Integration between Oracle Access Manager and Oracle Entitlement Server

This post describes the aspects of the integration between Oracle Entitlement Server and Oracle Access Manager. As we know that from 11g onwards, Oracle recommends OAM for authentication, SSO and OES for Authorization. Hence it's always good to know how this integration works.

Frankly, there is no integration between OAM and OES. The ease of the product OES allows us to integrate with various applications and utilise OES for ATZ. 

In my case, I have implemented the scenario as explained below.

The Weblogic Portal 10.2 will be authenticated using OAM and the authentication scheme can be used as Basic over Ldap or Form (I have done Basic Over LDAP for timebeing). 

Upon successful authentication using OAM, access server generates obssocookie and sends it to browser. However the front end here is the OHS proxy server for weblogic portal resource.
Hence the plugin in proxy server (mod_weblogic) will forward this request to the Weblogic Security Framework. WLS framework will inturn trigger the SSPI interface where the weblogic server SSM is being configured (as SSM realm). 

The providers that are configured are:
1. OAM Identity Asserter
2. LDAP Authenticator

The OAM 10.1.4.3 package provides the oamAuthnProvider.jar which should be copied to the weblogic server directory (wls_server103\mbeantypes\lib).
Once the request is passed to the SSPI interface of OES, the OAM identity Asserter (flagged as REQUIRED) kicks in and checks for ObSSOCookie in the request. If it exists then weblogic will validate the user against the LDAP using LDAP Authenticator. 

At this point, the resource is authorised at page level by OAM.
Now, its time for OES to do the page level and content level authorization.
Based on the resources and policies (ATZ and Role) configured in OES, it fetches the user accessing the resource and executes Role and ATZ policies. If the user is allowed GRANT, then the user will be shown the requested page.
If there are any ALES tags specified in the application for content level atz, it gets executed.

I will attach the architecture diagram soon.
Various products used in this integration are:
1. Oracle Access Manager 10.1.4.3
2. Oracle Entitlement Server 10.1.4.3 (Admin CP3, SSM CP3)
3. Weblogic Portal 10.2.0

Uninstall ALES Schema or Re-running DB Config tool

          As we know that it is pretty straight forward to create the ALES schema using DB Config tool. I am writing here something which is not documented anywhere as to how to re-run the DB config tool if wrong values are specified for oes username or password etc.,
               Here are the steps to be followed to revert and re-run the DB config tool. This assumes that the user created is oesdbuser while running the dbconfig tool.

1. Connet to sqlplus as sys user.
2. Execute the command "revoke asi_role from oesdbuser; "
3. Execute the command Execute the command "drop user oesdbuser cascade; "
4. Execute the command "revoke create trigger from asi_role;"
5. Execute the command "revoke create sequence from asi_role;"
6. Execute the command "revoke create table from asi_role;"
7. Execute the command "revoke create session from asi_role;"
8. Execute the command "drop tablespace ales_oracle including contents and datafiles;" 

Now, you can re-run the DB config tool safely.

Fine grained authorization of Weblogic Portal using Oracle Entitlement Server

Hi all,
This time I have come up with a viewlet which shows the fine grained atz of weblogic portal using OES. Fine grained atz includes page (portlet) level access and content level access based on roles specified in the OES.

I would also like to share some of the gotchas that I came up with during this OES-WLP integration. I followed the OOTB SimplePortalExample that is provided in examples folder of WL-SSM. I have found few differences with my application and SimplePortalExample. The resource PortalDefinitionManager should be created in netuix.jar which is under ejb resource.
So the final resource structure should look like ejb -> netuix.jar -> PortalDefinitionManager -> create. The authorization policy should be defined to provide execute permission to Administrator users which are weblogic and portaladmin.

Products used:
Oracle Entitlement Server 10.1.4.3 (CP3 for Admin WL-SSM)
Weblogic Portal 10.2.0

Note: Only weblogic Portal 10.2.0 is certifed with OES at the moment. I tried with Weblogic Portal 10.3.0 to test it and it failed to start the portal server after SSM instance creation.

For Viewlet and sample portal application with OES tags, please contact me.
 

Installing OES on 11g R1 Weblogic 10.3.1

Now its time to share the information that OES Admin server works with Weblogic server 10.3.1.
The steps followed are as shown in blog.
I have also tried with WLS 10.3.2 and it worked fine with Admin server and patching to CP3 had no problems. We are also able to access the OES consoles. However the problems arised after running configtool for WLS SSM. Hence its good not to try with WLS 10.3.2.
Watch this blog for more info on integrations with Weblogic Portal and Sharepoint coming soon.

Cookie less SSO with OAM

The cookieless single sign-on session support with OAM can be provided by placing the Oracle WebCache between user's browser and web server as depicted in above figure.

End-user can either use separate WebCache instances for each backend web server, or use the common WebCache instance which will be shared by multiple backend web servers. 

The Web Cache component provides cookie management, using the SSL session Id as key. The SSL sessions are mandatory for this solution, and they are established between the user’s browser and the OHS servers.    

The Single Domain single sign-on flow will be very similar to the cookie-based solution.  The main difference will be when the Oracle Access Manager WebGate sets a cookie, the cookie will be cached in the Web Cache instance, keyed using the SSL session ID.  When the user accesses the servers again later on, Web Cache retrieves the relevant cookies tied to this SSL session ID, and makes them available to the downstream servers and applications. 

Note that in this solution, the cookies are never made available to the end-user’s browser.  Assuming the Web Cache instances are protected by a firewall, then the cookies never need to go outside the protection of the firewall.

During logout, Oracle Access Manager WebGate will clean up their respective cookies by setting the obssocookie to “loggedoutcontinue”The Web Cache, when received such requests, removes the cookies from its cookie cache.

Oracle SSO provisioning for APEX

This section deals with provisioning Oracle SSO for APEX application.
1. Register APEX as partner application in Oracle Application server.
Note some of the details as shown below.
ID: 80F63272
Token: 51J0903680F63272
Encryption Key: EBBD933BC541FAFF
Login URL: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Single Sign-Off URL: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_logout
Name : APEX
Home URL : http://apex_hostname:8080/apex
Success URL : http://apex_hostname:8080/apex/wwv_flow_custom_auth_sso.process_success
Logout URL :http://apex_hostname:8080/apex
This Application Name APEX will be used in 5th step while associating SSO application name in the Authentication scheme.
2. Next step is to install SDK package and configuration.
Extract the sdk902.zip file present in middle tier to the local machine.
Login as FLOWS_xxxx user and execute @loadsdk.sql.
Then logout and login again, and execute @regapp.sql by inputting some parameters of Partner application.
Enter value for listener_token: HTML_DB:sbpdb.idc.oracle.com:8080
Enter value for site_id: 80F63272
Enter value for site_token: 51J0903680F63272
Enter value for login_url: http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Enter value for encryption_key: EBBD933BC541FAFF
Enter value for ip_check: N
It is important that listener_token should be in the format HTML_DB:hostname_where_apex_installed:port_no_apex_listens.
When the registration is successful, then the result will be as shown below:
Registration successful.
Listener token: HTML_DB:sbpdb.idc.oracle.com:8080
Site id : 80F63272
Site token : 51J0903680F63272
Encryption key: EBBD933BC541FAFF
Login URL : http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
Logout URL : http://directory_server_hostname:7777/pls/orasso/orasso.wwsso_app_admin.ls_logout
IP check : N
3. Third step is to execute custom_auth_sso_902.sql and custom_auth_sso_902.plb as FLOWS_xxxx user.
4. Grant execute permissions as shown below:
grant execute on wwv_flow_custom_auth_sso to APEX_PUBLIC_USER;
5. Login to APEX console, and create Authentication scheme with name CUSTOM SSO and map the SSO Partner application as APEX (as in the first step).

Congrats, you have finished SSO configurations for APEX.
Now login to apex application (for eg, http://apex_hostname:8080/apex/f?p=104:2) and check SSO login page will be displayed.

Caveats & Bugs identified while installing OAM on Linux

Ensure that following conditions are met while installing OAM on linux. Typically you will face issue after webpass installation while starting HTTP Server.
OAM 10.1.4.3:
1. While starting OIS Server
Error:
/disk1/oracle/Middleware/OAM/identity/oblix/apps/common/bin/ois_server: error while loading shared

libraries: libdl.so.2: cannot open shared object file: No such file or directory
rm: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or

directory
OIS Server started with pid: 21290
[oracle@ATL2-LNX01 bin]$ /bin/sh: error while loading shared libraries: libdl.so.2: cannot open shared

object file: No such file or directory

Solution: comment out all the lines where it is setting LD_ASSUME_KERNEL to 2.4.19 in start_ois_server

script OR run the script start_ois_server_nptl.

2. gcc libraries incompatibilty
Error:
/disk1/oracle/Middleware/WebTier/ohs/bin/apachectl startssl: execing httpd
httpd.worker: Syntax error on line 1047 of

/disk1/oracle/Middleware/WebTier/instances/instance1/config/OHS/ohs1/httpd.conf: Cannot load

/disk1/oracle/Middleware/OAM/ohswebpass/identity/oblix/lib/libgcc_s.so.1 into server:

/disk1/oracle/Middleware/OAM/ohswebpass/identity/oblix/lib/libgcc_s.so.1: wrong ELF class: ELFCLASSS32

Solution: libgcc_s.so.1 will be present in /usr/lib64 or /lib64 directories. So should copy those gcc lib

into the oblix lib location.
Similarly copy libstdc++.so.5 from OS binaries.


OAM 10.1.4.2:
1. Open the httpd.conf file and comment the perl module as shown below.

 #LoadModule perl_module        libexec/libperl.so

2. Add Kernel param value in OHS/opmn/conf/opmn.xml file as shown below.
                        
               
               
           
               
               
           
                      .......
                          
3. Disable ssl in OHS/opmn/conf/opmn.xml as shown below for HTTP_Server component tab.

             
                 
                 
             
                            


Bugs identified while upgrading to OAM 10.1.4.0.2 BP02:

When installing the 10.1.4.2.0 BP02 patch (Patch 6748699 or 5957301), against a 10.1.4.2.0 installation, you will receive the following error:

For Webpass:

    --- Oracle Access Manager install ---
    Error: You are trying to apply patch of Oracle WebPass for different server
    while the component Oracle WebPass is installed for different server.
    This is not supported

For Policy Manager:

    --- Oracle Access Manager install ---
    Error: You are trying to apply patch of Oracle Policy Manager for different
    server while the component Oracle Access Manager is installed for different
    server.
    This is not supported.

For WebGate :
    --- Oracle Access Manager install ---
    Error: You are trying to apply patch of Oracle Webgate for different
    server while the component Oracle Access Manager is installed for different
    server.
    This is not supported.


You are sure that you are using the correct patch installer for the component you are trying to patch
It is caused by a long path to the installation binary identified as Bug 6996850.

As a workaround, move the binary for the patch to a location with a shorter path. For example:
This fails:
    /scratch/download/OAM10_Release2_BP02_Patch/Oracle_Access_Manager10_1_4_2_0_BP02_Patch_linux_APACHE2_WebPass_binary_parameter
This works:
    /u01/orasoft/wgpatch/Oracle_Access_Manager10_1_4_2_0_Patch_linux_OHS_WebGate_binary_parameter

Integrating Access Manager with Oracle SSO

The following steps discuss the integration of Oracle Access Manager with Oracle Application Server.
(This is not applicable to a standalone oc4j.).

1. User accesses OAM protected application deployed on Oracle Application Server and webgate intercepts that request.
2. Webgate checks with the Access Server if the resource is protected.
3. When the resource is protected, Webgate prompts for the username and password (depends on authentication scheme selected for the resource in Policy Manager).
4. The credentials are validated by the Access Server against the LDAP server.
5. When authentication is successful, OAM cookie ObSSOCookie is set in the browser.
6. Upon successful authentication, Access System determines if the user is authorized to access the resource.
6. Upon successful authorization, Access system executes actions and sets HTTP Header variables that maps to the Oracle AS userid.
7. mod_osso (part of OSSO) intercepts the request and redirects to the Oracle SSO for authentication.
8. SSOOblixAuth.class is registered with OSSO and retrieives userid set in the HeaderVar by the OAM as part of Authz actions execution.
9. OSSO Cookie is set and user is redirected back to the requested URL.
10. Hence for any sub-sequent requests it uses ObSSOCookie as reference.

Note: The Header Variable name should be set as HTTP_REMOTE_USER.

Trouble Shooting OAM-Sharepoint Integration

This post will describe some of the trouble shooting tips of OAM and Sharepoint Integration.
Error: Images not appearing:-
Simulation:
1. Access the sharepoint portal page.
2. Enter the OAM credentials to login to portal.
3. Sharepoint portal page will be shown but images are not displayed.
Probable Solution: Check the Anonymous Access checkbox is enabled in Sharepoint Administration website. If not enable it and restart IIS web server.
Create a new web site and create 2 sites, first for default as / and second for testing purpose as sample.
Add the same hostname:port in the host identifiers section.
Restart Access Server.
Goto IIS console and to the new website created, enable the anonymous authentication in the Directory Security. Add the IIS impersonation dll in the Home Directory --> Configurations. Move the IIS dll upwards.
Restart IIS server and test the new sharepoint portal for OAM integration.

Error: Authentication prompting twice:-
Simulation:
1. Access the sharepoint portal page.
2. A windows pops up, user enters OAM credentials and submits.
3. Again a window appears (for Windows Native Authentication) for credentials.
4. Enter the credentials again with DOMAIN (eg., domain_name\orcladmin) and submit.
5. Sharepoint portal page will be shown.
Probable Solution : Check the Integrated Windows Authentication checkbox is enabled in the Sharepoint website. If so, uncheck it and restart IIS webserver.
Error : Access is Denied:
Description:
1. Access the sharepoint portal page.
2. A windows pops up, user enters OAM credentials and submits.
Probable Solutions:
1.Check if there is time difference between OAM machine and webgate Sharepoint machine.
2. Check the web based policies in Sharepoint Portal Administration Page to see if the authorized to see the resource.

Error : 401 UnAuthorized
Solution: Check if the anonymous access is diasabled in the sharepoint website. If so, enable the checkbox and restart IIS server.
Error:The following file(s) have been blocked by the administrator: /access/oblix/apps/webgate/bin/webgate.dll
Probable Solution: Goto Policy Manager console, access the sharepoint policy domain. Goto Authorization rules and check the access is allowed to all users. If not select Any One and try accessing the SPPS resource.

Keypoints to remember for this integration:
1. SPPSImpersonator should be added in DomainController Security Policy and Domain Security Policy. Goto LocalPolicies --> User Rights Assignments and double click act as part of operating system and add the SPPSImpersonator user.
2. Sharepoint machine and OAM installed machine should not have time difference.
3. Sharepoint Administrator website should not have IISImpersonation dll.
4. Sharepoint Administrator website should have both anonymous access and Integrated Windows Authentication checkboxes enabled.
5. The Sharepoint portal website should have anonymous access checkbox enabled, but IWA checkbox disabled.
6. Make the IISImpersonationExtension.dll as the first option in the Wildcard application maps in the sharepoint portal website properties.
7. Ensure that Allow option for Oracle Webgate in Web Service Extensions is greyed.
8. While installing .Net Framework 3.0 (before installing sharepoint) ensure that you are online (internet connection).
9. The Sharepoint policy domain should have Headervar as IMPERSONATE with attribute as uid in the Authentication Actions.
10. Ensure that port is specfied in IIS access gate in the Access System Console before IIS webgate installation.

KeyPoints for Multi Domain SSO:
The above integration has E-business Suite, OAM and Sharepoint were existing on different machines in different domains. OAM will provide multi domain SSO for E-biz and Sharepoint applications.
The OHS webgate installed on OAM machine should act as primary authentication server and IIS webgate installed on Sharepoint machine will act as secondary server.

However, both the webgates will have primary HTTP cookie domain and preferred hostnames specified with their respective domain and machine names.

The Authentication scheme for IIS webgate should have challenge redirect field specified as OHS server (eg., http://ohs_installed_hostname:port).

The Authentication scheme for E-business suite application should have authentication level (say 0) less than that of Auth level for IIS webgate(say 1).

OAM Password Policies

This post outlines the password policies, user challenges in Oracle Access Manager that are possible OOTB.
Lost Password Policy: Lost Password Policy creation is used to challenge the user with registered questions at first login and followed by reset password.
Password Policy: Password Policy is used for specifying the Password Specifications (if any), Password validity period, Password History etc.,
The Change on Reset option enables user to change their password at their first login.
The following steps describe the usage of password reset, lost password management.
1. New User gets created in OAM without registering challenge questions.
2. New user attempts to login to OAM console.
3. OAM forces the user to change their password. Upon changing, user will have to register their challenge questions (either user defined or system defined).
4. Upon successful password reset and questions registration, user will be shown the OAM console.
5. User forgets their password and clicks Loss Password button.
6. User will be challenged with registered questions. After answering the questions correctly, user will be prompted to change their password.
7. User logs in to OAM console successfully and attempts to reset password.
8. User navigates to My Profile, clicks on Modify and enters the existing and new passwords.

Viewlet:
To see the viewlet of configuring the OAM password policies, drop me a mail.

Troubleshooting OAM-OAAM integration

1. Error:

Oracle Access Manager Operation Error

The login form /oasa/loginPage.jsp defined for form authentication itself requires form authentication. It should be unprotected.

Contact your website administrator to remedy this problem.

Probable Solution:

Disable the policy protecting the /oasa/loginPage.jsp (if exists). Restart both webserver and access server.

2. Error:

UnsatisfiedLinkError: no obaccess in java.library.path (in webserver logs)

Probable Solution:

Add this E:\product\oracle\NetPoint\AccessSDK\AccessServerSDK\oblix\lib to the tomcat (where OASA is hosted) path variable. If the server hosting OASA application is weblogic, add this to startWeblogic.cmd to the LD_LIBRARY_PATH variable.

Troubleshooting tips on Oracle IDM 11g installations

1. Error:

Message from syslogd@itechdemo at Tue Aug  4 21:18:34 2009 ...

itechdemo Oblix: 2009/08/04@15:48:34.019699     17769   17783   ACCESS_GATE    FATAL    0x0000182C      /usr/abuild/Oblix/coreid1014/palantir/webgate2/src/apache2entry_web_gate.cpp:434        "The AccessGate is unable to contact any Access Servers."       raw_code^301

Solution: 1. Check the preferred hostname given in webgate (in Access console) in the Host Identifiers section.
              2. Rearrange the modules in httpd.conf by moving load modules to the end of file.

2. Error:

[oracle@atl2-lnx01 bin]$ ./start_ois_server

Using Linux Threading Library.

/disk1/identity_mgmt/Oracle/Middleware/OAM/identitySvr/identity/oblix/apps/common/bin/ois_server: error while loading shared libraries: libdl.so.2: cannot open shared object file: No such file or directory

rm: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory

OIS Server started with pid: 23568

[oracle@atl2-lnx01 bin]$ /bin/sh: error while loading shared libraries: libdl.so.2: cannot open shared object file: No such file or directory.

Solution: Comment out all the lines where it is setting LD_ASSUME_KERNEL to 2.4.19 in start_ois_server and start identity server.

Note: Follow the same solution for starting access server too.

Single Sign-on between Weblogic Server and Weblogic Portal using Oracle Access Manager

This post talks about the architecture, integration aspects and troubleshooting tips for the SSO implementation between WLS and WLP applications.
Architecture:

Description:
The components present in this architecture are Oracle Access Manager 10.1.4.3, Weblogic Server 10.3.0 and Weblogic Portal 10.3.0, SSPI Connector 10.1.4.2.2 and OHS webserver 11g .
The objective is to get Single Sign-On between Weblogic server and weblogic portal resources using SSPI connector.
Two SSPI connectors are used for Weblogic Server and Portal acting in Identity Assertion Provider mode which is available by default configuration. The OHS webserver acting as reverse proxy for both Weblogic Server and portal applications.
Here, the authentication & authz for Weblogic server resource happens through Oracle Access Manager using SSPI connector. However for the Weblogic Portal, only the authentication happens through OAM and Authz happens via Weblogic Portal.
The flow is described as shown below for Single Sign-On when user traverse from WLS to WLP applications:
1. User access Weblogic Server application through Proxy server and it is intercepted by OHS Webgate and checks with Policy Manager if the resource is protected or not.
2. If resource is protected, Webgate challenges user with form login. Form scheme is recommended for SSO solutions.
3. Login details are validated by Access Server and upon successful authentication, it checks if user is authorized to access the resource.
4. If user is authorized to access then Access server creates cookie and passes it to the browser.
5. The mod_proxy plugin present in the OHS server forwards the request to the Weblogic Server.
5. The Weblogic Security Framework invokes the SSPI connector and Identity Assertion provider listens for ObSSOCookie.
6. IAP will then check the user identity taken from the ObSSOCookie with the weblogic.
7. Upon successful verification, requested resource is shown.
8. User will then access the WLP portal application through the reverse proxy server.
Note: The WLP application is not protected by the OAM where as WLS application is protected by OAM.
9. The OHS webgate checks for the presence of cookie in the user session.
10. The ObLoginFilter configured in the web.xml gets invoked and checks for the ObSSOCookie. If its not present then it will present ObLogin.jsp. Since cookie is present in this scenario, it will check with the weblogic if the user is authorized to access the portal.
11. Upon successful authz, portal will be shown.

The flow is described as shown below for Single Sign-On when user traverse from WLP to WLS applications:
1. User access Weblogic portal application through Proxy server and it is intercepted by OHS Webgate and checks with Policy Manager if the resource is protected or not.
2. Since the user session does not have ObSSOCookie present, then ObLogin.jsp will be shown to enter login details.
3. Login details are validated by ASDK against Access Server and generates ObSSOCookie programatically.
4. It also checks against Weblogic if user is authorised to access the portal.
5. If user is authorized then portal page will be shown.
6.The user will then access the WLS application through the reverse proxy.
7. The OHS webgate intercepts request and check for cookie.
8. Since cookie is present, the mod_proxy plugin in OHS will forward request to Weblogic Server.
9. The Weblogic Security Framework invokes the SSPI connector and Identity Assertion provider listens for ObSSOCookie.
10. IAP will then check the user identity taken from the ObSSOCookie with the weblogic.
11. Upon successful verification, requested resource is shown.

Troubleshooting Tips:
1. Ensure that IPValidation for OHS webgate and both Access gates (portal and server) are OFF. Otherwise when user access WLS resource it will prompt for authentication.
2. Ensure that Login filter mappings are added in the portal application web.xml as shown below.

          OblixLoginFilter
          com.oracle.login.ObLoginFilter
     

         
          OblixLoginFilter
          /portlets/login_validate/*
     
web.xml

Oracle Access Manager and Weblogic Portal integration

This post will bring out the key points involved in the integration between Weblogic Portal and Oracle Access Manager using SSPI Connector.
Major Products involved:
1. Weblogic Portal 10.3.0
2. OAM 10.1.4.3
3. SSPI Connector 10.1.4.2.2
Key Points:
1. Create portaldmin user in OAM (as in user store) and assign Admin rights.
2. Create group BEA_Administrators and assign portaladmin user a member of that group.
3. Create NetPointRealm using the command as shown below.
./setupNetPointRealm_wl92.sh portal
4. The param "portal" provided in the above command is essential to create realm necessary for Weblogic portal with specific providers.
5. Ensure to add the p13DataSource in the SQLAuthenticator DataSource field. This makes the users weblogic and portaladmin which are part of myrealm to be available in NetPointRealm. Mark SQLAuthenticator as REQUIRED and OblixAuthenticator as OPTIONAL followed by a weblogic server restart.
6. You should be able to see the group BEA_Administrators in the NetpointRealm Users and Groups column. Copy the group name (eg., cn:EBEA_Administrators:Cdc:Eus:Cdc:Eoracle::Cdc:Ecom).
7. Goto the location, NetpointRealm -> Roles and Policies -> Global Roles -> Roles.
8. Goto the Admin Role and add the conditions to include BEA_Administrators.
9. Goto the PortalSystemAdministrator Role and add the conditions to include BEA_Administrators.
10. Delete the SQLAuthenticator and mark OblixAuthenticator as REQUIRED. SQLAuthenticator is no longer needed as weblogic and portaladmin users are part of OblixAuthenticator.
11. Now login as OAM user to the weblogic portal server.
Note: Follow the key steps 12 & 13 of section 10.5.9 Preparing the WebLogic Environment in the SSPI integration guide .
End-to-End Viewlet:
Please contact me to see the end-to-end viewlet of the usecase scenario.