2 Infrastructure Security Custom WLST Commands

2.1.1.1.1 Description

Adds a password credential with the given map, key, user name, and user password to the bootstrap credentials configured in the default JPS context of a JPS configuration file. In the event of an error, the command returns a WLSTException.

2.1.1.1.2 Syntax

addBootStrapCredential(jpsConfigFile, map, key, username, password)

jpsConfigFile  

map 

key 

username 

2.1.1.1.3 Example

The following invocation adds a credential to the bootstrap credential store:

wls:/mydomain/serverConfig> addBootStrapCredential(jpsConfigFile='./jps-config.xml', map='myMapName', key='myKeyName', username='myUser', password='myPassword')

2.1.1.2.1 Description

Adds a resource with specified actions to an entitlement in a specified application stripe. The passed resource type must exist in the passed application stripe.

2.1.1.2.2 Syntax

addResourceToEntitlement(appStripe="appStripeName", name="entName", resourceName="resName",actions="actionList")

appStripe  

name  

resourceName  

resourceType  

actions  

2.1.1.2.3 Example

The following invocation adds the resource myResource to the entitlement myEntitlement in the application stripe myApplication:

wls:/mydomain/serverConfig> addResourceToEntitlement(appStripe="myApplication", 
name="myEntitlement", resourceName="myResource", resourceType="myResType", 
actions="view,edit")

2.1.1.3.1 Description

Creates a new application role in the domain policy store with a given application and role name. In the event of an error, the command returns a WLSTException.

2.1.1.3.2 Syntax

createAppRole(appStripe, appRoleName)

appStripe 

appRoleName 

2.1.1.3.3 Example

The following invocation creates a new application role with application stripe myApp and role name myRole:

wls:/mydomain/serverConfig> createAppRole(appStripe="myApp", appRoleName="myRole")

2.1.1.4.1 Description

Creates a new credential in the domain credential store with a given map name, key name, type, user name and password, URL and port number. In the event of an error, the command returns a WLSTException. This command runs in interactive mode only.

2.1.1.4.2 Syntax

Optional arguments are enclosed in square brackets.

createCred(map, key, user, password, [desc])

map  

key 

user 

password 

desc 

2.1.1.4.3 Example

The following invocation creates a new password credential with the specified data:

wls:/mydomain/serverConfig> createCred(map="myMap, key="myKey", user="myUsr", 
password="myPassw", desc="updated usr name and passw to connect to app xyz")

2.1.1.5.1 Description

Creates a new entitlement with just one resource and a list of actions in a specified application stripe. Use addResourceToEntitlement to add additional resources to an existing entitlement; use revokeResourceFromEntitlement to delete resources from an existing entitlement.

2.1.1.5.2 Syntax

createEntitlement(appStripe="appStripeName", name="entitlementName", resourceName="resName", actions="actionList" [,-displayName="dispName"] [,-description="descript"])

appStripe  

name  

resourceName  

actions  

displayName  

description  

2.1.1.5.3 Example

The following invocation creates the entitlement myEntitlement with just the resource myResource in the stripe myApplication:

wls:/mydomain/serverConfig> createEntitlement(appStripe="myApplication", name="myEntitlement", resourceName="myResource", actions="read,write")

2.1.1.6.1 Description

Creates a resource of a specified type in a specified application stripe. The passed resource type must exist in the passed application stripe.

2.1.1.6.2 Syntax

createResource(appStripe="appStripeName", name="resName", type="resTypeName" [,-displayName="dispName"] [,-description="descript"])

appStripe  

name  

type  

displayName  

description  

2.1.1.6.3 Example

The following invocation creates the resource myResource in the stripe myApplication:

wls:/mydomain/serverConfig> createResource(appStripe="myApplication", name="myResource", type="myResType", displayName="myNewResource")

2.1.1.7.1 Description

Creates a new resource type element in the domain policy store within a given application stripe and with specified name, display name, description, and actions. Optional arguments are enclosed in between square brackets; all other arguments are required. In the event of an error, the command returns a WLSTException.

2.1.1.7.2 Syntax

Optional arguments are enclosed in square brackets.

createResourceType(appStripe, resourceTypeName, displayName, description [, provider] [, matcher], actions [, delimeter])

appStripe  

resourceTypeName 

displayName 

description 

provider 

matchere 

actions 

delimeter 

2.1.1.7.3 Example

The following invocation creates a resource type in the stripe myApplication with actions BWPrint and ColorPrint delimited by a semicolon:

wls:/mydomain/serverConfig> createResourceType(appStripe="myApplication", 
resourceTypeName="resTypeName", displayName="displName", description="A resource
type", provider="Printer", matcher="com.printer.Printer",
actions="BWPrint;ColorPrint" [, delimeter=";"])

2.1.1.8.1 Description

Removes all policies with a given application stripe. In the event of an error, the command returns a WLSTException.

2.1.1.8.2 Syntax

deleteAppPolicies(appStripe)

appStripe 

2.1.1.8.3 Example

The following invocation removes all policies of application myApp:

wls:/mydomain/serverConfig> deleteAppPolicies(appStripe="myApp")

2.1.1.9.1 Description

Removes an application role in the domain policy store with a given application and role name. In the event of an error, the command returns a WLSTException.

2.1.1.9.2 Syntax

createAppRole(appStripe, appRoleName)

appStripe 

appRoleName 

2.1.1.9.3 Example

The following invocation removes the role with application stripe myApp and role name myRole:

wls:/mydomain/serverConfig> deleteAppRole(appStripe="myApp", appRoleName="myRole")

2.1.1.10.1 Description

Deletes an entitlement in a specified application stripe. It performs a cascading deletion by removing all references to the specified entitlement in the application stripe.

2.1.1.10.2 Syntax

deleteEntitlement(appStripe="appStripeName", name="entitlementName")

appStripe  

name  

2.1.1.10.3 Example

The following invocation deletes the entitlement myEntitlement in the stripe myApplication:

wls:/mydomain/serverConfig> deleteEntitlement(appStripe="myApplication", name="myEntitlement")

2.1.1.11.1 Description

Removes a credential with given map name and key name from the domain credential store. In the event of an error, the command returns a WLSTException.

2.1.1.11.2 Syntax

deleteCred(map,key)

map  

key 

2.1.1.11.3 Example

The following invocation removes the credential with map name myMap and key name myKey:

wls:/mydomain/serverConfig> deleteCred(map="myApp",key="myKey")

2.1.1.12.1 Description

Deletes a resource and all its references from entitlements in an application stripe. It performs a cascading deletion: if the entitlement refers to one resource only, it removes the entitlement; otherwise, it removes from the entitlement the resource actions for the passed type.

2.1.1.12.2 Syntax

deleteResource(appStripe="appStripeName", name="resName", type="resTypeName")

appStripe  

name  

type  

2.1.1.12.3 Example

The following invocation deletes the resource myResource in the stripe myApplication:

wls:/mydomain/serverConfig> deleteResource(appStripe="myApplication", name="myResource", type="myResType")

2.1.1.13.1 Description

Removes a <resource-type> entry in the domain policy store within a given application stripe and with specified name. In the event of an error, the command returns a WLSTException.

2.1.1.13.2 Syntax

deleteResourceType(appStripe, resourceTypeName)

appStripe  

resourceTypeName 

2.1.1.13.3 Example

The following invocation removes the resource type myResType from the stripe myApplication:

wls:/mydomain/serverConfig> deleteResourceType(appStripe="myApplication", resourceTypeName="myResType")

2.1.1.14.1 Description

Writes the domain's credential encryption key to the file ewallet.p12. The password passed must be used to import data from that file with the command importEncryptionKey.

2.1.1.14.2 Syntax

exportEncryptionKey(jpsConfigFile, keyFilePath, keyFilePassword)

jpsConfigFile  

keyFilePath 

keyFilePassword 

2.1.1.14.3 Example

The following invocation writes the file ewallet.p12 in the directory myDir:

exportEncryptionKey(jpsConfigFile="pathName", keyFilePath="myDir" ,keyFilePassword="password")

2.1.1.15.1 Description

Returns the name, display name, and all the resources (with their actions) of an entitlement in an application stripe.

2.1.1.15.2 Syntax

getEntitlement(appStripe="appStripeName", name="entitlementName")

appStripe  

name  

2.1.1.15.3 Example

The following invocation returns the information of the entitlement myEntitlement in the stripe myApplication:

wls:/mydomain/serverConfig> getEntitlement(appStripe="myApplication", name="myEntitlement")

2.1.1.16.1 Description

Gets the relevant parameters of a <resource-type> entry in the domain policy store within a given application stripe and with specified name. In the event of an error, the command returns a WLSTException.

2.1.1.16.2 Syntax

getResourceType(appStripe, resourceTypeName)

appStripe  

resourceTypeName 

2.1.1.16.3 Example

The following invocation fetches the resource type myResType from the stripe myApplication:

wls:/mydomain/serverConfig> getResourceType(appStripe="myApplication", resourceTypeName="myResType")

2.1.1.17.1 Description

Adds a principal (class or name) to a role with a given application stripe and name. In the event of an error, the command returns a WLSTException.

2.1.1.17.2 Syntax

grantAppRole(appStripe, appRoleName,principalClass, principalName)

appStripe 

appRoleName 

principalClass 

principalName 

2.1.1.17.3 Example

The following invocation adds a principal to the role with application stripe myApp and role name myRole:

wls:/mydomain/serverConfig> grantAppRole(appStripe="myApp",  
appRoleName="myRole",principalClass="com.example.xyzPrincipal",
principalName="myPrincipal")

2.1.1.18.1 Description

Creates a new entitlement with a specified principal in a specified application stripe.

2.1.1.18.2 Syntax

grantEntitlement(appStripe="appStripeName", principalClass="principalClass", principalName="principalName" ,-permSetName="entName")

appStripe  

principalClass  

principalName  

permSetName  

2.1.1.18.3 Example

The following invocation creates the entitlement myEntitlement in the stripe myApplication:

wls:/mydomain/serverConfig> grantEntitlement(appStripe="myApplication", 
principalClass="oracle.security.jps.service.policystore.ApplicationRole", 
principalName="myPrincipalName", permSetName="myEntitlement")

2.1.1.19.1 Description

Creates a new permission for a given code base or URL. In the event of an error, the command returns a WLSTException.

2.1.1.19.2 Syntax

Optional arguments are enclosed in between square brackets.

grantPermission([appStripe,] [codeBaseURL,] [principalClass,] [principalName,]permClass, [permTarget,] [permActions])

appStripe 

codeBaseURL 

principalClass 

principalName 

permClass 

permTarget 

permActions 

2.1.1.19.3 Examples

The following invocation creates a new application permission (for the application with application stripe myApp) with the specified data:

wls:/mydomain/serverConfig> grantPermission(appStripe="myApp",  
principalClass="my.custom.Principal",  principalName="manager",
permClass="java.security.AllPermission")

The following invocation creates a new system permission with the specified data:

wls:/mydomain/serverConfig> grantPermission(principalClass="my.custom.Principal", principalName="manager",   
permClass="java.io.FilePermission", permTarget="/tmp/fileName.ext", 
permTarget="/tmp/fileName.ext", permActions="read,write")

2.1.1.20.1 Description

Imports encryption keys from the file ewallet.p12 into the domain. The password passed must be the same as that used to create the file with the command exportEncryptionKey.

2.1.1.20.2 Syntax

importEncryptionKey(jpsConfigFile, keyFilePath, keyFilePassword)

jpsConfigFile  

keyFilePath 

keyFilePassword 

2.1.1.20.3 Example

importEncryptionKey(jpsConfigFile="pathName", keyFilePath="dirloc" ,keyFilePassword="password")

2.1.1.21.1 Description

Lists all roles within a given application stripe. In the event of an error, the command returns a WLSTException.

2.1.1.21.2 Syntax

listAppRoles(appStripe)

appStripe 

2.1.1.21.3 Example

The following invocation returns all roles with application stripe myApp:

wls:/mydomain/serverConfig> listAppRoles(appStripe="myApp")

2.1.1.22.1 Description

Lists all members in a role with a given application stripe and role name. In the event of an error, the command returns a WLSTException.

2.1.1.22.2 Syntax

listAppRoleMembers(appStripe, appRoleName)

appStripe 

appRoleName 

2.1.1.22.3 Example

The following invocation returns all members in the role with application stripe myApp and role name myRole:

wls:/mydomain/serverConfig> listAppRoleMembers(appStripe="myApp", appRoleName="myRole")

2.1.1.23.1 Description

This script can be run in offline or online mode. When run in offline mode, a configuration file must be passed, and it lists the application stripes in the policy store referred to by the configuration in the default context of the passed configuration file; the default configuration must not have a service instance reference to an identity store. When run in online mode, a configuration file must not be passed, and it lists stripes in the policy store of the domain to which you connect. In any mode, if a regular expression is passed, it lists the application stripes with names that match the regular expression; otherwise, it lists all application stripes.

2.1.1.23.2 Syntax

listAppStripes([configFile="configFileName"] [, regularExpression="aRegExp"])

configFile  

regularExpression 

2.1.1.23.3 Examples

The following (online) invocation returns the list of application stripes in the policy store:

wls:/mydomain/serverConfig> listAppStripes

The following (offline) invocation returns the list of application stripes in the policy store referenced in the default context of the specified configuration file:

wls:/mydomain/serverConfig> listAppStripes(configFile=" 
/home/myFile/jps-config.xml")

The following (online) invocation returns the list of application stripes that contain the prefix App:

wls:/mydomain/serverConfig> listAppStripes(regularExpression="App*")

2.1.1.24.1 Description

This command allows listing codebase permissions in global policies.

2.1.1.24.2 Syntax

listCodeSourcePermissions([codeBase="codeUrl"])

codeBaseURL

2.1.1.24.3 Examples

The following invocation returns the list permissions assigned to a code source in all global policies:

wls:/mydomain/serverConfig> listCodeSourcePermissions(codeBaseURL="file:/tmp/lib/myJars.jar")

2.1.1.25.1 Description

If a principal name and a class are specified, it lists the entitlements that match the specified principal; otherwise, it lists all the entitlements.

2.1.1.25.2 Syntax

listEntitlement(appStripe="appStripeName" [, principalName="principalName", principalClass="principalClass"])

appStripe  

principalName  

principalClass  

2.1.1.25.3 Example

The following invocation lists all entitlements in the stripe myApplication:

wls:/mydomain/serverConfig> listEntitlement(appStripe="myApplication")

2.1.1.26.1 Description

Lists all the entitlements in an application stripe. If a resource name and a resource type are specified, it lists the entitlements that have a resource of the specified type matching the specified resource name; otherwise, it lists all the entitlements in the application stripe.

2.1.1.26.2 Syntax

listEntitlements(appStripe="appStripeName" [,resourceTypeName="resTypeName", resourceName="resName"])

appStripe  

resourceTypeName  

resourceName  

2.1.1.26.3 Examples

The following invocation lists all the entitlements in the stripe myApplication:

wls:/mydomain/serverConfig> listEntitlements(appStripe="myApplication")

The following invocation lists all the entitlements in the stripe myApplication that contain a resource type myResType and a resource whose name match the resource name myResName:

wls:/mydomain/serverConfig> listEntitlements(appStripe="myApplication", resourceTypeName="myResType", resourceName="myResName") 

2.1.1.27.1 Description

Lists all permissions granted to a given principal. In the event of an error, the command returns a WLSTException.

2.1.1.27.2 Syntax

Optional arguments are enclosed in between square brackets.

listPermissions([appStripe,] principalClass, principalName)

appStripe 

principalClass 

principalName 

2.1.1.27.3 Examples

The following invocation lists all permissions granted to a principal by the policies of application myApp:

wls:/mydomain/serverConfig> listPermissions(appStripe="myApp", principalClass="my.custom.Principal",principalName="manager")
                

The following invocation lists all permissions granted to a principal by system policies:

wls:/mydomain/serverConfig> listPermissions(principalClass="my.custom.Principal", principalName="manager")

2.1.1.28.1 Description

Lists the resources and actions in an entitlement within an application stripe.

2.1.1.28.2 Syntax

listResourceActions(appStripe="appStripeName", permSetName="entitlementName")

appStripe  

permSetName  

2.1.1.28.3 Example

The following invocation lists the resources and actions of the entitlement myEntitlement in the stripe myApplication:

wls:/mydomain/serverConfig> listResourceActions(appStripe="myApplication", permSetName="myEntitlement")

2.1.1.29.1 Description

If a resource type is specified, it lists all the resources of the specified resource type; otherwise, it lists all the resources of all types.

2.1.1.29.2 Syntax

listResources(appStripe="appStripeName" [,type="resTypeName"])

appStripe  

type  

2.1.1.29.3 Example

The following invocation lists all resources of type myResType in the stripe myApplication:

wls:/mydomain/serverConfig> listResources(appStripe="myApplication", type="myResType")

2.1.1.30.1 Description

Lists all the resource types in a specified application stripe.

2.1.1.30.2 Syntax

listResourceTypes(appStripe="appStripeName")

appStripe  

2.1.1.30.3 Example

The following invocation lists all resource types in the stripe myApplication:

wls:/mydomain/serverConfig> listResourceTypes(appStripe="myApplication")

2.1.1.31.1 Description

The script runs in offline mode and outputs the type of the OPSS security store (file, OID, or DB), its location, and the user allowed to access it (typically a security administrator).

2.1.1.31.2 Syntax

listSecurityStoreInfo(domainConfig="configFilePath")

domainConfig  

2.1.1.31.3 Example

The following invocation returns the type, location, and administrative user of the OPSS policy store:

wls:/mydomain/serverConfig> listSecurityStoreInfo(domainConfig="/home/myConfigPathDirectory/config/fmwconfig")

The following lines illustrate a sample output generated by this command:

For jps-config.xml
Store Type: DB_ORACLE
Location/Endpoint: jdbc:oracle:thin:@adc2120515.us.myComp.com:1555/OWSM.US.COM
User: DEV_OPSS
Datasource: jdbc/OpssDataSource
For jps-config-jse.xml
Store Type: DB_ORACLE
Location/Endpoint: jdbc:oracle:thin:@adc2120515.us.myComp.com:1521/OWSM.US.COM
User: DEV_OPSS

2.1.1.32.1 Description

Migrates security artifacts from a source repository to a target repository. For full details, see Migrating with the Script migrateSecurityStore.

2.1.1.33.1 Description

Updates a bootstrap credential store with given user name and password. In the event of an error, the command returns a WLSTException.

Typically used in the following scenario: suppose that the domain policy and credential stores are LDAP-based, and the credentials to access the LDAP store (stored in the LDAP server) are changed. Then this command can be used to seed those changes into the bootstrap credential store.

2.1.1.33.2 Syntax

modifyBootStrapCredential(jpsConfigFile, username, password)

jpsConfigFile  

username

password

2.1.1.33.3 Example

Suppose that in the LDAP store, the password of the user with distinguished name cn=orcladmin has been changed to welcome1, and that the configuration file jps-config.xml is located in the current directory.Then the following invocation changes the password in the bootstrap credential store to welcome1:

wls:/mydomain/serverConfig> modifyBootStrapCredential(jpsConfigFile='./jps-config.xml', username='cn=orcladmin', password='welcome1')

Any output regarding the audit service can be disregarded.

2.1.1.34.1 Description

The script reassociateSecurityStore migrates the OPSS security store from a source to a target LDAP- or DB-based store, and it resets services in the files jps-config.xml and jps-config-jse.xml to the target repository. It also allows specifying that the OPSS security store be shared with that in a different domain (see optional argument join below). The OPSS binaries and the target policy store must have compatible versions.

For complete details and samples see Securing Applications with Oracle Platform Security Services.

2.1.1.35.1 Description

Restores the state of the domain bootstrap keys as it was before running importEncryptionKey.

2.1.1.35.2 Syntax

restoreEncryptionKey(jpsConfigFile)

jpsConfigFile  

2.1.1.35.3 Example

restoreEncryptionKey(jpsConfigFile="pathName")

2.1.1.36.1 Description

Removes a principal (class or name) from a role with a given application stripe and name. In the event of an error, the command returns a WLSTException.

2.1.1.36.2 Syntax

revokeAppRole(appStripe, appRoleName, principalClass, principalName)

appStripe 

appRoleName 

principalClass 

principalName 

2.1.1.36.3 Example

The following invocation removes a principal to the role with application stripe myApp and role name myRole:

wls:/mydomain/serverConfig> revokeAppRole(appStripe="myApp", 
appRoleName="myRole",principalClass="com.example.xyzPrincipal", 
principalName="myPrincipal")

2.1.1.37.1 Description

Deletes an entitlement and revokes the entitlement from the principal in a specified application stripe.

2.1.1.37.2 Syntax

revokeEntitlement(appStripe="appStripeName", principalClass="principalClass", principalName="principalName" ,-permSetName="entName")

appStripe  

principalClass  

principalName  

permSetName  

2.1.1.37.3 Example

The following invocation deleted the entitlement myEntitlement in the stripe myApplication:

wls:/mydomain/serverConfig> revokeEntitlement(appStripe="myApplication", 
principalClass="oracle.security.jps.service.policystore.ApplicationRole", 
principalName="myPrincipalName", permSetName="myEntitlement")

2.1.1.38.1 Description

Removes a permission for a given code base or URL. In the event of an error, the command returns a WLSTException.

2.1.1.38.2 Syntax

Optional arguments are enclosed in between square brackets.

revokePermission([appStripe,] [codeBaseURL,] [principalClass,] [principalName,]permClass, [permTarget,] [permActions])

appStripe 

codeBaseURL 

principalClass 

principalName 

permClass 

permTarget 

permActions 

2.1.1.38.3 Examples

The following invocation removes the application permission (for the application with application stripe myApp) with the specified data:

wls:/mydomain/serverConfig> revokePermission(appStripe="myApp",  
principalClass="my.custom.Principal", principalName="manager", 
permClass="java.security.AllPermission")

The following invocation removes the system permission with the specified data:

wls:/mydomain/serverConfig> revokePermission(principalClass="my.custom.Principal", principalName="manager",  
permClass="java.io.FilePermission", permTarget="/tmp/fileName.ext", 
permActions="read,write")

2.1.1.39.1 Description

Removes a resource from an entitlement in a specified application stripe.

2.1.1.39.2 Syntax

revokeResourceFromEntitlement(appStripe="appStripeName", name="entName", resourceName="resName", resourceType="resTypeName", actions="actionList")

appStripe  

name  

resourceName  

resourceType  

actions  

2.1.1.39.3 Example

The following invocation removes the resource myResource from the entitlement myEntitlement in the stripe myApplication:

wls:/mydomain/serverConfig> revokeResourceFromEntitlement(appStripe="myApplication", name="myEntitlement", 
resourceName="myResource", resourceType="myResType", actions="view,edit")

2.1.1.40.1 Description

This offline script replaces the current domain OPSS encryption key with a new one; the current key is not deleted but archived, since it is used to decrypt data that was encrypted using that key.

Note the following important points:

• This command should be executed from the administration server in the domain. No server restart is needed after its execution.

• If the domain is the only domain accessing the security store, nothing else is required.

• However, if two or more domains share the security store, the newly generated key should be exported from the domain where the script was run and imported into each of the other domains sharing the security store, using the scripts exportEncryptionKey and importEncryptionKey.

2.1.1.40.2 Syntax

rollOVerEncryptionKey(jpsConfigFile="pathName")

2.1.1.40.3 Example

The following invocation lists all resource types in the stripe myApplication:

wls:/mydomain/serverConfig> rollOverEncryptionKey(jpsConfigFile="myConfig")

2.1.1.41.1 Description

Modifies the type, user name, password, URL, and port number of a credential in the domain credential store with given map name and key name. This command can update the data encapsulated in credentials of type password only. In the event of an error, the command returns a WLSTException. This command runs in interactive mode only.

2.1.1.41.2 Syntax

Optional arguments are enclosed in square brackets.

updateCred(map, key, user, password, [desc])

map 

key 

user 

password 

desc 

2.1.1.41.3 Example

The following invocation updates a password credential with the specified data:

wls:/mydomain/serverConfig> updateCred(map="myMap", key="myKey", user="myUsr", 
password="myPassw", desc="updated passw cred to connect to app xyz")

2.1.1.42.1 Description

Updates the trust service domain configuration. In the event of an error, the command returns a WLSTException.

2.1.1.42.2 Syntax

updateTrustServiceConfig([providerName="<the provider name>",] 
                          propsFile="<path of properties file>")

providerName 

propsFile

Here is a sample property file:

trust.keystoreType=KSS
trust.keyStoreName=kss://<stripeName>/<keystoreName>
trust.trustStoreName=kss://<stripeName>/<truststoreName>
trust.aliasName=<aliasName>
trust.issuerName=<aliasName>

Note that the list of specified properties differs according to the value of the property trust.keystoreType. The type can be KSS or JKS; if a property is set to the empty string, then that property is removed from the trust service configuration. For the list of available properties, see section Trust Service Properties.

2.1.1.42.3 Example

The following invocation updates the trust store service with the specifications in the file myProps:

wls:/mydomain/serverConfig> updateTrustServiceConfig(providerName="myProvider", propsFile="myProps")

2.1.2.1.1 Description

This command displays the mbean name for non-Java EE components given the instance name, component name, component type, and the name of the Oracle WebLogic Server on which the component's audit mbean is running. The mbean name is a required parameter to other audit WLST commands when managing a non-Java EE component.

2.1.2.1.2 Syntax

getNonJavaEEAuditMBeanName(instName, compName, compType, svrName)

2.1.2.1.3 Example

The following interactive command displays the mBean name for an Oracle Internet Directory:

wls:/mydomain/serverConfig> getNonJavaEEAuditMBeanName(instName='inst1', compName='oid1', compType='oid', svrName='AdminServer')

2.1.2.2.1 Description

This command displays audit policy settings including the filter preset, special users, custom events, maximum log file size, and maximum log directory size. The component mbean name is required for non-Java EE components like Oracle HTTP Server.

2.1.2.2.2 Syntax

getAuditPolicy([mbeanName, componentType])

2.1.2.2.3 Examples

The following command displays the audit settings for a Java EE component:

wls:/mydomain/serverConfig> getAuditPolicy(componentType='JPS');
Location changed to domainRuntime tree. This is a read-only tree with DomainMBean as the root.
For more help, use help(domainRuntime)
 
FilterPreset:All
Max Log File Size:104857600

The following command displays the audit settings for MBean CSAuditProxyMBean:

wls:/mydomain/serverConfig> getAuditPolicy(on='oracle.security.audit.test:type=CSAuditMBean,
name=CSAuditProxyMBean')

2.1.2.3.1 Description

Online command that configures the audit policy settings. You can set the filter preset, add or remove users, and add or remove custom events. The component mbean name is required for non-Java EE components like Oracle HTTP Server.

2.1.2.3.2 Syntax

setAuditPolicy([mbeanName],[filterPreset],[addSpecialUsers],
[removeSpecialUsers],[addCustomEvents],[removeCustomEvents], [componentType], [maxFileSize], [andCriteria], [orCriteria], [componentEventsFile])

2.1.2.3.3 Examples

The following interactive command sets audit policy to None level, and adds users user2 and user3 while removing user1 from the policy:

wls:/mydomain/serverConfig> setAuditPolicy (filterPreset=
'None',addSpecialUsers='user2,user3',removeSpecialUsers='user1',componentType='JPS')

wls:/mydomain/serverConfig> getAuditPolicy(componentType='JPS');
Already in Domain Runtime Tree

FilterPreset:None
Special Users:user2,user3
Max Log File Size:104857600

The following interactive command adds login events while removing logout events from the policy:

wls:/mydomain/serverConfig> setAuditPolicy(filterPreset=
'Custom',addCustomEvents='UserLogin',removeCustomEvents='UserLogout')
 

The following interactive command sets audit policy to a Low level:

wls:/IDMDomain/domainRuntime> setAuditPolicy(filterPreset='Low',componentType='JPS);
Already in Domain Runtime Tree
Audit Policy Information updated successfully

wls:/IDMDomain/domainRuntime> getAuditPolicy(componentType='JPS')
Already in Domain Runtime Tree
FilterPreset:Low
Max Log File Size:104857600

The following command sets a custom filter to audit the CheckAuthorization event:

wls:/IDMDomain/domainRuntime>setAuditPolicy(filterPreset='Custom',
componentType='JPS',addCustomEvents='Authorization:CheckPermission,
CheckSubject;CredentialManagement:CreateCredential,DeleteCredential');
Already in Domain Runtime Tree
 
Audit Policy Information updated successfully
wls:/IDMDomain/domainRuntime> getAuditPolicy(componentType='JPS');
Already in Domain Runtime Tree
 
FilterPreset:Custom
Special Users:user1
Max Log File Size:104857600
Custom Events:JPS:CheckAuthorization

2.1.2.4.1 Description

This command displays audit repository settings for Java EE components and applications (for other components like Oracle Internet Directory, the repository configuration resides in opmn.xml). Also displays database configuration if the repository is a database type.

2.1.2.4.2 Syntax

getAuditRepository 

2.1.2.4.3 Example

The following command displays audit repository configuration:

wls:/IDMDomain/domainRuntime> getAuditRepository()
Already in Domain Runtime Tree
 
Repository Type:File

2.1.2.5.1 Description

This command sets the audit repository settings for Java EE components and applications (for other components like Oracle Internet Directory, the repository is configured by editing opmn.xml).

2.1.2.5.2 Syntax

setAuditRepository([switchToDB],[dataSourceName],[interval])

2.1.2.5.3 Examples

The following command switches from a file repository to a database repository:

wls:/IDMDomain/domainRuntime> setAuditRepository(switchToDB='true');
Already in Domain Runtime Tree
 
Audit Repository Information updated
 
wls:/IDMDomain/domainRuntime> getAuditRepository();
Already in Domain Runtime Tree
 
JNDI Name:jdbc/AuditDB
Interval:15
Repository Type:DB

The following interactive command changes audit repository to a specific database and sets the audit loader interval to 14 seconds:

wls:/mydomain/serverConfig> setAuditRepository(switchToDB='true',dataSourceName='jdbc/AuditDB',interval='14')

2.1.2.6.1 Description

This command displays a component's audit events and attributes. For non-Java EE components, pass the component mbean name as a parameter. Java EE applications and services like Oracle Platform Security Services (OPSS) do not need the mbean parameter. Without a component type, all generic attributes applicable to all components are displayed.

2.1.2.6.2 Syntax

listAuditEvents([mbeanName],[componentType])

2.1.2.6.3 Examples

The following command displays audit events for the Oracle Platform Security Services component:

wls:/IDMDomain/domainRuntime> listAuditEvents(componentType='JPS');
Already in Domain Runtime Tree
 
Common Attributes
ComponentType
Type of the component. For MAS integrated SystemComponents this is the componentType
InstanceId
Name of the MAS Instance, that this component belongs to
HostId
DNS hostname of originating host
HostNwaddr
IP or other network address of originating host
ModuleId
ID of the module that originated the message. Interpretation is unique within Component ID.
ProcessId
ID of the process that originated the message

The following command displays audit events for Oracle HTTP Server:

wls:/mydomain/serverConfig> listAuditEvents(componentType='ohs')

The following command displays all audit events:

wls:/IDMDomain/domainRuntime> listAuditEvents();
Already in Domain Runtime Tree
 
Components:
DIP
JPS
OIF
OWSM-AGENT
OWSM-PM-EJB
ReportsServer
WS-PolicyAttachment
WebCache
WebServices
Attributes applicable to all components:
ComponentType
InstanceId
HostId
HostNwaddr
ModuleId
ProcessId
OracleHome
HomeInstance
ECID
RID
...

2.1.2.7.1 Description

This command exports the audit configuration to a file. For non-Java EE components, pass the component mbean name as a parameter. Java EE applications and services like Oracle Platform Security Services (OPSS) do not need the mbean parameter.

2.1.2.7.2 Syntax

exportAuditConfig([mbeanName],fileName, [componentType])

2.1.2.7.3 Examples

The following interactive command exports the audit configuration for a component:

wls:/mydomain/serverConfig> exportAuditConfig(on='oracle.security.audit.test:type=CSAuditMBean,
name=CSAuditProxyMBean',fileName='/tmp/auditconfig')

The following interactive command exports the audit configuration for a Java EE component; no mBean is specified:

wls:/mydomain/serverConfig> exportAuditConfig(fileName='/tmp/auditconfig')

2.1.2.8.1 Description

This command imports the audit configuration from an external file. For non-Java EE components, pass the component mbean name as a parameter. Java EE applications and services like Oracle Platform Security Services (OPSS) do not need the mbean parameter.

2.1.2.8.2 Syntax

importAuditConfig([mbeanName],fileName, [componentType])

2.1.2.8.3 Examples

The following interactive command imports the audit configuration for a component:

wls:/mydomain/serverConfig> importAuditConfig(on='oracle.security.audit.test:type=CSAuditMBean,
name='CSAuditProxyMBean',fileName='/tmp/auditconfig')

The following interactive command imports the audit configuration from a file; no mBean is specified:

wls:/mydomain/serverConfig> importAuditConfig(fileName='/tmp/auditconfig')

2.1.2.9.1 Description

This command generates a SQL script that you can use to create a database view of the audit definitions of a specified component. The script is written to the specified file and also printed out to the console.

Upon execution, the result of the SQL script depends on the audit model at your site:

• If using the 11.1.1.6.0 model, and the component is registered in the audit store, the script creates a view using the system component tables (IAU_COMMON, IAU_USERSESSION, IAU_AUDITSERVICE and IAU_CUSTOM) for the specified component.

• If using the pre-11.1.1.6.0 model, the component is not registered in the audit store but its event definitions reside in the component_events.xml file (in the oracle_common/modules/oracle.iau_11.1.1/components/componentType dir), and the view is created using the IAU_BASE and component tables.

2.1.2.9.2 Syntax

createAuditDBView(fileName, componentType)

2.1.2.9.3 Example

wls:/mydomain/serverConfig> 
createAuditDBView(fileName="/tmp/JPSAuditView.sql", componentType="JPS")

2.1.2.10.1 Description

This command creates a list of the components that can be audited. It lists components registered in the audit store using both the 11.1.1.6.0 model and the pre-11.1.1.6.0 model.

2.1.2.10.2 Syntax

listAuditComponents(fileName)

2.1.2.10.3 Example

listAuditComponents(fileName = "/tmp/complist.txt")

2.1.2.11.1 Description

Adds the event definition and translation content for a specified component to the audit store. If you try to register using the pre-11.1.1.6.0 audit XML schema definition, it is upgraded to the 11.1.1.6.0 XML schema definition and then registered with the audit store.

2.1.2.11.2 Syntax

registerAudit(xmlFile, [xlfFile], componentType, [mode=OVERWRITE|UPGRADE])

2.1.2.11.3 Example

wls:/mydomain/serverConfig>registerAudit(xmlFile="/tmp/comp.xml", 
xmlFile="/tmp/comp_xlf.jar", componentType="AuditApp", mode="UPGRADE")

2.1.2.12.1 Description

Removes an existing event definition and translation content for a specified component or application from the audit store.

2.1.2.12.2 Syntax

deregisterAudit(componentType)

2.1.2.12.3 Example

deregisterAudit(componentType="AuditApp")

2.1.3.1.1 Description

Changes the password for a key.

2.1.3.1.2 Syntax

changeKeyPassword(appStripe='stripe', name='keystore', password='password', 
alias='alias', currentkeypassword='currentkeypassword', 
newkeypassword='newkeypassword')

svc

appStripe

name

password

alias

currentkeypassword

newkeypassword

2.1.3.1.3 Example

This example changes the password on the key entry orakey:

changeKeyPassword(appStripe='system', name='keystore', password='password', 
alias='orakey', currentkeypassword='currentkeypassword', 
newkeypassword='newkeypassword')

2.1.3.2.1 Description

Changes the password of the specified keystore.

2.1.3.2.2 Syntax

changeKeyStorePassword(appStripe='stripe', name='keystore', currentpassword='currentpassword', newpassword='newpassword')

svc

appStripe

name

currentpassword

newpassword

2.1.3.2.3 Example

This example changes the password for keystore2.

changeKeyStorePassword(appStripe='system', name='keystore2', 
currentpassword='currentpassword', newpassword='newpassword')

2.1.3.3.1 Description

Creates a new keystore on the given application stripe.

2.1.3.3.2 Syntax

createKeyStore(appStripe='stripe', name='keystore', password='password',permission=true|false)

svc

appStripe

name

password

permission

2.1.3.3.3 Example

This example creates a keystore named keystore1.

createKeyStore(appStripe='system', name='keystore1', password='password', permission=true)

2.1.3.4.1 Description

This keystore service command deletes a specified keystore.

2.1.3.4.2 Syntax

deleteKeyStore(appStripe='stripe', name='keystore', password='password')

svc

appStripe

name

password

2.1.3.4.3 Example

This example deletes the keystore named keystore1.

deleteKeyStore(appStripe='system', name='keystore1', password='password')

2.1.3.5.1 Description

This command deletes the specified entry in a keystore.

2.1.3.5.2 Syntax

deleteKeyStoreEntry(appStripe='stripe', name='keystore', 
password='password', alias='alias', keypassword='keypassword')

svc

appStripe

name

password

alias

keypassword

2.1.3.5.3 Example

This example deletes a keystore entry denoted by alias orakey.

deleteKeyStoreEntry(appStripe='system', name='keystore2', password='password', alias='orakey', keypassword='keypassword')

2.1.3.6.1 Description

Exports a keystore to the specified file.

2.1.3.6.2 Syntax

exportKeyStore(appStripe='stripe', name='keystore', password='password', aliases='comma-separated-aliases', keypasswords='comma-separated-keypasswords', 
type='keystore-type', filepath='absolute_file_path')

svc

appStripe

name

password

aliases

keypasswords

type

filepath

2.1.3.6.3 Example

This example exports two aliases from the specified keystore.

exportKeyStore(appStripe='system', name='keystore2', 
password='password',aliases='orakey,seckey', 
keypasswords='keypassword1,keypassword2', 
type='JKS',filepath='/tmp/file.jks')

This example exports a keystore to create an Oracle Wallet file:

exportKeyStore(appStripe='system', name='keystore2', 
password='mypassword',aliases='orakey,seckey', 
keypasswords='', type='OracleWallet',filepath='/tmp')

2.1.3.7.1 Description

Exports a certificate, trusted certificate or certificate chain.

2.1.3.7.2 Syntax

exportKeyStoreCertificate(appStripe='stripe', name='keystore', 
password='password', alias='alias', keypassword='keypassword', 
type='entrytype',filepath='absolute_file_path')

svc

appStripe

name

password

alias

keypassword

type

filepath

2.1.3.7.3 Example

This example exports a certificate corresponding to the orakey alias:

exportKeyStoreCertificate(appStripe='system', name='keystore2', 
password='password', alias='orakey', keypassword='keypassword', 
type='Certificate', filepath='/tmp/cert.txt')

2.1.3.8.1 Description

Generates and exports a certificate request from a keystore.

2.1.3.8.2 Syntax

exportKeyStoreCertificateRequest(appStripe='stripe', name='keystore', 
password='password', alias='alias', keypassword='keypassword', 
filepath='absolute_file_path')

svc

appStripe

name

password

alias

keypassword

filepath

2.1.3.8.3 Example

This example exports a certificate request corresponding to the orakey alias.

exportKeyStoreCertificateRequest(appStripe='system', name='keystore2', 
password='password', alias='orakey', keypassword='keypassword', 
filepath='/tmp/certreq.txt')

2.1.3.9.1 Description

Generates a key pair in a keystore and wraps it in a demo CA-signed certificate.

2.1.3.9.2 Syntax

generateKeyPair(appStripe='stripe', name='keystore', password='password', 
dn='distinguishedname', keysize='keysize', alias='alias', 
keypassword='keypassword')

svc

appStripe

name

password

dn

keysize

alias

keypassword

2.1.3.9.3 Example

This example generates a keypair in keystore2.

generateKeyPair(appStripe='system', name='keystore2', password='password', dn='cn=www.oracle.com', keysize='1024', alias='orakey', keypassword='keypassword')

2.1.3.10.1 Description

Generates a symmetric key in a keystore.

2.1.3.10.2 Syntax

generateSecretKey(appStripe='stripe', name='keystore', password='password', 
algorithm='algorithm', keysize='keysize', alias='alias', 
keypassword='keypassword')

svc

appStripe

name

password

algorithm

keysize

alias

keypassword

2.1.3.10.3 Example

This example generates a keypair with keysize 128 in keystore2.

generateSecretKey(appStripe='system', name='keystore2', password='password', 
algorithm='AES', keysize='128', alias='seckey', keypassword='keypassword')

2.1.3.11.1 Description

Retrieves information about a certificate or trusted certificate.

2.1.3.11.2 Syntax

getKeyStoreCertificates(appStripe='stripe', name='keystore', 
password='password', alias='alias', keypassword='keypassword')

svc

appStripe

name

password

alias

keypassword

2.1.3.11.3 Example

This example gets certificates associated with keystore3.

getKeyStoreCertificates(appStripe='system', name='keystore3', password='password', alias='orakey', keypassword='keypassword')

2.1.3.12.1 Description

Retrieves secret key properties like the algorithm.

2.1.3.12.2 Syntax

getKeyStoreSecretKeyProperties(appStripe='stripe', name='keystore', 
password='password', alias='alias', keypassword='keypassword')

svc

appStripe

name

password

alias

keypassword

2.1.3.12.3 Example

This example gets properties for secret key seckey:

getKeyStoreSecretKeyProperties(appStripe='system', name='keystore3', 
password='password', alias='seckey', keypassword='keypassword')

2.1.3.13.1 Description

Imports a keystore from a system file.

2.1.3.13.2 Syntax

importKeyStore(appStripe='stripe', name='keystore', password='password', aliases='comma-separated-aliases', keypasswords='comma-separated-keypasswords', 
type='keystore-type', permission=true|false, filepath='absolute_file_path')

svc

appStripe

name

password

aliases  

keypasswords  

type  

filepath 

permission 

2.1.3.13.3 Example

This example imports a JKS keystore file to keystore2:

importKeyStore(appStripe='system', name='keystore2', 
password='password',aliases='orakey,seckey', keypasswords='keypassword1, 
keypassword2', type='JKS', permission=true, filepath='/tmp/file.jks')

This example imports an Oracle Wallet to keystore2:

importKeyStore(appStripe='system', name='keystore2', 
password='mypassword',aliases='orakey,seckey', keypasswords='', type='OracleWallet', permission=true, filepath='/tmp')

2.1.3.14.1 Description

Imports a certificate, trusted certificate or certificate chain.

2.1.3.14.2 Syntax

importKeyStoreCertificate(appStripe='stripe', name='keystore', 
password='password', alias='alias', keypassword='keypassword', 
type='entrytype',filepath='absolute_file_path')

svc

appStripe

name

password

alias  

keypassword  

type  

filepath  

2.1.3.14.3 Example

This example imports a certificate into keystore2.

importKeyStoreCertificate(appStripe='system', name='keystore2', 
password='password', alias='orakey', keypassword='keypassword', 
type='Certificate', filepath='/tmp/cert.txt')

2.1.3.15.1 Description

Lists expiring certificates and optionally renews them.

2.1.3.15.2 Syntax

listExpiringCertificates(days='days', autorenew=true|false)

svc

days  

autorenew  

2.1.3.15.3 Example

This example lists certificates expiring within one year, and requests that they be renewed:

listExpiringCertificates(days='365', autorenew=true)

2.1.3.16.1 Description

Lists the aliases in a keystore for a given type of entry.

2.1.3.16.2 Syntax

The syntax is as follows:

listKeyStoreAliases(appStripe='stripe', name='keystore', 
password='password', type='entrytype')

svc

appStripe

name

password

type

2.1.3.16.3 Example

This example lists secret keys in keystore2:

listKeyStoreAliases(appStripe='system', name='keystore2', 
password='password', type='SecretKey')

2.1.3.17.1 Description

Lists all the keystores in the specified stripe.

2.1.3.17.2 Syntax

listKeyStores(appStripe='stripe')

svc

appStripe

2.1.3.17.3 Example

This example lists all keystores on all stripes.

listKeyStores(appStripe='*')

2.1.3.18.1 Description

Synchronizes keystores in the central security store with those present in the domain directory.

If the target format is Oracle Wallet, the command synchronizes the contents of all KSS keystores for a given stripe into auto-login wallets on the server.

2.1.3.18.2 Syntax

The syntax is as follows:

syncKeyStores(stripeName='component-type#component-name', keystoreFormat='exported_file_format', 
rootDirectory='root_dir_absolute_path') 

StripeName

keystoreFormat

rootDirectory

2.1.3.18.3 Example

The following command looks up the central repository for the "system" stripe and downloads its contents into the keystores.xml file under the DOMAIN_HOME/config/fmwconfig directory. It also downloads the contents of the domain trust store into the same file:

syncKeyStores()
 

The following command generates Oracle Wallets corresponding to all keystores in the stripe 'ohs#ohs1':

syncKeyStores(stripeName=”ohs#ohs1”, 
keystoreFormat=”OracleWallet”, rootDirectory=”/tmp/bin”)

2.1.4.1.1 Description

Reloads the Identity Directory Service configuration.

2.1.4.1.2 Syntax

activateIDSConfigChanges()

This command has no arguments.

2.1.4.1.3 Example

activateIDSConfigChanges()

2.1.4.2.1 Description

Adds a new attribute to the entity configuration.

2.1.4.2.2 Syntax

addAttributeInEntityConfig(name, datatype, description, readOnly, pwdAttr, appName)

2.1.4.2.3 Example

addAttributeInEntityConfig('commonname','string','common name',false,false,'userrole')

2.1.4.3.1 Description

Adds new properties for an attribute in an entity configuration.

2.1.4.3.2 Syntax

addAttributePropsInEntityConfig(name, propNames, propVals, appName)

2.1.4.3.3 Example

addAttributePropsInEntityConfig('orgunit','labelname|multivalued','common name|true','userrole')

2.1.4.4.1 Description

Adds a new attribute to the specified entity.

2.1.4.4.2 Syntax

addAttributeRefForEntity(name, attrRefName, attrRefFilter, attrRefDefaultFetch, appName)

2.1.4.4.3 Example

addAttributeRefForEntity('User','givenname','none','true','userrole')

2.1.4.5.1 Description

Adds new properties for an attribute reference in an entity configuration.

2.1.4.5.2 Syntax

addAttrrefPropsInEntityConfig(entityName, attrName, propNames, propVals, appName)

2.1.4.5.3 Example

addAttrrefPropsInEntityConfig('org', 'orgunit','labelname|multivalued','common name|true','userrole')

2.1.4.6.1 Description

Adds a new property for a specified operation configuration.

2.1.4.6.2 Syntax

addCommonPropertyForOperationConfig(entityName, propName, propValue, appName)

2.1.4.6.3 Example

addCommonPropertyForOperationConfig('groupmember.attr', 'member', 'userrole')

2.1.4.7.1 Description

Adds a new entity to the entity configuration.

2.1.4.7.2 Syntax

addEntity(name, type, idAttr, create, modify, delete, search, attrRefNames, attrRefFilters, attrRefDefaultFetches, appName)

2.1.4.7.3 Example

addEntity('Group','group','commonname',true,true,true,true,'name|commonname','none|none','true|false','userrole')

2.1.4.8.1 Description

Adds new properties for an entity in an entity configuration.

2.1.4.8.2 Syntax

addEntityProps(name, propNames, propVals, appName)

2.1.4.8.3 Example

addEntityProps('User','inclobjclasses|exclobjclasses','inetorgperson|orclidxperson','userrole')

2.1.4.9.1 Description

Add a new entity relation to the entity configuration.

2.1.4.9.2 Syntax

addEntityRelation(name, type, fromEntity, fromAttr, toEntity, toAttr, recursive, appName)

2.1.4.9.3 Example

addEntityRelation('manager', 'ManyToOne', 'User', 'manager', 'User', 'principal', false, 'userrole')

2.1.4.10.1 Description

Adds a new IdentityStoreService to the Identity Directory Service configuration.

2.1.4.10.2 Syntax

addIdentityDirectoryService(name, description, propNames, propValues)

2.1.4.10.3 Example

addIdentityDirectoryService('userrole', 'user role', 'ovd.context|entity.config', 'default|userrole')

2.1.4.11.1 Description

Adds a new operation configuration to the entity configuration.

2.1.4.11.2 Syntax

addOperationConfig(entityName, propNames, propValues, appName)

2.1.4.11.3 Example

addOperationConfig('User', 'entity.searchbase', 'cn=users,dc=oracle,dc=com', 'userrole')

2.1.4.12.1 Description

Adds a new property to a specified operation configuration.

2.1.4.12.2 Syntax

addPropertyForOperationConfig(entityName, propName, propValue, appName)

2.1.4.12.3 Example

addPropertyForOperationConfig('User','entity.searchbase', 'cn=users,dc=oracle,dc=com', 'userrole')

2.1.4.13.1 Description

Deletes an attribute from an entity configuration.

2.1.4.13.2 Syntax

deleteAttributeInEntityConfig(name, appName)

2.1.4.13.3 Example

deleteAttributeInEntityConfig('commonname', 'userrole')

2.1.4.14.1 Description

Deletes attribute properties in an entity configuration.

2.1.4.14.2 Syntax

deleteAttributePropsInEntityConfig(name, propNames, appName)

2.1.4.14.3 Example

deleteAttributePropsInEntityConfig('orgunit','labelname|multivalued','userrole')

2.1.4.15.1 Description

Deletes attribute reference properties in an entity configuration.

2.1.4.15.2 Syntax

deleteAttrrefPropsInEntityConfig(entityName, attrName, propNames, appName)

2.1.4.15.3 Example

deleteAttrrefPropsInEntityConfig('org', 'orgunit','labelname|multivalued','userrole')

2.1.4.16.1 Description

Deletes an entity from an entity configuration.

2.1.4.16.2 Syntax

deleteEntity(name, appName)

2.1.4.16.3 Example

deleteEntity('User', 'userrole')

2.1.4.17.1 Description

Deletes entity properties in an entity configuration.

2.1.4.17.2 Syntax

deleteEntityProps(name, propNames, appName)

2.1.4.17.3 Example

deleteEntityProps('User','inclobjclasses|exclobjclasses','userrole')

2.1.4.18.1 Description

Deletes the specified entity relation.

2.1.4.18.2 Syntax

deleteEntityRelation(name, appName)

2.1.4.18.3 Example

deleteEntityRelation('manager', 'userrole')

2.1.4.19.1 Description

Deletes the specified IdentityStoreService in the Identity Directory Service configuration.

2.1.4.19.2 Syntax

deleteIdentityDirectoryService(name)

where name is the name of the IdentityStoreService configuration to be deleted.

2.1.4.19.3 Example

deleteIdentityDirectoryService('ids1')

2.1.4.20.1 Description

Deletes an operation configuration in an entity configuration.

2.1.4.20.2 Syntax

deleteOperationConfig(entityName, appName)

2.1.4.20.3 Example

deleteOperationConfig('User','userrole')

2.1.4.21.1 Description

Lists all attributes in the entity configuration.

2.1.4.21.2 Syntax

listAllAttributeInEntityConfig(appName)

where appName is the name of the Identity Directory Service that contains the entity configuration from which the list of attributes is retrieved.

2.1.4.21.3 Example

listAllAttributeInEntityConfig('userrole')

2.1.4.22.1 Description

Lists all entities defined in the specified entity configuration.

2.1.4.22.2 Syntax

listAllEntityInEntityConfig(appName)

where appName is the name of the Identity Directory Service that contains the entity configuration from which the list of entities is retrieved.

2.1.4.22.3 Example

listAllEntityInEntityConfig('userrole')

2.1.4.23.1 Description

Lists all IdentityStoreService in Identity Directory Service configuration.

2.1.4.23.2 Syntax

listAllIdentityDirectoryService()

This command has no arguments.

2.1.4.23.3 Example

listAllIdentityDirectoryService()

2.1.4.24.1 Description

Removes an attribute from the specified entity.

2.1.4.24.2 Syntax

removeAttributeRefForEntity(name, attrRefName, appName)

2.1.4.24.3 Example

removeAttributeRefForEntity('User','givenname','userrole')

2.1.4.25.1 Description

Removes a property for the specified operation configuration.

2.1.4.25.2 Syntax

removeCommonPropertyForOperationConfig(entityName, propName, appName)

2.1.4.25.3 Example

removeCommonPropertyForOperationConfig('groupmember.attr','userrole')

2.1.4.26.1 Description

Removes a property for the specified operation configuration.

2.1.4.26.2 Syntax

removePropertyForOperationConfig(entityName, propName, appName)

2.1.4.26.3 Example

removePropertyForOperationConfig('User','entity.searchbase','userrole')

2.1.4.27.1 Description

Updates attributes in an entity configuration.

2.1.4.27.2 Syntax

updateAttributeInEntityConfig(name, attrNames, attrVals, appName)

2.1.4.27.3 Example

updateAttributeInEntityConfig('commonname','readOnly|pwdAttr|attrInUse','true|false|false','userrole')

2.1.4.28.1 Description

Updates attribute properties in an entity configuration.

2.1.4.28.2 Syntax

updateAttributePropsInEntityConfig(name, propNames, propVals, appName)

2.1.4.28.3 Example

updateAttributePropsInEntityConfig('orgunit','multivalued','multivalued','userrole')

2.1.4.29.1 Description

Updates attribute reference properties in an entity configuration.

2.1.4.29.2 Syntax

updateAttrrefPropsInEntityConfig(entityName, attrName, propNames, propVals, appName)

2.1.4.29.3 Example

updateAttrrefPropsInEntityConfig('org', 'orgunit','multivalued','multivalued','userrole')

2.1.4.30.1 Description

Updates an entity's properties in an entity configuration.

2.1.4.30.2 Syntax

updateEntity(name, type, idAttr, create, modify, delete, search, appName)

2.1.4.30.3 Example

updateEntity('Group','group','commonname',true,true,true,true,'userrole')

2.1.4.31.1 Description

Updates the configuration attributes for an entity attribute.

2.1.4.31.2 Syntax

updateEntityAttrs(name, attrNames, attrVals, appName)

2.1.4.31.3 Example

updateEntityAttrs('User','idAttr|firstnameAttr','uid|givenname','userrole')

2.1.4.32.1 Description

Updates the entity properties in an entity configuration.

2.1.4.32.2 Syntax

updateEntityProps(name, propNames, propVals, appName)

2.1.4.32.3 Example

updateEntityProps('User','inclobjclasses|exclobjclasses','inetorgperson|orclidxperson','userrole')

2.1.5.1.1 Description

Adds an attribute to the DN Attributes List for an existing adapter configured for the libOVD configuration associated with an OPSS context.

2.1.5.1.2 Syntax

addDNAttribute(adapterName, attributeName, [contextName])

2.1.5.1.3 Example

addDNAttribute(adapterName='ldap1', attributeName='memberof', contextName='default')

2.1.5.2.1 Description

Reloads the libOVD configuration associated with a specific OPSS context.

2.1.5.2.2 Syntax

activateLibOVDConfigChanges([contextName])

2.1.5.2.3 Example

activateLibOVDConfigChanges('default')

2.1.5.3.1 Description

Adds an attribute exclusion rule to the exclusion list.

2.1.5.3.2 Syntax

addAttributeExclusionRule(attribute, mappingContextId, [contextName])

2.1.5.3.3 Example

addAttributeExclusionRule('objectsid')

2.1.5.4.1 Description

Adds a new attribute mapping rule to the libOVD configuration associated with a specific OPSS context..

2.1.5.4.2 Syntax

addAttributeRule(srcAttrs, srcObjectClass, srcAttrType, dstAttr, dstObjectClass, dstAttrType, mappingExpression, direction, mappingContextId, [contextName])

2.1.5.4.3 Example

addAttributeRule('lastname','','','sn','','','','Inbound')

2.1.5.5.1 Description

Adds a domain exclusion rule to the exclusion list.

2.1.5.5.2 Syntax

addDomainExclusionRule(domain, mappingContextId, [contextName])

2.1.5.5.3 Example

addDomainExclusionRule('cn=group,dc=oracle,dc=com')

2.1.5.6.1 Description

Adds a new domain mapping rule.

2.1.5.6.2 Syntax

addDoma]inRule(srcDomain, destDomain, domainConstructRule, mappingContextId, [contextName])

2.1.5.6.3 Example

addDomainRule('dc=oracle,dc=com', 'dc=oracle,dc=com', '', 'defaultContext', 'default')

2.1.5.7.1 Description

Adds a join rule to an existing Join Adapter for the libOVD configuration associated with the specified OPSS context.

2.1.5.7.2 Syntax

addJoinRule(adapterName, secondary, condition, [joinerType], [contextName])

2.1.5.7.3 Examples

addJoinRule('join1','secondaryldap','cn=cn', 'Simple', 'default')

addJoinRule('join1','secondaryldap','cn=cn', 'Conditional', 'default')

addJoinRule(adapterName='join1', secondary='LDAP3', condition='uid=cn', JoinerType='OneToMany')

addJoinRule(adapterName='join1', secondary='LDAP2',condition='uid=cn', contextName='myContext')

2.1.5.8.1 Description

Adds a new remote host (host and port) to an existing LDAP adapter. By default, the new host is configured in Read-Write mode with percentage set to 100.

2.1.5.8.2 Syntax

addLDAPHost(adapterName, host, port, [contextName])

2.1.5.8.3 Examples

addLDAPHost(adapterName='ldap1', host='myhost.example.com', port=389)

addLDAPHost('ldap1', 'myhost.example.com','389', 'myContext')

2.1.5.9.1 Description

Creates a new mapping context for the libOVD configuration associated with the specified OPSS context.

2.1.5.9.2 Syntax

addMappingContext(mappingContextId, [contextName])

2.1.5.9.3 Example

addMappingContext('defaultContext','context')

2.1.5.10.1 Description

Adds a plug-in to an existing adapter or at the global level. The "i"th key corresponds to "i"th value. The plug-in is added to default chain.

2.1.5.10.2 Syntax

addPlugin(pluginName, pluginClass, paramKeys, paramValues, [adapterName], [contextName])

2.1.5.10.3 Examples

addPlugin(adapterName='ldap1', pluginName='VirtualAttr',pluginClass='oracle.ods.virtualization.engine.chain.plugins.virtualattr.VirtualAttributePlugin', paramKeys='AddAttribute | MatchFilter | ContainerDN', paramValues='cn=%uid% | objectclass=person | dc=oracle,dc=com')

addPlugin(pluginName='VirtualAttr',pluginClass='oracle.ods.virtualization.engine.chain.plugins.virtualattr.VirtualAttributePlugin', paramKeys='AddAttribute | MatchFilter | ContainerDN', paramValues='cn=%uid% | objectclass=person | dc=oracle,dc=com') 

addPlugin(pluginName='DMSMetrics',pluginClass='oracle.ods.virtualization.engine.chain.plugins.DMSMetrics.MonitorPerformance', paramKeys='None',paramValues='None',adapterName='ldap1',contextName='default')

2.1.5.11.1 Description

Adds new parameter values to the existing adapter level plug-in or the global plug-in. If the parameter already exists, the new value is added to the existing set of values. The "i"th key corresponds to "i"th value.

2.1.5.11.2 Syntax

addPluginParam(pluginName, paramKeys, paramValues, [adapterName], [contextName])

2.1.5.11.3 Examples

addPluginParam(adapterName='ldap1', pluginName='VirtualAttr', paramKeys='ReplaceAttribute | MatchFilter', paramValues='cn=%uid% | objectclass=person')

addPluginParam(pluginName='VirtualAttr', paramKeys='ReplaceAttribute | MatchFilter', par)

2.1.5.12.1 Description

Adds a control to the Request Control Exclude List for an existing LDAP adapter configuration.

2.1.5.12.2 Syntax

addToRequestControlExcludeList(adapterName, control, [contextName])

2.1.5.12.3 Example

addToRequestControlExcludeList(adapterName='ldap1', control='2.16.840.1.113894.1.8.31', contextName='default')

2.1.5.13.1 Description

Adds a control to the Request Control Include List for an existing LDAP adapter configuration.

2.1.5.13.2 Syntax

addToRequestControlIncludeList(adapterName, control, [contextName])

2.1.5.13.3 Example

addToRequestControlIncludeList(adapterName='ldap1', control='2.16.840.1.113894.1.8.31', contextName='default')

2.1.5.14.1 Description

Assigns a view to an LDAP adapter in the libOVD configuration associated with an OPSS context.

2.1.5.14.2 Syntax

assignViewToAdapter(viewName, adapterName, [contextName])

2.1.5.14.3 Example

assignViewToAdapter('userView','ldap1', 'default')

2.1.5.15.1 Description

Creates a new Join Adapter for the libOVD configuration associated with an OPSS context.

2.1.5.15.2 Syntax

createJoinAdapter([contextName], adapterName, root, primaryAdapter, bindAdapter)

2.1.5.15.3 Examples

createJoinAdapter('join1','dc=join','primaryldap','myldap', 'myContext')

createJoinAdapter(adapterName='join1', root='dc=join', primaryAdapter='myldap')

2.1.5.16.1 Description

Creates a new LDAP adapter for the libOVD configuration associated with an OPSS context.

2.1.5.16.2 Syntax

createLDAPAdapter(adapterName, root, host, port, remoteBase, [isSecure], [bindDN], [bindPasswd], [passCred], [contextName])