Oracle Platform Security Services

19 Developing Secure Applications with Oracle Platform Security Services 19-1 19 Developing Secure Applications with Oracle Platform Security Services This chapter explains how applications developed using OPSS benefit and work with Oracle Fusion Middleware, and it includes the following sections: ■ OPSS for Developers ■ OPSS APIs ■ Common Uses of OPSS ■ Using OPSS with Oracle Application Development Framework ■ Using the Oracle Security Developer Tools ■ Using OPSS Outside Oracle JDeveloperOracle ADF

19.1 OPSS for Developers

This section explains the benefits of securing applications with Oracle Platform Security Services, in the following topics: ■ The Development Cycle ■ Challenges of Securing Java Applications ■ Meeting the Challenges with Oracle Platform Security Services ■ OPSS Architecture

19.1.1 The Development Cycle

Java EE software development is based on a develop-deploy-manage cycle. The Oracle Platform Security Services security implementation plays an important part in all phases of that cycle. The following list summarizes the Java EE development cycle, emphasizes the tasks specific to developing secure applications, and highlights the security enhancements that OPSS provides. 1. The developer creates Web components, enterprise beans, servlets, and application clients based on business requirements. While the developer has access to a declarative approach, additional value is obtained when using Oracle ADF, which makes use of OPSS APIs. 19-2 Oracle Fusion Middleware Application Security Guide 2. The developer defines Java EE logical roles and assigns them privileges through security constraints, all through configuration in standard Java EE deployment descriptors. 3. The components are assembled and combined into an Enterprise Archive EAR file. As part of this process, the assembler specifies options appropriate to the environment. 4. The assembler defines application-level security constraints and resolves potential conflicts between module-level configurations. 5. The EAR file is deployed to Oracle WebLogic Server. As part of the deployment process, the deployer may map Java EE roles to deployment users and roles. 6. The system administrator maintains and manages the deployed application. This task includes creating and managing roles and users in the deployment environment as required by the application customers. For finer-grained code-based or subject-based access control using Java 2 or JAAS features, the traditional steps include: 1. The developer identifies any resources that may be accessed and must be protected as appropriate. 2. The developer defines permissions to protect these resources. 3. The developer implements code for runtime authorization checks. 4. The system administrator maintains any necessary policy configuration to enforce the desired permissions. Policy provisioning should be completed prior to runtime. Oracle ADF and OPSS provide these enhancements: ■ At Design Time - modeling of application roles, defining resources as permissions, and assigning permissions to roles. Application credential management is supported, for example, ADF connections can store credentials in the Credential Store Framework during design time. ■ At Deployment Time - policy and credential migration options are available ■ Post-deployment, the administrator performs essential tasks such as mapping application roles to enterprise users or groups which are reflected at run-time

19.1.2 Challenges of Securing Java Applications

Java developers face some challenges in developing secure applications: ■ The Java EE standard does not define any API for fine-grained authorization, credential mapping, role mapping, auditing, or integration with single-sign. ■ Developers need to acquire in-depth security knowledge at the expense of focusing on application business logic. ■ There is no consistent security experience across platforms. For example, custom security solutions often develop their own security framework, which is often not portable across platforms. ■ Custom solutions for securing Java EE applications often lack support for large enterprise security deployments.