Handling Special Characters when Creating Identities Creating an Identity

Developing with the User and Role API 25-27 }catch Exception e { e.printStackTrace; } } }

25.8 SSL Configuration for LDAP-based User and Role API Providers

This section describes SSL support for the User and Role API. It contains these topics: ■ Out-of-the-box Support for SSL ■ Customizing SSL Support for the User and Role API

25.8.1 Out-of-the-box Support for SSL

LDAP-based providers for the User and Role API rely on the Sun Java Secure Sockets Extension JSSE to provide secure SSL communication with LDAP-based identity stores. JSSE is part of JDK 1.4 and higher. These LDAP providers are: ■ Microsoft Active Directory ■ Novell eDirectory ■ Oracle Directory Server Enterprise Edition ■ Oracle Internet Directory ■ OpenLDAP ■ Oracle WebLogic Server Embedded LDAP Directory

25.8.1.1 System Properties

To support SSL you must provide the following information in the form of system properties: javax.net.ssl.keyStore javax.net.ssl.keyStorePassword javax.net.ssl.trustStore javax.net.ssl.trustStorePassword Refer to Sun Microsystems’ documentation on JSSE for details.

25.8.1.2 SSL configuration

You need to provide SSL configuration details during User and Role API configuration. Provide your keystore location and password as system properties to the JVM: String keystore = key store location; String keypasswd = key store password; System.setPropertyjavax.net.ssl.trustStore,keystore; System.setPropertyjavax.net.ssl.trustStorePassword, keypasswd; 25-28 Oracle Fusion Middleware Application Security Guide Specify following properties in the environment when creating the IdentityStoreFactory instance: 1. Set the SSL URL of the LDAP server, as in this example: factEnv.putADIdentityStoreFactory.ST_LDAP_URL, ldaps:ldaphost:sslport; 2. Set the security protocol to SSL: factEnv.putjava.naming.security.protocol,SSL;

25.8.2 Customizing SSL Support for the User and Role API

You can customize SSL support by providing a customized SSLSocketFactory to the User and Role API provider.

25.8.2.1 SSL configuration

Specify the following properties when creating the IdentityStoreFactory instance: 1. Specify the custom SSL socket factory name: factEnv.putjava.naming.ldap.factory.socket, fully qualified custom socket factory name; 2. Set the SSL URL of the LDAP server, as in this example: factEnv.putADIdentityStoreFactory.ST_LDAP_URL, ldaps:ldaphost:sslport; 3. Set the security protocol to SSL: factEnv.putjava.naming.security.protocol,SSL;

25.9 The User and Role API Reference

The User and Role API reference Javadoc is available at: Oracle Fusion Middleware User and Role Java API Reference for Oracle Platform Security Services

25.10 Developing Custom User and Role Providers

This section explains how to develop custom providers that security developers can use to manage identities users and roles. It contains these topics: ■ SPI Overview ■ Types of User and Role Providers ■ Developing a Read-Only Provider ■ Developing a Full-Featured Provider ■ Development Guidelines ■ Testing and Verification ■ Example: Implementing an Identity Provider