Index

A B C D E F G H I J K L M N O P R S T U V W X

Symbols

<as-context> element, 15.6.2

<confidentiality> element, 15.6.1

<default-method-access> element, 14.2.2.5

<establish-trust-in-client> element, 15.6.1

<establish-trust-in-target> element, 15.6.1

<integrity> element, 15.6.1

<jazn> element

and <password-manager> element, 5.1.2

<jazn-loginconfig>, 8.6.1

<login-module> entity

options, 8.1

<method-permission> element, 14.2.2.1, 14.2.2.1

<password-manager> element, 5.1.2

<role-link> element, 14.2.2.1, 14.2.2.1

<role-name> element, 14.2.2.1

<run-as> element, 14.2.2.3

<sas-context> element, 15.6.3

<security-identity> element, 14.2.2.3

<security-role> element, 14.2.2.1

<security-role-mapping> element, 14.2.2.4

<security-role-ref> element, 14.2.2.1, 14.2.2.1

<session-tracking> element, 11.3

<ssl-config> element, 11.3

<transport-config> element, 15.6.1

<unchecked/> element, 14.2.2.2

<use-caller-identity/> element, 14.2.2.3

<web-app> element, 11.3

A

access control context (AccessControlContext), 1.4.4

access control lists

definition, 1.2.2

settings for 9.0.4 infrastructure, 6.3.2

access controller (AccessController), 1.4.4

Access Manager, COREid

introduction, 10.1.1

running, 10.1.5

Access SDK, COREid, 10.4.2, 10.4.3

AccessGate vs. WebGate (COREid), 10.1.1

accounts, OC4J

accounts created in OID, 6.4.1.3

predefined and required, 3.6.1

predefined for file-based provider, 7.3.4

activating users, file-based provider, 3.6.1

add command, C.3.3.1

adding and removing realms, C.4.1

adding and removing roles, C.4.3

adding and removing users, C.4.4

-addloginmodule option to JAZN Admintool, 8.5

-addperm option to JAZN Admintool, C.4.1

-addrealm option to JAZN Admintool, C.4.2

-addrole option to JAZN Admintool, C.4.3

-adduser option to JAZN Admintool, C.4.4

admin account

activate in Admintool, C.4.6

oc4jadmin account, 3.6.2

specifying new admin account, 3.6.3

administering

JAAS provider, 3.2

administration

JSR-77 support, 3.1

MBean browser, 3.2.1

MBeans, definition, 3.1

specifying new admin account, 3.6.3

AdminPermission class

definition, 2.3.3, 2.3.3

Admintool

invoking, 3.2.2

overview, 3.2.2

anonymous lookup, EJBs, 14.2.4

anonymous user

create in Oracle Internet Directory, 6.4.1.5.2

map to user in Oracle Internet Directory, 6.4.1.5.1

Application Server Control

console, introduction, 3.2.1

overview, 3.2.1

specifying security provider, 5.6.3

specifying security role mappings, 5.6.4.2

authentication, 1.2.1

BASIC, 13.1.1

CLIENT-CERT, 13.1.5, 13.1.5

DIGEST, 13.1.1

DIGEST (using OID), 13.1.3

failure, specify default realm, A.2.5.2

FORM, 13.1.4

J2EE, 2.2

SSO, 13.1.2

supported authentication methods, 2.2

using login modules, 1.5

using OracleAS Single Sign-On, 2.1.2

using RealmLoginModule class, 2.1.2

with OracleAS Single Sign-on, 2.1.2

with SSL, 11.2

with SSO, 6.2.3

authorization

coarse-grained vs. fine-grained, 1.2.3

defined, 1.2.1

JAAS model vs. J2EE model, 1.2.3

to any authenticated user (PUBLIC role), 5.6.4.4

B

BASIC authentication, 13.1.1

basic authentication, in COREid, 10.3.2

bootstrap accounts, 3.6.1

bootstrap jazn.xml file, 3.4.5

C

cache properties, 6.5.3

caching, 6.5.3

disabling, 6.5.3

caching properties, 6.5.3

callback handler, 1.5

capability model

definition, 1.2.2, 1.2.2

case-sensitivity for roles

custom login modules, 8

external LDAP providers, 9.1

file-based provider, 7

LDAP-based provider, 6

certificate authorities, 1.7.3

certificates (SSL), 1.7.3

checking

passwords, C.4.5

-checkpasswd option to JAZN Admintool, C.4.5

cipher suites

supported by Oracle HTTPS, 12.2.1.2, 12.2.1.3

class names

definition, 1.4.1

clear command, C.3.3.3

CLIENT-CERT authentication, 13.1.5

CN (common name), 6.1.2

coarse-grained authorization, 1.2.3

common name (CN), 6.1.2

Common Secure Interoperability version 2--see CSIv2

configuring

external LDAP providers, 9

file-based provider, 7

LoginModules, 8.6

connection properties, 6.5.2, 6.5.2

connector-factory element, 8.6.3

cookie domain, 11.3

cookie-domain attribute, 11.3

COREid

Access Manager, introduction, 10.1.1

Access Manager, running, 10.1.5

Access SDK, 10.4.2, 10.4.3

action URL, protecting, 10.3.4

application, protecting, 10.5.4

architecture, 10.1.3

auth-method setting, 10.5.3

basic authentication, 10.3.2

credential_mapping plug-in, 10.3.1.3, 10.3.2.2

EJB application, use case, 10.6.3

form-based authentication, 10.3.1

overview, 10.1.1

plug-ins, overview, 10.2.2

prerequisites, 10.1.2

resource types, configuration, 10.3.3

resource types, overview, 10.2.1

single sign-on cookie, 10.2.3

validate_password plug-in, 10.3.1.4

Web app using HTTP header variables, use case, 10.6.1

Web app using SSO cookie, use case, 10.6.2

Web service with SAML token, use case, 10.7.3

Web service with username token, use case, 10.7.1

Web service with X.509 token, use case, 10.7.2

credential_mapping plug-in, COREid, 10.3.1.3, 10.3.2.2

credentials, 5.1.3

CSIv2

and EJBs, 15.4

internal-settings.xml, 15.4

introduction, 15.3

properties in orion-ejb-jar.xml, 15.6

security properties, 15.6

custom Loginmodules

troubleshooting, A.2.2

custom security providers (custom login modules), 2.1.3

D

DAS (Delegated Administration Services for OID), 3.2.3.1

data storage

in LDAP-based environments, 6.1.3

DataSourceUserManager

configuring application to use it, 5.8.2

initialization parameters, 5.8.1

overview, 2.1.4

deactivated users, file-based provider, 3.6.1

debugging

general SSL debugging, 11.6.2

logging, A.3

PrintingSecurityManager, 4.2.2

default realm, 5.2.1

file-based provider, 7.3.1

Delegated Administration Services (DAS for OID), 3.2.3.1

deploying

LoginModule, 8.3

deployment

deployment plan, 3.1

deployment plan editor, 3.2.1

JSR-88 support, 3.1

deployment descriptors

security, 14.2.2.1

DER, 12.1.2

DIGEST authentication, 13.1.1

DIGEST authentication (using OID), 13.1.3

digital certificates, 1.7.2

directory information tree (DIT)

Java Authorization Service, 6.1.3.1

directory information tree Identity Management Realm, 6.1.1

disabling caching, 6.5.3

Distinguished Encoding Rules, 12.1.2

distinguished name (DN), 6.1.2

DN (distinguished name), 6.1.2

DTDs

internal-settings.xml, 15.1

E

EIS connections

JCA, 16

EJB

anonymous lookup, 14.2.4

CSIv2, 15.4

interoperability, 15

server security properties, 15.1

ejb_sec.properties, 15.2

Enterprise Manager, overview, 3.2.1

exit command, C.3.3.4

external LDAP provider, 2.1.3

external.synchronization (no longer supported), Preface

F

file-based provider

configuring, 7

file-based provider type, 2.1.3

fine-grained authorization, 1.2.3

FORM authentication, 13.1.4

form-based authentication, in COREid, 10.3.1

G

granting permissions, C.4.7

-grantperm option to JAZN Admintool, C.4.7

H

help command, C.3.3.5

HTTPClient.HttpUrlConnection, 12.2.4

HTTPConnection, 12.1.1

HTTPS tunneling, 11.3

I

identify propagation--see subject propagation

Identity Management Realm

role management, 6.1.1

sample LDAP directory information tree, 6.1.1

user management, 6.1.1

impliesAll attribute, 14.2.2.5

instance-level jazn.xml file, 3.4.5

instance-level security

administering, 7.2.6

provider, 7.2.6

integrating

custom LoginModule, 8.2

internal-settings.xml file, 15.1

CSIv2 entities, 15.4

DTD, 15.1

<sep-property> element, 15.1, 15.4

interoperability, 15

invoking Admintool, 3.2.2

invoking JAZN Admintool, C.2

isCallerInRole method, 14.2.2.1

J

JAAS

JAAS mode

introduction, 2.3.2

JAAS Provider

integration with SSL-enabled applications, 11.2

integration with SSO-enabled applications, 6.2.3

locations for jazn.xml, 3.4.5, A.2.1

overview, 2.1.1

permission classes, 2.3.3

security role, 13.2.3

JAAS. See Java Authentication and Authorization Service (JAAS)

jaas.username.simple (omit realm name from principals), 5.2.6

Java 2 Platform, Enterprise Edition (J2EE), 1.1

Oracle component responsibilities in SSL-enabled environments, 11.2

Java 2 Platform, Standard Edition (J2SE)

creating applications using the Java 2 Security Model, 1.1

Java 2 Security Model, 1.1

definition, 1.1

using access control capability model, 1.2.2

using with J2EE applications, 1.1

using with J2SE applications, 1.1

Java Authentication and Authorization Service (JAAS)

definition, 2.1.1

principals, 1.3

subjects, 1.3

Java Authorization Contract for Containers

introduction, 2.3.4

Java Key Store (JKS), 15.1

Java Platform, Enterprise Edition (J2EE)

security role, 2.4

java.net.URL framework, 12.2.4

java.security.policy system property, 4.2

java.security.Principal, 2.1.2, 5.6.4.1

java.security.Principal interface

using with principals, 1.3

javax.net.ssl.KeyStore, 12.3.1

javax.net.ssl.KeyStorePassword, 12.3.2

JAZN Admintool

adding and removing login modules, 8.5

adding and removing permissions, C.4.1

adding realms, C.4.2

adding roles, C.4.3

adding users, C.4.4

checking passwords, C.4.5

command options, C.2

granting and revoking permissions, C.4.7

granting roles, C.4.8

invoking, C.2

listing login modules, 8.5

listing permissions, C.4.10

listing roles, C.4.12

listing users, C.4.13

migrating principals, 7.5, C.4.14

navigating shell, C.3.3

revoking roles, C.4.8

setting passwords, C.4.15

shell commands, C.3

starting shell, C.3

JAZN Admintool shell commands

add, C.3.3.1

clear, C.3.3.3

exit, C.3.3.4

help, C.3.3.5

man, C.3.3.7

mk, C.3.3.1

pwd, C.3.3.8

rm, C.3.3.9

set, C.3.3.10

JAZN term, 2.1.1

JAZNAdminUser, JAZNAdminGroup, 6.1.3.2

jazn-data.xml

deploying LoginModules, 8.7.3

persistence mode, 3.4.3

JAZNPermission class

definition, 2.3.3, 2.3.3

JAZNUserManager

definition, 2.1.2

jazn.xml

file location, 3.4.5, A.2.1

JCA

component-managed vs. container-managed sign-on, 16.1.2

EIS connections, 16

security contract, 16.1.1

JNDI connection pool, 6.5.2

JSR-77 support, 3.1

JSR-88 support, 3.1

JVM, 4.1

K

keys (SSL), 1.7.3

keystore

definition, 15.1

keystores, 1.7.3

L

LDAP

caching properties, 6.5.3

configuring external providers, 9

connection properties, 6.5.2, 6.5.2

Oracle Internet Directory used as provider type, 2.1.3

SSL properties, 6.5.1

LDAP provider

creating users with OID DAS, 6.5

Sun Java System Directory Server, 9.5

LDAP-based provider (Oracle Identity Management with Oracle Internet Directory), 2.1.3

LDAPLoginModule, 2.1.3, 9.3

ldapmodify

create anonymous user in Oracle Internet Directory, 6.4.1.5.2

for ACL settings, 9.0.4 infrastructure, 6.3.2

ldap.password property name, 6.5.1

ldap.protocol, 6.5.1

ldapsearch to retrieve realm names from OID, A.2.3.2

ldap.user property name, 6.5.1

LDIF (lightweight directory interchange format), 6.4.1.5.2

Lightweight Directory Access Protocol (LDAP)-based, 6.1.3

Lightweight Directory Access Protocol (LDAP)-based environments

realm contents, 6.1.1

realm management, 6.1

sample Identity Management Realm directory information tree, 6.1.1

Lightweight Directory Access Protocol. See LDAP.

listing

permissions, C.4.10

roles, C.4.12

users, C.4.13

listing realms, C.4.11

-listloginmodules option to JAZN Admintool, 8.5

-listperm option to JAZN Admintool, C.4.10

-listrealms option to Admintool, C.4.11

-listroles option to JAZN Admintool, C.4.12

-listusers option to JAZN Admintool, C.4.13

logging, A.3

adding and removing in JAZN Admintool, 8.5

deployed as optional packages, 8.3.2

listing in JAZN Admintool, 8.5

LoginContext class, 1.5

authenticating subjects, 1.5

and third-party LDAP provider, 9.3

LoginModules, 8, 9.3

configuring, 8.6

configuring with different applications, 1.5

COREid login module, 10.5.5

definition, 1.5

deploying, 8.7.3

integrating, 8.7

integration with OC4J, 8.2

LDAPLoginModule, 2.1.3, 9.3

packaging and deployment, 8.3

RealmLoginModule, 8.1

troubleshooting custom, A.2.2

M

man command, C.3.3.7

MBeans

definition, 3.1

MBean browser, 3.2.1

-migrate option to JAZN Admintool, 7.5, C.4.14

migrating

principals, 7.5

mk command, C.3.3.1

N

navigating

JAZN Admintool shell, C.3.3

O

obfuscation, 5.1.3

LDAP password, 6.5.1

ObSSOCookie, COREid SSO cookie, 10.2.3

OC4J

interoperability, 15

oc4j-ra.xml, 8.6.3

oidadmin (Oracle Directory Manager), 3.2.3.2

OID--see Oracle Internet Directory

omitting realm names from principals, 5.2.6

OPMN (Oracle Process Manager and Notification Server), 11.7.2

optional packages, used for login modules, 8.3.2

Oracle COREid Access and Identity--see COREid

Oracle Directory Manager (oidadmin), 3.2.3.2

Oracle Enterprise Manager, overview, 3.2.1

Oracle HTTPS, 12

default system properties, 12.3

example, 12.4

feature overview, 12.2

supported cipher suites, 12.2.1.2, 12.2.1.3

Oracle Identity Management

(with Oracle Internet Directory)--the LDAP-based provider, 2.1.3

Oracle Internet Directory

(with Oracle Identity Management)--the LDAP-based provider, 2.1.3

Delegated Administration Services (DAS), 3.2.3.1

Oracle Directory Manager (oidadmin), 3.2.3.2

overview, 6.2.1

retrieving realm names using ldapsearch, A.2.3.2

supported versions, 6.3.1

OracleAS Single Sign-On, 2.1.2

overview, 6.2.2

servlet session synchronization, 6.4.3.4

supported versions, 6.3.1

oracle.home system property, 4.2.1

oracle.security.jazn.realm package

use of, 2.1.2

OracleSSLCredential, 12.1.2

Oracle.ssl.defaultCipherSuites, 12.3.3

orion-application.xml

and LoginModule, 8.6.2

deploying LoginModules, 8.7.3

mapping security roles to JAAS Provider users and roles, 13.2.4

orion-ejb.jar file

<establish-trust-in-target> element, 15.6.1

<sas-context> element, 15.6.3

<transport-config> element, 15.6.1

orion-ejb-jar.xml, 15.6

<as-context> element, 15.6.2

<establish-trust-in-client> element, 15.6.1

<integrity> element, 15.6.1

security properties, 15.6

orion-ejb-jar.xml file

<confidentiality> element, 15.6.1

ORMIS

configuring access restrictions, 11.7.3

configuring clients to use ORMIS, 11.7.4

configuring for OC4J in OAS, 11.7.2

configuring for standalone OC4J, 11.7.1

P

password indirection

definition, 5.1

password obfuscation

definition, 5.1

passwords, 5.1.3

checking, C.4.5

checking in JAZN Admintool, C.4.5

obfuscating, 5.1.3

setting in JAZN Admintool, C.4.15

permissions, 14.2.1

actions, 1.4.1

adding and removing in JAZN Admintool, C.4.1

class definitions, 2.3.3

class name, 1.4.1

defined, 1.4.1

granting and revoking in JAZN Admintool, C.4.7

in Java 2 Security Model, 1.4.1

JAAS Provider, 2.3.3

Java permission instance contents, 1.4.1

listing in JAZN Admintool, C.4.10

listing with the JAZN Admintool, C.4.10

target, 1.4.1

persistence mode, 3.4.3, 5.1.3

Pluggable Authentication Module (PAM), 1.1

plug-ins (COREid)

credential_mapping, 10.3.1.3, 10.3.2.2

overview, 10.2.2

validate_password, 10.3.1.4

policy

definition, 1.4.2

policy cache, 6.5.3

policy file

creating, 4.2.1

specifying, 4.2

ports

LDAP with or without SSL, 6.4.1.1, 6.5.1

principals

definition, 1.3

migrating, 7.5

migrating in JAZN Admintool, 7.5, C.4.14

with JAAS, 1.3

principals.xml file

converting from, 7.5

PrintingSecurityManager, 4.2.2

private keys (SSL), 1.7.3

privileges, 1.6

properties

connection, 6.5.2

JNDI connection pool, 6.5.2

LDAP caching, 6.5.3

LDAP SSL, 6.5.1

property names

ldap.password, 6.5.1

ldap.user, 6.5.1

PropertyPermission, 14.2.1

protection domain

in Java 2 Security Model, 1.4.3

provider types

retrieving permissions from, 1.2.2

public keys (SSL), 1.7.3

PUBLIC role (for access by any authenticated user), 5.6.4.4

pwd command, C.3.3.8

R

RBAC (role-based access control), 1.6

realm cache, 6.5.3

RealmLoginModule class, 2.1.2, 2.2, 8.1

RealmPermission class

definition, 2.3.3, 2.3.3

RealmPrincipal interface, 2.1.2

realms

adding and removing with the JAZN Admintool, C.4.1

adding in JAZN Admintool, C.4.2

creation of realm container in LDAP-based environments, 6.1.3

data storage in LDAP-based environments, 6.1.3

default realm, 5.2.1

definition, 1.4.5, 2.1.2

JAAS Provider support, 2.1.2

listing in Admintool, C.4.11

managing in LDAP-based environments, 6.1

managing in XML-based provider type, 7.3.2

omitting realm name from principals, 5.2.6

overview, 1.4.5

realm contents in LDAP-based environments, 6.1.1

retrieving realm names from OID using ldapsearch, A.2.3.2

retrieving realm names using Admintool, C.4.11

tasks and guidelines in OC4J, 5.2

troubleshooting issues, A.2.5

using multiple realms, 5.2.5

using nondefault realm, 5.2.4

-remloginmodule option to JAZN Admintool, 8.5

-remperm option to JAZN Admintool, C.4.1

-remrealm option to JAZN Admintool, C.4.2

-remrole option to JAZN Admintool, C.4.3

-remuser option to JAZN Admintool, C.4.4

resource types (COREid)

configuration, 10.3.3

overview, 10.2.1

-revokeperm option to JAZN Admintool, C.4.7

revoking

roles in JAZN Admintool, C.4.8

revoking permissions, C.4.7

rm command, C.3.3.9

RMI/IIOP, 15

role management, 6.1.1

role manager, 6.1.1

role mapping to JAAS Provider users and roles, 13.2.4

RoleAdminPermission class

definition, 2.3.3, 2.3.3

roles

adding and removing with the JAZN Admintool, C.4.3

adding in JAZN Admintool, C.4.3

case-sensitivity, custom login modules, 8

case-sensitivity, external LDAP providers, 9.1

case-sensitivity, file-based provider, 7

case-sensitivity, LDAP-based provider, 6

creating, editing, deleting (file-based provider), 7.2.5

definition, 1.6

granting in JAZN Admintool, C.4.8

listing in JAZN Admintool, C.4.12

listing with the JAZN Admintool, C.4.12

management in Identity Management Realms, 6.1.1

revoking in JAZN Admintool, C.4.8

role-based access control, 1.6

using the J2EE security roles, 2.4

run-as

example, 14.2.2.3

run-as security identity, 14.2.2.3

RuntimePermission, 14.2.1

S

Secure Sockets Layer. See SSL

security

keys and certificates, 1.7.3

permissions, 14.2.1

requesting client authentication, 11.5

SSL common problems and solutions, 11.6.1

SSL debugging, 11.6.2

using certificates with OC4J and OHS, 11.1

security managers

overview, SecurityManager class, 1.4.4

PrintingSecurityManager, 4.2.2

specifying, enabling, 4.2

security provider

definition, 1.2.1

supported providers, 2.1.3

security role

using in the web.xml file, 2.4

<sep-property> element, 15.1, 15.4

servlet session synchronization (with SSO), 6.4.3.4

session cache, 6.5.3

session synchronization for servlets (with SSO), 6.4.3.4

set command, C.3.3.10

-setpasswd option to JAZN Admintool, C.4.15

-shell option to JAZN Admintool, C.3

signon

component-managed vs. container-managed, 16.1.2

single sign-on, 2.2

COREid SSO cookie, 10.2.3

COREid SSO, configure Web apps, 10.5.3

integration with JAAS Provider, 6.2.3

OracleAS Single Sign-On overview, 6.2.2

SocketPermission, 14.2.1

SSL, 1.7.1

common problems, 11.6

enabling SSL in OC4J, 11.3

integration with JAAS Provider, 11.2

LDAP properties, 6.5.1

ORMI over SSL, 11.7

port for LDAP with SSL, 6.4.1.1, 6.5.1

SSO authentication, 13.1.2

starting

Admintool, 3.2.2

JAZN Admintool, C.2

subject propagation

enabling, 14.4.2

introduction, 1.7.4

overview in OC4J, 14.4.1

removing/configuring restrictions, 14.4.4

sharing principal classes, 14.4.3

Subject.doAs method

associating a subject with AccessControlContext, 1.3

invoking, 1.5

subjects, 1.3

definition, 1.3

with JAAS, 1.3

Sun Java System Directory Server

as LDAP provider, 9.5

system application

associating with Oracle Internet Directory, 6.4.1.5

overview, 3.5

system properties

java.security.manager, 4.2

java.security.policy, 4.2

oracle.home, 4.2.1

system-jazn-data.xml

and Admintool, 3.2.2

and LoginModule, 8.6.1

for policy data, 7.3.3

persistence mode, 3.4.3

T

target names

definition, 1.4.1

third-party LDAP provider, login-module element options, 9.3

<transport-config> element, 15.6.1

troubleshooting

custom LoginModules, A.2.2

trustpoint, 1.7.2

truststore

definition, 15.1

tunneling, HTTPS, 11.3

U

user repository

definition, 1.2.1

users

activating/deactivating, file-based provider, 3.6.1

adding and removing with the JAZN Admintool, C.4.4

adding in JAZN Admintool, C.4.4

creating, editing, deleting (file-based provider), 7.2.4

creating, with OID DAS for LDAP provider, 6.5

listing in JAZN Admintool, C.4.13

listing with the JAZN Admintool, C.4.13

management in Identity Management Realms, 6.1.1

V

validate_password plug-in, COREid, 10.3.1.4

W

Web services, use cases with COREid, 10.7

WebGate vs. AccessGate (COREid), 10.1.1

web.xml

using the J2EE security role, 2.4

X

XML-based provider, 2.1.3

XML-based provider type, 2.1.3

realm management, 7.3.2

XML-based provider--see file-based provider