Oracle WebCenter Sites uses an ACL-based permission model with site-level roles and asset-type permissions integrated with Oracle's security framework.
Built-in Roles
| Role | Content Author | Approve/Publish | Manage Sites | Admin Functions | Template Dev |
|---|---|---|---|---|---|
| GeneralAdmin | Yes | Yes | Yes | Yes | Yes |
| SiteAdmin | Yes | Yes | Yes (assigned) | Partial | No |
| AdvancedUser | Yes | Yes | No | No | Partial |
| BasicUser | Yes | No | No | No | No |
| Browser | Read-only | No | No | No | No |
ACL-Based Permissions
Permissions are assigned per asset type and per site:
<!-- WebCenter Sites ACL configuration -->
<!-- Assets types: Page, Article, Media, Template, CSElement -->
<acl>
<role name="AnalyticsAdmin">
<permission asset-type="Template" action="read,write"/>
<permission asset-type="CSElement" action="read,write"/>
<permission asset-type="Page" action="read"/>
</role>
</acl>
Analytics-Relevant Permissions
Template and CSElement editing permissions are required for analytics script installation:
<%-- WebCenter Sites Template: Add to Layout template --%>
<%-- Navigate to Admin > Template Management --%>
<head>
<ics:callelement element="Head/MetaTags"/>
<script async src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-XXXXXXXXXX');
</script>
</head>
LDAP Integration
WebCenter Sites integrates with Oracle Internet Directory (OID) or any LDAP provider through WebLogic Server's security realm.
Best Practices
- Use SiteAdmin for site-specific management rather than granting GeneralAdmin
- Create a custom AnalyticsAdmin role with only Template/CSElement write permissions
- Use the Browser role for stakeholders who only need to review content
- Integrate with LDAP/OID for centralized authentication
- Audit role assignments through the Admin interface > User Management