Credential Store Basics Oracle Fusion Middleware Online Documentation Library

4-2 Oracle Fusion Middleware Application Security Guide For details about LDAP authenticators, see section Configuring LDAP Authentication Providers in Oracle Fusion Middleware Securing Oracle WebLogic Server. In particular, the DefaultAuthenticator is available out-of-the-box, but its use is recommended only in developing environments for no more than ten thousand entries, for users, and for no more than twenty five hundred entries, for groups. Policies and credentials stored in an LDAP-based store must use the same physical persistent repository. For details, see the following chapters: ■ Chapter 9, Managing the Policy Store ■ Chapter 10, Managing the Credential Store

4.2 Management Tools

The tools available to a security administrator are the following: ■ WebLogic Administration Console ■ Oracle Enterprise Manager Fusion Middleware Control ■ Oracle Entitlements Server ■ OPSS scripts available on all supported platforms ■ LDAP server-specific utilities The tool to manage security data depends on the type of data stored and the kind of store used to keep that data. For applications deployed on WebSphere Application Server, there is also the WebSphere Application Server Administration Console; for details, see WebSphere Application Server documentation. Note that OPSS scripts are available for both platforms: WebLogic and WebSphere. Users and Groups If a domain uses the DefaultAuthenticator to store identities, then use the Oracle WebLogic Server Administration Console to manage the stored data. The data stored in the DefaultAuthenticator can also be accessed by the User and Role API to query user profile attributes. To insert additional attributes to users or groups in the DefaultAuthenticator, an applications also uses the User and Role API. Important: If using Oracle Internet Directory 10.1.4.3 with OPSS, a mandatory one-off patch for bug number 8351672 is recommended on top of Oracle Internet Directory 10.1.4.3. Download the patch for your platform from Oracle Support at http:myoraclesupport.oracle.com . To ensure optimal performance, the following Oracle Internet Directory tuning is recommended: ldapmodify -D cn=orcladmin -w password -v EOF dn: cn=dsaconfig,cn=configsets,cn=oracle internet directory changetype: modify add: orclinmemfiltprocess orclinmemfiltprocess: objectclass=orcljaznpermission orclinmemfiltprocess: objectclass=orcljazngrantee EOF About Oracle Platform Security Services Scenarios 4-3 For details about configuring this authenticator, see Section 3.1.2.1, Using an LDAP Authenticator. Otherwise, if authentication uses any other LDAP server different from the default authenticator or a DB, then, to manage users and groups, use the services of that LDAP server. Policies and Credentials Policies and credentials must use the same kind of storage file-, LDAP-, or DB-based, and if LDAP-based, the same LDAP server Oracle Internet Directory only. To manage policies and credentials use Fusion Middleware Control as explained in Section 9.2, Managing Policies with Fusion Middleware Control and Section 10.3, Managing Credentials with Fusion Middleware Control, or the OPSS scripts, as explained in Section 9.3, Managing Application Policies with OPSS Scripts and Section 10.4, Managing Credentials with OPSS Scripts. Alternatively, to manage policy data, use Oracle Entitlements Server as explained in Oracle Fusion Middleware Administrators Guide for Oracle Entitlements Server. The following list summarizes the tools used to manage security data: ■ Identity data – Default Authenticator: use Administration Console – Other LDAP or DB stores: use utilities provided by the LDAP server or DB ■ Policy and Credential data – File-based: use Fusion Middleware Control or WLST – LDAP-based: use Fusion Middleware Control, WLST, or Oracle Entitlements Server to manage policies. Changes to policies or credentials do not require server restart; changes to the file jps-config.xml do require server restart. For details about the automatic migration of application policies and credentials to the domain stores when the application is deployed, see Section 8.6, Migrating the OPSS Security Store. For details about managing tools on WebSphere Application Server, see Oracle Fusion Middleware Third-Party Application Server Guide. Important: If your domain uses the DefaultAuthenticator, then the domain administration server must be running for an application to operate on identity data using the User and Role API. Note: In general, domain configuration changes require the server to be restarted; however, changes to the domain data do not require the server to be restarted. An example of a domain configuration change is the reassociation of domain stores. 4-4 Oracle Fusion Middleware Application Security Guide

4.3 Packaging Requirements

File-based application policies are defined in the file jazn-data.xml. The only supported way to package this file with an application is to place it in the directory META-INF of an EAR file. File-based application credentials are defined in a file that must be named cwallet.sso. The only supported way to package this file with an application is to place it in the directory META-INF of an EAR file. For details, see Section 21.3, Packaging a Java EE Application Manually. For information about deployment on WebLogic, see Chapter 6, Deploying Secure Applications. On WebSphere, the behavior at deployment is controlled by properties specified in the file META-INFopss-application.xml. For details about policy migration, see Oracle Fusion Middleware Third-Party Application Server Guide. For details about credential migration, see Oracle Fusion Middleware Third-Party Application Server Guide.

4.4 Example Scenarios

The scenarios explained in this section describe the security features adopted by most Oracle ADF applications, Oracle WebCenter, and Web Services Manager Control. They assume that the application employs a security scheme that has the following characteristics: ■ Authentication: it uses the WebLogic Default Authenticator to store users and groups. ■ Authorization: it uses fine-grained JAAS authorization supported by file-based policies and credentials packaged with the application and by policy and credential stores file- or LDAP-based. One of these security schemes is typically employed by applications, such as Oracle ADF or Oracle SOA applications, that require fine-grained JAAS authorization. The various security components in these cases are managed with the appropriate tool. Based on these assumptions, the following scenarios are typical variations on the basic theme; note, however, that the list of variations is not exhaustive. Related Documentation For details about configuring the Default Authenticator, see section Configure Authentication and Identity Assertion Providers in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help. For details about configuring the OPSS security store, see Chapter 8, Configuring the OPSS Security Store. For details about managing policies, see Chapter 9, Managing the Policy Store. For details about managing credentials, see Chapter 10, Managing the Credential Store. Note: Oracle JDeveloper automatically packages the EAR file for a secured Oracle ADF application with all the required files and with the appropriate security configurations, when the EAR file is produced within that environment.