Release 9.0.2
Part Number A95995-01
 Contents |
 Index |
| Oracle Internet File System Setup and Administration Guide Release 9.0.2 Part Number A95995-01 |
|
This chapter covers planning and setting up Oracle Internet File System. The following topics are included:
Follow these steps to set up Oracle Internet File System:
The folder hierarchy is a very important component of Oracle 9iFS. It is a representation of how the files in the repository are organized. It is familiar to all users and makes organizing and browsing information easy. An important prerequisite is to model how you want to organize the file hierarchy. For example:
Home Inbox Correspondence Conferences Oracle Open World Oracle Applications Users Group Plans Presentations Public Product Information Oracle 9iFS Manuals Software Downloads Oracle JDeveloper Oracle8i Server Partners Program Partner Information Program Plan Technical Whitepapers Standards and Procedures Company Policies Procedure ManualsFolder hierarchies organize the repository so that users can browse through it easily. You can create multiple folder hierarchies to organize information in different ways to make browsing convenient for different types of users. For example, the sales, development, marketing, and consulting departments of a company may use different hierarchies.
A folder in Oracle 9iFS is identical to a physical file folder or a computer file folder, and is used to group and organize files or other objects. The organization of the folders is conceptual, not physical. The files and objects are not physically located in the folder; rather, they are in the repository and a folder references the objects that it contains. Because folders do not physically contain their objects:
When Oracle 9iFS is installed, several default objects are created, including a folder hierarchy (described in Table 4-1), commonly used ACLs, and several default users. The 9iFS Manager and Web interface are ready to use to add users and files. XML configuration files may also be used to create users, groups, and additional ACLs.
Table 4-1 Elements of the Default Folder Hierarchy
Follow these guidelines when planning your folder hierarchy.
root, which represents the highest level where documents and folders can be stored.
Access Control Lists (ACLs) are associated with each object in the hierarchy. An ACL contains a list of users and groups who can perform certain actions on the folder, such as browsing its contents, or adding or deleting items from that folder.
When designing the access permissions for the folder hierarchy, note the following features:
Folder security is defined by the ACL applied to it. The ACL applied to any newly created folder is the default ACL specified in the Primary User Profile of the user who created the folder. The ACL for a folder can be changed at any time by its owner once the folder has been created.
If you create a user with Oracle 9iFS Manager, the Web interface, or XML, Oracle 9iFS automatically creates the user, home folder, e-mail folder, Primary User Profile, and e-mail profile.
Folder security is distinct from file security. Folder security defines who can browse the contents of the folder and add or delete folder items. File security defines who can access, modify, and delete attributes and contents of a file. If an ACL is not specified at the time the folder or file is created, then the ACL is determined by the user's default ACL. If a file is placed in a user's home folder, it does not mean the file is associated with the PRIVATE ACL, and if a file is placed in a public folder, it does not mean the file is associated with the PUBLIC ACL. The ACL associated with a folder or file can be modified at any time once it has been created to reflect appropriate access.
Before you actually set up the folder hierarchy, create users and groups. Oracle 9iFS users are the end users who use Oracle 9iFS as a file management system. Groups are composed of users that are related in some way. For example, the Marketing group could contain all of the members of the corporate marketing organization.
Most people will use Oracle 9iFS as an enhanced file system. To customize Oracle 9iFS for your organization, some of these users should have administrative permissions.
There are three levels of system privileges:
Oracle 9iFS maintains Oracle 9iFS-specific user information in user profiles. Each active Oracle 9iFS user may have a Primary User Profile, an e-mail user profile, and an extended user profile:
Each user has a Primary User Profile. This profile points to the user's home folder location and the user's default ACLs. The default ACLs determine which ACLs should be associated when the user creates different objects, such as folders and documents. By default, Oracle 9iFS sets the non-administrator user's default ACL to PUBLISHED (except for e-mail-related objects, such as messages. These have the PRIVATE ACL as the default), and sets the administrator's default ACL to PRIVATE (except ACL, PropertyBundle, DirectoryObject, VersionSeries, and VerionsDescription, which are PUBLISHED).
A user's home folder is the default directory where a user starts when logging into Oracle 9iFS. Users can use their home folder as their personal workspace and to store their private files. A user's home folder can reside anywhere, so Oracle 9iFS Manager provides a dialog to change the default home folder location. The user's Primary User Profile points to the user's home folder location.
The user's e-mail profile points to the user's e-mail folder location and specifies the user's e-mail address. Oracle 9iFS Manager and the Web interface create the user's e-mail folders under the home folder. For example, /home/jsmith/mail/inbox.
In addition to the Primary Profile and Email profile information on the Profile property sheet, an Extended profile section allows you to specify an application name to associate with the user's profile. For example, if you wrote a custom application that displayed the items of a user-specified folder, you could subclass ExtendedUserProfile to create MyAppUserProfile and store the folder path in a custom attribute. Each user would have his/her own MyAppUserProfile. When the user logs into the custom application, the application would look in that user's MyAppUserProfile and display the contents of the specified folder.
Oracle 9iFS uses a credential manager to authenticate users. A credential manager is an extensible authentication mechanism that determines the validity of a credential, such as a user name and password.
Each Oracle 9iFS directory user specifies the name of the credential manager used to authenticate that user, as well as the distinguished name that identifies that user to the credential manager.
When you perform the initial configuration of Oracle 9iFS, a single credential manager is created, which may be either an Oracle 9iFS credential manager or an Oracle Internet Directory credential manager. The credential manager you select becomes the default credential manager. Credential managers may be added, modified, or deleted using the Oracle 9iFS Credential Manager configuration tool. For each Oracle 9iFS user created, for whom you don't explicitly specify the credential manager, a corresponding entry, consisting of the user's distinguished name and password, is stored in this default credential manager. See the Oracle Internet File System Installation and Configuration Guide for more information.
Optionally, the Oracle 9iFS credential manager can be configured to require users to be RDBMS users. If this feature is enabled, the Oracle 9iFS user named "jsmith" could only log into Oracle 9iFS if there was an RDBMS user named "jsmith." The credential manager only checks the user name. The RDBMS password does not have to match the Oracle 9iFS password.
Set the IFS.SERVICE.CREDENTIALMANAGER.Ifs.RdbmsUserMustExist property to True in the service configuration file to enable this setting. This property is located in the following directory:
| Platform | Directory |
|---|---|
|
UNIX |
|
|
Windows NT |
|
Oracle Internet Directory offers comprehensive and flexible support for directory access control. This includes entry level, attribute level, and prescriptive access control to provide varying levels of security to meet the specific needs of enterprise and service providers. An administrator can grant or control access to a specific directory object or to an entire directory subtree. Oracle Internet Directory implements three levels of user authentication: anonymous, password-based, and certificate-based using Secure Sockets Layer (SSL) Version 3 for authenticated access and data privacy.
HTTP authentication is a common mechanism for adding security to static Web pages. Oracle 9iFS uses its own security features as the basis for HTTP authentication. Files and folders need to have the PUBLISHED ACL applied for users to use a browser to access these objects without being forced to log in. If they are forced to log in, they must supply their Oracle 9iFS username and password.
Users can be created with most of the Oracle 9iFS administration tools. Oracle recommends that you use Oracle 9iFS Manager or an XML configuration file. These tools create all objects associated with a new users with standardized settings.
Creating users involves two steps:
Before creating a user, you can set the default user definitions which will be applied to all users you create. The user definitions provide a uniform way of creating users that is consistent with the various clients. Using Oracle 9iFS Manager, you can edit a small subset of the defined user definitions (see Table 4-2, "User Definitions Reference"). To change the rest of the default user definitions, use XML. See "Creating Users: Using an XML Configuration File".
To set the default user definitions:
The default allocated quota storage is 25 megabytes per user. If a user's quota is reached, he or she will be unable to save documents in Oracle 9iFS. If you disable quota, the user has an unlimited quota. Users with administrative permissions usually have an unlimited quota amount.
To create an Oracle 9iFS user, you specify general information and profile information about the user and add the user to groups for easier administration.
To specify general user information:
To specify user profile information:
/home/jsmith/mail/inbox.
To add this user to existing groups:
Because your system may support hundreds or thousands of users, it is infeasible to display all the users under the Users folder. Instead, a Search utility has been provided to select users based on particular search criteria. You can search by name, group membership, or both.
To find users:
Search results are displayed in sets of 20. You can navigate through the results with the Previous Set and Next Set buttons.
To perform a more complex search for users:
Creating users can be complicated since many other user-related objects, such as home folders, user profiles, and mail folders are created at the same time. Using the <SimpleUser> tag within the XML file applies all the default definitions found in Table 4-2, "User Definitions Reference". You can change the user default settings in Oracle 9iFS Manager to suit your requirements. You do not need to specify every single value unless you want to override any of the default values. You override the defaults by explicitly setting them in the XML file. The values are case-sensitive.
Creating a single user and all its user-related objects are created in a single transaction. These objects include a Directory User, Primary User Profile, Email Profile, Inbox, and a Home Folder. Therefore, do not include any other objects in your XML file. Also, if you are creating 10 users in a single file, and an error occurs on the 7th user, the previous 6 users and their user-related objects are not rolled back. The file will have to be edited and the definitions for the created users deleted before being able to use it again.
The following XML file lists the definitions used to create users with an XML file. When using XML, you really only need to include the username and password, but this example displays other definitions you can include to override the defaults you set using Oracle 9iFS Manager. This example also shows you how to create users by parsing the XML file and checking that the users were created using the Command Line Utilities.
<SimpleUser><UserName>gking</UserName> <Password>ifs</Password> <DistinguishedNameSuffix>.yourcompany.com</DistinguishedNameSuffix> <DirectoryUserDescription>Gary King</DirectoryUserDescription> <AdminEnabled>true</AdminEnabled> <HomeFolderRoot>/home</HomeFolderRoot> <EmailAddressSuffix>@yourcompany.com</EmailAddressSuffix></SimpleUser>
$ORACLE_HOME/9ifs/bin/ifsshell@ login system/<password>put users.xml
ls -class DirectoryUser
By assigning users to groups, you make administration and maintenance easier. Instead of adding each user to an Access Control List for a file or folder--a time consuming task--you can add a group of users all at the same time. Oracle 9iFS is shipped with World, a default group. When users are created, they are automatically added to this group. To create a group, you define the group itself, then populate it. Group names are unique within the owner's set of groups.
The default ACL of the user that created this group is assigned to any new group the user creates. Therefore, a group with the PUBLISHED ACL cannot be edited by any user. When creating groups, it is important to discuss with department managers and other users if they want all Oracle 9iFS users to have read-only access to the groups you are creating for their respective departments. If you need to change the default ACL, you can do so by modifying the ACL for a specific group.
Using Oracle 9iFS Manager, you can modify, view, and delete group. Modifying a group includes such tasks as adding or removing users and group to an existing group and renaming a group.
The default ACL of the user who created this group is assigned to any new group you create. Therefore, a group with the PUBLISHED ACL cannot be edited by any user. When creating groups, it is important to discuss with department managers and other users if they want all Oracle 9iFS users to have read-only access to the groups you are creating for their respective departments. If you need to change the default ACL, you can do so by modifying the ACL for a specific group.
This example XML file creates groups. You can use this file, although you must modify the name of the group to match the name of the group you are creating. When adding users to the group, the user names must exist. If you use any protocol to load the XML file into Oracle 9iFS, it is parsed and not saved anywhere in Oracle 9iFS.
<DIRECTORYGROUP><Name>DemonstrationUsers</Name> <Members><MEMBER reftype='name'>msmith</MEMBER> <MEMBER reftype='name'>mallen</MEMBER> <MEMBER reftype='name'>sward</MEMBER> <MEMBER reftype='name'>rjones</MEMBER> <MEMBER reftype='name'>tmartin</MEMBER> <MEMBER reftype='name'>dblake</MEMBER> <MEMBER reftype='name'>eclark</MEMBER> <MEMBER reftype='name'>sscott</MEMBER> <MEMBER reftype='name'>gking</MEMBER> <MEMBER reftype='name'>tturner</MEMBER> <MEMBER reftype='name'>jadams</MEMBER> <MEMBER reftype='name'>pjames</MEMBER> <MEMBER reftype='name'>gford</MEMBER> <MEMBER reftype='name'>amiller</MEMBER></Members> </DIRECTORYGROUP>
You can add users to the group at any time by following steps 4-9.
When you planned your system and folder hierarchy, you should have defined the following:
Create the folder hierarchy by starting at the root of the tree, adding the folders, then creating each folder's child folders, working downward. You can create folders using Oracle 9iFS Manager, the Web or Windows interfaces, or through the Command Line Utilities.
Using Oracle 9iFS Manager, you can only create folders one at a time and only from a single level. To create folders:
The owner of the folders created is the user who is logged into Oracle 9iFS Manager.
Note: If you plan to upload a foldered set of documents to the Oracle 9iFS server, create the folders first using this procedure, then upload the files to the proper folders.
Using XML, you can create multiple folders. When creating multiple objects, you must use the <ObjectList> tag. The following code creates multiple folders. This can be used when creating the folder hierarchy.
<Folder><Name> FY 2000 Budgets </Name> <FolderPath> /managers </FolderPath></Folder> <Folder><Name> Marketing </Name> <FolderPath> /managers/FY 2000 Budgets </FolderPath></Folder> <Folder><Name> Human Resources </Name> <FolderPath> /managers/FY 2000 Budgets </FolderPath></Folder> </ObjectList>
This XML example specifies that the folders are placed under the "Managers" folder; therefore, this folder must already exist in Oracle 9iFS for the other folders to be created.
When using the Windows interface to load this XML file, you may drag and drop the XML file to any directory. In this example, the XML file was placed in /managers. After this XML file has been loaded into Oracle 9iFS, the directory looks like:
Generally, creating objects in an objectlist tag is always in a single transaction, meaning, if there is an error, the complete transaction is rolled back, the objects are not created, and a log file is generated in the directory in which the XML file was dropped. You can use this log file to troubleshoot errors.
However, class objects and Directory object creation are implicitly committed. So, if there is an error while creating some of these objects in the objectlist tag, the objects prior to the error are created and committed to the database. The XML file will have to be edited and those object definitions deleted from the XML file before parsing it again.
To create several folders at a time, it is recommended that you use the Command Line Utilities and a batch file. Using the batch file, you create the folders and assign different ACLs.
To create folders:
login system/<password> cd /public mkdir specifications mkdir specifications/development mkdir specifications/qa setattr /public/specifications ACL -avsystemacl public setattr /public/specifications/development ACL -avsystemacl public setattr /public/specifications/qa ACL -avsystemacl public
$ORACLE_HOME/9ifs/bin/ifsshell -i batchfile.txt
/public directory. Drill down to see all folders.
To see if any errors occurred during the execution of your batch file, check the CupServer.log found in the following directory:
| Platform | Directory |
|---|---|
|
UNIX |
|
|
Windows NT |
|
Mount points in Oracle 9iFS are named directories that can be accessed as if they were top-level folders through the Windows and Web interfaces. The important attributes of mount points, especially for your users, are:
As the administrator, you should limit the number of mount points you create because having more than a few dozen makes it very difficult for users to find what they need.
The following mount points are set up by default:
You use mount points for two reasons:
/Public/product information/oracle ifs folder, he or she can use a mount point to start there instead of browsing through the hierarchy.
The new mount point displays in the Navigator.
It may be necessary to migrate your data from your legacy systems. This process requires you to manually transfer the data to the new environment. There are five different ways to load files into Oracle 9iFS:
ifsput command. XML files are parsed by default. You can turn off the parsing mode by using the ifsmode parse off command.
In Windows:
In the Web interface:
To retain the file structure:
-or-
Drag different parts of the directory tree separately, confirming that each part of the tree has been copied before copying the next one.
To FTP your files into Oracle 9iFS, the following requirements must be met:
To FTP your files into Oracle 9iFS:
Using the Web interface, you can only load one file at a time:
When you want to view a file using the Web interface that is not recognized, a new navigator window is opened and a dialog prompts for you to pick the application, save the file, or cancel this operation.
To browse and upload files using the Command Line Utilities:
@ login system/<password>
cd /public
put myfile.doc
Security in Oracle 9iFS is defined using passwords and Access Control Lists (ACLs).
Each user possesses an Oracle 9iFS user account which is associated with a User Profile containing the user's preferences for working in the repository (e.g., Home Folder, Default ACL).
When the user logs into an Oracle 9iFS client, the user supplies a password for authentication. Upon receiving the user's credentials, Oracle 9iFS checks the password against the user's specified credential manager. Oracle 9iFS provides a built-in credential manager which manages user accounts and passwords, or users may be authenticated with the Oracle Internet Directory credential manager. The default credential manager is specified during Oracle 9iFS configuration.
Oracle 9iFS users authenticated by an Oracle Internet Directory credential manager may have, in addition to their Oracle Internet Directory password, a second, Oracle 9iFS-specific password. These two passwords are not synchronized, although administrators can control which password type is used to authenticate users on a protocol-by-protocol basis. For example, since the FTP protocol specifies that passwords travel from the FTP client to the FTP server in the clear, an administrator can configure the Oracle 9iFS FTP server to use the Oracle 9iFS password to prevent interception of users' Oracle Internet Directory passwords.
While requiring a user's Oracle 9iFS-specific password to authenticate with such protocols doesn't prevent a hacker from using a packet sniffer to obtain that password, it mitigates the consequences of that password being compromised, since that Oracle 9iFS-specific password allows access to Oracle 9iFS, only, and not to all OiD/SSO-enabled applications.
You can control which protocols use the Oracle 9iFS-specific password through service configuration. See "Directory Service" in Appendix B, "Service Configuration Properties" for more information.
Oracle recommends that you use the Oracle 9iFS-specific password with the following protocols:
The following protocols use the common OiD (SSO) password:
As you set up users and groups and loaded files into Oracle 9iFS, you assigned Access Control Lists (ACLs) to the folders and files involved. When a client establishes a connection to the Oracle 9iFS repository, it maintains a database connection to the Oracle 9iFS schema. The user's access to each document and folder stored in the repository is governed by the ACL for that object. The ACL specifies which users and/or groups have what permissions (e.g., read, modify, delete) on that object.
If the user wants to perform administrative tasks in the repository, the user account will need to be granted administrative privileges.
Four system ACLs are provided to apply to your documents and folders. These ACLs cover the most common security needs in most shared environments. The system ACLs are listed and described in Table 4-3, "System ACLs".
Table 4-3 System ACLs
All objects may have an associated ACL. If no ACL is assigned, the object is PRIVATE (only the owner has full access to it). If a default ACL is specified in a user's Primary User Profile, that ACL is assigned to the new public object created by that user.
Similar to files, ACLs have an ACL associated with them to manage the users who can use them or modify them. System ACLs can be created and modified by system administrators only.
Each ACE is comprised of a:
For each user or group, you need to decide which of the permission bundles will be granted to them. Permission bundles are sets of permissions that are applied to users. The set of permission bundles assigned to a specific user or group is called an Access Control Entry (ACE).
ACLs give you the flexibility to grant the permission bundles your co-workers require while helping to protect your files against accidental modification or unauthorized access.
By setting the permission bundles for an individual or group, you create an Access Control Entry (ACE) in your Access Control List (ACL). It's possible to create a different ACE for every user in your Oracle 9iFS repository for every file you control, but, in most cases, the standard ACLs that come with Oracle 9iFS should meet your needs, and the remaining cases can be handled by creating an ACL.
When you define an ACE, the first choice you must make is whether the ACE you're creating is going to grant the permission bundles you select, or revoke them. If you are going to give only a few permission bundles to a selected user or group, choose Grant, and select only the permission bundles that they will be given. If you are going to give the selected user or group general access with only a few restrictions, choose Revoke. Then explicitly grant those permission bundles to the grantee.
A permission bundle is a collection of permissions. Permission bundles are convenient because you do not have to specify the individual permissions. For example, the permission bundle, "All," is a collection of permissions which grants all possible permissions. A permission bundle can be granted to a user or group, or revoked from a user or group. Oracle 9iFS Manager, the Web interface, and the Windows interface support ACLs and ACEs with permission bundles.
Table 4-4, "Permission Bundles Provided in Oracle 9iFS" lists the permission bundles used in Oracle 9iFS and the permissions they contain. The ClassCreate and ClassRestrictedCreation permission bundles are used exclusively for ACLs associated with class objects and are also known as ClassAccessControlLists.
Table 4-4 Permission Bundles Provided in Oracle 9iFS
The permissions bundled in the above permission bundles are listed and defined in Table 4-5, "The Individual Permissions". "Item" can be either a file or directory, unless stated otherwise.
Table 4-5 The Individual Permissions
In a new dialog, the administrator/user can specify the name, a description, and add any or all standard out-of-the-box permissions currently in the repository. Both sets of permissions are present to the user as a scrollable shuttle interface, from which the user can add or remove any number of items.
To define a custom permission bundle:
Groups and ACLs provide a powerful mechanism for managing access to objects. Assume a group is defined as a grantee in an ACE. If the group membership is changed, either by adding or deleting a member, those changes are reflected automatically in access to the object. If the group is granted permissions on an object and a new member is added to the group, that new member automatically has access to the object the on which the group has permission. The order of the ACEs is significant. The ACL is resolved in the order of the ACEs.
Users can also be specified as a grantee in an ACE. For example, if the user "jsmith" is part of the group "ifsdev." The ACL results in everyone in "ifsdev" having full access, except "jsmith," who cannot delete the object.
| Grantee | Permission Bundle | Grant or Revoke |
|---|---|---|
|
IFSDEV |
All |
Grant |
|
JSMITH |
Delete |
Revoke |
|
Note: The order of the ACEs is significant. If the order of the grantees is reversed, the ACL in the example above would resolve to "jsmith" having ALL permissions. |
Each user has a Primary User Profile. One of the attributes of this profile is a set of default ACLs. These ACLs determine the default ACL associated with all objects the user creates. Default ACLs can be:
Default ACLs are used at the time an object is created, unless the creator specifies a different ACL. The ACL can be changed at any time after the object has been created. The ACL associated with any created object is determined by the user's default ACL as specified in the Primary User Profile. A non-admin-enabled user's default ACL is set to PUBLISHED, except for MailBox, MailDocument, MailFolder, and Message, which are PRIVATE. An admin-enabled user's default ACL is set to PRIVATE, except for the following classes, which are set to PUBLISHED:
When an object has no ACL, the owner and administrator have access to it. Therefore, it is strongly recommended that a Primary User Profile with the default ACLs specified is created for each user. Creating a user with Oracle 9iFS Manager, the Web interface, or XML creates a user profile with the following default ACLs:
The ACL associated with any created object is determined by the user's default ACL as specified in the Primary User Profile. A non-admin-enabled user's default ACL is set to PUBLISHED, except for MailBox, MailDocument, MailFolder, and Message, which are PRIVATE. An admin-enabled user's default ACL is set to PRIVATE, except for the following classes, which are set to PUBLISHED:
To change the default ACL applied to a document, access Oracle Internet File System from the Web or Windows interface.
If you want to create a batch of ACLs, use the Create Like option. This creates an ACL similar to an existing ACL, which you can then customize. To apply an ACL, to a file or folder, use the Oracle 9iFS Manager Browser, or use the Web or the Windows interface.
Each of the users or groups you selected can have a separate set of ACEs associated with it. For each, select Grant to grant the permission bundles you select. If Grant is not selected, the permission bundles you select are revoked from that user or group. Scroll right to see all of the available permission bundles.
Each of the users or groups you selected has a separate ACE. For each, choose whether the ACE will Grant the privileges you select or Revoke the privileges you select. Scroll right to see all of the available permissions. Set the permissions by selecting the corresponding checkbox.
Through XML, you can create an ACL using the existing permission bundles. In addition, you can also create your own custom permission bundle. Once you have created your own permission bundle, you can use Oracle 9iFS Manager, the Web interface, or XML to create ACLs using the custom permission bundle.
To create your own custom permission bundle:
<PermissionBundle><Name> MyPermissionBundle </Name><AccessLevel><Discover> true </Discover> <GetContent> true </GetContent> <SetContent> false </SetContent></AccessLevel> </PermissionBundle>
To create an ACL using the custom permission bundle:
<AccessControlList><Name> MyAcl </Name> <Description> Custom ACL using custom permission bundle </Description> <ACEs><AccessControlEntry><Grantee classname='directorygroup' Reftype="name"> ifsdev </Grantee> <Granted> true </Granted> <PermissionBundles> <PermissionBundle Reftype='name'> MyPermissionBundle </PermissionBundle> </PermissionBundles></AccessControlEntry> </ACEs> </AccessControlList>
ACLs are applied to objects through the Browser. To apply an ACL to an object in the Browser:
To apply an ACL to a file or folder:
A success message displays to tell you that the ACL has been applied to the items.
To apply an ACL to a file or folder:
|
 Copyright © 1999, 2002 Oracle Corporation. All Rights Reserved. |
|