Oracle WebLogic Authenticators Authentication Basics

Understanding Identities, Policies, and Credentials 3-5 Policy Store Types A policy store can be file-, LDAP-, or DB-based. A file-based policy store is an XML file, and this store is the out-of-the-box policy store provider. The only LDAP-based policy store type supported is Oracle Internet Directory. The only DB-based policy store type supported is Oracle RDBMS releases 10.2.0.4 or later; releases 11.1.0.7 or later; and releases 11.2.0.1 or later. Policy Store Scope, Migration, and Reassociation There is exactly one policy store per domain. During development, application policies are file-based and specified in the file jazn-data.xml. When the application is deployed on WebLogic with Fusion Middleware Control, they can be automatically migrated into the policy store. For details about this feature, see Section 8.6.1, Migrating with Fusion Middleware Control. By default, the policy store is file-based. When the application is deployed on WebSphere, the behavior of migration at deployment can be manually specified as described in Section 21.4.1, Parameters Controlling Policy Migration, and Section 21.4.4, Parameters Controlling Credential Migration. For reassociation details, see Section 8.5, Reassociating the OPSS Security Store. For details about the resource catalog support within a policy store, see Section 20.3.1, The Resource Catalog.

3.3 Credential Store Basics

A credential store is a repository of security data credentials that certify the authority of users, Java components, and system components. A credential can hold user name and password combinations, tickets, or public key certificates. This data is used during authentication, when principals are populated in subjects, and, further, during authorization, when determining what actions the subject can perform. OPSS provides the Credential Store Framework, a set of APIs that applications can use to create, read, update, and manage credentials securely. Credential Store Types A credential store can be file-, LDAP-, or DB-based. A file-based credential store, also referred to as wallet-based and represented by the file cwallet.sso, is the out-of-the-box credential store. The only LDAP-based credential store type supported is Oracle Internet Directory. The only DB-based credential store type supported is Oracle RDBMS releases 10.2.0.4 or later; releases 11.1.0.7 or later; and releases 11.2.0.1 or later. Important: As long as a domain is pointing to a policy store, that policy store cannot be deleted from the environment. Note: All permission classes must be specified in the system class path. 3-6 Oracle Fusion Middleware Application Security Guide Credential Store Scope, Migration, and Reassociation An application can use either the domain credential store or its own wallet-based credential store. The domain credential store can be wallet-based by default, LDAP-, or DB-based. The only LDAP-based credential store type supported is Oracle Internet Directory. The migration of application credentials to the credential store can be configured to take place automatically when the application is deployed. For details, see Section 8.6.1, Migrating with Fusion Middleware Control. Credentials can also be reassociated from one type of store to another. For details, see Section 8.5, Reassociating the OPSS Security Store. 4 About Oracle Platform Security Services Scenarios 4-1 4 About Oracle Platform Security Services Scenarios This chapter describes some typical security scenarios supported by Oracle Platform Security Services. It also includes the list of LDAP, DB, and XML servers supported, the management tools that an administrator would use to administer security data in each scenario, and the package requirements for policies and credentials. These topics are explained in the following sections: ■ Supported LDAP-, DB-, and File-Based Services ■ Management Tools ■ Packaging Requirements ■ Example Scenarios ■ Other Scenarios

4.1 Supported LDAP-, DB-, and File-Based Services

Oracle Platform Security Services supports the following LDAP-, DB-, and file-based repositories: ■ For the OPSS security store: – If file-based, XML for the policy store and cwallet for the credential store. – If LDAP-based, Oracle Internet Directory versions 10.1.4.3 or 11g for the policy store and credential store. – If DB-based, Oracle RDBMS releases 10.2.0.4 or later; releases 11.1.0.7 or later; and releases 11.2.0.1 or later. ■ For the identity store, any of the LDAP authenticators supported by the Oracle WebLogic Server. An XML identity store is supported in only Java SE applications.