5 Configuring Access to Enterprise Content Sources

Identity Management with Enterprise Content Sources

Oracle SES lets you register an identity plug-in as an interface to any identity management system. Oracle SES provides registered identity plug-ins for Oracle Internet Directory, Active Directory, and other identity management systems. The plug-in that you activate is responsible for all authentication and validation activity in Oracle SES. This is done on the Global Settings - Identity Management Setup page.

The following table lists which identity plug-ins are available for each enterprise content source.

Important Notes for EMC Documentum Content Server Sources

The admin account of a DocBase should be used by the Documentum source in Oracle SES for crawling and indexing documents of that DocBase.

Setting Up Identity Management for EMC Documentum Content Server

Activate the identity plug-in on the Global Settings - Identity Management Setup page. Select Oracle Internet Directory identity plug-in and click Activate.

Enter values for the following parameters:

• For Authentication Attribute, select nickname.

• For Host name, enter the host name of the machine where Oracle Internet Directory is running.

• For Port, enter the value 389 (the default LDAP port number).

• For Use SSL, enter true or false.

• For Realm, enter the Oracle Internet Directory realm; for example, dc=us,dc=oracle,dc=com.

• For User name, enter the Oracle Internet Directory Administrator user name; for example, cn=orcladmin.

• For Password, enter the password for the user name.

Compatible version of Documentum Foundation Classes (DFC) must be installed on the machine running Oracle SES.

1. Import users/groups from Oracle Internet Directory to Documentum. First, create an LDAP Configuration Object in Documentum Administrator (DA):

   1. Login to DA.

   2. Navigate to Administration - User Management - LDAP.

   3. Click File - New - LDAP Configuration Object.

   4. For Name, enter a name for the ldap configuration object.

   5. For User Subtype, select dm_user.

   6. For Communication Mode, select Regular.

   7. For Import, select Users and Groups.

   8. Use this configuration object in the server field select Default Configuration Object.

   9. Click Next.

   10. For Directory Type, select Oracle Internet Directory Server.

   11. For Bind Type, select Bind by Searching for Distinguished Name.

   12. For Binding Name, enter the Administrator user name of Oracle Internet Directory, normally cn=orcladmin.

   13. For Binding Password, enter the Administrator password of Oracle Internet Director.

   14. For Host Name, enter the Oracle Internet Directory host name.

   15. For Port, it shows the default value 389 (the default port number of Oracle Internet Directory).

   16. For Person Object Class, enter the information of Base Person Object, typically the value is inetOrgPerson.

   17. For Person Search Base, enter the person search base defined in Oracle Internet Directory; for example, dc=Users,dc=us,dc=oracle,dc=com.

   18. For Person Search Filter, specify the cn=*.

   19. For Group Object Class, enter the Group Object; typically, its value is groupOfUniqueNames.

   20. For Group Search Base, enter the Group Search base defined in Oracle Internet Directory; for example, cn=Groups,dc=us,dc=oracle,dc=com.

   21. For Group Search Filter, specify the cn=*.

   22. Click Next.

   23. Attribute Map information is displayed. Click Finish.

2. Run the LDAP_Synchronization job:

   1. Login to DA.

   2. Navigate to Administration - Job Management - Jobs.

   3. Open the job dm_LDAPsynchronization.

   4. For state, select Active.

   5. Check the Deactivate On Failure check box.

   6. For Designated Server, select the host name of Documentum Server.

   7. Check the Run After Update check box.

   8. Go to the Schedule tab.

   9. For Start Date And Time, set the current date and time.

   10. Select Repeat time from the Repeat list.

   11. Set Frequency to any numeric value.

   12. Select the End Date And Time radio button and specify how long the synchronization job should run.

   13. Go to the Method tab.

   14. Check the Pass Standard Argument check box.

   15. Go to the SysObject info tab.

   16. Click OK.

3. Add permission to each folder and file to make them accessible by the search user. (Adding permissions to a folder automatically adds the same permissions to all files and sub-folders in the folder.) The following steps create a permission set and assign users/groups to that set. The same permission is assigned to documents. If the documents are not stamped with permission, then it won't get crawled.

   Create Access Control Lists (ACLs):

   1. Login to DA.

   2. Navigate to Administration - Security.

   3. In the File menu click File - New - Permission set.

   4. For Name, enter a name for the permission set.

   5. Click Next.

   6. Click Add to add more users/groups to the permission set.

   7. Select LDAP users/groups that are to made a part of the permission set and move them to the right frame using the arrow keys. Click OK.

   8. Click Finish.

4. Assign ACLs to documents:

   1. Login to DA.

   2. Navigate to the document where the permission set is to be applied.

   3. Select the Properties icon of this document.

   4. Go to the Permissions tab.

   5. Click Select in front of Permission set name.

   6. Search and select the permission set to be applied to the document.

   7. Click OK.

It is important that the users/groups in the permission sets that are applied to the documents are LDAP users/groups. Those documents that do not have permission sets with LDAP users/groups will not be crawled.

Creating an EMC Documentum Content Server Source

Create an EMC Documentum Content Server source on the Home - Sources page. Select EMC Documentum Content Server from the Source Type list, and click Create. Enter values for the following parameters:

• User name: Enter the user name of a valid Documentum Content Server user. The user should be an administrator user or a user who has access to all cabinets/folders and documents of the DocBases configured in the Container name parameter. The user should be able to retrieve content, metadata, and ACL from cabinets, folders, documents and other custom sub classes of all DocBases configured in Container name parameter. This is a required parameter.

• Password: Password of the Documentum user. This is a required parameter.

• Container name: The names of the containers to be crawled by Oracle SES. You can crawl an entire Documentum DocBase or a specific cabinet/folder. The format is <DocBase Name>/<Cabinet Name>/<Folder Name>/<Sub Folder Name>. Multiple comma-delimited container names can be entered. This parameter is case-sensitive; hence, the same cabinet name as in Documentum repository should be entered. This is a required parameter. For example:

  • Container name: DocBase1: The entire DocBase1 will be crawled.

  • Container name: DocBase2/Cabinet21: Cabinet21 and its sub-folders within DocBase2 will be crawled.

  • Container name: DocBase2/Cabinet21/Folder11: Folder11 and its sub-folders will be crawled.

  • Container name: DocBase1, DocBase2/Cabinet21/Folder11: The entire DocBase1 and Folder 11 in DocBase2/Cabinet21 will be crawled.

• Crawl folder attributes: Indicate whether folder attributes need to be crawled, either true or false. This is an optional parameter. The default value is false. If any other value is provided, it is assumed to be false.

• Crawl versions: Indicate whether multiple versions of documents should be crawled, either true or false. This is an optional parameter. The default value is false. If any other value is provided, it is assumed to be false and only the latest versions of a document will be crawled.

• Attribute list: The comma-delimited list of Documentum attributes along with their data types to be searchable. The format is <Attribute Name>:<Attribute Type>, <Attribute Name:Attribute Type>. Valid values are String, Number, and Date.

  Table 5-2 Documentum Data Type Mapping

  Sr. No	Documentum Data Type	Oracle SES Data Type
  1	Boolean	Number
  2	Integer	Number
  3	String	String
  4	ID	String
  5	Time or Date	Date
  6	Double	Number

  
  

  While crawling a DocBase, an attribute is indexed only if both name and type match the configured name and type; otherwise, it is ignored. This is an optional parameter. For example: To make the following Documentum attributes searchable:

  • Attribute Name: Account Name Attribute Type: String

  • Attribute Name: Account Id Attribute Type: Integer

  • Attribute Name: Creation Date Attribute Type: Date

  The value of Attribute list should be the following:

  Account Name: String, Account ID: Number, Creation Date:Date

  The default searchable attributes for Documentum Content Server are Modified Date, Title, and Author.

  Multiple attributes with same name are not allowed. For example, Emp_ID:String, Emp_ID:Number

• URL for Viewing the Document: A valid URL for Documentum WebTop or DA application used for viewing the Oracle SES search results. For example, http://<IP address>:<Port No>/da or http://<IP address>:<Port No>/webtop.

• Authentication Attribute: This parameter is used to set ACLs. This parameter lets you set multiple LDAP servers. If Oracle SES and Documentum Content Server are synchronized with Active Directory, then enter the value USER_NAME. If Oracle Internet Directory is used, then enter nickname.

Important Notes for FileNet Content Engine Sources

Any user having administrative privileges can be used to access FileNet Content Engine Crawler plug-in for crawling and indexing documents.

Setting Up Identity Management with Filenet Content Engine

If a FileNet Content Engine source is used, Oracle recommends that Active Directory be used as identity management system for the Oracle SES instance. The Active Directory instance must be the same one that FileNet Content Engine is using to authenticate users on the file system.

Creating a FileNet Content Engine Source

Create a FileNet Content Engine source on the Home - Sources page. Select FileNet Content Engine from the Source Type list, and click Create. Enter values for the following parameters:

• User name: A valid FileNet Content Engine user. The user should be an Administrator user or a user who has access to all Folders and Documents present in the configured container. The user should be able to retrieve content, metadata, and ACL from folders, documents of all containers configured in Container name parameter. This is a required parameter.

• Password: Password of the Content Engine user. This is a required parameter.

• Container name: The names of the containers to be crawled by Oracle SES. You can crawl a complete objectstore or a specific Folder. The format for specifying container is <ObjectStore>/<Folder Name>/<Sub Folder Name>. Multiple comma-delimited containers can be specified. This is a required parameter. For example:

  • Container name: ObjectStore1: The entire ObjectStore1 will be crawled.

  • Container name: ObjectStore1/Folder1/Folder12: The documents inside Folder12 and its sub-folders will be crawled.

  • Container name: ObjectStore1, ObjectStore2/Folder1/Folder12: The entire ObjectStore1 and contents of Folder12 in ObjectStore2 will be crawled.

• Attribute list: Attribute list corresponds to the comma-delimited list of Content Engine attributes along with their data types that the administrator wants to be searchable. The format is <Attribute Name>:<Attribute Type>, <Attribute Name:Attribute Type>. The valid values are String, Number, and Date.

  Table 5-3 FileNet Content Engine Data Type Mapping

  Sr. No	FileNet Content Engine Data Type	Oracle SES Data Type
  1	Boolean	String
  2	float, int, byte, and other numeric values	Number (Big Decimal)
  3	String	String
  4	DateTime, Date	Date
  5	Others	String

  
  

  While crawling from object store an attribute will be indexed only if a valid attribute name and data type should be matched with the configured name and type, else it will be ignored. This is an optional parameter. For example, to make the following Content Engine attributes searchable:

  • Attribute Name: DocumentTitle Attribute Type: String

  • Attribute Name: Id Attribute Type: Number

  • Attribute Name: DateCreated Attribute Type: Date

  The value of Attribute List should be: Document Title: String, Id: Number, DateCreated: Date

  The default searchable attributes for FileNet Content Engine are Title, Author, and Last Modified Date. Multiple attributes with same name are not allowed. For example: Emp_ID: String, Emp_ID: Number is not allowed.

• Crawl versions: Indicate multiple versions of documents to be crawled with true. By default, this value is false; that is, only the latest version of documents will be crawled. If any value other than true is specified, it is considered false.

• URL for viewing the documents: The URL for FileNet Workplace application used for viewing the search results. Workplace is a part of FileNet P8 AE. For example: http://<IP address> :< Port No.>/Workplace

• Remove deleted documents from index: This parameter determines whether documents deleted from CE object stores should be removed from the index as well, either true or false. The default value is false, as this would be a costly operation in terms of performance. If any value other than true is specified, it is considered false.

• Crawl folder attributes: Specify whether or not folder metadata should be indexed, either true or false. The default value is false. Any other value for this parameter is considered false.

Important Notes for FileNet Image Services Sources

A user belonging to IS SysAdmin group should be used to crawl documents and metadata in IS.

Setting Up Identity Management for FileNet Image Services

Activate the identity plug-in on the Global Settings - Identity Management Setup page.

Configure Oracle SES to Active Directory:

1. On the Global Settings - Identity Management Setup page, click Register new Identity Plug-in.

2. For Plug-in Manager Class Name, enter oracle.search.plugin.security.idm.IdentityPluginManagerADImpl

3. For Plug-in Manager Jar File Name, enter idm/idmPlugin.jar.

4. Click Finish.

5. Select the radio button for The Active Directory Identity Plug-in Manager implemented based on Oracle User & Role API and click Activate.

6. For Authentication Attribute, select USER_NAME.

7. For Directory URL, enter the host name and port number; for example, ldap://ldapserverhost:port.

8. For Directory account name, enter the Active Directory user; for example, Administrator.

9. For Directory account password enter the password of the Active Directory user.

10. For Directory subscriber, enter the Active Directory information like Directory subscriber (ldap base) like 'dc=us,dc=oracle,dc=com'.

11. For Directory security protocol, enter none or the port number.

12. Click Finish.

Configure the identity plug-in for Image Services

1. Go to the Global Settings - Identity Management Setup page in Oracle SES.

2. Create a new directory under [oracle_home]/product/[version]/ [SES Instance Name]/search/lib/plugin/Identity/ for example IdentityPlugin_folder.

3. Copy the FileNet Image Services identity plug-in jar to that folder.

4. Click Register new Identity Plug-in.

5. For Plug-in Manager Class Name, enter oracle.search.plugin.security.identity.fnis.FNISIdentityPluginManager

6. For Plug-in Manager Jar File Name, enter identity/fnis/FNISIdentityPlugin.jar.

7. Click Finish.

8. Select the radio button for The Image Services Identity Plug-in Manager implemented based on Oracle User & Role API and click Activate.

9. For Authentication Attribute, select NATIVE.

10. For Web Component URL enter the host name and port number of the Web component URL; for example, http://webserverhost:port/ISCrawlerWeb.

11. For Administrator user name, enter Image Services user name.

12. For Administrator password, enter the password of the Image Services user.

13. For Library name of IS Server, enter the name of the Image Services library like 'ISCF'. Library Name is the ISRA connection factory name that is created when ISRA is deployed.

14. Click Finish.

Image Services Resources Adapter (ISRA) must be deployed on a supported application server. See the ISRA documentation for supported application servers.

Connection Factory must be created for ISRA, the connection factory should be configured for the target IS libraries. See the ISRA documentation for deployment instructions.

ISRA comes with a viewer application for viewing images and annotations, the FNImageViewer.ear application should be deployed on the same application server as ISRA. This viewer would be invoked to display images for example jpeg, tiff, bmp, gif, and annotations. See the ISRA documentation for deployment instructions.

To support secure search, the Image Services server must be synchronized with the Active Directory server. See the section 'LDAP configuration' in ISRA deployment guides for importing Microsoft Active Directory users/groups to Image Services.

After Active Directory users/groups have been imported into Image Services, ISRA must be configured to authenticate with Active Directory. See the section 'LDAP configuration' in ISRA deployment guide for details.

Creating a FileNet Image Services Source

Create a FileNet Image Services source on the Home - Sources page. Select FileNet Image Services from the Source Type list, and click Create. Enter values for the following parameters:

• User name: Enter the user name of a valid FileNet Image Services user. The user should be a SysAdmin user or a user who has access to all Folders and Documents of the Libraries configured in the Container name parameter. The user should be able to retrieve content, metadata and ACL from folders, documents and other custom sub classes. The user should be defined in the configured LDAP server and should be imported into IS. This is a required parameter.

• Password: The FileNet Image Services user password. This is a required parameter.

• Container name: The names of the containers to be crawled by Oracle SES. You can crawl an entire FileNet Image Services Library or a specific Folder. The format is <Library Name>/<Folder Name>/<Sub Folder Name>(cache name). Library name is the ISRA connection factory name created when ISRA is deployed. Cache name is in which the document content can be found. Multiple comma-delimited container names can be entered. This is a required parameter. For example:

  • Container Name: LibraryName1(cache name): The entire LibraryName1 will be crawled

  • Container Name: LibraryName2/Folder1/(cache name): Folder1 and its sub-folders will be crawled.

  • Container Name: LibraryName1, LibraryName2/Folder1(cache name): The entire LibraryName1 and Folder 1 in LibraryName2 will be crawled

  • Cache name: The format is cache name:DomainName:Oraganization. This is an optional parameter, if the cache name is not provided the plug-in tries to retrieve document content from the default page cache. However, the plug-in throws an error if an invalid page cache or empty brackets () is specified. Ask IS administrator for cache details.

• Attribute names: The comma-delimited list of Image Services attributes along with their data types to search. The format is <Attribute Name> :<Attribute Type>, <Attribute Name: Attribute Type>. Valid values are String, Number, and Date.

  Table 5-4 FileNet Image Services Data Type Mapping

  Sr. No	FileNet Image Services Data Type	Oracle SES Data Type
  1	BOOLEAN	String
  2	BYTE	Number
  3	UNSBYTE	Number
  4	SHORT	Number
  5	UNSSHORT	Number
  6	LONG	Number
  7	UNSLONG	Number
  8	ASCII	String
  9	TIME	Date
  10	DATE	Date
  11	MENU	Number
  12	FP_NUM	Number

  
  

  While crawling a Library an attribute will be indexed only if both name and type of the attribute in the library match the configured name and type; otherwise, it is ignored. This is an optional parameter. For example, to make the following FileNet Image Services attributes searchable:

  • Attribute Name: Account Name Attribute Type: String

  • Attribute Name: Account Id Attribute Type: Integer

  • Attribute Name: Creation Date Attribute Type: Date

  The value of Attribute List should be

  Account Name: String, Account Id: Number, Creation Date: Date

• Set source hierarchy: Indicate whether the source should set the source hierarchy of the document, either true or false. The default value is false. If any other value is provided, it is assumed to be false.

  A document in Image Services can be filed in multiple folders, it is possible that a user could have READ permissions on a document but not on all the folders in which the document is filed. If Set Source Hierarchy is 'True', then there is a possibility that a user could view a source hierarchy on which he does not have permissions in IS. However, he would not be able to view the documents on which he does not have READ permissions.

• Web component URL: The URL of J2EE application server where the crawler plug-in Web component module is deployed. The format of the URL is http://<host name> :< Port Number>. This is a required parameter.

  The Web component is also used to view the search results, on clicking an Oracle SES search result the user is prompted for login. On successful login, the document is displayed. To view images and annotations the FileNet Image viewer FNImageViewer.ear should be deployed. FNImageViewer.ear is a part of ISRA CD. If the viewer is not deployed, the images will be displayed in native viewer or the user is prompted to download the document.

• Set public access: Indicate whether the source should set the public access of the documents whose ACL is Anyone, either true or false. The default value is false. If any other value is provided, it is assumed to be false.

• Authentication attribute: This parameter is used to get the LDAP authentication attribute. This parameter will vary based on the identity plug-in used for authentication. For Microsoft Active Directory, it should be USER_NAME. For FileNet Image Services identity plug-in, it should be NATIVE.

Important Notes for Lotus Notes Sources

The user-account used to crawl Lotus Notes databases should preferably be an Administrator account, such that it has access on all databases and is able to retrieve and crawl all documents in the specified databases.

Setting Up Identity Management for Lotus Notes

Activate an identity plug-in on the Global Settings - Identity Management Setup page. Select the identity plug-in for Microsoft Active Directory click Activate.

The users/groups on Active Directory can be synchronized with Lotus Domino Directory such that all users/groups in Active Directory get registered in Domino as well. Thus, any ACL entry in a notes database or notes document can be validated in Active Directory also, and vice versa.

Oracle SES also provides a Lotus Notes identity plug-in so the Lotus Domino Directory can be used to authenticate and validate the notes native users and groups in Oracle SES. To use the Lotus Notes identity plug-in:

1. Register the Lotus Notes identity plug-in by providing the following parameters:

   • Plug-in Manager Class Name = oracle.search.plugin.security.identity.ln.LNIdentityPluginManager

   • Plug-in Manager Jar File Name = <lotus notes identity plug-in folder>/ ln/LNIdentityPlugin.jar

2. Activate the Lotus Notes identity plug-in with the following parameters:

   • Server name: The Domino server fully qualified host name/IP address. If the HTTP port on the Domino server is not 80, then the host name should be "<server-name> :< HTTP port number>".

   • User name: Enter user name of a valid Lotus Domino Server user. This is a required parameter.

   • Password: Internet password of the Lotus Notes user. This is a required parameter.

Creating a Lotus Notes Source

Create a Lotus Notes source on the Home - Sources page. Select Lotus Notes from the Source Type list, and click Create. Enter values for the following parameters:

• User name: Enter the user name of a valid Lotus Domino Server user. The user should be an Administrator user or a user who has access to all Folders and Documents of the databases configured in the Container name parameter. The user should be able to retrieve content, metadata, and ACL from documents of all databases configured in Container name parameter. This is a required parameter.

• Password: Internet password of the Lotus Notes user. This is a required parameter.

• Container name: The comma-delimited names of the containers to be crawled by Oracle SES. These containers could be one or many specific databases or Directory-names if all databases in the particular directories need to be crawled. Multiple database or directory names should be separated by a comma. This is a required parameter.

• Attribute list: The comma-delimited list of Lotus Notes attributes along with their data types to search. The format is <Attribute Name> :< Attribute Type>, <Attribute Name: Attribute Type>. The valid values are String, Number, and Date.

  Table 5-5 Lotus Notes Data Type Mapping

  Sr. No	Lotus Notes Data Type	Oracle SES Data Type
  1	Boolean	String
  2	Integer	Number (Big Decimal)
  3	String	String
  4	Date	Date

  
  

  While crawling a database, an attribute is indexed only if both name and type match the configured name and type; otherwise, it is ignored. This is an optional parameter.

  The default searchable attributes for Lotus Domino Server are Modified Date, Title, and Author. Multiple attributes with same name are not allowed.

• Server name: The Domino server fully qualified host name/IP address. If the HTTP port on the Domino server is not 80, then the host name should be "<server-name> :< HTTP port number>". This is a required parameter.

• Crawl public documents: Indicate whether the public documents on notes databases need to be crawled such that they are available to anonymous users in Oracle SES, either true or false. This is a required parameter.

• Authentication attribute: The attribute used to validate the ACL. With Active Directory identity plug-in, the value should be USER_NAME. With the Lotus Notes identity plug-in, the value should be NATIVE. This is a required parameter.

• Mail template name: This parameter is specific to the mail-databases and the mail template's name should be specified here if any/all of the databases being crawled are mail databases. This is a mandatory parameter if either the Past Days or Future Days parameter is specified.

• Past days: If the user is crawling calendar entries, then this parameter specifies the number of days in the past for which the calendar entries are picked. The date of reference here is the start date of the event. This accounts for the number of days in the past, and it does not filter the search by time.

• Future Days: If the user is crawling calendar entries, then this parameter specifies the number of days in the future for which the calendar entries are picked. The date of reference here is the end date of the event. This accounts for the number of days in the future, and it does not filter the search by time.

• Notes title: Because in Lotus Notes custom applications it is not mandatory to maintain a Title field, this parameter has been provided where the administrator can specify those text fields that should be parsed to retrieve the title field. In case of multiple field names, the first field available on the document would be picked for the title. This is a required parameter.

Important Notes for NTFS Sources

• The operating system user running the Oracle SES instance must have read permission on the NTFS file share being crawled. For example, if the remote file share \\machine1\share1\directory1\ is crawled by the NTFS source, then the SES instance must be run as a domain user who has access to the file share.

• If you get the ACL in the form <encrypted acl>@domain for a folder on a remote machine, it probably means that the machine running the Oracle SES instance and the remote machine are on different domains and your machine cannot interpret the ACLs appropriately.

Setting Up Identity Management with NTFS Sources

If an NTFS source is used, Oracle recommends that Active Directory be used as identity management system for the Oracle SES instance. The Active Directory instance must be the same one that NTFS is using to authenticate users on the file system.

For the Oracle SES instance to read the files during crawling, add permission to each folder and file to make them accessible by the operating system user that runs the Oracle SES instance. (Adding permissions to a folder will automatically add the same permissions to all the files and sub-folders in the folder.)

Creating an NTFS Source

Create an NTFS source on the Home - Sources page. Select NTFS from the Source Type list, and click Create. Enter the values for the following parameters:

Suppose you want to crawl \\myserver\test1 and \\myserver\test2 on an NTFS box. Specify the UNC PATH as follows: \\myserver\test1 and \\myserver\test2. The domain user must have read privileges on the shared folders.

^https://*.oracle.com/
.jpg$

^https://.*\.oracle(?:corp){0,1}\.com 
 

/^https://.*\.oracle(?:corp){0,1}\.com;^https://*.oracle.com/;https://*.oracle.com/*/

Important Notes for NTFS Sources

• On the Windows server, the Super User must have permissions to read the NTFS file share

• The Super User must be the impersonate user in the IIS Server

Setting Up Identity Management with NTFS Sources

If an NTFS source is used, Oracle recommends that Active Directory be used as identity management system for the Oracle SES instance. The Active Directory instance must be the same one that NTFS is using to authenticate users on the file system.

For the Oracle SES instance to read the files during crawling, add permission to each folder and file to make them accessible by the operating system user that runs the Oracle SES instance. (Adding permissions to a folder will automatically add the same permissions to all the files and sub-folders in the folder.)

Creating an NTFS Source

Create an NTFS source on the Home - Sources page. Select NTFS from the Source Type list, and click Create. Enter the values for the following parameters:

• UNC PATH: UNC path for the NTFS system to crawl; for example, \\MYSERVER\mysharedfolder

• EndPoint: Target end point (HTTP or HTTPS); for example, http(s)://NTFS Domain server (mail.doklet.com in this fig.)/virtual directory (NTFSWebService in the fig.)/NTFSWebService.asmx

• USER NAME: User name to authenticate between Oracle SES and Microsoft Exchange: (configuration parameters similar to Exchange Agent in IIS)

• PASSWORD: Password to authenticate between Oracle SES and Microsoft Exchange: (configuration parameters similar to Exchange Agent in IIS)

^https://*.oracle.com/
.jpg$

^https://.*\.oracle(?:corp){0,1}\.com 
 

/^https://.*\.oracle(?:corp){0,1}\.com;^https://*.oracle.com/;https://*.oracle.com/*/

Important Notes for Open Text Livelink Sources

• The admin account should be used by the Livelink crawler plug-in for the container for crawling and indexing documents.

• The Livelink Enterprise Server version must be 9.2, 9.5.0, 9.5.5

Setting Up Identity Management for Open Text

The Livelink Enterprise Server identity plug-in authenticates native users of Livelink Enterprise Server. The identity plug-in communicates with the directory to authenticate a user's credentials, validate a user or group and return the associated canonical form, and return the groups associated with a given user.

Activate the identity plug-in on the Global Settings - Identity Management Setup page:

• For the Active Directory identity plug-in, activate the oracle.search.plugin.security.idm.IdentityPluginManagerADImpl plug-in.

• For the Livelink identity plug-in, activate the Livelink identity plug-in manager.

Creating an Open Text Livelink Source

Create an Open Text source on the Home - Sources page. Select Open Text from the Source Type list, and click Create. Enter values for the following parameters:

• User name: Name of a valid Livelink Enterprise Server user. The user must be an Administrator user or a user who has access to all folders and documents of the workspaces configured in the Container name parameter. The user should be able to retrieve content, metadata, and ACL from folders, documents and other custom sub classes of all workspaces configured in Container name parameter. This is a required parameter.

• Password: Password of the Livelink user. This is a required parameter.

• Container name: The names of the containers to be crawled by Oracle SES. You can crawl an entire Livelink Workspace or a specific folder. The format for is: <Workspace Name>/<Folder Name>/<Sub Folder Name>. Multiple comma-delimited container names can be entered. This is a required parameter. For example:

  • Container name: Workspace1: The entire Workspace1 will be crawled.

  • Container name: Workspace2/Folder21: Folder21 and its sub-folders within Workspace2 will be crawled.

• Crawl folder attributes: Indicate whether folder attributes need to be crawled, either true or false. This is an optional parameter. The default value is false. If any other value is provided, it is assumed to be false.

• Crawl versions: Indicates whether multiple versions of documents should be crawled, either true or false. This is an optional parameter and the default value is false. If any other value is provided, it is assumed to be false; in this case, only latest versions of a document will be crawled.

• Attribute list: The comma-delimited list of Livelink attributes along with their data types to be searchable. The format for attribute list is <Attribute Name>:<Attribute Type>, <Attribute Name:Attribute Type>. Valid values are String, Number, and Date.

  Table 5-9 Open Text Data Types

  Sr. No	Open Text Data Type	Oracle SES Data Type
  1	Boolean	String
  2	Integer	Number (Big Decimal)
  3	String	String
  4	Date	Date

  
  

  While crawling a Workspace an attribute is indexed only if both name and type match with configured name and type; otherwise, it will be ignored. This is an optional parameter. For example: If the administrator wants to make the following Livelink attributes searchable:

  • Attribute Name: Account Name Attribute Type: String

  • Attribute Name: Account Id Attribute Type: Integer

  • Attribute Name: Creation Date Attribute Type: Date

  The value of Attribute list should be

  Account Name: String, Account Id: Number, Creation Date:Date

  The default searchable attributes for Livelink Enterprise Server will be Modified Date, Title, and Author.

  Multiple attributes with same name are not allowed. For example Emp_ID:String, Emp_ID:Number

• Server Name and Port Number for Livelink: The machine name/IP address and the port number on which Livelink server is running. The format is <Server Name>:<Port Number>.

• Authentication attribute: The attribute used to set ACL. With Active Directory, the value is USER_NAME. With the Livelink identity plug-in, the value is NATIVE. This is a required parameter. This parameter is case-sensitive.

• Crawl objects with public access: This parameter indicates whether objects with public access should be crawled without any ACL. Valid values are true or false. If false, then all objects having this ACL will be ignored.

• SSL Enabled for Livelink: Specify if Livelink is running on SSL. If it is running on SSL, then this is true; otherwise, false.

Setting Up Identity Management for Oracle Calendar

The Oracle SES instance and the Oracle Calendar instance must be connected to the same Oracle Internet Directory system. Follow these steps to set up a secure Oracle Calendar source:

1. On the Global Settings - Identity Management Setup page in the Oracle SES administration tool, select the Oracle Internet Directory identity plug-in manager, and click Activate.

2. Use the following LDIF file to create an application entity for the plug-in. (An application entity is a data structure within LDAP used to represent and keep track of software applications accessing the directory with an LDAP client.)

   $ORACLE_HOME/bin/ldapmodify -h oidHost -p OIDPortNumber -D "cn=orcladmin" -w password -f  calPlugin.ldif
   
   

   Where $ORACLE_HOME is the Oracle Calendar infrastructure installation and calPlugin.ldif is the current directory.

   This defines the entity that will be used for the plug-in: orclApplicationCommonName=ocsCsPlugin,cn=ifs,cn=Products,cn=OracleContext. The entity will have the password welcome1.

Creating an Oracle Calendar Source

Create an Oracle Calendar source on the Home - Sources page. Select Oracle Calendar from the Source Type list, and click Create. Enter values for the following parameters:

Important Notes for Oracle Content Database Sources

Oracle Content Database and Oracle Content Services are the same product. This section uses the product name Oracle Content Database to mean Oracle Content Database and Oracle Content Services.

Setting Up Secure Oracle Content Database Sources

The Oracle SES instance and the Oracle Content Database instance must be connected to the same Oracle Internet Directory system. The groups in Oracle Content Database must also be synchronized with Oracle Internet Directory. Follow these steps to set up a secure Oracle Content Database source:

1. Read Known Limitations and confirm that the number of crawler threads does not exceed the available concurrent connection settings for each user in Oracle Content Database.

2. Activate the Oracle Internet Directory identity plug-in for the Oracle Content Database instance. This is done on the Global Settings - Identity Management Setup page in the Oracle SES administration tool.

3. Use the following LDIF file to create an application entity for the plug-in. (An application entity is a data structure within LDAP used to represent and keep track of software applications accessing the directory with an LDAP client.)

   $ORACLE_HOME/bin/ldapmodify -h oidHost -p OIDPortNumber -D "cn=oracle" -w password -f  csPlugin.ldif
   
   

   Where $ORACLE_HOME is the Oracle Content Database infrastructure installation and csPlugin.ldif is the current directory.

   This defines the entity that will be used for the plug-in: orclapplicationcommonname=ocscsplugin, cn=ifs,cn=products,cn=oraclecontext. The entity will have the password welcome1.

   See Also:

   Appendix E, "LDIF Files" to view the csPlugin.ldif file

Creating an Oracle Content Database Source

Create an Oracle Content Database source on the Home - Sources page. Select Oracle Content Database from the Source Type list, and click Create. Enter values for the following parameters:

Important Notes for Oracle E-Business Suite 11i Sources

The view or query to be crawled for this source should contain the following columns:

The view or query can contain the following optional columns:

Any other column in the view or query is considered an attribute of the document.

Setting Up Identity Management for Oracle E-Business Suite 11i

Activate the identity plug-in on the Global Settings - Identity Management Setup page. Select Identity Plugin Manager for Oracle E-Business Suite 11i and click Activate. Enter the values for the following parameters:

• User Validation Database Connection String: JDBC connection string for the database, used for validating a user.

• User ID: User ID to login to the user validation database.

• Password: Password to login to the user validation database.

• User Authentication Query: SQL query to authenticate a user. The query should return a single record with a single column with a string value of 'Y' or 'N' based on successful or unsuccessful authentication, respectively. The placeholder for user name and password should be specified as '?'. The default query (which can be changed if needed) is:

  SELECT fnd_web_sec.Validate_login(upper(?),?)
  FROM dual
  
  

• User Validation Query: SQL query to validate a given user. The query should return 1 if the user is valid. Else, no rows should be returned. The placeholder for the user name should be specified as '?'. The default query (which can be changed if needed) is:

  SELECT 1 FROM fnd_user WHERE user_name = upper(?)
  
  

Click Finish.

Creating an Oracle E-Business Suite 11i Source

Create an Oracle E-Business Suite 11i source on the Home - Sources page. Select Oracle E-Business Suite 11i from the Source Type list, and click Create. Enter values for the following parameters:

• Database Connection String: JDBC connection string for the E-Business Suite database from which the content will be crawled.

• User ID: User ID to login to the E-Business Suite database. This user ID should have access to the schema owning the view specified in the View parameter.

• Password: Password to login to the E-Business Suite database.

• View: Table or view containing the required set of columns

• Document Count: Maximum number of documents to be crawled and indexed. Enter -1 if all documents should be crawled before indexing.

• Query: Query projecting the required set of columns. This query should be used if the view defined in the View parameter is not available. Only one of these - View or Query – should be specified.

• URL Prefix: String to prefix the content of URL column to form a display URL for the document

• Cache File: Local file to which the contents can be temporarily cached while crawling.

• Path Separator: Path separator character in the document path string

• Parse Attributes: Enter true if the values of the attributes should be extracted from the document content specified in SOLUTION column. Otherwise, enter false.

• Grant Security Attributes: Space-delimited list of grant security attributes

• Deny Security Attributes: Space-delimited list of deny security attributes

Click Next.

Click Get Parameters to obtain a list of parameters for the authorization manager plug-in.

Enter the values for the authorization manager plug-in parameters:

• Authorization Database Connection String: JDBC connection string for the authorization database. The values of the security attributes to which a given user is authorized will be retrieved from this database.

• User ID: User ID to login to the authorization database

• Password: Password to login to the authorization database

• Authorization Query: SQL query to retrieve the values of security attributes to which a given user is authorized. The SELECT clause of this query should have all the security attributes specified in the Grant Security Attributes and Deny Security Attributes parameters with identical names. This query can be of two types:

  • The query can return a single record for a given user. The value in each security attribute column should be a space-delimited list of values to which the user is authorized.

  • The query can return multiple records for a given user. The value in each security attribute column of every row of the result set of this query will be interpreted as a single value.

  The placeholder for the user name in the query should be specified as '?'.

• Single Record Query: Enter true if the authorization query returns a single record. Enter false if the query can return multiple records.

Click Create.

Setting Up Identity Management for Siebel 8

Activate the identity plug-in on the Global Settings - Identity Management Setup page. Select Identity Plugin Manager for Siebel 8 and click Activate.

1. Enter values for the following parameters:

   • Siebel 8 authentication Web service endpoint: HTTP endpoint of the Siebel Web service that provides the authentication service

   • Siebel 8 validation Web service endpoint: HTTP endpoint of the Siebel Web service that provides the user validation service

   • User ID: Admin user ID for accessing the user validation service

   • Password: Admin password for accessing the user validation service

2. Click Finish.

Creating a Siebel 8 Source

Create a Siebel 8 source on the Home - Sources page. Select Siebel 8 from the Source Type list, and click Create.

1. Enter the values for the following parameters:

   • Configuration URL: File URL of the XML configuration file providing details about the source, such as the data feed type, location, security attributes, and so on.

     Obtain this file from Siebel administrator and save it on the machine on which Oracle SES is installed. Enter the configuration URL as file://localhost/<Absolute path of the configuration file>. For example: file://localhost/private/oracle/config.xml/.

   • User ID: User ID to login to the FTP server, if the data feeds are to be accessed over FTP. The access details of the data feed are specified in the configuration file. This can be obtained from Siebel administrator.

   • Password: Password to login to the FTP server. This can be obtained from Siebel administrator.

   • Scratch Directory: A directory, in the machine where Oracle SES is installed to temporarily write the status logs.

   • Maximum number of connection attempts: Maximum number of attempts to connect to the target server to access the data feed.

2. Click Next.

3. Enter the values for the authorization manager plug-in parameters:

   • Siebel 8 authorization Web service endpoint: Webs service endpoint of the Siebel Web service that provides the authorization service

   • User ID: Admin user ID for accessing the authorization service

   • Password: Admin password for accessing the authorization service

4. Click Create.

Important Notes for Microsoft Exchange Sources

On the Exchange server, the super user needs to grant himself the Send as and Receive as privileges. You can enable privileges globally for all users in the system. No user-specific privilege grants are required.

Setting Up Identity Management for Microsoft Exchange

If a Microsoft Exchange source is used, Oracle recommends that Active Directory be used as identity management system for the Oracle SES instance. The Active Directory instance must be the same one that Microsoft Exchange is using to authenticate users on the file system.

For the Oracle SES instance to read the files during crawling, add permission to each folder and file to make them accessible by the operating system user that runs the Oracle SES instance. (Adding permissions to a folder will automatically add the same permissions to all the files and sub-folders in the folder.)

Creating a Microsoft Exchange Source

Create a Microsoft Exchange source on the Home - Sources page. Select Microsoft Exchange from the Source Type list, and click Create.

Enter values for the following parameters:

• USER NAME: User name to authenticate between Oracle SES and Exchange (configuration parameters consistent with that for Exchange Agent in IIS).

• PASSWORD: password to authenticate between Oracle SES and Exchange (configuration parameters consistent with that for Exchange Agent in IIS).

• ENDPOINT: Target end point (HTTP or HTTPS); for example, http(s)://exchange server (mail.doklet.com in the example)/virtual directory (Web site in the example)/ExchangehttpsService.asmx.

^https://*.oracle.com/
.jpg$

^https://.*\.oracle(?:corp){0,1}\.com 
 

/^https://.*\.oracle(?:corp){0,1}\.com;^https://*.oracle.com/;https://*.oracle.com/*/

Federation Trusted Entities

When performing a secure search on a federation endpoint, the federation broker must pass the identity of the logged in user to the federation endpoint. If the endpoint instance trusts the broker instance, then the broker instance can proxy as the end user. To establish this trust relationship, Oracle SES instances should exchange some secret. This secret is exchanged in the form of a trusted entity. A trusted entity consists of two values: entity name and entity password. Each Oracle SES instance can have one or more trusted entities that it can use to participate in secure federated search. (A trusted entity is also referred to as a proxy user.)

Create trusted entities on the Global Settings - Federation Trusted Entities page of Oracle SES administration tool.

An Oracle SES instance can connect to an identity management (IDM) system for managing users and groups. An IDM system can be an LDAP compliant directory, such as Oracle Internet Directory or Active Directory.

Each trusted entity can be authenticated by either an IDM system or by the Oracle SES instance directly, independent of an IDM system. For authentication by an IDM system, check the box Use Identity Plug-in for authentication when creating a trusted entity. In this case, the entity password is not required. This is useful when there is a user configured in the IDM system that can be used for proxy authentication. Make sure that the entity name is the name of the user that exists in the IDM system and is going to be used as the proxy user.

For authentication of the proxy user by Oracle SES, clear (uncheck) the box Use Identity Plug-in for authentication when creating a trusted entity. Then use any name and password pair to create a trusted entity.

Use Authentication Attribute to specify the format of the user credential that the Oracle SES federation endpoint expects for this particular trusted entity in proxy authentication. The identity plug-in registered on the federation endpoint should be able to map this user identity to the default authentication format used on the federation endpoint. This is useful when a federation broker cannot send user identity in the default authentication format used on the federation endpoint for proxy authentication, but the identity plug-in registered on the federation endpoint can map the value from the attribute in which it receives the user identity during proxy authentication to the default authentication format used on the federation endpoint.

To use a proxy entity, use the Web services API proxyLogin() user name and password for the entity name and entity password. The identity plug-in can validate the password instead of storing it. When a request is sent for proxyLogin(), Oracle SES calls the identity plug-in (which returns the call) to authenticate the entity. The proxyLogin() must supply one of the valid trusted entities registered in the federation trusted entities.

To perform secure federated search, both the broker and the endpoint instances involved in the federation must have identity plug-ins registered. The identity plug-ins may or may not talk to the same IDM system. Carefully specify the following parameters under the section Secure Federated Search when creating a federated source on the broker instance:

• Remote Entity Name: This is the name of the federation trusted entity on the federation endpoint. It is provided by the administrator of the endpoint instance.

• Remote Entity Password: This is the password of the federation trusted entity on the federation endpoint. It is provided by the administrator of the endpoint instance.

• Search User Attribute: This attribute identifies, and is used to authenticate, a user on the federation endpoint instance. This parameter is an optional parameter, except when the broker and endpoint use different authentication attributes to identify end users. (For example, on the broker instance, an end user can be identified by user name; on the endpoint instance, the end user can be identified by e-mail address.)

  The identity plug-in registered on the broker instance should be able to map the user identity to this attribute based on the authentication attribute used during the registration of the identity plug-in. If this attribute is not specified during creation of the federation source, then the user identity on the broker instance is used to search on the endpoint instance.

  Note:

  If these parameters are not specified during the creation of the federated source, then the federated source is treated as a public source (that is, only public content is available to the search users).

• Secure Oracle HTTP Server-Oracle SES channel: Because any Oracle HTTP Server can potentially connect to the AJP13 port on the Oracle SES instances and masquerade as a specific person, either the channel between the Oracle HTTP Server and the Oracle SES instance must be SSL-enabled or the entire Oracle HTTP Server and Oracle SES instance machines must be protected by a firewall.