Summary of Roles and Classes

25-10 Oracle Fusion Middleware Application Security Guide

25.3.5.2 ECID Propagation

By default, ECID support is disabled in the User and Role API. When initializing the API, set the ST_ECID_ENABLED property to true for ECID support, as illustrated in the following example: factEnv.putOVDIdentityStoreFactory.ST_ECID_ENABLED, true;

25.3.5.3 When to Pass Configuration Values

You can specify configuration data: ■ when creating a factory instance RT_GROUP_CREATE_ BASES the base DNs in the LDAP server where a new role can be created RT_GROUP_SEARCH_ BASES the base DNs in the LDAP server that can be searched for a role RT_GROUP_MEMBER_ ATTRS An array of member attributes in a role. All members of a role have values for the attributes. RT_GROUP_FILTER_ OBJECT_CLASSES an array of object classes to use when searching for a role in the LDAP server RT_USER_SELECTED_ CREATE_BASE The currently selected user create base. The user will be created in this base DN upon execution of the createUser call. If the selected create base is null and the ST_SUBSCRIBER_NAME is not specified, the first supplied value of the RT_USER_ CREATE_BASE is used. If the ST_SUBSCRIBER_NAME is specified, the default value is relative to the subscriber name based on the identity store type. RT_GROUP_SELECTED_ CREATE_BASE The currently selected role create base. This role will be created in this base DN upon execution of the createRole call. If the selected create base is null and the ST_SUBSCRIBER_NAME is not specified, the first supplied value of the RT_GROUP_ CREATE_BASE is used. If the ST_SUBSCRIBER_NAME is specified, the default value is relative to the subscriber name based on the identity store type. RT_GROUP_GENERIC_ SEARCH_BASE A generic role search base to use in searching the roles related to a given identity. For example while searching all granted roles for a user, or all managed roles for a user, we need a search base under which all the required groups would reside; this helps in optimizing the searches. This search base is usually a common parent. By default, in all LDAP providers this value is set to the subscriber name if provider, else it uses the first group search base. RT_SEARCH_TYPE determines whether a search on the LDAP server should be of type SIMPLE, PAGED, or VIRTUAL_LIST_VIEW Note: This action is necessary only if either Oracle Internet Directory or Oracle Virtual Directory is used as the back-end identity store. It is not necessary if using other repositories such as Microsoft Active Directory or Novell eDirectory. Table 25–4 Cont. Runtime Identity Provider Configuration Properties Property Name Description Developing with the User and Role API 25-11 ■ when creating a store instance ■ at runtime, through a store configuration object

25.3.6 Configuring the Provider when Creating a Factory Instance

This section contains topics related to configuring the provider during factory instance creation. Configuration at this stage affects the entire factory object as well as objects created using this specific factory instance. Many start-time properties are set at this time, including these common properties: ■ ST_LDAP_URL - the URL of the LDAP repository ■ ST_SECURITY_PRINCIPAL - the user name ■ ST_SECURITY_CREDENTIAL - the user credentials required to connect to the repository

25.3.6.1 Oracle Internet Directory Provider

In this example, the provider is configured when setting up an Oracle Internet Directory OID factory: IdentityStoreFactoryBuilder builder = new IdentityStoreFactoryBuilder; IdentityStoreFactory oidFactory = null; Hashtable factEnv = new Hashtable; Creating the factory instance factEnv.putOIDIdentityStoreFactory.ST_SECURITY_PRINCIPAL, User DN; factEnv.putOIDIdentityStoreFactory.ST_SECURITY_CREDENTIALS, User password; factEnv.putOIDIdentityStoreFactory.ST_LDAP_URL, ldap:ldaphost:port; oidFactory = builder.getIdentityStoreFactory oracle.security.idm.providers.oid. OIDIdentityStoreFactory, factEnv;

25.3.6.2 Using Existing Logger Objects

You can supply named logger objects to the User and Role API. The API uses the specified logger to log messages. You must supply the external logger’s name as an environment variable during the factory creation. Here is an example: See Also: Section 25.3.6, Configuring the Provider when Creating a Factory Instance See Also: Section 25.3.7, Configuring the Provider when Creating a Store Instance See Also: Section 25.3.8, Runtime Configuration Note: The values in italics must be replaced with appropriate values prior to execution. 25-12 Oracle Fusion Middleware Application Security Guide Logger mylogr = Logger.getLoggermylogger.abc.com; FileHandler fh = new FileHandleruserroleapi.log; mylogr.addHandlerfh; … factEnv.putOIDIdentityStoreFactory.ST_LOGGER_NAME, mylogger.abc.com; oidFactory = builder.getIdentityStoreFactory oracle.security.idm.providers.oid. OIDIdentityStoreFactory, factEnv; This code directs that all the log messages should be redirected to the log file named userroleapi.log.

25.3.6.3 Supplying Constant Values

You can overwrite constants or pre-supply values for missing constants by supplying the map in the ST_PROPERTY_ATTRIBUTE_MAPPING property during factory creation. This example code sets the mapping of RoleProfile.OWNER to the myowner attribute. In this way, all operations related to the owner, such as getOwners, getOwnedRoles, and so on, are performed using this attribute. factEnv.put IPIdentityStoreFactory.ST_SECURITY_PRINCIPAL, User DN; factEnv.put IPIdentityStoreFactory.ST_SECURITY_CREDENTIALS, User password; factEnv.putIPIdentityStoreFactory.ST_LDAP_URL, ldap:ldaphost:port; Map m = new Hashtable; m.putRoleProfile.OWNER, myowner; factEnv.put IPIdentityStoreFactory.ST_PROPERTY_ATTRIBUTE_MAPPING, m; ipFactory = builder.getIdentityStoreFactory oracle.security.idm.providers.iplanet.IPIdentityStoreFactory, factEnv;

25.3.6.4 Configuring Connection Parameters

You can configure the connection pool parameters for minimummaximum connections using ST_CONNECTION_POOL_MIN_CONNECTIONS and ST_ CONNECTION_POOL_MAX_CONNECTIONS respectively. By default, the values for these parameters are 0 and 10 respectively. There is an additional restriction that: ST_CONNECTION_POOL_MAX_CONNECTIONS - ST_CONNECTION_POOL_MIN_CONNECTIONS = 10 Here is an example: factEnv.put LDIdentityStoreFactory.ST_CONNECTION_POOL_MIN_CONNECTIONS, 3; factEnv.put LDIdentityStoreFactory.ST_CONNECTION_POOL_MAX_CONNECTIONS, 16;