getEntitlement Managing Application Policies with OPSS Scripts

Managing the Policy Store 9-29 Example of Use The following invocation lists all entitlements in the stripe myApplication: listEntitlement -appStripe myApplication

9.3.28 listResourceTypes

The script listResourceTypes lists all the resource types in a specified application stripe. Script Mode Syntax listResourceTypes -appStripe appStripeName Interactive Mode Syntax listResourceTypesappStripe=appStripeName The meaning of the arguments is as follows: ■ appStripe specifies the application stripe where the resource types are located. Example of Use The following invocation lists all resource types in the stripe myApplication: listResourceTypes -appStripe myApplication

9.3.29 reassociateSecurityStore

The script reassociateSecurityStore migrates the OPSS security store from a source to a target LDAP- or DB-based store, and it resets the default policy and credential services to the target repository. It also allows specifying that the OPSS security store be shared with that in a different domain see optional argument join below. The OPSS binaries and the target policy store must have compatible versions; for details, see Section L.20, Incompatible Versions of Binaries and Policy Store. The source can be a file-, LDAP-, or DB-based store; the only type of LDAP target supported is Oracle Internet Directory; the only type of DB target supported is DB_ ORACLE. This script uses and modifies the domain configuration file jps-config.xml, and it is supported in only the interactive mode. For recommendations involving reassociation, see Important Points . Interactive Mode Syntax The script syntax varies slightly according to the type of the target store. When the target is an LDAP-based store, use the following syntax: reassociateSecurityStoredomain=domainName, servertype=OID, ldapurl=hostAndPort, jpsroot=cnSpecification, admin=cnSpecification, password=passWord [,join=trueOrfalse] When the target is a DB-based store, use the following syntax: reeassociateSecurityStoredomain=domainName, servertype=DB_ORACLE, datasourcename=datasourceName, jpsroot=jpsRoot,[admin=adminAccnt], [password=passWord],[join=trueOrfalse] The meaning of the arguments all required is as follows: 9-30 Oracle Fusion Middleware Application Security Guide ■ domain: on WebLogic, specifies the domain name where the reassociating takes place; on WebSphere, specifies the WebSphere cell name. ■ admin specifies, in case of an LDAP target, the administrator’s user name on the target server, and the format is cn=usrName. In case of a DB target, it is required only when the DB has a protected data source protected with userpassword; in this case, it specifies the user name set to protect the data source when the data source was created; that user and password must be present in the bootstrap credential store. ■ password specifies the password associated with the user specified for the argument admin. It is required in case of an LDAP target. In case of a DB target, it is required only when the DB has a protected data source; in this case, it specifies the password associated with the user specified for the argument admin. ■ ldapurl specifies the URI of the LDAP server. The format is ldap:host:port, if you are using the default port, or ldaps:host:port, if you are using an anonymous SSL or one-way SSL transmission. The secure port must be configured to handle the desired SSL connection mode, and must be distinct from the default non-secure port. ■ servertype specifies the kind of the target LDAP server or DB server. The only valid types are OID and DB_ORACLE. ■ jpsroot specifies the root node in the target LDAP repository under which all data is migrated. The format is cn=nodeName. ■ join specifies whether the domain is to share an OPSS security store in another domain. Optional. Set to true to share an existing store in another domain; set to false otherwise. The use of this argument allows multiple WebLogic domains to point to the same logical OPSS security store. ■ datasourcename specifies the JNDI name of the JDBC data source; this should be identical to the value of the JNDI name data source entered when the data source was created; see Section 8.3.1.3, Creating a Data Source Instance. Examples of Use reassociateSecurityStoredomain=myDomain, admin=cn=adminName, password=myPass, ldapurl=ldaps:myhost.example.com:3060, servertype=OID, jpsroot=cn=testNode Suppose that you want some other domain distinct from myDomain, say otherDomain to share the policy store in myDomain. Then you would invoke the script as follows: reassociateSecurityStoredomain=otherDomain, admin=cn=adminName, password=myPass, ldapurl=ldaps:myhost.example.com:3060, servertype=OID, jpsroot=cn=testNode, join=true Important: When an OPSS security store is reassociated with join=true, the bootstrap wallet from the first domain must be manually copied to the second domain. The reason for this requirement is that the first domain generates a local key that is used to encrypt the keystore data and the second domain needs to have the same key in its bootstrap wallet in order to decrypt that data.