Security Policy Approach Setting up a Security Policy

Managing the Security in Oracle Data Integrator 23-11 Use the Recover Password Storage wizard to start the password recovery. To launch the Recover Password Storage wizard: 1. From the ODI main menu, select Password Storage Recover... 2. Specify the login details of your Oracle Data Integrator master repository defined when Connecting to the Master Repository .

3. Click Finish.

4. Re-enter manually data server and context passwords. Refer to Chapter 4, Setting-up the Topology for more information.

23.3.2 Setting Up External Authentication

Oracle Platform Security Services OPSS is a standards-based and portable security framework for Java applications. OPSS offers the standard Java Security Model services for authentication and authorization. Oracle Data Integrator stores all user information as well as users’ privileges in the master repository by default. When a user logs to Oracle Data Integrator, it logs against the master repository. This authentication method is called Internal Authentication. Oracle Data Integrator can optionally use OPSS to authenticate its users against an external Identity Store, which contains enterprise user and passwords. Such an identity store is used at the enterprise level by all applications, in order to have centralized user and passwords definitions and Single Sign-On SSO. In such configuration, the repository only contains references to these enterprise users. This authentication method is called External Authentication.

23.3.2.1 Configuring ODI Components for External Authentication

To use the External Authentication option, you need to configure an enterprise Identity Store LDAP, Oracle Internet Directory, and so forth, and have this identity store configured for each Oracle Data Integrator component to refer by default to it. Oracle Data Integrator Studio The configuration to connect and use the identity store is contained in an OPSS Configuration file called jps-config.xml file. See Configuring a JavaEE Application to Use OPSS in the Oracle Fusion Middleware Application Security Guide for more information. WARNING: When performing a password storage recovery, passwords for context, data servers, jdbc password of the work repository and ESS related passwords are lost and need to be re-entered manually in Topology Navigator. Note: When using External Authentication, only users and passwords are externalized. Oracle Data Integrator privileges remain within the repository. Data servers and context passwords also remain in the master repository. It is possible to externalize data server and context passwords, using the External Password Storage feature. See Section 23.3.1, Setting Up External Password Storage for more information. 23-12 Oracle Fusion Middleware Developers Guide for Oracle Data Integrator Copy this file into the ODI_HOMEclientodibin directory. The Studio reads the identity store configuration and authenticates against the configured identity store. If you want to locate this file in a different location, edit the ODI_ HOMEclientodibinodi.conf file and edit the option that sets the location of the configuration file. This option is set in the following line: AddVMOption -Doracle.security.jps.config=.jps-config.xml Standalone Agent The configuration to connect and use the identity store is contained in an OPSS Configuration File called jps-config.xml file. Refer to the Oracle Fusion Middleware Application Security Guide for more information. Copy this file in the ODI_HOMEagentbin directory. The agent and the command line scripts will authenticate against the configured identity store. Java EE Components Oracle Data Integrator components deployed in a container Java EE Agent, Oracle Data Integrator Console do not require a specific configuration. They use the configuration of their container. See Configuring OAM Identity Assertion for SSO with Oracle Access Manager 10g in the Oracle Fusion Middleware Application Security Guide for more information on OPSS configuration in a Java EE context.

23.3.2.2 Setting the Authentication Mode

There are two ways to set or modify the password storage: ■ Creating the Master Repository allows you to define the authentication mode. ■ Switching the Authentication Mode modifies the authentication mode for an existing master repository.

23.3.2.3 Switching the Authentication Mode

Switching the authentication mode of the Oracle Data Integrator repository changes the way users authenticate. This operation must be performed by a Supervisor user. Use the Switch Authentication Mode wizard to change the user authentication mode. Before launching the Switch Authentication Mode wizard perform the following tasks: WARNING: When switching from an External to Internal authentication, user passwords are not copied from the identity store to the repository. The passwords are nullified. All the user accounts are marked as expired and must be reactivated by a SUPERVISOR that is created during the switch. When switching from Internal to External authentication, the users that exist in the repository and match a user in the identity store are automatically mapped. Users that do not match a user in the identity store are disabled. A Supervisor must edit the users so that their name has a match in the identity store. The context passwords are lost. Passwords for data servers, jdbc password of the work repository, and ESS related passwords are moved from a credential store to an other.