Configuring DB-Based OPSS Security Stores

24-4 Oracle Fusion Middleware Application Security Guide jazn-policy where: ■ MapName is the name of the map typically the name of the application for which you want to grant these permissions read, write, update, and delete permissions denoted by the wildcarded actions. ■ KeyName is the key name in use.

24.3.3 Permissions Grant Example 2

In this example permissions are granted for a specific map name and all its key names. jazn-policy grant grantee principals...principals codesource urlfile:{oracle.deployed.app.dir}MyApp{oracle.deployed.app.ext}url codesource grantee permissions permission classoracle.security.jps.service.credstore. CredentialAccessPermissionclass namecontext=SYSTEM,mapName=myMap,keyName=name -- Certain actions are explicitly specified -- -- Compare to wild-card grant in previous example -- actionsread,write,update,deleteactions permission permissions grant jazn-policy

24.4 Guidelines for the Map Name

When the domain-level credential store is used, name conflicts can arise with the various map names in the store for different applications. To avoid this, each application must have a unique map name in the store. To achieve this, it is recommended that the map name you use uniquely identify the application. Within a given map name, an application can store multiple credentials each of which is identifiable by a key. The map name and the key together constitute a primary key within a given credential store. If there is a requirement that an application use more than one map name, then uniqueness continues to be maintained. For example, consider three applications: ■ a Repository Creation Utility RCU based application, ■ a Oracle WebCenter application, and ■ a Fusion Middleware Control application For RCU, a map name of RCU is chosen and the keys for three credentials are say Key1, Key2, and Key3: Developing with the Credential Store Framework 24-5 MapName - RCU, Key - Key1 and Credential - PasswordCredential1 MapName - RCU, Key - Key2 and Credential - PasswordCredential2 MapName - RCU, Key - Key3 and Credential - GenericCredential1 For Oracle WebCenter, the map name is Web and the key for a single credential is Key1: MapName - Web, Key - Key1 and Credential - PasswordCredential3 For Fusion Middleware Control, the map name is denoted by EM and the keys for two credentials are Key1 and Key2 respectively: MapName - EM, Key - Key1 and Credential - PasswordCredential4 MapName - EM, Key - Key2 and Credential - GenericCredential2 Note that the map name and key name are just two arbitrary strings and can have any valid string values in practice. However, implementing this way makes map names easier to manage.

24.5 Configuring the Credential Store

The administrator needs to define the credential store instance in a configuration file which contains information about the location of the credential store and the provider classes. Configuration files are located in: DOMAIN_HOMEconfigfmwconfig and are named as follows: ■ jps-config.xml for Oracle WebLogic Server ■ jps-config-jse.xml for Java SE For details, see Chapter 10, Managing the Credential Store .

24.6 Steps for Using the API

You can use the credential store framework within Oracle WebLogic Server or in a standalone environment. ■ Using the CSF API in a Standalone Environment ■ Using the CSF API in Oracle WebLogic Server

24.6.1 Using the CSF API in a Standalone Environment

The steps for using the API in a standalone environment are:

1. Set up the classpath. Ensure that the jps-manifest.jar file is in your classpath.

For details, see Required JAR in Classpath in Section 1.5.3, Scenario 3: Securing a Java SE Application .

2. Set up the policy; to provide access to the CSF APIs, you need to configure the

access permissions in the reference policy store. For examples, see Section 24.3, Setting the Java Security Policy Permissions . Note: The map names and key names used here are arbitrary and chosen for illustration only. Your application can use altogether different map names andor keynames.