J Setting Up and Maintaining a Virtual Private Portal

J.1.1 Why Use Hosting?

Consider an Application Service Provider (ASP), Acme, that wants to provide portal services for its customers. Acme wants to give its customers the flexibility to build and customize cost-effective and secure portals. They want customers to create and manage their own users, information, and portal pages securely.

Dedicated portal or database instances for each customer would provide the security they require. Traditionally, implementing fully isolated portal environments for multiple organizations within a company required a dedicated database instance for each organization. This proved expensive in terms of hardware and manpower resources, especially when the number of organizations was large. Manpower and hardware costs fast increased as their customer base grew. A single shared instance is obviously more manageable, but will not provide the level of isolation required to host multiple organizations securely.

A single instance is cheaper and easier to manage, but a traditional portal solution requires complex security rules to be written into the application. What Acme needs is the best of both worlds. VPP provides a platform for ASPs a more manageable way for large Enterprise IT departments to host departmental intranet or extranet portal sites. Oracle Application Server Portal introduces a more cost-effective and manageable solution for hosting multiple organizations and provides the benefits of a shared instance model with complete security. When using VPP you are required to add subscribers. A Subscriber is a company that signs up with an ASP (Application Service Provider) and receives a stripe on a hosted Oracle Application Server Portal.

J.1.2 Known Limitations

Although a shared instance model has many benefits, there are several things to consider before implementing a VPP environment.

Hosted technology will completely isolate each subscriber or identity realm. The VPP will prompt each user to enter their company ID and name, or set a particular context before portal retrieves any content. The scope of the content and data is limited to the subscriber's context. The portal is secured at the subscriber level and does not allow sharing of any data between one subscriber and another. Sharing of data is not allowed for security reasons. For example, VPP should not be used if Company A and Company B need to share documents.

Making repetitive changes to all subscribers is also more complex. From an administrative perspective, user interface manipulation of the portal must be done for each subscriber.

J.2.1 Enabling Hosting

• Enable hosting on OracleAS Portal and the OracleAS Single Sign-On (SSO) server.

• Create a basic structure on Oracle Internet Directory for ASP user/group support.

J.2.2 Setting Up Users and Groups

• Set up the virtual private portal with a support and administration infrastructure and users. The ASP uses these to administer the virtual private portal on behalf of their customers.

J.2.3 Adding Subscribers

• Create a new subscriber stripe in the OracleAS Portal and SSO schemas. This step includes copying objects like page groups, pages, portlet and providers information so that the default environment and pages can be pre-defined.

• Create a new Oracle Internet Directory subscriber tree, and establish required portal entries in Oracle Internet Directory (for example, seeded groups, users, and privileges).

• Copy ASP groups/users for the new subscriber in Oracle Internet Directory (for example, creating mirror entries, assigning privileges, and so on).

J.2.4 Removing Subscribers

• Remove a subscriber's data in OracleAS Portal and SSO schema.

• Delete the whole subscriber sub tree in Oracle Internet Directory.

J.2.5 Advanced Features

• WebDAV enables you to use a URL address as a transparent read and write medium where content can be checked out, edited, and checked in.

• Oracle Ultra Search provides uniform search-and-locate capabilities over multiple repositories, such as Oracle Databases, IMAP servers, Web pages, disk files, and portal page groups.

J.2.6 Pre-Installation Checklist

Before running the scripts to enable virtual private portals, first gather the information to run them. Table J-1 lists and describes the parameters.

J.2.7 Using Oracle Directory Manager

To begin the process, use the Oracle Directory Manager (ODM). The ODM is a GUI tool to help you administer Oracle Internet Directory. To obtain the passwords for portal and orasso users:

1. Launch the Oracle Directory Manager.

   • In the first field, provide the Oracle Internet Directory bind DN (parameter –d). By default, it is cn=orcladmin. This DN must have Oracle Internet Directory admin privilege, for example, privilege to create new subscribers.

   • In the second field, provide the password for Oracle Internet Directory bind DN (parameter –w). By default, it is welcome1.

   • In the third field, select your Oracle Internet Directory instance. If you have not defined your Oracle Internet Directory instance, click the icon to right of the field and give the server host name (parameter –h) and port number (parameter –p) that Oracle Internet Directory is running on. By default, the port is 389 or 4032.

2. Once you have logged into Oracle Internet Directory, navigate through the menu tree. Entry Management > cn=OracleContext > cn=Products > cn=IAS.

   Cn=IAS Infrastructure Databases > orclReferenceName=name of Oracle Internet Directory database.

3. Continue to navigate the tree.

4. Click the orasso user name.

5. In the right pane, find the section called orclpasswordattribute. This is the password for the orasso user (parameter –sw).

6. Click the portal user name.

7. In the right pane, there is a section called orclpasswordattribute. This is the password for the portal user (parameter –pw).

J.4.1 Setting Up ASP Users and Groups

The master entry for ASP Users and groups resides under the default subscriber. Because these users and groups will have additional access (not all users in the default subscriber can log in to all subscribers) you must set up ASP users/groups explicitly.

When you enabled hosting on your portal, the script creates a group called ASP under the default subscriber's Oracle Internet Directory sub-tree, which is a placeholder for ASP user/group support. You need this to set up ASP users/groups. From now on, this placeholder group will be referred to as the ASP group. Let's look at some examples where Acme could use ASP users and groups:

• Alice needs to manage user accounts for all subscribers.

• Bob and Joe need to manage pages for all subscribers.

• Tom needs to log in to all subscribers but only have normal authenticated user privileges.

To accomplish this, do the following:

• Create users asp_alice, asp_bob, asp_joe and asp_tom in default subscriber.

• Create group asp_UserAdm in default subscriber and assign it privileges to manage user accounts; and also create group asp_PageAdm in default subscriber and assign it privileges to manage pages.

• Add asp_alice as member of asp_UserAdm group.

• Add asp_bob and asp_joe as members of asp_PageAdm group.

• Add asp_UserAdm and asp_PageAdm as members of the ASP group.

• Add user asp_tom as member of the ASP group.

Now you have set up ASP users and groups. The Oracle Internet Directory tree looks like Figure J-3:

Figure J-3 Oracle Internet Directory Tree with Users and Groups

Description of "Figure J-3 Oracle Internet Directory Tree with Users and Groups"

More precisely, ASP users/groups are defined as follows:

• ASP groups are either the ASP group itself or its direct group members.

• ASP users that are a direct user member of any ASP group.

Figure J-4 Membership Structure of Acme Users and Groups

Description of "Figure J-4 Membership Structure of Acme Users and Groups"

By default, the portal bootstrap users are members of the ASP group, which means that they are by default ASP users. For more information on portal bootstrap users portal, portal_admin, and orcladmin, see the Oracle Application Server Administrator's Guide and the Oracle Application Server Portal User's Guide.

When you add a new subscriber, the portal Add Subscriber script automatically creates mirror entries for those ASP users/groups in the new subscriber. Then those users can login and have the corresponding privileges.

J.4.2 Restrictions

There are some restrictions on ASP users/groups set up:

• ASP users and groups can be no more than two levels deep. That is, groups that are not direct members of the ASP group or users that are not direct members of any ASP groups are ignored during mirror entry creation.

• Oracle Internet Directory mandates that user names must be unique (case insensitive) within each subscriber, including those of ASP users. For example, you cannot have two users in subscriber CompanyA called Bob or bob. Because ASP users have mirror entries in every subscriber, use special names for ASP users to prevent user name collisions. This is reflected throughout this document with names such as asp_bob, asp_joe, and the like.

• For similar reasons, use special names for ASP groups, for example, asp_PageAdmin, asp_UserAdmin, and the like. Because hosting scripts handle ASP groups dynamically, do not make a portal seeded group into an ASP group. If you need an ASP group with similar privileges, create a new group and make it a member of the seeded group.

• Manage nondefault subscribers' ASP users and groups only with hosting scripts. Do not manually modify those users, or groups, or both.

• The ASP group is only a placeholder for all ASP users and groups, and is not designed for privilege purposes. Do not assign privileges to the ASP group. Those privileges are not propagated to other subscribers.

J.6.1 Managing ASP Users and Groups

After you have set up all the subscribers, there could be several types of changes to the ASP users/groups structure. For example:

• Bob changed his password in default subscriber, and you must synchronize the new password in all other subscribers.

• Joe left Acme and should no longer be able to login as an ASP user.

• The service contract changed and the ASP is no longer responsible for user account problems. So, the asp_UserAdm group is no longer needed.

• When ASP users/groups are changed in the default subscriber, you must use a provided script to synchronize the changes in all other subscribers.

The synchronization script has three options:

• Password Sync

• Delta (Structure Changes) Sync

• Complete Sync

> cd ORACLE_HOME/portal/admin/plsql/wwhost

>./syncasp.csh -pc portaldb.acme.com:1521:portaldb -ps portal -pw ky8T5sr3 -h oid.acme.com -p 389 -d "cn=orcladmin" -w welcome1 -mode pwd -u asp_bob

> cd ORACLE_HOME/portal/admin/plsql/wwhost

>./syncasp.csh -pc portaldb.acme.com:1521:portaldb -ps portal -pw ky8T5sr3 -h oid.acme.com -p 389 -d "cn=orcladmin" -w welcome1 -mode dif

> cd ORACLE_HOME/portal/admin/plsql/wwhost

>./syncasp.csh -pc portaldb.acme.com:1521:portaldb -ps portal -pw ky8T5sr3 -h oid.acme.com -p 389 -d "cn=orcladmin" -w welcome1 -mode all

J.6.2 Removing Subscribers

If a subscriber in a portal is no longer needed, or errors occurred during the subscriber creation, you can permanently remove a subscriber using a provided script. The script does the following:

• Removes the subscriber's data in OracleAS Portal and SSO schema.

• Deletes the whole subscriber sub tree in Oracle Internet Directory.

For example, to remove a subscriber called nowhere, type the following command at the UNIX command line. However, once you remove a subscriber, there is no way to restore it except from any backups taken of the Oracle Database on which the virtual private portal instance has been installed.

> cd ORACLE_HOME/portal/admin/plsql/wwhost

>./rmsub.csh -name nowhere -pc portaldb.acme.com:1521:portaldb -pp change_on_
install -ps portal -sc portaldb.acme.com:1521:portaldb -sp change_on_install -ss
 orasso –a portal.portaldb.portaldb.acme.com -h oid.acme.com -p 389 -d
 "cn=orcladmin" -w welcome1 -cs 1000

See Section J.8, "Parameters for the Scripts" for an explanation of parameters.

J.6.3 Using WebDAV in the Virtual Private Portal

WebDAV is a protocol that supports distributed authoring and versioning. With WebDAV the Internet becomes a transparent read and write medium where content can be checked out, edited, and checked in to a URL address. For details about how WebDAV works with OracleAS Portal and how to set up WebDAV, see Oracle Application Server Portal User's Guide.

Setting up WebDAV in a virtual private portal is the same as setting up WebDAV in an out-of-the-box portal.

Connecting to WebDAV in a virtual private portal is similar to that in an out-of-the-box portal. The only difference is that, when connecting to WebDAV in a virtual private portal, you use:

"<username>@<subscriber_name>" as the username, instead of just ...
"<username>" as required in an out-of-the-box portal.

For example, to connect to WebDAV using user Joe in subscriber CompanyA, use joe@CompanyA as the user name and Joe's password as the password.

When different subscribers use the same URL for WebDAV connection, the client side operating system may cache the connection. For example, if you connected to WebDAV using user portal_admin@acme on a Windows 2000 PC, you may not be able to connect to WebDAV in subscriber CompanyA as user joe@CompanyA because of the operating system cache. For details about how to clear an operating system cache and stored user name and password, see your operating system documents.

J.6.4 Using Oracle Ultra Search with the Virtual Private Portal

Oracle Ultra Search provides uniform search-and-locate capabilities over multiple repositories (Oracle Databases, IMAP servers, Web pages, disk files, and portal page groups). To use Oracle Ultra Search in a virtual private portal, do the following:

• Set up branded URL for different subscribers.

• Enable hosting on your Oracle Ultra Search instance.

To enable hosting on your Oracle Ultra Search instance, run the following commands in the UNIX command line:

> cd ORACLE_HOME/ultrasearch/admin
> sqlplus /nolog @wk0host.sql [schema_name] [schema_password] [connect_string] E

where:

[schema_name] - Oracle Ultra Search schema name

[schema_password] - Oracle Ultra Search schema password

[connect_string] - Database connect string of your Oracle Ultra Search instance

E – Enables hosting for an Oracle Ultra Search instance

Currently, Oracle Ultra Search does not support ASP users/groups.

J.6.5 Setting Up Directory Integration Platform for the Virtual Private Portal

The Directory Integration Platform is a comprehensive framework that performs synchronization between various directories and directory-enabled applications. One of the services it provides is Provisioning Integration, which can send notifications about directory events to Directory Enabled Applications.

In an out-of-the-box OracleAS Portal installation, the Directory Integration Platform is enabled. If you have disabled Directory Integration Platform for a virtual private portal, do the following to reenable Directory Integration Platform:

1. Run the provided script that enables Directory Integration Platform on existing subscribers.

   For example, for UNIX:

   enbldip.csh -pc portaldb.acme.com:1521:portaldb -pp change_on_install -ps portal -h oid.acme.com -p 389 -d "cn=orcladmin" -w welcome -enable
   
   

2. Uncomment the calls to oidprovtool in the addsub.csh and rmsub.csh, so that those two scripts take care of Directory Integration Platform profile entries when you add/remove subscribers.

   To do this:

   1. Open the two files in your editor.

   2. Search for lines with the oidprovtool string.

   3. Uncomment those lines.

Also, you can do the following to disable Directory Integration Platform on all subscribers in your portal:

1. Run the provided script in at the UNIX command line as follows:

   enbldip.csh -pc portaldb.acme.com:1521:portaldb -pp change_on_install -ps portal -h oid.acme.com -p 389 -d "cn=orcladmin" -w welcome -disable
   
   

2. Comment out the calls to oidprovtool in addsub.csh and rmsub.csh, so that those two scripts ignore Directory Integration Platform profile entries when you add or remove subscribers.

   To do this:

   1. Open the two files in your editor.

   2. Search for lines with oidprovtool.

   3. Comment these lines out.

J.6.6 Partially Prepare (Pre-Cook) Subscribers

Creating a new subscriber by running the addsub.csh script can take a few minutes based on how the computer where OracleAS Portal, Oracle Internet Directory, and OracleAS Single Sign-On are installed is configured. Along with the data operations that occur when a new subscriber is created, most ASPs have some administrative provisioning and subscriber-specific customizations that they perform when a subscriber is created.

To expedite subscriber registration, the virtual private portal allows ASPs to partially prepare the subscribers. This is done so that when an ASP is registered, the subscriber need only perform post registration customizations and directly assign a virtual private portal stripe to that subscriber. The virtual private portal provides a database-only mode in the addsub.csh script where the data copying is performed on the portal and SSO databases. When the ASP is ready to assign a stripe to a subscriber, it can complete the subscriber creation by running the addsub.csh script using the LDAP mode.

To partially prepare a subscriber in portal and SSO databases, use the -type parameter in addsub.csh. For example, type the following at the UNIX command line:

> cd ORACLE_HOME/portal/admin/plsql/wwhost
>./addsub.csh -name TEMP_COMPANY -id 1003 -type db -pc
 portaldb.acme.com:1521:portaldb -pp change_on_install -ps portal -pw ky8T5sr3 -sc
 portaldb.acme.com:1521:portaldb -sp change_on_install -ss orasso -sw hA6fHjE2 -h
 oid.acme.com -p 389 -d "cn=orcladmin" -w welcome1 -rc "cn=OracleContext" -sd acme

You can use a temporary name for company name, like (TEMP_COMPANY) as used in the preceding example. Later, when a customer (example, CompanyC) comes, you can run the following command at the UNIX command line:

> cd ORACLE_HOME/portal/admin/plsql/wwhost
>./addsub.csh -name CompanyC -id 1003 -type ldap -pc
 portaldb.acme.com:1521:portaldb -pp change_on_install -ps portal -pw ky8T5sr3 -sc
 portaldb.acme.com:1521:portaldb -sp change_on_install -ss orasso -sw hA6fHjE2 -a
 portal.portaldb.portaldb.acme.com -h oid.acme.com -p 389 -d "cn=orcladmin" -w
 welcome1 -rc "cn=OracleContext" -sd acme -tp ORACLE_HOME/ldap/schema/oid/

You must use the same subscriber ID when you partially prepare the subscriber, and give the real name of your customer (CompanyC). The new name will replace the old name (TEMP_COMPANY in the preceding example). The script will create an Oracle Internet Directory subscriber tree for CompanyC and synchronize the Oracle Internet Directory settings to portal schema, which takes less time than creating the subscriber from scratch.

You do have to partially prepare (using -type db option) the subscriber before you can use run addsub.csh with -type ldap option.

OracleAS Portal Middle-Tier Installation on the Virtual Private Portal

Follow the steps in Chapter 3, "Installing OracleAS Portal" to run the OracleAS Portal middle-tier installation. Then, you have to use the ptlconfig tool to reconfigure your OracleAS Portal middle-tier settings. See Appendix A, "Using the Portal Dependency Settings Tool and File" for details about using the ptlconfig tool.

The OracleAS Portal middle-tier installation can be run against a virtual private portal.

J.7.1 Scripts

The virtual private portal configuration and provisioning scripts currently only run on a UNIX C-shell environment.

J.7.2 ASP Users/Groups Support

• The top level ASP group must not have any Oracle Internet Directory privileges assigned to it. Privileges are not copies or synchronized across subscribers. Privileges of the sub-groups of the ASP group are synchronized and copied.

• Any modifications to the ASP user and group structure in Oracle Internet Directory that are performed on any other subscriber other than the default subscriber are not preserved when the subscriber synchronization scripts are run.

• Portal seeded groups should not be designated as ASP groups.

J.7.3 Add Subscriber

Names of new subscribers must be unique within Oracle Internet Directory.

J.7.4 Remove Subscriber

This script cannot be used to remove the default subscriber. To do that, use the Portal Dependency Settings Tool, ptlconfig. See Section A.1, "Portal Dependency Settings Tool" for details about using the ptlconfig tool.

J.7.5 Upgrade

When performing an upgrade from OracleAS Portal release 9.0.2.x to 9.0.4.x, the Oracle Text indexes need to be re-created. See Section 8.3.4.1, "Creating All Oracle Text Indexes Using ctxcrind.sql" for information on running the ctxcrind.sql script to re-create all the Oracle Text indexes.