Securing the Data Relationship Management Web Services

It is important to protect the DrmService and DrmGovernanceService Web services using a security policy in Oracle Web Services Manager. Different policies may be attached depending on usage.

The Oracle Data Relationship Management SOAP Web Services EAR, oracle-epm-drm-webservices.ear, now requires HTTPS transport for the following endpoints:

  • /oracle-epm-drm-webservices/DrmService

  • /oracle-epm-drm-webservices/DrmGovernanceService

Note:

  • Plain HTTP access is no longer supported for these SOAP services.

  • You must configure the WebLogic or Oracle HTTP Server (OHS) or Load Balancer endpoint that hosts the Data Relationship Management SOAP Web Services application with a valid server certificate and access the SOAP endpoints using https://

Note:

  • You must use the HTTPS as a mandatory for the endpoint, a valid server certificate is required, and client machines must trust the server certificate.

  • SOAP clients should use HTTPS URLs, for example:

    • https://<host>:<ssl-port>/oracle-epm-drm-webservices/DrmService

    • https://<host>:<ssl-port>/oracle-epm-drm-webservices/DrmGovernanceService

  • Client machines must trust the certificate chain presented by the server.

  • No client certificate is required unless mutual TLS is separately configured.

  • Existing Data Relationship Management SOAP authentication behavior is unchanged. Clients still call beginSession and use the returned session value for subsequent SOAP requests.

  • If SSL is terminated at OHS or a load balancer before forwarding to WebLogic, the deployment must be configured so WebLogic recognizes the original external request as HTTPS; otherwise the web application’s confidential transport constraint may reject or redirect requests unexpectedly.

The following policies can be used with the Data Relationship Management Web services:

Purpose Policy

Integration with Oracle Hyperion Financial Data Quality Management, Enterprise Edition

oracle/wss_username_token_service_policy or oracle/wss_username_token_service_policy (applies to DrmService only)

Integration with E-Business Suite General Ledger

oracle/wss_username_token_service_policy (applies to DrmService only)

Integration with Oracle Fusion Accounting Hub

oracle/wss_saml_or_username_token_service_policy (applies to DrmService only)

Workflow Development Kit

oracle/wss11_saml_or_username_token_with_message_protection (applies to DrmService only)

Custom API Programs or Integrations

One of the following (applies to DRMService and DRMGovernanceService):

  • oracle/wss11_saml_or_username_token_with_message_protection

  • oracle/wss_username_token_service_policy

  • oracle/wss_saml_or_username_token_service_policy

  • oracle/wss_http_token_service_policy

Note:

  • You must update existing integrations that call DRM SOAP Web Services to use the HTTPS endpoint instead of HTTP.

  • You must review the following assets for hard-coded http://<host>/oracle-epm-drm-webservices/... URLs:

    • SOAP client configuration files

    • Integration scripts

    • Scheduled jobs

    • Middleware connection profiles

See "Attaching Policies to Web Services" in Oracle Fusion Middleware Security and Administrator's Guide for Web Services.