Programmatic Authorization Credential Store Framework

20 The OPSS Policy Model 20-1 20 The OPSS Policy Model This chapter explains the OPSS policy and authorization models in the following sections: ■ The Security Policy Model ■ Authorization Overview ■ The JAASOPSS Authorization Model

20.1 The Security Policy Model

For details about the OPSS policy model and the security artifacts used in it, see Oracle Fusion Middleware Administrators Guide for Oracle Entitlements Server.

20.2 Authorization Overview

This section compares and contrasts the authorization available in the Java EE and the JAAS models, in the following sections: ■ Introduction to Authorization ■ The Java EE Authorization Model ■ The JAAS Authorization Model

20.2.1 Introduction to Authorization

A Java 2 policy specifies the permissions granted to signed code loaded from a given location. A JAAS policy extends Java 2 grants by allowing an optional list of principals; permissions are granted only to code from a given location, possibly signed, and run by a user represented by those principals. The Policy Store is a repository of system and application-specific policies and roles. Application roles can be granted mapped to enterprise users and groups specific to the application such as administrative roles. A policy can grant permissions to any of these roles, groups, or users as principals. For more details about policy-related security artifacts, see Chapter 3.2, Policy Store Basics. An application can delegate the enforcement of authorization to the container, or it can implement its own enforcement of policy checking with calls to methods such as checkPermission, checkBulkAuthorization, or getGrantedResources. For details about policy checking with API calls, see Checking Policies . 20-2 Oracle Fusion Middleware Application Security Guide

20.2.2 The Java EE Authorization Model

The Java EE authorization model uses role membership to control access to EJB methods and web resources that are referenced by URLs; policies assign permissions to users and roles, and they are enforced by the container to protect resources. In the Java EE model, authorization is implemented in either of the following ways: ■ Declaratively, where authorization policies are specified in deployment descriptors; the container reads those policies from deployment descriptors and enforces them. No special application code is required to enforce authorization. ■ Programmatically, where authorization policies are checked in application code; the code checks whether a subject has the appropriate permission to execute specific sections of code. If the subject fails to have the proper permission, the code throws an exception. Table 20–1 shows the advantages and disadvantages of each approach. A container can provide authorization to applications running in it in two ways: declaratively and programmatically; these topics and an example are explained in the following sections: ■ Declarative Authorization ■ Programmatic Authorization ■ Java EE Code Example

20.2.2.1 Declarative Authorization

Declarative authorization allows to control access to URL-based resources such as servlets and pages and methods in EJBs. The basic steps to configure declarative authorization are the following:

1. In standard deployment descriptors, specify the resource to protect, such as a web

URL or an EJB method, and a logical role that has access to the resource. Alternatively, since Java EE 1.5 supports annotations, use code annotations instead of deployment descriptors.

2. In proprietary deployment descriptors such as web.xml, map the logical role

defined in step 1 to an enterprise group. For details, see the chapter Using Security Services in Oracle Fusion Middleware Enterprise JavaBeans Developers Guide for Oracle Containers for Java EE.

20.2.2.2 Programmatic Authorization

Programmatic authorization provides a finer grained authorization than the declarative approach, and it requires that the application code invoke the method Table 20–1 Comparing Authorization in the Java EE Model Authorization Type Advantages Disadvantages Declarative No coding needed; easy to update by modifying just deployment descriptors. Authorization is coarse-grained and specified at the URL level or at the method level for EJBs. Programmatic Specified in application code; can protect code at a finer levels of granularity. Not so easy to update, since it involves code changes and recompilation.