How to configure SSL for Admin server when configured multiple authenticators

Symptoms:

We are getting following errors when we enabled SSL port and disabled non-SSL port for Admin server and try to check-in document in WCC:-

<oracle.ods.virtualization.engine.backend.jndi.DefaultAuthenticator.BackendJNDI> <LIBOVD-60143> <[#DefaultAuthenticator]  Unable to create connection to ldap://[localhost]:7002 as null.

javax.naming.CommunicationException: simple bind failed: localhost:7002 [Root exception is javax.net.ssl.SSLException: java.lang.RuntimeException:

Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]

        at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:218)

         at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740)

Cause: 

When we configure Admin Server to communicate over SSL then defaultLDAP automatically configure to communicate over SSL protocol (LDAPS). In case of multiple authenticators, and one of them is configure to communicate over SSL, we need to put the corresponding LDAP server's root certificate in an additional keystore used by the virtualisation (LibOVD) functionality otherwise application is unable to establish connection with defaultLDAP (ldaps://localhost:7002).

Solution:
Pre-requisites: Before completing this task, make sure the following configurations:-

• Configure the custom property called virtualize, and set its value to true.
• Admin Server SSL port is not enabled. (*) 
• Managed servers are down 

Steps:

1. Create the keystore:

a.      Set environment variables ORACLE_HOME, WL_HOME and JAVA_HOME.

export ORACLE_HOME=/u01/app/oracle/product/middleware/WC1

export WL_HOME=/u01/app/oracle/product/middleware/wlserver_10.3

export JAVA_HOME=/u01/app/jdk1.7.0_65/

b.      Setup the keystore by running libovdconfig.sh using -createKeystore option.

Open a shell prompt and change the directory to <MW_HOME>/oracle_common/bin. Then, run the following command:

./libovdconfig.sh -host <AdminServerHostName -port 7001 -userName weblogic -domainPath  <DomainPath> –createKeystore

      Enter AdminServer password:[Enter weblogic password]
Enter OVD Keystore password:[Enter a new password to secure a Keystore file]

Once this command runs, we see two new credentials in the Credential Store and a new Keystore file called adapters.jks under <DOMAIN_HOME>\config\fmwconfig\ovd\default\keystores.

2. Export the root certificate from the Admin Server SSL certificate or LDAP directory.
3. Import the root certificate to the libOVD keystore using the keytool command:

$JAVA_Home/bin/keytool -import -keystore adapters.jks -storepass <KeyStore password> -alias <alias of your choice> -file <Admin Server Certificate filename>

4. Enable SSL port and disabled non-SSL port of Admin server. (*)
5. Restart Admin Server and start all the managed servers.

* No need for this step if we are just configuring multiple authenticators with non-defaultLDAP (AD/OID) is communicating over SSL

Reference : Above steps are documented in Oracle BI security Guide: http://docs.oracle.com/cd/E21764_01/bi.1111/e10543/ssl.htm#BIESC6078

How to configure embedded (default) LDAP for WebCenter Collaboration Server (i.e. Discussion and Announcement Services)?

Applies to Oracle WebCenter 11G PS3 & PS4

Steps:

If you want to revert back from external or custom LDAP to embedded LDAP, you will not get clearly written steps in WebCenter Administration and Security Guides. Following are the simple steps in order to use embedded LDAP again:-  

Step 1. Enable Embedded LDAP Access

When WebLogic Server is installed, the LDAP access credential is set as a randomized value and encrypted in the config.xml file To reset the access credential for the embedded LDAP:

1.      Log in to the WebLogic Server Administration Console.

2.      In the Domain Structure pane, click wc_domain.

3.      In the Settings pane for wc_domain, click the Security tab, and then click the Embedded LDAP tab.

The Settings Pane for wc_domain displays the embedded LDAP settings

4.      Enter a new password in the Credential field, and reenter it in the Confirm Credential field.

5.      Click Save to save your settings.

6.      Restart the WebLogic server.

After this, you are ready to access the embedded LDAP server with the following values:

·         the DN value for admin access is "cn=Admin"

·         the password is the value you entered in the Credential field

·         the port is the same as the admin port, which by default is 7001

Step 2. Enabling Discussions Setup

1. Stop WC_Collaboration managed server (MS)

2. Change <setup>true</setup> entry to false on

<WebCenter-Domain-Home>\ config\fmwconfig\servers\WC_Collaboration\owc_discussions\jive_startup.xml.

...

<jive>

<!-- When setup is false, you can access the setup tool. -->

<setup>false</setup>

<!-- Database settings -->

3. Start WC_Collaboration MS

Step 3. Running Discussions Setup Screen

1. Log in to the Discussions Server Administration Console at:

http://localhost:8890/owc_discussions/admin

2.  On the Installation Checklist page, click Continue.
3. On the Database Settings page, choose JNDI Datasource, and click Continue.

4. Enter jdbc/OWC_DiscussionsDS in the JNDI Datasource Name field and click Continue.

5. For User, Group and Authentication Systems, select LDAP and click Contrinue.

6. Enter the following values for the embedded LDAP system and click Continue.

LDAP Host : localhost

LDAP Port: 7001

Base DN: ou=people,ou=myrealm,dc=wc_domain

Admin DN: cn=Admin

Admin Password: <Password of embedded LDAP>

7. For Admin Account Setup, enter the user name (i.e. weblogic)of the user for the Discussions (Jive) administrator.

You can now log in to Oracle Discussions with any user available in the embedded LDAP server.
You can log in to the Oracle Discussions Admin Console at: http://localhost:8890/owc_discussions/admin (use weblogic/<password>)