grantEntitlement Managing Application Policies with OPSS Scripts

9-32 Oracle Fusion Middleware Application Security Guide The reason for this outcome is that the policy cache has been refreshed with the change introduced in step 3 above. Scenario C 1. The user logs in to the application. 2. The user accesses the functionality secured by the application role. 3. From another host or domain, Oracle Entitlements Server is used to remove the enterprise role from the application role. 4. The user does not log out and remains able to access the functionality secured by the application role within 10 minutes. The reason for this outcome is that the policy cache has not yet been refreshed with the change introduced in step 3 above. Scenario D 1. The user logs in to the application. 2. The user accesses the functionality secured by the application role. 3. From another host or domain, Oracle Entitlements Server is used to remove the enterprise role from the application role. 4. The user does not log out, waits more than 10 minutes, and then attempts to access the functionality secured by the application role: the access is denied. The reason for this outcome is that the policy cache has been refreshed with the change introduced in step 3 above.

9.5 Granting Policies to Anonymous and Authenticated Roles with WLST Scripts

Several WLST scripts require the specification of the principal name and the principal class for a role involved in the operation. For example, the following invocation adds a principal to the role with application stripe myApp and name myAppRole: grantAppRole.py -appStripe myApp -appRoleName myAppRole -principalClass myPrincipalClass -principalName myPrincipal When in such scripts the principal refers to the authenticated role or the anonymous role, the principal names and principal classes are fixed and must be one of the following pairs: ■ Authenticated role – Name: authenticated-role – Class: oracle.security.jps.internal.core.principals.JpsAuthentica tedRoleImpl ■ Anonymous role – Name: anonymous-role – Class: oracle.security.jps.internal.core.principals.JpsAnonymousR oleImpl Managing the Policy Store 9-33 The list of WLST scripts that required the above principal name and class specification are the following: ■ grantAppRole ■ revokeAppRole ■ grantPermission ■ revokePermission ■ listPermissions

9.6 Application Stripe for Versioned Applications in WLST Scripts

Several WLST scripts require the specification of an application stripe. If the application is not versioned, the application stripe defaults to the application name. Otherwise, if the application is versioned, the application name and the application stripe are not identical. For example, the name of a versioned application with name myApp and version 1 is displayed myAppv1.0 in Fusion Middleware Control pages, but the application stripe of this application is myAppv1.0. In general, an application with display name appNamevers has application stripe appNamevers. It is this last string that should be passed as the application stripe in WLST scripts, as illustrated in the following invocation: listAppRoles myAppv1.0 The list of WLST scripts that can use stripe specification are the following: ■ createAppRole ■ deleteAppRole ■ grantAppRole ■ revokeAppRole ■ listAppRoles ■ listAppRoleMembers ■ grantPermission ■ revokePermission ■ listPermissions ■ deleteAppPolicies

9.7 Managing Application Policies with Oracle Entitlements Server

Oracle Entitlements Server allows managing and searching application policies and other security artifacts in a WebLogic domain that uses an Oracle Internet Directory LDAP policy store. For details, see the following topics in Oracle Fusion Middleware Administrators Guide for Oracle Entitlements Server: ■ Querying Security Artifacts ■ Managing Policies and Roles