Supported LDAP Identity Store Types

Understanding Identities, Policies, and Credentials 3-5 Policy Store Types A policy store can be file-, LDAP-, or DB-based. A file-based policy store is an XML file, and this store is the out-of-the-box policy store provider. The only LDAP-based policy store type supported is Oracle Internet Directory. The only DB-based policy store type supported is Oracle RDBMS releases 10.2.0.4 or later; releases 11.1.0.7 or later; and releases 11.2.0.1 or later. Policy Store Scope, Migration, and Reassociation There is exactly one policy store per domain. During development, application policies are file-based and specified in the file jazn-data.xml. When the application is deployed on WebLogic with Fusion Middleware Control, they can be automatically migrated into the policy store. For details about this feature, see Section 8.6.1, Migrating with Fusion Middleware Control. By default, the policy store is file-based. When the application is deployed on WebSphere, the behavior of migration at deployment can be manually specified as described in Section 21.4.1, Parameters Controlling Policy Migration, and Section 21.4.4, Parameters Controlling Credential Migration. For reassociation details, see Section 8.5, Reassociating the OPSS Security Store. For details about the resource catalog support within a policy store, see Section 20.3.1, The Resource Catalog.

3.3 Credential Store Basics

A credential store is a repository of security data credentials that certify the authority of users, Java components, and system components. A credential can hold user name and password combinations, tickets, or public key certificates. This data is used during authentication, when principals are populated in subjects, and, further, during authorization, when determining what actions the subject can perform. OPSS provides the Credential Store Framework, a set of APIs that applications can use to create, read, update, and manage credentials securely. Credential Store Types A credential store can be file-, LDAP-, or DB-based. A file-based credential store, also referred to as wallet-based and represented by the file cwallet.sso, is the out-of-the-box credential store. The only LDAP-based credential store type supported is Oracle Internet Directory. The only DB-based credential store type supported is Oracle RDBMS releases 10.2.0.4 or later; releases 11.1.0.7 or later; and releases 11.2.0.1 or later. Important: As long as a domain is pointing to a policy store, that policy store cannot be deleted from the environment. Note: All permission classes must be specified in the system class path.