3 Introducing Security

One of the key aspects of Oracle Utilities Application Framework is security, not only to confirm the identity of an individual user, but also to determine data and functions within the application.

Security Features

Security is one of the key features of Oracle Utilities Application Framework architecture, since it protects the access to your application, its functionality, and the underlying data stored and managed via Oracle Utilities Application Framework.

From an architecture point of view the following summarizes the approach to security:

  • Web Based Authentication: Oracle Utilities Application Framework provides a default method, using a traditional challenge and response mechanism, to authenticate users.
  • Support for Oracle WebLogic security: Oracle WebLogic can integrate into several internal and external security stores to provide authentication services. Oracle Utilities Application Framework can use those configurations, to liaise via Oracle WebLogic, to authenticate users for online and Web Services based security.
  • Operating System Security: For non-online and non-web service-based channels, Oracle Utilities Application Framework utilizes the operating system security (including any additional products used to enhance the base operating system security).
  • Non-Cookie based security: After authentication the user's credentials form part of each transaction call to correctly identify the user to the internal authorization model to ensure the user is only performing permitted actions. This support is not browser cookie-based.
  • Secure Transport Support: Transmission of data across the network can utilize the secure encryption methods supported for the infrastructure.
  • Inter-component security: Calls within Oracle Utilities Application Framework and across the tiers are subject to security controls to ensure only valid authenticated and authorized users using Java Authentication and Authorization Services (JAAS).
  • Inbuilt Authorization Model: Once a user is authenticated then the internal authorization model is used to determine the functions and data the user has access to within Oracle Utilities Application Framework.
  • Native Web Services Security: Web Services available from Oracle Utilities Application Framework are natively available from Oracle WebLogic. A wide range of security policies are available.
  • Keystore Support: Keys for encryption can be externalized in JCEKS based keystore.
  • Integration with other security products: Implementation of security varies from customer to customer, so Oracle Utilities Application Framework allows integration of other security products to offer enhanced security implementations, either directly or indirectly.

Additional Security Resources

In addition to the security resources described in this guide, Oracle Utilities Application Framework provides the following additional security resources:

  • Oracle Database Vault: Oracle Database Vault provides fine-grained access control to your sensitive data, including protecting data from privileged users. The Oracle Database Vault Administrator's Guide and Database Vault Integration Features (KB594173) describes how to use Oracle Database Vault.
  • Oracle Audit Vault: Oracle Audit Vault collects database audit data from sources such as Oracle Database audit trail tables, database operating system audit files, and database redo logs. Using Oracle Audit Vault, you can create alerts on suspicious activities, and create reports on the history of privileged user changes, schema modifications, and even data-level access. The Oracle Audit Vault Administrator's Guide and Audit Vault Integration Technical Brief (KB666292) describe how to administer Oracle Audit Vault.
  • Oracle Advanced Security: See the Oracle Database Advanced Security Administrator's Guide for information about advanced features such as transparent data encryption, wallet management, network encryption, and the RADIUS, Kerberos, Secure Sockets Layer authentication.
  • Oracle Identity Management Suite: Oracle offers a range of specialist security products to manage user identities, password management, single sign on, access management, identity governance, fraud detection and directory services. The Oracle Identity Management Suite Administrator Guide and Oracle Identity Management Suite Integration with Oracle Utilities Application Framework (KB228352)) provide additional information about these products and integration capabilities.