listResourceTypes reassociateSecurityStore Managing Application Policies with OPSS Scripts

9-34 Oracle Fusion Middleware Application Security Guide

9.8 Guidelines for Configuring the Policy Store

For details about OPSS properties tune up, see section Oracle Platform Security Services Tuning in Oracle Fusion Middleware Performance and Tuning Guide. 10 Managing the Credential Store 10-1 10 Managing the Credential Store A credential store is a repository of security data credentials. A credential can hold user name and password combinations, tickets, or public key certificates. Credentials are used during authentication, when principals are populated in subjects, and, further, during authorization, when determining what actions the subject can perform. Oracle Platform Security Services includes the Credential Store Framework CSF, a set of APIs that applications can use to create, read, update, and manage credentials securely. A typical use of the credential store is to store credentials user name and password to access some external system, such as a database or an LDAP-base repository. This chapter is divided into the following sections: ■ Credential Types ■ Managing Credentials with Fusion Middleware Control ■ Managing Credentials with OPSS Scripts

10.1 Credential Types

OPSS supports the following types of credentials according to the data they contain: ■ A password credential encapsulates a user name and a password. ■ A generic credential encapsulates any customized data or arbitrary token, such as a symmetric key. In CSF, a credential is uniquely identified by a map name and a key name. Typically, the map name corresponds with the name of an application and all credentials with the same map name define a logical group of credentials, such as the credentials used by the application. The combination of map name and key name must be unique for all entries in the credential store. Oracle Wallet is the default credential store; in a production environment, it is recommended the use of an LDAP-based Oracle Internet Directory as the credential store. It is also recommended that the Oracle Wallet be used to store X.509 certificates. The credential store does not allow the storage of end-user digital certificates.

10.2 Managing the Credential Store

Credentials can be provisioned, retrieved, modified, or deleted, but only by a user in the appropriate administration role. The following sections explain how an administrator can manage credentials using Fusion Middleware Control pages or OPSS scripts, and how code can access data in the CSF. 10-2 Oracle Fusion Middleware Application Security Guide

10.3 Managing Credentials with Fusion Middleware Control

The following procedure explains how to manage credentials with Fusion Middleware Control, including creating, viewing, deleting, or updating a credential.

1. Log in to Fusion Middleware Control and navigate to Domain Security

Credentials , to display the Credentials page. The following graphic partially illustrates this page: The area Credential Store Provider is read-only and, when expanded, displays the credential store provider currently in use in the domain. The table below this read-only area allows creating, editing, and searching credentials.

2. At any point, use the button Delete to remove a selected item key or map in the

table. Note that deleting a credential map, deletes all keys in it. Similarly, use the button Edit to view or modify the data in a selected item.

3. To display credentials matching a given key name, enter the string to match in the

box Credential Key Name, and then click the blue button to the right of it. The result of the query is displayed in the table.

4. To redisplay the list of credentials after examining the results of a query, select

Domain Security Credentials. To create a credential map:

1. Click Create Map to display the Create Map dialog.

2. In this dialog, enter the name of the map for the credential being created.

3. Click OK to return to the Credentials page. The new credential map name is

displayed with a map icon in the table. To add a key to a credential map:

1. Click Create Key to display the Create Key dialog.

2. In this dialog, select a map from the menu Select Map for the key being created,

enter a key in the text box Key, and select a type Password or Generic from the pull-down menu Type. The dialog display changes according the type selected. If Password is selected, enter the required fields Key, User Name, Password, Confirm Passwords. If Generic is selected, enter the required field Key and the credential information either as text select Enter as Text radio button, or as a list of key-value pairs