The Development Cycle OPSS for Developers

19-8 Oracle Fusion Middleware Application Security Guide Figure 19–3 Programmatic Authentication Key features include: ■ Username and password supplied by the application for programmatic authentication with the Authenticate API ■ Uses a WebLogic authenticator ■ Identity assertion through a token authentication without a password ■ Assertion protected by a code source permission. Only applications that have been granted the code source permission codebase permission grant oracle.security.jps.JpsPermission with name IdentityAssertion nd action execute can use this API for identity assertion.

19.3.3 Programmatic Authorization

Figure 19–4 illustrates a Java EE application using portable, fine-grained authorization. Figure 19–4 Fine-grained Authorization Key features include: ■ Authorization through JpsAuth.checkPermission API calls ■ Auditing of authorization decisions

19.3.4 Credential Store Framework

Figure 19–5 illustrates an application needing to access and store credentials for an external system such as a database. See Also: ■ Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server ■ Chapter 22, Authentication for Java SE Applicaitons . Developing Secure Applications with Oracle Platform Security Services 19-9 Figure 19–5 Storing External Passwords in Credential Store Framework Key features include: ■ Credentials stored securely in a credential store ■ Support for LDAP-based credential stores in addition to Oracle Fusion Middleware’s out-of-the-box, file-based credential store called Oracle wallet. ■ Credentials that can be managed with either Oracle Enterprise Manager Fusion Middleware Control or WLST scripts ■ Credential store operations that can be audited

19.3.5 User and Role

Figure 19–6 illustrates an application deployed on WebLogic that needs searching the identity store for users, such as searching all users in APAC, or identifying all emails with users in a given role. Figure 19–6 Searching the Identity Store with User and Role API Key features include: ■ Calling the User and Role API to access user attributes ■ The same APIs work on user attributes in the default authenticator or an external LDAP store. The User and Role API is automatically configured based on the configuration in the authentication provider, either default or any other LDAP based authentication. ■ Same API regardless of where the attributes are stored

19.3.6 Oracle ADF Authorization

For an example of authorization using Oracle ADF, see Section 19.4.2, How Oracle ADF Uses OPSS .