► How "secure" is your Site Studio site?

NOTE: This only applies to sites hosted directly off of Site Studio; meaning, not published via the Site Studio Publishing Utility (SSPU).

If you don't know how content is secured within Site Studio, expand this:

---

Inherently, Oracle UCM uses two levels of content security:  security groups and, optionally, accounts.  Site Studio sits on top of the content server as the presentation layout for the web sites it hosts, but the content is still secured in the same manner.

A Site Studio page consists of:

1. Fragments
2. Layout Files/Page Templates (.hcsp files)
3. Content (data files, native documents, etc)
4. Assets (images, javascript, etc)

At the minimum, unauthenticated visitors need to have (R)ead access to every piece mentioned above in order to view a Site Studio site unfettered.  This "anonymous user" access is defined by a combination of the Guest role and the account(s) identified by the DefaultAccounts config variable.

---

In my experience, many places have a poorly designed security and metadata model (not to mention an un-normalized one).  As a result, I have seen many implementations give the anonymous user (R)ead access to ALL security groups and the #all account.  In my opinion, there is no chance that 100% of your content is "web ready" and insensitive by nature.  Is it possible?  Sure, but I'm more likely to be the Redskins' quarterback next year, so why expose your web site and content server unnecessarily?

What's my point in all this?

What if I were to say that I could obtain copies of your entire fragment libraries, along with your layout pages, and also know the names and email addresses of those who edited them?

How?

► Credential Maps - Tips & Tricks

NOTE:  This post assumes you authenticate externally with Active Directory (AD), have a basic understanding of its schema and Security Groups (ADSGs), already have a working LDAP provider, and have a separate LDAP role/account prefix for each of your UCM instances.

Chances are that if you authenticate externally, you've tested your luck with credential maps.  I say "luck" because deciphering its syntax for the first time is akin to waiting in line to use the restroom:  frustratingly painful.  In a nutshell, credential maps are a part of the ProxyConnections8 component that allow you to link ADSGs (and their members) to Oracle UCM roles and/or accounts.

If you need a credential map that can link everything one-to-one:

---

ADSG		Role/Account
admin	»	admin
contributor	»	contributor
intern	»	intern
Corporate_R	»	Corporate(R)
ImageLibrary_RW	»	ImageLibrary(RW)

---

use the following:

---

#Maps all roles

|#all|,       %%

#Maps all accounts

@|#all|,    @%%

---

Note:  the #all term does not refer to an ADSG named #all; it is a reserved keyword to signify ALL ADSGs listed within the LDAP Role/Account Prefix OU.

As powerful as the above map is, it has one fundamental flaw:

It doesn't map the #none and #all accounts