Oracle WebLogic Server Authentication Providers

Developing Secure Applications with Oracle Platform Security Services 19-3 Such key aspects as manageability, availability, scalability, and reliability are often missing from custom solutions.

19.1.3 Meeting the Challenges with Oracle Platform Security Services

Oracle Platform Security Services OPSS is a portable security services abstraction layer that provides a robust security framework that saves development time and effort. OPSS enhances traditional Java EE development in many respects: ■ Provides basic security services such as authentication, authorization, auditing, role management, and credential management. ■ Allows developers to focus on the application logic. ■ Provides the same services that Oracle Fusion Middleware products get: – OPSS is the security platform for Oracle Fusion Middleware components, such as Oracle WebLogic Server, Oracle Entitlement Server, Oracle SOA Suite, and Oracle WebCenter. ■ Is standards-based and enterprise-ready: – Stress-tested to support enterprise deployments. – Interoperable across different LDAP servers and single sign-on SSO systems. – Certified on Oracle WebLogic Server. ■ Provides the same set of APIs for all types of applications in-house, third-party, Oracle Fusion. ■ Optimizes development time with by using abstraction layers. ■ Application maintenance is simplified since security rules can be changed without affecting application code. ■ Enables legacy and third-party security provider integration. OPSS support for Identity Management IdM includes: ■ A lightweight infrastructure that allows customers to build and deploy small to mid-size applications ■ A plug-in interface to IDM systems: – Applications build against OPSS can be plugged to a centrally deployed Identity Management system – Customers can scale their applications to switch to a centrally deployed Identity Management system – No code changes are required in the application when switching between IdM systems.

19.1.4 OPSS Architecture

Figure 19–1 shows the basic components of the OPSS architecture. There are specific APIs for most of the features discussed earlier in this manual that are available for use by application developers. Underlying SPIs service provider interfaces, mentioned briefly in Section 1.2, OPSS Architecture Overview, are mostly invisible to application developers and administrators. 19-4 Oracle Fusion Middleware Application Security Guide Figure 19–1 OPSS Architecture The Oracle Platform Security architecture provides: ■ A layered architecture that decouples the application layer from the underlying implementation. ■ An extensible framework that allows explicit extensibility points through the SPI layer where custom implementations such as custom login modules can be plugged into the framework to provide special functionality.

19.2 OPSS APIs

This section describes the APIs available to developers working with Oracle Platform Security Services: ■ The LoginService API ■ The User and Role API ■ JAAS Authorization and the JpsAuth.checkPermission API ■ The Credential Store Framework API

19.2.1 The LoginService API

OPSS provides the LoginService authentication API to enable Java SE applications to access and manage the identity store. Support for authentication is through the login module, a component that authenticates users and populates a subject with principals. This process occurs in two distinct phases: ■ In the first phase, the login module attempts to authenticate a user by means of credentials supplied by the user. ■ In the second phase, the login module assigns relevant principals to a subject, which is eventually used to perform a privileged action.