Supported LDAP-, DB-, and File-Based Services

4-4 Oracle Fusion Middleware Application Security Guide

4.3 Packaging Requirements

File-based application policies are defined in the file jazn-data.xml. The only supported way to package this file with an application is to place it in the directory META-INF of an EAR file. File-based application credentials are defined in a file that must be named cwallet.sso. The only supported way to package this file with an application is to place it in the directory META-INF of an EAR file. For details, see Section 21.3, Packaging a Java EE Application Manually. For information about deployment on WebLogic, see Chapter 6, Deploying Secure Applications. On WebSphere, the behavior at deployment is controlled by properties specified in the file META-INFopss-application.xml. For details about policy migration, see Oracle Fusion Middleware Third-Party Application Server Guide. For details about credential migration, see Oracle Fusion Middleware Third-Party Application Server Guide.

4.4 Example Scenarios

The scenarios explained in this section describe the security features adopted by most Oracle ADF applications, Oracle WebCenter, and Web Services Manager Control. They assume that the application employs a security scheme that has the following characteristics: ■ Authentication: it uses the WebLogic Default Authenticator to store users and groups. ■ Authorization: it uses fine-grained JAAS authorization supported by file-based policies and credentials packaged with the application and by policy and credential stores file- or LDAP-based. One of these security schemes is typically employed by applications, such as Oracle ADF or Oracle SOA applications, that require fine-grained JAAS authorization. The various security components in these cases are managed with the appropriate tool. Based on these assumptions, the following scenarios are typical variations on the basic theme; note, however, that the list of variations is not exhaustive. Related Documentation For details about configuring the Default Authenticator, see section Configure Authentication and Identity Assertion Providers in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help. For details about configuring the OPSS security store, see Chapter 8, Configuring the OPSS Security Store. For details about managing policies, see Chapter 9, Managing the Policy Store. For details about managing credentials, see Chapter 10, Managing the Credential Store. Note: Oracle JDeveloper automatically packages the EAR file for a secured Oracle ADF application with all the required files and with the appropriate security configurations, when the EAR file is produced within that environment. About Oracle Platform Security Services Scenarios 4-5 For details about managing Oracle Fusion Middleware on WebSphere Application Server, see Oracle Fusion Middleware Third-Party Application Server Guide. Common Scenario 1 This scenario describes a Java EE application during development. Authentication: The application uses the Default Authenticator, typical in development environments. Authorization: The policy and credential stores are file-based. Variation: The application uses the WebLogic support for SSO and Java EE security. For details about WebLogic support for SSO, see section Configuring Single Sign-On with Web Browsers and HTTP Clients in Oracle Fusion Middleware Securing Oracle WebLogic Server. Common Scenario 2 This scenario describes a Java EE application during development. Authentication: The application uses the Default Authenticator, typical in development environments. Authorization: The policy and credential stores are LDAP-based using the services of the same instance of an Oracle Internet Directory LDAP server. Variation: JAAS is enabled and policies include permissions for the anonymous and the authenticated roles. For details about configuring support for the anonymous and authenticated roles, see Section 2.3, The Authenticated Role, and Section 2.4, The Anonymous User and Role. Common Scenario 3 This scenario describes a Java EE application during development. Authentication: The application uses the Default Authenticator, typical in development environments. Authorization: The policy and credential stores are LDAP-based using the services of the same instance of an Oracle Internet Directory LDAP server. Variation: The application uses Java EE security, JAAS is enabled, and policies include permissions for the anonymous and the authenticated role. It also uses the Credential Store Framework CSF APIs to query, retrieve, and manage policies. For details about configuring support for the anonymous and authenticated roles, see Section 2.3, The Authenticated Role, and Section 2.4, The Anonymous User and Role. For details about CSF APIs, see Section 24.1, About the Credential Store Framework API.

4.5 Other Scenarios

The following scenarios differ from the common scenarios in that the application uses an authenticator other than the DefaultAuthenticator typically used in the application development phase or some API to access security data.