Oracle® Communications
Unified Inventory Management

Security Guide

Release 7.4

E88054-01

December 2017

Oracle Communications Unified Inventory Management Security Guide, Release 7.4

E88054-01

Copyright © 2013, 2017, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

Preface

- Audience

- Related Documentation

- Documentation Accessibility

1 UIM Security Overview

- Basic Security Considerations

- Understanding the UIM Environment

- Overview of UIM Security

- Recommended Deployment Scenarios

- Operating System Security

- Firewall Port Configuration

- Oracle Database Security

- Data Encryption

- Secure Database Connections

- SSL Authentication

- WebLogic Server Security

- Authorization

- WebLogic Resources

- Security Policies

- Secure Sockets Layer (SSL)

- Logging Security

- Oracle Security Documentation

2 Performing a Secure UIM Installation

- Installing UIM Securely

- About Password Policies

- Post-Installation Configuration

- Setting Up User Accounts to Lock and Expire

3 Implementing UIM Security

- Configuring and Using Authentication

- Java Authentication and Authorization Service

- About Callback Handlers

- Configuring and Using Access Control

- Configuring and Using Security Audit Logs

- Secure Access to UIM Web Services

- Managing UIM Security

4 Security Considerations for Developers

- About UIM Security Policies

- About Securing UIM APIs

- About Securing Entity Data

- About Securing Web Services

A UIM Secure Deployment Checklist

- Secure Deployment Checklist

Preface

This guide provides guidelines and recommendations for setting up Oracle Communications Unified Inventory Management (UIM) in a secure configuration.

Audience

This guide is intended for system administrators, database administrators, developers, and integrators, who work with UIM.

Related Documentation

For more information, see the following documents in Oracle Communications Unified Inventory Management documentation set:

- UIM Installation Guide: Describes the requirements for installing UIM, installation procedures, and postinstallation tasks.

- UIM System Administrator's Guide: Describes administrative tasks such as working with cartridges and cartridge packs, maintaining security, managing the database, configuring Oracle Map Viewer, and troubleshooting.

- UIM Concepts: Provides an overview of important concepts and an introduction to using both UIM and Design Studio.

- UIM Developer's Guide: Explains how to customize and extend many aspects of UIM, including the data model, life-cycle management, topology, security, rulesets, user interface, and localization.

- UIM Web Services Developer's Guide: Describes the UIM Service Fulfillment Web Service operations and how to use them, and describes how to create custom Web services.

- UIM API Overview: Provides detailed information and code examples of numerous APIs presented within the context of a generic service fulfillment scenario, and within the context of a channelized connectivity enablement scenario.

- UIM Information Model Reference: Describes the UIM information model entities and data attributes, and explains patterns that are common across all entities.

- Oracle Communications Information Model Reference: Describes the Oracle Communications information model entities and data attributes, and explains patterns that are common across all entities. The information described in this reference is common across all Oracle Communications products.

- UIM Cartridge Guide: Provides information about how you use cartridges and cartridge packs with UIM. Describes the content of the base cartridges.

- UIM NFV Orchestration Implementation Guide: Provides information about the NFV Orchestration functional module and includes how to you install, use, and extend this functionality. This guide also provides reference information for the NFV Orchestration RESTful APIs.

For step-by-step instructions for performing tasks, log in to each application to see the following:

- Design Studio Help: Provides step-by-step instructions for tasks you perform in Design Studio.

- UIM Help: Provides step-by-step instructions for tasks you perform in UIM.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

1 UIM Security Overview

This chapter provides an overview of Oracle Communications Unified Inventory Management (UIM) security.

Basic Security Considerations

The following principles are fundamental to using any application securely:

- Keep software up to date. This includes the latest product release and any patches that apply to it.

- Limit privileges as much as possible. Users should be given only the access necessary to perform their work. User privileges should be reviewed periodically to determine relevance to current work requirements.

- Monitor system activity. Establish who should access which system components, how often they should be accessed, and who should monitor those components.

- Install software securely. For example, use firewalls, secure protocols (such as SSL), and secure passwords. See Chapter 2, "Performing a Secure UIM Installation" for more information.

- Learn about and use UIM security features. See Chapter 3, "Implementing UIM Security" for more information.

- Use secure development practices. For example, take advantage of existing database security functionality instead of creating your own application security. See Chapter 4, "Security Considerations for Developers" for more information.

- Keep up to date on security information. Oracle regularly issues security-related patch updates and security alerts. You must install all security patches as soon as possible. See ”Critical Patch Updates and Security Alerts” on the Oracle Web site:
http://www.oracle.com/technetwork/topics/security/alerts-086861.html

Understanding the UIM Environment

When planning your UIM implementation, consider the following:

- Which resources must be protected? For example:

- You must protect customer data.

- You must protect internal data, such as proprietary source code.

- You must protect system components from being disabled by external attacks or intentional system overloads.

- Who are you protecting data from?
For example, if your business has service subscribers, you must protect their data from other subscribers, but someone in your organization might have to access that data to manage it. You can analyze your workflows to determine who needs access to the data; for example, a system administrator could manage your system components without needing to access the system data.

- What happens if protections on strategic resources fail?
In some cases, a fault in your security scheme is nothing more than an inconvenience. In other cases, a fault might cause great damage to you or your customers. Understanding the security ramifications of each resource helps you protect it properly.

Overview of UIM Security

Figure 1-1 shows all the various components that can comprise UIM, including the components to which it connects. Each installed or integrated component requires special steps and configurations to ensure system security.

Figure 1-1 UIM Components

Recommended Deployment Scenarios

Figure 1-2 shows a single server deployment scenario: the simplest UIM deployment architecture.

Figure 1-2 Single Sever Deployment

In this scenario, all the application components and data are kept on a single system, protected from external attacks by a firewall. The firewall can be configured to block known illegal traffic types. There are fewer resources to secure because all the components are on a single system and all the communication is local. Fewer ports have to be opened through the firewall.

Conversely, there are fewer points of attack, and if security is compromised, an attacker would have access to the entire system and data.

A single server deployment is best suited for test and lab environments.

A single server deployment is cost effective for small organizations but does not provide high availability because all components are stored on a single system.

Figure 1-3 shows a clustered server deployment: a scalable UIM deployment offering greater security and high availability.

Figure 1-3 Clustered Server Deployment

In this scenario, the application tier is isolated by firewalls from both the Internet and the intranet. The database and servers are protected from potential attacks by two layers of firewall. Both firewalls can be configured to block known illegal traffic types. The two layers of firewall provide intrusion containment. Although there are a greater number of components to secure, and more ports have to be opened to allow secure communication between the tiers, the attack surface is spread out.

Operating System Security

This section lists UIM-specific operating system security configurations. This section applies to all supported operating systems.

Firewall Port Configuration

UIM communicates through the firewall with various components on specific ports. Ensure that the operating system IPtables for the firewalls are configured to manage traffic on the following ports:

- Port 22 (optional, both directions): Used by the File Transfer and Parsing cartridge for SSH communication. Close this port if you are not using the File Transfer and Parsing cartridge.

- WebLogic Server SSL listen ports (both directions): Used by Administration and Managed servers for listening for traffic.

- Oracle Database listener ports: Used to listen for Oracle Database traffic.

Close all unused ports, especially non-SSL ports. Opt for SSL-enabled ports, instead of non-SSL ports, for all communications (for example: HTTPS, IIOPS, t3s).

For more information about securing your operating system, see your operating system documentation.

Oracle Database Security

This section lists the UIM-specific security configurations for the Oracle Database:

- Data Encryption

- Secure Database Connections

For more information about securing Oracle Database, see Oracle Database Security Guide and Oracle Database Advanced Security Administrator's Guide.

Data Encryption

If your database connection is not configured to use data encryption, data is sent across the network in a format that is designed for fast transmission and can be decoded by interceptors given some time and effort.

It is also possible (but not recommended) to encrypt the UIM tablespace and schema, at the expense of system performance. Encrypting the schema and tablespace is not necessary, because the database is sufficiently secure without the encryption.

See Oracle Database Advanced Security Administrator's Guide for more information.

Secure Database Connections

Encrypting network data is a critical security measure that ensures that data traveling over the network is difficult to intercept and access. Secure network connections to the Oracle Database using the Oracle Advanced Security feature. You can configure the Oracle Database with either Network Data Encryption and SSL authentication, as both ensure that the data is secure while traveling over the network.

The Oracle Advanced Security feature also provides security against the following types of attacks:

- Data modification attack, where an unauthorized party intercepts data in transit over the network, alters it, and transmits the altered data to the database.

- Replay attack, where an unauthorized party repeatedly transmits entire sets of valid data.

SSL Authentication

Use the Oracle Advanced Security feature to enable SSL authentication, using a digital certificate, on data that travels over the network to the database. See Oracle Database Advanced Security Administrator's Guide for more information.

Using SSL authentication allows UIM to communicate with servers over an encrypted connection and to communicate with the database over an encrypted connection.

SSL authentication supports the following authentication modes:

- Only the server authenticates itself to the client.

- Both client and server authenticate themselves to each other.

- Neither the client nor the server authenticate with each other (SSL encryption feature by itself).

WebLogic Server Security

For information about securing WebLogic Server, see Oracle Fusion Middleware Securing a Production Environment for Oracle WebLogic Server.

Authorization

Authorization is the process where the interactions between users and WebLogic Server resources are controlled, based on user identity or other information. In WebLogic Server, an Authorization provider is used to limit the interactions between users and WebLogic resources to ensure integrity, confidentiality, and availability.

For more information about changing WebLogic Server passwords, see the WebLogic Server Administration Console Help.

WebLogic Resources

A WebLogic Server resource is a structured object used to represent an underlying WebLogic Server entity, which can be protected from unauthorized access using security roles and security policies.

WebLogic resources are hierarchical. Therefore, the level at which you define these security roles and security policies is up to you. For example, you can define security roles and security policies on entire enterprise applications; an Enterprise Java Bean JAR containing multiple EJBs; a particular Enterprise Java Bean (EJB) within that JAR; or a single method within that EJB.

Security Policies

Security policies replace access control lists and answer the question ”Who has access to a WebLogic server resource?” A security policy is created when you define an association between a WebLogic resource and one or more users, groups, or security roles. You can optionally define date and time constraints for a security policy. A WebLogic resource has no protection until you assign it a security policy.

Security policies are stored in an authorization provider's database. By default, the XACML Authorization provider is configured in a domain, and security policies are stored in the embedded LDAP server.

To use a user or group to create a security policy, the user or group must be defined in the security provider database for the authentication provider that is configured in the default security realm. To use a security role to create a security policy, the security role must be defined in the security provider database for the Role Mapping provider that is configured in the default security realm. By default, the authentication and XACML Role Mapping providers are configured in the database in the embedded LDAP server. Also by default, security policies are defined in WebLogic Server resources. These security policies are based on security roles and default global groups. You also have the option of basing a security policy on a user.

Secure Sockets Layer (SSL)

SSL enables secure communication between applications connected through the Web. WebLogic Server fully supports SSL communication. By default, WebLogic Server is configured for one-way SSL authentication. Using the WebLogic Server Administration Console, you can configure WebLogic Server for two-way SSL authentication.

- To use one-way SSL from a client to a server, enable the SSL port on the server, configure identity for the server and trust for the client.

- To use two-way SSL between a client and a server, enable two-way SSL on the server, configure trust for the server, and identity for the server.
In either case, the trusted CA certificates must include the trusted CA certificate that issued the peer's identity certificate. This certificate does not necessarily have to be the root CA certificate.

To acquire a digital certificate for your server, generate a public key, private key, and a Certificate Signature Request (CSR), which contains your public key. Send the CSR request to a certificate authority and follow their procedures for obtaining a signed digital certificate.

After you have your private keys, digital certificates, and any additional trusted CA certificates that you may need, you must store them so that WebLogic Server can use them to verify identity. Store private keys and certificates in keystores.

For more information on security fundamentals, see the Oracle Fusion Middleware documentation:

http://docs.oracle.com

Logging Security

Oracle recommends a Logging level of ERROR for Logging Services. An explicit administrative action is required to change the log level. See UIM Developer's Guide for more information. When the log levels are set to DEBUG or lower, the log levels can contain raw exceptions and stack traces that could be exploited to compromise the security of your UIM system.

Oracle Security Documentation

UIM uses other Oracle products, such as Oracle Database and Oracle WebLogic Server. See the following documents, as they apply to UIM:

- Oracle Database Security Guide

- Oracle Fusion Middleware Securing a Production Environment for Oracle WebLogic Server

- Oracle Application Server Security Guide

- Oracle Application Server Administrator's Guide

2 Performing a Secure UIM Installation

This chapter presents planning information for your Oracle Communications Unified Inventory Management (UIM) system and describes recommended installation scenarios that enhance security.

For more information about installing UIM, see UIM Installation Guide.

Installing UIM Securely

You can perform a custom installation or a typical installation. Oracle recommends that you perform a custom installation to avoid installing options and products you do not need. However, you can perform a typical installation, and remove or disable features you do not need after the installation is complete.

When installing UIM, do the following:

- When creating the WebLogic Server domain for UIM:

- Make sure that SSL ports are being used on the Administration Server and all Managed servers.

- If installing UIM on a cluster of servers, configure the cluster addresses to use SSL ports.

- After you have created the WebLogic Server domain for UIM, start the Administration Server. Then, use t3s to start the Managed servers:

startManagerServer.sh ManagedServer_1 t3s://host_name

where ManagedServer_1 is the name of the first Managed server, and host_name is the host name of the Administration server.

- Using the WebLogic Server Administration Console, configure Certificate Identity and trust store to use SSL. Do not use the default demonstration certificate that comes with WebLogic Server. See the WebLogic administrator's documentation for more information.

- During the installation of UIM, on the Disable Unsecured Listen Port window of the Oracle Universal Installer, select the Disable all the non-SSL ports check box to secure all communication between components, and JCA and JMS collection, over SSL ports.

About Password Policies

Oracle recommends having strong password policies for UIM and database schema users. Consider enforcing the following password policies:

- Minimum length of password is 8 characteristics.

- Password must contain at least one digit, one capital letter, and one special character. For example, WebLogic@123.

- The user name must not be part of the password.

Stricter rules can be set for the authentication provider using the WebLogic Server Administration Console. For details on authentication providers and their configuration, refer to WebLogic administrator documentation.

See UIM System Administrator's Guide for information about changing and setting UIM passwords.

Post-Installation Configuration

This section explains security configurations to complete after UIM is installed.

Setting Up User Accounts to Lock and Expire

Create UIM user accounts to lock after a certain number of failed log in attempts, and to expire after a certain amount of idle time.

See UIM System Administrator's Guide for information about changing and setting UIM passwords.

3 Implementing UIM Security

This chapter explains the security features of Oracle Communications Unified Inventory Management (UIM).

Configuring and Using Authentication

Authentication is the mechanism by which users provide specific information as a proof of having access to a system. Authentication answers the question ”Who are you?” using credentials such as user name and password.

In Oracle WebLogic Server, authentication providers are used to prove the identity of users or system processes. Authentication providers also remember, transport, and make identity information available to various components of a system when needed. During the authentication process, a principal validation provider provides additional security protection for the principals (users and groups) contained within the subject by signing and verifying the authenticity of those principals.

Upon installation, UIM uses the WebLogic-embedded Lightweight Directory Access Protocol (LDAP) as the authentication provider. However, you can use any WebLogic-supported authentication provider, such as Oracle Internet Directory (OID), Relational Database Management System (RDBMS), or Security Assertion Markup Language (SAML).

Note:
If your UIM environment requires high-grade security and your user base is high (over 10,000 users), Oracle recommends you use an external LDAP such as OID.

UIM uses user name and password authentication. See UIM System Administrator's Guide for more information.

Whether UIM is configured to communicate with WebLogic Server over HTTP or HTTPS, login authentication is always sent over a secured HTTPS channel.

If you are using a Web services interface, authentication details are supplied with each request using the Username token header. See UIM Web Services Developer's Guide for more information.

Java Authentication and Authorization Service

WebLogic Server uses the Java Authentication and Authorization Service (JAAS) classes to authenticate to the client, whether the client is an application, applet, Enterprise JavaBean, or servlet that requires authentication.

JAAS implements a Java version of the Pluggable Authentication Module (PAM) framework, which permits applications to remain independent from underlying authentication technologies. Therefore, the PAM framework allows the use of new or updated authentication technologies without requiring modifications to the application.

About Callback Handlers

A callback handler is a flexible JAAS standard that allows a variable number of arguments to be passed as complex objects to a method.

There are three types of callback handlers: NameCallback, PasswordCallback, and TextInputCallback, all of which are part of the javax.security.auth.callback package. NameCallback and PasswordCallback return the user name and password, respectively. You can use TextInputCallback to access the data users enter into any additional fields on a login form (that is, fields other than those for obtaining the user name and password). When used, there should be one TextInputCallback per additional form field, and the prompt string of each TextInputCallback must match the field name in the form. WebLogic Server uses only the TextInputCallback for form-based Web application login.

An application implements a callback handler and passes it to underlying security services so that they may interact with the application to retrieve specific authentication data, such as user names and passwords, or to display certain information, such as error and warning messages.

Callback handlers are implemented in an application-dependent fashion. For example, implementations for an application with a UI may prompt users for requested information, or display error messages. An implementation may also choose to obtain requested information from an alternative source without asking the user.

Underlying security services make requests for different types of information by passing individual call backs to the callback handler. The callback handler implementation decides how to retrieve and display information depending on the call backs passed to it.

Configuring and Using Access Control

Authorization is used to control access by:

- Permitting only certain users to access a resource or action

- Applying varying limitations on user access or actions

Upon installation, UIM defines the uimuser role. This is a super role that grants access to all UIM resources, so the role should not be granted to everyone. Rather, Oracle recommends that you define your own application roles to restrict access to UIM resources.

The uimuser role is part of the uim-users WebLogic Server group. To access UIM, a user must be assigned a role that is part of the uim-users group. If a user is not assigned a role that is part of the uim-users group, after successful authentication, the user encounters the following error:

Error 403 - Access Forbidden error. For details on Group Management, see the WebLogic Server Administration Console Help.

Configuring and Using Security Audit Logs

For information about configuring and using security audit logs in Oracle WebLogic Server, see:

http://docs.oracle.com/middleware/1221/wls/SECMG/toc.htm

Secure Access to UIM Web Services

The Web services API is standards based using JAX-RPC over HTTPS. The UIM Web services API uses the same security access level as the UIM UI. So any user able to log in to UIM can also use the Web Service API.

Managing UIM Security

UIM System Administrator's Guide contains information on the following security management topics:

- Authentication

- Password management

- Authenticating Web services

- Authorization

- Security roles and policies

- Taskflow and resource permissions

- Application role management

- Application policy management

- Enabling Web service authentication at runtime

- Partitioning the database

4 Security Considerations for Developers

This chapter provides information for developers about how to create secure applications for Oracle Communications Unified Inventory Management (UIM) and how to extend UIM without compromising its security.

About UIM Security Policies

UIM uses ADF security for its UI resources (JSDD or JSPX), and protects them with the uimuser role. Users having this role can run create, read, update, and delete operations on these pages. These policies can be customized in Oracle Fusion Middleware Enterprise Manager.

About Securing UIM APIs

By default, UIM APIs are not secured. To secure an API, you must extend UIM security to include the APIs. This can be done by:

- Securing APIs through the SecurityValidation Aspect

- Securing APIs through rulesets and extension points

See UIM Developer's Guide for more information.

About Securing Entity Data

By default, UIM entity data is not secured. To secure entity data, you must extend UIM security to control data access to individual entities. This is done by creating custom rulesets that run at specified extension points. The custom rulesets set permissions or partitions for an entity, enforces any permissions or partitions that are set for an entity, and logs error messages whenever a security violation is detected.

See UIM Developer's Guide for more information.

About Securing Web Services

By default, the Service Fulfillment Web service has security enabled upon installation. Specifically, the HTTP and JMS Web service ports are associated to the default WebLogic security policy file, Auth.xml. As a result, a user name and password must be sent in clear text over a secure tunnel (HTTPS/t3s). You can modify the default security settings through the WebLogic Server Administration Console. See UIM Web Services Developer's Guide for more information.

When you create a custom Web service, it is up to you secure the Web service. How you secure the Web service depends upon how you created the Web service. For example, if your custom Web service deploys with the custom.ear file, you need to create your own deployment plan; if your custom Web service deploys with the inventory.ear file, you need to modify the inventory.ear deployment plan that is part of the UIM installation. See UIM Web Services Developer's Guide for more information.

A UIM Secure Deployment Checklist

The following security checklist lists guidelines to help you secure Oracle Communications Unified Inventory Management (UIM) and its components.

Secure Deployment Checklist

- Install only the components you require.

- Lock and expire default user accounts.

- Enforce strong password management.

- Enable data dictionary protection on the Oracle Database for UIM.

- Restrict, control, and revisit user privileges:

- Grant only the necessary privileges to each user.

- Revoke unnecessary privileges from the PUBLIC user group.

- Restrict permissions on run-time facilities.

- Enforce the use of access controls by using the Authorization Policies.

- Require clients to authenticate.

- Restrict network access by doing the following:

- Use firewalls.

- Never leave an unnecessary hole in a firewall.

- Password-protect the Oracle listener against remote access.

- Monitor listener activity.

- Monitor who accesses your systems.

- Restrict system access by IP addresses.

- Encrypt network traffic.

- Apply all security patches and workarounds.

- Encrypt sensitive information.

- Contact Oracle Security Products if you discover a vulnerability in any Oracle product.

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2019, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Pre-General Availability Draft Documentation Notice

If this document is in public or private pre-General Availability status:

This documentation is in pre-General Availability status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Pre-General Availability Draft Documentation Notice

If this document is in private pre-General Availability status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your pre-General Availability trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.