Set up SOAP Security

Integrating Native Java Applications 4-3

a. Select the row oraclewss_http_token_service_policy.

6. To disable SOAP Authentication:

a. Select the rows oraclebinding_authorization_permitall_policy, oracleno_

authentication_service_policy , oracleno_authorization_service_policy and click the Next button

7. Click the Attach button in the next page.

8. Restart OAAM Server if required. Client Side Keystore to secure the SOAP User password Web ServicesSOAP clients need to send the username and password for successful communication with OAAM web services. 1. In the ORACLE_HOMEoaamcli directory, create a file, for example, soap_ key.file, and enter the HTTP authentication user password in it. The password from the user that was added to the OAAMSOAPServicesGroup rolegroup. 2. Copy sample.soap_3des_input.properties to soap_3des_ input.properties. 3. Update soap_3des_input.properties with the keystore password, the alias password, and password file. This is the password for opening the keystore. keystorepasswd= This is the password reading alias key in the keystore keystorealiaspasswd= File containing from key. Please note, keys in AES could be binary. Also note algorithms like 3DES require minimum 24 characters in the key keyFile=soap_key.file keyFile= 4. Generate the keystore. ■ For UnixLinux, run JAVA_EXE -Djava.security.policy=confjmx.policy -classpath CLSPTH com.bharosa.vcrypt.common.util.KeyStoreUtil updateOrCreateKeyStore readFromFile=soap_3des_input.properties ■ For Windows, run genkeystore.cmd soap_3des_input.properties If the KeyStore command was successful, you will see output similar to the following: updateOrCreateKeyStore done Keystore file:system_soap.keystore,algorithm=DESede KeyStore Password=ZG92ZTEyMzQ= Alias Password=ZG92ZTEyMw== 5. Note down the Keystore password and Alias Password print on the screen. You will need to add these to bharosa_server.properties. 6. Save the system_soap.keystore file in your source code control system. Please take adequate security precaution while handling this file. The file contains critical password information. Make sure that only authorized personnel have read access 4-4 Oracle Fusion Middleware Developers Guide for Oracle Adaptive Access Manager to this file. If you lose it, Oracle Adaptive Access Manager will not be able to recover data encrypted. 7. Copy your system_soap.keystore to the following directories: ■ applicationWEB-INFclassesbharosa_properties classpath of the native client deployment ■ OAAM applicationbharosa_properties 8. Delete both the soap_key.file and soap_3des_input.properties files. 9. Add the following properties with the encoded passwords from step 5 and the authentication username to bharosa_server.properties. vcrypt.soap.auth.keystorePassword=base64 encoded keystore password vcrypt.soap.auth.aliasPassword=based64 encoded password to the alias vcrypt.soap.auth.username=user configured for accessing the soap services vcrypt.soap.auth.keystoreFile=system_soap.keystore

4.3.2 Set SOAP Related Properties in bharosa_server.properties

Set the following properties in bharosa_server.properties of the native application: vcrypt.common.util.vcryptsoap.impl.classname=com.bharosa.vcrypt.common.impl.VCrypt SOAPGenericImpl vcrypt.tracker.impl.classname=com.bharosa.vcrypt.tracker.impl.VCryptTrackerSOAPImp l vcrypt.user.image.dirlist.property.name=bharosa.image.dirlist bharosa.config.impl.classname=com.bharosa.common.util.BharosaConfigPropsImpl bharosa.config.load.impl.classname=com.bharosa.common.util.BharosaConfigLoadPropsI mpl vcrypt.tracker.soap.useSOAPServer=true vcrypt.soap.disable=false vcrypt.soap.auth.keystoreFile=system_soap.keystore Environment specific values need to be replaced below this line vcrypt.tracker.soap.url=http:host-name:portoaam_serverservices bharosa.image.dirlist=absolute folder path where OAAM images are available If SOAP Authentication is enabled, then the following have to be set otherwise just set the property vcrypt.soap.auth=false vcrypt.soap.auth=true vcrypt.soap.auth.keystorePassword=Java keystore password vcrypt.soap.auth.aliasPassword=Keystore alias password vcrypt.soap.auth.username=SOAP User name

4.4 About VCryptResponse

VCryptResponse contains information about the status of the processing. It contains useful information if the status of the processing was Success isSuccess. If there were an error, it also contains error codes. It can also contain other payload information in the form of extended data maps. You can use these features of VCryptResponse depending on your requirements for integration.