Challenges of Securing Java Applications

Developing Secure Applications with Oracle Platform Security Services 19-9 Figure 19–5 Storing External Passwords in Credential Store Framework Key features include: ■ Credentials stored securely in a credential store ■ Support for LDAP-based credential stores in addition to Oracle Fusion Middleware’s out-of-the-box, file-based credential store called Oracle wallet. ■ Credentials that can be managed with either Oracle Enterprise Manager Fusion Middleware Control or WLST scripts ■ Credential store operations that can be audited

19.3.5 User and Role

Figure 19–6 illustrates an application deployed on WebLogic that needs searching the identity store for users, such as searching all users in APAC, or identifying all emails with users in a given role. Figure 19–6 Searching the Identity Store with User and Role API Key features include: ■ Calling the User and Role API to access user attributes ■ The same APIs work on user attributes in the default authenticator or an external LDAP store. The User and Role API is automatically configured based on the configuration in the authentication provider, either default or any other LDAP based authentication. ■ Same API regardless of where the attributes are stored

19.3.6 Oracle ADF Authorization

For an example of authorization using Oracle ADF, see Section 19.4.2, How Oracle ADF Uses OPSS . 19-10 Oracle Fusion Middleware Application Security Guide

19.3.7 Java SE Application Using OPSS APIs

Figure 19–7 illustrates a Java SE Swing application using different OPSS APIs. Figure 19–7 Java SE Application using OPSS APIs Key features include: ■ LoginService API for authentication ■ JpsAuth.CheckPermission for authorization ■ User and Role API to query attributes stored in LDAP or other back-end ■ Use of credential store to secure credentials

19.4 Using OPSS with Oracle Application Development Framework

When you use Oracle ADF to develop and deploy applications, you are able to directly leverage the security features of OPSS, since Oracle ADF is integrated with OPSS. This section introduces Oracle ADF and provides an example of OPSS security in an Oracle ADF application.

19.4.1 About Oracle ADF

The Oracle Application Development Framework Oracle ADF is an end-to-end application framework that builds on Java Platform, Enterprise Edition Java EE standards and open-source technologies to simplify and accelerate implementing service-oriented applications. For enterprise solutions that search, display, create, Note: In an LDAP-based store, like that shown in the figure, both policies and credentials are maintained in the same store, while file-based stores maintain separate files for each. Important: The OPSS policy provider must be explicitly set in Java SE applications, as illustrated in the following snippet: java.security.Policy.setPolicynew oracle.security.jps.internal.policystore.JavaProvider Not setting the policy provider explicitly in a Java SE application may cause runtime methods such as JpsAuth.checkPermission to return incorrect values.