Maintaining a DB-Based Security Store

Configuring the OPSS Security Store 8-11 3. For a Data Source on the Oracle WebLogic Server, use the WebLogic Administration console to specify the above properties and values in the tab Configuration Connection Pool of the Data Source . For details, see Oracle Fusion Middleware Administrators Guide. 4. For a Data Source on the WebSphere Application Server, use the Administration Console as follows:

1. Navigate to Data Sources YourDataSourceName Custom Properties.

2. Create the new custom property connectionProperties with a value as illustrated in the following line: oracle.net.ssl_server_dn_match=true;javax.net.ssl.trustStore=scratchweini uworkcertsqatestca.jks;javax.net.ssl.trustStoreType=JKS;javax.net.ssl.tr ustStorePassword=welcome1;javax.net.ssl.keyStore=scratchweiniuworkcerts jksuser1.jks;javax.net.ssl.keyStoreType=JKS;javax.net.ssl.keyStorePassword =welcome1;oracle.net.ssl_version=3.0 Note that the values are separated by a semicolon, and the setting oracle.net.ssl_version=3.0 is required.

8.4 Configuring the OPSS Security Store

For examples of store configurations for Java SE applications, see Section 23.1, Configuring Policy and Credential Stores in Java SE Applications. For examples of store configurations for Java EE applications, see Example 1 and Example 4 . For details about configuring other artifacts, see Configuring the Identity Provider, Property Sets, and SSO .

8.5 Reassociating the OPSS Security Store

Reassociating the OPSS security store consists in relocating the policy, credential, and key stores from one repository to another one. The source can be file-, LDAP-, or DB-based; the target can be LDAP- or DB-based. The only type of LDAP target supported is Oracle Internet Directory; the only type of DB target supported is DB_ORACLE. Reassociation changes the repository preserving the integrity of the data stored. For each security artifact, reassociation searches the target store and, if it finds a match for it, it updates the matching artifact; otherwise, creates a new artifact. Reassociation is typically performed, for example, when setting a domain to use an LDAP- or DB-based OPSS store instead of the out-of-the-box file-based store. This operation can take place at any time after the OPSS store has been configured and instantiated, and it is carried out using either Fusion Middleware Control or reassociateSecurityStore as explained in the following sections: ■ Reassociating with Fusion Middleware Control ■ Reassociating with the Script reassociateSecurityStore

8.5.1 Reassociating with Fusion Middleware Control

Reassociation migrates the OPSS policy store policies, credentials, and keys from one repository to another and reconfigures the appropriate security store providers. This section explains how to perform reassociation with Fusion Middleware Control pages. 8-12 Oracle Fusion Middleware Application Security Guide For information about other uses of the Security Provider Configuration page, see Configuring the Identity Provider, Property Sets, and SSO . Important Points ■ Before reassociating to a target LDAP store, ensure that your setup satisfies the Prerequisites to Using an LDAP-Based Security Store . ■ Before reassociating to a target DB store, ensure that your setup satisfies the Prerequisites to Using a DB-Based Security Store . ■ If reassociation requires a one-way SSL, follow the instructions in Setting Up a One- Way SSL Connection before reassociating. ■ After reassociating to an LDAP store, to secure access to the root node of the Oracle Internet Directory store, follow the instructions in Securing Access to Oracle Internet Directory Nodes . ■ The jps-config.xml file produced by reassociation is good for only Java EE applications. In case of Java SE applications, edit the file jps-config-jse.xml to match the one described in Section 23.1.3, Configuring DB-Based OPSS Security Stores. To reassociate the OPSS security store with Fusion Middleware Control, proceed as follows:

1. Log in to Fusion Middleware Control and navigate to Domain Security

Security Provider Configuration if connected to Oracle WebLogic Server or to Cell Security Security Provider Configuration if connected to WebSphere Application Server, to display the Security Provider Configuration page, partially illustrated in the following graphic: The table in the area Security Stores shows the characteristics of the current provider configured in the domain.

2. Click the button Change Association to display the Set Security Provider page,

and choose the Store Type from the pull-down list. The text displayed on this page depends on the store type selected. The following graphic partially illustrates this page when Oracle Internet Directory is selected.