In the left pane of the Console, under Domain Structure, select the domain for Select Configuration Security and click Advanced.

3 Understanding Identities, Policies, and Credentials 3-1 3 Understanding Identities, Policies, and Credentials Applications use the identity, policy, and credential stores configured in the domain in which they run. This chapter introduces the basic concepts regarding identity, policy, and credential data, and it is divided into the following sections: ■ Authentication Basics ■ Policy Store Basics ■ Credential Store Basics For definitions of the terms used in this chapter, see Section 2.1, Terminology. For scenarios illustrating the use of stores, see Chapter 4, About Oracle Platform Security Services Scenarios.

3.1 Authentication Basics

OPSS uses server authentication providers, components that validate user credentials or system processes based on a user name-password combination or a digital certificate. Authentication providers also make user identity information available to other components in a domain through subjects when needed. Java EE applications must use LDAP-based authentication providers; Java SE applications use file-based identity stores out-of-the-box, but the identity store can be configured to be LDAP-based. For further details, see section Authentication in Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server. This section covers the following topics: ■ Supported LDAP Identity Store Types ■ Oracle WebLogic Authenticators Note: OPSS does not support automatic migration of users and groups used in application development to a remote WebLogic Server where an application may be deployed. Instead, one must independently create the necessary application identities using the Oracle WebLogic Administration Console, OPSS scripts, or the appropriate tool depending on the authentication providers configured in your domain. 3-2 Oracle Fusion Middleware Application Security Guide ■ WebSphere Identity Stores

3.1.1 Supported LDAP Identity Store Types

The following list enumerates the LDAP repositories supported for an identity store: ■ Oracle Internet Directory 11g ■ Oracle Virtual Directory ■ Oracle Directory Server Enterprise Edition 11.1.1.3.0 ■ Active Directory 2008 ■ Novell eDirectory 8.8 ■ OpenLDAP 2.2. For the special configuration required for this type, see Appendix J, Using an OpenLDAP Identity Store. ■ Tivoli Access Manager ■ Sun DS 6.3, 7.0 ■ Oracle DB 10g, 11gR1, 11gR2 ■ iPlanet Directory Server ■ Custom Authenticator For information about Oracle Fusion Middleware Certification and Supported Configurations, visit http:www.oracle.comtechnologysoftwareproductsiasfilesfus ion_certification.html . In regards to support for reference integrity in Oracle Internet Directory servers, see Important note Section 8.2, Using an LDAP-Based OPSS Security Store.

3.1.2 Oracle WebLogic Authenticators

For a list of WebLogic authenticator providers, see chapter 4, Authentication Providers in Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server. For details about the available authenticators, and choosing and configuring one, see section Configuring Authentication Providers in Oracle Fusion Middleware Securing Oracle WebLogic Server, and section Configure Authentication and Identity Assertion providers in Oracle Fusion Middleware Oracle WebLogic Server Administration Console Help. By default and out-of-the-box, Oracle WebLogic Server stores users and groups in the DefaultAuthenticator. This authenticator is setup to use cn as the default attribute. The data stored in any LDAP authenticator can be accessed by the User and Role API to query user profile attributes. For details about WebLogic LDAP authenticators, see the following sections: ■ Using an LDAP Authenticator ■ Configuring the LDAP Identity Store Service ■ Additional Authentication Methods