Java EE Application using OPSS APIs Authenticating with OPSS APIs

Developing Secure Applications with Oracle Platform Security Services 19-13 service-oriented architecture. The tools build upon the core foundations of cryptography, public key infrastructure, web services security, and federated identity management, and are widely used in building Oracles own security offerings. For more information about the tools, see: ■ Oracle Security Developer Toolkit in the Oracle Fusion Middleware Security Overview ■ Oracle Fusion Middleware Reference for Oracle Security Developer Tools

19.6 Using OPSS Outside Oracle JDeveloperOracle ADF

You can make use of OPSS APIs in your applications if you are using a development IDE other than Oracle JDeveloper and Oracle ADF. However, in that case, you will need to perform manual configuration in OPSS configuration files and web.xml, so you do not get the benefits of automatic configuration and security migration that are available when using Oracle JDeveloper. For more information about this topic, see Chapter 21, Manually Configuring Java EE Applications to Use OPSS . 19-14 Oracle Fusion Middleware Application Security Guide 20 The OPSS Policy Model 20-1 20 The OPSS Policy Model This chapter explains the OPSS policy and authorization models in the following sections: ■ The Security Policy Model ■ Authorization Overview ■ The JAASOPSS Authorization Model

20.1 The Security Policy Model

For details about the OPSS policy model and the security artifacts used in it, see Oracle Fusion Middleware Administrators Guide for Oracle Entitlements Server.

20.2 Authorization Overview

This section compares and contrasts the authorization available in the Java EE and the JAAS models, in the following sections: ■ Introduction to Authorization ■ The Java EE Authorization Model ■ The JAAS Authorization Model

20.2.1 Introduction to Authorization

A Java 2 policy specifies the permissions granted to signed code loaded from a given location. A JAAS policy extends Java 2 grants by allowing an optional list of principals; permissions are granted only to code from a given location, possibly signed, and run by a user represented by those principals. The Policy Store is a repository of system and application-specific policies and roles. Application roles can be granted mapped to enterprise users and groups specific to the application such as administrative roles. A policy can grant permissions to any of these roles, groups, or users as principals. For more details about policy-related security artifacts, see Chapter 3.2, Policy Store Basics. An application can delegate the enforcement of authorization to the container, or it can implement its own enforcement of policy checking with calls to methods such as checkPermission, checkBulkAuthorization, or getGrantedResources. For details about policy checking with API calls, see Checking Policies .