6 Security in Oracle Ultra Search

About Oracle Ultra Search Security

This section describes the Oracle Ultra Search security model. It contains the following sections:

• Oracle Ultra Search Security Model

• Oracle Ultra Search with Secure Socket Layer and HTTPS

• Classes of Users and Their Privileges

• Resources Protected by Oracle Ultra Search

• Authorization and Access Enforcement

• How Oracle Ultra Search Leverages Security Services

• How Oracle Ultra Search Leverages the Oracle Identity Management Infrastructure

• Oracle Ultra Search Extensibility and Security

Configuring a Security Framework for Oracle Ultra Search

This section describes special security configuration steps within Oracle Ultra Search.

Enabling Secure Search

Oracle Ultra Search supports secure searches, which return only documents satisfying the search criteria that the search user is allowed to view. For secure searches, each indexed document should be protected by an access control list (ACL). During searches, the ACL is evaluated. If the user performing the search has permission to read the protected document, then the document is returned by the query API. Otherwise, it is not returned.

This section describes how to enable secure search.

Step 1: Check the database version requirements and configure Oracle Identity Management.

Before you can set up a secure Oracle Ultra Search installation, you must do the following:

• Install or upgrade the Oracle database to 9.2.0.4 or higher. The middle tier and IM (identity management) version should be 9.0.4 or higher. If you have a 9.2.0.4 database, you can use RepCA to convert a 9.2.0.4 database to an Oracle Application Server 9.0.4 metadata repository.

• Install and configure the Oracle Internet Directory

  The middle tier and IM (identity management) version should be 9.0.4 or higher.

• Register the database to Oracle Internet Directory.

  You can use repCA to register the database to Oracle Internet Directory. After registration, you need to perform these manual steps:

  • Add the distinguished name of the database to the database server parameter file, as an RDBMS_SERVER_DN initialization parameter value.

  • Restart the database, so that the new initialization parameter takes effect.

• Configure the Oracle-Oracle Internet Directory SSL link. To establish a secure connection between database and Oracle Internet Directory, follow the instructions in the following books:

  • Configuring Oracle Internet Directory for SSL: "Secure Sockets Layer (SSL) and the Directory," chapter in the Oracle release 9.2 of the Oracle Internet Directory Administrator's Guide

  • Configuring the database for SSL: Chapter 15, "Managing Enterprise User Security" (Part II, Task 1 - Task 3), in the Oracle Database release 9.2 of the Oracle Advanced Security Administrator's Guide

Secure search functionality requires that the Oracle Ultra Search database is Oracle version 9.2.0.4 or higher and that the Oracle Ultra Search database is linked to a compatible instance of Oracle Internet Directory. This is necessary because Oracle Ultra Search utilizes XML DB functionality, which requires a certain version of Oracle. Oracle XML DB, in turn, requires a live link to Oracle Internet Directory, through which it retrieves all LDAP principal information. The connection between Oracle and Oracle Internet Directory must be running at all times for secure search to work. To set up this link, configure the Oracle Database to use Oracle Identity Management.

Step 2: Restart the Oracle listener.

In the previous step, you configured the Oracle Database to use Identity Management. That process involved configuring ORACLE_HOME for directory usage. You must make sure to restart the Oracle listener to inherit the changes made to ORACLE_HOME. Restart the listener, if you have not already done so.

Step 3: Install or upgrade Oracle Ultra Search, if necessary.

After you have configured the Oracle Ultra Search database to work with Oracle Internet Directory, you can install or upgrade the Oracle Ultra Search backend into the Oracle Server, if you have not already done so.

Step 4: Create the /sys/apps/ultrasearch folder.

Immediately after installation or upgrade, you must run a SQL script to create the /sys/apps/ultrasearch folder in the XML DB repository. This folder stores all Oracle Ultra Search ACLs in XML DB.

To create the /sys/apps/ultrasearch folder, do the following:

1. cd to $ORACLE_HOME/ultrasearch/admin

2. Login to the Oracle Ultra Search database using SQL*Plus as user WKSYS

3. Invoke the SQL script: @wk0prepxdb.sql

Upon termination, the wk0prepxdb.sql script lists all Oracle Ultra Search-related XML DB resources by running the following SQL:

SELECT any_path FROM resource_view WHERE any_path LIKE '%ultrasearch%';

Running that SQL statement must show two rows:

/sys/apps/ultrasearch
/sys/apps/ultrasearch_acl.xml

If you do not see this confirmation, then this step has failed, and you cannot proceed. Recheck that all previous steps were performed correctly.

Step 5: Turn on secure search functionality in Oracle Ultra Search.

Because there is currently no way to programatically verify a proper Oracle-Oracle Internet Directory installation, the secure search functionality in Oracle Ultra Search is turned off by default. You must explicitly turn on this feature after completing all previous steps.

Step 6: Turn On Secure Search in the Query Application.

To turn on secure search functionality in Oracle Ultra Search:

1. Login to the Oracle Ultra Search database using SQL*Plus as user WKSYS

2. Invoke the following PL/SQL API: exec WK_ADM.SET_SECURE_MODE(1)

The argument (1) indicates that you are turning on secure search.

After you have turned on secure search functionality, you can create Oracle Ultra Search instances that are secure search-enabled.

Oracle Ultra Search supports secure searches, which return only documents satisfying the search criteria that the search user is allowed to view. To turn on secure search in the query application, follow these steps:

1. Deploy Oracle Ultra Search query (ultrasearch_query.ear).

2. Edit the OC4J jazn.xml file to connect to Oracle Internet Directory. For example:

   <jazn provider="LDAP" default-realm="us" location="ldap://localhost:3060">
        <property name="ldap.user" value="orcladmin"/> 
        <property name="ldap.password" value="!welcome"/> 
        </jazn>
   
   

3. Restart OC4J.

4. Edit applications/ultrasearch_query/META-INF/orion-application.xml to turn on JAZN LDAP.

5. Edit applications/ultrasearch_query/query/WEB-INF/web.xml to enable login functionality in usearch.jsp. For example:

   <init-param> 
   <param-name>login enabled</param-name> 
   <param-value>true</param-value> 
   </init-param> 
   
   

6. Enable mod_osso in Apache.

7. Access http://hostname:port/ultrasearch/query/usearch.jsp to see the login function, and test secure search.