Understanding Service Providers Working with Service Providers

25-12 Oracle Fusion Middleware Application Security Guide Logger mylogr = Logger.getLoggermylogger.abc.com; FileHandler fh = new FileHandleruserroleapi.log; mylogr.addHandlerfh; … factEnv.putOIDIdentityStoreFactory.ST_LOGGER_NAME, mylogger.abc.com; oidFactory = builder.getIdentityStoreFactory oracle.security.idm.providers.oid. OIDIdentityStoreFactory, factEnv; This code directs that all the log messages should be redirected to the log file named userroleapi.log.

25.3.6.3 Supplying Constant Values

You can overwrite constants or pre-supply values for missing constants by supplying the map in the ST_PROPERTY_ATTRIBUTE_MAPPING property during factory creation. This example code sets the mapping of RoleProfile.OWNER to the myowner attribute. In this way, all operations related to the owner, such as getOwners, getOwnedRoles, and so on, are performed using this attribute. factEnv.put IPIdentityStoreFactory.ST_SECURITY_PRINCIPAL, User DN; factEnv.put IPIdentityStoreFactory.ST_SECURITY_CREDENTIALS, User password; factEnv.putIPIdentityStoreFactory.ST_LDAP_URL, ldap:ldaphost:port; Map m = new Hashtable; m.putRoleProfile.OWNER, myowner; factEnv.put IPIdentityStoreFactory.ST_PROPERTY_ATTRIBUTE_MAPPING, m; ipFactory = builder.getIdentityStoreFactory oracle.security.idm.providers.iplanet.IPIdentityStoreFactory, factEnv;

25.3.6.4 Configuring Connection Parameters

You can configure the connection pool parameters for minimummaximum connections using ST_CONNECTION_POOL_MIN_CONNECTIONS and ST_ CONNECTION_POOL_MAX_CONNECTIONS respectively. By default, the values for these parameters are 0 and 10 respectively. There is an additional restriction that: ST_CONNECTION_POOL_MAX_CONNECTIONS - ST_CONNECTION_POOL_MIN_CONNECTIONS = 10 Here is an example: factEnv.put LDIdentityStoreFactory.ST_CONNECTION_POOL_MIN_CONNECTIONS, 3; factEnv.put LDIdentityStoreFactory.ST_CONNECTION_POOL_MAX_CONNECTIONS, 16; Developing with the User and Role API 25-13

25.3.6.5 Configuring a Custom Connection Pool Class

To use a custom connection pool, you must provide the fully qualified class name of the custom connection pool class, as follows: factEnv.putOIDIdentityStoreFactory.ST_CONNECTION_POOL_CLASS, oracle.security.idm.providers.stdldap.JNDIPool; For related information, see Section L.6, Failure to Connect to the Embedded LDAP Authenticator.

25.3.7 Configuring the Provider when Creating a Store Instance

The IdentityStore configuration affects the store object and all objects that are created using this store instance. A configuration parameter commonly used with the store is ST_SUBSCRIBER_NAME, which is the only start-time property accepted here. All the runtime properties can be supplied during identity store creation. Continuing with the earlier example in Section 25.3.6, Configuring the Provider when Creating a Factory Instance which created a factory instance, this code creates a handle instance to the store. IdentityStore oidStore = null; Hashtable storeEnv = new Hashtable; Creating the store instance storeEnv.putOIDIdentityStoreFactory.ST_SUBSCRIBER_NAME, dc=us,dc=oracle,dc=com; oidStore = oidFactory.getIdentityStoreInstancestoreEnv;

25.3.8 Runtime Configuration

Earlier, in Section 25.3.6, Configuring the Provider when Creating a Factory Instance and Section 25.3.7, Configuring the Provider when Creating a Store Instance , we demonstrated how to perform configuration when creating an instance. To facilitate adding and modifying properties at runtime, the User and Role APIs also provide a Configuration class. The Configuration instance can be obtained from the store instance using the IdentityStore.getStoreConfiguration API call. Properties can be modified using the configuration object. Only runtime properties can be modified using this approach, and the effect is visible only at runtime. This example sets the RT_USER_SEARCH_BASES property: StoreConfiguration conf = oidStore.getStoreConfiguration; conf.setProperty“RT_USER_SEARCH_BASES”, “dc=us,dc=oracle,dc=com”;

25.3.9 Programming Considerations

This section contains tips for working with providers and provider artifacts. Note: Directories require that you supply a valid subscriber name. For Oracle Internet Directory, you can supply the STsubscriber name as either a proper DN or as the nickname of the realm.