Storing Passphrases in the Oracle Credential Store

Passphrases themselves must be placed in the Oracle Credential Store (OCS) to prevent unauthorized access to them.

To do this, follow these steps:

  1. On each host in the Oracle Commerce distributed application, use the Oracle Wallet Manager to create an Oracle Wallet to hold the passphrases that you specify for the truststores and keystores on that host. For information about how to do this, refer to the Oracle documentation.

  2. On each host, run manage_credentials.bat (Windows) or manage_credentials.sh (UNIX) to upload the passphrases for that host to the Oracle Wallet.

Because there is only one truststore and one keystore on each host, manage_credentials must be run only once on each host.

Note

The Oracle Credential Store is shipped with no passphrases or other credentials in it.

The following sections describe the syntax of manage-credentials for adding passphrases to and deleting them from the Oracle Credential Store.

manage_credentials[.bat|.sh] add [--config path_to_jps-config.xml] [--mapName map_name] [--user user_id] [--key key_name] [--type (password|generic)]

where:

add

Required, to identify the operation to be performed.

path_to_jps-config.xml

The path to the Oracle Wallet configuration file jps_config.xml. The default path is ../../server/workspace/credential_store/jps-config.xml

map_name

Specifies the map name under which trustStorePassword and keyStorePassword are pushed into OCS. Omit to accept the required default (endecaToolsAndFrameworks).

user_id

The ID of the user who invokes the manage_credentials script. The default is "admin" . Note that user_id is used only when you specify password for --type.

key_name

Any arbitrary value by which the passphrase can be accessed. If you do not specify a key_name value with the --key option, you are prompted to enter one.

password|generic

Specify generic.

manage_credentials[.bat|.sh] delete [--config <path to jps-config.xml> ] [--mapName map_name] [--key key_name]

where:

delete

Required, to identify the operation to be performed.

path_to_jps-config.xml

The path to the Oracle Wallet configuration file jps_config.xml. The default path is ../../server/workspace/credential_store/jps-config.xml

map_name

Specifies the map name under which trustStorePassword and keyStorePassword were pushed into OCS. Omit to accept the required default (endecaToolsAndFrameworks).

key_name

Required to identify the passphrase to be deleted from the Oracle Credential Store.

If you intend to use the JDBC or ODBC adapter with the Oracle Credential Store, you must edit DataIngest.xml to specify the credentials map, jpsconfig file path and opss directory path.

To do this, modify the following tags under "Forge" component definition in DataIngest.xml:

Example 

 <forge id="Forge" host-id="ITLHost">
		  . . .
		  <credentials-map>mymap</credentials-map>
 		
		  <jps-config-path>C:\ToolsAndFrameworks\11.1.0\server\workspace\credential_store\jps-config.xml</jps-config-path>
 		
		  <opss-jars-dir>C:\PlatformServices\11.1.0\lib\java\opss</opss-jars-dir>
		  . . .
	</forge>

In addition, while configuring ODBC adapter, you need to specify an additional argument tag to place $ENDECA_ROOT\lib\java\adapter.jar in the java classpath.

To do this, add the following elements to the Forge Component definition in DataIngest.xml: 

 <forge id="Forge" host-id="ITLHost"> 
		  . . . 
		 <args> 
		    . . . 
		    <arg>--javaClasspath</arg> 
		    <arg>C:\PlatformServices\11.1.0\lib\java\adapter.jar</arg> 
		    . . . 
		  </args> 
		  ... 
		</forge>

Copyright © Legal Notices