Cryptography Integrating the Credential Store

Developing Secure Applications with Oracle Platform Security Services 19-7 Figure 19–2 Java EE Application using Multiple OPSS APIs Key features include: ■ Integration with Oracle WebLogic Server ■ Credential Store Framework API to secure credentials in the LDAP directory or file-based credential store. Different types of credentials will be stored here - external database credentials, external Web Service credentials, and so on. ■ User and Role API to query attributes stored in the identity store ■ JpsAuth.checkPermission API for authorization

19.3.2 Authenticating with OPSS APIs

Developers have the following choices when implementing authentication: ■ Declarative authentication, where authentication is configured in the file web.xml this is standard Java EE security ■ Programmatic security. Oracle Fusion Middleware provides several APIs, including: – Oracle WebLogic Server’s authentication API, weblogic.security.auth.Authenticate – OPSS oracle.security.jps.service.login.LoginService API for Java SE applications. This API supports userpassword authentication and username assertion. The assertion functionality is protected by JpsPermission with the name IdentityAssertion. Figure 19–3 illustrates a Java EE application that must assert an identity through a token or through user credentials. 19-8 Oracle Fusion Middleware Application Security Guide Figure 19–3 Programmatic Authentication Key features include: ■ Username and password supplied by the application for programmatic authentication with the Authenticate API ■ Uses a WebLogic authenticator ■ Identity assertion through a token authentication without a password ■ Assertion protected by a code source permission. Only applications that have been granted the code source permission codebase permission grant oracle.security.jps.JpsPermission with name IdentityAssertion nd action execute can use this API for identity assertion.

19.3.3 Programmatic Authorization

Figure 19–4 illustrates a Java EE application using portable, fine-grained authorization. Figure 19–4 Fine-grained Authorization Key features include: ■ Authorization through JpsAuth.checkPermission API calls ■ Auditing of authorization decisions

19.3.4 Credential Store Framework

Figure 19–5 illustrates an application needing to access and store credentials for an external system such as a database. See Also: ■ Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server ■ Chapter 22, Authentication for Java SE Applicaitons .