Deploying Standard Java EE Applications

Deploying Secure Applications 6-11 ■ If credentials have been modified in the test environment, then disable the option to migrate credentials at deploy time by selecting the option Ignore under the Application Credential Migration area in Fusion Middleware Control’s page Configuration Application Security; otherwise, select Append . 2. Use the script migrateSecurityStore to migrate modified data, as follows: ■ If you chose to Ignore application policy migration, then migrate application and system policies from the test to the production LDAP. See example in Migrating Policies Manually . ■ If you chose to Ignore application credential migration, then migrate credentials from the test to the production LDAP. See example in Migrating Credentials Manually . 3. In any case, use Fusion Middleware Control to map application roles to production enterprise groups, as appropriate. 4. Use Fusion Middleware Control to verify that administrative credentials in the production environment are valid; in particular, test passwords versus production passwords; if necessary, modify the production data, as appropriate.

6.5.2.1 Migrating Policies Manually

By default, the script migrateSecurityStore recreates GUIDs and may take a long time to migrate large volume of policies; for these reasons, during the transition from a test to a production environment, you may want to consider migrating policies and credentials with an alternate procedure that uses Oracle Internet Directory bulk operations. For details, see Migrating Large Volume Policy and Credential Stores . Migrating policies manually with the script migrateSecurityStore requires assembling a configuration file where the source and destination are specified. Here is a complete sample of a configuration file, named t2p-policies.xml, illustrating the specification of policy sources in LDAP, DB, and XML storages, and of policy destinations in LDAP and DB storages: ?xml version=1.0 encoding=UTF-8 standalone=yes? jpsConfig xmlns=http:xmlns.oracle.comoracleasschema11jps-config-11_1.xsd Note: You can select Append that is, to migrate application policies in combination with checking the box Migrate only application roles and grants. Ignore identity store artifacts , even when application roles have been modified in the test environment to the extent of mapping them to test enterprise groups. Selecting this combination migrates application policies but disregards the maps to test enterprise groups. Later on, in step 3 below, you must remap application roles to production enterprise groups. Note: There is a way to configure the application so that, at deployment, the migration of policies preserves GUIDs instead of recreating them. This setting can only be configured manually. For details, see parameter jps.approle.preserveguid in Section 21.4.1, Parameters Controlling Policy Migration. 6-12 Oracle Fusion Middleware Application Security Guide xmlns:xsi=http:www.w3.org2001XMLSchema-instance xsi:schemaLocation=http:xmlns.oracle.comoracleasschema11jps-config-11_ 1.xsd schema-major-version=11 schema-minor-version=1 serviceProviders serviceProvider class=oracle.security.jps.internal.policystore.xml.XmlPolicyStoreProvider name=policystore.xml.provider type=POLICY_STORE descriptionXML-based policy store providerdescription serviceProvider serviceProvider class=oracle.security.jps.internal.policystore.ldap.LdapPolicyStoreProvider name=ldap.policystore.provider type=POLICY_STORE property value=OID name=policystore.type descriptionLDAP-based policy store providerdescription serviceProvider serviceProvider class=oracle.security.jps.internal.policystore.ldap.LdapPolicyStoreProvider name=db.policystore.provider type=POLICY_STORE property value=DB_ORACLE name=policystore.type descriptionDB-based policy store providerdescription serviceProvider serviceProviders serviceInstances -- Source XML-based policy store instance -- serviceInstance location=.system-jazn-data.xml provider=policystore.xml.provider name=policystore.xml.source descriptionReplace location with the full path of the folder where the system-jazn-data.xml is located in the source file system description serviceInstance -- Source LDAP-based policy store instance -- serviceInstance provider=ldap.policystore.provider name=policystore.ldap.source descriptionReplace: A. mySourceDomain and mySourceRootName to appropriate values according to your source LDAP directory structure; B. OID with OVD, if your source LDAP is OVD; C. ldap:mySourceHost.com:3060 with the URL and port number of your source LDAPdescription property value=OID name=policystore.type property value=bootstrap name=bootstrap.security.principal.key property value=cn=mySourceDomain name=oracle.security.jps.farm.name property value=cn=mySourceRootName name=oracle.security.jps.ldap.root.name property value=ldap:mySourceHost.com:3060 name=ldap.url serviceInstance -- Source DB-based policy store instance -- serviceInstance provider=db.policystore.provider name=policystore.db.source descriptionReplace: mySourceDomain and mySourceRootName to appropriate values according to your source DB policy store structure description property value=DB_ORACLE name=policystore.type property value=cn=mySourceDomain name=oracle.security.jps.farm.name property value=cn=mySourceRootName name=oracle.security.jps.ldap.root.name property value=jdbc:oracle:thin:mySourceHost.com:1722:orcl name=jdbc.url -- the value of jdbc.url should be the value entered when the source datasource was set up -- property value=oracle.jdbc.driver.OracleDriver name=jdbc.driver