Contents

List of Tables

Title and Copyright Information

Send Us Your Comments

Preface

• Audience
• Customer Support
• Improved Process for Oracle Retail Documentation Corrections
• Oracle Retail Documentation on the Oracle Technology Network
• Conventions

1 General Security Principles

• Web Services Security or WS-Security
• Aspects of Web Services Security
  • Authentication
  • Authorization (or Access Control)
  • Confidentiality (or Privacy)
  • Integrity (or Non Repudiation)
• SOA Security in Practice
• WS-Security Standards / Web Services Security Concepts
  • Standard Industry Approach
  • WS-Policy
  • WS-Security
  • WS-Trust
  • WS-SecureConversation
  • WS-ReliableMessaging
  • WS-AtomicTransactions
• Oracle WSM Principles
  • Define
  • Enforce
  • Monitor
• Types of Security
• Security Options in WebLogic
  • Transport-level Security
  • Message-level Security
  • Access Control Security
• Oracle Services Bus Security
  • Inbound Security
  • Outbound Security
  • Options for Identity Propagation
• Security Policies
  • Identifying the Different Parts of a Policy Name
  • When Should You Use Oracle WS-Security Policies?
  • Are WebLogic Policies and Oracle WSM Policies compatible?

2 Retail Service Backbone Security

• Recommended Security Approach for RSB
  • Edge App Services
  • Decorator Services
    • Active-Intermediary
    • Pass-Through
• Oracle Retail Enterprise Level Out-of-the-Box Certified Policies
  • Policy A (Default Policy)
  • Policy B

3 Installation Overview

• Installing Infrastructure Components
• Assumptions / Prerequisites
• Secure Installation and Configuration
• Pre-Installation Steps
• Configuring Security for Policy A
  • Securing Edge Application Services with Policy A
    • Enabling the HTTPS Port
    • Configuring and Using Authentication
    • Configuring and Using Security Policies
    • Securing Decorator Services with Policy A
  • Configuring Security Using rsb-home
    • Configuring Security (In Brief) Using rsb-home
  • Consumer Side Configuration for Policy A
    • Consumer Side Configuration for Policy A (PLSQL Apps)
  • Post Installation Steps
    • Verify Policy Using the Retail Integration Console
    • Verify Policy Using a SOAP User Interface
• Configuring Security for Policy B (Message Protection)
  • Securing Edge Application Services with Policy B
    • Generating Key Store and Certificates
    • Configuring the WebLogic Server to Use the Certificates
    • Configuring and Using Authentication
    • Configuring and Using Security Policies
    • Exporting the Certificate
  • rsb-home and OSB Side
  • Configuring Consumer Side (Policy B)
  • Policy B Consumer in WebLogic Server
  • Post Installation Steps
    • Verifying Policy Using the Retail Integration Console
    • Verifying Policy Using the OSB Console
    • Verifying Policy Using the Java Code

4 Troubleshooting

• Error Getting Response; java.net.SocketException: Connection Reset
  • Description
  • Solution
• SOAP Response is ”Unknown Exception, Internal System Processing Error”
  • SOAP Response
  • Solution
• SOAP Response is ”Error on Verifying Message Against Security Policy Error Code: 1025"
  • SOAP Response
  • Solution
• Only SOAP UI 4.5.1 Works With Secured Decorators
  • Solution
• Null Pointer Exception
  • Solution
• Useful Commands for Troubleshooting Security Issues
  • JVM Parameters for SSL Debug
  • Location Identity and Trust Stores for WebLogic
  • Generate a Certificate for Development Purposes
  • Import the Certificate to DemoIdentity Keystore
  • Keytool Commands
  • Location of Java Keystore

5 Security Considerations for Developers

• Oracle Retail Web Service Security General Principles
  • Technical Guidelines and Standards

A Sample Java Policy A Client Program

B Sample Java Policy B Consumer Using WebLogic Policy

C Sample Java Policy B Consumer Using OWSM Client Policy