Configuring LDAP-Based Policy and Credential Stores

Developing with the Credential Store Framework 24-3 CSF supports securing credentials: ■ at the map level, or ■ with finer granularity for specific mapname, key

24.3.1 Guidelines for Granting Permissions

The Credential Store Framework relies on Java permissions to grant permissions to credential store objects. It is highly recommended that only the requisite permissions be granted, and no more.

24.3.2 Permissions Grant Example 1

The CredentialStore maintains mappings between map names and credential maps. Each map name is mapped to a CredentialMap, which is a secure map of keys to Credential objects. This example grants permissions for a specific map name and a specific key name of that map. jazn-policy grant grantee principals...principals -- This is the location of the jar -- -- as loaded with the run-time -- codesource urlfile:{oracle.deployed.app.dir}MyApp{oracle.deployed.app.ext}url codesource grantee permissions permission classoracle.security.jps.service.credstore. CredentialAccessPermissionclass namecontext=SYSTEM,mapName=myMap,keyName=myKeyname -- All actions are granted -- actionsactions permission permissions grant Notes: ■ To properly access the CSF APIs, you need to grant Java permissions in the policy store. ■ The code invoking CSF APIs needs code source permission. The permissions are typically for specific code jars and not for the complete application. WARNING: It is risky and inadvisable to grant unnecessary permissions, particularly permissions to all maps andor keys. Note: In the examples, the application jar file name is AppName.jar. 24-4 Oracle Fusion Middleware Application Security Guide jazn-policy where: ■ MapName is the name of the map typically the name of the application for which you want to grant these permissions read, write, update, and delete permissions denoted by the wildcarded actions. ■ KeyName is the key name in use.

24.3.3 Permissions Grant Example 2

In this example permissions are granted for a specific map name and all its key names. jazn-policy grant grantee principals...principals codesource urlfile:{oracle.deployed.app.dir}MyApp{oracle.deployed.app.ext}url codesource grantee permissions permission classoracle.security.jps.service.credstore. CredentialAccessPermissionclass namecontext=SYSTEM,mapName=myMap,keyName=name -- Certain actions are explicitly specified -- -- Compare to wild-card grant in previous example -- actionsread,write,update,deleteactions permission permissions grant jazn-policy

24.4 Guidelines for the Map Name

When the domain-level credential store is used, name conflicts can arise with the various map names in the store for different applications. To avoid this, each application must have a unique map name in the store. To achieve this, it is recommended that the map name you use uniquely identify the application. Within a given map name, an application can store multiple credentials each of which is identifiable by a key. The map name and the key together constitute a primary key within a given credential store. If there is a requirement that an application use more than one map name, then uniqueness continues to be maintained. For example, consider three applications: ■ a Repository Creation Utility RCU based application, ■ a Oracle WebCenter application, and ■ a Fusion Middleware Control application For RCU, a map name of RCU is chosen and the keys for three credentials are say Key1, Key2, and Key3: