Introduction to Securing SOA Composite Applications

Securing SOA Composite Applications 6-5 For more information on SAML2IdentityAsserter and configuring SSO with web browsers and HTTP clients, see Oracle Fusion Middleware Securing Oracle WebLogic Server. 6.4.2 Automatically Authenticating Oracle BPM Worklist Users in Windows Native Authentication Environments For Windows native authentication through Kerberos to work with Oracle BPM Worklist, you must use the integrationworklistappssologin protected URL. For example, after configuring Windows native authentication, you access Oracle BPM Worklist as follows: http:host_name.domain_name:8001integrationworklistappssologin For information on configuring SSO with Microsoft clients, see Oracle Fusion Middleware Securing Oracle WebLogic Server. 6.4.3 Automatically Authenticating Oracle Business Process Management Process Composer Users in Windows Native Authentication Environments For Windows native authentication through Kerberos to work with Oracle Business Process Management Process Composer, you must use the bpmcomposerssologin protected URL. For example, after configuring Windows native authentication, you access Process Composer as follows: http:host_name.domain_name:8001bpmcomposerssologin For information on configuring SSO with Microsoft clients, see Oracle Fusion Middleware Securing Oracle WebLogic Server.

6.5 Listing the Authentication Provider

This section describes how to set the first authentication provider.

6.5.1 Listing Oracle Internet Directory as the First Authentication Provider

The Oracle BPM Worklist and workflow services use Java Platform Security JPS and the User and Role API. For this reason, the Oracle Internet Directory authenticator must be the first provider listed when workflow is used with Oracle Internet Directory. If Oracle Internet Directory is not listed first for example, it is listed below DefaultAuthenticator, login authentication fails. For information about changing the order of authentication providers, see Oracle Fusion Middleware Securing Oracle WebLogic Server.

6.5.2 Accessing Web-based Applications with the Default Authentication Provider

Logins to web-based applications may fail when using Oracle Internet Directory authentication. This is caused when the Oracle WebLogic Server configuration is set to use the Oracle Internet Directory authentication before default authentication. This may produce the following error: User weblogic is not found in configuration jazn.com Check if the user exists in the repository specified by the configurations. Check the error stack and fix the cause of the error. Contact oracle support if error is not fixable. The order of the security providers should be: 6-6 Oracle Fusion Middleware Administrators Guide for Oracle SOA Suite and Oracle BPM Suite 1. Default authentication 2. Oracle Internet DirectoryLDAP authentication

6.6 Configuring SSL

This section describes configuring SSL in Oracle SOA Suite and Oracle Business Process Management environments.

6.6.1 Recommendation to Configure Either All on No Managed Servers with SSL

As a best practice, Oracle recommends that you configure either all managed servers or no managed servers with SSL SOA, BAM, and so on. Configuring some managed servers with SSL, while not configuring others, may lead to undesirable results in Oracle BPM Worklist and Oracle Web Services Manager OWSM. For example, if there is an SSL-configured managed server bam_server, servers not configured with SSL are not be used by OWSM. In cases in which an SSL-configured server is down, it causes OWSM to be in a down state, which in turn causes Oracle BPM Worklist to be in a down state.

6.6.2 Switching from Non-SSL to SSL Configurations with Oracle BPM Worklist

Switching from non-SSL to SSL configurations with Oracle BPM Worklist requires the Frontend Host and Frontend HTTPS Port fields to be set in Oracle WebLogic Server Administration Console. Not doing so results in exception errors when you attempt to create to-do tasks. To switch from non-SSL to SSL configurations with Oracle BPM Worklist: 1. Log in to Oracle WebLogic Server Administration Console.

2. In the Environment section, select Servers.

3. Select the name of the managed server for example, soa_server1.

4. Select Protocols, then select HTTP.

5. In the Frontend Host field, enter the hostname on which Oracle BPM Worklist is

located.

6. In the Frontend HTTPS Port field, enter the SSL listener port.

7. Click Save.

6.6.3 Configuring SOA Composite Applications for Two-Way SSL Communication

Oracle SOA Suite uses both Oracle WebLogic Server and Sun Secure Socket Layer SSL stacks for two-way SSL configurations. ■ For the inbound web service bindings, Oracle SOA Suite uses the Oracle WebLogic Server infrastructure and, therefore, the Oracle WebLogic Server libraries for SSL. ■ For the outbound web service bindings, Oracle SOA Suite uses JRF HttpClient and, therefore, the Sun JDK libraries for SSL. Due to this difference, start Oracle WebLogic Server with the following JVM option. To configure SOA composite applications for two-way SSL communication: 1. Open the following file: