Migrating Large Volume Policy and Credential Stores

7 Configuring the Identity Store Service 7-1 7 Configuring the Identity Store Service This chapter explains how to use the identity store service in OPSS. Topics include: ■ Introduction to the Identity Store Service ■ Configuring the Identity Store Provider ■ Configuring the Identity Store Service ■ Querying the Identity Store Programmatically

7.1 Introduction to the Identity Store Service

This section describes key concepts of the OPSS identity store service: ■ About the Identity Store Service ■ Service Architecture ■ Application Server Support

7.1.1 About the Identity Store Service

The identity store service enables you to query the identity store for user and role group information. By default, a service instance supports querying against a single LDAP identity store. You can configure the service to support a virtualized identity store which queries multiple LDAP identity stores. This feature, known as identity virtualization, is described in Section 7.3, Configuring the Identity Store Service .

7.1.2 Service Architecture

Figure 7–1 shows the architecture of the identity store service. Depending on the configuration, the service can support: ■ one or more LDAP servers ■ an XML file as the identity store. When the service is configured for LDAP, it queries a single LDAP store by default. You can also configure the service to query multiple LDAP stores. 7-2 Oracle Fusion Middleware Application Security Guide Figure 7–1 The OPSS Identity Store Service

7.1.3 Application Server Support

The identity store service supports: ■ Oracle WebLogic Server ■ Third-party application servers The service configuration differs depending on the application server as you need to specify the provider that supports the service.

7.1.4 Java SE Support

The identity store service is available in a stand-alone Java SE environment. For more information, see Section 7.3.5, Java SE Environments .

7.2 Configuring the Identity Store Provider

Before you can make use of the identity store service, you need to configure the identity store provider. OPSS support both XML- and LDAP-based providers. This fragment from the jps-config.xml file shows the configuration of both XML and LDAP providers. The serviceProvider elements are children of the serviceProviders element. serviceProvider type=IDENTITY_STORE name=idstore.ldap.provider class=oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider descriptionLDAP-based IdentityStore Providerdescription serviceProvider serviceProvider type=IDENTITY_STORE name=idstore.xml.provider class=oracle.security.jps.internal.idstore.xml.XmlIdentityStoreProvider descriptionXML-based IdentityStore Providerdescription serviceProvider For details, see Section 8.7.1, Configuring the Identity Store Provider .