider in the list:

Download sample application - WebCenterUserProfileApp.zip.