3 Authentication and Security Policy Configuration

Authentication and session management are handled differently depending on the integration method being used. This chapter contains the following sections:

• Section 3.1, "Basic Authentication"

• Section 3.2, "Using OWSM Security Policies"

• Section 3.3, "Applying OWSM Security Polices to Oracle I/PM Web Services"

• Section 3.4, "Java API Login with Security Policies"

3.1 Basic Authentication

When first installed, the Oracle I/PM Web Services are configured with no Oracle Web Service Manager security policies applied. When no security policies are applied, the services leverage the HTTP Basic Authentication mechanism where by user credentials (user ID and password) are transmitted in the web service HTTP message header. This mechanism is, however, not very secure since the users credentials are not encrypted in any way unless a Secure Socket Layer (SSL) transport mechanism is used. If SSL is properly configured for the Oracle I/PM server instance, I/PM can be configured to force the use of SSL in all web service communication. This done by setting the I/PM configuration MBean “RequireBasicAuthSSL” to true. By default, it is false. [Note, the RequireBasicAuthSSL setting only applies when no HTTP Basic Authentication is in use because no OWSM security policies have been applied.]

3.2 Using OWSM Security Policies

When higher degrees of security are desirable, Oracle I/PM web services support the following Oracle Web Services Management (OWSM) security policies.

• wss_username_token

• wss_username_token_over_ssl

• wss11_username_token_with_message_protection

• wss10_saml_token

• wss_saml_token_over_ssl

• wss11_saml_token_with_message_protection

When applying a security policy to the I/PM web services, remember that the same policy must be applied to all of the web services with the exception of the DocumentContentService. The DocumentContentService is designed to use streaming MTOM that is incompatible with OWSM security policies. Security for DocumentContentService first requires a separate, stateful login through the LoginService, which does leverage OWSM security policy. (This information is primarily significant when making direct web services calls. The proper login sequence occurs automatically when using the native Java API.

3.3 Applying OWSM Security Polices to Oracle I/PM Web Services

Security policies are applied to I/PM web services from the WebLogic Server Administration Console using the following procedure.

1. Log in to Administration Console.

2. Click Deployments. The Summary of Deployments page is displayed.

3. Click the plus (+) icon next to imaging in the Name column of the Deployments table. The imaging deployment expands.

4. For each imaging web service under Web Services except DocumentContentService, do the following:

   1. Select the web service. The setting page for the service is displayed.

   2. Select the Configuration tab. The configuration tab becomes active.

   3. Select the WS-Policy tab. The WS-Policy tab becomes active.

   4. Click the web service port in the Service Endpoints and Operations column of the WS-Policy Files Associated With This Web Service table. The Configure the Policy Type for a Web Service page is displayed.

   5. Ensure OWSM is selected and click Next. Note that WebLogic polices are not supported. The Configure a WebService Policy page ID displayed.

   6. Choose a supported service policy from the Available Endpoint Policies field. Supported polices are listed in the section "Using OWSM Security Policies".

   7. Click the right arrow to move the selected policy to the Chosen Endpoint Policies field. Note that only one security policy should be selected.

   8. Click Finish. The Save Deployment Plan Assistant page is displayed.

   9. Click OK to save the deployment plan.

   10. Repeat step 4 for each web service except DocumentContentService until the same policy is applied for all services.

5. Click Deployments to return to the Deployments page.

6. Enable the check box next to imaging in the Name column of the Deployments table and click Update. The Update Application Assistant page is displayed with the new deployment plan specified next to Deployment plan path.

7. Click Finish. The new policies are applied and the deployment updated.

3.4 Java API Login with Security Policies

When OWSM security policies are applied to the I/PM web service, Java API code must use the WsmUserToken class to login rather than the BasicUserToken class. The WsmUserToken class is helper class for configuring OWSM client side security polices, including a set of static constants for setting the correct client side policy. Depending on the policy being used, addition configuration setting may be required as well. Refer to OWSM document for complete details on the meaning of the various configuration options.

The following example code fragments demonstrate possible usages of the WsmUserToken class for various policy types.

Example 3-1 WsmUserToken Class for Various Policy Types

WsmUserToken userToken = new WsmUserToken ("weblogic", "weblogic");
userToken.setClientPolicy(WsmUserToken.USERNAME_TOKEN_POLICY);
ServicesFactory.login(userToken,  wsurl);

WsmUserToken userToken = new WsmUserToken ("weblogic");
userToken.setClientPolicy(WsmUserToken.SAML_TOKEN_POLICY);

WssUserToken userToken = new WssUserToken ();
userToken.setUserName("weblogic");
userToken.setClientPolicy(WsmUserToken.SAML_TOKEN_MP_POLICY);
userToken.setKeystore(".\\config\\default-keystore.jks", "JKS", "welcome");
userToken.getSecurityParameters().put(SecurityConstants.ClientConstants.WSS_ENC_KEY_ALIAS, "orakey");
userToken.getSecurityParameters().put(SecurityConstants.ClientConstants.WSS_ENC_KEY_PASSWORD, "welcome");
userToken.getSecurityParameters().put(SecurityConstants.ClientConstants.WSS_SIG_KEY_ALIAS, "orakey");
userToken.getSecurityParameters().put(SecurityConstants.ClientConstants.WSS_SIG_KEY_PASSWORD, "welcome");