Users Introduction to Oracle Data Integrator Security

23-10 Oracle Fusion Middleware Developers Guide for Oracle Data Integrator

23.3.1.2 Switching the Password Storage

Switching the password storage of the Oracle Data Integrator repository changes how data servers and contexts passwords are stored. This operation must be performed by a SUPERVISOR user. Use the Switch Password Storage wizard to change the password storage options of the data server passwords. Before launching the Switch Password Storage wizard perform the following tasks: ■ Disconnect Oracle Data Integrator Studio from the repository. ■ Shut down every component using the Oracle Data Integrator repository. To launch the Switch Password Storage wizard: 1. From the ODI main menu, select Password Storage Switch...

2. Specify the login details of your Oracle Data Integrator master repository as

defined when Connecting to the Master Repository .

3. Click Next.

4. Select the password storage:

■ Select Internal Password Storage if you want to store passwords in the Oracle Data Integrator repository. ■ Select External Password Storage if you want use JPS Credential Store Framework CSF to store the data server and context passwords. If you select External Password Storage, you must provide the MBean Server Parameters to access the credential store as described in Table 23–2 and then click Test Connection check the connection to the MBean Server.

5. Click Finish.

The password storage options have been changed. You can now re-connect to the Oracle Data Integrator repository.

23.3.1.3 Recovering the Password Storage

Oracle Data Integrator offers a password recovery service that should be used only in case of an external password storage crash. Using this procedure, password storage is forced to Internal Password Storage as the external storage is no longer available. This operation should be performed by a Supervisor user. WARNING: When performing such a switch, the data server passwords are moved from one storage to another. Context passwords are lost. Table 23–2 MBean Server Parameters Host MBeans Server Host, for example: mymachine.oracle.com Port MBeans Server Port, for example: 7001 User MBeans Server User Name, for example: weblogic Password MBeans Server Password, for example: weblogic Managing the Security in Oracle Data Integrator 23-11 Use the Recover Password Storage wizard to start the password recovery. To launch the Recover Password Storage wizard: 1. From the ODI main menu, select Password Storage Recover... 2. Specify the login details of your Oracle Data Integrator master repository defined when Connecting to the Master Repository .

3. Click Finish.

4. Re-enter manually data server and context passwords. Refer to Chapter 4, Setting-up the Topology for more information.

23.3.2 Setting Up External Authentication

Oracle Platform Security Services OPSS is a standards-based and portable security framework for Java applications. OPSS offers the standard Java Security Model services for authentication and authorization. Oracle Data Integrator stores all user information as well as users’ privileges in the master repository by default. When a user logs to Oracle Data Integrator, it logs against the master repository. This authentication method is called Internal Authentication. Oracle Data Integrator can optionally use OPSS to authenticate its users against an external Identity Store, which contains enterprise user and passwords. Such an identity store is used at the enterprise level by all applications, in order to have centralized user and passwords definitions and Single Sign-On SSO. In such configuration, the repository only contains references to these enterprise users. This authentication method is called External Authentication.

23.3.2.1 Configuring ODI Components for External Authentication

To use the External Authentication option, you need to configure an enterprise Identity Store LDAP, Oracle Internet Directory, and so forth, and have this identity store configured for each Oracle Data Integrator component to refer by default to it. Oracle Data Integrator Studio The configuration to connect and use the identity store is contained in an OPSS Configuration file called jps-config.xml file. See Configuring a JavaEE Application to Use OPSS in the Oracle Fusion Middleware Application Security Guide for more information. WARNING: When performing a password storage recovery, passwords for context, data servers, jdbc password of the work repository and ESS related passwords are lost and need to be re-entered manually in Topology Navigator. Note: When using External Authentication, only users and passwords are externalized. Oracle Data Integrator privileges remain within the repository. Data servers and context passwords also remain in the master repository. It is possible to externalize data server and context passwords, using the External Password Storage feature. See Section 23.3.1, Setting Up External Password Storage for more information.