4 Oracle Identity Management

4.1.1 Dependencies on Oracle Identity Management

For some Oracle Application Server components, such as OracleAS Portal, the Oracle Identity Management infrastructure is always required. However, Oracle Identity Management is not mandatory for all Oracle Application Server components. Many Oracle Application Server components can be deployed with or without leveraging the Oracle Identity Management infrastructure. When deployed without the Oracle Identity Management infrastructure, these services would rely on their own standalone interfaces for user management and security.

4.1.2 Leveraging Third-Party Identity Management Services

OC4J applications developed by ISVs and customers need not rely on Oracle Identity Management or any other infrastructure. These applications can instead use third-party identity management services, such as Sun Java Enterprise System (formerly iPlanet) Directory or Microsoft Active Directory. Thanks to configurable OracleAS JAAS Provider LoginModules, OC4J applications can also be integrated with any other custom user management and authentication services in the customer environment.

All Oracle products that rely on centralized user management and single sign-on services, including products such as OracleAS Portal, require Oracle Identity Management infrastructure for their operation. If you have already deployed a non-Oracle Identity Management infrastructure, the Oracle products can be deployed to fully leverage your investment in such infrastructure. In such environments, Oracle product security still depends on Oracle Identity Management infrastructure, but that infrastructure is configured to fully utilize your existing infrastructure. For instance, you need not reimplement or alter your implementation of directory tree structure, practices, and policies for user management, password management, and so on. Oracle Identity Management integration services transparently adopt your existing policies without requiring any additional implementation effort.

4.2.1 Centralized User Management

Oracle Internet Directory, a key component of the Oracle Identity Management infrastructure, facilitates centralized user management for the Oracle technology environment, as well as for the rest of the enterprise. Users are defined centrally in Oracle Internet Directory; all other Oracle Identity Management and security services, as well as all applications that in turn rely on these services, share this single definition of user identity, credentials, profiles and preferences. This centralized management not only facilitates administrative convenience, it also enhances security for applications that share this infrastructure.

4.2.2 Password Management Policies

Password policies help strengthen the security of password-based authentication environments. Password policies allow an enterprise to establish rules that users must follow while setting and using passwords to authenticate themselves to the applications on the network. Oracle Identity Management password policies can be customized at deployment.

Oracle Identity Management supports complex password policies that enterprises can leverage to make the user passwords more secure. Oracle Internet Directory and the OracleAS Single Sign-On services support value-based as well as state-based password policies.

• Value-based password policies make it difficult to guess passwords. These policies enforce the password values to be arbitrarily complex, such as minimum lengths, presence of minimum number of special characters, and so on.

• State-based password policies help enforce user discipline, such as periodically resetting password values. State-based password policies also facilitate detection and prevention of malicious attempts to break into these environments. Password expiration policies and lockout policies based on maximum number of retries are examples of such state-based password policies.

The Oracle Internet Directory plug-in capability can be exploited by customers to implement custom password policies.

(UNIX) ORACLE_HOME/bin/resetiASpasswd.sh cn=orcladmin password ORACLE_HOME
(Windows) ORACLE_HOME\bin\resetiASpasswd cn=orcladmin password ORACLE_HOME

4.2.3 OracleAS Single Sign-On for Authentication

OracleAS Single Sign-On allows users to sign on to the enterprise network once instead of being prompted for sign-on credentials each time they access other Web applications. When you deploy an application with OracleAS Single Sign-On, after the first sign-on, a user's identity is validated by the OracleAS Single Sign-On only once, no matter how many different Oracle Application Server applications the user invokes during a session.

4.2.4 Secure and Transparent Sign-On To Oracle Database

Middle-tier business intelligence components must access Oracle Database schema resources on behalf of users who have signed on to the middle-tier. To do so, the components must acquire the end user's account name and password information for relevant database resources. To facilitate this acquisition, Oracle Internet Directory supports an LDAP structure called Resource Access Descriptors, as well as APIs and Oracle Delegated Administration Services interfaces to securely administer this information. This ensures that access is restricted to the end user who owns it and to the applications that need it.

4.2.5 Delegated Administration and Self-Service Interfaces

Although centralized management of user identities and other security information has its obvious benefits, the process of administration could become unscalable without the means to delegate administration to different sets of administrators for different real-world administrative functions. To support this delegation, the Oracle Delegated Administration Services component of Oracle Identity Management infrastructure defines a delegation model based on Role-Based Access Control (RBAC).

The infrastructure also supports necessary interfaces to implement this model not only for Oracle Identity Management, but also within applications that rely on Oracle Identity Management.

Oracle Delegated Administration Services consists of the following:

• Interfaces for enabling end-user self-service, such as:

  • User password updates, reset, and recovery

  • User preferences and profile management

  • Directory white page lookups

• Interfaces for enabling directory administrator self service such as:

  • Creating and managing users

  • Creating and managing groups

  • Customizing Oracle Delegated Administration Services user and group management interfaces

  • Customizing end-user self-service interface characteristics

  • Oracle Identity Management service-related administration roles

Oracle Delegated Administration Services also supports APIs that applications can use to integrate all these services in their application-specific administration tools.

4.2.6 Role-Based Access Control and Privilege Delegation

Many Oracle Application Server components, such as OracleAS Portal, support the Role-Based Access Control (RBAC) model to control access to their resources and operations. The associated application roles are implemented by using the underlying support of Oracle Internet Directory for managing groups and roles. APIs and Delegated Administration Services interfaces are leveraged by the Oracle Application Server components for managing these objects that represent their application-specific administrative roles.

4.2.7 Provisioning Integration

Provisioning Integration refers to integrating user account creation and privilege assignment tasks for all applications across the enterprise, based on Oracle Identity Management events. These activities are governed by application-specific rules, as well as by enterprise deployment policies. Oracle Identity Management infrastructure supports a feature called Provisioning Integration to facilitate both integration and automation of such provisioning related tasks.

Oracle Application Server components, such as OracleAS Portal and OracleAS Wireless, leverage this capability to be notified of events involving changes to user objects and specific group objects that have direct impact on user accounts and privileges within their environments.

To leverage this service, applications subscribe to directory events that have direct mappings to their application accounts and privileges. Provisioning Integration monitors change events in the directory and notifies applications whose registered interests match this change event.

APIs and configuration interfaces are available for integrating third-party enterprise applications with OracleAS Integration platform.

4.2.8 Public Key Infrastructure (PKI) and OracleAS Certificate Authority

Oracle Application Server Certificate Authority (OCA) exposes a simple self-service interface for OracleAS Single Sign-On users to provision their own X.509 certificates. With OCA, customers who want to deploy PKI to enable higher levels of security for their environment can do so without incurring significant overhead.

4.2.9 Integrating Third-Party Identity Management Solutions

Oracle Identity Management supports interfaces and procedures to integrate Oracle products with existing third-party identity management solutions in a customer environment. There are three categories of Identity Management integration considerations:

• Integrating Third-Party LDAP Directories and Other Directory Sources

• Integrating Third-Party Single Sign-On Services

• Integrating Third-Party Provisioning Solutions