How to setup Service To Service (S2S) Authentication?

Introduction

When you have custom application code that contains Content Services WebServices code, and requires S2S (ServiceToServiceManager) authentication, you need to separately login to Content Services using the WebServices API -- but, to avoid that, you should use the S2S authentication.

With S2S, you authenticate against a registered application (specify which ever password you want), then, you just need the SSO username, without the password to login to Content Services.

S2STestSetup uses the repository API to create a new application entity for Service-to-

Service authentication testing. The application entity created is added to the trusted applications list.

It attempts to create an application under the IFS container with name S2STestApplication. The password for this application is set to welcome1. The DN ends up looking like:

 orclApplicationCommonName=S2STestApplication,cn=IFS, cn=Products,cn=OracleContext

Steps to Do

Step 1:

The default configuration for an out-of-box Oracle Collaboration Suite installation allows Cleartext Authentication only if SSL has been enabled (and the Web Services connection string begins with https). See the authentication topic for details.

To allow Cleartext Authentication to take place over standard (non-SSL) HTTP, set the Oracle Collaboration Suite domain property IFS.DOMAIN.WS.CleartextAuthenticationRequiresHttps to false using Enterprise Manager (Application Server Control).

If the domain property above is not modified to false and Cleartext Authentication is attempted using using standard HTTP, an FdkException will be thrown:

ORACLE.FDK.UnexpectedError : ORACLE.FDK.FeatureNotEnabled

Step 2:

Download the Oracle Content Services Java Web Services Accelerator 10.1.2.3 release - (3983028 bytes)(JDeveloper 10.1.2 build 1811 support) from

http://www.oracle.com/technology/products/cs/developer/contentservicesdev/sourcepacka

ges/CS10gWS_for_ContentServices_10.1.2.3_RTM_For_JDEV_10.1.2_OTN_release.zip

Step 3:

Unzip the file to ORACLE_HOME so that a directory CS10gWS becomes available under ORACLE_HOME

Step 4:

Edit the java file to ensure OID superuser details are correct (aka orcladmin password).

ORACLE_HOME/CS10gWS/other/service_to_service/S2STestSetup.java

Step 5:

Compile S2StestSetup.java as shown below

$ javac -source 1.4 -classpath /ocsinfra/product/10.1.2/ocs_1/jlib/repository.jar

/ocsinfra/product/10.1.2/ocs_1/CS10gWS/other/service_to_service/S2STestSetup.java

$ zip -u -m S2STest.jar S2STestSetup.class

For the above commands to successfully run, make sure

1. ORACLE_HOME should be set to the middle-tier home.

2. LD_LIBRARY_PATH variable on Linux platform should be set to include

$ORACLE_HOME/lib

3. PATH variable on Windows should be set to include %ORACLE_HOME%\bin

Step 6:

The S2STest jar file must be configured in jazn-data.xml

The repository API is protected by JAZN using code based authentication. For this protection, the API itself needs to have a list of access controls that are specified in ORACLE_HOME/config/jazn-data.xml

e.g. Create an entry:

<grant> <grantee> <codesource> <url>file: /user2/ocsapps/product/10.1.2/ocs_2/CS10gWS/other/se rvice_to_service/S2STest.jar </url> </codesource> </grantee> <permissions> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>SchemaManager</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>addInstanceAccessToOIDEntry</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>addPrivilegeToOIDEntry</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>connectAs</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getAllSchemas</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getBaseSchema</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getDBConnect</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getDBPassword</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getInstallType</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getInstanceName</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getOIDConnect</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getOIDUser</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getOIDVersion</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getSSOConnect</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getSchema</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>getVirtualHostName</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>isProductChildExist</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>makeNewOIDEntry</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>setComponentSuccess</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>deleteOIDEntry</name> </permission> <permission> <class>oracle.ias.repository.schemaimpl.CheckRepositoryPermission</class> <name>removeInstanceAccessInOIDEntry</name> </permission> </permissions> </grant>

Step 7:

Then execute the following command to successfully start using S2S Authentication

$ java -classpath ORACLE_HOME/jlib/repository.jar:ORACLE_HOME/CS10gWS/other/service_to_service/S2STest.jar S2STestSetup

What is Service To Service (S2S) Authentication Framework?

The AXIS Java client stubs shipped with Oracle Content Services do not support digest authentication (see http://ws.apache.org/axis/java/security.html).

Clients that use the Java stubs can authenticate through basic authentication, or alternatively by using an HTTP client and the S2S servlet.

The Service to Service (S2S) authentication framework provides a means for a trusted partner application to establish user sessions with a trusting provider application on behalf of its users, without having to supply any credentials for the users individually.The partner application instead supplies a digest credential with each user session login request (or potentially, a basic credential over HTTPS) that is used to validate/authenticate the partner as being trusted to the particular provider service.

Oracle Content Services operates as the trusting provider service, with the partner service being potentially any application (registered/configured with Oracle Internet Directory) that is capable of establishing a client SOAP over HTTP Web Service connection with digest authentication headers. For this manager to function, the server must be configured for S2S authentication, and the domain property IFS.DOMAIN.CREDENTIALMANAGER. ServiceToServiceAuthenticationEnabled must be
set to true. Use the Oracle Collaboration Suite Control to set domain properties.

S2S Login manager provides facilities to:

1. Authenticate a user with given user name. The S2S header ORA_S2S_PROXY_USER must also be set to the value of the supplied user’s Oracle Internet Directory nickname attribute.
2. As an example, consider a custom application that renders information pertaining to the user’s most recently accessed documents in Oracle Content Services. The runtime flow would be similar to the following:
3. User authenticates to Oracle Portal
4. A default portal user home page is requested to be displayed that contains the "most recent documents"
5. The application checks to see if an existing Oracle Content Services session cookie exists for the user in the user’s HttpSession (or equivalent) object store. If no existing session exists, proceed with service to service authentication. Otherwise,obtain a FileManager (step 7) and make the appropriate call.
6. The application obtains the portal service's credentials from a credential store (such as Oracle Internet Directory)
7. The application initiates a Web Service request to the Oracle Content Services. ServiceToServiceLoginManager with digest authentication HTTP headers present that identify the partner service (Oracle Portal), and HTTP header ORA_S2S_PROXY_USER set to a non-null value (for example, "matt"). The ServiceToServiceLoginManager login method is called, supplying the user name of the portal authenticated user ("barani"[@non-default realm])
8. A session cookie is returned that identifies the newly created Oracle Content Services user session. This, in turn, is stored in an appropriate location, such as the user’s HttpSession object.
9. Using the session cookie, obtain a FileManager, and then call the getMostRecentDocuments method.
10. Process the returned item array and render application results.

Tip – A number of Web Services clients provide no published means to access the underlying HTTP transport to allow setting of the HTTP headers and so forth. These clients are thus are incapable of utilizing the ServiceToServiceLoginManager. As a workaround, Oracle Content Services ships an S2S Servlet that can be accessed through a regular HTTP client library, such as HttpClient, part of the Apache Jakarta Commons project. The session cookie returned through authentication to the S2S servlet can then be used by the Web Services client.

What is HTTP Digest Authentication?

HTTP Digest authentication is intended to supersede unencrypted use of the Basic access authentication, allowing user identity to be established securely without having to send a password in plaintext over the network. Digest authentication is basically an application of MD5 cryptographic hashing with usage of nonce values to prevent cryptanalysis.

The process consists of the following steps

1. The client asks for a page that requires authentication but does not provide a username and password. Typically this is because the user simply entered the address or followed a link to the page.
2. The server responds with the "401" response code, providing the authentication realm and a randomly-generated, single-use value called a nonce.
3. At this point, the client will present the authentication realm (typically a description of the computer or system being accessed) to the user and prompt for a user name and password. The user may decide to cancel at this point.
4. Once a user name and password have been supplied, the client re-sends the same request but adds an authentication header that includes the response code.
5. In this example, the server accepts the authentication and the page is returned. If the user name is invalid and/or the password is incorrect, the server might return the "401" response code and the client would prompt the user again.

Note: A client may already have the required user name and password without needing to prompt the user, e.g. if they have previously been stored by a web browser

Fine Tuning of Content Services

Oracle Content Services uses Oracle Database Cost-Based Optimizer (CBO) to determine the most efficient way to run SQL statements. For the CBO to work properly, the Oracle Content Services analyze.sql script needs to be run as part of regular Oracle Content Services operations, especially after large volume changes to the data, such as after users have loaded a large number of files into the database instance. This script generates statistics about the distribution of data in Oracle Content Services so that the CBO can choose the most efficient way to execute SQL statements.

To run the script, enter the following at the command line:

$ cd ORACLE_HOME/content/admin/sql

$ sqlplus content_services_schema/password@connect_string @analyze.sql

content_services_schema

Service Configurations in Content Services & Java Memory Sizing

Service Configurations

Each service configuration specifies values for service properties such as credential manager settings, the sizes of the cache and database connection pools, maximum number of sessions, etc.

Whenever a new Oracle Content Services schema is created, three service configuration

objects are generated:

• 
  SmallServiceConfiguration
  
• 
  MediumServiceConfiguration
  
• 
  LargeServiceConfiguration
  

These objects are named to reflect the sizes of their data caches

Service Configurations and Java Memory Sizing

If you see java.lang.OutOfMemory errors in your OC4J_Content.default_island.1 or

application.log files, then you also need to adjust your -Xmx setting.

The Table describes factors that might require you to change the -Xmx setting.

Calculating Xmx Settings

A general guideline for calculating the Xmx setting is:

Xmx = PCCU * 2.8MB

How to configure FTP or FTPS access to Content Services?

1. Access the Oracle Collaboration Suite EM Control and navigate to “Content” system component.

2. You may want to change the default port number for the FTP server. To do this:

a. In the Administration section, click Server Configurations.

b. Click FtpServerConfiguration.

c. Click IFS.SERVER.PROTOCOL.FTP.Port, in the Properties section. ( i would suggest you to give port number such as 2100)

d. Update the Value with the desired port number and click OK.

e. Click OK on the Edit Server Configuration page.

3. Return to the Content Services Home page and click Node Configurations, in the

Administration section.

4. Click the name of the node configuration that corresponds to the node where you

want to run the FTP server. You can only run the FTP server on regular nodes;

you cannot run FTP on HTTP nodes.

5. Scroll down to the Servers table and click FtpServer.

6. Select Active and Initially Started.

7. Click OK on the Edit Server page.

8. Click OK on the Edit Node Configuration page.

9. Return to the Content Services Home page and restart the node.

Repeat this procedure for any additional regular nodes on which you want to run FTP.

Enabling Anonymous FTP Access

For security reasons, anonymous FTP access is disabled by default. If you want to enable

anonymous access, you must first modify the FTP server configuration to allow anonymous access, then allow public access to a particular folder or folders in Oracle Content Services.

Once public access has been enabled for a particular folder, users can connect directly to that folder using anonymous FTP. In most cases, anonymous users should use FTP links to connect. For example, if an administrator only enables public access to the folder /DEFAULT_NAME/TestFiles/Public, users would need to configure an FTP client to connect directly to that folder. Anonymous users would not be able to connect to the root folder and navigate to the "Public" folder, because "DEFAULT_NAME" & "TestFiles" folders do not have public access enabled.

To modify the FTP server configuration to allow anonymous access:

1. Connect to the Oracle Collaboration Suite Control and navigate to the Content Services Home page.

2. In the Administration section, click Server Configurations.

3. Click FtpServerConfiguration.

4. In the Properties section, select

IFS.SERVER.PROTOCOL.FTP.AnonymousAllowed and click Edit, or just click the property name.

5. Set the Value to True and click OK.

6. Click OK on the Edit Server Configuration page.

7. Return to the Content Services Home page and restart the node.

Where to download Oracle Content Services Web Services Development Kit?

The Oracle Content Services Web Services Development Kit can be downloaded from

http://www.oracle.com/technology/products/cs/developer/contentservicesdev/contenservi

cesdevkit.html

Inside you will find the necessary JAR files with which to run the Web Services client.

The following JARs from the /lib directory of the Development Kit must be in your CLASSPATH to run:

• activation
  
• axis
  
• commons-discovery-0.2
  
• commons-logging-1.0.3
  
• content-ws-client
  
• http_client
  
• jaxrpc
  
• mail
  
• saaj
  
• wsdl4j-1.5.1
  
• xmlparserv2
  

How to allow Public Access to Content Services Folders?

Before you can allow public access to a particular folder, you must ensure that the ability to grant public access has been enabled at the Site level.

To ensure that the ability to grant public access is enabled for the Site:

1. Connect to Oracle Content Services as a user with the Content Administrator and

User Administrator roles, such as orcladmin.

2. Change to Administration Mode.

3. Access the Sharing Properties for the root Site folder.

4. Ensure that the option Allow public access to be granted has been enabled.

To grant public access to a particular folder:

1. Connect to Oracle Content Services as a user with the Content Administrator and User Administrator roles, such as orcladmin.

2. Change to Administration Mode.

3. Access the Sharing Properties for the folder to which you want to grant public access.

4. Add the special group Public to this folder. If you cannot add this group, make sure that you enabled the ability to grant public access at the Site level, as described in the previous procedure.

Useful OPMN commands for managing Content Services

I. Starting, Stopping, or Restarting the Oracle Content Services Domain

opmnctl startproc ias-component=Content

opmnctl stopproc ias-component=Content

opmnctl restartproc ias-component=Content

II. Starting, Stopping, or Restarting Node Processes

opmnctl startproc process-type=OC4J_Content

opmnctl startproc process-type=Node

How to change the default Server Email Addresses after installation of OCS 10g?

Change the below values using EM console by navigating to Content
-> Domain ->Properties
search for “email”

IFS.DOMAIN.EMAIL.AdministratorAddress STRING OCS_SUPPORT@domain.com

IFS.DOMAIN.EMAIL.SmtpHost STRING mail.hostname.com

IFS.DOMAIN.EMAIL.SmtpPort INTEGER 25

IFS.DOMAIN.EMAIL.SmtpTimeoutLength INTEGER 60

IFS.DOMAIN.EMAIL.SmtpUser STRING OCS_SUPPORT@domain.com

How to speed up user provisioning from Oracle Internet Directory to Content Services?

When a user is created in OID the user provisioning in Content Services happens in two phases:

1) The ODISRV process pushes a new OID USER_ADD event into the content services schema. ODISRV / the directory integration agent will check OID for new actions every 5 minutes and push a USER_ADD event into a content services schema table called ODMZ_OIDCREDENTIALMANAGEREVNT.

2) The OidCredentialManagerAgent reads the event from the table and provisions the user: The OidCredentialManagerAgent is configured to run every 15 minutes (by default). When it runs it will read all events from the DMZ_OIDCREDENTIALMANAGEREVNT table and provision the user.

There are two intervals which may cause the final user provisioning to take up to 20 minutes.

(5 minutes for the ODISRV process + 15 minutes activationtime for the oidcredentialmanageragent).To speed up the user provisioning time, follow the steps mentioned below.

Step 1: Change the 5 minute interval to 1 minute for the odisrv agent:

1) Start oidadmin (Oracle Directory Manager) and logon to the OID infrastructure as orcladmin

2) Navigate to Entry Management-> cn=OracleContext ->
cn=Products
-> cn=Directory Integration Platform -> cn=Provisioning ->
cn=Profiles
-> orclODIPProfileName= XXXXXX

3) Change the value if 'orclodipprofileschedule' from 300 to 60 (seconds)

4) Press 'Apply' to save the change

5) Restart the IAS infrastructure to activate the change

Step 2: Change the OidCredentialManagerAgent interval:

Login to Application Server Enterprise Manager console, navigate to “CONTENT” -> Server Configurations -> OidCredentialManagerAgentConfiguration

1) Set the IFS.SERVER.TIMER.ActivationPeriod from default 15m to 1m

2) Restart the Content Services domain to activate the change

This should allow new users to provision within 5 minutes after they are created in OID.

How to enable on-demand provisioning in Content Services?

After users have been created in Oracle Internet Directory, they are automatically provisioned in Oracle Content Services every 15 minutes by the Oracle Internet Directory Credential Manager Agent.

You can change the default provisioning time period by changing the IFS.SERVER.TIMER.ActivationPeriod parameter of the Oracle Internet Directory Credential Manager Agent. You can choose a time period anywhere from 5 minutes to 24 hours.

Additionally, after a user has been created in Oracle Internet Directory, signing on to Oracle Content Services as that user will immediately provision the user in Oracle Content Services, regardless of the time interval specified for the Agent. This feature, known as on-demand provisioning, can be enabled or disabled through the IFS.DOMAIN.CREDENTIALMANAGER.AutoUserProvisioningEnabled domain property.

Where do i find the log file of Content Services Application?

All the content services exceptions are available in the application.log in

$ORACLE_HOME/j2ee/OC4J_Content/application-deployments/content/OC4J_Content_default_island_1/application.log

Oracle Workspaces exceptions are captured in the log file whose location is as mentioned below.

$ORACLE_HOME/j2ee/OC4J_OCSClient/application-deployments/workspaces/OC4J_OCSClient_default_island_1/application.log

Oracle Content Services Administrator Roles

Security Administrators

• Can modify Site and Container access role
  
• Manage the access roles of Libraries, folders, and files within the Container
  
• Can assign administrative roles to any user in the Site
  

Content Administrators

• Has access to all content in the Site
  
• can unlock files locked by any user
  
• can rename and delete Libraries
  
• can restore deleted files from the Archive
  

Container Administrators

• Can create and delete Containers
  

Category Administrators

• Define a hierarchy of categories and subcategories (Users can categorize files by applying categories to them in the File Properties window)
  
• Can add or remove attributes for all categories
  

Library Administrators

• Can create and delete Libraries, but they cannot change the configuration settings of the Library after it has been created
  
• Can move Libraries if they have Container Administrator privileges in the target Site or Container
  

Records Administrator

• Creates, modifies, and deletes file plans
  
• Can change content that has been declared a record back to regular content
  

Quota Administrator

• Manages the quota of allocated disk space for Libraries throughout the Site or Container
  

User Administrator

• Adds and removes members to a content services group
  
• Assigns a group member the Group Manager role
  
• Creates and deletes groups
  

How to enable Data Aging in Content Services?

To enable data aging, navigate to the Content Services Domain Properties window. Set the

two properties

IFS.DOMAIN.BFILE.Enabled &

IFS.DOMAIN.BFILE.AgingEnabled to true. 

For the change to take effect, the domain must be restarted.

There are two settings for BFILE storage management:

1. The base path for the BFILE storage must be set. This is the directory off which the folders containing the BFILEs will be created. It can be an absolute path, or by prefixing it with ./ it will be a path relative to the database’s Oracle home directory.The default is named after the Content Services datastore schema name, ./ifsbfiles/CONTENT.
2. The BFILE policy determines whether to remove the file physically from disk if the document is deleted from within Content Services (this is the default) or whether it should remain available as operating system files after deletion.

Then configure the Content Agent. This is the process that will manage the migration of data between BLOBs and BFILEs, transparently as necessary.

• IFS.SERVER.AGENT.CONTENTAGENT.ContentToBfileManager: The Java class that implements data aging and should not be modified
  
• IFS.SERVER.AGENT.CONTENTAGENT.MaxFilesPerFolder: The maximum number of files to be written for every path created for BFILE storage. This should be adjusted according to optimal values for the file system and hardware of the node running the database.
  
• IFS.SERVER.AGENT.CONTENTAGENT.MaxFoldersPerActivationPeriod: The maximum number of folders (or directory paths) that may be created by each run of the agent
  
• IFS.SERVER.AGENT.CONTENTAGENT.RetentionPeriod: The period for which a file will be kept within the database, unaccessed, as a BLOB before migration to a BFILE. The default of 180 days may be excessive for many sites.
  

To start the Content Agent automatically, from the Content Services home page take the Node Configurations link. Select the node on which you want to run the agent to reach the node’s home page. All the possible agents are listed, but the Content Agent is not started initially by default; select it, and check the Initially Started check box.

What is Data Aging?

Content Services uses the BLOB architecture but also makes use of an extension of the principle: the use of the BFILE data type. The data is stored in operating system files external to the database. As far as programmers are concerned, a BFILE column is just another column, but the database administrator and the system administrator know that they are actually independent files stored in the database server’s file system.This gives the administrator the freedom to store the BFILE data on any devices, even within tape libraries or on optical devices that would normally be unusable for an Oracle database.

Use of BFILEs gives you the ability to migrate a large part of the data stored within Content Services to comparatively low-cost and high-volume devices. A multi-terabyte Content Services datastore might be uneconomical to maintain on high-speed disks, but if the actual data (not the indexing information) could be migrated to tape, it becomes feasible. Clearly, a sophisticated tape management system is necessary.

For example, the ADSM (Adstar Distributed Storage Manager) tape library software from IBM can migrate files to tape if they have not been accessed for a certain period of time, while leaving them visible in the file system’s directory; they are transferred back from tape to disk on demand.

What is Oracle Records Management?

All organizations have a need to store records: data usually in the form of a file that must be available to certain users for a certain time frame, with certain access restrictions.Oracle Records Management is an application shipped with Content Services that some sites may decide to implement to manage their records.

There may be policies that may cover retention periods, disposition actions, record freezes,and record searches. There are integration points for use of BPEL (Business Process Execution Language) applications, and also hardware retention policies. The hardware integration is either to Network Appliance SnapLock devices or to EMC Centera devices.

How is content services superior to other Content Management Systems?

The Content Services application component is a file server, but much of its superiority over conventional file servers stems from the fact that the data is not stored as files on disk, but as rows in a database. When a user accesses a file that is stored in Content Services, he is not reading or writing the server’s disk system: he is executing select,insert, update, and delete commands against a database.

The default method for storing Content Services data is as BLOBs. The release 10g database used for Oracle Collaboration Suite 10g can theoretically store terabyte-size BLOBs. There is therefore no effective limit to the size of the documents that can be stored within Content Services.

This technique enhances performance substantially, because the pattern of access to BLOB data tends to be very different to the pattern of access to other columns. 

Consider a simple example of uploading all your music CDs into a database. Once you have identified the CD of interest, there will be a continuous read of 600MB as it is downloaded.

The Oracle BLOB data type lets the database administrator separate the one logical table

into two physical segments; one segment contains the small columns, the other contains the BLOB column. Each segment can be configured appropriately for its typical access and stored on devices optimized for this.

What protocols do Content Services support?

The FTP and FTPS protocol server node should be usable by any client with the appropriate client tools. The problem with FTP is that it transmits passwords unencrypted. If the Content Services FTP protocol server were to prompt for and validate the users’ Oracle Internet Directory Single Sign-On passwords, the whole security structure would be blown apart; a malicious user could monitor the network traffic, intercept a user’s username and password as transmitted with an FTP connection request, and then use them to access the user’s complete Oracle Collaboration Suite environment, and indeed any other Single Sign-On–enabled applications.

This is a problem with the FTP protocol. To counter this, before a user can connect to an FTP protocol server, he must create a separate FTP password. It is this password, not his Single Sign-On password that he must provide when using FTP with Content Services. The FTP password is stored within the Oracle Internet Directory and has no other purpose.

The WebDAV protocol, layered on top of HTTP, lets users lock documents when they download them. It is also possible to enable versioning, so that saving the document back to the server will create a new version while retaining the previous version. This functionality is not available with FTP. To use WebDAV, users need an appropriate client.Probably the most commonly used WebDAV-capable client is Windows XP Explorer, through the My Network Places desktop icon.

Where does the content services stores its data in Metadata Repository?

The Content Services data is stored by default in the schema CONTENT, with two other schemas whose names are derived from this, CONTENT$CM and CONTENT$ID, that are used for integration purposes.

It is possible to use just the one database for all these purposes, but such an arrangement would only be suitable for a relatively small-scale installation. In most circumstances, the schema will be in a database created specially for this purpose and tuned accordingly.

If a single database instance can’t provide adequate response times, RAC can take the scalability to whatever is required. It is however not possible to spread one domain’s data across multiple databases.

There are several tablespaces used for storing Content Services data:

1. CONTENT_IFS_MAIN: This stores the tables that hold metadata-describing documents
   
2. CONTENT_IFS_LOB_N: This stores the BLOB (binary large object) columns that hold the actual documents for non-indexed documents.
   
3. CONTENT_IFS_LOB_I: This stores the BLOB columns that hold the actual documents for indexed documents.
   
4. CONTENT_IFS_CTX_I, CONTENT_IFS_CTX_K, CONTENT_IFS_CTX_X: These tablespaces store the indexing data used by Search