Example 3: Java EE Application with LDAP Store

Developing with the User and Role API 25-5

25.3 Working with Service Providers

In this section we describe basic provider concepts and life cycle, and explain how to set up, configure, and use the provider to work with user repositories in an Oracle Platform Security Services environment. After ensuring the environment is properly set up, implementing the provider involves: ■ identifying the underlying repository and selecting the provider factory class appropriate to that repository ■ creating instances of the provider factory and the identity store ■ configuring the provider This section contains these topics: ■ Understanding Service Providers ■ Setting Up the Environment ■ Selecting the Provider ■ Properties for Provider Configuration ■ Programming Considerations ■ Provider Life cycle

25.3.1 Understanding Service Providers

Although the User and Role API is called for user and role management, the API does not directly interact with the underlying identity repository. Instead, security applications make use of providers which carry out the actual communication with the underlying repository. This offers flexibility since the same code can be used with various underlying repositories simply by modifying the providerconnection information. SubjectParser Interface This interface provides utility methods for extracting out the user and role principals from the given Subject. Service provider needs to provide the implementation for this interface. User Interface This interface represents a user in the identity store. UserManager Interface This interface represents a user manager that manages execution of various operations, involving users, in the identity repository. UserProfile Interface This interface represents the detailed profile of a user. It allows for user properties to be accessed in a generic manner. You can read or modify any property of user with these APIs: ■ getPropertyjava.lang.String ■ getPropertiesjava.lang.String[] ■ setPropertyoracle.security.idm.ModProperty ■ setPropertiesoracle.security.idm.ModProperty[] Table 25–1 Cont. Classes and Interfaces in the User and Role API Name Type Description 25-6 Oracle Fusion Middleware Application Security Guide

25.3.2 Setting Up the Environment

Jar Configuration Several jars must be present in your environment: ■ the provider jar file, which implements the desired underlying identity repository ■ the User and Role API jars ■ other component jars which the provider may need, including Toplink, jdbc, xdb, and so on Ensure that your application classpath includes the relevant jars. User Classes in jps-config.xml Oracle Virtual Directory only For efficiency when fetching user attributes, add the following entry in jps-config.xml to specify the user object classes for the search: . . serviceInstance name=idstore.ldap provider=idstore.ldap.provider property name=idstore.config.provider value=oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider property name=CONNECTION_POOL_CLASS value=oracle.security.idm.providers.stdldap.JNDIPool extendedProperty nameuser.object.classesname values valuetopvalue valuepersonvalue valueinetorgpersonvalue valueorganizationalpersonvalue valueotherActiveDirectorySpecificClassesvalue ... values extendedProperty . .

25.3.3 Selecting the Provider

Oracle Platform Security Services support a range of user repositories, including the following LDAP directories: ■ Microsoft Active Directory ■ Novell eDirectory ■ Oracle Directory Server Enterprise Edition ■ Oracle Internet Directory ■ Oracle Virtual Directory ■ OpenLDAP Note: Make this change only for the Oracle Virtual Directory authenticator.