Secure Sockets Layer and Oracle Directory Integration Platform

2-2 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform The server verifies its identity to the client by sending a certificate issued by a trusted certificate authority CA . This mode requires a public key infrastructure PKI and certificates to be stored in the Java Keystore JKS. To use SSL with Oracle Directory Integration Platform, you must start both the Oracle Internet Directory and Oracle Directory Integration Platform in the same SSL mode. For example, if Oracle Internet Directory is running in SSL mode 1, then Directory Integration Platform must be configured to connect to Oracle Internet Directory using the same SSL mode 1.

2.1.2 Oracle Directory Integration Platform Authentication in SSL Mode

The identity of the directory server can be established by starting both Oracle Internet Directory and the directory integration server in SSL server authentication mode. In this case, the directory server provides its certificate to the directory integration server, which acts as the client of Oracle Internet Directory. You can also configure the Oracle Directory Integration Platform to use SSL when connecting to a third-party directory. In this case, you store the connected directory certificates in the Java Keystore JKS as described in Managing the SSL Certificates of Oracle Internet Directory and Connected Directories on page 4-14.

2.1.3 Profile Authentication

Within Oracle Internet Directory, an integration profile represents a user with its own distinguished name DN and password. The users who can access the profiles are: ■ The administrator of Oracle Directory Integration Platform, represented by the DN cn=dipadmin,cn=dipadmins,cn=directory integration platform,cn=products,cn=oraclecontext ■ Members of the Oracle Directory Integration Platform administrator group, represented by the DN cn=odisgroup,cn=DIPadmins,cn=Directory Integration Platform,cn=Products,cn=OracleContext When the Oracle Directory Integration Platform imports data to Oracle Internet Directory based on an integration profile, it proxy-binds to the directory as that integration profile.The Oracle Directory Integration Platform can bind in either SSL or non-SSL mode.

2.2 Access Control and Authorization and Oracle Directory Integration Platform

Authorization is the process of ensuring that a user reads or updates only the information for which he or she has privileges. When directory operations are attempted within a directory session, the directory server ensures that the user— identified by the authorization identifier associated with the session—has the requisite permissions to perform those operations. If the user does not have the necessary permissions, then the directory server disallows the operation. Through this mechanism, called access control, the directory server protects directory data from unauthorized operations by directory users. See Also: The chapter on preliminary tasks and information in the Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory for instructions about starting the Oracle directory server in SSL mode Security Features in Oracle Directory Integration Platform 2-3 To restrict access to only the desired subset of Oracle Internet Directory data, for both the directory integration server and a connector, place appropriate access policies in the directory. This section discusses these policies in detail. It contains these topics: ■ Access Controls for the Oracle Directory Integration Platform ■ Access Controls for Profiles

2.2.1 Access Controls for the Oracle Directory Integration Platform

The Oracle Directory Integration Platform binds to the directory both as itself and on behalf of the profile, as follows: ■ When it binds as itself, it can cache the information in various integration profiles. This enables the directory integration server to schedule synchronization actions to be carried out by various connectors. ■ When the directory integration server operates on behalf of a profile, it acts as proxy for the profile—that is, it uses the profile credentials to bind to the directory and perform various operations. The directory integration server can perform only those operations in the directory that are permitted in the profile. To establish and manage access rights granted to directory integration servers, Oracle Directory Integration Platform creates a group entry, called odisgroup, during installation. When a directory integration server is registered, it becomes a member of this group. The DN of odisgroup is: cn=odisgroup,cn=directory admins,cn=directory integration plataform,cn=products,cn=oraclecontext You control the access rights granted to directory integration servers by placing access control policies in the odisgroup entry. The default policy grants various rights to directory integration servers for accessing the profiles. For example, the default policy enables the directory integration server to compare user passwords between Oracle Internet Directory and a connected directory it binds as a proxy on behalf of a profile. It also enables directory integration servers to modify status information in the profile—such as the last successful execution time and the synchronization status.

2.2.2 Access Controls for Profiles

During installation, Oracle Directory Integration Platform creates a group entry called odipgroup that enables you to control the access rights granted to various profiles. For additional security, the odipigroup and odipegroup groups are also created during installation. All import profiles are assigned to the odipigroup group and all export profiles are assigned to the odipegroup group. Rights are controlled by placing appropriate access policies in the odipgroup entry. The default access policy, automatically installed with the product, grants to profiles certain standard access rights for the integration profiles they own. One such right is the ability to modify status information in the integration profile, such as the parameter named orclodipConDirLastAppliedChgTime. The default access policy also permits profiles to access Oracle Internet Directory change logs, to which access is otherwise restricted. See Also: The chapter on access control, specifically, the section about security groups, in Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory for instructions about setting access control policies for group entries