Functional Security Integrating Authorization

19-4 Oracle Fusion Middleware Application Security Guide Figure 19–1 OPSS Architecture The Oracle Platform Security architecture provides: ■ A layered architecture that decouples the application layer from the underlying implementation. ■ An extensible framework that allows explicit extensibility points through the SPI layer where custom implementations such as custom login modules can be plugged into the framework to provide special functionality.

19.2 OPSS APIs

This section describes the APIs available to developers working with Oracle Platform Security Services: ■ The LoginService API ■ The User and Role API ■ JAAS Authorization and the JpsAuth.checkPermission API ■ The Credential Store Framework API

19.2.1 The LoginService API

OPSS provides the LoginService authentication API to enable Java SE applications to access and manage the identity store. Support for authentication is through the login module, a component that authenticates users and populates a subject with principals. This process occurs in two distinct phases: ■ In the first phase, the login module attempts to authenticate a user by means of credentials supplied by the user. ■ In the second phase, the login module assigns relevant principals to a subject, which is eventually used to perform a privileged action. Developing Secure Applications with Oracle Platform Security Services 19-5 For details, see Chapter 22, Authentication for Java SE Applicaitons .

19.2.2 The User and Role API

The user and role API framework allows applications to access identity information users and roles in a uniform and portable manner regardless of the particular underlying identity repository, since the type of the underlying identity store is transparent to the caller. This API framework provides a convenient way to access repositories programmatically in a portable way, freeing the application developer from the potentially difficult task of accounting for the intricacies of particular identity sources. The framework allows an application to work against different repositories seamlessly. An application can switch between various identity repositories without any code changes being required. Supported operations include creating, updating, or deleting users and roles, or searching users and roles for attributes or information of interest. For example, you may want to search for the e-mail addresses of all users in a certain role. The API supports: ■ LDAP directory servers such as Oracle Internet Directory ■ Flat files ■ Other custom repositories such as databases, by implementing a custom provider for the repository With the User and Role API, you can: ■ Access repositories programmatically in a portable way. ■ Eliminate the need to account for the intricacies of particular identity sources. ■ Enable your application to work against different repositories. ■ Switch between various identity repositories without any code changes to your application. For details, see Chapter 25, Developing with the User and Role API .

19.2.3 JAAS Authorization and the JpsAuth.checkPermission API

The Java EE authorization model uses role membership to control access to EJBs and web resources that are referenced by URLs; the Java 2 authorization model uses permissions instead of role memberships to control access decisions. You can specify authorization policies in application code. Sensitive lines of code are preceded with calls to check whether a subject has the appropriate permission to execute specific sections of code. If the subject fails to have the proper permission, the code throws a security exception. Java 2 authorization is based on permissions, rather than roles, and access control decisions are evaluated by calls to the SecurityManager or the AccessController. When used with JAAS, this model allows for a programmatic authorization capability, thus providing fine-grained control to resources. Oracle Fusion Middleware supports authorization using Java EE DDannotation based authorization and JAASJava2 permission based authorization. Both declarative and programmatic approaches for enforcing authorization policies are supported; the latter is implemented through the JpsAuth.checkPermission API, and AccessController.checkPermission can be used as well.