In the Navigator pane, expand WebLogic Domain to show the domain for which From the WebLogic Domain menu, select Security then Credentials.

Setting Up Your Environment for Policies 10-19 Figure 10–6 Keys Configured in Oracle WSM Credential Map You can edit the keys in the credential map by selecting the key and clicking Edit. Make sure that any changes you make in the credential store are consistent with the definition of the key in the Oracle WSM Java keystore.

4. Click Create Key to create new entries in the oracle.wsm.security credential

map, for example for the ServiceA and ServiceB aliases. The Create Key dialog box appears, as shown in Figure 10–7 . Figure 10–7 Create Key Dialog Box

a. From the Select Map menu, select the map name oracle.wsm.security if it is

not already selected.

b. In the Key field, enter csfServiceA to create a key-value pair to access the

key store.

c. From the Type menu, select Password.

d. In the User Name field, enter the alias name that you specified for the private

key in the keystore, for example ServiceA.

e. In the Password and Confirm Password fields, enter the password that you

specified for the alias in the keystore, for example welcome1.

f. In the Description field, enter a description of for the entry, for example, Key

for ServiceA. 10-20 Oracle Fusion Middleware Security and Administrators Guide for Web Services

g. Click OK.

h. Click Create Key again and provide the values for any additional keystore

aliases, such as csfServiceB for the ServiceB alias.

5. Optionally, click Create Key to create entries in the oracle.wsm.security

credential map for the any csf-key user credentials, for example basic.credentials, as follows:

a. From the Select Map menu, select the map name oracle.wsm.security if it is

not already selected.

b. In the Key field, enter basic.credentials. In this example, we use

basic.credentials but you can specify any name you choose for the key.

c. From the Type menu, select Password.

d. In the User Name field, enter a valid username that exists in the OPSS identity

store, for example AppID.

e. In the Password and Confirm Password fields, enter a valid password for the

user, for example AppPWord.

f. In the Description field, enter a description of for the entry, for example,

Username and Password for basic.credential key.

g. Click OK.

6. Restart the server. Using WLST Follow these steps to add additional keys and user credentials to the credential store using WLST commands.

1. Go to the Oracle Common home directory for your installation, for example

homeOracleMiddlewareoracle_common. For information about the Oracle Common home directory and installing Oracle Fusion Middleware, see the Oracle Fusion Middleware Installation Planning Guide.

2. Start WLST using the WLST.shcmd command located in the oracle_

commoncommonbin directory. For example: ■ homeOracleMiddlewareoracle_commoncommonbinwlst.sh UNIX ■ C:\Oracle\Middleware\oracle_common\common\bin\wlst.cmd Windows When executed, these commands start WLST in offline mode. To use the credential store WLST commands, you must use WLST in online mode. 3. Start Oracle WebLogic Server. For more information, see Start and stop servers in the Oracle WebLogic Server Administration Console Online Help. 4. Connect to the running WebLogic Server instance using the connect command. For example, the following command connects WLST to the Administration Server at the URL myAdminServer.oracle.com:7001 using the usernamepassword credentials weblogicwelcome1: connectweblogic,welcome1,t3:myAdminServer.oracle.com:7001 Setting Up Your Environment for Policies 10-21 5. Use the createCred command to create entries in the oracle.wsm.security credential map for the ServiceA and ServiceB aliases. For example, create an entry csfServiceA for the ServiceA alias, using a command such as the following: wls:DefaultDomainserverConfig createCredmap=oracle.wsm.security, key=csfServiceA, user=ServiceA, password=welcome1, desc=Key for ServiceA 6. Repeat step 5 to create an entry for any additional aliases, for example csfServiceB, for the ServiceB alias. 7. Use the createCred command to create entries in the oracle.wsm.security credential map for the any csf-key user credentials, for example basic.credentials. wls:DefaultDomainserverConfig createCredmap=oracle.wsm.security, key=basic.credentials, user=AppID, password=AppPWord, desc=Key for ServiceA 8. View the details about a key in the credential store using the listCred command as shown in the following example: listCredmap=oracle.wsm.security, key=csfServiceA How Oracle WSM Locates Keystore And Key Passwords Oracle WSM expects keystore and key passwords to be in the Credential Store Framework CSF. Here is how it works. ■ A JKS keystore file is protected by a keystore password. ■ A keystore file consists of zero or more private keys, and zero or more trusted certificates. Each private key has its own password, although it is common to set the key passwords to be the same as the keystore password. Oracle WSM needs to know both the keystore password and key password. ■ The CSF consists of many maps, each with a distinct name. Oracle WSM only uses the map oracle.wsm.security. ■ Inside each map is a mapping from multiple csf-key entries to corresponding credentials. A csf-key is just a simple name, but there can be many different types of credentials. The most common type of credential is a password credential which is primarily comprised of a username and a password. Oracle WSM refers to the following csf-keys inside the oracle.wsm.security map: – keystore-csf-key - This key should contain the keystore password. The username is ignored. – enc-csf-key - This key should contain the encryption key alias as the username, and the corresponding key password. – sign-csf-key - This key should contain the signature key alias as the username, and the corresponding key password. In addition to these csf-keys, you should add a csf-key entry for every new private key that you want Oracle WSM to use, for example when you want to specify signature and encryption keys in configuration overrides.