How Oracle ADF Uses OPSS

20-4 Oracle Fusion Middleware Application Security Guide out.printlnrequest.isUserInRolesr_developer = + request.isUserInRolesr_developer + br; out.printlnrequest.getUserPrincipal = + request.getUserPrincipal + br; out.printlnBODY; out.printlnHTML; } }

20.2.3 The JAAS Authorization Model

The JAAS authorization introduces permissions but can still use the notion of roles. An authorization policy binds permissions with a Subject role, group, or user and, optionally, with source code. Granting to a role is achieved through calls to addPrincipalsToAppRole. Permissions are evaluated by calls to the SecurityManager or the AccessController, and it allows fine-grained control to resources. In this model, an authorization policy specifies the following information: ■ Application roles and enterprise groups. ■ Permissions granted to users, groups, and code sources. For users and groups, they determine what a user or the member of a group is allowed to access. For code sources, they determine what actions the code is allowed to perform. When programming with this model, sensitive lines of code are preceded with calls to check whether the current user or role is granted the appropriate permissions to access the code. If the user has the appropriate permissions, the code is run. Otherwise, the code throws and exception. For details about JAAS standard permissions, see http:java.sun.comJava SE6docstechnotesguidessecuritypermissions.html .

20.3 The JAASOPSS Authorization Model

JAASOPSS authorization is based on controlling the operations that a class can perform when it is loaded and run in the environment. This section is divided into the following sections: ■ The Resource Catalog ■ Managing Policies ■ Checking Policies ■ The Class ResourcePermission

20.3.1 The Resource Catalog

OPSS supports the specification and runtime support of the resource catalog in file-, LDAP-, and DB-based policy stores. Using the resource catalog provides the following benefits: ■ Describes policies and secured artifacts in human-readable terms. ■ Allows defining and modifying policies independently of and without knowledge of the application source code. ■ Allows browsing and searching secured artifacts. The OPSS Policy Model 20-5 ■ Allows grouping of secured artifacts in building blocks entitlements or permission sets which can be later used in authorization policies.

20.3.2 Managing Policies

Resource catalog artifacts can be managed with the policy management API. Specifically, the following interfaces, all subinterfaces of the interface oracle.security.jps.service.policystore.EntityManager, are directly relevant to the artifacts in the resource catalog: ■ GrantManager - This interface includes methods to query grants using search criteria, to obtain list of grants that satisfy various combinations of resource catalog artifacts, and to grant or revoke permissions to principals. ■ PermissionSetManager - This interface includes methods to create, modify, and query permission sets entitlements. ■ ResourceManager - This interface includes methods to create, delete, and modify resource instances. ■ ResourceTypeManager - This interface includes methods to create, delete, modify, and query resource types. For details about these interfaces, see the Javadoc document Oracle Fusion Middleware Java API Reference for Oracle Platform Security Services. The following code snippet illustrates the creation of a resource type, a resource instance, actions, and a permission set: import oracle.security.jps.service.policystore.entitymanager.; import oracle.security.jps.service.policystore.search.; import oracle.security.jps.service.policystore.info.resource.; import oracle.security.jps.service.policystore.info.; import oracle.security.jps.service.policystore.; import java.util.; public class example { public static void mainString[] args throws Exception { ApplicationPolicy ap; ResourceTypeManager rtm = ap.getEntityManagerResourceTypeManager.class; ResourceTypeSearchQuery query = new ResourceTypeSearchQuery; query.setANDMatch; query.addQueryResourceTypeSearchQuery.SEARCH_PROPERTY.NAME, false, ComparatorType.EQUALITY, resourceType, BaseSearchQuery.MATCHER.EXACT; ListResourceTypeEntry allResourceTypes = rtm.getResourceTypesquery; ResourceManager rm = ap.getEntityManagerResourceManager.class; ResourceSearchQuery ResourceQuery = new ResourceSearchQuery; ResourceQuery.setANDMatch; ResourceQuery.addQueryResourceSearchQuery.SEARCH_PROPERTY.NAME, false, ComparatorType.EQUALITY, R2, BaseSearchQuery.MATCHER.EXACT; ListResourceEntry allResources = rm.getResourcesRT2, ResourceQuery; PermissionSetManager psm = ap.getEntityManagerPermissionSetManager.class; PermissionSetSearchQuery pssq = new PermissionSetSearchQuery; pssq.setANDMatch; pssq.addQueryPermissionSetSearchQuery.SEARCH_PROPERTY.NAME, false, ComparatorType.EQUALITY, PS1, BaseSearchQuery.MATCHER.EXACT; ListPermissionSetEntry allPermSets = psm.getPermissionSetspssq;