Customize Navigation Menu's Permissions to be Role Based

I think most of us knows how to Customize Oracle UCM 11g navigation menus, and if not take a look at other blog posts like this one from Kyle's blog: Modifying Navigation Menus in UCM 11g

But what if you want the navigation menus to be based on Custom security roles that you have created, unfortunately it is not available out of the box. In the following lines, I will explain how to do that:

- When created your menus, you have overridden a resource include called CoreMenuItemsFlags
For example:

<@dynamicdata CoreMenuItemsFlags@>
id, flags
FUNCTIONA, isAdmin
<@end@>

- Instead of using predefined permissions based on fixed roles like isAdmin, isLoggedIn, or isSysManager, we need to use permissions based on our custom roles also we need to write code once (I mean we will not change our custom code for every new role created).

- My approach is: if we have a new custom role called HR, then we will use a permission for the navigation menu called isUserInSpecificRoleBillingAuditorHR, so the resource include will be

<@dynamicdata CoreMenuItemsFlags@>
id, flags
FUNCTIONA, isUserInSpecificRoleBillingAuditorHR
<@end@>

- Now the real story comes
We will customize a resource include called navigation_filter_rset_menu_item where we will add an extra check for our prefix isUserInSpecificRoleBillingAuditor, and according to the Role added to the prefix we grant users access to the menu item

<$elseif flags like "*isUserInSpecificRole*"$>
<$if strIndexOf(flags, ':') == -1$>
<$userInRole = strSubstring(flags,20,strLength(flags))$>
<$else$>
<$part1 = strSubstring(flags,strIndexOf(flags,'isUserInSpecificRole')+20,strLength(flags))$>
<$if strIndexOf(part1, ':') == -1$>
<$userInRole = part1$>
<$else$>
<$userInRole = strSubstring(part1,0,strIndexOf(part1, ':'))$>
<$endif$>
<$endif$>
<$if not userHasRole(userInRole)$>
<$tmpDeleteRow = 1$>
<$endif$>

Note the extra check should be added after isContributor check

<$if flags like "*isContributor*"$>

Or you can read the resource include code and customize it as you want

. Oracle ranks as Leader in all content technology segments

Forrester Wave ranks Oracle as Leader in all content technology segments in their 2011 Q4 report.

However Forrester said "Oracle’s main weaknesses lie in its archiving and compound document publishing capabilities".

I think all of us agreed with that, where

• Oracle Document Capture needs a lot of improvements (for example index forms design, and localization).
• I am wondering why they offer IPM, we can do the same thing with UCM interface. 
• Also Ad-Hoc scanning (scanning from Checkin page) is a big requirement that all customers I worked with are asking for.

Here is the link to the report http://www.oracle.com/us/corporate/analystreports/infrastructure/forrester-wave-ecm-q4-2011-1352096.pdf

Displaying metadata field as checkbox

I think most of us knows how to Customize Oracle UCM 11g menus, and if not take a look at other blog posts like form this one from Kyle's blog: Modifying Navigation Menus in UCM 11g

But what if you want the menus to be based on Custom security roles that you have created, unfortunately it is not available out of the box. In the following lines, I will explain how to do that:

- When created your menus, you have overridden a resource include called CoreMenuItemsFlags
For example:

<@dynamicdata CoreMenuItemsFlags@>
id, flags
FUNCTIONA, isAdmin
<@end@>

- Instead of using predefined permissions based on fixed roles like isAdmin, isLoggedIn, or isSysManager, we need to use permissions based on our custom roles also we need to write code once (I mean we will not change our custom code for every new role created).

- My approach is: if we have a new custom role called HR, then we will use a permission for the menu called isUserInSpecificRoleBillingAuditorHR, so the resource include will be

<@dynamicdata CoreMenuItemsFlags@>
id, flags
FUNCTIONA, isUserInSpecificRoleBillingAuditorHR
<@end@>

- Now the real story comes
We will customize a resource include called navigation_filter_rset_menu_item where we will add an extra check for our prefix isUserInSpecificRoleBillingAuditor, and according to the Role added to the prefix we grant users access to the menu item

<$elseif flags like "*isUserInSpecificRole*"$>
<$if strIndexOf(flags, ':') == -1$>
<$userInRole = strSubstring(flags,20,strLength(flags))$>
<$else$>
<$part1 = strSubstring(flags,strIndexOf(flags,'isUserInSpecificRole')+20,strLength(flags))$>
<$if strIndexOf(part1, ':') == -1$>
<$userInRole = part1$>
<$else$>
<$userInRole = strSubstring(part1,0,strIndexOf(part1, ':'))$>
<$endif$>
<$endif$>
<$if not userHasRole(userInRole)$>
<$tmpDeleteRow = 1$>
<$endif$>

Note the extra check should be added after isContributor check

<$if flags like "*isContributor*"$>

Or you can read the resource include code and customize it as you want

Increase maximum number of folders and content per folder

Changing maximum content and folders per folder to be more than 1000 gives an error in UCM 11g.

It is not recommended to increase number of folders where user may got out of memory. The limitation comes from Java Runtime Environment. However sometimes you need to increase it a little.

The following steps explain how to increase it from 1000 to 2000.
- Browse to Oracle UCM configurations directory (for example /u01/oracle/ecm1/ucm)
- Then move to folders component configurations directory /cs/data/components/folders
- You will find a file called config.cfg
- Change the following parameters
MaxContent=2000
MaxFolders=2000
- Restart UCM and test

Modify UCM Workflow History

If you want to generate reports on Workflow, you may noticed two tables in UCM schema called DocumentHistory and WorkflowHistory. Both of them audits and saves all actions  done.

But those tables have few fields, notice DocumentHistory table

What if we want to add new fields to to the history, why? because I want to track changes on some custom fields and report them, another example if I want to track updates done on metadata fields using "Update" action.

Good news UCM is great, we can add our custom fields to the table (simply by modifying table structure), like adding xComments

At the end we can overwrite UCM query that inserts to the table actions' history. So we will modify IdocHistory, as the following

<tr> <td>IdocHistory</td> <td>INSERT INTO DocumentHistory (dActionMillis, dActionDate, dID, dRevClassID, dUser, dDocName, dAction, dSecurityGroup, xComments) values(?, ?, ?, ?, ?, ?, ?, ?, ?)</td> <td>dActionMillis int dActionDate date dID int dRevClassID int dUser varchar dDocName varchar dAction varchar dSecurityGroup varchar xComments varchar</td> </tr>

Senior Oracle ECM Consultants required for ME

I have several openings for Oracle ECM consultants, the openings are with a couple of companies. The required resources should have good experience with Oracle ECM for three years at least, and preferable to be based on Saudi Arabia (Having Visa there is a big plus), Jordan, Egypt, and Kuwait.

Send to me you resume, so that I will forward it to the companies. My email is hisham.galal.eldin@gmail.com (note most likely I am not the interviewer, I am just broker :) ).

If you are talented fresh graduate (I mean you have done something interesting) either your experience in ECM or other FMW products, send your resume too you are most welcomed.

Solved password reset for UCM 11g

Today I returned to the password reset issue in UCM 11g, and I solved it by creating a custom component. Just less than 27 line of code solved it !!! till now I wonder why Oracle missed that.

Anyway I want to share it with you in case you faced the same problem and you were looking for a solution.

I will assume you know how to create a custom service, and in case if you don't know refer to The Definitive Guide to Stellent Oracle Content Server for Bex Huff.

1- Create a custom component using Component Wizard

2- Create a java class and make this class extends UserService

3- Add the following method to the class

public void resetPassword() throws Exception {
      Hashtable env = new Hashtable();
      env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
      env.put(Context.PROVIDER_URL, "ldap://localhost:7001/dc=my_domain");
      env.put(Context.SECURITY_AUTHENTICATION, "simple");
      env.put(Context.SECURITY_PRINCIPAL, "cn=Admin");
      env.put(Context.SECURITY_CREDENTIALS, "weblogic1");
      DirContext ctx = new InitialDirContext(env);
      ModificationItem[] mods = new ModificationItem[1];
      Attribute mod0 = new BasicAttribute("userpassword", m_binder.getLocal("dPassword"));
      mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, mod0);
      ctx.modifyAttributes("uid=sysadmin,ou=people,ou=myrealm", mods);
}

3- Modify the existing service EDIT_USER_PROFILE (by the Component Wizard)
-Change service class to the newly created class by you (don't forget package name)
-Then add new action which is of type java method and refers to our newly created method resetPassword
-Order actions so that resetPassword be before storeUserDatabaseProfileData

At the end restart and test. One last thing from inside weblogic administration console, you need to change embedded ldap credential and be sure it is configured correctly.

UCM users cannot reset their passwords!!!

I had an issue that I was trying to avoid, until I worked in a project that needs it. I cannot imagine how Oracle guys missed it, USERS CANNOT RESET THEIR PASSWORDS.

I don't care about how the new UCM has been structured, Users must have the ability to change their passwords. Guys most of the time LDAPS are only used as a repository (it is database) and users are not accessing them, that's beside a lot of customers doesn't have LDAP to work with or integration is not part of the scope.

Do you think this is a minor issue or not an issue at all?

At the end I want to thank Raj from Oracle support for his support.

Google Web Toolkit with UCM

Started development using Google Web Toolkit which in my opinion will be one of the major development tools for enterprise applications.

Let me explain from Oracle UCM point of view, in UCM services can be consumed using JSON that's by adding IsJson=1 at end of the URL, even if you created custom services you can consume them using JSON too. Now using GWT you can build your vertical solution which calls UCM services and display results and takes actions. In that way you will gain great benefits, like concentrating on user interface, build easy to use application, and lightweight too which will attract customers.

I recommend you to take a look and consider it seriously as another point of view for development.

Active Directory Notes

I was working on integration on Active Directory with Oracle UCM 11g and I have the following notes that may be helpful:

- Change DefaultAuthenticator's Control Flag from REQUIRED to SUFFICIENT

- We are not using Oracle UCM LDAP Providers for integration with Active Directory anymore

- Users mapping between Oracle UCM and Weblogic embedded LDAP is done using JpsUserProvider provider

- In Oracle UCM 11g, you can give default roles and accounts for authenticated users, to do that from Oracle UCM Providers page edit a provider called JpsUserProvider and in Default Network Roles field add the default roles separated with commas, for default accounts use Default Network Accounts field

- Any weblogic ldap user assigned to administrators group, he will have Oracle UCM admin role

Starting Weblogic Admin Server and Node Manager as background service

The following steps explains how to start Weblogic Node Manager and Admin Server automatically with Linux OS (Redhat in my case):

- Create boot.properties file under

/user_projects/domains/my_domain/servers/AdminServer/security

- Add to the file the following entries

username=weblogic
password=welcome1

- Create a file called wlsndm under

/etc/init.d

- Add to the file the following

#!/bin/bash
#
# wlsndm startup script for node manager
#
# chkconfig: - 74 15
# description: weblogic
# processname: WLSNDM

# Source function library
. /etc/rc.d/init.d/functions

start() {
echo -n $"Starting $prog: "
nohup su - oracle -c /wlserver_10.3/server/bin/startNodeManager.sh > /wlserver_10.3/server/bin/wlsnd.log &
echo "OK"
}

case "$1" in
start)
start
;;
*)
echo $"Usage: $prog {start}"
exit 1
esac

exit 1

- Create a file called wlsadmin under

/etc/init.d

- Add to the file the following

#!/bin/bash
#
# wlsadmin startup script for node manager
#
# chkconfig: - 75 15
# description: weblogic
# processname: WLSADMIN

# Source function library
. /etc/rc.d/init.d/functions

start() {
echo -n $"Starting $prog: "
nohup su - oracle -c /user_projects/domains/my_domain/bin/startWebLogic.sh > /user_projects/domains/my_domain/servers/AdminServer/logs/wlsa.log &
echo "OK"
}

case "$1" in
start)
start
;;
*)
echo $"Usage: $prog {start}"
exit 1
esac

exit 1

- Create the following symbolic links under /etc/rc5.d/

ln -s /etc/init.d/wlsndm S74NodeManager
ln -s /etc/init.d/wlsadmin S75Weblogic

- then Create background services

chkconfig --add wlsadmin
chkconfig --add wlsndm

- Activate the created background services

chkconfig wlsadmin on
chkconfig wlsndm on

Now we have finished creation of background service, and you can start UCM or any other Managed Server from Admin Server Console. Using the same approach you can start UCM automatically.

Using UCM11g Logout With Site Studio

As most of us remember in Oracle UCM 10g, logout was not there by default. In UCM 11g Oracle has added logout to be there by default.

Also it is noticed there is new Service (LOGOUT) added to UCM 11g for logout and that service make use of redirect template.

What if you want to secure parts of a website designed by Site Studio using Oracle UCM security (may be it is intranet and you want to add security to HR section). Definitely UCM security will be used on a section and/or a layout, however you will need to add logout, and you want logout to redirect you to some page like home page or login screen.

To do that create your logout link like below

<a style="text-decoration:none " href='/cs/idcplg?IdcService=LOGOUT&RedirectUrl=%2Fmywebsite%2Findex.htm'>Logout</a>

Removing Subscribe and Unsubscribe from DOC_INFO template

Someone called Anonymous :D has commented from days on one of my posts asking me how to remove subscribe and unsubscribe menu items.

To do that will need to modify a resource include called docinfo_menus_setup.

Simply follow these steps if you are not familiar with Oracle UCM ComponentsWizard utility
- Open ComponentWizard utility
- Add new component, choose a name you want
- Add new Resource of type HTML Include/String 
- Inside in the new resource file, select an existing resource include called docinfo_menus_setup
- Do your modifications on the code inside the chosen include, enable the component, and restart the server.

I hope it is helpful for you Anonymous
.

Oracle UCM Benchmarking

Oracle says "The 11g version of UCM was enhanced to enable exceptional performance even when dealing with extremely large volumes of content, including ingestion rates of over one hundred million content items per day."

I have found a white paper from Oracle which can give us a sample benchmark for Oracle UCM, which is helpful for us in expecting UCM performance:

Those results are based on a physical machine with specification 2 CPU 2.33 GHz Xeon®, 16 GB RAM, and as we know processing power is matters and affecting both of performance and license cost.

Collections in UCM 11g

I have noticed that Collections/Folders in UCM 11g release had some changes. One of them is using randomly auto-generated IDs for folders, even for Contribution Folders. I know some guys did integrations using collections database table, which will cause some issues for them. For example if they are depending on using IDs on your development environment then you moved to production, for sure IDs will be totally different.

So how to retrieve Folders under Contribution Folders, without depending on IDs, the answer is using COLLECTION_DISPLAY service with the following parameters:

<$dCollectionPath="/Contribution Folders/"$>
<$hasCollectionPath=1$>
<$executeService("COLLECTION_DISPLAY")$>

Notice hasCollectionPath took value equal 1 which means true in IdocScript.

Adding profiles to COLLECTION_DISPLAY template

I have a requirement to allow users to check-in files inside folders according to a chosen profile, this will not be done from WebDAV it will be from the UCM Web Interface.

So in this case we need to customize with COLLECTION_DISPLAY template or resources used inside it.

After investigations I found that I need to customize the two resources collection_explore_menus, and new_content_form

For example I created a new profile called Processes, and I want to add it as a link under New Content link. In the first resource collection_explore_menus we will add the following at the end of the resource

FOLDER_EXPL_NEW_CONTENT_Processes,  FOLDER_EXPL_NEW_ITEM,     70,        wwArchiveProcesses,    javascript:document.newcontentformProcesses.submit(),

Where

id            = FOLDER_EXPL_NEW_CONTENT_Processes

parentId  = FOLDER_EXPL_NEW_ITEM

labelKey = wwArchiveProcesses

href        = javascript:document.newcontentformProcesses.submit()

Then as you noticed we are firing Submit action for a HTML form called newcontentformProcesses which has to be created by us and here comes the role of the next resource new_content_form, so will add the following to the resource and after the first HRML form there

<form action="<$HttpCgiPath$>" method="GET" name="newcontentformProcesses">

<input name="IdcService" type="hidden" value="CHECKIN_NEW_FORM" />
<input name="<$collectionIDMeta$>" type="hidden" value="<$dCollectionID$>" />
<input name="xIdcProfile" type="hidden" value="wwArchiveProcesses" />

</form>

Notice the hidden field xIdcProfile which is the profile trigger metadata field.

I hope this post will be helpful

Oracle BPM Suite 11g: New Book

Packt has asked me to review this book, I have just downloaded it and I will start reading it tomorrow. However one of friends told me that the book is good and it covers SOA too.

It worth to mention that BPM is an important part of Middleware which facilitates building of business processes by business users, and those processes are SOA based. I didn't use it yet, after reviewing the book I will come with an example of how to use BPM and UCM together.

I wish Packt will change their books' titles to "Hands On" :D which became very helpful to start with Oracle Middleware solutions in short time.

Oracle UCM 11g clustered (continued)

I forgot to mention two things about clustering in my previous post.

- After creating a domain on the first physical machine, and you want to transfer the configuration to the other physical machine, do the following:

On the first machine

$ cd /u01/oracle/middleware/user_projects/domains/
$ ../../wlserver_10.3/common/bin/pack.sh -managed=true -domain=my_domain -template=my_domain.jar template_name="my_domain"
$ scp my_domain.jar oracle@node2.mydomain.com:/u01/oracle/middleware/user_projects/domains

on the second machine

$ cd /u01/oracle/middleware/user_projects/domains/
$ ../../wlserver_10.3/common/bin/unpack.sh -domain=my_domain -template=my_domain.jar

Note, when configuring weblogic machine on linux,  it is better to use Unix Machine (you can accept the defualts)

- Now you have UCM clustered on two machines, so what about load balancing? you have several options like using another weblogic instance to do load balancing, but in my case I used apache HTTP server for doing that (this was because I wanted to minimize licenses required)

To do load balancing
- Download weblogic plugin for Apache from http://www.oracle.com/technetwork/middleware/ias/downloads/wls-plugins-096117.html
- Ensure that Apache is up and working on the server
- Extract the plugin in a directory on  your server
- add the following to httpd.conf (I assume here we are installing on linux)

#Weblogic Proxy Plugin
LoadModule weblogic_module /root/wlsplugin/lib/mod_wl.so

#Weblogic Proxy Plugin

SetHandler weblogic-handler
WebLogicCluster node1.mydomain.com:16200,node2.mydomain.com:16200

I hope you will have a good picture about how to accomplish that

Oracle UCM 11g clustered

One of the biggest advantages we got with UCM 11g is that it is being hosted inside Weblogic Application Server. That allows us to create a clustered UCM without big efforts and in my opinion it doesn't need any expert to do that.

I think most of you guys remember clustering with UCM 10g, it was really silly :)

In next lines I will explain to you how to do that, but I will assume that you installed Weblogic Server 10.3.3,  Oracle ECM 11g, and middleware home is "/u01/oracle/middleware":

- $ cd /u01/oracle/middleware/Oracle_ECM1/common/bin
- $ ./config.sh

- Create new weblogic domain (or use an existing one if you have)



- Configure domain to support UCM, IBR, and Site Studio



- Name the new domain in this case I named it for demonstration my_domain



- Add the Weblogic admin password



- Choose Production environment



- Configure database connection information, if you are using Oracle database 11gR2 you will gain major feature which using one host name (scan name) and DNS will automatically will take care of load balancing and failover for RAC nodes.



- Next choose the following to configure clustered nodes for UCM and IBR



- Accept the default for the admin server



- In the managed servers page, you will have by default UCM_server1 and IBR_server1, we will add two other managed servers UCM_server2 and IBR_server2



- Next will create two clusters one for UCM and one for IBR



- Under UCM cluster we will add UCM managed servers and under IBR cluster we ill add IBR managed servers



- Next will add two Machines representing two physical machines, and they responsible for communicating with Node Managers on the two nodes we have here



- Add the managed servers and admin server to the Weblogic machines



- Next we can see the UCM cluster is automatically configured to support the required libraries and applications



- JDBC and the other required services is configured automatically



- At the end accept the configurations and you will have a ready UCM cluster on two nodes

The remaining part here is to have a shared storage like SAN for storing vault and weblayout repoistories, in this case also you need to have OS file system cluster. On linux you can use Oracle File System Cluster for doing that.

Oracle Universal Content Management Handbook

A new book about Oracle UCM has been published by Packt, I have been asked by Packt to review this book. I found this book is very interesting especially if you are new to UCM or you didn't get the chance to review all UCM capabilities. I used to give UCM trainings with Oracle, I can admit that reading this book will give the same knowledge you may get from trainings.

But I was wishing that this book will cover Oracle UCM 11g, where it covers UCM 10g, however almost all information in that book can be applied to 11g too.

.