Oracle AIA Recommendations for Policies

26-6 Developers Guide for Oracle Application Integration Architecture Foundation Pack

26.4 Deploying Security Policies

AIA recommends applying policies globally rather than constraining policy attachment at the individual service level. The global policies are applied when the Foundation Pack is installed. In some cases, it is imperative to override the globally attached client policies with directly attached local policies. General guidelines are given below. ■ Global Authentication Policies are delivered – Eliminates the need to define policies at the composite level. – Global Service Policy applied: oracleaia_wss_saml_or_username_token_ service_policy_OPT_ON. This is a cloned copy of oraclewss_saml_or_username_token_service_policy with Local Optimization set to ON. – Global Service Client Policy applied: oracleaia_wss10_saml_token_client_ policy_OPT_ON This is a cloned copy of oraclewss10_saml_token_client_policy with Local Optimization set to ON. ■ Assess your individual flow needs and harden the services if necessary. Further hardening can be done by associating local policies. ■ Applications invoking secured AIA Web Services need to send credentials. ■ Inter-AIA communication is handled by the Global Service Client Policy.

26.4.1 Oracle AIA Recommendations for Policies

In general, determining which policies to use depends on the basic requirements of your organizations security policy. The following questions help determine which policies can be used. ■ Is there a need only to authenticate users? ■ Is there a need for message protection? ■ Will the token be inserted in the transport layer or in a SOAP header? ■ Do you need to use a particular type of token? The following policies should be attached globally to the AIA Services: ■ oracleaia_wss_saml_or_username_token_service_policy_OPT_ON ■ aia_wss_saml_or_username_or_http_token_service_policy_OPT_ON ■ oracleaia_wss10_saml_token_client_policy_OPT_ON oracleaia_wss_saml_or_username_token_service_policy_OPT_ON This is a cloned copy of oraclewss_saml_or_username_token_service_policy with Local Optimization set to ON. This is needed for local optimization to work when both client and service composite are co-located. This policy authenticates users using credentials provided either in SAML tokens in the WS-Security SOAP header or in the UsernameToken WS-Security SOAP header. The credentials in a SAML token are authenticated against a SAML login module, while the credentials in a UsernameToken are authenticated against the configured Working with Security 26-7 identity store. Only plain text mechanism is supported for the UsernameToken. This policy can be applied to any SOAP-based endpoint. aia_wss_saml_or_username_or_http_token_service_policy_OPT_ON This is a cloned copy of oraclewss_saml_or_username_token_service_policy with Local Optimization set to ON and http basic authentication added as an additional option. Clients such as ODI that do not have the infrastructure to use webservices security can call this service using http basic authentication. This is only attached to AIAAsyncErrorHandlerBPEL service. oracleaia_wss10_saml_token_client_policy_OPT_ON This is a cloned copy of oraclewss10_saml_token_client_policy with Local Optimization set to ON. This is needed for local optimization to work when both client and service composite are co-located. This policy includes SAML tokens in outbound SOAP request messages.

26.5 Policy Naming Conventions