Oracle Security Token Service Component Characteristics

Configuring High Availability for Identity Management Components 8-127 events. The components then uptakes these change events. OAM components reload their entire configuration every time a change happens.

8.8.3.2 Oracle Security Token Service Component Characteristics

This section describes Oracle Security Token Service component characteristics and includes the following topics: ■ Section 8.8.3.2.1, Oracle Security Token Service Component Lifecycle ■ Section 8.8.3.2.2, Runtime Processes ■ Section 8.8.3.2.3, Starting and Stopping Oracle Security Token Service ■ Section 8.8.3.2.4, J2EE Components and Subcomponents ■ Section 8.8.3.2.5, Session State Information ■ Section 8.8.3.2.6, Configuration Artifacts ■ Section 8.8.3.2.7, External Dependencies

8.8.3.2.1 Oracle Security Token Service Component Lifecycle On startup, the OAMOracle

Security Token Service Server initializes connections to the backend repositories. If the repository is not reachable, the OAMOracle Security Token Service server retries the connections to the repositories using a timeout that grows exponentially with a configurable upper limit. OAMOracle Security Token Service Server provide continuity of service based on locally cached data if the backend connections go down. Service continues until the caches grow stale or the backend connections come up again.

8.8.3.2.2 Runtime Processes The following graphic shows the Oracle Security Token

Service runtime process. Figure 8–15 Oracle Security Token Service Runtime Process The Oracle Security Token Service runtime process works as described below: 1. A Web Service Consumer WSC sends a Web Services-Trust Request Security Token RST message for a security token type that the WSP requires. Authentication of the client occurs by using the transport layer authentication, or by binding the WSS Token to the RST message. 2. The Security Token Service STS validates the RST message, authenticates the request, then authorizes the requested operation. 3. The appropriate security token is generated in accordance with the metadata that the RST message specifies. For the policy driven exchange use-case, the STS looks Note: The additionremoval of Access Server instances is transparent to other Oracle Security Token Service instances in the cluster. Verify that removing a specific Oracle Security Token Service server does not affect the load. 8-128 Oracle Fusion Middleware High Availability Guide up the appropriate token generation policy to generate the appropriate security token. 4. STS generates an RST message that contains the generated security token; it sends the message to the WSC as a response.

8.8.3.2.3 Starting and Stopping Oracle Security Token Service Because they are J2EE

applications, you can start the Access Server where Oracle Security Token Service is deployed and Admin Console from the user interface and Command Line tool that the Application Server provides.

8.8.3.2.4 J2EE Components and Subcomponents J2EE Components and sub-components

include the following: ■ STS - An event based design pattern that implements the core Oracle Security Token Service 11gR1-PS1. It is packaged as a WAR application in the OAM EAR file and comprises a WS Provider Servlet and Java classes. The STS Web Application is bound to the sts root path ■ Admin Console - A stand-alone console based on ADFIDM Shell, and packaged as an EAR file. ■ JMX Mbeans - Packaged with the Access Server package. Config Mbeans are packaged as standalone JAR files. ■ WSLT Command - Consists of Java classes that are in the OAMOracle Security Token Service package. ■ OWSM Agent - Web Service interceptor providing support for WSS protocol, part of JRF. ■ ORAProvider - JRF Web Service Provider

8.8.3.2.5 Session State Information Oracle Security Token Service is a stateless J2EE

application with the exception of the Nonce caching for Username Tokens, where OSTS will keep track of presented username tokens when the nonce is present, in order to prevent replay attacks.

8.8.3.2.6 Configuration Artifacts Oracle Access Manager and Oracle Security Token

Service are built together and use the same modules for configuration, logging, and other processes. The Oracle Security Token Service configuration artifacts include the following files. ■ DOMAIN_HOMEconfigfmwconfigoam-config.xml — The configuration file, which contains instance-specific information. ■ DOMAIN_HOMEconfigfmwconfigoam-policy.xml — Present only when OES Micro SM is not being used. ■ DOMAIN_HOMEconfigfmwconfigserversinstanceNamelogging.xml — Logging config ■ DOMAIN_HOMEconfigfmwconfigcwallet.sso — Passwords Note: WSP validation of the security token depends on the token type. When STS acts as a trust intermediary only, validation is performed against the underlying security infrastructure, such as Kerberos. Configuring High Availability for Identity Management Components 8-129 ■ DOMAIN_HOMEconfigfmwconfigoamkeystore — keystore containing keys and certificates OAMOracle Security Token Service owns ■ DOMAIN_HOMEconfigfmwconfigamtruststore — keystore containing the trust anchors used for X509 cert validation ■ DOMAIN_HOMEconfigfmwconfigamcrl.jar — zip file containing CRLs used for certificate revocation ■ DOMAIN_HOMEconfigfmwconfigdefault-keystore.jks — OWSM keystore used to store keys and certificates used by the OWSM Agent, as well as trusted anchors used to validate X.509 certificates for WSS operations

8.8.3.2.7 External Dependencies Oracle Security Token Service has external

dependencies on the: ■ LDAP based Identity Store – User Identity Repository – LDAP access abstracted by UserRole API. ■ OCSP Responder Service – Real-time X.509 Certification Validation ■ RDBMS Policy Store – Policy Authentication and Authorization Repository – RDBMS access abstracted by the OAM policy engine

8.8.3.3 Oracle Security Token Service High Availability Configuration Steps