18 Oracle Enterprise Scheduling Service Security

18.1.1 Oracle Enterprise Scheduling Service Metadata Access Control

At design time the Metadata creator needs to decide which job functions can access which Metadata objects. This is expressed by associating each Metadata object with one or more roles and specifying one or more actions for each role. Figure 18-1 shows the metadata security summary.

Figure 18-1 Design Time Metadata Security for Oracle Enterprise Scheduling Service

18.1.2 Oracle Enterprise Scheduling Service Job Execution Security

During job submission, the user under whose permissions the job request is submitted is called the submitting user. At request execution time all user Java code including pre-processing, post-processing, Java jobs, and substitution, is run as the submitting user, retaining all roles and credentials.

If the job metadata specifies SYS_RUNAS_APPLICAITONID, however, the job runs under the elevated privileges of an application ID. For more information, see Section 18.5, "Elevating Privileges for Oracle Enterprise Scheduling Service Jobs."

18.2.1 How to Enable Application Security with Oracle ADF Security Wizard

These steps describe a minimal, validated security setup for an application using Oracle Enterprise Scheduling Service.

Follow these steps to create a working jps-config.xml and a partially-populated jazn-data.xml. Use these steps to configure servlets to work with JPS.

To enable security using the ADF Security wizard:

1. In Oracle JDeveloper, with an application open, from the Application menu select Secure.

2. From the dropdown list, select Configure ADF Security. The Configure ADF Security wizard displays.

3. In the Enable ADF Security page, select either ADF Authentication and Authorization or ADF Authentication and click Next.

4. In the Select authentication type page, select either HTTP Basic Authentication or Form-Based Authentication and click Next.

5. In the Enable automatic policy grants page, select the appropriate options from the Enable Automatic Grant area, and click Next.

6. In the Specify authenticated welcome page, select options as needed and click Next.

7. In the Summary page verify the options and click Finish.

8. In the Security Infrastructure Created dialog, click OK.

Next, to enable security and to ensure that the jazn-data.xml is included in the application deployment, perform the following steps after assembling the EAR file for the application. For more information, see Section 5.6.3, "How to Assemble the EAR File for Oracle Enterprise Scheduling Service Sample Application."

Ensure the security related files are included with EAR file:

1. In Oracle JDeveloper, select Application > Application Properties.

2. In the Application Properties page, in the Navigator select Deployment.

3. In the Deployment Profiles area, select the EAR file Deployment descriptor. For example, for the sample application this is shown in Section 5.6.3, "How to Assemble the EAR File for Oracle Enterprise Scheduling Service Sample Application".

4. Click Edit. This displays the Edit EAR Deployment Profile Properties page.

5. In the Edit EAR Deployment Profile Properties page, expand File Groups > Application Descriptors > Filters.

6. In the Filters area, select the Files tab.

7. Ensure that the files jazn-data.xml, jps-config.xml, and weblogic-application.xml are selected under the META-INF folder.

8. Click OK to save the descriptor.

18.2.2 How to Define Principals for Security

You need to define roles before the roles are used in Oracle Enterprise Scheduling Service security. There are two types of roles that may be defined:

• Enterprise roles: These are defined directly in Oracle WebLogic Server either using the Oracle WebLogic Server console, using the WLST scripts, or using the ADF Security Wizard in Oracle JDeveloper.

• Application roles: These can be defined in the jazn-data.xml file or using the ADF Security Wizard.

To define principals security:

1. In Oracle JDeveloper, open the application and expand Application Resources in the Application Navigator.

2. In the Application Resources area, expand Descriptors and META-INF.

3. In META-INF, double-click to open jazn-data.xml.

4. In the page showing jazn-data.xml, select the Overview tab. Note, if the Overview tab is not shown, try closing jazn-data.xml and then opening it again.

5. Click Application Roles...(Manage Users and Roles).

6. On the Edit JPS Identity and Policy Store page, in the navigator expand Identity Store and jazn.com.

7. In the navigator, select Roles and click Add.... This displays the Add Role dialog.

8. In the Add Role dialog, enter a name in the Name field.

9. Click OK.

10. On the Edit JPS Identity and Policy Store page, in the navigator select Application Policy Store. If there is a sub-element with the same name as the application, go to the next step, Otherwise, do the following:

    1. Select Application Policy Store.

    2. Click New... . This displays the Create Application Policy dialog.

    3. In the Create Application Dialog the Display Name field should contain the application name.

    4. Click OK to accept the default Display Name.

11. On the Edit JPS Identity and Policy Store page, in the navigator expand Application Policy Store and expand the application name.

12. In the navigator, select Application Roles. This displays the Application Roles page.

13. In the Application Roles page, click Add... to add roles. For correct functionality at least one enterprise role must be mapped to the application role by adding enterprise roles in the Member Roles tab.

14. Click OK.

18.2.3 How to Create Grants with Oracle Enterprise Scheduling Service Metadata Pages

Access to all Metadata is controlled by grants. In order to ensure access by the right identities, you need to give the correct grants. It is expected that most Metadata grants will be done using the Oracle Enterprise Scheduling Service Oracle JDeveloper add-in.

First, create any required Oracle Enterprise Scheduling Service Metadata in an application using File > New > Business Tier > Enterprise Scheduler Metadata. For more information on creating Metadata, see Section 5.5, "Creating Metadata for Oracle Enterprise Scheduling Service Sample Application."

Using Oracle JDeveloper, you can add security grants to Oracle Enterprise Scheduling Service metadata objects.

To secure Oracle Enterprise Scheduling Service metadata objects:

1. Open the Editor page for any Oracle Enterprise Scheduling Service Metadata object.

2. In the Access Control area, click Add to add a new access control item.

3. In the Add Access Control dialog, select a Role from the dropdown list. This selects a role to grant access privileges.

4. Select one or more actions from the list, Read, Execute, Update, or Delete.

5. Click OK. This displays the updated role, as shown in Figure 18-2.

6. Repeat for as many roles as needed.

Figure 18-2 Security Roles for Oracle Enterprise Scheduling Service Metadata

18.2.4 How to Create Grants with Oracle ADF Security Wizard

There may be occasions where you want to create grants explicitly, for example when using wildcards. These steps show how to set up grants using the ADF Security wizard.

Note that these steps assume you have already created application roles.

To specify grants with the ADF Security wizard:

1. In the Application Navigator, expand the Application Resources panel.

2. Expand Descriptors and META-INF, as shown in Figure 18-3.

   Figure 18-3 Security Configuration Files Including jazn-data.xml in META-INF

   
   

3. Double-click jazn-data.xml to open the file. In the editor panel for jazn-data.xml, select the Overview tab, and click Application Roles... (Manage Users and Roles). This displays the JPS Identity & Policy Store dialog. Note, if the Overview tab is not shown, try closing jazn-data.xml and then opening it again.

4. In the JPS Identity & Policy Store dialog, in the navigator expand Application Policy Store.

5. Expand application-name, and select Application Roles.

6. Click New.

7. Enter the display name you wish for this grant, and click OK.

8. Select the Principals tab, and click Add... .

9. Enter the name of the application role which will receive the grant; this should be one of the role names created. Leave the Class field as is.

10. Click OK.

11. With the new role selected in the Principals tab, make sure the Type is role.

12. Select the Permissions tab, and click Add....

13. For the Name field, enter a full permission string or a partial string with wildcards; see Table 18-1 for examples. In the Class field, enter oracle.as.scheduler.security.MetadataPermission. Click OK.

14. With the new permission selected in the Permissions tab, enter the desired actions in the Actions Field.

15. Click OK to save the grant.

    Note:

    If necessary, use the following workaround:

    1. Right-click the jazn-data.xml file and select Open.

    2. Click the Source tab.

    3. Under <jazn-policy><grant><grantee>, remove the elements <display-name> and <type>.

18.2.5 About MetadataPermission APIs

Grants for Metadata are part of the class oracle.as.scheduler. security.MetadataPermission. The name, or target of the permission is based on the package, Metadata object type, and name of the Metadata object being protected; this identifier can be retrieved from MetdataObjectId#toPermissionString().

Table 18-2 lists the actions for the grants. The notation <Type> is a placeholder for all of the metadata object types. For example, get<Type>() refers to the methods getJobDefinition(), getJobType(), getJobSet().

If you are submitting ad-hoc requests, you can have full wildcard ("*") permission with both EXECUTE and CREATE actions. When submitting ad-hoc requests, that is, using submitRequest() without certain MetadataObjectIds, you can grant permissions with the full wildcard ("*") name using the EXECUTE and CREATE actions.

18.2.6 What Happens When You Configure Metadata Security

Each time a user application calls a MetdataService or RuntimeService method, Oracle Enterprise Scheduling Service checks the current subject for privileges on the metadata accessed by the methods. For example, submitting a request requires EXECUTE permissions on the job definition or job set metadata object associated with the submission. Methods that change metadata, for example calling updateJobDefinition(), require UPDATE permissions.

For all MetadataService methods except queries, an exception is thrown when the user tries to access a Metadata object for which the user does not have permission.

The MetadataService query methods have different behavior. When a user performs a query Oracle Enterprise Scheduling Service only returns Metadata objects that have READ permission. Thus a user who has no permissions on Metadata objects receives an empty list for all queries, but this user would not see an exception thrown due to lack of permissions.

The value of SystemProperty.USER_NAME is overwritten at submission time; the user cannot spoof an identity at submission time using SystemProperty.USER_NAME.

18.6.1 How to Configure a Single Policy Stripe in Oracle Enterprise Scheduling Service

Oracle Enterprise Scheduling Service allows specifying an applicationStripe name and mapping it to a JPS policy context ID. You can assign multiple Oracle Enterprise Scheduling Service hosting applications to a single policy context.

To configure an Oracle Enterprise Scheduling Service hosting application to a specific applicationStripe:

1. Open the ejb-jar.xml file.

2. Under the message-driven element, add an activation-config-properties element with the value applicationStripe.

3. Under the jpsinterceptor-class element, configure the JpsInterceptor.

   Make sure to match the value of applicationStripe under the <message-driven> element with the application.name value under the <interceptor> element.

   Example 18-1 shows an applicationStripe configuration for the policy context ESS_FUNCTIONAL_TEST_APP_STRIPE.

   Example 18-1 Configuring the applicationStripe and the JpsInterceptor

   <ejb-jar>
      ....
    
      <enterprise-beans>
       <message-driven>
         <ejb-name>ESSAppEndpoint</ejb-name>
         <ejb-class>oracle.as.scheduler.ejb.EssAppEndpointBean</ejb-class>
         <activation-config>
           ....
           <activation-config-property>
             <activation-config-property-name>applicationStripe</activation-config-property-name>
             <activation-config-property-value>ESS_FUNCTIONAL_TESTS_APP_
               STRIPE</activation-config-property-value>
           </activation-config-property>
         </activation-config>
       </message-driven>
       .....
    
     </enterprise-beans>
    
     <interceptors>
       <interceptor>
         <interceptor-class>oracle.security.jps.ee.ejb.JpsInterceptor</interceptor-class>
         <env-entry>
           <env-entry-name>application.name</env-entry-name>
           <env-entry-type>java.lang.String</env-entry-type>
           <env-entry-value>ESS_FUNCTIONAL_TESTS_APP_STRIPE</env-entry-value>
           <injection-target>
             <injection-target-class>oracle.security.jps.ee.ejb.JpsInterceptor
             </injection-target-class>
             <injection-target-name>application_name</injection-target-name>
           </injection-target>
         </env-entry>
       </interceptor>
     </interceptors>
   </ejb-jar>
   

4. If your application has a web module, configure the web module JpsFilter to use the same applicationStripe in the file web.xml. Example 18-2 shows a code sample.

   Example 18-2 Configuring the Web Module in web.xml

   <web-app>
     <filter>
         <filter-name>JpsFilter</filter-name>
         <filter-class>oracle.security.jps.ee.http.JpsFilter</filter-class>
         ...
         <init-param>
             <param-name>application.name</param-name>
             <param-value>ESS_FUNCTIONAL_TESTS_APP_STRIPE</param-value>
         </init-param>
     </filter>
    
   </web-app>
   

18.6.2 What Happens When You Configure a Single Policy Stripe

At design time, an application stripe manifests as:

• An <application> element under the <policystore> element in the jazn-data.xml file.

• A node under the node cn=<Weblogic.domain.name>,cn=JPSContext,cn=<root.node>, such as cn=ATGDemo,cn=base_domain,cn=JPSContext,cn=MY_Node.

18.6.3 What Happens at Runtime

At run time, an application stripe manifests as an instance of the class oracle.security.jps.service.policystore.ApplicationPolicy.