Example 1: Searching for Users

Developing with the User and Role API 25-29

25.10.1 SPI Overview

The User and Role API is accompanied by a service provider interface SPI that makes it possible to develop custom userrole providers. You can use the service provider interface to develop a custom provider for any identity data repository. The SPI is bundled as the oracle.security.idm.spi package, which is a set of abstract classes. Custom User and Role providers are created by extending this SPI to fit your requirements.

25.10.2 Types of User and Role Providers

The User and Role API offers functions for both search and CreateReadUpdateDelete CRUD operations. A User and Role provider based on read-only functions supports only search operations. A full-featured provider supports both search operations and CRUD operations. In other words, the full-featured provider is a superset of a read-only provider. As a developer you have the choice of creating either read-only or full-functionality providers depending upon the requirements. It is reasonable to develop a read-only provider in the following situations: ■ if the underlying identity repository operates in read-only mode ■ if applications consuming the User and Role API do not make any CRUD API calls For example, it makes sense to develop a read-only provider for use with the SOA identity service.

25.10.3 Developing a Read-Only Provider

This section describes the classes used to implement a provider. Topics include: ■ SPI Classes Requiring Extension ■ oracle.security.idm.spi.AbstractIdentityStoreFactory ■ oracle.security.idm.spi.AbstractIdentityStore ■ oracle.security.idm.spi.AbstractRoleManager ■ oracle.security.idm.spi.AbstractUserManager ■ oracle.security.idm.spi.AbstractRoleProfile ■ oracle.security.idm.spi.AbstractUserProfile ■ oracle.security.idm.spi.AbstractSimpleSearchFilter ■ oracle.security.idm.spi.AbstractComplexSearchFilter ■ oracle.security.idm.spi.AbstractSearchResponse

25.10.3.1 SPI Classes Requiring Extension

Table 25–5 shows that SPI classes that must be extended to implement a read-only provider: See Also: The User and Role SPI Reference Note: All abstract methods must be implemented. 25-30 Oracle Fusion Middleware Application Security Guide Additional requirements and notes for each class are provided below.

25.10.3.2 oracle.security.idm.spi.AbstractIdentityStoreFactory

The class extending this SPI class must have following constructors: 1. The default constructor one which has no arguments. 2. A constructor that accepts a java.util.Hashtable object as an argument. You can use the hash table to accept any configuration properties required by the provider. The configuration properties are passed to this constructor during the user and role configuration phase. The properties are key-value pairs passed in the Hashtable argument: ■ The key must be java.lang.String. ■ The value can be java.lang.Object. It is recommended that the value be of type String. This guarantees that the property can be specified in jps-config.xml, which is a text file.

25.10.3.3 oracle.security.idm.spi.AbstractIdentityStore

The User and Role SPI Reference provides details about the methods that need to be implemented in this class. Note that: ■ Method getStoreConfiguration is optional and can throw OperationNotSupportedException. ■ Method getSubjectParser can return null. When there are no search results to be returned, all search APIs should throw: oracle.security.idm.ObjectNotFoundException Table 25–5 SPI Classes to Extend for Custom Provider Class Usage Notes oracle.security.idm.spi.AbstractIdentityStoreFactory The extending class must include a default constructor and a constructor accepting a java.util.Hashtable object. oracle.security.idm.spi.AbstractIdentityStore oracle.security.idm.spi.AbstractRoleManager oracle.security.idm.spi.AbstractUserManager oracle.security.idm.spi.AbstractRoleProfile oracle.security.idm.spi.AbstractUserProfile oracle.security.idm.spi.AbstractSimpleSearchFilter The constructor of the extending class must call the constructor of the abstract super class. oracle.security.idm.spi.AbstractComplexSearchFilter The constructor of the extending class must call the constructor of the abstract super class. oracle.security.idm.spi.AbstractSearchResponse See Also: The User and Role SPI Reference for details about the methods that need to be implemented in this class. All listed methods must be implemented.