1. Security Guide
  2. Accessing OPERA Cloud Distribution Platform

5 Accessing OPERA Cloud Distribution Platform

Customers access the OPERA Cloud Distribution application from the following interfaces:

  • A web browser. This is the primary means to access all OPERA Cloud Distribution functionalities.

  • REST API. OPERA Cloud Distribution publishes a rich set of APIs for integration with the Oracle Hospitality Integration Platform (OHIP), partners, or channels. Applications can integrate with OHIP to consume OPERA Cloud Distribution features.

The Security Model

OPERA Cloud Distribution cloud security requirements arise from the need to protect customer data from unauthorized attempts to access or alter the data. Secondary concerns include protecting against undue delays in accessing or using data, or even against interference to the point of denial of service.

The critical security features that provide these protections are:

  • Authentication. Ensuring that only authorized individuals get access to the system and data

  • Authorization. Access control to system privileges and data. This builds on authentication to ensure that individuals only get appropriate access.

  • Audit. Allows administrators to detect attempted breaches of the authentication mechanism and attempted or successful breaches of access control.

Configuring and Using Access Control

OPERA Cloud Distribution uses the Oracle OPERA Identity Management (OIM) system for application user identity and access management. User accounts must be created in the identity management system and granted distribution specific roles to access the user interface. Review product documentation for a list of roles required to access OPERA Cloud Distribution functionalities. Oracle recommends that users use a complex password meeting federal password complexity guidance and follow principles of least privilege when assigning application roles to end-users.

Transport Layer Security

OPERA Cloud Distribution application interfaces are secured by Transport Layer Security (TLS) version 1.2 or above using only strong ciphers. This application does not support unsecured / plain HTTP communication.

On connecting to OPERA Cloud Distribution APIs, applications must validate that the TLS certificate is legitimate and not a forgery. This prevents fraudulent attacks resulting in compromised passwords and extraction of customer data.