listAppStripes Managing Application Policies with OPSS Scripts

9-16 Oracle Fusion Middleware Application Security Guide Interactive Mode Syntax listAppRolesappStripe=appName The meaning of the argument required is as follows: ■ appStripe specifies an application stripe. Example of Use The following invocation returns all the roles with application stripe myApp: listAppRoles.py -appStripe myApp

9.3.7 listAppRolesMembers

The script listAppRoleMembers lists all members in a role with a given application stripe and role name. Script Mode Syntax listAppRoleMembers.py -appStripe appName -appRoleName roleName Interactive Mode Syntax listAppRoleMembersappStripe=appName, appRoleName=roleName The meanings of the arguments all required are as follows: ■ appStripe specifies an application stripe. ■ appRoleName specifies a role name. Example of Use The following invocation returns all the members in a role with application stripe myApp and name myRole: listAppRoleMembers.py -appStripe myApp -appRoleName myRole

9.3.8 grantPermission

The script grantPermission creates a permission granted to a code base or URL or principal, in either an application policy or the global policy section. Script Mode Syntax grantPermission [-appStripe appName] [-codeBaseURL url] [-principalClass prClassName] [-principalName prName] -permClass permissionClassName [-permTarget permName] [-permActions comma_separated_list_of_actions] Interactive Mode Syntax grantPermission[appStripe=appName,] [codeBaseURL=url,] [principalClass=prClassName,] [principalName=prName,] permClass=permissionClassName, [permTarget=permName,] [permActions=comma_separated_list_of_actions] Managing the Policy Store 9-17 The meanings of the arguments optional arguments are enclosed in between square brackets are as follows: ■ appStripe specifies an application stripe. If not specified, then the script works on system policies. ■ codeBaseURL specifies the URL of the code granted the permission. ■ principalClass specifies the fully qualified name of a class grantee. ■ principalName specifies the name of the grantee principal. ■ permClass specifies the fully qualified name of the permission class. ■ permTarget specifies, when available, the name of the permission target. Some permissions may not include this attribute. ■ permActions specifies the list of actions granted. Some permissions may not include this attribute and the actions available depend on the permission class. Examples of Use The following invocation creates an application permission for the application with application stripe myApp with the specified data: grantPermission.py -appStripe myApp -principalClass my.custom.Principal -principalName manager -permClass java.security.AllPermission The following invocation creates a system permission with the specified data: grantPermission.py -principalClass my.custom.Principal -principalName manager -permClass java.io.FilePermission -permTarget tmpfileName.ext -permActions read,write

9.3.9 revokePermission

The script revokePermission removes a permission from a principal or code base defined in an application or the global policy section. Script Mode Syntax revokePermission [-appStripe appName] [-codeBaseURL url] [-principalClass prClassName] [-principalName prName] -permClass permissionClassName [-permTarget permName] [-permActions comma_separated_list_of_actions] Interactive Mode Syntax revokePermission[appStripe=appName,][codeBaseURL=url,] [principalClass=prClassName,] [principalName=prName,] permClass=permissionClassName, [permTarget=permName,] [permActions=comma_ separated_list_of_actions ] The meanings of the arguments optional arguments are enclosed in between square brackets are as follows: 9-18 Oracle Fusion Middleware Application Security Guide ■ appStripe specifies an application stripe. If not specified, then the script works on system policies. ■ codeBaseURL specifies the URL of the code granted the permission. ■ principalClass specifies the fully qualified name of a class grantee. ■ principalName specifies the name of the grantee principal. ■ permClass specifies the fully qualified name of the permission class. ■ permTarget specifies, when available, the name of the permission target. Note that some permissions may not include this attribute. ■ permActions specifies the list of actions removed. Note that some permissions may not include this attribute and the actions available depend on the permission class. Examples of Use The following invocation removes the application permission for the application with application stripe myApp with the specified data: revokePermission.py -appStripe myApp -principalClass my.custom.Principal -principalName manager -permClass java.security.AllPermission The following invocation removes the system permission with the specified data: revokePermission.py -principalClass my.custom.Principal -principalName manager -permClass java.io.FilePermission -permTarget tmpfileName.ext -permActions read,write

9.3.10 listPermissions

The script listPermissions lists all permissions granted to a given principal. Script Mode Syntax listPermissions [-appStripe appName] -principalClass className -principalName prName Interactive Mode Syntax listPermissions[appStripe=appName,] principalClass=className, principalName=prName The meanings of the arguments optional arguments are enclosed in between square brackets are as follows: ■ appStripe specifies an application stripe. If not specified, then the script works on system policies. ■ principalClass specifies the fully qualified name of a class grantee. ■ principalName specifies the name of the grantee principal. Examples of Use The following invocation lists all permissions granted to a principal by the policies of application myApp: