Profiles Introduction to Oracle Data Integrator Security

Managing the Security in Oracle Data Integrator 23-9

2. On the Cleanable tab, select Clean for the cleanable security settings you wish to

remove. The security settings that cannot be removed are shown on the Non-cleanable tab.

3. Click OK to cleanup the selected security settings.

23.3 Advanced Security

This section explains how to improve security in Oracle Data Integrator by using some of the advanced security features. This section contains the following topics: ■ Section 23.3.1, Setting Up External Password Storage ■ Section 23.3.2, Setting Up External Authentication ■ Section 23.3.3, Enforcing Password Policies

23.3.1 Setting Up External Password Storage

Oracle Java Platform Security JPS offers the standard Java Security Model services for authentication and authorization. Oracle Data Integrator stores by default all security information in the master repository. This password storage option is called Internal Password Storage. Oracle Data Integrator can optionally use JPS for storing critical security information. When using JPS with Oracle Data Integrator, the data server passwords and contexts are stored in the JPS Credential Store Framework CSF. This password storage option is called External Password Storage. To use the external password storage option, you need to install a WebLogic Server instance configured with JPS and all Oracle Data Integrator components including the run-time Agent need to have access to the remote credential store. See Configuring a JavaEE Application to Use OPSS in the Oracle Fusion Middleware Application Security Guide for more information.

23.3.1.1 Setting the Password Storage

There are four ways to set or modify the password storage: ■ Importing the Master Repository allows you to change the password storage. ■ Creating the Master Repository allows you to define the password storage. ■ Switching the Password Storage modifies the password storage for an existing master repository. ■ Recovering the Password Storage allows you to recover from a credential store crash. Note: When using External Password Storage, other security details such as user names, password, and privileges remain in the master repository. It is possible to externalize the authentication and have users and password stored in an Identity Store using External Authentication. See Section 23.3.2, Setting Up External Authentication for more information. 23-10 Oracle Fusion Middleware Developers Guide for Oracle Data Integrator

23.3.1.2 Switching the Password Storage

Switching the password storage of the Oracle Data Integrator repository changes how data servers and contexts passwords are stored. This operation must be performed by a SUPERVISOR user. Use the Switch Password Storage wizard to change the password storage options of the data server passwords. Before launching the Switch Password Storage wizard perform the following tasks: ■ Disconnect Oracle Data Integrator Studio from the repository. ■ Shut down every component using the Oracle Data Integrator repository. To launch the Switch Password Storage wizard: 1. From the ODI main menu, select Password Storage Switch...

2. Specify the login details of your Oracle Data Integrator master repository as

defined when Connecting to the Master Repository .

3. Click Next.

4. Select the password storage:

■ Select Internal Password Storage if you want to store passwords in the Oracle Data Integrator repository. ■ Select External Password Storage if you want use JPS Credential Store Framework CSF to store the data server and context passwords. If you select External Password Storage, you must provide the MBean Server Parameters to access the credential store as described in Table 23–2 and then click Test Connection check the connection to the MBean Server.

5. Click Finish.

The password storage options have been changed. You can now re-connect to the Oracle Data Integrator repository.

23.3.1.3 Recovering the Password Storage

Oracle Data Integrator offers a password recovery service that should be used only in case of an external password storage crash. Using this procedure, password storage is forced to Internal Password Storage as the external storage is no longer available. This operation should be performed by a Supervisor user. WARNING: When performing such a switch, the data server passwords are moved from one storage to another. Context passwords are lost. Table 23–2 MBean Server Parameters Host MBeans Server Host, for example: mymachine.oracle.com Port MBeans Server Port, for example: 7001 User MBeans Server User Name, for example: weblogic Password MBeans Server Password, for example: weblogic