This chapter includes the following sections:
Note:
See the following sections for information on attaching and detaching policies:
This chapter describes security procedures unique to SOA composite applications. Most SOA composite application security procedures do not require SOA-unique steps and can be performed by following the documentation listed in Table 8-1.
Table 8-1 Security Documentation
For Information On... | See The Following Guide... |
---|---|
Securing Oracle Fusion Middleware, including Oracle Single Sign-On (OSSO) configuration |
Securing Applications with Oracle Platform Security Services |
Securing and administering web services |
|
Understanding Oracle WebLogic Server security |
|
Securing an Oracle WebLogic Server production environment |
Securing a Production Environment for Oracle WebLogic Server |
Securing Oracle WebLogic Server |
Administering Security for Oracle WebLogic Server 12c (12.2.1) |
Developing new security providers for use with Oracle WebLogic Server |
|
Securing web services for Oracle WebLogic Server |
|
Programming security for Oracle WebLogic Server |
|
Securing Oracle User Messaging Service |
You must add the /integration
location in the mod_wl_ohs.conf
file of Oracle HTTP Server for Oracle BPM Worklist to work through Oracle HTTP Server.
<Location /integration>
SetHandler weblogic-handler
# PathTrim /weblogic
ErrorPage http:/WEBLOGIC_HOME:WEBLOGIC_PORT/
</Location>
This section describes how to set up and validate Security Assertion Markup Language (SAML) message-protected policy configuration for the SOA Infrastructure with the Oracle WebLogic Scripting Tool (WLST). The example in this section describes task query service configuration. However, these instructions are relevant to all human workflow services that support SAML-token ports:
Activity guide query service
Activity guide metadata service
Activity guide admin service
Task query service
Task service
Task metadata service
Runtime config service
Task evidence service
User metadata service
If you want to change the policy for another service, you must apply the same WLST commands to that service's SAML-token port.
To set up an SAML message-protected policy configuration:
This section describes how to authenticate Oracle BPM Worklist and Oracle Business Process Management users in different environments.
To be automatically authenticated when accessing a second Oracle BPM Worklist from a first Oracle BPM Worklist in SAML SSO environments, you must perform the following steps. Otherwise, you are prompted to log in again when you access the second Oracle BPM Worklist. In these environments, the first Oracle BPM Worklist is configured as the SAML identity provider and the second Oracle BPM Worklist that you access is configured as the SAML service provider.
To automatically authenticate Oracle BPM Worklist users in SAML SSO environments:
Add /integration/worklistapp/*
as the redirect URL for worklistapp
to the SAML service provider site's SAML2IdentityAsserter
configuration as follows.
In the Oracle WebLogic Server Administration Console, select Security Realms.
Click the realms for the service providers.
Select the Providers tab, and then the Authentication subtab.
From the provider list, select the provider with the description SAML 2.0 Identity Assertion Provider.
If you do not see the SAML identity assertion provider configuration, follow the instructions in Administering Security for Oracle WebLogic Server.
Select the Management tab.
Under the Management tab, you see a list of identity provider partners. These are hosts that have been configured as the SAML identity provider partners for this SAML identity service provider site. Remember that this configuration step is performed on the identity service provider site on which Oracle BPM Worklist is hosted.
Select the identity provider site where you want the user to perform the initial login.
Scroll down the page until you see the field Redirect URIs.
Add /integration/worklistapp/*
to the list.
After performing this step, you can log in to Oracle BPM Worklist at the SAML identity provider site though the regular URL of/integration/worklistapp
. If necessary, you can then navigate to the URL /integration/worklistapp/ssologin
at the SAML service provider site, where you gain access to Oracle BPM Worklist and are automatically authenticated.
For more information about SAML2IdentityAsserter
and configuring SSO with web browsers and HTTP clients, see Administering Security for Oracle WebLogic Server.
To be automatically authenticated when accessing a second Oracle BPM Workspace from a first Oracle BPM Workspace in SAML SSO environments, you must perform the following steps. Otherwise, you are prompted to log in again when you access the second Oracle BPM Workspace. In these environments, the first Oracle BPM Workspace is configured as the SAML identity provider and the second Oracle BPM Workspace that you access is configured as the SAML service provider.
To automatically authenticate Oracle BPM Workspace users in SAML SSO environments:
Add /bpm/workspace/*
as the redirect URL for workspace
to the SAML service provider site's SAML2IdentityAsserter
configuration as follows.
In the Oracle WebLogic Server Administration Console, select Security Realms.
Click the realms for the service providers.
Select the Providers tab, and then the Authentication subtab.
From the provider list, select the provider with the description SAML 2.0 Identity Assertion Provider.
If you do not see the SAML identity assertion provider configuration, follow the instructions in Administering Security for Oracle WebLogic Server.
Select the Management tab.
Under the Management tab, you see a list of identity provider partners. These are hosts that have been configured as the SAML identity provider partners for this SAML identity service provider site. Remember that this configuration step is performed on the identity service provider site on which Oracle BPM Workspace is hosted.
Select the identity provider site where you want the user to perform the initial login.
Scroll down the page until you see the field Redirect URIs.
Add /bpm/workspace/*
to the list.
After performing this step, you can log in to Oracle BPM Workspace at the SAML identity provider site though the regular URL of/bpm/workspace
. If necessary, you can then navigate to the URL /bpm/workspace/ssologin
at the SAML service provider site, where you gain access to Oracle BPM Workspace and are automatically authenticated.
For more information about SAML2IdentityAsserter
and configuring SSO with web browsers and HTTP clients, see Administering Security for Oracle WebLogic Server.
To be automatically authenticated when accessing a second Oracle Business Process Composer from a first Oracle Business Process Composer in SAML SSO environments, you must perform the following steps. Otherwise, you are prompted to log in again when you access the second Oracle Business Process Composer. In these environments, the first Oracle Business Process Composer is configured as the SAML identity provider and the second Oracle Business Process Composer that you access is configured as the SAML service provider.
To automatically authenticate Oracle Business Process Composer users in SAML SSO environments:
Add /bpm/composer/*
as the redirect URL for composer
to the SAML service provider site's SAML2IdentityAsserter
configuration as follows.
In the Oracle WebLogic Server Administration Console, select Security Realms.
Click the realms for the service providers.
Select the Providers tab, and then the Authentication subtab.
From the provider list, select the provider with the description SAML 2.0 Identity Assertion Provider.
If you do not see the SAML identity assertion provider configuration, follow the instructions in Administering Security for Oracle WebLogic Server.
Select the Management tab.
Under the Management tab, you see a list of identity provider partners. These are hosts that have been configured as the SAML identity provider partners for this SAML identity service provider site. Remember that this configuration step is performed on the identity service provider site on which Oracle Business Process Composer is hosted.
Select the identity provider site where you want the user to perform the initial login.
Scroll down the page until you see the field Redirect URIs.
Add /bpm/composer/*
to the list.
After performing this step, you can log in to Oracle Business Process Composer at the SAML identity provider site though the regular URL of/bpm/composer
. If necessary, you can then navigate to the URL /bpm/composer/ssologin
at the SAML service provider site, where you gain access to Oracle Business Process Composer and are automatically authenticated.
For more information about SAML2IdentityAsserter
and configuring SSO with web browsers and HTTP clients, see Administering Security for Oracle WebLogic Server.
For Windows native authentication through Kerberos to work with Oracle BPM Worklist, you must use the /integration/worklistapp/ssologin
protected URL. For example, after configuring Windows native authentication, you access Oracle BPM Worklist as follows:
http://host_name.domain_name:8001/integration/worklistapp/ssologin
For information on configuring SSO with Microsoft clients, see Administering Security for Oracle WebLogic Server.
For Windows native authentication through Kerberos to work with Oracle Business Process Composer, you must use the bpm/composer/ssologin
protected URL. For example, after configuring Windows native authentication, you access Process Composer as follows:
http://host_name.domain_name:8001/bpm/composer/ssologin
For information on configuring SSO with Microsoft clients, see Administering Security for Oracle WebLogic Server.
The authentication provider that you want to use should appear first in the list of authentication providers. This section describes how to set the first authentication provider.
Oracle BPM Worklist and workflow services use Java Platform Security (JPS) and the User and Role API. For this reason, the Oracle Internet Directory authenticator must be the first provider listed when workflow is used with Oracle Internet Directory. If Oracle Internet Directory is not listed first (for example, it is listed below DefaultAuthenticator
), login authentication fails.
For information about changing the order of authentication providers, see Administering Security for Oracle WebLogic Server.
Logging in to web-based applications may fail when using Oracle Internet Directory authentication. This is caused when the Oracle WebLogic Server configuration is set to use the Oracle Internet Directory authentication before default authentication.
This may produce the following error:
"@ User "weblogic" is not found in configuration "jazn.com" Check if the user exists in the repository specified by the configurations. Check the error stack and fix the cause of the error. Contact oracle support if error is not fixable."
The order of the security providers should be:
Default authentication
Oracle Internet Directory/LDAP authentication
The Adjudication provider determines what to do if multiple Authorization providers are configured in a security realm.
For information about the Adjudication provider and enabling multiple authentication providers, see "Configuring the WebLogic Adjudication Provider" in Administering Security for Oracle WebLogic Server.
When attempting to invoke a web service that requests NT LAN Manager (NTLM) authentication, you must set the following properties in the composite.xml
file:
oracle.webservices.auth.username
oracle.webservices.auth.password
oracle.webservices.preemptiveBasicAuth
You must set oracle.webservices.preemptiveBasicAuth
to false
.
The following example provides the details:
<reference name="Service1" ui:wsdlLocation="test1.wsdl"> <interface.wsdl interface="http://tempuri.org/#wsdl.interface(IService1)"/> <binding.ws port="http://tempuri.org/#wsdl.endpoint(Service1/BasicHttpBinding_IService1)" location="test1.wsdl" soapVersion="1.1"> <property name="weblogic.wsee.wsat.transaction.flowOption" type="xs:string" many="false">WSDLDriven</property> <property name="oracle.webservices.auth.username" type="xs:string" many="false">test</property> <property name="oracle.webservices.auth.password" type="xs:string" many="false">password</property> <property name="oracle.webservices.preemptiveBasicAuth" type="xs:string" many="false">false</property> </binding.ws> </reference>
Not setting these properties results in the following error when the BPEL process attempts to invoke the web service.
setting preemptive basic auth" and "invoke failed...Bad response: 401 Unauthorized
This section describes how to configure secure socket layer (SSL) in Oracle SOA Suite and Oracle Business Process Management environments.
If the SOA/BPM server is configured with an HTTPS port, ensure that your SSL certificate adheres to the following standards:
The certificate that the server presents to SSL clients (the browser or other internal clients such as the notification senders) is a trusted certificate by its own trust store (the CA store).
If the certificate for the server is self-signed, ensure that you add it to the trust store.
Not doing so can cause problems when task notifications are sent. For example, you can receive the following task notification error message in the server out log (soa_server_name.out).
<Sep 13, 2011 12:59:41 AM PDT> <Error> <oracle.soa.services.workflow.common> <BEA-000000> <<.> ORABPEL-0 at oracle.bpel.services.workflow.task.notification. TaskNotifications.getEmailPaylOad (TaskNotifications.java:1354) at oracle.bpel.services.workflow.task.notification. TaskNotifications.getEmailNotificationContent (TaskNotifications.java:987) at weblogic.jms.client.JMSSession$UseForRunnable.run (JMSSession.java:5170) at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerI mpl.java:528) at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209) at weblogic.work.ExecuteThread.run(ExecuteThread.java:178) Caused By: javax.net.ssl.SSLKeyException: [Security:090477]Certificate chain received from myhost.us.example.com - 10.232.152.78 was not trusted causing SSL handshake failure. at com.certicom.tls.interfaceimpl.TLSConnectionImpl. fireException(UnknownSource) at com.certicom.tls.interfaceimpl.TLSConnectionImpl. fireAlertSent(UnknownSource) at com.certicom.tls.record.handshake.HandshakeHandler. fireAlert(Unknown Source). ficationContent(TaskNotifications.java:987) at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5170) at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerI mpl.java:528) at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209) at weblogic.work.ExecuteThread.run(ExecuteThread.java:178) Caused By: javax.net.ssl.SSLKeyException: [Security:090477]Certificate chain received from myhost.us.example.com - 10.232.152.78 was not trusted causing SSL handshake failure. at com.certicom.tls.interfaceimpl.TLSConnectionImpl. fireException(UnknownSource) at com.certicom.tls.interfaceimpl.TLSConnectionImpl. fireAlertSent(UnknownSource) at com.certicom.tls.record.handshake.HandshakeHandler. fireAlert(Unknown Source
For more information about concepts and configuration details, see Administering Security for Oracle WebLogic Server.
As a best practice, Oracle recommends that you configure either all managed servers or no managed servers with SSL (SOA, BAM, and so on). Configuring some managed servers with SSL, while not configuring others, may lead to undesirable results in Oracle BPM Worklist and Oracle Web Services Manager (OWSM). For example, if there is an SSL-configured, managed server (bam_server), servers not configured with SSL are not used by OWSM. In cases in which an SSL-configured server is down, it causes OWSM to be in a down state, which in turn causes Oracle BPM Worklist to be in a down state. For more information, see "Unable to Connect to the Policy Manager" in the Securing Web Services and Managing Policies with Oracle Web Services Manager.
Switching from non-SSL to SSL configurations with Oracle BPM Worklist requires the Frontend Host and Frontend HTTPS Port fields to be set in the Oracle WebLogic Server Administration Console. Not doing so will result in errors when attempting to create to-do tasks.
To switch from non-SSL to SSL configurations with Oracle BPM Worklist:
Oracle SOA Suite uses both Oracle WebLogic Server and Oracle Secure Socket Layer (SSL) stacks for two-way SSL configurations.
For the inbound web service bindings, Oracle SOA Suite uses the Oracle WebLogic Server infrastructure and, therefore, the Oracle WebLogic Server libraries for SSL.
For the outbound web service bindings, Oracle SOA Suite uses JRF HttpClient and, therefore, the Oracle JDK libraries for SSL.
Due to this difference, start Oracle WebLogic Server with the following JVM option.
To configure SOA composite applications for two-way SSL communication:
In addition, perform the following steps to enable two-way SSL for a SOA composite application to invoke another SOA composite application or another non-SOA application.
Note:
Both the server and client are assumed to have been configured for two-way SSL.
On the client side, provide the keystore location.
From the SOA Infrastructure menu, select SOA Administration > Common Properties.
At the bottom of the page, click More SOA Infra Advanced Configuration Properties.
Click KeystoreLocation.
In the Value column, enter the keystore location.
Click Apply.
Click Return.
On the client side, provide the keystore location in DOMAIN_HOME
\config\soa-infra\configuration\soa-infra-config.xml
.
<keystoreLocation>absolute_path_to_the_keystore_location_and_the_file_name
</keystoreLocation>
During design time in Oracle JDeveloper, update the reference section in the composite.xml
file with the oracle.soa.two.way.ssl.enabled
property.
<reference name="Service1"
ui:wsdlLocation=". . .">
<interface.wsdl interface=". . ."/>
<binding.ws port=". . .">
<property name="oracle.soa.two.way.ssl.enabled">true</property>
</binding.ws>
</reference>
In Oracle Enterprise Manager Fusion Middleware Control, select WebLogic Domain > domain_name.
Right-click domain_name and select Security > Credentials.
Click Create Map.
In the Map Name field, enter a name (for example, SOA
), and click OK.
Click Create Key.
Enter the following details.
Field | Description |
---|---|
Select Map |
Select the map created in Step 7 (for this example, SOA). |
Key |
Enter the key name ( |
Type |
Select Password. |
User Name |
Enter the keystore user name ( |
Password |
Enter the password that you created for the keystore. |
Note:
When you set up SSL in Oracle WebLogic Server, a key alias is required. You must enter mykey
as the alias value. This value is required.
Set the keystore location in Oracle Enterprise Manager Fusion Middleware Control. See Step 1 for instructions.
Modify composite.xml
to use https
and sslport
to invoke a SOA composite application. For example, change the syntax shown in bold:
<?xml version="1.0" encoding="UTF-8" ?> <!-- Generated by Oracle SOA Modeler version 1.0 at [4/1/09 11:01 PM]. --> <composite name="InvokeEchoBPELSync" revision="1.0" label="2009-04-01_23-01-53_994" mode="active" state="on" xmlns="http://xmlns.oracle.com/sca/1.0" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:orawsp="http://schemas.oracle.com/ws/2006/01/policy" xmlns:ui="http://xmlns.oracle.com/soa/designer/"> <import namespace="http://xmlns.oracle.com/CustomApps/InvokeEchoBPELSync/BPELProcess1" location="BPELProcess1.wsdl" importType="wsdl"/> <import namespace="http://xmlns.oracle.com/CustomApps/EchoBPELSync/ BPELProcess1"location="http://hostname:port/soa-infra/services/default/EchoBPEL Sync/BPELProcess1.wsdl" importType="wsdl"/>
to use https
and sslport
:
location="https://hostname:sslport/soa-infra/services/default/EchoBPELSync /BPELProcess1.wsdl"
When invoking a web service as an external reference from a SOA composite application in one-way SSL environments, ensure that the certificate name (CN) and the hostname of the server exactly match. This ensures a correct SSL handshake.
For example, if a web service is named adfbc
and the certificate has a server name of myhost05
, the following syntax results in an SSL handshake exception.
<import namespace="/adfbc1/common/" location="https://myhost05.us.example.com:8002/CustomApps-adfbc1-context-root/Ap pModuleService?WSDL" importType="wsdl"/> <import namespace="/adfbc1/common/" location="Service1.wsdl" importType="wsdl"/>
If you switch the order of import
, the SSL handshake passes.
<import namespace="/adfbc1/common/" location="Service1.wsdl" importType="wsdl"/> <import namespace="/adfbc1/common/" location="https://myhost05.us.example.com:8002/CustomApps-adfbc1-context-root/Ap pModuleService?WSDL" importType="wsdl"/>
Note the following restrictions around this issue:
There are no options for ignoring hostname verification in Oracle JDeveloper as exist with the Oracle WebLogic Server Administration Console. This is because the SSL kit used by Oracle JDeveloper is different. Only the trust store can be configured from the command line. All other certificate arguments are not passed.
In the WSDL file, https://
hostname
must match with that in the certificate, as described above. You cannot perform the same procedures as you can with a browser. For example, if the hostname is myhost05.us.example.com
in the certificate's CN, then you can use myhost05
, myhost05.us.example.com
, or the IP address from a browser. In Oracle JDeveloper, always use the same name as in the certificate (that is, myhost05.us.example.com
).
Follow these steps to configure SSL communication between Oracle SOA Suite and Oracle HTTP Server.
To configure Oracle HTTP server for SSL communication:
The Test Web Service page in an Oracle WebCache and Oracle HTTP Server environment may require communication back through Oracle WebCache. Therefore, SSL must be configured between the business flow instance and Oracle WebCache (that is, export the user certificate from the Oracle WebCache wallet and import it as a trusted certificate in the Oracle WebLogic Server trust store).
To invoke a SOA composite application from another composite over HTTPS when using a custom trust store created with a tool such as keytool
or orapki
, perform the following actions in Oracle JDeveloper.
To use a custom trust store for one-way SSL during design time:
Assume you create the following environment:
Asynchronous BPEL process A invokes asynchronous BPEL process B
Asynchronous BPEL process A is deployed to a one-way SSL enabled, managed server
All WSDL references and bindings use plain HTTP
At runtime, the WSDL is found over HTTPS, and the callback message from asynchronous BPEL process B fails.
To resolve this issue, the callbackServerURL
property must be passed at the reference binding level in the composite.xml
file. This explicitly indicates the value of the callback URL for the given reference invocation. The callback is made over HTTP instead of the default HTTPS. If the client composite is running in an SSL-managed server, then the callback defaults to SSL.
<binding.ws port="http://xmlns.oracle.com/Async/AsyncSecondBPELMTOM/BPELProcess1#wsdl.
endp oint(bpelprocess1_client_ep/BPELProcess1_pt)"
location="http://localhost:8000/soa-infra/services/default/AsyncSecondBPELMTOM/
bpelprocess1_client_ep?WSDL">
<wsp:PolicyReference URI="oracle/wss_username_token_client_policy"
orawsp:category="security" orawsp:status="enabled"/>
<wsp:PolicyReference URI="oracle/wsaddr_policy" orawsp:category="addressing"
orawsp:status="enabled"/>
<property name="callbackServerURL">http://localhost:8000/</property>
</binding.ws>