How to configure Indirect Password using Enterprise Manager Data Source?

In production environments, while configuring datasources in OC4J using Enterprise Manager, the credential password should not be exposed as clear text. To secure it, there is an option called "Use Indirect Password" while configuring datasources in Oracle SOA Suite 10.1.3.1.

Step 1:

As shown above, provide the "Indirect Password" such as "PwdForORABPEL" & save the data source. This updates the following file

ORACLE_HOME\j2ee\OC4J_HOME\config\data-sources.xml

Step 2:

Provide the actual Indirect Password in ORACLE_HOME\j2ee\OC4J_HOME\config\system-jazn-data.xml

Step 3:

Restart the OC4J. This encrypts the password like the one as shown below

What is a BPEL Worklist Application & How to customize the Worklist Application?

The Oracle BPEL Worklist Application (Worklist Application) is a Web interface that enables users to act on their assigned human workflow tasks.

Accessing the Worklist Application in Local Languages

Using the sample worklist configured with the user community in the JAZN XML file, you can set the user's preferred language and time zone in the demo-users-properties.xml file as follows:

<timeZone>America/Los_Angeles</timeZone> <languagePreference>en_US</languagePreference>

The demo-users-properties.xml file is found in Oracle_Home\bpel\system\services\config

When a user opens a browser and logs in to the Worklist Application, the worklist screens are rendered in the browser's locale and time zone. Most strings in the Worklist Application come from the worklist application bundle. By default, this is the class
oracle.bpel.services.workflow.resource.WorkflowResourceBundle

Customizing the Worklist Application

I. Worklist Application Architecture 

The Worklist Application follows the standard model-view-controller approach.

i. A request coming from the browser is handled by a servlet. The servlet validates the request and calls the appropriate workflow service client API to query or update data.

ii. The worklist client APIs support a variety of different protocols (local and remote EJBs, direct java invocation, SOAP) for invoking the underlying workflow service.

iii. After the API call, the servlet stores the data required for rendering the next page in the session. The JSP picks up the data from the session, renders the data, and removes it from the session.

iv. The servlets are responsible for making the back-end API calls and the JSPs are responsible for formatting the data.

The Worklist Application servlets are at

$ORACLE_HOME/j2ee/oc4j_soa/applications/hw_services/worklistapp/src/worklistapp/servlets

All servlets extend the class worklistapp.servlets.BaseServlet. This class implements common functionality required by all servlets, such as authentication.

The JSPs are at $ORACLE_HOME/j2ee/oc4j_soa/applications/hw_services/worklistapp/public_html

The workflow client API is a public interface made available by the workflow services. The

interface is at oracle.bpel.services.workflow.client.IWorkflowServiceClient

An instance of the API interface can be obtained by invoking the getWorkflowServiceClient

method on oracle.bpel.services.workflow.client.WorkflowServiceClientFactory

A typical page flow sequence is as follows

• The first time a user enters the login URL, the login servlet redirects the page to the login JSP that is sent to the browser.
• The user enters a username and password and the login servlet calls the authenticate method on the task query service.
• If successful, it redirects to the TaskList servlet URL.
• The browser's request then goes to the TaskList servlet that calls the queryTasks method on the task query service for getting the tasks that the user should see.
• Then it redirects the page to the TaskList JSP that is sent to the browser.
• When a user clicks a task link, the request is handled by the TaskDetails servlet.
• This calls the getTaskDetailsById method on the task query service and redirects the page to the TaskDetails JSP that is sent to the browser.

II. Changing the Client-Service Binding for the Worklist Application
The workflow services client interfaces can use a number of protocols to communicate with the workflow services. The client implementations encapsulate all the communication details,
and users of the client interfaces do not need to be concerned with the details.

The Worklist Application is deployed in the same container as the workflow services, by default, and the application uses the Java client.

To switch the client type used by the Worklist Application, modify the init method in BaseServlet.java as follows:

public void init(ServletConfig config) throws ServletException
{
super.init(config);
try
{
wfSvcClient = WorkflowServiceClientFactory.getWorkflowServiceClient(
WorkflowServiceClientFactory.JAVA_CLIENT);
}
catch (Exception e)
{
wlSvcError = getStackTraceString(e);
}
}
Also, change WorkflowServiceClientFactory.JAVA_CLIENT to one of the following:

• WorkflowServiceClientFactory.SOAP_CLIENT—to use the SOAP-based Web services interface
• WorkflowServiceClientFactory.LOCAL_CLIENT—to use the local EJB interface
• WorkflowServiceClientFactory.REMOTE_CLIENT—to use the remote EJB interface

In addition, ensure that the wf_client_config.xml file is correctly set up for the client type that you select.

How to configure BPEL Worklist Application to use Oracle Single Sign On Server?

Before starting with the below mentioned steps, make sure you have configured 10.1.3.x Mid-tier Instance to Use Oracle Single Sign On Server.

Step 1. Protect URL/Web Context Root (Statically)

Now, you can protect URLs with mod_osso by applying directives to the mod_osso.conf file.

This file is found at $ORACLE_HOME/Apache/Apache/conf.

<IfModule mod_osso.c> 

<Location /integration/worklistapp > 

AuthType Basic 

require valid-user 

</Location> 

</IfModule>

Step 2. Configure SSO Realm Information

Navigate to the following file.

$ORACLE_HOME/bpel/system/services/config/wf_client_config.xml Change jazn.com to the realm name in SSO.

<portal> 

<realmmapping>

your_realm

</realmmapping> 

</portal>

Step 3:Modification of Servlet Code under worklistapp

Step 3a:

Open the $ORACLE_HOME\j2ee\oc4j_soa\applications\hw_services\worklistapp\src\worklistapp\ser vlets\BaseServlet.java file.

Remove the following code fragment that begins on line 218 in the validateSession() method:

else 

{ // forward request to login page, if user session is null

//(not if session store or wfCtx is null, as login servlet will set them) 

if ( userSession == null ) 

{ 

RequestDispatcher rd = getServletContext().getRequestDispatcher(WorklistappConstants.PAGE_LOGIN_JSP); 

if (rd != null) 

{ 

rd.forward(request,response); 

return false; 

} 

} 

}

Step 3b:

Open the Login.java file in the same directory. Replace the code up to the end of the try{} block in the handleRequest() method with the following:

user = getParameter(request,WorklistappConstants.PARAM_LOGIN_USER); 

String password = getParameter(request,WorklistappConstants.PARAM_LOGIN_ PASSWORD);

String realm = getParameter(request,WorklistappConstants.PARAM_LOGIN_REALM); 

String redirectURL = getParameter(request,WorklistappConstants.PARAM_REDIRECT_ URL);

HttpSession userSession = request.getSession(true); 

SessionStore sessStore = new SessionStore(userSession); 

String remoteUser = request.getRemoteUser(); 

if ((user == null) && (password == null) && (remoteUser == null)) 

{ 

pageRedirect(request, response, WorklistappConstants.PAGE_LOGIN_JSP); 

return; 

} 

try 

{ 

IWorkflowContext wfCtx = null; 

if ( user != null ) 

{ //Authenticate the supplied credentials 

wfCtx = wfSvcClient.getTaskQueryService().authenticate(user, password, realm, null); 

}

else 

{ //Create context using remoteUser in request (pre-authenticated request)

wfCtx = wfSvcClient.getTaskQueryService().createContext(request); 

} 

initSessionAttributes(sessStore, wfCtx); 

initRequestStatus(sessStore); 

if (redirectURL != null) 

response.sendRedirect(redirectURL); 

else 

response.sendRedirect(WorklistappConstants.SERVLET_TASK_LIST); 

}

Step 3b:

After making the entry, restart the Mid-tier Instance: $ORACLE_HOME/opmn/bin/opmnctl stopall $ORACLE_HOME/opmn/bin/opmnctl startall

Now, when a user accesses the Worklist application from the mid-tier host like the one shown below, http://hostname: 7778/integration/worklistapp/TaskList, the default SSO page shows up & login as oc4jadmin (any valid OID user). It should login successfully & reach TaskList Homepage.

How to secure BPEL Admin using JAZN LDAP?

Step 1:

Create a user in OID using OIDDAS . For e.g “admin_user”.

Step 2:

Create the privilege group by name “AdminPrivGroup” in OID. Make this group available as a role in OID using OIDDAS

Step 3:

Add the user created in Step 1 to the role created in Step 2.

Step 4:

Login to the SOA Suite 10.1.3.1 Midtier & edit the following file

$ORACLE_HOME/j2ee/oc4j_soa/application-deployments/orabpel/admin/orion-web.xml

Add the following lines inside <orion-web-app>

<security-role-mapping name=" ConsolePrivGroupRole"> 

<group name=" AdminPrivGroup" /> 

</security-role-mapping>

Step 5:

Edit $ORACLE_HOME/j2ee/oc4j_soa/applications/orabpel/admin/WEB-INF/web.xml . Make the following changes, Add <auth-constraint> inside <security-constraint> as shown below

a) <security-constraint>

... 

<auth-constraint> 

<role-name> 

AdminPrivGroup

</role-name> 

</auth-constraint> 

</security-constraint>

b) Add <login-config> inside <web-app>

<login-config> 

<auth-method>

BASIC

</auth-method> 

<realm-name>

DEFAULT_REALM_NAME

</realm-name> 

</login-config>

c)Provide the <security-role> inside <web-app> as shown below

<security-role>

<description>

BPEL PM User

</description> 

<role-name> 

AdminPrivGroup

</role-name> 

</security-role>

How to secure BPEL Console using JAZN LDAP?

Step 1:

Create a user in OID using OIDDAS . For e.g “admin_user”.

Step 2:

Create the privilege group by name “ConsolePrivGroup” in OID. Make this group available as a role in OID using OIDDAS

Step 3:

Add the user created in Step 1 to the role created in Step 2.

Step 4:

Login to the SOA Suite 10.1.3.1 Midtier & edit the following file

$ORACLE_HOME/j2ee/oc4j_soa/application-deployments/orabpel/console/orionweb.xml

Add the following lines inside <orion-web-app>

<security-role-mapping name=" ConsolePrivGroupRole"> 

<group name=" ConsolePrivGroup" /> 

</security-role-mapping>

Step 5:

Edit $ORACLE_HOME/j2ee/oc4j_soa/applications/orabpel/console/WEB-INF/web.xml . Make the following changes, Add <auth-constraint> inside <security-constraint> as shown below

a) <security-constraint>

... 

<auth-constraint> 

<role-name> 

ConsolePrivGroup

</role-name> 

</auth-constraint> 

</security-constraint>

b) Add <login-config> inside <web-app>

<login-config> 

<auth-method>

BASIC

</auth-method> 

<realm-name>

DEFAULT_REALM_NAME

</realm-name> 

</login-config>

c)Provide the <security-role> inside <web-app> as shown below

<security-role>

<description>

BPEL PM User

</description> 

<role-name> 

ConsolePrivGroup

</role-name> 

</security-role>

How to invoke a BPEL Process from a Remote OC4J in SOA Suite?

Step 1:

Create a Shared Library in the Remote OC4J by name BPEL & add the following archives

$ORACLE_HOME/bpel/lib/ant_1.6.5.jar

$ORACLE_HOME/bpel/lib/bicmn.jar

$ORACLE_HOME/bpel/lib/bipres.jar

$ORACLE_HOME/bpel/lib/bpm-infra.jar

$ORACLE_HOME/bpel/lib/connector15.jar

$ORACLE_HOME/bpel/lib/orabpel.jar

$ORACLE_HOME/bpel/lib/orabpel-ant.jar

$ORACLE_HOME/bpel/lib/orabpel-common.jar

$ORACLE_HOME/bpel/lib/orabpel-exts.jar

$ORACLE_HOME/bpel/lib/orabpel-thirdparty.jar

$ORACLE_HOME/bpel/lib/oracle_http_client.jar

$ORACLE_HOME/bpel/registry/lib/builtin_serialization.jar

$ORACLE_HOME/bpel/registry/lib/core_services_client.jar

$ORACLE_HOME/bpel/registry/lib/jaxm.jar

$ORACLE_HOME/bpel/registry/lib/jaxrpc.jar

$ORACLE_HOME/bpel/registry/lib/saaj.jar

$ORACLE_HOME/bpel/registry/lib/uddiclient_api_v3.jar

$ORACLE_HOME/bpel/registry/lib/uddiclient_core.jar

$ORACLE_HOME/bpel/registry/lib/wasp.jar

$ORACLE_HOME/bpel/system/classes/

$ORACLE_HOME/bpel/system/services/config/

$ORACLE_HOME/bpel/system/services/lib/bpm-services.jar

$ORACLE_HOME/bpel/system/services/lib/fndctx.jar

$ORACLE_HOME/bpel/system/services/lib/phaos.jar

$ORACLE_HOME/bpel/system/services/lib/pushapi.jar

$ORACLE_HOME/bpel/system/services/lib/wdk.jar

$ORACLE_HOME/bpel/system/services/lib/wfapi.jar

$ORACLE_HOME/bpel/system/services/schema/

$ORACLE_HOME/integration/esb/lib/bpm-ide-common.jar

$ORACLE_HOME/integration/esb/lib/ide.jar

$ORACLE_HOME/integration/esb/lib/javatools.jar

$ORACLE_HOME/integration/esb/lib/oraesb.jar

$ORACLE_HOME/integration/esb/lib/xmleditor.jar

$ORACLE_HOME/jdk/lib/tools.jar

$ORACLE_HOME/jlib/javax-ssl-1_1.jar

$ORACLE_HOME/jlib/jewt4.jar

$ORACLE_HOME/jlib/jssl-1_1.jar

$ORACLE_HOME/jlib/ldapjclnt10.jar

$ORACLE_HOME/jlib/netcfg.jar

$ORACLE_HOME/jlib/regexp.jar

$ORACLE_HOME/jlib/share.jar

$ORACLE_HOME/jlib/uix2.jar

$ORACLE_HOME/rdbms/jlib/xdb.jar

$ORACLE_HOME/rules/lib/jr_dav.jar

$ORACLE_HOME/rules/lib/rl.jar

$ORACLE_HOME/rules/lib/rulesdk.jar

$ORACLE_HOME/rules/lib/webdavrc.jar

$ORACLE_HOME/webservices/lib/wsif.jar

See the diagram as shown below.

Step 2:

While creating a Location object while calling from JSP make sure the properties are passed with proper values. The below code snippet would be used for

Properties props = new java.util.Properties();

props.put("orabpel.platform", "ias_10g" );

props.put("java.naming.factory.initial",

"com.evermind.server.rmi.RMIInitialContextFactory" );

props.put("java.naming.provider.url",

"opmn:ormi://hostname:6004:oc4j_soa/orabpel" );

props.put("java.naming.security.principal", "oc4jadmin" );

props.put("java.naming.security.credentials", "welcome1" );

String securityCredentials = "bpel123";

String selectedDomain = "default";

Locator locator = new Locator(selectedDomain, securityCredentials, props);

Step 3:

Create the war file and deploy it in the new OC4J (OC4J_J2EE) as shown below. Provide the war file location on the disk.

Click on next. In the next screen provide the parent application as “default” and provide “Application Name” and “Context Root”.

Click next. Click on “Select Security Provider” link as shown below

Step 4:Provide Security Provider while deploying war file

In the “Security Provider” Drop down, select “Oracle Identity Management” as shown below

Press “OK” button.

Step 5: Configure Class Loading

Click on “Configure Class Loading” as shown below

As shown below, select the checkbox across “BPEL” (which has been created in Step 1) and “JSP_Runtime” and Press OK.

Now, deploy the application by pressing “Deploy” Button.

How to deploy Oracle BPEL Portlets?

This posting describes how to deploy the Oracle BPEL Portlets and configure the Oracle Application Server Portal (OracleAS Portal) to provide access to data from these portlets.

OracleAS Portal Introduction

OracleAS Portal is a component of Oracle Application Server used for the development,deployment, administration, and configuration of enterprise class portals. A portal page, can contain one or more components called portlets that can each get their content from different data sources.

Oracle Application Server Portal and BPEL Process Integration

You can configure OracleAS Portal to access the following portlets:

• Oracle BPEL Console reports portlets
  
• Oracle BPEL Worklist Application portlets
  

I. Deploy the BPEL Portlets with Oracle Enterprise Manager 10g Application Server Control Console

1) Login to the EM using ias_admin

2) Select the OC4J_SOA from the Name column of the System Components table.

3) Click the Applications tab & click Deploy EAR file

4) Enter the following details:

J2EE Application: Oracle_Home\integration\orabpel\system\services\lib\BPELPortlet.ear

Application Name:BPELPortlet

Parent Application:orabpel

5) Click Continue. The Deploy Application: URL Mapping for Web Modules window appears. Accept the default BPELPortlet for Oracle BPEL Process Manager value or enter a different name in the URL Mapping field. Click Next. The Deploy Application: User Manager window appears.

6) Select Use JAZN LDAP User Manager. The LDAP Location field displays the Oracle Internet Directory instance associated with the Oracle Application Server Infrastructure. Click Next. The Deploy Application: Review window appears.

7) Review a summary of the selections you made on previous windows:

The EAR file to deploy 

The deployment destination instance

The URL mapping for Web modules & click Deploy.

8) Messages display indicating that deployment is in progress. When complete, the following message appears:

Application "BPELPortlet" was successfully deployed.

II. Create the BPEL Provider in Oracle AS Portal

Create a new Provider by name BPEL Provider by logging in as Adminsitrator in Portal ->

Navigator -> Registered Providers.

In the connection settings, provide the deployed URL as 

http://hostname:portno/BPELPortlet/providers

Once the provider is properly configured, the BPEL portlets can be added to any portal page.