13/14

8 Relationship Management Security

This chapter explains how to secure the RM application. RM REST APIs are authenticated using Basic Authentication.

8.1 Security Groups and Roles

RM defines the users, groups, and security roles based on the WebLogic users, groups, and security roles defined in the Fusion Middleware Securing Resources Using Roles and Policies for Oracle WebLogic Server Guide. This release defines the following three security roles:

Table 8-1 describes the security roles defined in this release.

Table 8-1 Security Roles

Security Role	Name	Privilege	Description	Operating Resources
RmIntegrator	System Integrator	search, create, and update	Used for creating and updating relationships, registering MPI domains, and resolving potential relationships	metadata, relationships, entities, and application configuration
RmAnalyst	Business Analyst	search	Used for searching and viewing the relationships	metadata, relationships, and entities
RmAdministrator	System Administrator	search, create, and update	Used for creating and updating relationships, registering MPI domains, and resolving potential relationships	metadata, relationships, entities, and application configuration

Note:

In this release, there is no difference between the system administrator role and system integrator role at the application level.

Table 8-2 describes the relationship security groups defined in this release.

Table 8-2 Relationship Security Group

Security Group	RM Security Role	WebLogic Role
RmAdministrator	RmAdministrator	Admin
RmAnalyst	RmAnalyst	Not Applicable
RmIntegrator	RmIntegrator	AdminChannelUser, Deployer, Operator, Monitor, and AppTester

8.1.1 Creating the Relationship Management Security Groups and Roles

Before deploying the RM application, you must create security groups, roles, and users using the WebLogic Server Administration Console.

To create roles and groups:

1. Log on to the Oracle WebLogic Server Administration Console using the credentials for administrator.

   The Oracle WebLogic Administration Console appears.

2. On the left panel, under Domain Structure, select Security Realms.

3. In the table on the Summary of Security Realms panel, click myrealm, that is the name of the realm.

   The Settings for myrealm panel appears.

4. Click the Users and Groups tab and then click the Groups tab.

   The Groups table appears.

5. Click New to add a new RM group.

   The Create a New Group panel appears.

6. In the Name field, type RmAnalyst.

7. Click OK.

8. Repeat steps 6 through 8 to add the following RM groups:

   • RmAdministrator

   • RmIntegrator

9. Click the Roles and Policies tab and then click the Realm Roles tab.

   The Roles table appears.

10. Expand Global Roles and click Roles.

    The Global Roles table appears.

11. Click New to add a new RM role.

    The Create a New Role for this Realm panel appears.

12. In the Name field, type RmAnalyst.

13. Click OK.

14. Repeat steps 12 through 14 to add the following RM roles:

    • RmAdministrator

    • RmIntegrator

15. Click RmAnalyst in the Global Roles table.

    The Edit Global Role panel appears.

16. Click Add Conditions.

17. Select Group from the Predicate List drop-down list.

18. Click Next.

19. In the Group Argument Name field, type RmAnalyst.

20. Click Add.

21. Click Finish.

22. Click Save.

23. Repeat steps 16 through 23 for the following RM roles by selecting the corresponding group:

    • RmAdministrator

    • RmIntegrator

24. Click the Users and Groups tab and then click the Users tab.

    The Users table appears.

25. Click New to add a new RM user.

    The Create a New User panel appears.

26. In the Name field, type RmAnalyst.

27. Enter a password for the user in the Password field and reconfirm the password in the Confirm Password field.

28. Click OK.

29. Click RmAnalyst in the Users table.

    The Settings for RmAnalyst panel appears.

30. Click the Groups tab.

31. Double-click the RmAnalyst group under the Available section.

    The RmAnalyst group moves under the Chosen section.

32. Click Save.

    The RmAnalyst group is assigned to the RmAnalyst user.

33. Repeat steps 25 through 33 for the following users:

    • RmAdministrator

    • RmIntegrator

8.2 Masking-off the Sensitive Information

You can mask the custom attributes of relationship and entity instances including ID field of the entity.

To mask the sensitive information, configure the sensitive fields in <Relationship Management project>\config\ui\uiConfig.js.

The following example shows masking configuration for entity type:

entityTypes: {
   USPatient:   {shape: 'human', color: 'green', sensitive_fields ['SSN' , 'ID']},
   ...
}

The following example shows masking configuration for relationship type:

relationshipTypes: {
   'primary-care-physician-of': {color: '#3385b7', sensitive_fields :[ '<attribute name>']},
   ...
}

The masked value for a field configured as sensitive is displayed as *****.

8.3 Enabling SSL

Oracle recommends that you secure RM APIs and application using SSL. To do so, you must configure SSL in WebLogic server. For more information on how to configure WebLogic SSL, see Oracle Fusion Middleware Administering Security for Oracle WebLogic Server 12.1.3.