text: Managing Partitions and Work Manager Groups
  7 Managing Partitions and Work Manager Groups
  This chapter describes how to manage partitions, manage work manager groups, and secure access to partitions, including how to create, delete, and edit partitions; perform bulk management lifecycle tasks on composites; view and configure work manager properties; view work manager pending and completed requests; view and create work manager groups; view partition roles; and assign users to partition roles.
  For information about monitoring the overall status of a specific partition, see Monitoring the Overall Status of the SOA Infrastructure or Individual Partition.
  For information about tracking the status of business flow instances in a specific partition, see Tracking Business Flow Instances .
  For information about performing error recovery in a specific partition, see Recovering From Faults in the Error Hospital.
  7.1 Managing Partitions
  You can deploy SOA composite applications into separate sections of the SOA Infrastructure known as partitions. Deploying composites to partitions enables you to:
  Perform the following bulk lifecycle management tasks on all SOA composite applications within a specific partition:
  Secure access to partitions
  At least one partition is required for deploying SOA composite applications. A default partition named default is automatically included with Oracle SOA Suite. You can delete the default partition. You cannot rename existing partitions; only creation and deletion of partitions is supported.
  To manage partitions:
  Access the Manage Partitions page through one of the following options:
  Right-click soa-infra, select Manage Partitions.
  Links for creating, deleting, and editing partitions.
  A Composite Control list for starting up, shutting down, activating, and retiring all composites in the selected partition.
  A Deployment list for deploying to this partition or undeploying all from this partition.
  A table that lists each partition, the work manager group, the number of active and retired SOA composite application revisions in each partition, and the name of the composites contained in each partition (under the View link).
  Description of the illustration GUID-683A9AFE-4B56-49E4-8BFE-44496A0E1832-default.png
  You can perform the following partition management tasks:
  Changing the Work Manager Group of a Partition
  Performing Bulk Lifecycle Management Tasks on Composites in Partitions
  For more conceptual information about partitions, see Introduction to Partitions.
  7.1.1 Creating Partitions
  You can create partitions from the Manage Partitions page.
  You must ensure that the Session Lock on the Change Center in the Oracle WebLogic Server Administration Console is released before creating a partition.
  Access the Manage Partitions page as described in Managing Partitions.
  Description of the illustration GUID-3227FD09-D2F8-4134-86F6-7BD1AB4BE47F-default.png
  In the Name field, enter a partition name.
  Description of the illustration GUID-C7A788E6-A351-42AF-8B94-EDDA831D4EEE-default.png
  For information about performing bulk lifecycle management tasks from the Composites Control and Deployment lists, see Performing Bulk Lifecycle Management Tasks on Composites in Partitions.
  7.1.2 Deleting Partitions
  You can delete partitions from the Manage Partitions page.
  Before deleting the selected partition, all SOA composite application revisions in the partition are undeployed. The states of all active instances of undeployed composites are changed to aborted.
  Select a specific partition and click Delete. If you are not on the Manage Partitions page, you can also perform the following steps:
  Right-click a specific partition in the navigator and click Delete This Partition.
  Select a specific partition in the navigator and select Delete This Partition from the SOA Partition menu.
  The Delete SOA Partition dialog is displayed.
  Description of the illustration GUID-E7999866-EC47-449E-90C5-EB0765E6CC21-default.png
  7.1.3 Changing the Work Manager Group of a Partition
  You can change the work manger group associated with a partition by either selecting an existing group or creating a new group.
  You must ensure that the Session Lock on the Change Center in the Oracle WebLogic Server Administration Console is released before changing the work manager group of a partition.
  To change the work manager group of a partition:
  Select a specific partition, and click Edit.
  The Edit SOA Partition dialog is displayed.
  Description of the illustration GUID-63B8DDE6-8980-49AF-8872-827D4B846F1C-default.png
  7.1.4 Performing Bulk Lifecycle Management Tasks on Composites in Partitions
  You can perform bulk lifecycle management tasks on all SOA composite applications in a specific partition on the Manage Partitions page, on the Deployed Composites page of a specific partition, and from the menu that is displayed when you right-click a partition in the navigator.
  Access either of the following pages:
  Access the Deployed Composites page by clicking a partition in the navigator and clicking the Deployed Composites tab.
  As a shortcut, you can also right-click a specific partition in the navigator to display a menu for selecting the bulk lifecycle management actions described in this section. For more information about this menu, see Step 3 of Navigating Through the Partition Home Page and Menu.
  Two dropdown lists that are displayed on either the Manage Partitions page or the Deployed Composites page enable you to perform bulk lifecycle management actions:
  On the Deployed Composites page of a specific partition, these lists are displayed at the top of the page.
  Description of the illustration GUID-A8958032-E4AE-4058-99AF-FFFFED2EB123-default.png
  Description of the illustration GUID-E71532B7-8247-4606-AB0F-34E3F4AAF8CE-default.png
  Be aware that when you select Retire All from the Composite Control list, all composites in that partition are retired with no warning message to indicate that the default, last active composite is being retired.
  This is the expected behavior when performing a bulk retirement of all composites in a partition.
  Description of the illustration GUID-2455A11F-9E79-4FD4-87CE-09D8D6672F4B-default.png
  Each partition must be associated with a work manager group that consists of work managers. A work manager is an Oracle WebLogic Server entity that represents a logical thread pool. It is similar to a queue in which work items line up for processing. You can define priorities for the work to be processed by work managers. Work managers manage thread pools internally and automatically, providing for optimal scheduling. Work managers provide the following capabilities:
  Oracle WebLogic Server includes a number of Oracle SOA Suite work managers. You can create Oracle SOA Suite work manager groups that are automatically associated with these work managers. A work manager group consists of work managers dedicated to processing Oracle SOA Suite background work for a given partition. Work manager groups isolate partition configuration and request processing. A work manager group can be shared by multiple partitions.
  Mapping between a partition and a single work manager group. A work manager group comprises all logical thread pools for background processing tasks in a given partition. Multiple partitions can share a single work manager group. For example:
  The default and HR partitions can be associated with a standard work manager group.
  The sales partition can be associated with a high priority work manager group.
  However, each partition is associated with only one work manager group.
  Description of the illustration GUID-A81B89BE-8DDD-4C46-BA8B-74D7334F1A49-default.png
  Description of the illustration GUID-FC2DCCD7-A5B8-4981-8FC8-DA3F7636511E-default.png
  Description of the illustration GUID-FD5E583F-62CB-4FF5-99BE-445A69AEC392-default.png
  Description of the illustration GUID-05D4BC1E-71BD-4759-B48F-51B5F34B5A3C-default.png
  Description of the illustration GUID-0E4D71A0-B748-4665-BF88-D67569C461CB-default.png
  Description of the illustration GUID-18BD8A62-A070-4259-A789-745EB9752F22-default.png
  Description of the illustration GUID-1B8223DC-C6F4-4ADE-941D-8600F1A3A2A4-default.png
  Description of the illustration GUID-B52AD16A-F806-4318-B99C-6F7A64B9A7E1-default.png
  7.3 Securing Access to Partitions
  All partitions are automatically secured with application roles and partition roles. Partition-based security provides the following benefits:
  Access control of information is provided at partition levels. You can only view the partition and composites to which you have access. For example, a user with access to only Partition1 can only see Partition1 and its deployed composites. This user cannot see any other partitions.
  Association of different users to separate roles for each partition.
  Oracle Enterprise Manager Fusion Middleware Control pages such as Flow Instances and Error Hospital show instance data filtered by partition.
  Separate thread pools and work managers are configured per partition. For more information, see Managing Work Manager Groups.
  Application roles and partition roles consist of various combinations of Java permission classes and actions.
  Table 7-1 shows the Oracle SOA Suite-wide application roles. These applications roles are not limited to a specific partition.
  Table 7-2 describes the roles available with each partition. These partition-specific roles include various combinations of permission classes and actions.
  Table 7-2 Partition Roles
  For the successful operation of deployed SOA composite applications in the partition.
  You can perform the following partition access management tasks:
  Viewing Partition Roles
  Viewing the Permissions Assigned to Each Partition Role
  Assigning Users to Partition Roles
  7.3.1 Viewing Partition Roles
  You can view the roles associated with each partition on the Application Roles page.
  For each partition, the roles described in Table 7-2 are displayed:
  partition_name_Monitor
  partition_name_Composer
  partition_name_Tester
  partition_name_Deployer
  partition_name_ApplicationOperator
  Description of the illustration GUID-0722B3D8-6A10-4EC9-B0FD-80F9124E7922-default.png
  7.3.2 Viewing the Permissions Assigned to Each Partition Role
  You can view the permissions assigned to each partition role on the Application Policies page.
  Select a partition role in the table.
  The bottom of the page is refreshed to display the permission class and actions assigned to the selected partition role.
  Description of the illustration GUID-219AF0B6-9CCC-4143-81B1-7B88F588FC6F-default.png
  7.3.3 Assigning Users to Partition Roles
  You can assign the specific partition roles you want a user to possess on a partition. These roles determine the tasks that a user can perform in Oracle Enterprise Manager Fusion Middleware Control.
  Support for partition level permissions and roles:
  To assign users to partition roles:
  Create a user in which to assign partition roles:
  When you create users in Oracle WebLogic Server Administration Console, partition-specific users only require the Monitor role. This role enables these users to access Oracle Enterprise Manager Fusion Middleware Control. Only the system administrator or super user requires the Administrator role.
  Select the partition role to which to map to the user, and click Edit.
  For this example, the ApplicationOperator role in the partition consoleTests is selected. For all partitions, the partition roles shown in Table 7-2 are automatically assigned.
  Description of the illustration GUID-8DD333B7-257D-4E5F-AD65-ACAC6CE3C86B-default.png
  Description of the illustration GUID-8DDDB4A1-B3E7-48C0-A017-41D35EF4BA31-default.png
  Description of the illustration GUID-773C810A-67DB-4397-8502-488EC98F64F2-default.png
  This adds the selected user to the partition role ApplicationOperator for the partition consoleTests.
  Log in to Oracle Enterprise Manager Fusion Middleware Control as the user you assigned to the partition role in Step 9.
  Because the user was given permissions on only the consoleTests partition, they:
  Can only see the consoleTests partition in the Application Navigator of which they are a member. All partitions to which they do not belong are hidden from view.
  Cannot create other partitions.
  7.3.4.1 Understanding Permissions on Initiating and Participating Composites in Different Partitions
  The administration operations that you can perform on initiating and participating SOA composite applications in different partitions are based on the initiating composite in the business flow instance, and not on the participating composite.
  Create a new partition (for this example, named test), assuming that the default partition is already present.
  Deploy a SOA composite application (for this example, named ResponseCreditRating) to the default partition.
  Deploy a SOA composite application (for this example, named RequestCreditRating) to the test partition.
  The soamonuser user has administration permissions on the test partition and no permissions on the default partition. However, the soamonuser user can abort and delete instances of the initiating RequestCreditRating composite even though this instance flow also calls the participating ResponseCreditRating composite on the default partition on which the soamonuser user has no permissions.
  7.3.4.2 Viewing Oracle SOA Composer Permission Actions in a Partition
  Oracle SOA Composer users have the following permission actions by default for any artifact (domain value maps (DVMs), business rules, composite sensors, and so on) in that partition:
  CompositePermission with the read permission action for inspecting any artifact in that partition.
  CompositePermission with the write permission action for changing any artifact in that partition.
  SOAPlatformPermission with the read-shared-data permission action for inspecting any artifact in the shared folder. The shared folder is the location for all shared artifacts between SOA composite applications that can span multiple partitions.
  To view Oracle SOA Composer permission actions for a partition.
  Select partition_name_Composer in the table.
  Description of the illustration GUID-1AAAEE12-6829-4A59-8D4D-2A3380FD6602-default.png
  Log in to Oracle Enterprise Manager Fusion Middleware Control and assign the default_Composer role to that user on the Application Roles page (where default represents the partition for this example).