Introduction Oracle Fusion Middleware Online Documentation Library

18-8 Oracle Fusion Middleware Application Security Guide For details about integration, see Integrating Authorization . For further information about programmatic authorization, see also Chapter 22, Authentication for Java SE Applicaitons.

18.6.4 User and Role Management

An application integrating with OPSS must use the User and Role API to manage users and external roles programmatically. This API facilitates the use of identity services without the developer having to know low-level details such as the location of a user account or the particular physical implementation of roles. The User and Role API supports the following operations: ■ Create, update, delete, modify, get attributes, and change password on a user profile. ■ Create, update, delete, modify, and get attributes on a role. For details about the User and Role API, see Chapter 25, Developing with the User and Role API.

18.7 Integrating Authentication

This section explains the most important points of the following topics: ■ Container-Based Authentication ■ Oracle WebLogic Server Authentication Providers ■ Programmatic Authentication ■ Single Sign-On through OPSS

18.7.1 Container-Based Authentication

To enable user authentication during the development phase, developers run the ADF security wizard that generates the necessary OPSS configuration and specify authentication methods in the application deployment descriptor web.xml. At run time, the container authenticates the end user of an application in one of the following ways: basic, form, or client cert. In most situations, form-based authentication is the appropriate choice. The container obtains the authentication data such as user name and password from the user, which is processed by the Oracle WebLogic Server to establish a user session. OPSS then queries Oracle WebLogic Server for the authenticated subject when a protected resource is to be accessed.

18.7.2 Oracle WebLogic Server Authentication Providers

OPSS uses authentication providers available in Oracle WebLogic Server. These providers validate user credentials or system processes based on a user name-password combination or a digital certificate. They also make user identity information available through subjects to other components in a domain when needed. Available authentication providers include the Default Authenticator and the external LDAP stores. For details, see section Authentication Providers in Oracle Fusion Middleware Developing Security Providers for Oracle WebLogic Server.