Navigate to Data Sources YourDataSourceName Custom Properties.

8-16 Oracle Fusion Middleware Application Security Guide -Djavax.net.ssl.trustStore=absolute path name to file myKeys.jks To establish a one-way SSL connection between the server and the policy store, proceed as follows if applicable, the trust CA is assumed exported: 1. Use the utility keytool to import trust CA to the trust key store, as illustrated in the following invocation: keytool -import -v -trustcacerts -alias trust -file serverTrust.cert -keystore myKeys.jks -storepass keyStorePassword 2. Modify the script typically startWebLogic.sh that starts the server to include a line like the following, and then restart the server: -Dweblogic.security.SSL.trustedCAKeyStore=absolute path name to file myKeys.jks 3. If the OID server uses a wild card in the SSL certificate, then add the following line to the script that starts the WebLogic server: -Dweblogic.security.SSL.ignoreHostnameVerification=true Setting Up the WebLogic Server in Case of a Java SE Application The setting up in the case of Java SE applications is the same for both the identity and the policy store services. 1. If the CA is known to the Oracle WebLogic server, skip this step; otherwise, use the utility keytool to import the Oracle Internet Directorys CA into the WebLogic truststore. The following invocation, which outputs the file myKeys.jks, illustrates the use of this command to import the file serverTrust.cert: keytool -import -v -trustcacerts -alias trust -file serverTrust.cert -keystore myKeys.jks -storepass keyStorePassword 2. Modify the script that starts the JMV to include a line like the following: -Djavax.net.ssl.trustStore=absolute path name to file myKeys.jks

8.5.1.2 Securing Access to Oracle Internet Directory Nodes

The procedure explained in this section is optional and performed only to enhance the security to access an Oracle Internet Directory. An access control list ACL is a list that specifies who can access information and what operations are allowed on the Oracle Internet Directory directory objects. The control list is specified at a node, and its restrictions apply to all entries in the subtree under that node. ACL can be used to control the access to policy and credential data stored in an LDAP Oracle Internet Directory repository, and it is, typically, specified at the top, root node of the store. To specify an ACL at a node in an Oracle Internet Directory repository, proceed as follows: 1. Create an LDIF file with a content that specifies the ACL: dn: storeRootDN changetype: modify add: orclACI