4 Using Oracle Ultra Search with Oracle Application Server

Oracle Ultra Search Backend with Oracle Application Server

Oracle Ultra Search backend is installed as part of an Oracle Database Server installation. Oracle Application Server middle tier uses the Oracle Ultra Search backend. The Oracle Application Server Metadata Repository resides on the Oracle Database.

The Oracle Ultra Search release depends on the Oracle Database Server release. If the OracleAS Metadata Repository resides on Oracle Database 10g release 1 (10.1), then you have Oracle Ultra Search 10g release 1 (10.1). If the OracleAS Metadata Repository resides on Oracle9i Database Server release 2 (9.2), the you have the Oracle Ultra Search release that shipped with the database.

If Oracle Ultra Search was not installed during the database installation, then an error will occur when creating OracleAS Metadata Repository on top of the database. Install Oracle Ultra Search using the Oracle Universal Installer.

http://www.oracle.com/technology/documentation/

Oracle Ultra Search Middle Tier with Oracle Application Server

Oracle Ultra Search middle tier is part of the Oracle Application Server installation. You must choose the OracleAS Portal and Wireless option from the Oracle Universal Installer menu to install and configure the Oracle Ultra Search middle tier during the Oracle Application Server installation.

Configuring Oracle Ultra Search in a Hosted Environment (Optional)

Oracle Ultra Search is configured to be non-hosted during the default installation. To change to a hosted environment, perform the following steps:

In a hosted environment, one enterprise, such as an application service provider, makes Oracle Ultra Search available to other enterprises and stores information for them. The enterprise performing the hosting is called the default subscriber, and the enterprises that are hosted are called subscribers.

1. Make sure the hosting mode is enabled.

2. Make sure you have execute permission on the usca.sh script, and setup the ORACLE_HOME environment variable. The Oracle Internet Directory user must have the iASAdmins privilege.

3. For each subscriber, run the usca script to configure Oracle Ultra Search in the Oracle Internet Directory subscriber context.

   • For UNIX:

     ORACLE_HOME/ultrasearch/setup/usca.sh -action add_subscriber \
     -user OID_user_DN -password orcladmin_password -subscriber subscriber_DN
     
     

   • For Windows:

     ORACLE_HOME\ultrasearch\setup\usca.bat -action add_subscriber \
     -user OID_user_DN -password orcladmin_password -subscriber subscriber_DN
     
     

   The script does the following:

   • Creates the reference objects in the subscriber context.

   • Creates default privilege group entry in the subscriber context.

   • Updates the subscriber information in the Oracle Ultra Search metadata repository.

   The following example illustrates how to configure Oracle Ultra Search in the subscriber dc=us, dc=oracle, dc=com:

   ORACLE_HOME/ultrasearch/setup/usca.sh -action add_subscriber -user
     'cn=orcladmin' -password welcome1 -subscriber 'dc=us,dc=oracle,dc=com'
   
   

ORACLE_HOME/ultrasearch/setup/usca.sh -action remove_subscriber \
    -user OID_user_DN -password orcladmin_password -subscriber \
    subscriber_DN

Oracle Ultra Search Administrator Privilege Model in the Hosted Environment

The default subscriber and its search base are specified in the attributes of the Oracle Internet Directory cn=Common,cn=Products,cn=OracleContext entry:

• orclDefaultSubscriber

• orclSubscriberSearchBase

In a non-hosted environment, in which there are no subscribers, the enterprise installing Oracle Ultra Search is the default subscriber. All Oracle Ultra Search administration groups (super-user and instance administrator groups) are created under Default Subscriber Oracle Context, such as cn=OracleContext, dc=us,dc=oracle,dc=com in the Oracle Internet Directory Information Tree.

Figure 4-1 shows an example of the Oracle Internet Directory topology of a hosted environment. There are two subscribers (A and B) and the default subscriber. Each subscriber has its own super-user privilege group associated with it. There are four Oracle Ultra Search instances created in the Oracle Ultra Search backend Install 1. Instance 1 is associated with the default subscriber. Instance 2 and Instance 3 are associated with Subscriber A. Instance 4 is associated with Subscriber B. Each Oracle Ultra Search instance has its instance administration group associated with it.

Figure 4-1 Oracle Internet Directory Topology of a Hosted Environment

Description of the illustration isrch011.gif

Administration Privilege Model

This section describes the administrator privilege model of Oracle Ultra Search administration tool in the hosted environment. The model applies to both the Oracle Application Server Single Sign-On login mode and the non-single sign-on login mode.

In single sign-on mode, only single sign-on users can log in to the administration tool. Single sign-on users have different privileges depending on the user belonging to the default subscriber or another subscriber. If the single sign-on user belongs to the default subscriber, then the following apply:

• If the single sign-on user has the super-user privilege, then the user can administer all Oracle Ultra Search instances across the default subscriber and any other subscribers (for example, Instances 1, 2, 3, and 4).

• If the single sign-on user has the admin privilege on a particular Oracle Ultra Search instance (for example, Instance 1) within the default subscriber, then the user can administer the instance (Instance 1) that is associated with the default subscriber.

If the single sign-on user belongs to a particular subscriber, then the following apply:

• If the single sign-on user has the super-user privilege, then the user can only administer only Oracle Ultra Search instances within the subscriber. For example, if the user from Subscriber A has the super-user privilege, then the user can only administer Instance 2 and 3.

• If the single sign-on user has the admin privilege on a particular Oracle Ultra Search instance (for example, Instance 2), then the user can administer the instance (Instance 2) that is associated with the subscriber (Subscriber A).

In non-single sign-on mode, only database users can log in to the administration tool.

• If the login database user has the super-user privilege, then the user can administer all Oracle Ultra Search instances across the default subscriber and any other subscribers.

• If the login database user only has the admin privilege on a particular Oracle Ultra Search instance, then the user can administer the instance regardless of whether the instance is associated with the default subscriber or any other subscribers.

Privileges to Create and Drop an Oracle Ultra Search Instance

To create or drop an Oracle Ultra Search instance, the user must have the super-user privilege.

In single sign-on mode, the following apply:

• If the login single sign-on user belongs to the default subscriber, then the user can create or drop an instance and associate the instance with any subscriber, including the default subscriber.

• If the login single sign-on user belongs to particular subscriber, then an instance created by the user is associated with the subscriber. Because the user might not have access to create the instance schema in the database, the user must inform the hosting company (default subscriber) to create the database schema for the instance.

In non-single sign-on mode, the database user can create or drop an instance and associate the instance with any subscriber, including the default subscriber.

Privileges to Grant or Revoke a Super-user

To grant or revoke a super-user, log in to the administration tool as a super-user.

In single sign-on mode, the following apply:

• If the login single sign-on user belongs to the default subscriber, then the user can do the following:

  • Grant or revoke the super-user privilege to single sign-on users in the default subscriber.

  • Grant or revoke the super-user privilege to single sign-on users in another subscriber.

• If the login single sign-on user belongs to a particular subscriber, then the user can grant or revoke the super-user privilege to users with the same subscriber.

In non-single sign-on mode, only super-users can grant or revoke the super-user privilege to and from other database users.

Privileges to Grant or Revoke an Instance Administrator

To grant or revoke an instance administrator, log in to the admin tool as a super-user or an instance administrator.

In single sign-on mode, the following apply:

• The login single sign-on user can grant or revoke only the instance admin privilege to single sign-on users within the same subscriber. For example, the user can grant the admin privilege on Instance 2 or Instance 3 to a single sign-on user in Subscriber A.

• The login single sign-on user cannot grant or revoke the instance admin privilege to single sign-on users within a different subscriber. For example, the user cannot grant the admin privilege on Instance 2 or Instance 3 to a single sign-on user in Subscriber B.

In non-single sign-on mode, only super-users or instance administrators can grant or revoke the instance admin privilege to and from other database users.