Policy Parameter Configuration According to Behavior

21-22 Oracle Fusion Middleware Application Security Guide codesource grantee permissions permission class oracle.security.jps.service.policystore.PolicyStoreAccessPermission class namecontext=SYSTEMname actionsgetConfiguredApplicationsactions permission permission class oracle.security.jps.service.policystore.PolicyStoreAccessPermission class namecontext=APPLICATION,name=name actionsgetApplicationPolicyactions permission permissions grant This section describes the supported values for the elements class, name, and actions within a permission.

21.4.6.1 Policy Store Permission

Class name: oracle.security.jps.service.policystore.PolicyStoreAccessPermission When the permission applies to a particular application, use the following pattern for the corresponding element name: context=APPLICATION,name=appStripeName When the permission applies to all applications, use the following name pattern for the corresponding element name: context=APPLICATION,name= When the permission applies to all applications and system policies, use the following name pattern for the corresponding element name: context=APPLICATION The list of values allowed in the corresponding element actions are the following stands for any allowed action: createPolicy getConfiguredApplications getSystemPolicy getApplicationPolicy createApplicationPolicy deleteApplicationPolicy grant revoke Important: All permission classes used in policies must be included in the class path, so the policy provider can load them when a service instance is initialized. Manually Configuring Java EE Applications to Use OPSS 21-23 createAppRole alterAppRole removeAppRole addPrincipalToAppRole removePrincipalFromAppRole hasPermission containsAppRole

21.4.6.2 Credential Store Permission

Class name: oracle.security.jps.service.credstore.CredentialAccessPermission When the permission applies to a particular map and a particular key in that map, use the following pattern for the corresponding element name: context=SYSTEM,mapName=myMap,keyName=myKey When the permission applies to a particular map and all keys in that map, use the following pattern for the corresponding element name: context=SYSTEM,mapName=myMap,keyName= The list of values allowed in the corresponding element actions are the following stands for any allowed action: read write update delete

21.4.6.3 Generic Permission

Class name: oracle.security.jps.JpsPermission When the permission applies to an assertion performed by a callback instance of oracle.security.jps.callback.IdentityCallback, use the following pattern for the corresponding element name: IdentityAssertion The only value allowed in the corresponding element actions is the following: execute

21.4.7 Specifying Bootstrap Credentials Manually

This topic is for an administrator who is not using Oracle Fusion Middleware Control to perform reassociation to an LDAP-based store. The credentials needed for an administrator to connect to and access an LDAP directory must be specified in a separate file named cwallet.sso bootstrap credentials and configured in the file jps-config.xml. These credentials are stored after the LDAP reassociation process. Bootstrap credentials are always file-based. Every instance of an LDAP-based policy or credential store must specify bootstrap credentials in a jpsContex element that must be named bootstrap_ credstore_context, as illustrated in the following excerpt: 21-24 Oracle Fusion Middleware Application Security Guide serviceInstances ... serviceInstance location=.bootstrap provider=credstoressp name=bootstrap.cred property value=.bootstrap name=location serviceInstance ... serviceInstances jpsContext name=bootstrap_credstore_context serviceInstanceRef ref=bootstrap.cred jpsContext In the example above, the bootstrap credential cwallet.sso is assumed located in the directory bootstrap. An LDAP-based policy or credential store instance references its credentials using the properties bootstrap.security.principal.key and bootstrap.security.principal.map, as illustrated in the following instance of an LDAP-based policy store: serviceInstance provider=ldap.policystore.provider name=policystore.ldap ... property value=bootstrapKey name=bootstrap.security.principal.key ... serviceInstance If the property bootstrap.security.principal.map is not specified in the service instance, its value defaults to BOOTSTRAP_JPS. To modify or add bootstrap credentials with OPSS scripts, see Section 10.4.5, modifyBootStrapCredential, and Section 10.4.6, addBootStrapCredential.

21.4.8 Migrating Identities with migrateSecurityStore

Identity data can be migrated manually from a source repository to a target LDAP repository using the OPSS script migrateSecurityStore. The script produces an LDIF file that after minor manual editing can be imported into an LDAP-based identity store and can be used with any source 10g or 11g file-based identity store. For example, this script can be used to convert user and role information in a 10.1.x jazn-data.xml file to user and role information in WebLogic LDIF format; the LDIF output file can then be imported into the WebLogic embedded LDAP identity store after changing the password for each user see note at the end of this section. This script is offline, that is, it does not require a connection to a running server to operate; therefore, the configuration file passed to the argument configFile need not be an actual domain configuration file, but it can be assembled just to specify the source and destination repositories of the migration. This script can be run in interactive mode or in script mode, on WebLogic Server, and in interactive mode only, on WebSphere. In interactive mode, you enter the script at a command-line prompt and view the response immediately after. In script mode, you write scripts in a text file with a py file name extension and run it without requiring input, much like the directives in a shell script. For platform-specific requirements to run an OPSS script, see Important Note . Manually Configuring Java EE Applications to Use OPSS 21-25 Script and Interactive Modes Syntaxes To migrate identities on WebLogic, use the script first or interactive second syntaxes arguments are written in separate lines for clarity: migrateSecurityStore -type idStore -configFile jpsConfigFileLocation -src srcJpsContext -dst dstJpsContext [-dstLdifFile LdifFileLocation] migrateSecurityStoretype=idStore, configFile=jpsConfigFileLocation, src=srcJpsContext, dst=dstJpsContext, [dstLdifFile=LdifFileLocation] For details about running OPSS scripts on WebSphere Application Server, see The meaning of the arguments all required except dstLdifFile is as follows: ■ configFile specifies the location of a configuration file jps-config.xml relative to the directory where the script is run. ■ src specifies the name of a jps-context in the configuration file passed to the argument configFile, where the source store is specified. ■ dst specifies the name of another jps-context in the configuration file passed to the argument configFile, where the destination store is specified. The destination store must be an LDAP-based identity store. For list of supported types, see Section 3.1.1, Supported LDAP Identity Store Types. ■ dstLdifFile specifies the relative or absolute path to the LDIF file created. Applies only when the destination is an LDAP-based Oracle Internet Directory store, such as the embedded LDAP. Notice that the LDIF file is not imported into the LDAP server and, typically, requires manual editing. The contexts passed to src and dst must be defined in the passed configuration file and must have distinct names. From these two contexts, the script determines the locations of the source and the target repositories involved in the migration.

21.4.9 Example of Configuration File jps-config.xml

The following sample shows a complete jps-config.xml file that illustrates the configuration of several services and properties; they apply to both Java EE and Java SE applications. ?xml version=1.0 encoding=UTF-8 standalone=yes? jpsConfig xmlns=http:xmlns.oracle.comoracleasschema11jps-config-11_1.xsd property value=off name=oracle.security.jps.jaas.mode propertySets propertySet name=saml.trusted.issuers.1 property value=www.oracle.com name=name propertySet propertySets Important: The password of every user in the output LDIF file is not the real user password, but the fake string weblogic. In case the destination is an LDAP-based Oracle Internet Directory store, the fake string is change. Therefore, before importing the LDIF file into the target LDAP store, the security administrator would typically edit this file and change the fake passwords for real ones. 21-26 Oracle Fusion Middleware Application Security Guide serviceProviders serviceProvider class=oracle.security.jps.internal.credstore.ssp.SspCredentialStoreProvider name=credstoressp type=CREDENTIAL_STORE descriptionSecretStore-based CSF Providerdescription serviceProvider serviceProvider class=oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider name=idstore.ldap.provider type=IDENTITY_STORE descriptionLDAP-based IdentityStore Providerdescription serviceProvider serviceProvider class=oracle.security.jps.internal.idstore.xml.XmlIdentityStoreProvider name=idstore.xml.provider type=IDENTITY_STORE descriptionXML-based IdentityStore Providerdescription serviceProvider serviceProvider class=oracle.security.jps.internal.policystore.xml.XmlPolicyStoreProvider name=policystore.xml.provider type=POLICY_STORE descriptionXML-based PolicyStore Providerdescription serviceProvider serviceProvider class=oracle.security.jps.internal.login.jaas.JaasLoginServiceProvider name=jaas.login.provider type=LOGIN descriptionJaasLoginServiceProvider to conf loginMod servInstsdescription serviceProvider serviceProvider class=oracle.security.jps.internal.keystore.KeyStoreProvider name=keystore.provider type=KEY_STORE descriptionPKI Based Keystore Providerdescription property value=owsm name=provider.property.name serviceProvider serviceProvider class=oracle.security.jps.internal.audit.AuditProvider name=audit.provider type=AUDIT descriptionAudit Servicedescription serviceProvider serviceProvider class=oracle.security.jps.internal.credstore.ldap.LdapCredentialStoreProvider name=ldap.credentialstore.provider type=CREDENTIAL_STORE serviceProvider class=oracle.security.jps.internal.policystore.ldap.LdapPolicyStoreProvider name=ldap.policystore.provider type=POLICY_STORE property value=OID name=policystore.type serviceProvider serviceProviders serviceInstances serviceInstance location=. provider=credstoressp name=credstore descriptionFile Based Credential Store Service Instancedescription serviceInstance serviceInstance provider=idstore.ldap.provider name=idstore.ldap property value=oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider name=idstore.config.provider serviceInstance serviceInstance location=.system-jazn-data.xml provider=idstore.xml.provider name=idstore.xml descriptionFile Based Identity Store Service Instancedescription property value=jazn.com name=subscriber.name serviceInstance