Summary of Tasks per Participant per Phase

18-12 Oracle Fusion Middleware Application Security Guide ■ In a clustered environment, use the Credential Store Mbean API over the Credential Store Framework API to create, retrieve, update, and delete application credentials. If, however, you are simply reading credentials either use either API. For details about MBeans, see Section E.2, Configuring OPSS Services with MBeans.

18.9.2 Cryptography

Oracle Security Developer Tools provide cryptographic building blocks necessary to develop basic tasks, such as secure messaging, and more complex ones, such as implementing a secure service-oriented architecture. These tools build upon the core foundations of cryptography, public key infrastructure, Web services security, and federated identity management, to provide: ■ Authentication, which assures the receiver that the information is coming from a trusted source. Authentication is typically achieved by using a Message Authentication Code MAC, a digital signature, or a digital certificate. ■ Confidentiality, which ensures that only the intended recipient of the message can read it. Confidentiality is typically achieved through encryption. ■ Integrity, which ensures that the received message has not been tampered. Integrity is typically achieved by using a cryptographic hash function. ■ Non-repudiation, which proves that a given sender actually sent a particular message. Non-repudiation is typically achieved by using digital signatures. For details about the Oracle Security Developer Tools, see Section H.1, OPSS API References, and Section 19.5, Using the Oracle Security Developer Tools. 19 Developing Secure Applications with Oracle Platform Security Services 19-1 19 Developing Secure Applications with Oracle Platform Security Services This chapter explains how applications developed using OPSS benefit and work with Oracle Fusion Middleware, and it includes the following sections: ■ OPSS for Developers ■ OPSS APIs ■ Common Uses of OPSS ■ Using OPSS with Oracle Application Development Framework ■ Using the Oracle Security Developer Tools ■ Using OPSS Outside Oracle JDeveloperOracle ADF

19.1 OPSS for Developers

This section explains the benefits of securing applications with Oracle Platform Security Services, in the following topics: ■ The Development Cycle ■ Challenges of Securing Java Applications ■ Meeting the Challenges with Oracle Platform Security Services ■ OPSS Architecture

19.1.1 The Development Cycle

Java EE software development is based on a develop-deploy-manage cycle. The Oracle Platform Security Services security implementation plays an important part in all phases of that cycle. The following list summarizes the Java EE development cycle, emphasizes the tasks specific to developing secure applications, and highlights the security enhancements that OPSS provides. 1. The developer creates Web components, enterprise beans, servlets, and application clients based on business requirements. While the developer has access to a declarative approach, additional value is obtained when using Oracle ADF, which makes use of OPSS APIs.