listResourceActions createEntitlement Managing Application Policies with OPSS Scripts

9-28 Oracle Fusion Middleware Application Security Guide

9.3.26 revokeEntitlement

The script revokeEntitlement deletes an entitlement and revokes the entitlement from the principal in a specified application stripe. Script Mode Syntax revokeEntitlement -appStripe appStripeName -principalClass principalClass -principalName principalName -permSetName entName Interactive Mode Syntax revokeEntitlementappStripe=appStripeName, principalClass=principalClass, principalName=principalName ,-permSetName=entName The meaning of the arguments is as follows: ■ appStripe specifies the application stripe where the entitlement is deleted. ■ principalClass specifies the class associated with the principal. ■ principalName specifies the name of the principal to which the entitlement is revoked. ■ permSetName specifies the name of the entitlement deleted. Example of Use The following invocation deletes the entitlement myEntitlement in the stripe myApplication: revokeEntitlement -appStripe myApplication -principalClass oracle.security.jps.service.policystore.ApplicationRole -principalName myPrincipalName -permSetName myEntitlement

9.3.27 listEntitlement

The script listEntitlement lists an entitlement in a specified application stripe. If a principal name and a class are specified, it lists the entitlements that match the specified principal; otherwise, it lists all the entitlements. Script Mode Syntax listEntitlement -appStripe appStripeName [-principalName principalName -principalClass principalClass] Interactive Mode Syntax listEntitlementappStripe=appStripeName [, principalName=principalName, principalClass=principalClass] The meaning of the arguments is as follows: ■ appStripe specifies the application stripe where the entitlement is located. ■ principalName specifies the name of the principal to match. Optional. ■ principalClass specifies the class of the principal to match. Optional. Managing the Policy Store 9-29 Example of Use The following invocation lists all entitlements in the stripe myApplication: listEntitlement -appStripe myApplication

9.3.28 listResourceTypes

The script listResourceTypes lists all the resource types in a specified application stripe. Script Mode Syntax listResourceTypes -appStripe appStripeName Interactive Mode Syntax listResourceTypesappStripe=appStripeName The meaning of the arguments is as follows: ■ appStripe specifies the application stripe where the resource types are located. Example of Use The following invocation lists all resource types in the stripe myApplication: listResourceTypes -appStripe myApplication

9.3.29 reassociateSecurityStore

The script reassociateSecurityStore migrates the OPSS security store from a source to a target LDAP- or DB-based store, and it resets the default policy and credential services to the target repository. It also allows specifying that the OPSS security store be shared with that in a different domain see optional argument join below. The OPSS binaries and the target policy store must have compatible versions; for details, see Section L.20, Incompatible Versions of Binaries and Policy Store. The source can be a file-, LDAP-, or DB-based store; the only type of LDAP target supported is Oracle Internet Directory; the only type of DB target supported is DB_ ORACLE. This script uses and modifies the domain configuration file jps-config.xml, and it is supported in only the interactive mode. For recommendations involving reassociation, see Important Points . Interactive Mode Syntax The script syntax varies slightly according to the type of the target store. When the target is an LDAP-based store, use the following syntax: reassociateSecurityStoredomain=domainName, servertype=OID, ldapurl=hostAndPort, jpsroot=cnSpecification, admin=cnSpecification, password=passWord [,join=trueOrfalse] When the target is a DB-based store, use the following syntax: reeassociateSecurityStoredomain=domainName, servertype=DB_ORACLE, datasourcename=datasourceName, jpsroot=jpsRoot,[admin=adminAccnt], [password=passWord],[join=trueOrfalse] The meaning of the arguments all required is as follows: