java.net.socketpermission on WebCenter Content (UCM) Applets

After the one of the last updates of my local JRE I couln't connect to the UCM Applets of the client throught the proxy connection.

This error appears:

To solve this issue, go to your "java.policy" file, mine is under this path:

C:\Program Files (x86)\Java\jre7\lib\security\java.policy

Modify your file and add this line at the end of the file:

permission java.net.SocketPermission "*", "connect,accept,resolve"; 

After that modification, close all your browsers and retry to open the Applet.

NullPointerException in VCR_GET_CONTENT_TYPE service

Recently I was debugging an error in WebCenter Portal, that didn't allow the user to search over a content-server instance with a Content-Presenter TaskFlow.

In this case, we had 2 instances of UCM connected to WebCenter Portal application, the first one works without problems, but when we attached the second one, and you try to query over it, the page is refreshed and the content-presenter wizard is closed.

The Portal log shows this error:

Caused By: oracle.stellent.ridc.protocol.ServiceException: Could not load information about VCR content type. Unable to execute service method 'vcrGetContentTypeInfo'. The error was caused by an internally generated issue. The error has been logged.
 at oracle.stellent.ridc.protocol.ServiceResponse.getResponseAsBinder(ServiceResponse.java:135)
 at oracle.stellent.ridc.protocol.ServiceResponse.getResponseAsBinder(ServiceResponse.java:107)

And looking at UCM log this error is shown:

services/3 02.07 15:22:14.039 IdcServer-89 !csUserEventMessage,sysadmin,CIS!$ intradoc.common.ServiceException: !csVcrCouldNotLoadContentType!csUnableToExecMethod,vcrGetContentTypeInfo
 services/3 02.07 15:22:14.039 IdcServer-89 *ScriptStack VCR_GET_CONTENT_TYPE
 services/3 02.07 15:22:14.039 IdcServer-89 3:vcrGetContentTypeInfo,**no captured values**
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.ServiceRequestImplementor.buildServiceException(ServiceRequestImplementor.java:2115)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.buildServiceException(Service.java:2260)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.createServiceExceptionEx(Service.java:2254)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.createServiceException(Service.java:2249)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.ServiceHandler.executeAction(ServiceHandler.java:102)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.doCodeEx(Service.java:533)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.doCode(Service.java:505)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.ServiceRequestImplementor.doAction(ServiceRequestImplementor.java:1643)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.doAction(Service.java:477)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.ServiceRequestImplementor.doActions(ServiceRequestImplementor.java:1458)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.doActions(Service.java:472)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.ServiceRequestImplementor.executeActions(ServiceRequestImplementor.java:1391)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.executeActions(Service.java:458)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.ServiceRequestImplementor.doRequest(ServiceRequestImplementor.java:737)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.Service.doRequest(Service.java:1890)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.ServiceManager.processCommand(ServiceManager.java:435)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.IdcServerThread.processRequest(IdcServerThread.java:265)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.IdcServerThread.run(IdcServerThread.java:160)
 services/3 02.07 15:22:14.039 IdcServer-89         at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:528)
 services/3 02.07 15:22:14.039 IdcServer-89         at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
 services/3 02.07 15:22:14.039 IdcServer-89         at weblogic.work.ExecuteThread.run(ExecuteThread.java:178)
 services/3 02.07 15:22:14.039 IdcServer-89 Caused by: java.lang.NullPointerException
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.vcr.VcrServiceHandler.addPropertyChoicesForFieldAndView(VcrServiceHandler.java:514)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.vcr.VcrServiceHandler.vcrGetContentTypeInfo(VcrServiceHandler.java:464)
 services/3 02.07 15:22:14.039 IdcServer-89         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 services/3 02.07 15:22:14.039 IdcServer-89         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
 services/3 02.07 15:22:14.039 IdcServer-89         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
 services/3 02.07 15:22:14.039 IdcServer-89         at java.lang.reflect.Method.invoke(Method.java:597)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.common.IdcMethodHolder.invokeMethod(IdcMethodHolder.java:86)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.common.ClassHelperUtils.executeMethodReportStatus(ClassHelperUtils.java:324)
 services/3 02.07 15:22:14.039 IdcServer-89         at intradoc.server.ServiceHandler.executeAction(ServiceHandler.java:79)
 services/3 02.07 15:22:14.039 IdcServer-89         ... 16 more

After seeing that the problem resides at UCM service execution we see that the status-code returned is -32. (Any status-code lower than 0 means service execution error).

Looking at the dDocTypes all appears correctly, but after accessing to the "Check-in" form, some errors can give us an idea of the problem. When I access to check-in form, some alerts are showed to the user indicating that some of the metadata "views" seems corrupted.

To find out wich metadata is the one that uses that view, I've opened Firebug and look for that view on JS files.

The metadata called "xIsEditable" is using YesNoList view, its recommended to perform more search and see how many metadata fields are using that view.

The problem in this case was that the view was empty and didn't have any value, this causes the NPE (NullPointerException) in the execution of the service VCR_GET_CONTENT_TYPE.

After adding values to the view, and going back to check-in page, no more "alert" of view errors were shown.

Now the UCM is ready to be used again with content-presenter, and the problem solved.

Showing first tab always in a ADF panelTabbed

Oracle ADF panelTabbed component has the capability of remember the last Tab that the user keeps opened.

When the user get back to the page or taskflow that contains the af:panelTabbed, the last tab opened will be shown instead of the first tab.

If you want to show always first tab as "opened", there is a couple of parameters at the af:showDetailItem that will help us.

This  is a sample code that will make the trick:

<af:panelGroupLayout id="pgl1" layout="vertical">
  <af:panelTabbed id="ptab1" position="above">
    <af:showDetailItem text="First" id="sdi1" persist="disclosed" disclosed="true"/>
    <af:showDetailItem text="Second" id="sdi2" persist="disclosed" disclosed="false"/>
    <af:showDetailItem text="Third" id="sdi3" persist="disclosed" disclosed="false"/>
  </af:panelTabbed>
</af:panelGroupLayout>  

 Check ADF Tag Library

• af:panelTabbed
• af:showDetailItem

Big thanks to my co worker María for finding the solution :-)

Download sample project

Validate check-in form fields with Javascript

At one of my current projects we faced the problem that the dDocName field was filled with no common characters by the user.

For example they insert spaces and letters (like áéíóú). This kind of contentID was breaking the indexer process of UCM.

Most of you will tell me to use the AUTO_NUMBER property of content server, but on some type of content, the user have to insert a specified dDocName for our SSXA Web project.

To prevent contentID like "BIOGRAFÍA CATALÁN", we developed a custom component that performs a JS validation before check-in process.

For the validation I've created a REGEX expresion that allows only letters, numbers and underscore.

This is the code inserted in the custom-component. As you see, this will "include" all system validations with the <$include super.custom_schema_validation_script_post$> sentence.
After that, starts our custom validation, we only have to return "false" if we want to cancel the check-in process.

<@dynamichtml custom_schema_validation_script_post@>
<$include super.custom_schema_validation_script_post$>
<$if ((dpAction like "CheckinSel" or dpAction like "CheckinNew" or dpAction like "Update"))$>
if (document.Checkin != null && document.Checkin.dDocName != null)
{
var name = document.Checkin.dDocName.value;
if(name != null && name != '' && name.length > 0)
{
 var rgx_docname = /^[A-Za-z0-9_]{1,30}$/;
 
 if (rgx_docname.test(name))
 {
  vstatus = "Ok";
 }
 else
 {
  vstatus = "Error";
  alert("Error: You cannot use non-ASCII characters for ContentID");
  return false;
 }
}
}
<$endif$>   
<@end@>

Download here the custom-component for your customization and use.

Using WebCenter REST API from Java

Most WebCenter services are available over REST access. In this example app we will try to connect to our development Spaces instance and get the list of spaces for the user.

The REST API supports two kind of different authentication, depending where you use the Java code. If you are creating a taskflow to be deployed on same domain of the spaces node, you should use "OIT" auth, this kind of auth does not need the user password on each request to the server.

Instead, if your code is outside of the weblogic domain, you must send (user + password) on each request.

This sample app have a boolean flag to enable "development-mode" that means connection from outside of weblogic domain (for example my local JDeveloper).

Keep in mind that on each request you should have the URL access to your REST API, to generate that URL you need before the userToken.

//Get the client connnection
RESTUtils rest = new RESTUtils();
rest.setDevelopmentMode(true);

//Get weblogic user token
String userToken = rest.getUserToken();

//Creation of endpoint URL

//Sample URL: http://owc:8888/rest/api/spaces?utoken=FMgUQjBKZ96NGgwGdlZrX-WJACJ4_w**
URL endpoint = new URL(RESOURCE_INDEX + UTOKEN + userToken);

//Establishing connection
HttpURLConnection connection = rest.getConnection(endpoint);

This is the sample output of the app after executing the class WCSpaces.java

5-sep-2012 10:34:33 webcenter.rest.RESTUtils getUserToken
INFO: Obtaining user token
25-sep-2012 10:34:33 webcenter.rest.RESTUtils getConnection
INFO: We are connecting in development mode
25-sep-2012 10:34:33 webcenter.rest.RESTUtils getConnection
INFO: Auth sent:Basic d2VibG9naWM6T3JhY2xlMTFn
25-sep-2012 10:34:33 webcenter.rest.RESTUtils getConnection
INFO: Finished development connection to http://owc:8888/rest/api/resourceIndex
25-sep-2012 10:34:33 webcenter.rest.RESTUtils getUserToken
INFO: Obtained token:FMgUQjBKZ96NGgwGdlZrX-WJACJ4_w**
25-sep-2012 10:34:33 webcenter.rest.RESTUtils getConnection
INFO: We are connecting in development mode
25-sep-2012 10:34:33 webcenter.rest.RESTUtils getConnection
INFO: Auth sent:Basic d2VibG9naWM6T3JhY2xlMTFn
25-sep-2012 10:34:33 webcenter.rest.RESTUtils getConnection
INFO: Finished development connection to http://owc:8888/rest/api/spaces?utoken=FMgUQjBKZ96NGgwGdlZrX-WJACJ4_w**
25-sep-2012 10:34:33 webcenter.rest.WCSpaces getSpaces
INFO: Space displayName:blog
25-sep-2012 10:34:33 webcenter.rest.WCSpaces getSpaces
INFO: Space displayName:test
Process exited with exit code 0.

As you see, both "displayName" of the spaces are obtained.

Here is the sample app for download.

And finally the Oracle Documentation about REST

• Using Oracle WebCenter Portal REST APIs

Disable component resizing in Oracle Composer

When using Oracle Composer sometimes apper an icon under componentes that allows resizing in runtime.

Check this image

As you see, appears an icon at the botton-right of the component with an appaerance of a triangle. This icon/behaviour can be disabled editing TaskFlow properties and disabling the option.

This action should be performed every time we add a new TaskFlow so is quite annoying.

To disable all resizing behaviour in our portal we have to modify our adf-config.xml file including this lines

  <customizableComponentsSecurity xmlns="http://xmlns.oracle.com/adf/faces/customizable/config">
    <enableSecurity value="true"/>
    <actionsCategory>
      <actionCategory name="personalizeActionsCategory" value="true"></actionCategory>
      <actionCategory name="editActionsCategory" value="true"/>
      <actions>
        <action name="showResizer" value="false"/>
      </actions>
    </actionsCategory>
  </customizableComponentsSecurity>

After this modification, the components won't show the "resize" icon any more.

Sources: Oracle Documentation

• http://docs.oracle.com/cd/E21764_01/webcenter.1111/e10148/jpsdg_page_editor_security.htm#CHDGDDDI
• http://docs.oracle.com/cd/E21764_01/webcenter.1111/e10148/jpsdg_app_rc.htm#BABJCJDD

Configuración REST para WebCenter Spaces (PS3, PS4)

WebCenter Spaces incluye una API REST para consumir sus servicios, esta API es necesaria para alguno de los siguientes casos:

• Utilizar la aplicación de iPhone / iPad
• Utilizar datos de Spaces desde una aplicación WebCenter Portal
• Subir recursos a Spaces (PageTemplate, Content Presenter Templates, etc...)

Para mi ejemplo voy a configurar mi máquina virtual (owc) para que permita este tipo de conexiones.

Es importante indicar que esto solo es necesario en WebCenter PS3 y PS4, en la nueva PS5 ya viene configurado de serie.

Probamos a conectar a la siguiente URL:

• http://<host>:<port>/rest/api/resourceIndex

En mi caso: http://owc1:8888/rest/api/resourceIndex





Como se puede observar no tenemos acceso, realizaremos los pasos que incluye la documentación oficial, que consiste en:

• Configurar Identity Asserter
• Configurar el servidor de almacenes de credenciales.

Pasos a seguir

1.- Creamos el keystore

cd /oracle/jdk/bin (cualquier directorio Java)

./keytool -genkeypair -keyalg RSA -dname "cn=spaces,dc=oracle,dc=com" -alias orakey -keypass welcome1 -keystore /home/oracle/default-keystore.jks -storepass welcome1 -validity 1064

./keytool -exportcert -v -alias orakey -keystore /home/oracle/default-keystore.jks -storepass welcome1 -rfc -file /home/oracle/orakey.cer

./keytool -importcert -alias webcenter_spaces_ws -file /home/oracle/orakey.cer -keystore /home/oracle/default-keystore.jks -storepass welcome1

./keytool -importcert -alias df_orakey_public -file /home/oracle/orakey.cer -keystore /home/oracle/default-keystore.jks -storepass welcome1

2.- Lo copiamos a (Todos los manejados)

cp /home/oracle/default-keystore.jks /oracle/middleware/user_projects/domains/dev_domain/config/fmwconfig

scp /home/oracle/default-keystore.jks oracle@owc2:/oracle/middleware/user_projects/domains/dev_domain/config/fmwconfig/

vi /oracle/middleware/user_projects/domains/dev_domain/config/fmwconfig/jps-config.xml

Añadimos:

<propertySet name="trust.provider.embedded">
<property value="oracle.security.jps.internal.trust.provider.embedded.EmbeddedProviderImpl" name="trust.provider.className"/>
<property value="60" name="trust.clockSkew"/>
<property value="1800" name="trust.token.validityPeriod"/>
<property value="false" name="trust.token.includeCertificate"/>
<property value="orakey" name="trust.aliasName"/>
<property value="orakey" name="trust.issuerName"/>
</propertySet>

3.- Configuro el JKS a través de wlst.sh

/oracle/middleware/Oracle_WC1/common/bin/wlst.sh

connect('weblogic','Oracle11g','t3://owc1:7001')
updateCred(map="oracle.wsm.security", key="keystore-csf-key", user="owsm", password="welcome1", desc="Keystore key")

updateCred(map="oracle.wsm.security", key="enc-csf-key", user="orakey", password="welcome1", desc="Encryption key")

updateCred(map="oracle.wsm.security", key="sign-csf-key", user="orakey", password="welcome1", desc="Signing key")

disconnect()

exit()

4.- Reiniciamos los servidores

Reiniciamos todos los servidores manejados.

5.- Configuramos WLS Trust Service Asserter

1. Accedemos a la consola de WLS
2. Navegamos a Security Realms -> myrealm
3. Nuevo proveedor de autenticación
4. Nombre del "asserter" (por ejemplo, TrustServiceIdAsserter).
5. Seleccionamos TrustServiceIdentityAsserter como tipo.
6. Activar cambios

6.- Configuramos a través de WLST

/oracle/middleware/Oracle_WC1/common/bin/wlst.sh

connect('weblogic','Oracle11g','t3://owc1:7001')

createCred(map="o.webcenter.jf.csf.map", key="keygen.algorithm", user="keygen.algorithm", password="AES")

createCred(map="o.webcenter.jf.csf.map", key="cipher.transformation", user="cipher.transformation", password="AES/CBC/PKCS5Padding")

disconnect()
exit()

7.- Reiniciamos los servidores

Reiniciamos los nodos manejados

Por último, accedo a: http://owc1:8888/rest/api/resourceIndex y vemos el resultado obtenido

Fuentes de información:

• Documentación oficial
• http://docs.oracle.com/cd/E21764_01/webcenter.1111/e10148/jpsdg_rest_api.htm#CDEBFIII