About Oracle HTTP Server Security

Managing Application Security 8-3 ■ Content generated by modules within Oracle HTTP Server. Modules such as mod_perl, mod_dms generate responses that are returned to the client. ■ Oracle Application Server components that exist behind Oracle HTTP Server, including servlets and JSPs running with Oracle WebLogic Server that are accessed through mod_wl_ohs. Oracle HTTP Server forms the first line of authentication and authorization for these components, although further authentication may occur at the component level.

8.4 Authentication, Authorization and Access Control

Oracle HTTP Server provides user authentication and authorization at two stages: ■ Access Control stage one: This is based on the details of the incoming HTTP request and its headers, such as IP addresses or host names. ■ User Authentication and Authorization stage two: This is based on different criteria depending on the HTTP server configuration. The server can be configured to authenticate users with user name and password pairs that are checked against a list of known users and passwords. You can also configure the server to use single sign-on authentication for Web applications or X.509 client certificates over SSL.

8.4.1 Access Control

Access control refers to any means of controlling access to any resource.

8.4.2 User Authentication and Authorization

Authentication is any process by which you verify that someone is who they claim they are. Authorization is any process by which someone is allowed to be where they want to go, or to have information that they want to have.

8.4.2.1 Using Apache to Authenticate Users

Access control refers to any means of controlling access to any resource.

8.4.2.2 Using mod_osso to Authenticate Users

mod_osso enables single-sign on for Oracle HTTP Server. mod_osso examines incoming requests and determines whether the resource requested is protected, and if so, retrieves the Oracle HTTP Server cookie for the user. Through mod_osso, Oracle HTTP Server becomes a single sign-on SSO partner application enabled to use SSO to authenticate users and obtain their identity using Oracle Single Sign-On, and to make user identities available to Web applications as an Apache header variable. Using mod_osso, Web applications can register URLs that require SSO authentication. When Oracle HTTP Server receives URL requests, mod_osso detects which requests require SSO authentication and redirects them to the SSO server. Once SSO server authenticates the users, it passes the users authenticated identity back to mod_osso in a secure token, or cookie. mod_osso retrieves the users identity from the cookie and See Also: Refer to the Apache documentation for more information on how to configure access control to resources. See Also: Refer to the Apache documentation for more information on how to authenticate users. 8-4 Oracle Fusion Middleware Administrators Guide for Oracle HTTP Server propagates the users identity information to applications running in Oracle HTTP Server instance.mod_osso can propagate the users identity information to applications running in CGI, and those running in Oracle WebLogic Server, and it can also authenticate users for access to static files. See Also: Oracle Fusion Middleware Security Guide