7 Managing Policy Distribution

Policy distribution comprises the process used to make configured policies and policy data available for evaluation. Evaluation of the policies will produce a grant or deny authorization decision in answer to an access request. This chapter contains the following sections.

• Section 7.1, "Understanding Policy Distribution"

• Section 7.2, "Defining Distribution Modes"

• Section 7.3, "Distributing Policies"

7.1 Understanding Policy Distribution

Managing policies and distributing them are distinct operations. Policy management operations are used to define, modify and delete policies in the policy store. The Policy Distribution Component then makes the policies available to a Security Module where the data is used to grant or deny access to a protected resource. Policies are not enforced until they are distributed. Policy distribution may include any or all of the following actions:

• Reading policies from the policy store.

• Caching policy objects in the in-memory policy cache maintained by the Security Module for use during authorization request processing.

• Perserving policy objects in a file-based persistent cache, local to the Policy Distribution Component, that provides independence from the policy store.

Both the central Oracle Entitlements Server Administration Console and the locally-installed (to the protected application) Security Module contain the Policy Distribution Component. This architecture allows two deployment scenarios: the first involves a centralized Policy Distribution Component that can communicate with many Security Modules while the second involves a Policy Distribution Component that is local to, and communicates with, one Security Module.

Note:

For details on configuring a Security Module for policy distribution, see Section A.1, "Policy Distribution Configuration." For details on creating definitions and binding Security Modules, see Section 8.2, "Configuring Security Module Definitions."

The following sections contain more information.

• Using a Central Policy Distribution Component

• Using a Local Policy Distribution Component

7.1.1 Using a Central Policy Distribution Component

The centralized Policy Distribution Component scenario involves the use of the Policy Distribution Component (within the Administration Console) to act as a server communicating with the Security Module's Policy Distribution Component client. Figure 7-1 illustrates how, in this scenario, the Security Module's Policy Distribution Component client does not communicate with the policy store. The distribution of policies is initiated by the Oracle Entitlements Server administrator and pushed to the Policy Distribution Component client. Currently, data can only be pushed in a controlled manner as described in Section 7.2.1, "Controlled Distribution." This scenario allows for a central Policy Distribution Component that can communicate with many Security Modules.

Figure 7-1 Using Oracle Entitlements Server Policy Distribution Component

Description of "Figure 7-1 Using Oracle Entitlements Server Policy Distribution Component"

7.1.2 Using a Local Policy Distribution Component

The local (to the Security Module) scenario involves the Security Module's Policy Distribution Component communicating directly with the policy store. This scenario allows for a local Policy Distribution Component to communicate with one Security Module only. The application administers management operations and decides when the Security Module instance of the Policy Distribution Component will distribute policies or policy deltas. In this deployment, as illustrated in Figure 7-2, the Policy Distribution Component pulls data from the policy store (by periodically checking the policy store for data to be distributed) and sends policy data from the policy store, making it available to the PDP after administrator-initiated policy distribution.

Figure 7-2 Using Security Module Policy Distribution Component

Description of "Figure 7-2 Using Security Module Policy Distribution Component"

Currently, data can be pulled in either a controlled manner as described in Section 7.2.1, "Controlled Distribution" or a non-controlled manner as described in Section 7.2.2, "Non-controlled Distribution."

7.2 Defining Distribution Modes

Oracle Entitlements Server handles the task of distributing policies to individual Security Modules that protect applications and services. Policy data is distributed in either a controlled manner or a non-controlled manner. The distribution mode is defined in the jps-config.xml configuration file for each Security Module. The specified distribution mode is applicable for all Application objects bound to that Security Module. The following sections have more information on the distribution modes.

• Controlled Distribution

• Non-controlled Distribution

7.2.1 Controlled Distribution

Controlled distribution is the default distribution mode. It is initiated by the Policy Distribution Component, ensuring that the PDP client (Security Module) receives policy data that has been created or modified since the last distribution. In this respect, distribution is controlled by the policy administrator who takes explicit action to distribute the new or updated policy data. (The Policy Distribution Component maintains a versioning mechanism to keep track of policy changes and distribution.) When controlled distribution is enabled, the Security Module cannot request distribution of the Policy Distribution Component directly.

Note:

The exception is when a Security Module starts and registers itself with the Policy Distribution Component with a Configuration ID. The policies are distributed to the Security Module based on this registration.

With controlled distribution, the Policy Distribution Component distributes new and updated policy data to the Security Module where the data is stored in a local persistent cache, a file-based cache maintained by the PDP to store policy objects and provide independence from the policy store. The Policy Distribution Component does not maintain constant live connections to its Security Module clients; it will establish a connection before distributing policy to it. Thus, the Security Module is not dependent on the policy store for making policy decisions; it can use its own local cache if the policy store is offline. When the Security Module starts, it will check if the policy store is available. If it is not available, the Security Module will use policy data from the local persistent cache.

Caution:

Controlled distribution is supported only on database type policy stores - not on LDAP-based policy stores. If the distribution API is invoked for an LDAP policy store, it will be non-operable.

With controlled distribution, if any policy distribution operation fails, the entire policy distribution fails. By default, controlled distribution is disabled.

7.2.2 Non-controlled Distribution

When the PDP client (Security Module) periodically retrieves (or pulls) policies and policy modifications from a policy store, it is referred to as non-controlled distribution. Non-controlled distribution makes policy changes available as soon as they are saved to the policy store. Non-controlled distribution is initiated by the Security Module and may retrieve policies that are not yet complete. The policy store must be online and constantly available for non-controlled distribution. Non-controlled distribution is supported on any policy store type.

7.3 Distributing Policies

From a high level, the following steps are needed to get to the point where you can distribute policies.

1. Create a Security Module definition.

   See Section 8.2.1, "Creating a Security Module Definition."

2. Bind the definition to the appropriate Application.

   See Section 8.2.2, "Binding an Application to a Security Module." To unbind the Security Module, see Section 8.2.3, "Unbinding an Application From a Security Module."

3. Open the Application in the Home area.

   See Section 7.3.1, "Distributing Policies Using the Administration Console."

4. Distribute the policies.

   See Section 7.3.1, "Distributing Policies Using the Administration Console."

7.3.1 Distributing Policies Using the Administration Console

Policies are distributed from within an Application. The following procedure documents how to distribute policies using the Administration Console.

1. Expand the Applications node in the Navigation Panel.

2. Select the Application to modify.

3. Right-click the Application name and select Open from the menu.

   The General tab, the Delegated Administrators tab and the Policy Distribution tab are all active.

4. Click the Policy Distribution tab.

5. Select the definition of the Security Module to which you will distribute policies.

6. Click Distribute.

7. Click Refresh to update the distribution progress.