Optionally, check the box Use SSL to Connect to establish an anonymous SSL

8-18 Oracle Fusion Middleware Application Security Guide

8.6.1 Migrating with Fusion Middleware Control

Application policies are specified in the application file jazn-data.xml and can be migrated to the policy store when the application is deployed to a server in the WebLogic environment with Fusion Middleware Control; they can also be removed from the policy store when the application is undeployed or be updated when the application is redeployed. All three operations, the migration, the removal, and the updating of application policies, can take place regardless of the type of policy repository, but they do require particular configurations. For details, see procedure in Section 6.5.2, Migrating Policies and Credentials at Deployment.

8.6.2 Migrating with the Script migrateSecurityStore

Application-specific policies or system policies can be migrated manually from a source repository to a target repository using the OPSS script migrateSecurityStore. This script is offline, that is, it does not require a connection to a running server to operate; therefore, the configuration file passed to the argument configFile need not be an actual domain configuration file, but it can be assembled just to specify the source and destination repositories of the migration. For further details about OPSS scripts and their syntax, see section Overview of WLST Command Categories, in Oracle Fusion Middleware WebLogic Scripting Tool Command Reference. For platform-specific requirements to run an OPSS script, see Important Note . To migrate all policies system and application-specific, for all applications on WebLogic use the script first or interactive second syntaxes arguments are written in separate lines for clarity: migrateSecurityStore.py -type policyStore -configFile jpsConfigFileLocation -src srcJpsContext -dst dstJpsContext Note: Use the system property jps.deployment.handler.disabled to disable the migration of application policies and credentials for applications deployed in a WebLogic Server. When this system property is set to TRUE, the migration of policies and credentials at deployment is disabled for all applications regardless of the particular application settings in the application file weblogic-application.xml. Note: Since the script migrateSecurityStore recreates GUIDs and takes a long time to migrate large volume of data, you may want to consider migrating stores with an alternate procedure that uses Oracle Internet Directory bulk operations. For details, see Section 6.5.2.3, Migrating Large Volume Policy and Credential Stores. . Configuring the OPSS Security Store 8-19 migrateSecurityStoretype=policyStore, configFile=jpsConfigFileLocation, src=srcJpsContext, dst=dstJpsContext The meanings of the arguments all required are as follows: ■ configFile specifies the location of a configuration file jps-config.xml relative to the directory where the script is run. Typically, this configuration file is created just to be used with the script and serves no other purpose. This files contains two jps-contexts that specify the source and destination stores. In addition, if the migration involves one or two LDAP-based stores, then this file must contain a bootstrap jps-context that refers to the location of a cwallet.sso file where the credentials to access the LDAP based involved in the migration are kept. ■ src specifies the name of a jps-context in the configuration file passed to the argument configFile. ■ dst specifies the name of another jps-context in the configuration file passed to the argument configFile. The contexts passed to src and dst must be defined in the passed configuration file and must have distinct names. From these two contexts, the script determines the locations of the source and the target repositories involved in the migration. To migrate just system policies on WebLogic, use the script first or interactive second syntaxes arguments are written in separate lines for clarity: migrateSecurityStore.py -type globalPolicies -configFile jpsConfigFileLocation -src srcJpsContext -dst dstJpsContext migrateSecurityStoretype=globalPolicies, configFile=jpsConfigFileLocation, src=srcJpsContext, dst=dstJpsContext The meanings of the arguments all required are identical to the previous case. To migrate just application-specific policies on WebLogic, for one application, use the script first or interactive second syntaxes arguments are written in separate lines for clarity: migrateSecurityStore.py -type appPolicies -configFile jpsConfigFileLocation -src srcJpsContext -dst dstJpsContext -srcApp srcAppName [-dstApp dstAppName] [-overWrite trueOrfalse] [migrateIdStoreMapping trueOrfalse] [mode laxOrstrict] migrateSecurityStoretype=appPolicies, configFile=jpsConfigFileLocation, src=srcJpsContext, dst=dstJpsContext, srcApp=srcAppName, [dstApp=dstAppName], [overWrite=trueOrfalse], [migrateIdStoreMapping=trueOrfalse], [mode=strict] The meanings of the arguments configFile, src, and dst are identical to the previous cases. The meaning of other five arguments is as follows: