Example 3: User Management in a Microsoft Active Directory Store

Developing with the User and Role API 25-31 Never return an empty SearchResponse.

25.10.3.4 oracle.security.idm.spi.AbstractRoleManager

The User and Role SPI Reference provides details about the methods that need to be implemented in this class. Note that only the following methods need concreteactual implementations: ■ getGrantedRoles ■ getOwnedRoles ■ getManagedRoles ■ isGranted ■ isManagedBy ■ isOwnedBy ■ isDropRoleSupported – should always return false ■ isCreateRoleSupported – should always return false ■ isModifyRoleSupported – should always return false The remaining methods must throw the following in their respective implementations: oracle.security.idm.OperationNotSupportedException

25.10.3.5 oracle.security.idm.spi.AbstractUserManager

The User and Role SPI Reference provides details about the methods that need to be implemented in this class. Only the following methods need concreteactual implementations: ■ authenticateUserUser, char[] ■ authenticateUserString, char[] ■ isDropUserSupported – should always return false ■ isCreateUserSupported – should always return false ■ isModifyUserSupported – should always return false The remaining methods must throw the following in their respective implementations: oracle.security.idm.OperationNotSupportedException

25.10.3.6 oracle.security.idm.spi.AbstractRoleProfile

oracle.security.idm.spi.AbstractRoleProfile is an abstract class that can be used to return a detailed role profile. The User and Role SPI Reference provides details about the methods that need to be implemented in this class. Only the following methods need concreteactual implementations: ■ getDisplayName ■ getGUID ■ getName 25-32 Oracle Fusion Middleware Application Security Guide ■ getUniqueName ■ getPrincipal ■ getDescription ■ getGrantees ■ getManagers ■ getOwners ■ getProperty - If requested property is not setvalid for corresponding role then null should be returned as value. ■ isApplicationRole - must always return false ■ isEnterpriseRole - must always return false ■ isSeeded - must always return false ■ getRoleProfile – should return reference to current object. The remaining methods must throw the following in their respective implementations: oracle.security.idm.OperationNotSupportedException

25.10.3.7 oracle.security.idm.spi.AbstractUserProfile

oracle.security.idm.spi.AbstractUserProfile is an abstract class that can be used to return a detailed user profile. The User and Role SPI Reference provides details about the methods that need to be implemented in this class. Only the following methods need concreteactual implementations: ■ getDisplayName ■ getGUID ■ getName ■ getUniqueName ■ getPrincipal ■ getProperty - If the requested property is not setvalid for corresponding role then a null value must be returned. ■ getProperties – If the requested property is not setvalid for the corresponding user, then a null value must be returned. ■ getAllUserProperties – Only the properties set for the corresponding user should be returned. ■ getReportees ■ getManagementChain ■ getUserProfile – must return reference to current object. These two methods: ■ setProperty ■ setProperties must throw the following in their implementation: Developing with the User and Role API 25-33 oracle.security.idm.OperationNotSupportedException

25.10.3.8 oracle.security.idm.spi.AbstractSimpleSearchFilter

oracle.security.idm.spi.AbstractSimpleSearchFilter is an abstract class that can be extended to implement a simple search filter. The implementing class must have a constructor that calls the constructor of the abstract class: AbstractSimpleSearchFilter String attrname, int type, Object value The User and Role SPI Reference provides details about the methods that need to be implemented in this class. Only the following methods need concreteactual implementations: ■ getNativeRepresentation – convert filter into the native representation to be used with the underlying identity repository. ■ getWildCardChar – wild card character, for example , to be used in searches. The specific character depends on the underlying identity repository.

25.10.3.9 oracle.security.idm.spi.AbstractComplexSearchFilter

oracle.security.idm.spi.AbstractComplexSearchFilter is an abstract class that can be extended to implement a search filter of any complexity. The implementing class must have a constructor that calls the constructor of the abstract class: AbstractComplexSearchFilter oracle.security.idm.SearchFilter[] filters, int oper_type The User and Role SPI Reference provides details about the methods that need to be implemented in this class. Only the following methods need concreteactual implementations: ■ getNativeRepresentation – convert the filter into the native representation to be used with the underlying identity repository.

25.10.3.10 oracle.security.idm.spi.AbstractSearchResponse

The SearchResponse object contains search results being returned from a repository. Each result entry corresponds to one user or role in the underlying identity repository, represented by the corresponding UserProfileRoleProfile class implementation. The SearchResponse object must return one or more results. This means that the hasNext method must return TRUE at least once. Do not use if there are zero results to return. When no results are to be returned, the corresponding search API should throw the following exception: oracle.security.idm.ObjectNotFoundException 25-34 Oracle Fusion Middleware Application Security Guide

25.10.4 Developing a Full-Featured Provider

The full-featured provider implements all the functionality supported by a read-only provider, and additionally supports CRUD operations. This requires that the CRUD APIs be implemented in the SPI implementation classes. In the read-only provider, these APIs were implemented simply by throwing an OperationNotSupportedException see the class descriptions in Section 25.10.3, Developing a Read-Only Provider . For a full-featured provider, this needs to be replaced by concreteactual implementation of the corresponding CRUD operations.

25.10.5 Development Guidelines

This section provides some guidelines for developing providers. Mapping of Names Be aware of the usage of naming constants such as UserProfile.NAME, UNIQUE_ NAME, UserProfile.USER_NAME, UserProfile.USER_ID. ■ NAME – name of the user or role in the underlying repository. ■ UNIQUE_NAME – Complete name with which the user or role is represented in the underlying repository. ■ USER_NAME – login ID of the user in the underlying repository. ■ USER_ID – always same as USER_NAME constant mapping. Depending on the identity repository, these constants might map to the same underlying identity repository attribute or they might map to different attributes. If the underlying repository is an LDAP v3 server, the mappings are as follows: ■ NAME – mapped to naming attribute of usergroup entry, for example cn ■ UNIQUE_NAME - mapped to DN of usergroup entry ■ USER_NAMEUSER_ID – mapped to login attribute, for example uid or mail Thread Safety The following objects are likely to be shared among multiple threads: ■ IdentityStoreFactory, ■ IdentityStore, ■ UserManager, ■ RoleManager You should ensure that there are no thread safety-related issues in the corresponding implementation classes of your provider.

25.10.6 Testing and Verification

The User and Role API ships with a test suite to enable you to test the basic operations of providers that you develop. The test suite can be used to test both read-only and full-featured providers. Usage java oracle.security.idm.tests.SPITest propertiesfile