This chapter describes the most important changes introduced in this and previous releases.
The features and documentation changes introduced in release 11.1.1.9.0 include the following:
FIPS 140-2 support. Form details, see Section 4.6, "FIPS 140 Support in Oracle Platform Security Services".
Attributes table for the new OWSM-JKSMBEAN Audit component. For details, see Table C-9, "OWSM-JKSMBEAN Events".
Two runtime policy store properties have been introduced. For details, see the last two entries in Table F-4, "Runtime Policy Store Properties".
The features and documentation changes introduced in release 11.1.1.7.0 include the following:
Migration of keystore data within and across domains. For details, see Section 6.6.4.
An introduction to deploying applications with audit. For details, see Section 6.5.
Additional WLST commands for audit management. For details, see Section C.4.
The WSLT script listCred has been decommissioned and is no longer available. An alternative to this WLST command is explained at the end of Section 10.5.
New code examples have been added to describe how applications can access the Keystore Service. For details, see Section 21.6.2.
System components can now specify the audit log location in a flexible manner. For details, see Section K.1.1.7.
A detailed explanation of the procedure to create an audit schema. For details, see Section 13.2.1.
Updated procedure for audit policy configuration using Fusion Middleware Control. For details, see Section 13.3.
Audit records are written with UTC time-stamps by default. For details, see Section 13.4.
Data purge scripts are introduced. For details, see Section 13.6.6.4.
Bulk authorization for file-based stores with the method Jps.Auth.checkBulkAuthorization.
Introduction of the audit administration service APIs. For details, see Section 22.5.
Requirement for audit clients to have certain system grants to invoke the audit APIs. For details, see Section 22.6.2.
New properties audit.timezone and audit.change.scanning.interval have been added for audit service configuration.
Compatibility Matrix for 11g Versions. For details, see Section 3.1.
The features introduced in release 11.1.1.6.0 include the following:
Encrypting credentials.
Trusted Header Assertion with the Oracle Access Manager Identity Assertion Provider.
Integrating application security with OPSS.
Developing applications using the Audit Service.
Using the Identity Directory API in your applications.
Administering the Keystore Service.
Developing applications using the Keystore Service.
Upgrading with upgradeOpss.
Documentation updates include the following:
Updates to the discussion of the Common Audit Framework.
Procedures to enable SSL for the Identity Store Service.
The features introduced in release 11.1.1.4.0 include the following:
Support for DB-based stores.
Support for the IBM WebSphere Application Server.
Support for identity virtualization, which allows querying multiple identity stores.
Support for security administrative scripts on IBM WebSphere Application Server.
The WLST command upgradeOpss.
Additional WLST commands.
Improved Fusion Middleware Control security pages.
Enhanced OAMCfgTool for OAM 10g SSO, with additional parameters.
User and Role API support for IBM Tivoli and Microsoft ADAM directories.
The features introduced in release 11.1.1.3.0 include the following:
The Resource Catalog, a way of specifying resource types, resources, actions, and entitlements in an application policy grant. Starting with this release, OPSS supports resource-based policies with the introduction of the resource catalog.
Instructions for developing custom User and Role providers.
Use of the class ResourcePermission in permissions.
New WLST commands to manage resource types.
The system property jps.deployment.handler.disabled of the Oracle WebLogic Server has been introduced.
A new use of the WLST command upgradeSecurityStore.
A new argument to the WLST command migrateSecurityStore to control the migration behavior upon encountering duplicate items. It applies only when migrating application policies.
The features introduced in release 11.1.1.2.0 include the following:
The class Resource Permission.
Principal name comparison has been enhanced.
Manual settings for policy migration have been simplified. In particular, versioning the application is no longer required.
The WLST command migrateSecurityStore supports the embedded LDAP store as a target.
The configuration of the identity store has been simplified. For example, previously required properties such as username.attr and login.name.attr are no longer needed when configuring an LDAP identity store.
The WLST command reassociateSecurityStore supports an existing LDAP node as a target.
New and improved Oracle Fusion Middleware Control pages. In particular, using these pages, one can specify the SSO service to use in a domain.
The single most important new feature in this release is the Oracle WebLogic Server as the environment where applications run and where security is provisioned.
The features introduced in release 11gR1 include the following:
Support for application policies and roles, and the authenticated and anonymous users and roles
Credential Store Framework
Auditing framework for Oracle Platform Security Services (OPSS) events for credential and policy management, and authorization checks
Support for application lifecycle security integrated with JDeveloper
Enhanced authorization framework
Consolidation of code-based and subject-based policies in system-jazn-data.xml
Management of security with Oracle Fusion Middleware and WLST commands
New security-related WLST commands
The features de-supported in release 11gR1 include the following:
Jazn is replaced with OPSS.
Jazn Realm API is replaced by the User and Role API.
Migration of OSDT toolkit from proprietary objects to JCE is desupported.
The identity store, as previously configured in system-jazn-data.xml, is replaced by the use of WebLogic authenticators.
The functions of Oracle Jazn Administration Tool are replaced as follows:
User and Role CRUD operations are replaced by the use of the Embedded LDAP configured and operated with the Oracle WebLogic Administration Console
The configuration of login modules is replaced with the use of the Oracle WebLogic Administration Console to configure authenticators
JavaSSO is no longer supported. On a Oracle WebLogic Server domain, Single Sign-On (SSO) is automatic within clusters only when session replication is turned on.