This chapter describes recommended deployment configurations for your Oracle Communications Pricing Design Center (PDC) installation that enhance security.
For information about installing PDC, see PDC Installation and System Administration Guide.
You can install PDC in the following modes:
Silent
Secured
The silent installation is not meant for production environments, and it should be used only in test environments for setting up quickly or backing up the properties for later use in another test environment.
The secured installation is the only recommended option for production environments. See "Installing Pricing Design Center" for more information.
PDC is supported on Linux 6UL6+ and 7UL2+ (both Oracle Enterprise Linux and Red Hat Enterprise Linux) and Oracle Solaris for SPARC (10 Update 4+ and 11 Update 3+). See the following documents for more information:
Guide to the Secure Configuration of Red Hat Enterprise Linux 6 and 7 at
Hardening Tips for the Red Hat Enterprise Linux 6 and 7 at
Oracle Solaris 10 and 11 System Hardening References at
This section describes the security configurations during pre-installation and installation of PDC.
Perform the following pre-installation tasks:
Verify that you have Oracle WebLogic Server installed.
Enable SSL for the target WebLogic server domain, configure the server keystore certificate, and then get the client keystore trusted certificate (.jks file). You provide the path to this client-side keystore file during PDC installation to enable secure communication for PDC.
If SSL is already enabled, ensure that the keystore file is created in a secure drive and access is strictly limited to the user account.
Configure Oracle Database advanced security encryption and integrity algorithms for a secure connection from the installer. See the Oracle Database documentation for advanced security configuration parameters. This is required for a PDC installer to make a secured (encrypted) database connection over the network. For more details, see Oracle Database Advanced Security Administrator's Guide 12c Release.
Verify that you have JDK 1.8.0_172 or later installed.
During PDC installation, select SSL mode and provide the client keystore certificate (.jks file) for connecting to a WebLogic server over SSL.
The following logs are generated after the PDC installation.
Location: oraInventory/logs/
The default location of the oraInventory directory is in the /etc/oraInst.loc (Linux) file or the /var/opt/oracle/oraInst.loc (Solaris) file.
-rw-r----- 1 user1 eng 480058 Aug 15 09:25 installActions2011-08-15_08-06-57AM.log -rw-r----- 1 user1 eng 2384 Aug 15 10:33 dbScripts2011-08-15_10-32-00AM.log-rw-r----- 1 user1 eng 124268 Aug 15 10:33 oraInstall2011-08-15_10-27-07AM.err
installActionTimeStamp.log and oraInstallTimeStamp.err will have details in clear-text form entered in the PDC installation wizards. Passwords entered in the wizard are not logged in any of the PDC installation logs. Delete these installation log files if you do not need them for future reference, otherwise protect them appropriately if you do require them. These log files are created with the file level permission 640 (owner can read/write, group members can read, others cannot do anything) by default.
PDC user permissions depend on the group the user belongs to. The following groups are created in the WebLogic server during PDC installation:
Pricing Design Admin
Pricing Reviewer
Pricing Analyst
Migration Admin
The users belonging to the Pricing Design Admin group have read and write access and can perform any kind of operation from the PDC UI.
The users belonging to the Pricing Reviewer group have read-only access to the pricing and setup components.
The users belonging to the Pricing Analyst group have read and write access to all pricing components and read-only access to setup components.
The users belonging to the Migration Admin group can migrate pricing data from the BRM database to the PDC database.
None of the users by default is authorized to access PDC. The WebLogic server administrator must create an account for each intended user by creating the user in the WebLogic Server Administration Console and adding the user to one of the above groups depending on the user role.
Do not use your browser's Remember Password feature for the WebLogic Server Administration Console URL. Always enter the WebLogic server user name and password manually in the login page, as a precaution.
Oracle recommends deploying PDC only on SSL, which encrypts sensitive data, thus eliminating problems like session stealing.
A common Web security problem is session stealing. This happens when an attacker manages to get a copy of your session cookie, generally while the cookie is being transmitted over the network. This can only happen when the data is being sent in clear-text format; that is, the cookie is not encrypted.
WebLogic Server allows a user to securely access HTTPS resources in a session that was initiated using HTTP, without loss of session data.
To use secure cookies:
Open the MW_Home/user_projects/domains/Domain_Name/config/config.xml file.
where:
MW_Home is the directory in which the Oracle Middleware components are installed.
Domain_Name is the name of the domain you are configuring.
Add AuthCookieEnabled="true" to the <WebServer> element.
<WebServer Name="myserver" AuthCookieEnabled="true"/>.
You can also set this entry using the WebLogic Server Administration Console:
Log in to WebLogic Server Administration Console.
The home page appears.
In the Domain Configurations section, under Domain, click Domain.
The Settings for Domain_Name page appears.
Click the Web Applications tab.
Verify that the Auth Cookie Enabled check box is selected.
Click Save.
By default, the Auth Cookie Enabled check box is selected, but it is not present in the config.xml file. If you deselect it, the <AuthCookieEnabled> element is added to the config.xml file.
Setting AuthCookieEnabled to true, which is the default setting, causes the WebLogic Server instance to send a new secure cookie, _WL_AUTHCOOKIE_JSESSIONID, to the browser when authenticating through an HTTPS connection. After the secure cookie is set, the session is allowed to access other security-constrained HTTPS resources only if the cookie is sent from the browser.
For more information, see "Using Secure Cookies to Prevent Session Stealing" on the Oracle Technology Network Web site:
http://download.oracle.com/docs/cd/E12840_01/wls/docs103/security/thin_client.html#wp1053780
Oracle recommends keeping cookies enabled in the browser. Disabling cookies in the browser disables several features, such as Help.
The default session timeout in PDC is 10 minutes. The WebLogic Server administrator can change this value after deployment by doing the following:
Log in to WebLogic Server Administration Console.
In the Domain Structure section, click Deployments.
Click on the application PricingDesignCenter deployed as type Enterprise Application.
The deployment settings for PricingDesignCenter appear.
Click the Configuration tab.
Set Session Timeout (in seconds): to the new timeout value, in seconds.
Click the Overview tab.
In the Modules and Components table, click PricingDesignCenter.
Click the Configuration tab.
Set Session Timeout (in seconds): to the same timeout value, in seconds, set in step 5.
Click Save.
If no deployment plan is created, WebLogic Server creates one with the above changes and prompts you to save the deployment plan. Provide the name and path for the deployment plan and click OK.
In the Domain Structure section, click Deployments.
Select the application PricingDesignCenter deployed as type Enterprise Application.
The Update button is enabled.
Click Update.
Select Update this application in place with new deployment plan changes.
Set Deployment plan path to the deployment plan created in steps 2 through 10. Click the Change Path button to browse to the file.
Click Next.
Click Finish.
Restart WebLogic Server.
Verify your changes by doing the following:
Log in to WebLogic Server Administration Console.
In the Domain Structure section, click Deployments.
Click on the application PricingDesignCenter deployed as type Enterprise Application.
The deployment settings for PricingDesignCenter appear.
Click the Configuration tab.
Verify that Session Timeout (in seconds): is set to the value you have provided.
For more information, see "Configuring Applications for Production Deployment" on the Oracle Technology Network Web site:
http://download.oracle.com/docs/cd/E12840_01/wls/docs103/deployment/config.html
Following are the default permissions set for the installed files:
rw------- 600 (for all nonexecutable files)
rwx------ 700 (for all executable files)
Permissions are set to the lowest possible level, and the WebLogic Server administrator can add or revoke permissions. Oracle recommends keeping the permissions as restrictive as possible, as per your business needs.
The WebLogic Server configuration (JMS, JDBC, etc) file, config.xml, in the domain's configuration directory should be protected with proper permissions.
Output files generated by the export utility should be stored in a protected directory because it may contain sensitive pricing information.
The following files remain in the system after uninstalling PDC:
Install logs:
Location: oraInventory/logs/
-rw-r----- 1 user1 eng 480058 Aug 15 09:25 installActions2011-08-15_08-06-57AM.log -rw-r----- 1 user1 eng 0 Aug 15 10:27 oraInstall2011-08-15_10-27-07AM.out-rw-r----- 1 user1 eng 2384 Aug 15 10:33 dbScripts2011-08-15_10-32-00AM.log-rw-r----- 1 user1 eng 124268 Aug 15 10:33 oraInstall2011-08-15_10-27-07AM.err
PDC_Home/oui/data.properties: This file is used to auto-populate the data during re-installs.
Delete these files manually if you do not need them or protect them appropriately if they are required for future reference.
These files are created with the file permission 640 (owner can read/write, group members can read, others cannot do anything) by default.
When you install PDC, the passwords that you enter for the WebLogic Server domain, the PDC user, the transformation cross-reference database, the migration cross-reference database, and the BRM database are automatically encrypted. These encrypted passwords are stored in the PDC utility configuration files. The encryption keys for the encrypted passwords are stored in a keystore.
You use the encrypt utility to update the encrypted passwords in the PDC utility configuration files. See the discussion about changing encrypted passwords in the configuration files in PDC Installation and System Administration Guide for more information.
A keystore is a file-based credential store that contains the encryption keys for the encrypted passwords. In PDC, the pdc.jks file is used as the keystore.
Each encryption key in a keystore has an alias key and is password protected. The keystore is also password protected.
The PDC Installer prompts you to enter the following when you install PDC and BRM Integration Pack:
The encryption key password for accessing the PDC alias key in the keystore.
The password used for accessing the keystore (pdc.jks).
The PDC Installer creates the pdc.jks file in the following locations:
For PDC: PDC_Home/apps/conf
For BRM Integration Pack: BRM_Integration_Pack_Home/apps/conf
The pdc.jks file is used by the following utilities:
ImportExportPricing
SyncPDC
BRETransformer and RRETransformer (transformation engines)
MigrateBRMPricing
When you run any of these utilities, the utility gets the encrypted password from its configuration file and prompts you for the encryption key password to access the encryption keys from the pdc.jks file. The utility then uses the encryption key from the pdc.jks file to decrypt the encrypted password.
For more information about the PDC utilities and their corresponding configuration files, see PDC User's Guide and PDC Pricing Migration Guide.