Token Configurations in Oracle SOA Suite PS6 ( 11.1.1.7.0)

Oracle Soa Suite PatchSet 6 or 11.1.1.7.0  now has support for Token configurations which really can help administrators in configuring or overriding external Web Service Reference parameters like the protocol ( http, oramds or https ),  the remote host etc. And more important if you do it right you can kick out the all those Soa Suite deployment plans :-)

Important to know this only works on the location attribute of the binding.ws element of the composite.xml file. But when you use Metadata Service (MDS) and call a Web Service like a Java WS, .Net WS,  OSB or SOA Suite Reference Services then you can use this new feature.

In this blogpost I will show you all the steps.

First step is to make all these services in depended of each other ( Don't want invalid composites or want to use deployment plans ), I followed this great AIA blog about Best Practices for Decoupling Services and Avoiding Invalid Composites at Server Startup

In this demo I created a workspace with a MDS project which contains some WSDL's with a XML Schema. This WSDL is used in the Helloworld Reference Soa project. Deployed it together with the MDS soa sar and I put the Impl of the Reference WSDL back to the MDS so it can be used in my other main project ( I downloaded it from the EM and changed the xml schema import ).

The main project will call this helloworld reference service and in this project we will use a server name token in the WSDL url ( location attribute of the binding.ws element ).

In my main project I added this externel reference web service to my composite by selecting the Reference Impl from the MDS  ( First add a File MDS in the Resource Palette and map this to your local MDS location and finally lookup the WSDL, for compiling you also need to add an extra MDS location to the adf-config.xml )

After adding the reference service, we need to fix some hard references in the composite.xml to this remote service.

• Change the location attribute of the composite import to oramds://
• Do the same for ui:wsdlLocation attribute of the Reference element.
• In the location attribute of the Binding.WS element we need to use the real reference WSDL url ( see the EM for the reference WSDL url  ). 

Do the same for the Reference Wrapper WSDL

Now our main Soa Suite project only needs this reference service at runtime and we won't have any deployment issues or invalid composites after a reboot of the Soa Suite Service.

Next step is to create a Token file which contains some server host entries, we can use this file in the JDeveloper Token wizard or later when we want to import these Tokens in the Oracle Enterprise Manager.  See this url for an Token xml example http://docs.oracle.com/cd/E28280_01/dev.1111/e10224/sca_bindingcomps.htm#CIHFJFJC

I added two host key values entries 

Click the token button of the composite.xml editor.

Select our reference service and click on edit.

Lookup the just created Token file and on the Host field we can lookup our LocalSoaServer entry.

This will change the location attribute to http://${LocalSoaServer}:8001.....

We are ready to compile the project.


The Soa Suite server does not know this LocalSoaServer token so we need to create this token in the Enterprise Manager.

Go to SOA Infrastructure -> SOA Administration -> Token Configurations.

Click on Modify Configuration File and add a new token.

Add the LocalSoaServer Token with its value.

Commit this token.

 This will update the mdm-url-resolver.xml file located in the config/fmwconfig folder of the weblogic soa domain.

 We can also upload the Token file of JDeveloper, this will add the missing tokens.

You need to reboot the Soa Server, after this you can deploy the main project and test the main project.

here is the demo workspace with all the above code.

Testing Activiti BPM on WebLogic 12c

Activiti is a great open source workflow + BPM platform, which you can use in your own java application (embedded) or test it in the provided Rest or Web demo applications. Activiti also provides  an Eclipse designer plugin which you can use to create your own BPMN 2.0 definitions and export this to the Activiti applications.

In blogpost I will show you the steps how to get this working on the WebLogic 12c JEE container and in Oracle Enterprise Pack for Eclipse as IDE.

First step is to download OEPE , Coherence and WebLogic 12c and install WebLogic with OEPE.

Next step is to start Eclipse and create a workspace.
After the initial eclipse setup, we can add the Activiti designer plugin to Eclipse. Go to Help menu and Install New Software
Use http://activiti.org/designer/update/ as value in the Work with field and select Activiti BPMN Designer

Finish the installation.

Download Activiti ( I used 5.12 version ) and extract the zip.

We need to update the WebLogic Jackson Core and Mapper JSON jars so these matches with the two demo application wars ( else you get some jackson reporting errors )

cp ../activiti-5.12/wars/activiti-explorer/WEB-INF/lib/jackson-core-asl-1.9.9.jar /Oracle/Middleware12.1/modules/org.codehaus.jackson.core.asl_1.1.0.0_1-8-3.jar

cp ../activiti-5.12/wars/activiti-explorer/WEB-INF/lib/jackson-mapper-asl-1.9.9.jar /Oracle/Middleware12.1/modules/org.codehaus.jackson.mapper.asl_1.1.0.0_1-8-3.jar

Now we can add a new server to your Eclipse workspace and create a new WebLogic domain.

For the Rest Activiti demo which uses its own basic authentication we need to disable the WebLogic authentication interception. You can do this by opening the config.xml of the WebLogic domain in an editor and add
<enforce-valid-basic-auth-credentials>false</enforce-valid-basic-auth-credentials> just above the end tab of the security-configuration element

Next steps is to extract the two demo applications. This way we can deploy these wars as WebLogic exploded folders. Now we can easily change the Activiti configuration files without making new wars ( change what you like and restart WebLogic server).

The demo activiti-explorer and activiti-rest applications need to have its own repository database , I will use MySQL ( tried Oracle as database but this will give me a lot of SQL group by and Month , Year errors ).

Here are my MySQL statements.

create database activiti;
create database activiti2;

create user 'activiti'@'%' identified by 'activiti';
grant all on activiti.* to 'activiti'@'%';
grant all on activiti2.* to 'activiti'@'%';

create user 'activiti'@'localhost' identified by 'activiti';
grant all on activiti.* to 'activiti'@'localhost';
grant all on activiti2.* to 'activiti'@'localhost';

mysql activiti -u activiti -pactiviti < ../activiti-5.12/database/create/activiti.mysql.create.engine.sql
mysql activiti -u activiti -pactiviti < ../activiti-5.12/database/create/activiti.mysql.create.history.sql
mysql activiti -u activiti -pactiviti < ../activiti-5.12/database/create/activiti.mysql.create.identity.sql

mysql activiti2 -u activiti -pactiviti < ../activiti-5.12/database/create/activiti.mysql.create.engine.sql
mysql activiti2 -u activiti -pactiviti < ../activiti-5.12/database/create/activiti.mysql.create.history.sql
mysql activiti2 -u activiti -pactiviti < ../activiti-5.12/database/create/activiti.mysql.create.identity.sql


Next we can update the db.properties file in activiti-explorer/web-inf/classes folder

db=mysql
jdbc.driver=com.mysql.jdbc.Driver
jdbc.url=jdbc:mysql://localhost:3306/activiti?autoReconnect=true
jdbc.username=activiti
jdbc.password=activiti

Also update the db.properties file of the activit-rest application also in /web-inf/classes folder

db=mysql
jdbc.driver=com.mysql.jdbc.Driver
jdbc.url=jdbc:mysql://localhost:3306/activiti2?autoReconnect=true
jdbc.username=activiti
jdbc.password=activiti

Deploy these exploded web applications to WebLogic.

After a successful deployment of these two application we can shutdown the WebLogic container so we can disable the second time demo data generation. ( the rest demo application does not have demo data )

For this we need to update the activiti-standalone-context.xml in activiti-explorer/web-inf/classes 

put these demoDataGenerator entries to false

  <bean id="demoDataGenerator" class="org.activiti.explorer.demo.DemoDataGenerator" init-method="init">

    <property name="processEngine" ref="processEngine" />

    <property name="createDemoUsersAndGroups" value="false" />

    <property name="createDemoProcessDefinitions" value="false" />

    <property name="createDemoModels" value="false" />

    <property name="generateReportData" value="false" />

  </bean>

Startup WebLogic and so we can test the demo applications.

Go to http://localhost:7001/activiti-explorer
use kermit as username / password

Go to Vacation request proces and click Start Process

Complete the Form

The manager must approve

Claim and complete the task

Optionally look at the activity reports.

Or manage the repository.

For the Rest Activiti demo application we first need to fill the user, groups tables.

 Add an admin record to act_id_group

Add the kermit user

Assign admin group to the kermit user

Next steps we can test the rest services

I will use the Advanced Rest Client plugin of Google Chrome browser.

First check the login of the kermit user

Next step is to retrieve the kermit user details.
We need to provide Authorization: Basic HTTP Header property with kermit:kermit as value in base64 encoding

The last part is the Activiti Designer in Eclipse.

Create an Activiti Project and after that import or add an Activiti Diagram.

Open the BPMN process

Design your process.

Export your process from the Package Explorer.

Upload the generated bar export file to the activi-explorer application or to the rest application ( use basic authentication, upload the bar file and use application/x-www-form-urlencoded as Content-Type )

I also greated a LDAP module so you can use Activiti with a LDAP repository as Active Directory, OpenLDAP or the internal WebLogic LDAP.

https://github.com/biemond/activiti

ldap groups with admin and user as cn have security-role as type
rest of the group are automatically jave assignment as type

requires the following jars
activiti-engine-5.12.jar
ldap-client-api-0.1.jar
shared-all-0.9.18.jar

That's all.

Active Directory user management with the IdentityStore framework of FMW

With the IdentityStore framework of Fusion Middleware you can change or create any user or role in almost every LDAP server. With this framework the authenticated user change their own password from ADF or in your own ADF Admin page you can create an user with its roles without knowing LDAP or know what LDAP server is used.

IdentityStore framework will automatically detect the configured WebLogic LDAP servers. Default is the internal WebLogic LDAP and this is also the first authenticator. You can also add other LDAP servers like Microsoft Active Directory or Oracle Internet Directory. For this you need to set the virtualize property with true as value to the idstore.ldap serviceInstance entry.
In this case I will set the AD Authenticator as first authenticator and don't use virtualize property, this way I can retrieve all the LDAP attributes and know for sure that new users are created in AD and not in the local WebLogic LDAP.

To create an user or change a password in AD we need to use LDAPS ( port 636 and not 389 ).  Else you will get this error javax.naming.OperationNotSupportedException: [LDAP: error code 53 - 00002077: SvcErr: DSID-03190E49, problem 5003 (WILL_NOT_PERFORM), data 0 ];

This means we need to configure SSL.

The first step is to import the AD ca key and the AD public key to the local WebLogic TrustStore keystore.

keytool.exe -importcert -trustcacerts -alias ad_ca -file C:\2008-ca.cer -keystore C:\oracle\JDEV11~1.6\WLSERV~1.3\server\lib\DemoTrust.jks -storepass DemoTrustKeyStorePassPhrase

Trust this certificate? [no]: yes

keytool.exe -importcert -trustcacerts -alias ad_pub -file C:\2008-pub.cer -keystore C:\oracle\JDEV11~1.6\WLSERV~1.3\server\lib\DemoTrust.jks -storepass DemoTrustKeyStorePassPhrase

We also need to set the Hostname verification to None.

Create the AD Authenticator and also put all Control Flag to Sufficient ( also the default Authenticator )

We need to use LDAPS so use 636 as Port and enable SSL

Restart the Weblogic server and check if you can see all the AD users and the AD roles in the WebLogic Console .


Here is the java code to change the password of the AD user

Here is the code to create an AD User with a password, add an AD role to this user and set the UserAccountControl to 66048.

Here you can download the demo application at github