Objects, Instances and Methods

23-8 Oracle Fusion Middleware Developers Guide for Oracle Data Integrator ■ To deny all these methods in all repositories, click Deny selected methods in all repositories . ■ To grant all these methods in certain work repositories, click Allow selected methods in selected repositories , then select the repositories from the list.

5. From the File main menu, select Save.

23.2.4.4 Revoking an Authorization by Object Instance

To revoke an authorization by object instance from an user:

1. In Security Navigator expand the Users accordion.

2. Expand the Instances node under the user for which you want you revoke

privileges.

3. Right-click the instance from which you want to revoke an authorization, and then

select Delete. 4. Click OK in the Confirmation dialog. The authorizations on this object instance are revoked from the user.

23.2.4.5 Cleaning up Unused Authorizations

Authorizations by object instance are stored in the master repository. However, if objects are deleted from all work repositories, the authorization are not necessarily deleted. You may wish to retain certain unused authorizations if they refer, for example, to objects currently stored in an exported file or in a stored solution. The Security Clean-up Tool should be used periodically to remove these unused authorizations from the master repository. Unused authorizations are removed if they refer to objects that do not exist in the master repository or in any work repository. To clean up unused authorizations: 1. From the Security Navigator toolbar menu, select Clean Up Security Settings... The Security Clean-up Tool dialog appears. Note: Only certain objects support the authorization by object instance. These object types are listed under the Instances node for each user. Methods for which the user has generic privileges are not listed in the Object Instance Editor. Note: You can also revoke privileges per method by editing the Authorization by Object instance and denying certain methods to this user. If, after this operation, the user no longer has any privilege on an instance, the instance automatically disappears from the tree in Security Manager. Note: All work repositories attached to the master repository must be accessible in order to check the existence of the objects in these repositories Managing the Security in Oracle Data Integrator 23-9

2. On the Cleanable tab, select Clean for the cleanable security settings you wish to

remove. The security settings that cannot be removed are shown on the Non-cleanable tab.

3. Click OK to cleanup the selected security settings.

23.3 Advanced Security

This section explains how to improve security in Oracle Data Integrator by using some of the advanced security features. This section contains the following topics: ■ Section 23.3.1, Setting Up External Password Storage ■ Section 23.3.2, Setting Up External Authentication ■ Section 23.3.3, Enforcing Password Policies

23.3.1 Setting Up External Password Storage

Oracle Java Platform Security JPS offers the standard Java Security Model services for authentication and authorization. Oracle Data Integrator stores by default all security information in the master repository. This password storage option is called Internal Password Storage. Oracle Data Integrator can optionally use JPS for storing critical security information. When using JPS with Oracle Data Integrator, the data server passwords and contexts are stored in the JPS Credential Store Framework CSF. This password storage option is called External Password Storage. To use the external password storage option, you need to install a WebLogic Server instance configured with JPS and all Oracle Data Integrator components including the run-time Agent need to have access to the remote credential store. See Configuring a JavaEE Application to Use OPSS in the Oracle Fusion Middleware Application Security Guide for more information.

23.3.1.1 Setting the Password Storage

There are four ways to set or modify the password storage: ■ Importing the Master Repository allows you to change the password storage. ■ Creating the Master Repository allows you to define the password storage. ■ Switching the Password Storage modifies the password storage for an existing master repository. ■ Recovering the Password Storage allows you to recover from a credential store crash. Note: When using External Password Storage, other security details such as user names, password, and privileges remain in the master repository. It is possible to externalize the authentication and have users and password stored in an Identity Store using External Authentication. See Section 23.3.2, Setting Up External Authentication for more information.