About Named Password Connections Guidelines for Proxy Connections Data

5-60 Oracle Fusion Middleware System Administrators Guide for Oracle Content Server This section covers the following topics: ■ Section 5.8.3.1, About Named Password Connections ■ Section 5.8.3.2, Guidelines for Proxy Connections Data ■ Section 5.8.3.3, Creating a Proxied Connection

5.8.3.1 About Named Password Connections

Using the Proxied Connection AuthenticationAuthorization Information Screen you can create named passwords, which are passwords that you assign to specific connections by name. Each named password can be associated with a host and IP address filter on both the direct socket communication to an Oracle Content Server instance and on any communication performed through the controlling web server the HTTP filter for an Oracle Content Server instance. When an outside agent such as a web server for another Oracle Content Server instance wants to communicate with the Oracle Content Server instance, it can use a named password connection. A named password connection also can be associated with a credentials map so that the privileges of users accessing the Oracle Content Server instance can be reduced or changed. Proxy connections entry fields are provided in the forms for configuring outgoing socket providers and outgoing HTTP providers in which you can specify a named password connection. To view provider selections for your instance, select Administration , Providers. Passwords are hashed SHA1 message digest with their allowed host and IP address wildcard filter on the client side. If the copy of a stored password is exposed, it will only allow access from clients that satisfy both the host and IP address filter. The expiration implementation for passwords means that the various servers involved must have their clocks reasonably synchronized within a few minutes at least.

5.8.3.2 Guidelines for Proxy Connections Data

The data you enter in the Proxied Connection AuthenticationAuthorization Information Screen defines different passwords that can be used by external agents to connect to an Oracle Content Server instance. Instead of an external agent being forced to provide a password for each user, which may be unavailable to the client for many reasons such as message digest algorithms that do not use clear text passwords, proxy connections enable the agent to authenticate using a single named connection password. Each named password connection can be linked to rules to restrict which hosts can connect to the Oracle Content Server instance and to control the privileges granted to users. Each named password connection is uniquely identified, and the calling agent must supply the identifier along with the password. Caution: All passwords are hashed by a time-out value before being sent to a server. If a password value is exposed while in communication to a server, the password will only be usable until the expiration time approximately fifteen minutes after the time the request is issued. Also, the password will only be usable in a replay attack from the same source host and IP address, as previously described. If firewall-protected internal host and IP addresses are not being used, a very committed attacker could spoof the host and IP addresses by hijacking any of the major DNS servers, an event that has occurred in at least a couple of cases. Managing Security and User Access 5-61 The host name and IP address filters are used to determine which host names or IP addresses are allowed to use a named password connection when performing direct socket connections to an Oracle Content Server instance. The rules for defining the filters are identical to those defined in the System Properties editor the wildcard symbols = match 0 or many and | = match either or can be used to create flexible rules. If an entry is empty then it provides no restriction on its target attribute either the host name or IP address of the client depending on which of the following two fields is involved. Two options are implemented through the Providers page: ■ Whenever you add an outgoing provider you have the option to use named password connections and to choose whether the provider is a connecting server so that Web access and security is controlled through a remote server. ■ Whenever you add a user provider such as LDAP you can choose to use an available credentials map. No credentials maps are defined in the Proxied Connection AuthenticationAuthorization Information Screen . For information on creating a credentials map, see Section 5.8.2, Credential Mapping.

5.8.3.3 Creating a Proxied Connection