Specifying Bootstrap Credentials Manually

22-2 Oracle Fusion Middleware Application Security Guide – Section JAAS Authentication Development Environment in Chapter 4 in Oracle Fusion Middleware Programming Security for Oracle WebLogic Server ■ For links to all OPSS API javadocs, see Section H.1, OPSS API References.

22.2 Authentication for Java SE Applications

This section explains the identity store support for Java SE applications, and it includes the following sections: ■ The Identity Store ■ Configuring an LDAP Identity Store in Java SE Applications ■ Supported Login Modules for Java SE Applications ■ Using the OPSS API LoginService in Java SE Applications For details about authorization in Java SE applications, see Section 23.1, Configuring Policy and Credential Stores in Java SE Applications.

22.2.1 The Identity Store

Authentication is the mechanism by which callers prove that they are acting on behalf of specific users or system. Using data, such as name-password combinations, authentication answers the question Who are you? The term identity store refers to the storage where identity data is kept, and authentication providers are ways to access an identity store. An application obtains information from an OPSS security store identity, policy, or credential store and manages its contents using the OPSS APIs, as illustrated in the following graphic:

22.2.2 Configuring an LDAP Identity Store in Java SE Applications

A Java SE application can use an LDAP-based identity store configured in the file jps-config-jse.xml with the elements serviceProvider, serviceInstance, and jpsContext, as illustrated in the following snippet: serviceProviders serviceProvider type=IDENTITY_STORE name=idstore.ldap.provider class=oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider descriptionPrototype LDAP-based ID storedescription serviceProvider serviceProviders serviceInstances serviceInstance name=idstore.ldap provider=idstore.ldap.provider property name=idstore.type value=OID Authentication for Java SE Applicaitons 22-3 property name=security.principal.alias value=MyCredentialMapName property name=security.principal.key value=MyCredentialMapKey property name=ldap.url value={LDAP_URI} property name=max.search.filter.length value=500 extendedProperty nameuser.search.basesname values valuecn=users,dc=us,dc=oracle,dc=comvalue values extendedProperty extendedProperty namegroup.search.basesname values valuecn=groups,dc=us,dc=oracle,dc=comvalue values extendedProperty serviceInstance serviceInstances jpsContexts default=ldap_idstore jpsContext name=ldap_idstore serviceInstanceRef ref=idstore.ldap jpsContext jpsContext name=bootstrap_credstore_context serviceInstanceRef ref=bootstrap.cred jpsContext jpsContexts Note the following points: ■ The name of the serviceInstance idstore.ldap in the example above can have any value, but it must match the instance referenced in element serviceInstanceRef. ■ The name of the serviceProvider idstore.ldap.provider in the example above can have any value, but it must match the provider in element serviceInstance. ■ To add properties to a provider instance with a prescribed script, see Appendix E.1, Configuring OPSS Service Provider Instances with a WLST Script. ■ The credentials to access the identity LDAP store are specified with the instance properties security.principal.key and security.principal.alias and stored in the bootstrap credential store.

22.2.3 Supported Login Modules for Java SE Applications

A login module is a component that authenticates users and populates a subject with principals. This process occurs in two distinct phases: during the first phase, the login module attempts to authenticate a user requesting, as necessary, a name and a password or some other credential data; only if this phase succeeds, the second phase is invoked. During the second phase, the login module assigns relevant principals to a subject, which is eventually used to perform some privileged action.

22.2.3.1 The Identity Store Login Module

A Java SE application can use a stack of login modules to authenticate its users; each module in the stack performs its own computations independently from the others in the stack. These and other services are specified in the file jps-config-jse.xml.