Message Authentication Directly access the Portal page by entering the URL noted in Step 4 into your

Enhancing Java Portlets 7-43

7.2.7.8 HTTPS Communication

Normal communication between Oracle Portal and a provider uses HTTP, a network protocol that transmits data as plain text using TCP as the transport layer. HTTPS uses an extra secured layer SSL on top of TCP to secure communication between a client and a server, making it difficult to intercept and read messages. Each entity for example, an Oracle Web Cache instance receiving a communication using SSL has a freely available public key and a private key known only to the entity itself. Any messages sent to an entity are encrypted with its public key. A message encrypted by the public key may only be decrypted by the private key so that, even if a message is intercepted by a felonious third party, it cannot be decrypted. Certificates used to sign communications ensure that the public key does in fact belong to the correct entity. These are issued by trusted third parties, known as Certification Authorities CA. They contain an entitys name, public key, and other security credentials and are installed on the server end of an SSL communication to verify the identity of the server. Client certificates may also be installed on the client to verify the identity of a client. Oracle Wallet Manager manages public key security credentials. It generates public and private key pairs, creates a certificate request to a CA, and installs the certificate on a server. For more information on this topic, refer to the Oracle Fusion Middleware Administrators Guide for Oracle Portal. Configuration of SSL When a provider is registered from an Oracle Portal instance, only one URL is entered, which means either HTTP or HTTPS may be used but not both. Each port on each server that may be used to receive SSL messages must have a server-side certificate installed that is, an OracleAS Web Cache instance in front of the Web provider and the server that hosts the provider. The certificate installed on a server port ensures that communication between two points is encrypted but does not authenticate the source of a message. Message authentication should be used as well to fully secure communication between a trusted Oracle Portal instance and a provider. For more information about SSL configuration for Oracle Portal, refer to the Oracle Fusion Middleware Administrators Guide for Oracle Portal.

7.2.7.9 LDAP Oracle Internet Directory Security

PDK-Java uses Portlet Security Managers for LDAP Oracle Internet Directory security. PDK-Java uses Oracle Internet Directory as a repository of users, groups, and permissions. It retrieves information about the logged-in user and determines whether the user has the required permissions to view the portlet and data within the portlet. By enabling Oracle Internet Directory security, your providers perform the following: ■ Secure portlets based on groups. ■ Restrict access to the administrative functions of your portlets using your own security manager. ■ Retrieve all of the user property information stored in the Oracle Internet Directory including first name, last name, title, e-mail, telephone number, groups, and photo. ■ Create users and groups for Oracle Portal. 7-44 Oracle Fusion Middleware Developers Guide for Oracle Portal By default, Oracle Internet Directory security is disabled. You must make a change in the deployment properties file for a specific provider to enable this feature. Enabling and using Oracle Internet Directory to secure your portlets can be done quickly and easily. To do this, perform the following steps: 1. Enable the Oracle Internet Directory manager in the deployment properties files provider_name.properties. oidManager=true oidAdminClass=class_that_extends_oracle.portal.provider.v2.oid.OidInfo 2. Provide the connection information for Oracle Internet Directory by extending the simple class called OidInfo. 3. Provide a list of groups that can view your portlet in the provider definition file. groupcn=group1,cn=groups,dc=us,dc=oracle,dc=comgroup Your provider connects to Oracle Internet Directory using the information provided to the OidInfo class by you. The portlet accesses Oracle Internet Directory using the credentials provided for example, user name and password and performs the specified tasks. We recommend that you create an Oracle Internet Directory user specifically for your provider connection with the minimum set of privileges needed to complete the tasks requested by your portlets. For example, if your portlet only checks group information, do not connect to the Oracle Internet Directory as an administrator.

7.2.7.9.1 Implementing Oracle Internet Directory Security PDK-Java provides a set of

default classes specifically for Oracle Internet Directory integration. These classes handle the connection from your portlets to Oracle Internet Directory, enable your portlets to be secured based on Oracle Portal groups, and provide access to user property information from within Oracle Internet Directory. The classes used by your Web provider for Oracle Internet Directory integration are as follows: ■ oracle.portal.provider.v2.oid.OidInfo receives the Oracle Internet Directory connection information provided by the developer and connects to Oracle Internet Directory. When building your own portlets, you should extend this class to send secure connection details from the provider to Oracle Internet Directory. ■ oracle.portal.sample.v2.devguide.oid.UnsafeOidInfo is an extension of OidInfo and provides an easy way to test portlet security. This class is used by the Oracle Internet Directory samples in PDK-Java and parses the deployment properties file for the Oracle Internet Directory connection information seen subsequently. This class should be used only for testing and development, it is not safe to use in a production scenario. ■ oidManager is set to false by default. It must be set to true in provider_ name .properties to enable Oracle Internet Directory. If you have only one provider in your Web application, ensure that provider_name.properties is identical to _default.properties. For example: serviceClass=oracle.webdb.provider.v2.adapter.soapV1.ProviderAdapter loaderClass=oracle.portal.provider.v2.http.DefaultProviderLoader showTestPage=true definition=providerslab_providerprovider.xml autoReload=true oidManager=true oidAdminClass=oracle.portal.sample.v2.devguide.oid.UnsafeOidInfo oidHost=myhost.mydomain.com Enhancing Java Portlets 7-45 oidPort=oidPort oidUser=oidUser oidPasswd=oidPassword ■ oidAdminClass is set to the class that extends OidInfo. PDK-Java provides UnsafeOidInfo by default, but as the name suggests, this class should not be used in production scenarios. – oidHost is the machine where Oracle Internet Directory is hosted. – oidPort is the port used by the Oracle Internet Directory. – oidUser is the Oracle Internet Directory account. – oidPasswd is the Oracle Internet Directory password. For example: serviceClass=oracle.webdb.provider.v2.adapter.soapV1.ProviderAdapter loaderClass=oracle.portal.provider.v2.http.DefaultProviderLoader showTestPage=true definition=providerslab_providerprovider.xml autoReload=true oidManager=true oidAdminClass=oracle.portal.sample.v2.devguide.oid.UnsafeOidInfo oidHost=myhost.mydomain.com oidPort=oidPort oidUser=oidUser oidPasswd=oidPassword ■ oracle.portal.provider.v2.security.GroupSecurityManager manages which groups have access to your provider and its portlets. It retrieves this information from the provider definition file and is portlet specific. Each portlet in a provider may have different group settings. There is no limit on the number of groups that can be set using this tag, but, since the Web provider parses and validates each group in turn, listing many groups may degrade performance. ■ group is the tag in provider.xml that handles group management. It lists the groups allowed to access the portlet. The group information here follows the same case sensitivity as the Oracle Internet Directory. securityManager class=oracle.portal.provider.v2.security. GroupSecurityManager groupcn=DBA,cn=portal_instance_id,cn=groups, dc=us,dc=oracle,dc=comgroup securityManager For more information on the syntax of provider.xml, refer to the provider Javadoc on OTN: http:www.oracle.comtechnologyproductsiasportalhtmljavadocx ml_tag_reference_v2.html The advantages of Oracle Internet Directory security are as follows: ■ Offers a simple, powerful way to secure your portlets. Note: The following example refers to your portal_instance_id, which is specific to your installation. To find your instance identifier, refer to your Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory.