Out-of-the-box Support for SSL

25-34 Oracle Fusion Middleware Application Security Guide

25.10.4 Developing a Full-Featured Provider

The full-featured provider implements all the functionality supported by a read-only provider, and additionally supports CRUD operations. This requires that the CRUD APIs be implemented in the SPI implementation classes. In the read-only provider, these APIs were implemented simply by throwing an OperationNotSupportedException see the class descriptions in Section 25.10.3, Developing a Read-Only Provider . For a full-featured provider, this needs to be replaced by concreteactual implementation of the corresponding CRUD operations.

25.10.5 Development Guidelines

This section provides some guidelines for developing providers. Mapping of Names Be aware of the usage of naming constants such as UserProfile.NAME, UNIQUE_ NAME, UserProfile.USER_NAME, UserProfile.USER_ID. ■ NAME – name of the user or role in the underlying repository. ■ UNIQUE_NAME – Complete name with which the user or role is represented in the underlying repository. ■ USER_NAME – login ID of the user in the underlying repository. ■ USER_ID – always same as USER_NAME constant mapping. Depending on the identity repository, these constants might map to the same underlying identity repository attribute or they might map to different attributes. If the underlying repository is an LDAP v3 server, the mappings are as follows: ■ NAME – mapped to naming attribute of usergroup entry, for example cn ■ UNIQUE_NAME - mapped to DN of usergroup entry ■ USER_NAMEUSER_ID – mapped to login attribute, for example uid or mail Thread Safety The following objects are likely to be shared among multiple threads: ■ IdentityStoreFactory, ■ IdentityStore, ■ UserManager, ■ RoleManager You should ensure that there are no thread safety-related issues in the corresponding implementation classes of your provider.

25.10.6 Testing and Verification

The User and Role API ships with a test suite to enable you to test the basic operations of providers that you develop. The test suite can be used to test both read-only and full-featured providers. Usage java oracle.security.idm.tests.SPITest propertiesfile Developing with the User and Role API 25-35 where propertiesfile contains the provider class name and any configuration data for the provider. It also contains information about the tests to be run. You need to edit this file and update it with correct information before running the tests; the file contents are self-explanatory. One such file ffprovider.properties is available with the sample provider discussed in Section 25.10.7.1, About the Sample Provider . Results The test will produce the results on-screen. All providers that you develop must pass the Lookup tests, Role membership tests and Profile tests in the test suite. Full-featured providers must pass all the tests in the suite including CreateDrop tests. The log of test results will be output to the file results.out in current working directory.

25.10.7 Example: Implementing an Identity Provider

The distribution includes a sample identity provider that you can use to understand how custom providers are built. This section describes how to access the sample provider, and explains the steps needed to implement a custom provider. The steps rely on the sample for illustration. ■ About the Sample Provider ■ Overview of Implementation ■ Configure jps-config.xml to use the Sample Identity Provider ■ Configure Oracle WebLogic Server

25.10.7.1 About the Sample Provider

The sample provider is bundled in sampleprovider.zip. Unzip the file. It should generate the following structure: sampleprovider build.xml - ant build file ffprovider.properties - properties file required for testing jlib - provider jar file location out - location of generated class files samples - Folder for samples src - provider source code Run ant help for instructions on building and testing this provider. The provider relies on an ad-hoc identity repository for fetching identity information and has been tested with Oracle SOA Suite. It is not intended for production use without appropriate testing for your environment.

25.10.7.2 Overview of Implementation

The sample identity provider used in this example is a custom IdentityAuthentication provider that uses an RDBMS as the underlying store. It can be used as both an identity provider and an authentication provider.