Migrating Audit Policies Migrating from a Test to a Production Environment

7-2 Oracle Fusion Middleware Application Security Guide Figure 7–1 The OPSS Identity Store Service

7.1.3 Application Server Support

The identity store service supports: ■ Oracle WebLogic Server ■ Third-party application servers The service configuration differs depending on the application server as you need to specify the provider that supports the service.

7.1.4 Java SE Support

The identity store service is available in a stand-alone Java SE environment. For more information, see Section 7.3.5, Java SE Environments .

7.2 Configuring the Identity Store Provider

Before you can make use of the identity store service, you need to configure the identity store provider. OPSS support both XML- and LDAP-based providers. This fragment from the jps-config.xml file shows the configuration of both XML and LDAP providers. The serviceProvider elements are children of the serviceProviders element. serviceProvider type=IDENTITY_STORE name=idstore.ldap.provider class=oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider descriptionLDAP-based IdentityStore Providerdescription serviceProvider serviceProvider type=IDENTITY_STORE name=idstore.xml.provider class=oracle.security.jps.internal.idstore.xml.XmlIdentityStoreProvider descriptionXML-based IdentityStore Providerdescription serviceProvider For details, see Section 8.7.1, Configuring the Identity Store Provider . Configuring the Identity Store Service 7-3

7.3 Configuring the Identity Store Service

This section describes how to configure the identity store service to LDAP-based stores. ■ What is Configured? ■ Configuration in WebLogic Server ■ Configuring Split Profiles ■ Configuration in Other Application Servers ■ Java SE Environments 7.3.1 What is Configured? This section explains the different configuration parameters for the identity store service. ■ Configuring Multi-LDAP Lookup ■ GlobalConnection Parameters ■ Back-EndConnection Parameters

7.3.1.1 Configuring Multi-LDAP Lookup

You use the following parameters to configure the service for multi-LDAP look-ups: ■ The virtualize property - This property can be either true multi-LDAP lookup or false single-LDAP lookup. The default is false. ■ Global Connection Parameters if virtualize is enabled - The calling application uses these parameters to specify global LDAP configuration such as the search base, create base, and so on. If any of these parameters are not configured, OPSS uses default values. ■ Back-end Connection Parameters - These parameters are specific to each LDAP store. One set of back-end parameters is specified for each LDAP. You do not need to set these parameters unless you wish to overwrite existing values.

7.3.1.2 GlobalConnection Parameters

Table 7–1 shows the global parameters and their default values, if applicable: Table 7–1 Global LDAP Identity Store Parameters Parameter Default Value group.create.bases same as user.create.bases group.filter.object.classes groupofuniquenames If the global value is explicitly given, it is used. group.mandatory.attrs - group.member.attrs uniquemember group.object.classes groupofuniquenames group.search.bases - group.selected.create.base - group.selected.search.base - 7-4 Oracle Fusion Middleware Application Security Guide

7.3.1.3 Back-EndConnection Parameters

As mentioned earlier, these are specific to the back-end LDAP store. For details, see: ■ Table F–5, LDAP-Based Identity Store Properties ■ Section F.2.1, Policy Store Properties

7.3.2 Configuration in WebLogic Server

You configure LDAP authenticators in Oracle WebLogic Server using either the WebLogic console or WLST command-line; at runtime, Oracle WebLogic Server passes the configuration details to OPSS. Oracle WebLogic Server allows the configuration of multiple authenticators in a given context, selecting the first authenticator to initialize the identity store service by default. This process is explained in Section 3.1.2.2, Configuring the LDAP Identity Store Service . After the authenticators are configured, the identity store service can be set up to query one LDAP identity store or multiple stores. Configuring for multiple stores requires setting up the virtualize property. This section explains how these options are set up.

7.3.2.1 Configuring the Service for Single LDAP

You can configure the identity store service to query only one LDAP store. Example 7–1 shows a fragment of jps-config.xml with a single LDAP service instance: groupname.attr cn If the global value is explicitly given, it is used. max.search.filter.length - search.type - user.create.bases If only one authenticator, uses that create base value. If multiple authenticators, no default value is set; user must explicitly set the global value. user.filter.object.classes inetorgperson user.login.attr uid user.mandatory.attrs - user.object.classes inetorgperson If the global value is explicitly given, it is used. user.search.bases Same as group.search.bases username.attr cn If the global value is explicitly given, it is used. See Also: Section F–6, Generic LDAP Properties Table 7–1 Cont. Global LDAP Identity Store Parameters Parameter Default Value Configuring the Identity Store Service 7-5

7.3.2.2 Configuring the Service for Multiple LDAP using Fusion Middleware Control

As in the single LDAP setup, you start by configuring the authentication providers in Oracle WebLogic Server. Next, take these steps in Fusion Middleware Control:

1. Select the WebLogic domain in the navigation pane on the left.

2. Navigate to Security, then Security Provider Configuration.

3. Expand the Identity Store Provider section of the page.

4. Click Configure corresponding to Configure parameters for User and Role APIs

to interact with identity store.

5. The Identity Store Configuration page appears.

6. Under Custom Properties, click Add.

7. Add the new property as follows:

Property Name=virtualize Value=true

8. Click OK.

7.3.2.3 Configuring the Service for Multiple LDAP using WLST

To configure the virtualize property using WLST, take these steps: 1. Create a py script file to connect to the administration server in the domain of interest. You need to specify the userName, userPass, localHost, and portNumber for the operation. See Appendix E.1, Configuring OPSS Service Provider Instances with a WLST Script for details about this script. 2. Navigate to ORACLE_HOMEcommonbin. 3. Run the wlst.sh command to execute the script. For example, if the domain configuration file contains an authenticator named idstore.ldap, the following command: wlst.sh tmpupdateServiceInstanceProperty.py -si idstore.ldap -key virtualize -value true configures the provider for multi-LDAP lookup.

7.3.2.4 Configuring Other Parameters

If desired, you can update jps-config.xml to set query parameters listed in Section 7.3.1, What is Configured? . These parameters are optional; default values are provided. Note: Be sure to add the property to the identity store service instance in the default context. See Also: Section E.1, Configuring OPSS Service Provider Instances with a WLST Script . 7-6 Oracle Fusion Middleware Application Security Guide

7.3.2.5 Restarting Servers

After configuring for multi-LDAP query, restart Weblogic servers admin and managed servers.

7.3.2.6 Examples of the Configuration File

Example 7–1 shows a sample jps-config.xml file configured for single-LDAP queries in the Oracle WebLogic Server environment: Example 7–1 Single-LDAP Configuration in Oracle WebLogic Server -- JPS WLS LDAP Identity Store Service Instance -- serviceInstance name=idstore.ldap provider=idstore.ldap.provider property name=idstore.config.provider value=oracle.security.jps.wls.internal.idstore. WlsLdapIdStoreConfigProvider property name=CONNECTION_POOL_CLASS value=oracle.security.idm.providers.stdldap.JNDIPool serviceInstance Example 7–2 shows a sample jps-config.xml file configured for multi-LDAP queries in the Oracle WebLogic Server environment: Example 7–2 Multi-LDAP Configuration in Oracle WebLogic Server jpsConfig xmlns=http:xmlns.oracle.comoracleasschema11jps-config-11_1.xsd xmlns:xsi=http:www.w3.org2001XMLSchema-instance xsi:schemaLocation=http:xmlns.oracle.comoracleasschema11jps-config-11_ 1.xsd schema-major-version=11 schema-minor-version=1 serviceProviders serviceProvider type=IDENTITY_STORE name=idstore.ldap.provider class=oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider descriptionLDAP-based IdentityStore Providerdescription serviceProvider serviceProviders serviceInstances -- IDstore instance connecting to multiple ldap -- serviceInstance name=idstore.virtualize provider=idstore.ldap.provider -- following property indicates using WLS ldap Authenticators -- property name=idstore.config.provider value=oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider -- following property enables virtualization i.e., support for multiple stores -- property name=virtualize value=true -- Front end ldap properties if not supplied, will use default values -- extendedProperty nameuser.create.basesname values valuecn=users_front,dc=us,dc=oracle,dc=comvalue values extendedProperty