Performing a Secure Pricing Design Center Installation

Recommended Installation Mode

There are two types of installation modes: silent and secured.

The silent installation is not meant for production environments, and it should be used only in test environments for setting up quickly or backing up the properties for later use in another test environment.

The secured installation is the only recommended option for production environments.

Operating System Security

PDC is supported on Linux (both Oracle Enterprise Linux and Red Hat Enterprise Linux) and Windows Client. For the supported versions, see "PDC Software Compatibility" in BRM Compatibility Matrix. See the following documents for more information about operating system security:

Guide to the Secure Configuration of Red Hat Enterprise Linux
Hardening Tips for the Red Hat Enterprise Linux

Preinstallation Tasks

Perform the following preinstallation tasks:

Enable SSL for the target WebLogic server domain, configure the server KeyStore certificate, and then get the client KeyStore trusted certificate. This client KeyStore file should be used in installer to make secured connection during installation.
If SSL is enabled, ensure that the KeyStore file is created in a secure drive and access is strictly limited to the user account.
Configure Oracle Database advanced security encryption and integrity algorithms for a secure connection from the installer. See the Oracle Database documentation for advanced security configuration parameters. This is required for a PDC installer to make a secured (encrypted) database connection over the network. For more details, see the Oracle Database Advanced Security Administrator's Guide documentation.
Verify that you have the latest supported version of Oracle JDK installed.

Installation Tasks

Perform the following installation tasks:

During PDC installation, select SSL mode and provide the client KeyStore certificate for connecting to a WebLogic server over SSL.
The following logs are generated after the PDC installation.

Location: Oracle Inventory/logs/
```
-rw-r-----  1 user1 eng  480058 Aug 15 09:25 installActions2018-08-15_08-06-57AM.log 
-rw-r-----  1 user1 eng    2384 Aug 15 10:33 dbScripts2018-08-15_10-32-00AM.log
-rw-r-----  1 user1 eng  124268 Aug 15 10:33 oraInstall2018-08-15_10-27-07AM.err
```
The installActionsxxxxx.log and oraInstallxxxx.err files have details in clear text format that were entered in the PDC installation wizard. Passwords that were entered in the installation wizard are not logged in any of the PDC installation log files. Delete these installation log files if you do not need them for future reference. If you do require them, protect them appropriately. These log files are created with the file level permission 640 (owner can read/write, group members can read, others cannot do anything) by default.

Postinstallation Configuration

PDC user permissions depend on the group the user belongs to. The following three groups are created in the WebLogic server during PDC installation:
- Pricing Design Admin
- Pricing Reviewer
- Pricing Analyst
The users belonging to Pricing Design Admin group have read and write access and can perform any kind of operation from PDC User Interface.

The users belonging to Pricing Analyst group have read and write access to all pricing components and read only access to setup components.

The users belonging to Pricing Reviewer group have read only access to the pricing and setup components.

None of the users by default is authorized to access PDC. The WebLogic server administrator must create an account for each intended user by creating the user in the Oracle WebLogic Remote Console and adding the user to one of the above groups depending on the user role.
Do not use your browser's remember password feature for the WebLogic Remote Console URL. Always enter the WebLogic server user name and password manually on the login page as a precaution.

Using Secure Cookies

Note:

Oracle recommends deploying PDC only on SSL, which encrypts sensitive data, thus eliminating problems like session stealing.

A common Web security problem is session stealing. This happens when an attacker manages to get a copy of your session cookie, generally while the cookie is being transmitted over the network. This can only happen when the data is being sent in clear-text; that is, the cookie is not encrypted.

WebLogic Server allows a user to securely access HTTPS resources in a session that was initiated using HTTP, without loss of session data.

To use secure cookies:

Enable cookie authentication in WebLogic Server. See "Enabling Authentication Cookies".
Update your PDC deployment plan to use secure cookies. See "Updating Your PDC Deployment Plan".

Enabling Authentication Cookies

You can enable cookie authentication in two different ways: by editing the config.xml file or using the WebLogic Remote Console.

To enable cookie authentication through the config.xml file:

Open the config.xml file.

Add AuthCookieEnabled="true" to the WebServer element.

<WebServer Name="myserver" AuthCookieEnabled="true"/>

To enable cookie authentication using the WebLogic Remote Console:

Log in to the WebLogic Remote Console.
Click Edit Tree, then Environment, and then Domain.
Click the Web Application tab.
Verify that Auth Cookie Enabled is turned on.
Click Save.

By default, Auth Cookie Enabled is turned on, but it is not present in the config.xml file. If you turn it off, the <AuthCookieEnabled> element is added to the config.xml file.

Setting AuthCookieEnabled to true, which is the default setting, causes the WebLogic Server instance to send a new secure cookie, _WL_AUTHCOOKIE_JSESSIONID, to the browser when authenticating through an HTTPS connection. After the secure cookie is set, the session is allowed to access other security-constrained HTTPS resources only if the cookie is sent from the browser.

Oracle recommends keeping cookie settings enabled in the browser. Disabling cookies in the browser disables several features, such as Help.

Updating Your PDC Deployment Plan

To update your PDC deployment plan to use secure cookies:

Open the PDC_home/setup/plan.xml file in a text editor.

Add the following configuration under the <module-override> tag:

<module-override>     
   <module-name>BPA.war</module-name>     
   <module-type>war</module-type>
   <module-descriptor external="false">     
      <root-element>weblogic-web-app</root-element>
      <uri>WEB-INF/weblogic.xml</uri>     
      <variable-assignment>     
         <name>secure-cookie</name>
         <xpath>/weblogic-web-app/session-descriptor/cookie-secure</xpath>     
      </variable-assignment>
      <variable-assignment>    
         <name>url-rewriting-enabled-enable</name>
         <xpath>/weblogic-web-app/session-descriptor/url-rewriting-enabled</xpath>
         <operation>add</operation>     
      </variable-assignment>     
      <variable-assignment>
         <name>pdc-application-path</name>     
         <xpath>/weblogic-web-app/session-descriptor/cookie-path</xpath>
         <operation>add</operation>     
      </variable-assignment>     
   </module-descriptor>
</module-override>

Add the following configuration under the <variable-definition> tag:

<variable>    
   <name>secure-cookie</name>    
   <value>true</value>  
</variable>  
<variable>
   <name>pdc-application-path</name>    
   <value>/pdc;SameSite=strict</value>  
</variable>  
<variable>
   <name>url-rewriting-enabled-enable</name>    
   <value>false</value>  
</variable>  
<variable>
   <name>pdc-samesite</name>    
   <value>strict</value>  
</variable>

Save and close the file.
Redeploy the PDC application with your new plan.xml file.

For more information about updating and deploying your deployment plan, see the "Create and Use a Deployment Plan in Oracle WebLogic Server" tutorial.

Configuring the Session Timeout

The default session timeout in PDC is 10 minutes. Your WebLogic Server administrator can change this value after deployment by doing the following:

Log in to WebLogic Remote Console.
Click Monitoring Tree, then Deployments, and then Application Management.

A page with a list of installed Java EE applications and standalone application modules appears.
In the table, click PricingDesignCenter.

The information about PricingDesignCenter appears.
Click Configuration in the tree in the left pane.
Click Session Descriptor in the tree in the left pane.
In the Session Timeout (in seconds) field, enter a new timeout value in seconds.
Click Save.
If you do not already have a deployment plan, or if the deployment plan is unavailable, WebLogic Server creates a deployment plan with the changes above and prompts you to save it. Provide the name and path for the new deployment plan and click OK.
Click Application Management in the tree in the left pane.
In the table, select the PricingDesignCenter application.
Click Update/Redeploy.
Select Update - Deployment Plan on Server and set the Plan Path field to the deployment plan.
Click Done.
Restart WebLogic Server.
Verify your changes by doing the following:
1. Log in to WebLogic Remote Console.
2. Click Monitoring Tree, then Deployments, and then Application Management.
  
  A page with a list of installed Java EE applications and standalone application modules appears.
3. In the table, select PricingDesignCenter.
  
  The information about PricingDesignCenter page appears.
4. Click Configuration in the tree in the left pane.
5. Click Session Descriptor in the tree in the left pane.
6. Verify that Session Timeout (in seconds) is set to the value you specified.

For more information about deployment plans, including an example of using one while updating session timeout, see "Configuring Applications for Production Deployment" in Oracle Fusion Middleware Deploying Applications to Oracle WebLogic Server.

Managing File Permissions

Following are the default permissions set for the installed files:
- rw------- 600 (for all non executable files)
- rwx------ 700 (for all executable files)
Permissions are set to the lowest possible level, and the WebLogic Server administrator can add or revoke permissions. Oracle recommends keeping the permissions as restrictive as possible, as per your business needs.
The WebLogic configuration (JMS, JDBC, etc) file, config.xml, in the domain's configuration directory should be protected with proper permissions.
Output files generated by the export utility should be stored in a protected directory because they may contain sensitive pricing information.

Uninstalling Pricing Design Center

The following files remain in the system after uninstalling PDC:

Install logs:

Location: Oracle Inventory/logs/

-rw-r-----  1 user1 eng  480058 Aug 15 09:25 installActions2018-08-15_08-06-57AM.log 
-rw-r-----  1 user1 eng       0 Aug 15 10:27 oraInstall2018-08-15_10-27-07AM.out
-rw-r-----  1 user1 eng    2384 Aug 15 10:33 dbScripts2018-08-15_10-32-00AM.log
-rw-r-----  1 user1 eng  124268 Aug 15 10:33 oraInstall2018-08-15_10-27-07AM.err

PDC_home/oui/data.properties: This file is used to auto-populate the data during re-installs.

Delete these files manually if you do not need them or protect them appropriately if they are required for further references.

These files are created with the file permission 640 (owner can read/write, group members can read, others cannot do anything) by default.

About Changing Passwords in the Wallets

PDC stores the passwords for the WebLogic Server domain, PDC user, cross-reference database, and Oracle Communications Billing and Revenue Management (BRM) database in PDC and BRM Integration Pack wallets.

To change the password in the wallets, you must encrypt the new password manually and update the entry in the appropriate wallet. See "Changing Passwords in the Wallet" in BRM System Administrator's Guide for more information.

Implementing Pricing Design Center Security

This section describes how to implement the security capabilities in PDC by using Oracle Identity Management (IDM).

PDC uses IDM for authenticating and authorizing PDC users. Each instance of PDC requires an appropriately configured instance of IDM to enable these functions.

For information about installing PDC, see PDC Installation Guide.

Note:

If you have configured IDM, you must authorize PDC users by using IDM only.

About Authentication

Within IDM, Oracle Identity Manager (OIM) provides a mechanism for managing user password policies. You must configure OIM to authenticate and authorize PDC users. See Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

About Authorization

Authorization refers to granting appropriate privileges to users and denying access to other functionality based on their job functions. The users with the following roles can access PDC by using IDM:

Pricing Design Admin: Can import and export all pricing and setup components in PDC.
Pricing Analyst: Can import only pricing components. However, the user with this role can export pricing and setup components.
Pricing Reviewer: Can only export all pricing and setup components.
Migration Admin: Can migrate pricing data from the BRM database to the PDC database.
JDGroup: Can manually trigger job dispatcher to put transformation jobs in the work item queue.

Configuring Authentication and Authorization by Using OIM

OIM enables enterprises to manage the entire user life cycle across all enterprise resources within and beyond a firewall.

To configure OIM to authenticate and authorize users in PDC:

Configure OAM in WebLogic Server. See "Configuring OAM in WebLogic Server".
Add users and assign roles in OIM. See "Adding Users and Assigning Roles in OIM".

Configuring OAM in WebLogic Server

To configure Oracle Access Manager (OAM) in WebLogic server:

Log in to the WebLogic Remote Console.
Click Edit Tree, then Security, and then Realms.

The Summary of Security Realms page appears.
Click the myrealm link.

The myrealm configuration page appears.
Click Authentication Providers in the tree in the left pane. .

A page with an Authentication Providers table appears.
Click New.
In the Name field, enter OAM Identity Asserter.
From the Type list, select Oracle Access Manager Identity Asserter.
From the Control Flag list, select REQUIRED.
Click Create.
Click New.
In the Name field, enter OUD Authenticator.
From the Type list, select Oracle Unified Directory Authenticator.
From the Control Flag list, select SUFFICIENT.
Click Create.
Click the Oracle Unified Directory Authenticator Parameters tab and provide the Oracle Unified Directory (OUD) connection details.
Click Save.
In the Authentication Provider table, arrange the providers in the following order using the Move Down and Move Up buttons.
- OAMIdentityAsserter
- OUD Authenticator
- DefaultAuthenticator
- DefaultIdentityAsserter
Click DefaultAuthenticator in the tree in the left pane and modify the Control Flag to SUFFICIENT.
Click Save.
Click the shopping cart at the top right, and then click Commit Changes to commit your changes.
Restart WebLogic Server.

Adding Users and Assigning Roles in OIM

To add users and assign roles in OIM to access PDC:

Log in to Oracle Identity Self Service.

The Oracle Identity Self Service home page appears.
Create new users (if required) by performing the following steps:
1. Click Manage.
2. Click Users.
  
  The Users page appears.
3. Click + Create.
  
  The Create Users page appears.
4. Enter the required information.
  
  For more information on creating users, see the discussion about creating and managing users in the Oracle Identity Manager Administrative and User Console Guide.
Select a user.
Click + Request Roles.
In the Search field, enter the name of the role and click Search.

See "About Authentication" for the supported roles.

The search results appear.
Select a role from the list under Categories.
Click + Add to Cart.
Click Next and click Submit.

Now, the users can access PDC.

Verifying OIM Configuration in WebLogic Server

To verify the OIM configuration in the WebLogic server:

Log in to the WebLogic Remote Console.
Click Security Data Tree and then Realms.

The Summary of Security Realms page appears.
Click myrealm.

The myrealm configuration page appears.
Click Authentication Providers in the tree in the left pane.

A page with an Authentication Provider table appears.
In the Authentication Provider table, click DefaultAutheticator.
Click Users in the tree in the left pane.

The list of users created in OIM appears.

3 Performing a Secure Pricing Design Center Installation