Supported Permission Classes Configuring Applications to Use OPSS

21-28 Oracle Fusion Middleware Application Security Guide property value=REQUIRED name=jaas.login.controlFlag serviceInstance serviceInstance provider=jaas.login.provider name=user.authentication.loginmodule descriptionUser Authentication Login Moduledescription property value=oracle.security.jps.internal.jaas.module.authentication.JpsUserAuthenticati onLoginModule name=loginModuleClassName property value=REQUIRED name=jaas.login.controlFlag serviceInstance serviceInstance provider=jaas.login.provider name=user.assertion.loginmodule descriptionUser Assertion Login Moduledescription property value=oracle.security.jps.internal.jaas.module.assertion.JpsUserAssertionLoginMod ule name=loginModuleClassName property value=REQUIRED name=jaas.login.controlFlag serviceInstance serviceInstance provider=ldap.credentialstore.provider name=credstore.ldap property value=bootstrap name=bootstrap.security.principal.key property value=cn=wls-jrfServer name=oracle.security.jps.farm.name property value=cn=jpsTestNode name=oracle.security.jps.ldap.root.name property value=ldap:stadw12.us.oracle.com:3060 name=ldap.url serviceInstance serviceInstance location=.bootstrap provider=credstoressp name=bootstrap.cred property value=.bootstrap name=location serviceInstance serviceInstance provider=ldap.policystore.provider name=policystore.ldap property value=OID name=policystore.type property value=bootstrap name=bootstrap.security.principal.key property value=cn=wls-jrfServer name=oracle.security.jps.farm.name property value=cn=jpsTestNode name=oracle.security.jps.ldap.root.name property value=ldap:stadw12.us.oracle.com:3060 name=ldap.url serviceInstance serviceInstances jpsContexts default=default jpsContext name=default serviceInstanceRef ref=keystore serviceInstanceRef ref=audit serviceInstanceRef ref=credstore.ldap serviceInstanceRef ref=policystore.ldap jpsContext jpsContext name=oracle.security.jps.fmw.authenticator.DigestAuthenticator serviceInstanceRef ref=digest.authenticator.loginmodule jpsContext jpsContext name=X509CertificateAuthentication serviceInstanceRef ref=certificate.authenticator.loginmodule jpsContext jpsContext name=SAML serviceInstanceRef ref=saml.loginmodule jpsContext jpsContext name=bootstrap_credstore_context serviceInstanceRef ref=bootstrap.cred jpsContext jpsContexts jpsConfig 22 Authentication for Java SE Applicaitons 22-1 22 Authentication for Java SE Applicaitons The information in this chapter applies only to Java SE applications, and the audience are developers of Java SE applications. Details about authenticating Java EE applications can be found in the listed links to other Oracle WebLogic documentation. To use effectively the information in this chapter, it is recommended that the developer be familiar with the context in which APIs are used for authentication. For details, see Section 19.3.2, Authenticating with OPSS APIs. This chapter includes in the following topics: ■ Links to Authentication Topics for Java EE Applications ■ Authentication for Java SE Applications ■ The OPSS Java SE Client

22.1 Links to Authentication Topics for Java EE Applications

The following documents are a good source of information for developing authentication in Java EE applications: ■ For general information about authentication in the Oracle WebLogic Server, see section Authentication in chapter 3 in Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server. ■ Oracle Fusion Middleware Programming Security for Oracle WebLogic Server – Chapter 3, Securing Web Applications – Chapter 4, Using JAAS Authentication in Java Clients – Chapter 5, Using SSL Authentication in Java Clients ■ Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server – Chapter 4, Authentication Providers – Chapter 5, Identity Assertion Providers – Chapter 13, Servlet Authentication Filters ■ Custom modules in Java EE applications required to be wrapped in an authenticator provider. For details, see section How to Develop a Custom Authentication Provider in Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server. ■ For login modules used in Java EE applications, see the following documentation: – Section Login Modules in chapter 4 in Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server. 22-2 Oracle Fusion Middleware Application Security Guide – Section JAAS Authentication Development Environment in Chapter 4 in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server ■ For links to all OPSS API javadocs, see Section H.1, OPSS API References.

22.2 Authentication for Java SE Applications

This section explains the identity store support for Java SE applications, and it includes the following sections: ■ The Identity Store ■ Configuring an LDAP Identity Store in Java SE Applications ■ Supported Login Modules for Java SE Applications ■ Using the OPSS API LoginService in Java SE Applications For details about authorization in Java SE applications, see Section 23.1, Configuring Policy and Credential Stores in Java SE Applications.

22.2.1 The Identity Store

Authentication is the mechanism by which callers prove that they are acting on behalf of specific users or system. Using data, such as name-password combinations, authentication answers the question Who are you? The term identity store refers to the storage where identity data is kept, and authentication providers are ways to access an identity store. An application obtains information from an OPSS security store identity, policy, or credential store and manages its contents using the OPSS APIs, as illustrated in the following graphic:

22.2.2 Configuring an LDAP Identity Store in Java SE Applications

A Java SE application can use an LDAP-based identity store configured in the file jps-config-jse.xml with the elements serviceProvider, serviceInstance, and jpsContext, as illustrated in the following snippet: serviceProviders serviceProvider type=IDENTITY_STORE name=idstore.ldap.provider class=oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider descriptionPrototype LDAP-based ID storedescription serviceProvider serviceProviders serviceInstances serviceInstance name=idstore.ldap provider=idstore.ldap.provider property name=idstore.type value=OID