| Oracle® Retail Store Inventory Management Security Guide Release 15.0 E68593-01 |
|
 Previous |
 Next |
| Oracle® Retail Store Inventory Management Security Guide Release 15.0 E68593-01 |
|
Previous |
Next |
This section describes the security features built into SIM.
The SIM application uses a multi-tier architecture. It is important to understand how it is structured when considering application infrastructure security.
The SIM application is deployed to an instance of a WebLogic application server running on a private network. SIM requires the WebLogic domain to be created with the Java Required Files (JRF) extension, which includes the Oracle Platform Security Services (OPSS). OPSS is a security framework that provides security to Oracle Fusion Middleware and associated applications.
SIM uses the OPSS credential store framework and Java authorization functionality to manage sensitive information related to application security. For example, SIM stores encryption keys and integration user credentials in the credential store.
The OPSS configuration for the WebLogic domain can be managed through Oracle Enterprise Manager. For detailed information on OPSS, see the Oracle Fusion Middleware Application Security Guide.
SIM supports multiple user security modes that affect user authentication and authorization. Based on the selected identity management solution and organization requirements, the appropriate user security mode should be used.
The default and recommended user security mode is external authentication and authorization, which allows LDAP to store and manage user data.
The internal authentication and authorization mode allows the SIM application to manage the user data, which is stored in the database.
There is a hybrid user security mode that uses a combination of LDAP and the database for storage and management of user data. This mode allows for an externally managed identity store while retaining application functionality for user management of internal data. When accessing both external and internal data, the external system is prioritized before the internal system.
If a hybrid mode is used then it is recommended to disable the cache or reduce it to the minimum acceptable value.Authentication and authorization capabilities are configurable through security provider setup and user permissions to produce alternative restricted variations.
For further information on the user security modes and configuration, see the Oracle Retail SIM Implementation Guide Volume 1.
Information on securing the dependent applications can be found in the following security guides:
Oracle Database 12c 2 Security Guide.
Oracle Application Security Guide.
WebLogic 12.1.3 Security Guide
The application security features are organized into authentication, authorization, audit, and user management sections.
In order for a remote client to connect to the SIM application, user authentication is required. SIM supports authentication for SSO, LDAP, and database security. This is handled by WebLogic security authentication providers.
WebLogic security authentication providers are based on the JAAS framework, which allows the providers to be ordered and apply control flags that determine how the overall sequence behaves. If a user cannot be authenticated then the client will not be allowed to connect to the SIM application.
When the user is successfully authenticated by one of the authentication providers, the user is then processed for authorization to grant access to resources and application features.
User authorization is handled by both the WebLogic application server and the SIM application. After successful authentication the security providers will have specified privileges for the session such as a user and associated roles/groups. The deployed resources can be configured within WebLogic application server to restrict access based on those privileges. This allows for fine grained access control of resources. It is recommended that application users be given access only to the SIM functionality required for their tasks.
The SIM application handles business authorization for an authenticated user during the login process. Application features are restricted using a role based access control system. Roles are managed in the SIM database to define sets of permissions that are required to perform business operations associated with organization roles. User access is also restricted by stores and allows roles to be assigned per store.
Role and store assignments for users are managed in the selected identity store (LDAP or database). When a user logs into a store the authorization process validates role and store assignments and applies the resulting collection of permissions to the user session. Access to application features is limited to the set of permissions granted to the user session.
In addition, access to application and server resources is restricted to users that belong to specific groups, such as the administrator, security ops, MPS ops groups.
For detailed information on SIM role based security and permissions, see the Oracle Retail SIM Implementation and Operation Guides.
SIM provides basic audit capabilities for business processes. Audit records are held in the SIM database as either generic activity history or specific history records for certain business areas such as item UIN history.
The SIM client application can be used to manage user data, role, store and group assignments that are managed internally (database). External user data (LDAP, SSO) is not managed by SIM and must be performed using appropriate organization resources.
For detailed information on user management of internal SIM users, see the Oracle Retail SIM Implementation and User Guides.
Security components within SIM are designed to allow for extension and customization. This allows cryptography operations to be implemented as needed. The SIM standard security implementation uses the Java Cryptography Extension (JCE) framework to protect sensitive and security related information.
The algorithms parameters used for cryptography are configurable through configuration files. For detailed information on algorithm options and parameters, see the Oracle JCE documentation.
SIM uses hashing for storing user passwords in the database when an internal authentication security mode is used. The hashing can only be performed in one direction, which ensures that passwords cannot be reverse engineered.
The hashing is performed using an encryption key that is stored separately in the credential store. Passwords can only be validated using the same encryption key. If user passwords are migrated between databases then the encryption key must also be migrated between credential stores. If an encryption key is lost or changed then all existing passwords in the database will fail authentication.
By default the application will automatically generate a random encryption key during initialization if none exists. Manual key management can be performed by updating the credential store.The user password cryptography configuration is located in the server.cfg file, located in sim-server-resources.jar.
For detailed information on this configuration file, see the Oracle Retail Store Inventory Management Operations Guide.
SIM uses encryption and hashing for generation and validation of SSO tokens when SSO authentication is used. The token is generated using an encryption key that is stored separately in the credential store.
By default the application will automatically generate a new random encryption key during initialization, which simplifies key management. For manual key management the automatic generation can be disabled through configuration, allowing the encryption key to be manually managed by updating the credential store. The SSO token cryptography configuration is located in the web-launch.properties file, located in sim-client.war.
For detailed information on this configuration file, see the Oracle Retail Store Inventory Management Operations Guide.
