Home
HCL Digital Experience Product Documentation
Welcome to the product documentation for HCL Digital Experience. Find information about how to install, configure, maintain, and use HCL Web Content Manager and HCL Portal Server, Enable, and Extend solutions.
HCL Digital Experience 8.5
Learn how to install, configure, troubleshoot, maintain, and use Version 8.5 of HCL Web Content Manager and HCL Portal Server, Enable, and Extend.
Securing
Security tasks include setting up property extension databases and custom user repositories, configuring and activating SSL, and configuring authentication. In addition, tasks such as activating Federal Information Processing Standards (FIPS) and NIST SP800-131a security modules and configuring external security managers such as Security Access Manager might be required to secure your portal environment.
External security managers
Use external security managers such as IBM Security Access Manager to perform authentication and authorization for HCL Digital Experience. You can use an external security manager for authentication only or for both authentication and authorization. Using an external security manager to perform only authorization is not supported at this time.
Security Access Manager
HCL Digital Experience supports the use of IBM Security Access Manager. Existing Security Access Manager users can use the Security Access Manager services to assist them in their deployment.
Configuring Security Access Manager
HCL Digital Experience can be integrated with IBM Security Access Manager to provide authentication services, authorization, and to link HCL Digital Experience's credential vault to the ISAM GSO Lockbox feature.
Security Access Manager prerequisites
Complete the prerequisite tasks before you configure IBM Security Access Manager.

HCL Digital Experience Product Documentation
Welcome to the product documentation for HCL Digital Experience. Find information about how to install, configure, maintain, and use HCL Web Content Manager and HCL Portal Server, Enable, and Extend solutions.
- HCL Digital Experience 9.5
- HCL Digital Experience 9.5 [Legacy Content]
- HCL Digital Experience 9.0
  Learn how to install, configure, troubleshoot, maintain, and use Version 9.0 of HCL Web Content Manager and HCL Portal Server, Enable, and Extend.
- HCL Digital Experience 8.5
  Learn how to install, configure, troubleshoot, maintain, and use Version 8.5 of HCL Web Content Manager and HCL Portal Server, Enable, and Extend.
  - Overview
    HCL Digital Experience (formerly IBM WebSphere Portal and IBM Web Content Manager) empowers you to create, manage, and deliver engaging omnichannel digital experiences to virtually all audiences with responsive content, targeted offers, seamlessly integrated applications, and consistent branding across channels (web, mobile. and hybrid mobile/web applications and more).
  - Roadmaps to deploy your system
    Review the roadmaps to understand the common deployment, configuration, migration, and integration patterns.
  - Roadmaps to create your website
    Review the roadmaps to understand how to create your website.
  - Online Help
    This Online Help is made available in the HCL Digital Experience Help Center for quick references on how to install, configure, maintain, and use HCL Digital Experience.
  - Installing
    HCL Digital Experience provides flexible deployment options that range from proof-of-concept where you can examine and test functionality to a highly available and scalable production environment. Review the planning information to learn more about hardware and software requirements, high availability, scalability, supported topologies, and much more. Select your operating system and then select the installation pattern that most reflects your business needs.
  - Configuring
    Run the following tasks after you install and deploy HCL Digital Experience. They address tasks that are typically run one time and have a global effect. Some configuration changes are made more frequently or do not have a global effect. These tasks are addressed in the Administering section.
  - Backup and restore
    Backup and recovery of data files and databases is an essential operation for any business system, particularly for data and applications that run in production environments. Create and follow a plan for backing up and recovering data on all tiers of your HCL Digital Experience deployment. IBM Installation Manager must also be included in backup and recovery planning. If you back up the HCL Portal file structure and then install a fix pack, your HCL Digital Experience and IBM Installation Manager become out of sync after you restore the HCL Portal file system. This condition is not recoverable.
  - Migrating
    Successful migration requires significant planning and preparation, understanding the tools that are involved, and careful execution of the appropriate steps in the order provided.
  - Integrating
    Integrate HCL Digital Experience with software such as HCL Sametime to enable your users to collaborate more easily. You can also use the unified task list portlet to integrate HCL with your backend business process software, such as IBM Process Server.
  - Administering
    Use the administration tools that are provided with the portal to do various day-to-day administration tasks. There are two methods for editing portal setup: using the administration portlets or the XML configuration interface. The administration portlets are a convenient way to make real-time updates to the portal's configuration. While the XML configuration interface is suited to more advanced administration, including batch processing of updates.
  - Securing
    Security tasks include setting up property extension databases and custom user repositories, configuring and activating SSL, and configuring authentication. In addition, tasks such as activating Federal Information Processing Standards (FIPS) and NIST SP800-131a security modules and configuring external security managers such as Security Access Manager might be required to secure your portal environment.
    - Security and authentication considerations
      Security and authentication are key elements of a production environment. Learn about single sign-on, credential vaults and external security managers.
    - Controlling access
      After creating users and groups, you can assign them different levels of access to specific resources, roles, and policies. This access controls what actions they can perform on various pages, portlets, and applications.
    - Enabling Attribute Based Security
      Attribute based security for HCL Web Content Manager content is an access filter in the product filter chain. You can extend the access control permission checks for HCL Web Content Manager content beyond the user or group-based decisions. You can define your own criteria. The criteria might involve categories, keywords, textComponents, htmlComponents, or shortTextComponents for an item.
    - Java 2 security
      Java 2 (J2SE) security provides a policy-based, fine-grain access control mechanism that increases overall system integrity by checking for permissions before allowing access to certain protected system resources. J2SE security allows you to set up individual policy files that control the privileges assigned to individual code sources. If the code does not have the required permissions and still tries to execute a protected operation, the Java™ Access Controller will throw a corresponding security exception.
    - Integrating with OpenID authentication
      Web applications provide information and services to public users and personalized information and services to authenticated users. Users often work with multiple web applications, which require multiple IDs and passwords. This requirement can be difficult to maintain. Integrating identity providers (Google, Yahoo, or Facebook) into your site can simplify logging in for your users.
    - Integrating with IBM WebSphere Application Server TAI authentication
      WebSphere Application Server provides Trust Association Interceptors (TAI) plug-ins to generate an authenticated session and security context for applications that are running on the tWas infrastructure and the HCL Portal server. The login process is coded to recognize an established WebSphere Application Server authentication and use the implicit login path for such cases.
    - Enabling step-up authentication and/or the Remember me cookie
      Using step-up authentication and/or the Remember me cookie lets you fine-tune user authentication to pages and portlets.
    - Securing LTPA keys on a production environment
      The Lightweight Third Party Authentication (LTPA) key holds cryptographic keys that secure the user authentication session and cookies. To secure the production server environment, regenerate the LTPA key using the WebSphere Integrated Solutions Console. If you plan to enable single sign-on at a later time, you must first disable the automatic key generation.
    - Configuring SSL
      Secure socket layers (SSL) encrypt traffic between the client browser and the server to secure information exchanged over the network between the browser and HCL Digital Experience. You will need to configure your environment for SSL to activate this additional security feature.
    - Enabling FIPS and (NIST) SP800-131a
      HCL Digital Experience tolerates IBM WebSphere Application Server support of Federal Information Processing Standards (FIPS) and National Institute of Standards and Technology (NIST) SP800-131a. You can configure WebSphere Application Server to activate FIPS 140-2 compliant security modules. When you enable FIPS, you can use only FIPS to securely encrypt data. For this reason, you must also configure FIPS for systems that require secure transactions, which can include HTTP servers and LDAP servers.
    - Configuring Session Security Integration
      IBM WebSphere Application Server protects your session from access by other users.
    - Enabling HTTP Basic Authentication for simple clients
      HCL Digital Experience provides an HTTP Basic Authentication Trust Association Interceptor that can be enabled to allow specific clients to log into the portal by using HTTP Basic Authentication instead of HTTP Form Based Authentication.
    - Setting up custom user repositories
      A custom user repository is any repository that HCL Portal does not support out-of-box. However, you can configure HCL Portal to support any type of repository in a federated or stand-alone user registry, whether an LDAP directory, database, file system, and so on. Setting up custom user repositories involves tasks such as defining additional repositories to the default federated user registry, creating a custom stand-alone user repository, and updating your user repository to reflect changes in your environment. Learn what steps are required to create and update custom user repositories and what specific interfaces you must implement to enable communication between HCL Portal and a repository.
    - External security managers
      Use external security managers such as IBM Security Access Manager to perform authentication and authorization for HCL Digital Experience. You can use an external security manager for authentication only or for both authentication and authorization. Using an external security manager to perform only authorization is not supported at this time.
      - Planning for external security managers
        By default, IBM WebSphere Application Server controls authentication to HCL Digital Experience and HCL Digital Experience controls authorization (access control) to resources.
      - Enabling and configuring single sign-on for HTTP requests using SPNEGO
        You can create single sign-on requests for your HTTP server using the Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) available in IBM WebSphere Application Server. Creating single sign-on requests using SPNEGO allows HTTP users to log in and authenticate only once and receive automatic authentication from WebSphere Application Server.
      - Security Access Manager
        HCL Digital Experience supports the use of IBM Security Access Manager. Existing Security Access Manager users can use the Security Access Manager services to assist them in their deployment.
        Configuring Security Access Manager
        HCL Digital Experience can be integrated with IBM Security Access Manager to provide authentication services, authorization, and to link HCL Digital Experience's credential vault to the ISAM GSO Lockbox feature.
        Security Access Manager prerequisites
        Complete the prerequisite tasks before you configure IBM Security Access Manager.
        Creating the PdPerm.properties file
        The PdPerm.properties file configures the Access Manager Java Run Time Environment (AMJRTE). You must create the PdPerm.properties file before you configure IBM Security Access Manager for authentication, authorization, Credential Vault, or user provisioning. Run the run-svrssl-config task to create the files. This task also creates the keystore file that is used to encrypt communication with Security Access Manager.
        Configuring Security Access Manager for authentication only
        HCL Digital Experience and IBM WebSphere Application Server support the Trust Association Interceptors (TAI) that IBM Security Access Manager provides. If you use Security Access Manager for authorization, you must also use Security Access Manager for authentication. Using Security Access Manager only for authorization is not supported.
        Configuring Security Access Manager for authorization
        You can configure IBM Security Access Manager for both authentication and authorization for HCL Digital Experience. If you configure these functions at different times as independent tasks, configure Security Access Manager for authentication first. Using Security Access Manager only for authorization is not supported.
        Configuring the Credential Vault adapter for Security Access Manager
        You can use IBM Security Access Manager in the HCL Digital Experience Credential Vault service. HCL Portal includes a vault adapter to access the Security Access Manager Global Sign-on (GSO) lockbox. Any existing Tivoli resource or resource credentials can be used in your portlets that access the credential vault service without any additional configuration. In addition, the credential vault service and credential vault management portlet can create or update an existing GSO lockbox entry.
        Configuring Security Access Manager for authentication, authorization, and the Credential Vault
        You can configure Security Access Manager for authentication, authorization, and the vault adapter with one task.
        Removing Security Access Manager
        After you install and use IBM Security Access Manager, you might find that you no longer require its use. You can then remove it from the HCL Digital Experience environment and restore authentication capabilities to IBM WebSphere Application Server and authorization capabilities to HCL Digital Experience.
        Enabling user provisioning
        When users are created in HCL Digital Experience, they are not automatically imported into Security Access Manager. Enabling automatic user provisioning to Security Access Manager changes this behavior. After this feature is enabled, users are automatically imported into Security Access Manager whenever they are created in HCL Digital Experience. When user provisioning is enabled, anyone with access to the public URL can become an active user in Security Access Manager if the self-registration feature remains enabled.
        Verifying external authorization to Security Access Manager
        After configuring HCL Digital Experience to use Security Access Manager for externalized authorization, you should verify that it works properly before continuing with any additional configuration tasks.
        Removing the Credential Vault adapter
        If you no longer require the use of the credential vault adapter that you created, you can remove it from your configuration.
        Disabling user provisioning
        After you enable and use the user provisioning feature within IBM Security Access Manager, you can disable the feature.
      - Configuring eTrust SiteMinder
        HCL Digital Experience supports the use of Computer Associates eTrust SiteMinder for authentication and authorization.
      - Verifying Trust Association Interceptors for authentication
        After configuring HCL Digital Experience to use an external security manager for authentication, you should verify that the Trust Association Interceptors (TAI) are working properly before continuing with any additional configuration tasks.
      - Changing the login and logout pages
        By default, when unauthenticated users attempt to access the myportal page, they get redirected to the login page to provide a user name and password. When using a WebSEAL or Computer Associates eTrust SiteMinder TAI for authentication, you no longer need to use the HCL Digital Experience login page. Instead, the login icon should point to the protected portal page.
      - Managing access control with external security managers
        HCL Digital Experience externalizes roles and uses access control to control role membership. From the perspective of the external security manager, these externalized roles contain only one permission: membership in the role. HCL Digital Experience always determines the permissions associated with each role.
    - Deleting passwords from properties files
      The configuration tasks might require you to write security-sensitive information, such as passwords, into multiple properties files. When you no longer need this security-sensitive information for your configuration, you should remove them and move the files to a safe place or set the file permissions so that only authorized users can read them.
    - Updating user ID and passwords
      HCL Digital Experience and IBM WebSphere Application Server use some accounts from the registry (for example, the LDAP server) including administrative and bind IDs for authenticated access to databases and LDAP severs respectively, as well as the HCL Digital Experience and WebSphere Application Server administrative IDs. Often this means that the account passwords are stored in the HCL Digital Experience and WebSphere Application Server bootstraps configuration files, which allows the authentication process to work.
    - Content Security Policy
      The Content-Security-Policy header is used by modern browsers to enhance security of HCL Digital Experience site documents or web pages by allowing HCL Digital Experience administrators or developers declare which dynamic resources are allowed to load.
  - Monitoring
    HCL Portal includes tools and features to help you monitor the portal site.
  - Setting up a website
    Setting up a website includes, creating pages, adding navigation, setting up search, and adding content to the site. Themes are used to customize the portal's look-and-feel. Out-of-the-box templates and the site wizard can help you set up your portal site faster. You can add wikis and blogs to your site and let users tag and rate content on your site.
  - Staging to production
    During portal solution development, the solution is initially developed, tested, and refined on one server or a limited number of servers. The solution is deployed later on live systems, referred to as the production environment. The process of moving the solution from the development environment to the production environment is called staging.
  - Developing
    This section includes developer documentation on extending applications and development assets for HCL Portal and HCL Web Content Manager.
  - Troubleshooting
    This section helps you resolve problems, use diagnostic tools and tracing to capture HCL Digital Experience system errors.
  - Reference
    View information that can help you use the Digital Experience Help Center including directory conventions, terms of use, trademarks, a glossary, and more.
  - Glossary
    This glossary includes terms and definitions for HCL Digital Experience.
  - Content Template Catalog 4.4
    The Content Template (CTC) is a set of templates that accelerate the process of building a website.

Security Access Manager prerequisites | HCL Digital Experience

Complete the prerequisite tasks before you configure IBM Security Access Manager.

Complete the following task before you configure Security Access Manager:

Install HCL Digital Experience.
Run the appropriate Configuration Wizard option to configure HCL Digital Experience. The stand-alone server and production server options include a database transfer and LDAP server configuration.
Install and configure Security Access Manager.
Configure the WebSEAL security proxy. Refer to the WebSEAL installation guide for information.
Set JAVA_HOME in your operating system shell to point to the IBM SDK that your Portal server is running on.
Example: C:\IBM\WebSphere\AppServer\java\8.0
Ensure that the path of your operating system shell includes %JAVA_HOME%\bin directory.

Tip: IBM® WebSphere® Application Server ships a PD.jar file that HCL Digital Experience uses to configure Security Access Manager. The file is in the AppServer_root/tivoli/tam directory. However, the Security Access Manager typically contains a newer version of the PD.jar file.

To enable HCL Digital Experience tasks, copy the PD.jar file to <AppServer>/<javaversion>jre/lib/ext/ (ideally, the updated PD.jar; minimally, the AppServer_root/tivoli/tam/PD.jar.