Customize Navigation Menu's Permissions to be Role Based

I think most of us knows how to Customize Oracle UCM 11g navigation menus, and if not take a look at other blog posts like this one from Kyle's blog: Modifying Navigation Menus in UCM 11g

But what if you want the navigation menus to be based on Custom security roles that you have created, unfortunately it is not available out of the box. In the following lines, I will explain how to do that:

- When created your menus, you have overridden a resource include called CoreMenuItemsFlags
For example:

<@dynamicdata CoreMenuItemsFlags@>
id, flags
FUNCTIONA, isAdmin
<@end@>

- Instead of using predefined permissions based on fixed roles like isAdmin, isLoggedIn, or isSysManager, we need to use permissions based on our custom roles also we need to write code once (I mean we will not change our custom code for every new role created).

- My approach is: if we have a new custom role called HR, then we will use a permission for the navigation menu called isUserInSpecificRoleBillingAuditorHR, so the resource include will be

<@dynamicdata CoreMenuItemsFlags@>
id, flags
FUNCTIONA, isUserInSpecificRoleBillingAuditorHR
<@end@>

- Now the real story comes
We will customize a resource include called navigation_filter_rset_menu_item where we will add an extra check for our prefix isUserInSpecificRoleBillingAuditor, and according to the Role added to the prefix we grant users access to the menu item

<$elseif flags like "*isUserInSpecificRole*"$>
<$if strIndexOf(flags, ':') == -1$>
<$userInRole = strSubstring(flags,20,strLength(flags))$>
<$else$>
<$part1 = strSubstring(flags,strIndexOf(flags,'isUserInSpecificRole')+20,strLength(flags))$>
<$if strIndexOf(part1, ':') == -1$>
<$userInRole = part1$>
<$else$>
<$userInRole = strSubstring(part1,0,strIndexOf(part1, ':'))$>
<$endif$>
<$endif$>
<$if not userHasRole(userInRole)$>
<$tmpDeleteRow = 1$>
<$endif$>

Note the extra check should be added after isContributor check

<$if flags like "*isContributor*"$>

Or you can read the resource include code and customize it as you want

. Oracle ranks as Leader in all content technology segments

Forrester Wave ranks Oracle as Leader in all content technology segments in their 2011 Q4 report.

However Forrester said "Oracle’s main weaknesses lie in its archiving and compound document publishing capabilities".

I think all of us agreed with that, where

• Oracle Document Capture needs a lot of improvements (for example index forms design, and localization).
• I am wondering why they offer IPM, we can do the same thing with UCM interface. 
• Also Ad-Hoc scanning (scanning from Checkin page) is a big requirement that all customers I worked with are asking for.

Here is the link to the report http://www.oracle.com/us/corporate/analystreports/infrastructure/forrester-wave-ecm-q4-2011-1352096.pdf

Displaying metadata field as checkbox

I think most of us knows how to Customize Oracle UCM 11g menus, and if not take a look at other blog posts like form this one from Kyle's blog: Modifying Navigation Menus in UCM 11g

But what if you want the menus to be based on Custom security roles that you have created, unfortunately it is not available out of the box. In the following lines, I will explain how to do that:

- When created your menus, you have overridden a resource include called CoreMenuItemsFlags
For example:

<@dynamicdata CoreMenuItemsFlags@>
id, flags
FUNCTIONA, isAdmin
<@end@>

- Instead of using predefined permissions based on fixed roles like isAdmin, isLoggedIn, or isSysManager, we need to use permissions based on our custom roles also we need to write code once (I mean we will not change our custom code for every new role created).

- My approach is: if we have a new custom role called HR, then we will use a permission for the menu called isUserInSpecificRoleBillingAuditorHR, so the resource include will be

<@dynamicdata CoreMenuItemsFlags@>
id, flags
FUNCTIONA, isUserInSpecificRoleBillingAuditorHR
<@end@>

- Now the real story comes
We will customize a resource include called navigation_filter_rset_menu_item where we will add an extra check for our prefix isUserInSpecificRoleBillingAuditor, and according to the Role added to the prefix we grant users access to the menu item

<$elseif flags like "*isUserInSpecificRole*"$>
<$if strIndexOf(flags, ':') == -1$>
<$userInRole = strSubstring(flags,20,strLength(flags))$>
<$else$>
<$part1 = strSubstring(flags,strIndexOf(flags,'isUserInSpecificRole')+20,strLength(flags))$>
<$if strIndexOf(part1, ':') == -1$>
<$userInRole = part1$>
<$else$>
<$userInRole = strSubstring(part1,0,strIndexOf(part1, ':'))$>
<$endif$>
<$endif$>
<$if not userHasRole(userInRole)$>
<$tmpDeleteRow = 1$>
<$endif$>

Note the extra check should be added after isContributor check

<$if flags like "*isContributor*"$>

Or you can read the resource include code and customize it as you want

Increase maximum number of folders and content per folder

Changing maximum content and folders per folder to be more than 1000 gives an error in UCM 11g.

It is not recommended to increase number of folders where user may got out of memory. The limitation comes from Java Runtime Environment. However sometimes you need to increase it a little.

The following steps explain how to increase it from 1000 to 2000.
- Browse to Oracle UCM configurations directory (for example /u01/oracle/ecm1/ucm)
- Then move to folders component configurations directory /cs/data/components/folders
- You will find a file called config.cfg
- Change the following parameters
MaxContent=2000
MaxFolders=2000
- Restart UCM and test

Modify UCM Workflow History

If you want to generate reports on Workflow, you may noticed two tables in UCM schema called DocumentHistory and WorkflowHistory. Both of them audits and saves all actions  done.

But those tables have few fields, notice DocumentHistory table

What if we want to add new fields to to the history, why? because I want to track changes on some custom fields and report them, another example if I want to track updates done on metadata fields using "Update" action.

Good news UCM is great, we can add our custom fields to the table (simply by modifying table structure), like adding xComments

At the end we can overwrite UCM query that inserts to the table actions' history. So we will modify IdocHistory, as the following

<tr> <td>IdocHistory</td> <td>INSERT INTO DocumentHistory (dActionMillis, dActionDate, dID, dRevClassID, dUser, dDocName, dAction, dSecurityGroup, xComments) values(?, ?, ?, ?, ?, ?, ?, ?, ?)</td> <td>dActionMillis int dActionDate date dID int dRevClassID int dUser varchar dDocName varchar dAction varchar dSecurityGroup varchar xComments varchar</td> </tr>

Senior Oracle ECM Consultants required for ME

I have several openings for Oracle ECM consultants, the openings are with a couple of companies. The required resources should have good experience with Oracle ECM for three years at least, and preferable to be based on Saudi Arabia (Having Visa there is a big plus), Jordan, Egypt, and Kuwait.

Send to me you resume, so that I will forward it to the companies. My email is hisham.galal.eldin@gmail.com (note most likely I am not the interviewer, I am just broker :) ).

If you are talented fresh graduate (I mean you have done something interesting) either your experience in ECM or other FMW products, send your resume too you are most welcomed.

Modify Workflow Popup

Recently I got requirement to modify workflow popup menu according to certain conditions

The following explains how simply to do that:

• Go to the following directory <middleware_home>/Oracle_ECM1/ucm/idc/resources/core/idoc
• In that directory, we have two interesting files that contains most of resource includes that we desire to customize std_page.idoc & std_workflow.idoc
• As per our requirement of customizing Workflow related feature so our target will be std_workflow.idoc, inside it you will find an include called setup_workflow_action_popups
• I will assume you will be able to create a new component, and add a resource file to it, then inside that resource file copy and past the include setup_workflow_action_popups from std_workflow.idoc as is.
• Now lets take a look at the include

You will find there repeating parts in the include everyone is representing an item in the popup menu.

<$exec rsAppendNewRow("PopupProps")$>

<$exec setValue("PopupProps", "label", lc(""))$>

<$exec setValue("PopupProps", "function", "")$>
<$exec setValue("PopupProps", "ifClause", "")$>

<$exec setValue("PopupProps", "class", "workflow")$>

<$exec setValue("PopupProps", "id", "")$>

id: unique i for the popup menu item

class: will be always workflow

function: either a link location or javascript calls. The link may be composited by idoc script

label: localized display label for the popup menu item

ifClause: Which is the amazing feature, it is the condition for displaying the menu item and it can be something like dDocType like 'Correspondence' and of course you can make use of the existing conditions like AllowReview & AllowCheckin 

Here is an example of a new item I added

<$exec rsAppendNewRow("PopupProps")$>

<$exec setValue("PopupProps", "label", lc("wwUpdateAndApprove"))$>

<$exec setValue("PopupProps", "function", "<$HttpCgiPath$&>IdcService=GET_UPDATE_FORM&dDocType=Correspondence&dID=<$dID$>&dDocName=<$url(dDocName)$>&idcToken=<$idcToken$>")$>

<$exec setValue("PopupProps", "ifClause", "dDocType like 'Correspondence'")$>

<$exec setValue("PopupProps", "class", "workflow")$>

<$exec setValue("PopupProps", "id", "workflowUpdateAndApprove")$>

The two resource file std_page.idoc & std_workflow.idoc will make you very powerful, don't miss them and don't give up until you find your needs.

Solved password reset for UCM 11g

Today I returned to the password reset issue in UCM 11g, and I solved it by creating a custom component. Just less than 27 line of code solved it !!! till now I wonder why Oracle missed that.

Anyway I want to share it with you in case you faced the same problem and you were looking for a solution.

I will assume you know how to create a custom service, and in case if you don't know refer to The Definitive Guide to Stellent Oracle Content Server for Bex Huff.

1- Create a custom component using Component Wizard

2- Create a java class and make this class extends UserService

3- Add the following method to the class

public void resetPassword() throws Exception {
      Hashtable env = new Hashtable();
      env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
      env.put(Context.PROVIDER_URL, "ldap://localhost:7001/dc=my_domain");
      env.put(Context.SECURITY_AUTHENTICATION, "simple");
      env.put(Context.SECURITY_PRINCIPAL, "cn=Admin");
      env.put(Context.SECURITY_CREDENTIALS, "weblogic1");
      DirContext ctx = new InitialDirContext(env);
      ModificationItem[] mods = new ModificationItem[1];
      Attribute mod0 = new BasicAttribute("userpassword", m_binder.getLocal("dPassword"));
      mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, mod0);
      ctx.modifyAttributes("uid=sysadmin,ou=people,ou=myrealm", mods);
}

3- Modify the existing service EDIT_USER_PROFILE (by the Component Wizard)
-Change service class to the newly created class by you (don't forget package name)
-Then add new action which is of type java method and refers to our newly created method resetPassword
-Order actions so that resetPassword be before storeUserDatabaseProfileData

At the end restart and test. One last thing from inside weblogic administration console, you need to change embedded ldap credential and be sure it is configured correctly.

UCM users cannot reset their passwords!!!

I had an issue that I was trying to avoid, until I worked in a project that needs it. I cannot imagine how Oracle guys missed it, USERS CANNOT RESET THEIR PASSWORDS.

I don't care about how the new UCM has been structured, Users must have the ability to change their passwords. Guys most of the time LDAPS are only used as a repository (it is database) and users are not accessing them, that's beside a lot of customers doesn't have LDAP to work with or integration is not part of the scope.

Do you think this is a minor issue or not an issue at all?

At the end I want to thank Raj from Oracle support for his support.

Active Directory Notes

I was working on integration on Active Directory with Oracle UCM 11g and I have the following notes that may be helpful:

- Change DefaultAuthenticator's Control Flag from REQUIRED to SUFFICIENT

- We are not using Oracle UCM LDAP Providers for integration with Active Directory anymore

- Users mapping between Oracle UCM and Weblogic embedded LDAP is done using JpsUserProvider provider

- In Oracle UCM 11g, you can give default roles and accounts for authenticated users, to do that from Oracle UCM Providers page edit a provider called JpsUserProvider and in Default Network Roles field add the default roles separated with commas, for default accounts use Default Network Accounts field

- Any weblogic ldap user assigned to administrators group, he will have Oracle UCM admin role

Removing Subscribe and Unsubscribe from DOC_INFO template

Someone called Anonymous :D has commented from days on one of my posts asking me how to remove subscribe and unsubscribe menu items.

To do that will need to modify a resource include called docinfo_menus_setup.

Simply follow these steps if you are not familiar with Oracle UCM ComponentsWizard utility
- Open ComponentWizard utility
- Add new component, choose a name you want
- Add new Resource of type HTML Include/String 
- Inside in the new resource file, select an existing resource include called docinfo_menus_setup
- Do your modifications on the code inside the chosen include, enable the component, and restart the server.

I hope it is helpful for you Anonymous
.

Collections in UCM 11g

I have noticed that Collections/Folders in UCM 11g release had some changes. One of them is using randomly auto-generated IDs for folders, even for Contribution Folders. I know some guys did integrations using collections database table, which will cause some issues for them. For example if they are depending on using IDs on your development environment then you moved to production, for sure IDs will be totally different.

So how to retrieve Folders under Contribution Folders, without depending on IDs, the answer is using COLLECTION_DISPLAY service with the following parameters:

<$dCollectionPath="/Contribution Folders/"$>
<$hasCollectionPath=1$>
<$executeService("COLLECTION_DISPLAY")$>

Notice hasCollectionPath took value equal 1 which means true in IdocScript.

Adding profiles to COLLECTION_DISPLAY template

I have a requirement to allow users to check-in files inside folders according to a chosen profile, this will not be done from WebDAV it will be from the UCM Web Interface.

So in this case we need to customize with COLLECTION_DISPLAY template or resources used inside it.

After investigations I found that I need to customize the two resources collection_explore_menus, and new_content_form

For example I created a new profile called Processes, and I want to add it as a link under New Content link. In the first resource collection_explore_menus we will add the following at the end of the resource

FOLDER_EXPL_NEW_CONTENT_Processes,  FOLDER_EXPL_NEW_ITEM,     70,        wwArchiveProcesses,    javascript:document.newcontentformProcesses.submit(),

Where

id            = FOLDER_EXPL_NEW_CONTENT_Processes

parentId  = FOLDER_EXPL_NEW_ITEM

labelKey = wwArchiveProcesses

href        = javascript:document.newcontentformProcesses.submit()

Then as you noticed we are firing Submit action for a HTML form called newcontentformProcesses which has to be created by us and here comes the role of the next resource new_content_form, so will add the following to the resource and after the first HRML form there

<form action="<$HttpCgiPath$>" method="GET" name="newcontentformProcesses">

<input name="IdcService" type="hidden" value="CHECKIN_NEW_FORM" />
<input name="<$collectionIDMeta$>" type="hidden" value="<$dCollectionID$>" />
<input name="xIdcProfile" type="hidden" value="wwArchiveProcesses" />

</form>

Notice the hidden field xIdcProfile which is the profile trigger metadata field.

I hope this post will be helpful

Oracle Universal Content Management Handbook

A new book about Oracle UCM has been published by Packt, I have been asked by Packt to review this book. I found this book is very interesting especially if you are new to UCM or you didn't get the chance to review all UCM capabilities. I used to give UCM trainings with Oracle, I can admit that reading this book will give the same knowledge you may get from trainings.

But I was wishing that this book will cover Oracle UCM 11g, where it covers UCM 10g, however almost all information in that book can be applied to 11g too.

.

IRM Blog

I was searching for any available resources about IRM, and I discovered that there is an official Oracle blog for IRM http://blogs.oracle.com/irm/

How to move Vault and Weblayout Directories???

Most of the time you want the vault and weblayout folders to exist in a storage server (for example on SAN storage). You can do that during installation of UCM, where you will be asked for the location of the Vault and Weblayout directories, but if you forgot to do that, no problem you can change the location of the two directories.

In the following lines, I will tell you how to change the location of the two directories:

First I will suppose that we have a shared directory on the file server in which we will move the vault and weblayout directories, let us suppose the shared directory named "\\stellent-share\"

1. Stop the content server
2. Stop the webserver
   
3. Move Vault and Weblayout directories to "\\stellent-share\"
4. Edit the following configuration files
   /bin/intradoc.cfg
   /admin/bin/intradoc.cfg
   and add the following entries
   VaultDir=d:/vault/
   WeblayoutDir=d:/weblayout/
   
5. In the currently used Web Server, change the location of the weblayout in the website settings
   
   Note: You need to create a mapped drive the new location of the weblayout directory (with win, use PUSHD command), which will be used with Web server settings
   
   If for example I mapped "//stellent-share/weblayout" to "Z:", in Apache the configurations will be
   
   
6. Restart the web server
7. Restart the content server

Don't forget you can do the

UCM Workshop in Nigeria

I am late in posting this photo for attendees of Oracle UCM Workshop in Nigeria and me, that is because I received it from a week and I was busy. I'd like to thank Rasaq Hanafi for sending that photo, he is not in this photo, but he was one of the attendees and I think he is one of the most active attendees in the workshop.

Site Studio 10gR4 tutorial

I am currently in the process of building Site Studio 10gR4 tutorial. I will try to help by giving you exact steps for building a complete website using most of Site Studio features. Actually I like the materials that I am using during my trainings for oracle partners which is based on Oracle University materials, and I will try to simulate them.

Views & Resultsets

If you have a view and you want to use it within your code, I mean that you want to loop on the view data to display that data, - using IdocScript- you can get a resultset from that view, then loop on that resultset to display its data.

As an example for how to do that, let us assume that we have a view called view1

<$getViewValuesResultSet("view1", "", "")$>
<$loop SchemaData$>
<option><$dOption$></option>
<$endloop$>

PopUpCalendar component

I was creating a custom checkin page using IdocScript, and in that template I had a metadata field of type date. So I discovered that I need a pop-up calendar, where the user will not care about formating dates.

In Content Server, I found that there are a component called PopUpCalendar which adds pop-up calendars to checkin and search pages. So I said, I should use the same calendar object to give to my custom checkin page the same look and feel.

Note: This component is taken fromYahoo Developer Network, you can find there a lot of useful javascript objects, and part of the content server scripts are taken from there.

So to use that component in your template, do the following

1- If you will use it for custom checkin template, add the following include
<$include std_checkin_html_head_declarations$>

2- If you will use it for custom search template, add the following include
<$include std_query_html_head_declarations$>

3- Now I will assume that we have a metadata field called xPublishDate and we want to have a popup calendar for that field

<input id="xPublishDate" name="xPublishDate" size="20" maxlength="30" value="" type="text" READONLY>
<a href="javascript:pucToggleCalendar('xPublishDate')" style="vertical-align: middle;">
<img style="cursor: pointer; vertical-align: middle;" src="<$HttpWebRoot$>images/PopUpCalendar/calendar.png" border="0" width="20" height="19">
</a>
<script type="text/javascript">
pucCreateCalendar({ id: "xPublishDate", caption: "Publish Date"}, "xPublishDate");
</script>
<div id="puc_panel_xPublishDate_div" style="display: none;">
<div class="hd">Publish Date</div>
<div class="bd">
<div id="puc_calendar_xPublishDate_div"></div>
</div>
</div>