Introduction to the OPSS Security Store

8-6 Oracle Fusion Middleware Application Security Guide

1. Start RCU to display the RCU Welcome page; in this page, click Next to display

the Drop Repository page. 2. In that page, select the radio button Drop; then click Next to display the Database Connections Details page. 3. In that page, enter the appropriate connectivity information: Database Type, Host Name, Port, Service Name, Username, Password, and Role. Then click Next to display the Select Components dialog.

4. In that dialog, select the prefix and, in the Component hierarchy, check AS

Common Schemas and Oracle Platform Security Services; then click Next to display the Summary page.

5. In that page, verify that the details gathered are correct, and click Drop to trigger

the dropping; when the operation is successfully completed, RCU displays the Completion Summary page detailing the schema dropped.

8.3.1.3 Creating a Data Source Instance

To create a data source instance, see section Creating a JDBC Data Source in Oracle Fusion Middleware Configuring and Managing JDBC for Oracle WebLogic Server. The JNDI name of the JDBC data source entered in the procedure in that section is used in the configuration of a DB-based store. To set up a data source on WebSphere Application Server, see Oracle Fusion Middleware Third-Party Application Server Guide.

8.3.2 Maintaining a DB-Based Security Store

This section describes a few tasks that an administrator can follow to maintain a DB-based security store. A DB-based security store maintains a change log that should be periodically purged. To purge it, an administrator can use the provided SQL script opss_purge_changelog.sql, which will purge change logs older than 24 hours, or connect to the database and run SQL delete with the appropriate arguments as illustrated in the following lines: SQLdelete from jps_changelog where createdate selectmaxcreatedate - 1 from jps_changelog; SQLCommit; If the OPSS management API performs slowly while accessing the DB-based security store, run the DBMS_STATS package to gather statistics about the physical storage of a DB table, index, of cluster. This information is stored in the data dictionary and can be used to optimize the execution plan for SQL statements accessing analyzed objects. When loading large amount of data into a DB-based security store, such as when creating thousands of new application roles, it is recommended that DBMS_STATS be run within short periods and concurrently with the loading activity. Otherwise, when the loading activity is small, DBMS_STATS needs to be run just once and according to your needs. The following sample illustrates the use of DBMS_STATS: Note: 11.2 Oracle JDBC driver deprecated the following time zones: EtcUCT, UCT, EtcUTC, EtcUniversal, EtcZulu, and Universal. When setting a time zone for your Oracle JDBC driver, make sure that it is a non-deprecated time zone. Configuring the OPSS Security Store 8-7 EXEC DBMS_STATS.GATHER_SCHEMA_STATSDEV_OPSS, DBMS_STATS.AUTO_SAMPLE_SIZE, no_invalidate=FALSE; where DEV_OPSS denotes the name of the DB schema created during the RCU setup see section Creating the OPSS Schema in an Oracle Database . For details about the DBMS_STATS package, see the Oracle Database Administrator’s Guide. To run DBMS_STATS periodically, use a shell script or an SQL script, as described next. The following sample script runs the command DBMS_STATS every 10 minutes: binsh i=1 while [ i -le 1000 ] do echo i sqlplus dev_opsswelcome1inst1 opssstats.sql sleep 600 i=`expr i + 1` done where opssstats.sql contains the following text: EXEC DBMS_STATS.gather_schema_statsDEV_OPSS,DBMS_STATS.AUTO_SAMPLE_SIZE, no_invalidate=FALSE; QUIT; The following sample SQL script also runs the command DBMS_STATS every 10 minutes: variable jobno number; BEGIN DBMS_JOB.submit job = :jobno, what = DBMS_STATS.gather_schema_statsDEV_OPSS,DBMS_STATS.AUTO_SAMPLE_SIZE,no_invali date=FALSE;, interval = SYSDATE+102460; COMMIT; END; To stop the periodic invocation of DBMS_STATS by the above SQL script, first find out its job number by issuing the following commands: sqlplus as sysdba SELECT job FROM dba_jobs WHERE schema_user = DEV_OPSS AND what = DBMS_STATS.gather_schema_statsDEV_OPSS,DBMS_STATS.AUTO_SAMPLE_SIZE, no_invalidate=FALSE;; Then issue a command like the following, in which it is assumed that the query above returned the job number 31: EXEC DBMS_JOB.remove31;

8.3.3 Setting Up an SSL Connection to the DB

This section describes how to establish a one- or two-way SSL connection to a DB-Based OPSS security store. This set up is optional and the procedures involved in it are explained in the following sections: ■ Configuring SSL on an Oracle DB Server