Guidelines for Using CSF

19-6 Oracle Fusion Middleware Application Security Guide OPSS APIs provide the following benefits beyond the traditional authorization models: ■ They extend the JAAS model with the ability to use application roles that are assigned permissions. ■ They provide policy management support, which is lacking in the standard JAAS model. See Section 20.3.2, Managing Policies for an example. ■ Using the JpsAuth.checkPermission OPSS API as opposed to the standard checkPermission, they provide additional benefits such as more robust debugging and integrated audit support. For details about authorization features of OPSS, see Chapter 23, Authorization for Java SE Applications .

19.2.4 The Credential Store Framework API

A credential store is a secure, central repository where credentials and collections of credentials are stored. Multiple applications can use the same credential store. The Credential Store Framework CSF API provides the mechanism by which applications access the credential store. The CSF API supports file-based Oracle wallet and LDAP-based credential stores. Critical functions provided by the CSF API include returning credentials for a given map name, assigning credentials to and deleting credentials from a given map name, and other operations related to credential maps and keys. Operations on CredentialStore are secured by CredentialAccessPermission, which implements the fine-grained access control model utilized by CSF. For details about the API, see Chapter 24, Developing with the Credential Store Framework .

19.3 Common Uses of OPSS

The same set of OPSS APIs can be used by both Java EE and Java SE developers. Topics in this section illustrate common applications for the APIs, and demonstrate differences between Java EE and Java SE implementations.

19.3.1 Java EE Application using OPSS APIs

Figure 19–2 illustrates a standard Java EE application using OPSS security APIs. Developing Secure Applications with Oracle Platform Security Services 19-7 Figure 19–2 Java EE Application using Multiple OPSS APIs Key features include: ■ Integration with Oracle WebLogic Server ■ Credential Store Framework API to secure credentials in the LDAP directory or file-based credential store. Different types of credentials will be stored here - external database credentials, external Web Service credentials, and so on. ■ User and Role API to query attributes stored in the identity store ■ JpsAuth.checkPermission API for authorization

19.3.2 Authenticating with OPSS APIs

Developers have the following choices when implementing authentication: ■ Declarative authentication, where authentication is configured in the file web.xml this is standard Java EE security ■ Programmatic security. Oracle Fusion Middleware provides several APIs, including: – Oracle WebLogic Server’s authentication API, weblogic.security.auth.Authenticate – OPSS oracle.security.jps.service.login.LoginService API for Java SE applications. This API supports userpassword authentication and username assertion. The assertion functionality is protected by JpsPermission with the name IdentityAssertion. Figure 19–3 illustrates a Java EE application that must assert an identity through a token or through user credentials.