Java SE Environments Configuring the Identity Store Service

Configuring the OPSS Security Store 8-3 For a list of properties that can be specified in a service instance, see Appendix F.2.4, Properties Common to All LDAP-Based Instances. The information in this section is divided into the following topics: ■ Multiple-Node Server Environments ■ Prerequisites to Using an LDAP-Based Security Store

8.2.1 Multiple-Node Server Environments

In domains where several server instances are distributed across multiple machines, it is highly recommended that the OPSS security store be LDAP- or DB-based. Typically, applications do not change policy, credential, or key data. When they do, however, it is crucial that these changes be correctly propagated to all managed servers and clusters in a domain and, therefore, it is recommended that any such changes be performed in the domain administration server and not in managed servers. In a single-node server domain, the propagation of local changes to security data is irrelevant: in this scenario, local changes are equivalent to global changes. In a multiple-node server domain, however, the JMX framework propagates local changes to a file-based policy to each runtime environment, so that the data is refreshed based on caching policies and configuration. For details about properties you can set on policies and credentials, see sections Appendix F.2.1, Policy Store Properties, and Appendix F.2.2, Credential Store Properties. To summarize, in a multiple-node server environment, it is highly recommended that: ■ Both the policy and credential stores be centralized in a LDAP-based store and configured in the administration server. ■ Or, if they are file-based, then local changes to policy or credential data be performed only by the domain administration server to ensure that they are correctly propagated from the administration server to all managed servers in the domain.

8.2.2 Prerequisites to Using an LDAP-Based Security Store

The only supported LDAP-based OPSS security store is Oracle Internet Directory. In order to ensure the proper access to the Oracle Internet Directory, you must set a node in the server directory as explained below. Fusion Middleware Control automatically provides bootstrap credentials in the file cwallet.sso when that tool is used to reassociate to an LDAP-based repository. To specify these required credentials manually, see section Section 21.4.7, Specifying Bootstrap Credentials Manually. Setting a Node in an Oracle Internet Directory Server The following procedure is carried out by an Oracle Internet Directory administrator. To set a node in the LDAP Oracle Internet Directory directory, proceed as follows: 1. Create an LDIF file assumed jpstestnode.ldif, for illustration purpose specifying the following DN and CN entries: dn: cn=jpsroot cn: jpsroot objectclass: top objectclass: OrclContainer