20 Oracle Application Server Integration B2B Security

Classes of Users and Their Privileges

A single user named admin is automatically created during OracleAS Integration B2B installation. The password for admin is the same one you specified for the Oracle Application Server administrator named ias_admin when prompted during the J2EE and Web Cache and OracleAS Integration B2B installations.

The admin user consists of a single default user role named Administrator. The Administrator role consists of the use cases (privileges) that enable the admin user to use the entire functionality of the OracleAS Integration B2B user interface tool to design, deploy, monitor, and manage integrations. A Reports role is also available for users (such as business analysts) that require access to only the Reports tab of the OracleAS Integration B2B user interface tool. The admin user can create additional users to which to assign the Administrator role.

You can also administer portions of OracleAS Integration B2B from the Oracle Enterprise Manager 10g Application Server Control Console. Log in with the ias_admin username. Use the same password for ias_admin that you specified when prompted during the J2EE and Web Cache and OracleAS Integration B2B installations.

See the following for more information:

• "Creating a Trading Partner Person" to create additional users of the OracleAS Integration B2B user interface tool

• "Assigning a User Role to a Host Trading Partner Person" to assign the Administrator or Reports role to a user

• "Viewing a Trading Partner Person and Updating the Person Password" to update the admin user password

• "Updating a Host or Remote Trading Partner" to update the name

• Chapter 18, "System Management with Oracle Enterprise Manager 10g" to administer OracleAS Integration B2B from the Oracle Enterprise Manager 10g Application Server Control Console

Resources Protected

The following security is provided for protecting resources:

• The partner data that you design with the OracleAS Integration B2B user interface tool is protected by both the admin username and password and by the security provided by the Oracle database used for the Oracle Application Server Metadata Repository.

• Network messaging can be secured and encrypted using Oracle Advanced Security. Network messaging can also be secured by using secure HTTP with the OracleAS Integration B2B user interface tool.

• Transport protocols that enable communication between applications and OracleAS Integration B2B use their own security (such as HTTP, FTP, and SMTP) to restrict access to data.

• The messages that trading partners send and receive during integrations between enterprises are protected by the following levels of security:

  • Digital envelopes and certificates

  • Digital signatures for host and remote trading partners

  • Secure HTTP (using secure socket layer (SSL))

  • Encrypted wallet password for a host trading partner

See "OracleAS Integration B2B Security Configuration" for an overview of security configuration for integrations between enterprises.

Authorization and Access Enforcement

When you attempt to access the OracleAS Integration B2B user interface tool, you are prompted for a username and password. Without knowledge of this connection information, you cannot access the user interface tool to design, deploy, and manage integrations between enterprises.

Use of Oracle Application Server Security Services

Oracle Application Server provides a series of security services. OracleAS Integration B2B enables you to use SSL. You can use SSL for securing connections between host and remote trading partners. SSL uses a public key infrastructure to provide authentication and data integrity.

Secure HTTP can also be used to secure the OracleAS Integration B2B user interface tool.

See Oracle Application Server Security Guide for a description of Oracle Application Server security services.

Use of Oracle Identity Management Infrastructure

This release of OracleAS Integration B2B does not require use of Oracle Identity Management infrastructure features; Oracle Identity Management is optionally selectable for use during OracleAS Integration B2B installation and is only used for OracleAS Integration B2B schema password storage.

OracleAS Integration B2B Security Framework Configuration Issues

The OracleAS Integration B2B schema is protected by a password created during Oracle Application Server Infrastructure installation. These schemas are stored in the metadata repository of Oracle Application Server Infrastructure to which you configure access during OracleAS Integration B2B installation. In addition, the partner data you design, deploy, and manage with the OracleAS Integration B2B user interface tool is stored in this same metadata repository of Oracle Application Server Infrastructure.

See the following for more information:

• Oracle Application Server Security Guide for Oracle Application Server Infrastructure and Oracle Application Server security details, including how to configure the Oracle HTTP Server with secure HTTP

• Oracle Application Server Containers for J2EE Security Guide

Identity Management Configuration Issues Specific to OracleAS Integration B2B

This initial release of OracleAS Integration B2B does not use the identity management infrastructure. Therefore, there are no identity management configuration issues and options.

OracleAS Integration B2B Installation

This section describes OracleAS Integration B2B security installation issues.

OracleAS Integration B2B Security Configuration

You configure security with the OracleAS Integration B2B user interface tool after installation. OracleAS Integration B2B provides the following levels of security:

• Digital Envelopes and Certificates for Host and Remote Trading Partners

• Digital Signatures for Host and Remote Trading Partners

• Secure HTTP and Client Authentication

• Encrypted Wallet Passwords for Host Trading Partners

See "Creating a Trading Partner Agreement" to create a trading partner agreement to which to assign a trading partner with its delivery channel characteristics.

Host Trading Partner Password Encryption in High Availability Environments

OracleAS Integration B2B provides a feature that automatically encrypts the host trading partner's OracleAS Integration B2B passwords through use of an obfuscated, encryption key created during installation. If you want to change this key value, do so during OracleAS Integration B2B downtime, as all passwords within the OracleAS Integration B2B schema are re-encrypted. A new encryption key is then created.

If OracleAS Integration B2B is part of a high availability or disaster recovery configuration and you want to change the encryption key, you must perform the following procedures:

1. Follow the instructions in "Managing and Monitoring a Middle-Tier Instance from Oracle Enterprise Manager 10g Application Server Control Console" to log in to the Oracle Enterprise Manager 10g Application Server Control Console and access the primary OracleAS Integration B2B instance.

2. Shut down the B2B server and Oracle Application Server Containers for J2EE (OC4J) instance subcomponents on the primary system on which OracleAS Integration B2B is installed.

3. Go to the Security Key parameter on the Server Properties page.

4. Make the following changes:

   1. Change the encryption key in the Security Key field.

   2. Check the Re-encrypt Security Key for B2B Repository box.

      This action re-encrypts the OracleAS Integration B2B schema password.

5. Click Apply.

6. Go to the secondary (or backup) system of which OracleAS Integration B2B is a part.

7. Repeat Steps 2 and 3 on the secondary system.

8. Enter the same encryption key in the Security Key field as you did in Step 3a. However, do not check the Re-encrypt Security Key for B2B Repository box.

9. Repeat Steps 6 through 8 for additional secondary systems.

10. Restart the primary and secondary systems.

Configuration Issues and Options to Use for Oracle Application Server Security Framework

You can enable encryption between OracleAS Integration B2B and the Oracle Application Server Metadata Repository by setting several Oracle Net configuration parameters. For example, you can encrypt JDBC with the following sqlnet.ora parameters:

sqlnet.encryption_server=accepted
sqlnet.encryption_client=requested
sqlnet.encryption_types_server=(RC4_40)
sqlnet.encryption_types_client=(RC4_40)
sqlnet.crypto_seed ="-kdje83kkep39487dvmlqEPTbxxe70273"

http://www.oracle.com/technology

Oracle HTTP Server Transport Servlet and OracleAS Integration B2B

OracleAS Integration B2B is integrated with the transport servlet of the Oracle HTTP Server to provide security for incoming messages of trading partners.

Messages sent from remote trading partners must first pass through the transport servlet of the Oracle HTTP Server that is automatically deployed after installation. The transport server receives and passes messages on to a remote method invocation (RMI) port and instance name to which the B2B server component of OracleAS Integration B2B listens. RMI functionality enables the different Java processes of the Oracle HTTP Server and the B2B server to interface. RMI also provides for scalability: you can configure one RMI to communicate with multiple B2B servers. The messages are then passed on to OracleAS Integration B2B.

Figure 20-1 shows Oracle HTTP Server and OracleAS Integration B2B configuration.

Figure 20-1 Oracle HTTP Server and OracleAS Integration B2B

Description of "Figure 20-1 Oracle HTTP Server and OracleAS Integration B2B"

The RMI port number and instance name to which the OracleAS Integration B2B listens are automatically configured with the same values in both the transport servlet's web.xml file and in the OracleAS Integration B2B server properties settings (accessible from the Oracle Enterprise Manager 10g Application Server Control Console). These values must be the same. If you change these values in one location, you must also change them to the same values in the other location.

This procedure is followed only for incoming messages from remote trading partners.

For security reasons, Oracle recommends that you install and configure an additional Oracle HTTP Server outside your corporate network to receive messages from remote trading partners and pass them onto the Oracle HTTP Server and OracleAS Integration B2B instances inside your corporate network. This additional Oracle HTTP Server hides the actual location of the host trading partner from all outside parties.