1 Introduction to Oracle Authorization Policy Manager

1.1 Audience and Prerequisites

The intended users of Authorization Policy Manager are security administrators.

Authorization Policy Manager requires that:

• The domain policy store be LDAP-based; the only supported policy store type is Oracle Internet Directory. Before using Authorization Policy Manager, make sure that the policy store has been reassociated to an Oracle Internet Directory. For details on reassociating the domain policy store, see Oracle Fusion Middleware Application Security Guide.

• The domain identity store be LDAP-based; supported identity store types are:

  • Oracle Internet Directory

  • Oracle Virtual Directory

  • WebLogic EmbeddedLDAP

  • Sun Java System Directory Service version 6.3

  • Active Directory 2003, 2008

  • Novell eDirectory 8.8

  • OpenLDAP 2.2. For the special configuration required for this type, see Appendix A, "Using an OpenLDAP Identity Store."

  • Tivoli Directory Server

  For information about Oracle Fusion Middleware Certification and Supported Configurations, visit http://www.oracle.com/technology/software/products/ias/files/fusion_certification.html.

Applications whose policies are managed with Authorization Policy Manager are assumed to use Oracle Platform Security Services for authorization. For details about integrating an application with these services, see Oracle Fusion Middleware Application Security Guide.

1.2 What Is Authorization Policy Manager?

A security administrator can use WLST commands or Fusion Middleware Control to manage application policies. On the one hand, using WLST command requires manually running commands; on the other hand, even though Fusion Middleware Control offers a graphical user interface, it is a rather complex tool that requires that the administrator work with low-level security artifacts and know names and concepts familiar to, typically, only developers (such as permission class names or task-flow names, for example).

Authorization Policy Manager greatly simplifies the creation, configuration, and administration of application policies over those two other tools by offering:

• User-friendly names and descriptions of security artifacts; for details, see Chapter 2, "The OPSS Authorization Model."

• A way to organize application roles by business, product, or any other parameter specific to an application; for details, see Section 2.3.5, "Role Categories."

• A uniform graphic interface to search, create, browse, and edit security artifacts; for details, see Chapter 4, "Querying Security Artifacts," and Chapter 5, "Managing Security Artifacts."

• A way to specify a subset of applications that a role can manage; for details, see Chapter 6, "Delegated Administration."

1.3 The Big Picture

Figure 1-1 illustrates how a security administrator accesses Authorization Policy Manager, and how the tool communicates with the domain policy and identity stores within the context of Oracle WebLogic server.

That figure also illustrates the fact that Authorization Policy Manager can access policies (and identities) of application deployed in a different domain to that in which Authorization Policy Manager is deployed, provided that those other domains point to the same policy and identity store. Authorization Policy Manager uses OPSS management APIs to access the policy store, and IGF APIs to access the identity store.

Figure 1-1 APM Deployed in a WebLogic Domain

Authorization Policy Manager does not support the management of users and external roles; these artifacts can only be viewed with the tool. Their provision and management is typically accomplished using Oracle Identity Manager. Changes to the identity store are immediately visible in Authorization Policy Manager.