Managing Policies The JAASOPSS Authorization Model

20-12 Oracle Fusion Middleware Application Security Guide Oracle recommends, however, the use of these methods in the class oracle.security.jps.util.JpsSubject because they render better performance and provide auditing.

20.3.3.3 Using the Method checkBulkAuthorization

The method checkBulkAuthorization determines whether a Subject has access to one or more resource actions. Specifically, the method returns the set of resource actions the passed Subject is authorized to access in the passed resources. When invoking this method in a Java SE application, make sure that:

1. The system property java.security.policy has been set to the location of the

OPSSOracle WebLogic Server policy file.

2. Your application must call first the method setPolicy to explicitly set the policy

provider, as illustrated in the following lines: java.security.Policy.setPolicynew oracle.security.jps.internal.policystore.JavaProvider

3. Your application calls checkBulkAuthorization after the call to setPolicy.

In any application, checkBulkAuthorization assumes that the caller can provide: ■ A Subject with User and Enterprise Role Principals. ■ A list of resources including the stripe each resource belongs to. Grants using resource permissions must include the required resource type. checkBulkAuthorization also assumes that the application has visibility into the policy store stripes configured in the domain where the application is running. checkBulkAuthorization does not require resources to be present in the policy store.

20.3.3.4 Using the Method getGrantedResources

The method getGrantedResources provides a runtime authorization query to fetch all granted resources on a given Subject by returning the resource actions that have been granted to the Subject; only permissions associated with resource types directly or indirectly through permission sets are returned by this method, and it is available only when the policy store is LDAP-based.

20.3.4 The Class ResourcePermission

A permission class provides the means to control the actions that a grantee is allowed on a resource. Even though a custom permission class provides the application designer complete control over the actions, target matching, and the implies logic, to work as expected at runtime, a custom permission class must be specified in the system classpath of the server so that it is available and can be loaded when required. But modifying the system class path in environments is difficult and, in some environments, such modification might not be even possible. Note: If checkPermission is called inside a doAs block and the check permission call fails, to display the failed protection domain you must set the system property java.security.debug=access,failure. The OPSS Policy Model 20-13 OPSS includes the class oracle.security.jps.ResourcePermission that can be used as the permission class within any application grant to protect application or system resources. Therefore, the application developer no longer needs to write custom permission classes, since the class ResourcePermission is available out-of-the-box and can be readily used in permissions within application grants stored in any supported policy provider. This class is not designed to be used in system policies, but only in application policies. Configuring Resource Permissions A permission that uses the class ResourcePermission is called a resource permission, and it specifies the resource type, the resource name, and an optional list of actions according to the format illustrated in the following XML sample: permission classoracle.security.jps.ResourcePermissionclass nameresourceType=type,resourceName=namename actionscharacter-separated-list-of-actionsactions permission The above specification requires that the resource type encoded in the type name be defined. Even though the resource type information is not used at runtime, its definition must be present for a resource permission to be migrated successfully; moreover, resource types help administrators model resources and manage their use. The following fragments illustrate the specifications of resource permissions and the corresponding required resource types: permission classoracle.security.jps.ResourcePermissionclass nameresourceType=epm.calcmgr.permission,resourceName=EPM_Calc_Managername permission resource-types resource-type nameepm.calcmgr.permissionname display-nameCalcManager ResourceTypedisplay-name descriptionResourcetype for managing CalcManager grantsdescription provider-nameprovider-name matcher-classoracle.security.jps.ResourcePermissionmatcher-class actions-delimiter,actions-delimiter actionsactions resource-type resource-types permission classoracle.security.jps.ResourcePermissionclass nameresourceType=oracle.bi.publisher.Reports,resourceName=GLReportsname actionsdevelop;scheduleactions permission resource-types resource-type nameoracle.bi.publisher.Reportsname display-nameBI Publisher Reportsdisplay-name provider-nameprovider-name matcher-classoracle.security.jps.ResourcePermissionmatcher-class actions-delimiter;actions-delimiter actionsview;develop;scheduleactions resource-type resource-types