Functional Security with ADF

Developing Secure Applications with Oracle Platform Security Services 19-5 For details, see Chapter 22, Authentication for Java SE Applicaitons .

19.2.2 The User and Role API

The user and role API framework allows applications to access identity information users and roles in a uniform and portable manner regardless of the particular underlying identity repository, since the type of the underlying identity store is transparent to the caller. This API framework provides a convenient way to access repositories programmatically in a portable way, freeing the application developer from the potentially difficult task of accounting for the intricacies of particular identity sources. The framework allows an application to work against different repositories seamlessly. An application can switch between various identity repositories without any code changes being required. Supported operations include creating, updating, or deleting users and roles, or searching users and roles for attributes or information of interest. For example, you may want to search for the e-mail addresses of all users in a certain role. The API supports: ■ LDAP directory servers such as Oracle Internet Directory ■ Flat files ■ Other custom repositories such as databases, by implementing a custom provider for the repository With the User and Role API, you can: ■ Access repositories programmatically in a portable way. ■ Eliminate the need to account for the intricacies of particular identity sources. ■ Enable your application to work against different repositories. ■ Switch between various identity repositories without any code changes to your application. For details, see Chapter 25, Developing with the User and Role API .

19.2.3 JAAS Authorization and the JpsAuth.checkPermission API

The Java EE authorization model uses role membership to control access to EJBs and web resources that are referenced by URLs; the Java 2 authorization model uses permissions instead of role memberships to control access decisions. You can specify authorization policies in application code. Sensitive lines of code are preceded with calls to check whether a subject has the appropriate permission to execute specific sections of code. If the subject fails to have the proper permission, the code throws a security exception. Java 2 authorization is based on permissions, rather than roles, and access control decisions are evaluated by calls to the SecurityManager or the AccessController. When used with JAAS, this model allows for a programmatic authorization capability, thus providing fine-grained control to resources. Oracle Fusion Middleware supports authorization using Java EE DDannotation based authorization and JAASJava2 permission based authorization. Both declarative and programmatic approaches for enforcing authorization policies are supported; the latter is implemented through the JpsAuth.checkPermission API, and AccessController.checkPermission can be used as well. 19-6 Oracle Fusion Middleware Application Security Guide OPSS APIs provide the following benefits beyond the traditional authorization models: ■ They extend the JAAS model with the ability to use application roles that are assigned permissions. ■ They provide policy management support, which is lacking in the standard JAAS model. See Section 20.3.2, Managing Policies for an example. ■ Using the JpsAuth.checkPermission OPSS API as opposed to the standard checkPermission, they provide additional benefits such as more robust debugging and integrated audit support. For details about authorization features of OPSS, see Chapter 23, Authorization for Java SE Applications .

19.2.4 The Credential Store Framework API

A credential store is a secure, central repository where credentials and collections of credentials are stored. Multiple applications can use the same credential store. The Credential Store Framework CSF API provides the mechanism by which applications access the credential store. The CSF API supports file-based Oracle wallet and LDAP-based credential stores. Critical functions provided by the CSF API include returning credentials for a given map name, assigning credentials to and deleting credentials from a given map name, and other operations related to credential maps and keys. Operations on CredentialStore are secured by CredentialAccessPermission, which implements the fine-grained access control model utilized by CSF. For details about the API, see Chapter 24, Developing with the Credential Store Framework .

19.3 Common Uses of OPSS

The same set of OPSS APIs can be used by both Java EE and Java SE developers. Topics in this section illustrate common applications for the APIs, and demonstrate differences between Java EE and Java SE implementations.

19.3.1 Java EE Application using OPSS APIs

Figure 19–2 illustrates a standard Java EE application using OPSS security APIs.