4-2 Oracle Fusion Middleware Administrators Guide for Oracle Real-Time Decisions
Oracle WebLogic Server Oracle Real-Time Decisions authentication is handled by the Oracle WebLogic Server
authenticator providers, in compliance with the OPSS model. An authentication provider performs the following functions:
■
Establishes the identity of users and system processes
■
Transmits identity information
■
Serves as a repository for identity information from where components can retrieve it
The default authentication provider is the directory server embedded in Oracle WebLogic Server. Alternate authentication providers can be used if desired and
managed in the Oracle WebLogic Administration Console.
For more information on Oracle WebLogic Server authentication providers, see Oracle Fusion Middleware Oracle WebLogic Server Administration Console Online Help.
Oracle WebLogic Server Security Realms An Oracle WebLogic Server security realm is specific to a domain, and contains the
authentication providers, users, groups, security roles, and security policies configured together. Whereas multiple security realms can be defined for a domain,
only one can be active, that is, designated as the default realm, at a given time.
Security Administration Tools The administrative tasks required to secure and protect application objects are
performed through Oracle Fusion Middleware and Oracle WebLogic Server consoles, and the command-line Oracle WebLogic Scripting Tool WLST. For details, see
Section 4.4, Administration Tools Used for Common Security-Related Tasks.
4.2 Getting Started with Security for Oracle RTD
The security platform depends on certain key elements and processes to provide uniform security and identity management for all Oracle Fusion Middleware
products. The default elements created during a simple install of Oracle RTD are used to illustrate this overview of security as it affects Oracle RTD users.
For more information about these elements, processes, and the security platform, see Oracle Fusion Middleware Application Security Guide.
4.2.1 The Security Controls for Oracle RTD
This topic introduces the security controls that relate to Oracle RTD, and the security configuration that is created during a default installation.
The key protections required for applications, and the basic questions they address, are:
■
Authentication
Who are the users allowed to access the application? Users and groups are stored in an identity store.
■
Authorization
What are the authenticated users allowed to do in and with the application? The roles and permissions allocated to authenticated users and groups of users are
stored in a policy store.
Security for Oracle Real-Time Decisions 4-3
Table 4–1 summarizes the standard security controls for Oracle RTD.
To illustrate the security concepts, Figure 4–1
shows an example of the relationships between users, groups, application roles, and permissions, as defined and used in
Oracle Fusion Middleware applications. This example is used as a reference point in subsequent descriptions of the individual security elements.
Figure 4–1 Example of Oracle Fusion Middleware Security Elements
The groups BIConsumers, BIAuthors, and BIAdministrators, and the application roles BIConsumer, BIAuthor, and BIAdministrator, are set up during installations
that configure Oracle Real-Time Decisions or other Oracle Business Intelligence components. C1, C2, C3, Au1, Au2, Ad1 are examples of users who would be defined
as members of their groups after installation.
By their membership in groups that are assigned to roles, users can inherit permissions from higher levels of group and role hierarchies.
For example, the authors Au1 and Au2 have two sets of permissions:
■
Explicit permissions from the BIAuthor role, as the BIAuthors group is a member of the BIAuthor role
Table 4–1 Standard Security Controls for Oracle RTD
Security Control
Main Purpose Description
Identity store
Authentication Trusted store to hold user and group identities.
Policy Store
Authorization Trusted store used to hold the application roles and application
grants that enable access to application objects.
4-4 Oracle Fusion Middleware Administrators Guide for Oracle Real-Time Decisions
■
Implicit permissions from the BIConsumer role, inherited through both the BIAuthor role and also through the BIConsumers group
The rest of this section describes how users acquire their privileges to access applications and to control what they can do in the applications.
4.2.2 Key Authentication Elements
