deleteAppRole grantAppRole Managing Application Policies with OPSS Scripts

Managing the Policy Store 9-19 listPermissions.py -appStripe myApp -principalClass my.custom.Principal -principalName manager The following invocation lists all permissions granted to a principal by system policies: listPermissions.py -principalClass my.custom.Principal -principalName manager

9.3.11 deleteAppPolicies

The script deleteAppPolicies removes all policies with a given application stripe. Script Mode Syntax deleteAppPolicies -appStripe appName Interactive Mode Syntax deleteAppPoliciesappStripe=appName The meaning of the argument required is as follows: ■ appStripe specifies an application stripe. If not specified, then the script works on just system policies. Example of Use deleteAppPolicies -appStripe myApp

9.3.12 createResourceType

The script createResourceType inserts a new resource-type entry in the policy store within a given application stripe and with specified name, display name, description, and actions. Optional arguments are enclosed in between square brackets; all other arguments are required. Script Mode Syntax createResourceType -appStripe appStripeName -resourceTypeName resTypeName -displayName displName -description descripString [-provider resTypeProvider] [-matcher resTypeClass] -actions resTypeActions [-delimiter delimChar] Interactive Mode Syntax createResourceTypeappStripe=appStripeName, resourceTypeName=resTypeName, displayName=displName, description=descripString [, provider=resTypeProvider, matcher=resTypeClass], actions=resTypeActions[, delimiter=delimChar] The meaning of the arguments is as follows: ■ appStripe specifies the application stripe where to insert the resource type. ■ resourceTypeName specifies the name of the resource type to insert. ■ displayName specifies the name for the resource type used in UI gadgets. 9-20 Oracle Fusion Middleware Application Security Guide ■ description specifies a brief description of the resource type. ■ provider specifies the provider for the resource type. ■ matcher specifies the class of the resource type. If unspecified, it defaults to oracle.security.jps.ResourcePermission. ■ actions specifies the actions allowed on instances of the resource type. ■ delimiter specifies the character used to delimit the list of actions. If unspecified, it defaults to comma ,. Example of Use The following invocation creates a resource type in the stripe myApplication with actions BWPrint and ColorPrint delimited by a semicolon: createResourceType -appStripe myApplication -resourceTypeName Printer -displayName PRINTER -description A resource type representing a Printer -provider Printer -matcher com.printer.Printer -allowedActions BWPrint;ColorPrint -delimiter ;

9.3.13 getResourceType

The script getResourceType returns the relevant parameters of a resource-type entry in the policy store within a given application stripe and with specified name. Script Mode Syntax getResourceType -appStripe appStripeName -resourceTypeName resTypeName Interactive Mode Syntax getResourceTypeappStripe=stripeName, resourceTypeName=resTypeName The meaning of the arguments is as follows: ■ appStripe specifies the application stripe from where to fetch the resource type. ■ resourceTypeName specifies the name of the resource type to fetch. Example of Use The following invocation fetches the resource type myResType from the stripe myApplication: getResourceType -appStripe myApplication -resourceTypeName myResType

9.3.14 deleteResourceType

The script deleteResourceType removes a resource type with a given name from the passed application stripe. This script applies a cascading deletion by removing all resource instances of the resource type from entitlements and all grants that use resource instances of the resource type.