Configuring Split Profiles Configuration in Other Application Servers

7-12 Oracle Fusion Middleware Application Security Guide 8 Configuring the OPSS Security Store 8-1 8 Configuring the OPSS Security Store The OPSS security store is the repository of system and application-specific policies, credentials, and keys. For an introduction to policies and credentials, see the following sections: ■ Section 3.2, Policy Store Basics ■ Section 3.3, Credential Store Basics This chapter explains the features of the OPSS security store common to policies and credentials, and it is divided into the following sections: ■ Introduction to the OPSS Security Store ■ Using an LDAP-Based OPSS Security Store ■ Using a DB-Based OPSS Security Store ■ Configuring the OPSS Security Store ■ Reassociating the OPSS Security Store ■ Migrating the OPSS Security Store ■ Configuring the Identity Provider, Property Sets, and SSO ■ Cataloging Oracle Internet Directory Attributes For details about Java EE and WebLogic Security, see section Java EE and WebLogic Security in Oracle Fusion Middleware Understanding Security for Oracle WebLogic Server.

8.1 Introduction to the OPSS Security Store

The OPSS security store is the repository of system and application-specific policies, credentials, and keys. This centralization facilitates the administration and maintenance of policy, credential, and key data. Note: When a WebLogic domain is setup to use policies based on the OPSS security store, JACC policies and the Java Security Manager become unavailable on all managed servers in that domain. Important: All permission classes used in policies in the OPSS security store must be included in the class path, so the policy provider can load them when a service instance is initialized. 8-2 Oracle Fusion Middleware Application Security Guide The OPSS security store can be file-, LDAP-, or DB-based depending on the choice of repository type, and it can be reassociated that is, the repository type can be changed from file-based to LDAP- or DB-based; from DB-based to LDAP- or DB-based; and from LDAP-based to LDAP- or DB-based. No other reassociation is supported. For details about the tools and procedures available to reassociate the OPSS security store, see sections Reassociating with Fusion Middleware Control and Reassociating with the Script reassociateSecurityStore . Out-of-the-box, the OPSS security store is file-based. The security data relevant to a Java EE application is typically packaged with the application and it can be migrated at deploy time to the OPSS security store. For details about the tools and procedures available to migrate to the OPSS security store, see sections Migrating with Fusion Middleware Control and Migrating with the Script migrateSecurityStore .

8.2 Using an LDAP-Based OPSS Security Store

An LDAP-based policy store is typically used in production environments. The only LDAP server supported in this release is the Oracle Internet Directory release 10.1.4.3 or later. To use a domain LDAP-based OPSS security store the domain administrator must configure it, as appropriate, using Oracle Enterprise Manager Fusion Middleware Control or OPSS scripts. Note: Depending on the version, the following patches to Oracle Internet Directory are required: ■ Patch to fix bug 9093298 in Oracle Internet Directory 10.1.4. ■ Patch to fix bug 8736355 in Oracle Internet Directory 11.1.x ■ Patch to fix bug 8426457 in Oracle Internet Directory 11.1.x and 10.1.4.3.0 ■ Patch to fix bug 8351672 in Oracle Internet Directory 10.1.4.3.0 To apply a patch, proceed as follows: 1. Visit Oracle Automated Release Updates at http:aru.us.oracle.com:8080 2. Click the Patches tab. 3. Enter the bug number in the Request Number box, and click Search. 4. Apply the patch. Important: OPSS does not support enabling referencial integrity on Oracle Internet Directory servers. The server will not work as expected if referencial integrity is enabled. To disable a server’s referencial integrity, use Oracle Enterprise Manager Fusion Middleware Control as follows: 1. Select Administration, then Shared Properties from the Oracle Internet Directory menu, and then select General. 2. Select Disabled from the Enable referencial Integrity list. Configuring the OPSS Security Store 8-3 For a list of properties that can be specified in a service instance, see Appendix F.2.4, Properties Common to All LDAP-Based Instances. The information in this section is divided into the following topics: ■ Multiple-Node Server Environments ■ Prerequisites to Using an LDAP-Based Security Store

8.2.1 Multiple-Node Server Environments

In domains where several server instances are distributed across multiple machines, it is highly recommended that the OPSS security store be LDAP- or DB-based. Typically, applications do not change policy, credential, or key data. When they do, however, it is crucial that these changes be correctly propagated to all managed servers and clusters in a domain and, therefore, it is recommended that any such changes be performed in the domain administration server and not in managed servers. In a single-node server domain, the propagation of local changes to security data is irrelevant: in this scenario, local changes are equivalent to global changes. In a multiple-node server domain, however, the JMX framework propagates local changes to a file-based policy to each runtime environment, so that the data is refreshed based on caching policies and configuration. For details about properties you can set on policies and credentials, see sections Appendix F.2.1, Policy Store Properties, and Appendix F.2.2, Credential Store Properties. To summarize, in a multiple-node server environment, it is highly recommended that: ■ Both the policy and credential stores be centralized in a LDAP-based store and configured in the administration server. ■ Or, if they are file-based, then local changes to policy or credential data be performed only by the domain administration server to ensure that they are correctly propagated from the administration server to all managed servers in the domain.

8.2.2 Prerequisites to Using an LDAP-Based Security Store

The only supported LDAP-based OPSS security store is Oracle Internet Directory. In order to ensure the proper access to the Oracle Internet Directory, you must set a node in the server directory as explained below. Fusion Middleware Control automatically provides bootstrap credentials in the file cwallet.sso when that tool is used to reassociate to an LDAP-based repository. To specify these required credentials manually, see section Section 21.4.7, Specifying Bootstrap Credentials Manually. Setting a Node in an Oracle Internet Directory Server The following procedure is carried out by an Oracle Internet Directory administrator. To set a node in the LDAP Oracle Internet Directory directory, proceed as follows: 1. Create an LDIF file assumed jpstestnode.ldif, for illustration purpose specifying the following DN and CN entries: dn: cn=jpsroot cn: jpsroot objectclass: top objectclass: OrclContainer