4 Authentication

From a security point of view authentication is about identification of the user. It is the first line of defense in any security solution. In simple terms it can be as simple as the challenge-response mechanism we know as userid and password. It can be also as complex as using digital certificates as the identification mechanism and numerous other schemes for user identification.

The authentication aspect of security for Oracle Utilities Application Framework is delegated to the infrastructure used to run the product. This is due to the following:

  • Authentication scheme support: Oracle WebLogic supports several industry standard security repositories and authentication methods. These can be native to Oracle WebLogic or additional products that can be integrated.
  • Enterprise Level Identity Management: Identity Management is typically performed at an enterprise level rather than managed at an individual product level. Oracle Utilities Application Framework typically is not the only application used at any site and managing security across the enterprise is more efficient.

Online Authentication

Oracle Utilities Application Framework delegates the responsibility of authentication of the online users to Oracle WebLogic. This means that any integration that Oracle WebLogic has with specific security protocols or security products can be used with the product for authentication purposes. The configuration of authentication is therefore performed within Oracle WebLogic itself.

Typically, Oracle WebLogic support one or more of the following:

  • Inbuilt Security: Oracle WebLogic supplies a default basic security store and associated security management capability that can be used if no other security repository exists.
  • LDAP Based Security: The Lightweight Directory Access Protocol (LDAP) is a protocol for accessing and maintaining distributed directory information services. LDAP is used to standardize the interface to common security repositories (such as Oracle Internet Directory, Microsoft Active Directory etc). LDAP support may be direct or indirect via Identity Management software like Oracle Virtual Directory or Oracle Identity Federation.
  • SAML Based Security: Security Assertion Markup Language (SAML) is an XML based data format for exchanging authentication and authorization information between parties.
  • DBMS Based Security: Oracle WebLogic can store, manage and retrieve security information directly from a database.
  • Operating System Based Security: Oracle WebLogic can store, manage and retrieve security information directly from the underlying operating system.
  • Oracle Utilities Application Framework Security Provider: The Oracle Utilities Application Framework includes an optional custom WebLogic Security Provider that allows implementations to verify user identity and whether the user is enabled as part of a security domain configuration. If the security provider is not used, these attributes are checked at login time.

These security configurations can be natively support or can be augmented with additional products. Refer to the Security Guides supplied with Oracle WebLogic for details of the security configuration process.

Batch Authentication

The Batch component of the architecture utilizes the operating system-based security (including any extensions to that security) to authenticate users to execute batch processes. From an authentication point of view:
  • Batch users must be defined in the operating system and associated with the operating system security group assigned at product installation time. This ensures users have appropriate access to product resources and the ability to write logs.
  • Threadpools can be started by any valid operating system user but ideally threadpools and submitters should be executed by the same operating system user.
  • Before any threadpool or submitter is executed, the user must execute the splenviron utility to set the environment variables for the application correctly. This can be done at the command line for each threadpool and submitter or globally using the logon profile for the operating system user.

Web Service Authentication

The Web Service component of Oracle Utilities Application Framework is housed in Oracle WebLogic and utilizes the native Web Services security mechanism supported by that server. From an authentication point of view:

  • The Web Service is deployed using an administration account using the utilities provided from the product online (for developers) or using command line utilities.
  • The Web Service is managed using the administration account using the administration console provided with Oracle WebLogic.
  • Oracle WebLogic allows security policies and security access rules to be configured at an individual Web Service point of view. Any of the valid policies and security rules supported by Oracle WebLogic can be used.
  • Web Service management products such as Oracle Web Services Manager can be used to augment security for Inbound Web Services.