Meeting the Challenges with Oracle Platform Security Services OPSS Architecture

19-10 Oracle Fusion Middleware Application Security Guide

19.3.7 Java SE Application Using OPSS APIs

Figure 19–7 illustrates a Java SE Swing application using different OPSS APIs. Figure 19–7 Java SE Application using OPSS APIs Key features include: ■ LoginService API for authentication ■ JpsAuth.CheckPermission for authorization ■ User and Role API to query attributes stored in LDAP or other back-end ■ Use of credential store to secure credentials

19.4 Using OPSS with Oracle Application Development Framework

When you use Oracle ADF to develop and deploy applications, you are able to directly leverage the security features of OPSS, since Oracle ADF is integrated with OPSS. This section introduces Oracle ADF and provides an example of OPSS security in an Oracle ADF application.

19.4.1 About Oracle ADF

The Oracle Application Development Framework Oracle ADF is an end-to-end application framework that builds on Java Platform, Enterprise Edition Java EE standards and open-source technologies to simplify and accelerate implementing service-oriented applications. For enterprise solutions that search, display, create, Note: In an LDAP-based store, like that shown in the figure, both policies and credentials are maintained in the same store, while file-based stores maintain separate files for each. Important: The OPSS policy provider must be explicitly set in Java SE applications, as illustrated in the following snippet: java.security.Policy.setPolicynew oracle.security.jps.internal.policystore.JavaProvider Not setting the policy provider explicitly in a Java SE application may cause runtime methods such as JpsAuth.checkPermission to return incorrect values. Developing Secure Applications with Oracle Platform Security Services 19-11 modify, and validate data using web, wireless, desktop, or web services interfaces, Oracle ADF can simplify the development effort. Used in tandem, Oracle JDeveloper 11g and Oracle ADF give you an environment that covers the full development life cycle from design to deployment, with drag-and-drop data binding, visual UI design, and team development features built in.

19.4.2 How Oracle ADF Uses OPSS

The Oracle ADF Security framework is the preferred technology to provide authentication and authorization services to the Fusion web application. Among the advantages: ■ Oracle ADF Security is built on top of the Oracle Platform Security Services OPSS architecture, which provides a critical security framework and is itself well-integrated with Oracle WebLogic Server. ■ Oracle JDeveloper and Oracle ADF use the OPSS application life cycle listener framework to migrate credential and policy data when the application is deployed. Oracle ADF’s built-in support for security features including OPSS features helps reduce some of the effort that would be required to implement those features outside Oracle ADF; indeed, certain features are not available using only container-managed security. Figure 19–8 illustrates an Oracle ADF application using both fine-grained authorization and Java EE container-based authentication. Figure 19–8 Oracle ADF using JpsAuth.checkPermission Key features include: ■ Use of JDeveloper’s security wizard to create required security configuration ■ Calls by Oracle ADF filter to JpsAuth.checkPermission ■ Task flows and regions protected using custom Oracle ADF permissions For more information, see: ■ ADF Security in the Oracle Fusion Middleware Security Overview See Also: Chapter 6, Deploying Secure Applications