Integrating UCM Wiki Content Presenter into WebCenter 11g PS3/PS4

WebCenter 11g PS3/PS4 is able to store and retrieve Wiki content directly to and from Oracle UCM Content Server. Thats really good improvement comparing with early WebCenter releases, because there is no need to run separate server just to maintain static Wiki content. However, there are few tips and tricks to know, when integrating and making it work together with WebCenter Portal Framework application. This post will explain how to publish static Wiki content inside WebCenter Portal Framework application with the help of WebCenter Content Presenter ADF Task Flow.

Sample application defines connection to UCM server, you should change these details according to your infrastructure:

Download sample application for this post - EnterprisePortalApp_v8.zip.

Menu is implemented using WebCenter Portal Framework menu model. Wiki content will be retrieved and displayed in the menu using Content Query - Static Content:

In WebCenter PS3/PS4, we can construct menu from list of documents dynamically, based on UCM query. Content Query retrieves Wiki documents of type text/html, by specified Tag - populated list will be converted into menu automatically (make sure Insert Folder Contents option is set):

You may wonder, what is this Tag, which we are using to construct menu list. Tag is defined directly inside UCM, for example if we have documents stored in UCM:

Each of the documents/folders can be assigned with specific Tag, we can use this tag from WebCenter menu model Content Query:

Here is example of menu list populated from Content Query, Wiki document is loaded based on menu selection. All such menu links, generated based on Content Query, are rendering Wiki content directly inside Content Presenter:

We can edit Wiki document, because content is loaded inside Content Presenter automatically. Let's specify a link to another Wiki document available in UCM:

Wiki document is updated inside Content Presenter, using Rich Text editor:

Let's see what will happen, when we click on newly added link to another Wiki document:

When link to another Wiki document is clicked, WebCenter is loading Document Viewer task flow and opens referenced Wiki document:

Its not what we want, there is no need to open Document Viewer, we want to open Wiki document as static HTML page. Even more, when Document Viewer is opened from Wiki link, it destroys WebCenter menu model - portal application becomes broken (even Logout doesn't work):

But don't worry ! There is option to force Wiki links to behave as simple links and load static content - 31.3.5 Displaying Wiki Page Links Within Content Presenter. We need to update adf-config.xml file with Wiki resource handler:

Let's try to click on Wiki link again:

It works now ! Referenced Wiki document was loaded, even menu selection was updated automatically - thats what we need:

Configuring Oracle UCM 11g Access Control List Security - Missing Steps

If you are working with Oracle UCM 11g, I can imagine you may encounter hard times, when thinking about content security architecture design. But really, its not so complex - as it looks first, just there are lots of confusion between Security Groups, Accounts and Access Control Lists (ACL). For your reference, in Oracle UCM its not enough to define security groups to protect content - Understanding Oracle UCM 11g and Oracle ADF 11g Security Integration. One of the recommended ways is to use security Accounts in combination with Security Groups to protect RWDA permissions for files and folders. However, while this approach is recommended - is not so practical. Idea of using Security Groups and Accounts combination is hardly acceptable by customers, because first is hard to understand, second is hard to maintain. Its hard to maintain, because from administration point there is no difference between Security Group and Account, but it matters for UCM.

We prefer to use Access Control List (ACL) functionality to implement content security in Oracle UCM 11g. ACL was available in previous versions of UCM, before 10g and returned back in 11g. This suggests ACL being simple to understand and preferred solution to protect content security - 5.6 Access Control List Security.

Goal of this post is to describe few missing steps from Oracle UCM 11g documentation, related to ACL configuration.

Let's follow 5.6.1 Configuring Access Control List Security section and define UseEntitySecurity=true together with AllowQuerySafeUserColumns=true properties:

This should be enough to enable ACL support, as per documentation.

We can see now that two additional fields became available - User Access List and Group Access List (out of scope for this post) for folder/file configuration. Type redsa into Add User box, auto-suggest list with matching users will appear:

Assign RWD permissions to redsam for the 266 folder. You should keep in mind, this folder is enabled with Security Group called - Proposal :

Make sure that Force Folder Security is set to True - this will ensure ACL list propagation to child folders or files:

For example, if we upload new file into 266 folder, this file will inherit ACL list:

Another folder - 267, is assigned for user redsam1 with RWD permissions:

Let's do a test now, logically thinking folder 267 should not be visible for user redsam because of ACL setup:

Its still visible, both folders are visible, when it should be visible only one:

What was missing in UCM 11g ACL configuration guide, is SpecialAuthGroups property. From WebCenter Administrator's Guide 11.2.2.2 Configuring Oracle Content Server 11g to Support Item Level Security in All WebCenter Applications:

SpecialAuthGroups is a comma separated list of security groups that contains the content on which ILS can be specified. If in a WebCenter Spaces application users are to be provided ILS support, then the security group in which all Spaces content is created must be one of the SpecialAuthGroups. For WebCenter Spaces, the security group is named the same as the Document Spaces Property's application name. (For WebCenter Portal applications, the applicationName is the name of the security group in which content is created.)

In our case, we are using Proposal group for ACL enabled folders and files, it can be any other custom Security Group:

Make sure this group is included into ACL configuration:

It works now as expected, user redsam will see only those folders allowed through ACL - it works:

Folder 267 is not accessible for redsam, when going directly through URL as well, as it should be:

Major difference between UCM 10g and 11g, in 11g it runs directly integrated into WebLogic. This simplifies lots of administration and configuration tasks, for example UCM security is synchronized with WebLogic security providers. This means its enough to define Active Directory security provider for WebLogic, it will be visible for UCM as well.

UCM 11g is fetching users from WebLogic security provider automatically:

UCM role is mapped with roles from WebLogic security provider automatically as well, for example ProposalRole from UCM:

Can be used directly inside WebLogic security provider or fetched from Active Directory, etc.:

WebCenter Document Management ADF Task Flows Without Oracle UCM

Primarily we are using WebCenter Document Management ADF Task Flows in connection with Oracle UCM product - Oracle Universal Content Management 11g and Oracle ADF/WebCenter 11g Integration. However, we are not constrained if there is no Oracle UCM available, it is possible to use as document repository regular file system storage. You will not be able to do indexing, document management performance will not be so good as in Oracle UCM, but still it will work. Let's look - how it works.

Download sample application - WCDocManagementFS.zip. This sample as document content repository is using file system connection:

WebCenter Document Management ADF Task Flow is implemented inside ADF Region. There is initialization method inside that region, method is called each time and it created file system folder for current user (if folder doesn't exist already):

Default Method Call is invoking our custom method and passing current user name:

Method is using standard Java IO package to create new folder on file system:

I have generated custom Data Control for this class, in order to call this method through Data Control bindings:

Method becomes available in Data Control and can be called through ADF bindings:

WebCenter Document Management ADF Task Flow configuration obtains resourceId value dynamically, from our custom bean based on current user name. This allows to restrict unique folder view per each user:

Now we login into application - user redsam1:

File system folder is created automatically:

We can upload document:

User can view uploaded documents, but is restricted to open other users folders:

Disclaimer: File System adapter is not supported for production use and supported only for use during development in JDeveloper, according to Oracle WebCenter Developer Guide section - 26.2.3 How to Create a Content Repository Connection Based on the File System Adapter. However, technically it works on production deployment as well. I don't recommend one approach over another, decide on your own, if you want to use File System adapter and possibly migrate to UCM in the future.

Production environment test for File System adapter:

1. File system connection is define on Oracle Enterprise Linux:

2. Application is deployed on production WebLogic server:

3. WebCenter Document Management ADF Task Flow works well and access to File System is done successfully:

4. We can upload file:

5. User folder is created on file system:

6. File is uploaded on file system as well:

How to Install Oracle ECM 11g PS3 - Domain Configuration Hint

When we want to install Oracle Fusion Middleware on WebLogic server or to create/extend WebLogic domain, in most of the cases we are running quickstart.sh script. This script is available in utils folder, under ORACLE_HOME:

But it seems not true, for Oracle ECM 11g PS3 installation. Lets create new WebLogic domain, by running quickstart.sh script and selecting Oracle UCM product:

Domain creation is failing, with the following error:

First I was thinking, may be Oracle ECM 11g PS3 installation package download was corrupted and downloaded it once again, but received the same error.

Configuration hint: run config.sh script inside common/bin directory from Oracle ECM 11g PS3 installation folder:

WebLogic domain configuration wizard opened:

This time domain configuration was successful: