addBootStrapCredential Managing Credentials with OPSS Scripts

11-4 Oracle Fusion Middleware Application Security Guide – event-specific attributes like authentication method, source IP address, target user, resource, and so on – contextual attributes like the execution context ID ECID, session ID, and others ■ Common mechanism for audit policy configuration Oracle Fusion Middleware Audit Framework offers a unified method for configuring audit policies in the domain. ■ Leverages the Oracle Fusion Middleware 11g infrastructure – is usable across Oracle Fusion Middleware 11g components and services such as Oracle Web Services Manager, Oracle Internet Directory, Oracle Virtual Directory, and Oracle Directory Integration and Provisioning – integrates with Oracle Enterprise Manager Fusion Middleware Control for UI-based configuration and management – integrates with wlst for command-line, script-based configuration – integrates with Oracle Platform Security Services to provide multiple benefits

11.3 Oracle Fusion Middleware Audit Framework Concepts

This section introduces basic concepts of the Oracle Fusion Middleware Audit Framework: ■ Audit Architecture ■ Key Technical Concepts ■ Audit Record Storage ■ Analytics

11.3.1 Audit Architecture

The Oracle Fusion Middleware Audit Framework consists of the following key components: ■ Audit APIs These are APIs provided by the audit framework for any audit-aware components integrating with the Oracle Fusion Middleware Audit Framework. During runtime, applications may call these APIs where appropriate to audit the necessary information about a particular event happening in the application code. The interface allows applications to specify event details such as username and other attributes needed to provide the context of the event being audited. ■ Audit Events and Configuration The Oracle Fusion Middleware Audit Framework provides a set of generic events for convenient mapping to application audit events. Some of these include common events such as authentication. The framework also allows applications to define application-specific events. These event definitions and configurations are implemented as part of the audit service in Oracle Platform Security Services. Configurations can be updated through Enterprise Manager UI and WLST command-line tool ■ The Audit Bus-stop Introduction to Oracle Fusion Middleware Audit Framework 11-5 Bus-stops are local files containing audit data records before they are pushed to the audit store. In the event that no audit store is configured, audit data remains in these bus-stop files. The bus-stop files are simple text files that can be queried easily to look up specific audit events. When an audit store is in place, the bus-stop acts as an intermediary between the component and the audit store. The local files are periodically uploaded to the data store based on a configurable time interval. A key advantage of the audit store is that audit data from multiple components can be correlated and combined in reports, for example, authentication failures in all middleware components, instances and so on. ■ Audit Loader As its name implies, the audit loader loads audit data from the audit bus-stop into the audit store, if one is configured. For Java component auditing, the audit loader is is a startup class that is started as part of the container start-up. For system components, the audit loader is a periodically spawned process that is invoked by OPMN. ■ Audit Store The audit store is a database that contains a pre-defined Oracle Fusion Middleware Audit Framework schema, created by Repository Creation Utility RCU. Once configured, all the audit loaders are aware of the data store and upload data to it periodically. The audit data in the store is expected to be cumulative and will grow overtime. Ideally, this should not be an operational database used by any other applications - rather, it should be a standalone RDBMS used for audit purposes only. ■ Audit Configuration Mbeans All audit configuration is managed through audit configuration MBeans. For Java components and applications, these MBeans are present in the domain administration server and the audit configuration is centrally managed. For system components, separate MBean instances are present for every component instance. Enterprise Manager UI and command-line tools manage Audit configuration using these MBeans. ■ Oracle Business Intelligence Publisher The data in the audit store is exposed through pre-defined reports in Oracle Business Intelligence Publisher. The reports allow users to drill down the audit data based on various criteria. For example: – Username – Time Range – Application Type – Execution Context Identifier ECID You can also use Oracle Business Intelligence Publisher to create your own audit reports. 11-6 Oracle Fusion Middleware Application Security Guide Figure 11–1 Audit Event Flow Audit Flow The process can be illustrated by looking at the actions taken in the framework when an event say, login occurs at a component like Oracle HTTP Server or Oracle Virtual Directory within an application server instance: 1. Oracle Fusion Middleware Audit Framework is activated for a component when the component starts up. 2. The component calls an audit function to audit the event. 3. The framework checks if events of this type, status, and with certain attributes need to be audited. 4. If so, the audit function is invoked to create the audit event structure and collect event information like the status, initiator, resource, ECID, and so on. 5. The event is stored on a local file in an intermediate location known as the bus-stop; each component has its own bus-stop. 6. The next component in the flow is the Audit Loader, a which is module of the Oracle WebLogic Server instance and provides process control for that instance. The audit loader is responsible for collecting the audit records for all components running in that instance. If a database is configured for an audit store, the audit loader pulls the events from the bus-stops and moves the data to the audit store. Note: The architecture shown in Figure 11–1 contains a data store; if your site did not configure a data store for auditing, the audit records reside in the bus-stop files.